@runa-ai/runa-cli 0.5.26

package/dist/commands/env/commands/env-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-check.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiWpC,eAAO,MAAM,YAAY,SAOrB,CAAC"}

package/dist/commands/env/commands/env-encrypt.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AI HINT: dotenvx encryption command (Vercel-aligned structure)
+ *
+ * Purpose: Encrypt .env.{environment} files using dotenvx
+ * Design: 3 environments = 3 keys (development, preview, production)
+ *
+ * Structure:
+ *   .env.development  → DOTENV_PRIVATE_KEY_DEVELOPMENT
+ *   .env.preview      → DOTENV_PRIVATE_KEY_PREVIEW
+ *   .env.production   → DOTENV_PRIVATE_KEY_PRODUCTION
+ *
+ * Usage:
+ *   runa env encrypt                          # Encrypt all 3 environments
+ *   runa env encrypt -e development           # Encrypt specific environment
+ *   runa env encrypt --stdout                 # Show encrypted output
+ */
+import { Command } from 'commander';
+export declare const encryptCommand: Command;
+//# sourceMappingURL=env-encrypt.d.ts.map

package/dist/commands/env/commands/env-encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-encrypt.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8MpC,eAAO,MAAM,cAAc,SAqBvB,CAAC"}

package/dist/commands/env/commands/env-pull.d.ts

@@ -0,0 +1,49 @@
+/**
+ * AI HINT: Vercel environment pull command (Vercel-aligned structure)
+ *
+ * Purpose: Pull environment variables from Vercel to .env.{environment} files
+ * Design: Vercel = SSOT for both env vars AND encryption keys
+ *
+ * PHILOSOPHY: Environment Variable First (AI-autonomous)
+ * - Supports VERCEL_TOKEN + VERCEL_PROJECT_ID from env (no vercel link needed)
+ * - Supports --token + --project flags for explicit auth
+ * - Falls back to .vercel/project.json for interactive auth
+ *
+ * Structure (3 environments = 3 files = 3 keys):
+ *   .env.development  → DOTENV_PRIVATE_KEY_DEVELOPMENT (+ localhost values)
+ *   .env.preview      → DOTENV_PRIVATE_KEY_PREVIEW (production Supabase)
+ *   .env.production   → DOTENV_PRIVATE_KEY_PRODUCTION (production Supabase)
+ *
+ * Key insight: DOTENV_PRIVATE_KEY_* are stored in Vercel (All Environments)
+ * so they come with the pulled env vars. We extract them to .env.keys.
+ *
+ * Local Development (default behavior):
+ *   - .env.development uses localhost:54321/54322 (supabase start)
+ *   - .env.preview/.env.production use production Supabase
+ *   - This enables `pnpm dev` to use local Supabase safely
+ *
+ * Workflow with --encrypt:
+ *   1. vercel env pull → .env.{environment} (includes DOTENV_PRIVATE_KEY_*)
+ *   2. Replace .env.development values with localhost (unless --production-all)
+ *   3. Extract DOTENV_PRIVATE_KEY_* → .env.keys
+ *   4. Remove DOTENV_PRIVATE_KEY_* from .env files
+ *   5. dotenvx encrypt using .env.keys
+ *
+ * Benefits:
+ *   - AI-autonomous: VERCEL_TOKEN + VERCEL_PROJECT_ID = no interactive auth needed
+ *   - New developer: `runa env pull` = one command setup with safe local dev
+ *   - Re-pull: Same keys preserved (from Vercel)
+ *   - No local key management needed
+ *   - Local development doesn't touch production database
+ *
+ * Usage:
+ *   runa env pull                              # Pull all + localhost for development (default)
+ *   runa env pull --production-all             # Pull all with production URLs everywhere
+ *   runa env pull -e development               # Pull single environment + encrypt
+ *   runa env pull --no-encrypt                 # Pull without encryption (not recommended)
+ *   runa env pull --token xxx --project prj_xxx  # Explicit auth (AI-friendly)
+ *   VERCEL_TOKEN=xxx VERCEL_PROJECT_ID=prj_xxx runa env pull  # Env var auth (CI-friendly)
+ */
+import { Command } from 'commander';
+export declare const pullCommand: Command;
+//# sourceMappingURL=env-pull.d.ts.map

package/dist/commands/env/commands/env-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-pull.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAYH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAq5BpC,eAAO,MAAM,WAAW,SAkCpB,CAAC"}

package/dist/commands/env/commands/env-setup.d.ts

@@ -0,0 +1,51 @@
+/**
+ * AI HINT: Environment Setup Command (Production Onboarding)
+ *
+ * Purpose: Automated setup of production environment variables
+ * Design: Fetch from Vercel/Supabase APIs → Generate role passwords → Register to Vercel/GitHub
+ *
+ * 3-Role Architecture (Security):
+ * ┌─────────────────┬─────────┬──────────┬───────────────────────────────────┐
+ * │ Role            │ DDL     │ RLS      │ Use Case                          │
+ * ├─────────────────┼─────────┼──────────┼───────────────────────────────────┤
+ * │ postgres        │ ✅ Yes  │ N/A      │ Schema migrations (db sync/apply) │
+ * │ drizzle_app     │ ❌ No   │ Enforced │ User API requests, Server Comps   │
+ * │ drizzle_service │ ❌ No   │ Bypassed │ Webhooks, Background Jobs, Cron   │
+ * └─────────────────┴─────────┴──────────┴───────────────────────────────────┘
+ *
+ * Password Sources:
+ * - postgres: [POSTGRES_PW] from Supabase Dashboard
+ * - drizzle_app: [DRIZZLE_APP_PW] CLI-generated
+ * - drizzle_service: [DRIZZLE_SERVICE_PW] CLI-generated
+ *
+ * Workflow:
+ * 1. Auth check (vercel login, gh auth login, supabase login)
+ * 2. URL input (Vercel, GitHub, Supabase - 1:1:1 mapping)
+ * 3. Postgres password input (can't be fetched via API)
+ * 4. Info fetch & generate (Supabase API → keys, CLI → role passwords)
+ * 5. Display list with masked passwords & [NEW]/[OVERWRITE] indicators
+ * 6. Confirm overwrites if any exist
+ * 7. Register (Vercel env, GitHub secrets)
+ * 8. Complete with next steps
+ *
+ * Usage:
+ *   runa env setup                                  # Interactive mode
+ *   runa env setup --vercel-url <url> --github-url <url> --supabase-url <url>  # Non-interactive
+ *   runa env setup --postgres-password <pw>         # Provide password non-interactively
+ *   runa env setup --auto-approve                   # Skip overwrite confirmations
+ *
+ * Implementation: Split into modules under ./setup/
+ *   - types.ts: Type definitions and schemas
+ *   - parsers.ts: URL parsers and password generators
+ *   - auth.ts: Authentication checks
+ *   - vercel-api.ts: Vercel API integration
+ *   - supabase-api.ts: Supabase API integration
+ *   - github-api.ts: GitHub API integration
+ *   - prompts.ts: Interactive prompts
+ *   - helpers.ts: Action helper functions
+ *   - file-export.ts: File export utilities
+ *   - action.ts: Main action orchestration
+ */
+import { Command } from 'commander';
+export declare const setupCommand: Command;
+//# sourceMappingURL=env-setup.d.ts.map

package/dist/commands/env/commands/env-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,YAAY,SAkCrB,CAAC"}

package/dist/commands/env/commands/env-sync.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AI HINT: Environment data sync command
+ *
+ * Purpose: Sync data between environments with PII masking
+ * Design: Delegates to SDK functions, CLI handles UX
+ *
+ * Usage:
+ *   runa env sync --from production --to local          # Full sync with masking
+ *   runa env sync --from production --to preview        # Sync to preview DB
+ *   runa env sync --from production --to local --sample 1000  # Sample 1000 rows
+ *   runa env sync --from production --to local --tables users,orders  # Specific tables
+ */
+import { Command } from 'commander';
+/**
+ * env sync command
+ */
+export declare const syncCommand: Command;
+//# sourceMappingURL=env-sync.d.ts.map

package/dist/commands/env/commands/env-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8HpC;;GAEG;AACH,eAAO,MAAM,WAAW,SAsBpB,CAAC"}

package/dist/commands/env/commands/setup/action.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AI HINT: Main Action Orchestration
+ *
+ * Purpose: Main env setup action that orchestrates the entire flow
+ * Extracted from: env-setup.ts (lines 1591-1822)
+ *
+ * Refactored for reduced cognitive complexity:
+ * - createReadlineIfInteractive() - Centralized readline creation
+ * - handleDryRunMode() - Handle dry run early return
+ * - handleExportMode() - Handle export early return
+ */
+import type { Command } from 'commander';
+import type { EnvSetupOptions } from './types.js';
+/**
+ * Run the environment setup action
+ */
+export declare function runEnvSetupAction(options: EnvSetupOptions, setupCommand: Command): Promise<void>;
+//# sourceMappingURL=action.d.ts.map

package/dist/commands/env/commands/setup/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0BzC,OAAO,KAAK,EAEV,eAAe,EAIhB,MAAM,YAAY,CAAC;AAsGpB;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CAsLf"}

package/dist/commands/env/commands/setup/auth.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: Authentication Checks
+ *
+ * Purpose: Check authentication status for Vercel, GitHub, and Supabase CLIs
+ * Extracted from: env-setup.ts (lines 285-390)
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { AuthStatus } from './types.js';
+/**
+ * Check if Supabase CLI is logged in and get linked project if any
+ *
+ * Uses `supabase projects list` command directly instead of manually
+ * extracting and verifying the token. This is more reliable as it
+ * works regardless of how Supabase CLI stores the token internally.
+ */
+export declare function checkSupabaseCliAuth(): Promise<{
+    authenticated: boolean;
+    linkedProject?: string;
+    error?: string;
+}>;
+/**
+ * Check authentication status for all required services
+ */
+export declare function checkAuth(logger: ReturnType<typeof createCLILogger>): Promise<AuthStatus>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/env/commands/setup/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAsCD;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAyD/F"}

package/dist/commands/env/commands/setup/file-export.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AI HINT: File Export Utilities
+ *
+ * Purpose: Write environment variables to file for review
+ * Extracted from: env-setup.ts (lines 1517-1585)
+ *
+ * SECURITY NOTES:
+ * - Temporary files are written with restrictive permissions (600)
+ * - Files contain sensitive credentials and should be deleted after use
+ * - Owner-only read/write prevents other users from accessing credentials
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { EnvVariable } from './types.js';
+export declare const ENV_SETUP_TMP_FILE = ".env.setup-tmp";
+/**
+ * Write environment variables to .env.setup-tmp file for review
+ * This allows users to review and manually register the values
+ */
+export declare function writeEnvSetupFile(envVars: EnvVariable[], drizzleAppPassword: string, drizzleServicePassword: string, logger: ReturnType<typeof createCLILogger>): void;
+//# sourceMappingURL=file-export.d.ts.map

package/dist/commands/env/commands/setup/file-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-export.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/file-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAMnD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,EAAE,EACtB,kBAAkB,EAAE,MAAM,EAC1B,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,IAAI,CAqEN"}

package/dist/commands/env/commands/setup/github-api.d.ts

@@ -0,0 +1,17 @@
+/**
+ * AI HINT: GitHub API Integration
+ *
+ * Purpose: GitHub secrets operations
+ * Extracted from: env-setup.ts (lines 807-863)
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { RegistrationResult } from './types.js';
+/**
+ * Check if a GitHub secret exists
+ */
+export declare function checkGitHubSecret(name: string, repoFullName: string): Promise<boolean>;
+/**
+ * Set a GitHub secret
+ */
+export declare function setGitHubSecret(name: string, value: string, overwrite: boolean, repoFullName: string, logger: ReturnType<typeof createCLILogger>): Promise<RegistrationResult>;
+//# sourceMappingURL=github-api.d.ts.map

package/dist/commands/env/commands/setup/github-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-api.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/github-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5F;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,OAAO,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,kBAAkB,CAAC,CAkC7B"}

package/dist/commands/env/commands/setup/helpers.d.ts

@@ -0,0 +1,117 @@
+/**
+ * AI HINT: Main Action Helpers
+ *
+ * Purpose: Helper functions for env setup action flow
+ * Extracted from: env-setup.ts (lines 963-1511)
+ */
+import type * as readline from 'node:readline/promises';
+import { type createCLILogger } from '@runa-ai/runa';
+import type { AuthStatus, EnvSetupOptions, EnvVariable, RegistrationResult, SupabaseProjectInfo } from './types.js';
+/**
+ * Early link status for informational display
+ */
+export interface EarlyLinkStatus {
+    vercelLinked: boolean;
+    vercelProjectId?: string;
+    supabaseLinked: boolean;
+    supabaseProjectRef?: string;
+}
+/**
+ * Check link status early (before authentication) to provide better guidance
+ * This is informational only - doesn't block the flow
+ */
+export declare function checkEarlyLinkStatus(logger: ReturnType<typeof createCLILogger>): EarlyLinkStatus;
+/**
+ * Validate authentication for all required services
+ * Enhanced with link status context for better error messages
+ */
+export declare function validateAuthenticationWithLinkStatus(authStatus: AuthStatus, options: EnvSetupOptions, linkStatus: EarlyLinkStatus): Promise<void>;
+/**
+ * Collect URLs interactively or from options
+ */
+export declare function collectUrls(rl: readline.Interface | null, options: EnvSetupOptions, logger: ReturnType<typeof createCLILogger>): Promise<{
+    vercelUrl: string;
+    githubUrl: string;
+    supabaseUrl: string;
+}>;
+/**
+ * Parse and validate URLs
+ */
+export declare function parseAndValidateUrls(vercelUrl: string, githubUrl: string, supabaseUrl: string): {
+    vercelParsed: {
+        team: string;
+        project: string;
+    };
+    githubParsed: {
+        owner: string;
+        repo: string;
+    };
+    supabaseRef: string;
+};
+/**
+ * Build the list of environment variables to register
+ * Passwords are URL-encoded to handle special characters safely
+ *
+ * 3-Role Architecture:
+ * - drizzle_app: DML + RLS enforced (user requests)
+ * - drizzle_service: DML + RLS bypassed (webhooks, background jobs)
+ * - postgres: DDL + DML (migrations only)
+ */
+export declare function buildEnvVarList(supabaseProject: SupabaseProjectInfo, supabaseRef: string, postgresPassword: string, drizzleAppPassword: string, drizzleServicePassword: string, dotenvxKeys: {
+    development: string;
+    preview: string;
+    production: string;
+}): EnvVariable[];
+/**
+ * Mask sensitive values in display (passwords, keys)
+ */
+export declare function maskSensitiveValue(key: string, value: string): string;
+/**
+ * Display summary of environment variables to be registered
+ */
+export declare function displayEnvVarsSummary(envVars: EnvVariable[], overwrites: {
+    vercel: string[];
+    github: string[];
+}, logger: ReturnType<typeof createCLILogger>): void;
+/**
+ * Check for existing variables that would be overwritten
+ */
+export declare function checkExistingOverwrites(envVars: EnvVariable[], vercelLinkedDir: string, githubRepoFullName: string, options: EnvSetupOptions): Promise<{
+    vercelOverwrites: string[];
+    githubOverwrites: string[];
+}>;
+/**
+ * Confirm overwrites with user
+ */
+export declare function confirmOverwrites(rl: readline.Interface | null, vercelOverwrites: string[], githubOverwrites: string[], vercelProjectName: string, githubRepoFullName: string, options: EnvSetupOptions, logger: ReturnType<typeof createCLILogger>): Promise<{
+    vercelApproved: boolean;
+    githubApproved: boolean;
+}>;
+/**
+ * Register environment variables to Vercel
+ */
+export declare function registerToVercel(envVars: EnvVariable[], linkedDir: string, projectDisplayName: string, overwrites: string[], overwriteApproved: boolean, logger: ReturnType<typeof createCLILogger>): Promise<RegistrationResult[]>;
+/**
+ * Register environment variables to GitHub
+ */
+export declare function registerToGitHub(envVars: EnvVariable[], overwrites: string[], overwriteApproved: boolean, repoFullName: string, logger: ReturnType<typeof createCLILogger>): Promise<RegistrationResult[]>;
+/**
+ * Print final summary and next steps
+ *
+ * 3-Role Architecture:
+ * - drizzle_app: DML + RLS enforced (user requests)
+ * - drizzle_service: DML + RLS bypassed (webhooks, background jobs)
+ * - postgres: DDL + DML (migrations only)
+ */
+export declare function printFinalSummary(results: RegistrationResult[], _drizzleAppPassword: string, _drizzleServicePassword: string, logger: ReturnType<typeof createCLILogger>): void;
+/**
+ * Check project linking status and offer to link if not already linked
+ */
+export declare function checkAndLinkProjects(rl: readline.Interface | null, vercelParsed: {
+    team: string;
+    project: string;
+}, supabaseRef: string, options: EnvSetupOptions, logger: ReturnType<typeof createCLILogger>): Promise<{
+    vercelLinked: boolean;
+    supabaseLinked: boolean;
+}>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/commands/env/commands/setup/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAgB/D,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GAAG,eAAe,CA6BhG;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,CACxD,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAmCxE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB;IACD,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC;CACrB,CAuBA;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,eAAe,EAAE,mBAAmB,EACpC,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EACxB,kBAAkB,EAAE,MAAM,EAC1B,sBAAsB,EAAE,MAAM,EAC9B,WAAW,EAAE;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,GACA,WAAW,EAAE,CAiFf;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BrE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAClD,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,IAAI,CAsBN;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyBrE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,EAAE,MAAM,EAC1B,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC,CA2B/D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,MAAM,EAAE,EACpB,iBAAiB,EAAE,OAAO,EAC1B,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAc/B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,EAAE,MAAM,EAAE,EACpB,iBAAiB,EAAE,OAAO,EAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAe/B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,mBAAmB,EAAE,MAAM,EAC3B,uBAAuB,EAAE,MAAM,EAC/B,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,IAAI,CAsCN;AA6CD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,YAAY,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC,CAuC7D"}

package/dist/commands/env/commands/setup/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AI HINT: Setup Module Re-exports
+ *
+ * Purpose: Central export point for all setup modules
+ */
+export * from './types.js';
+export * from './parsers.js';
+export * from './auth.js';
+export * from './vercel-api.js';
+export * from './supabase-api.js';
+export * from './github-api.js';
+export * from './prompts.js';
+export * from './helpers.js';
+export * from './file-export.js';
+export * from './action.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/env/commands/setup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC"}

package/dist/commands/env/commands/setup/parsers.d.ts

@@ -0,0 +1,66 @@
+/**
+ * AI HINT: URL Parsers and Password Generators
+ *
+ * Purpose: Parse Vercel, GitHub, and Supabase URLs; generate secure passwords
+ * Extracted from: env-setup.ts (lines 156-277)
+ */
+/**
+ * Generate a cryptographically secure password for drizzle_app
+ */
+export declare function generateDrizzleAppPassword(): string;
+/**
+ * Generate a cryptographically secure password for drizzle_service
+ * Note: drizzle_service has BYPASSRLS privilege for Webhooks/Background Jobs
+ */
+export declare function generateDrizzleServicePassword(): string;
+/**
+ * Generate dotenvx private key (32 bytes hex string)
+ * Used for encrypting .env files with dotenvx
+ */
+export declare function generateDotenvxPrivateKey(): string;
+/**
+ * Parse Vercel project URL to extract project info
+ * Formats:
+ *   - https://vercel.com/team/project
+ *   - https://vercel.com/team/project/settings
+ *   - https://vercel.com/team/project/deployments
+ *   - vercel.com/team/project
+ *
+ * Note: Subpaths like /settings, /deployments are ignored
+ */
+export declare function parseVercelUrl(url: string): {
+    team: string;
+    project: string;
+} | null;
+/**
+ * Parse GitHub repo URL to extract owner and repo
+ * Formats:
+ *   - https://github.com/owner/repo
+ *   - https://github.com/owner/repo/tree/main
+ *   - https://github.com/owner/repo.git
+ *   - github.com/owner/repo
+ *   - owner/repo (shorthand)
+ *
+ * Note: Subpaths like /tree/main, /pulls are ignored
+ */
+export declare function parseGitHubUrl(url: string): {
+    owner: string;
+    repo: string;
+} | null;
+/**
+ * Parse Supabase dashboard URL to extract project ref
+ * Formats:
+ *   - https://supabase.com/dashboard/project/abcd1234
+ *   - https://supabase.com/dashboard/project/abcd1234/settings
+ *   - supabase.com/dashboard/project/abcd1234
+ *   - https://app.supabase.com/project/abcd1234
+ *
+ * Note: Supabase project refs are 20-character lowercase alphanumeric strings
+ */
+export declare function parseSupabaseUrl(url: string): string | null;
+/**
+ * URL-encode a password for use in database connection strings
+ * Handles special characters like @, #, /, ?, %, :
+ */
+export declare function encodePasswordForUrl(password: string): string;
+//# sourceMappingURL=parsers.d.ts.map

package/dist/commands/env/commands/setup/parsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/parsers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4BlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwB3D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/commands/env/commands/setup/prompts.d.ts

@@ -0,0 +1,41 @@
+/**
+ * AI HINT: Interactive Prompts
+ *
+ * Purpose: User input prompts for URLs, passwords, and confirmations
+ * Extracted from: env-setup.ts (lines 869-957)
+ *
+ * Refactored for reduced cognitive complexity:
+ * - handlePasswordChar() - Process single character input
+ */
+import * as readline from 'node:readline/promises';
+import { type createCLILogger } from '@runa-ai/runa';
+import type { EnvSetupOptions } from './types.js';
+/**
+ * Prompt for a URL value
+ */
+export declare function promptForUrl(rl: readline.Interface, prompt: string, existingValue?: string): Promise<string>;
+/**
+ * Prompt for password with masked input (asterisks instead of characters)
+ * Uses raw mode to capture keystrokes without echoing
+ */
+export declare function promptForPassword(prompt: string): Promise<string>;
+/**
+ * Prompt for yes/no confirmation
+ */
+export declare function promptForConfirmation(rl: readline.Interface, message: string, autoApprove?: boolean): Promise<boolean>;
+/**
+ * Collect service role key interactively or from options
+ * Key input is masked (asterisks) for security
+ * Only prompted if the API returns a masked sb_secret_ key
+ */
+export declare function collectServiceRoleKey(rl: readline.Interface | null, options: EnvSetupOptions, isSecretKeyMasked: boolean, projectRef: string, logger: ReturnType<typeof createCLILogger>): Promise<string | undefined>;
+/**
+ * Prompt user to link projects to current directory
+ */
+export declare function promptForProjectLink(rl: readline.Interface, needsVercel: boolean, needsSupabase: boolean): Promise<boolean>;
+/**
+ * Collect postgres password interactively or from options
+ * Password input is masked (asterisks) for security
+ */
+export declare function collectPostgresPassword(rl: readline.Interface | null, options: EnvSetupOptions, projectRef: string, logger: ReturnType<typeof createCLILogger>): Promise<string>;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/commands/env/commands/setup/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmElD;;GAEG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiDvE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,OAAO,EAAE,eAAe,EACxB,iBAAiB,EAAE,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6B7B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,QAAQ,CAAC,SAAS,EACtB,WAAW,EAAE,OAAO,EACpB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/commands/env/commands/setup/supabase-api.d.ts

@@ -0,0 +1,30 @@
+/**
+ * AI HINT: Supabase API Integration
+ *
+ * Purpose: Supabase project info and API key retrieval
+ * Extracted from: env-setup.ts (lines 676-801)
+ *
+ * Refactored for reduced cognitive complexity:
+ * - fetchSupabaseProjects() - List projects via CLI
+ * - fetchSupabaseApiKeys() - Get API keys for a project
+ * - resolveServiceRoleKey() - Determine best service role key
+ */
+import type * as readline from 'node:readline/promises';
+import { type createCLILogger } from '@runa-ai/runa';
+import type { SupabaseProjectInfo } from './types.js';
+/**
+ * Check if Supabase project is already linked in the specified directory
+ */
+export declare function checkSupabaseLinked(cwd: string): {
+    linked: boolean;
+    projectRef?: string;
+};
+/**
+ * Link Supabase project to the current working directory
+ */
+export declare function linkSupabaseInCwd(projectRef: string, logger: ReturnType<typeof createCLILogger>): Promise<void>;
+/**
+ * Get Supabase project information including API keys
+ */
+export declare function getSupabaseProjectInfo(projectRef: string, logger: ReturnType<typeof createCLILogger>, rl: readline.Interface | null, providedServiceRoleKey?: string): Promise<SupabaseProjectInfo>;
+//# sourceMappingURL=supabase-api.d.ts.map

package/dist/commands/env/commands/setup/supabase-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-api.d.ts","sourceRoot":"","sources":["../../../../../src/commands/env/commands/setup/supabase-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAG/D,OAAO,KAAK,EAAmB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAmBvE;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAczF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC,CAQf;AAiID;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,EAC1C,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAC7B,sBAAsB,CAAC,EAAE,MAAM,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA8C9B"}