@runa-ai/runa-cli 0.5.26

package/dist/commands/ci/utils/ci-summary.d.ts

@@ -0,0 +1,109 @@
+/**
+ * AI HINT: CI summary writer
+ *
+ * Contract:
+ * - Always write `.runa/tmp/ci-summary.json`.
+ * - Keep the shape stable for AI + tooling.
+ */
+import { z } from 'zod';
+export declare const CiLayerStatusSchema: z.ZodEnum<{
+    timeout: "timeout";
+    passed: "passed";
+    failed: "failed";
+    skipped: "skipped";
+    killed: "killed";
+}>;
+export type CiLayerStatus = z.output<typeof CiLayerStatusSchema>;
+export declare const LayerBlockingLevelSchema: z.ZodEnum<{
+    blocking: "blocking";
+    warning: "warning";
+    reportOnly: "reportOnly";
+}>;
+export type LayerBlockingLevel = z.output<typeof LayerBlockingLevelSchema>;
+export declare const CiStepStatusSchema: z.ZodEnum<{
+    timeout: "timeout";
+    passed: "passed";
+    failed: "failed";
+    skipped: "skipped";
+    killed: "killed";
+}>;
+export type CiStepStatus = z.output<typeof CiStepStatusSchema>;
+export declare const CiSummarySchema: z.ZodObject<{
+    version: z.ZodString;
+    mode: z.ZodEnum<{
+        local: "local";
+        "github-actions": "github-actions";
+    }>;
+    command: z.ZodEnum<{
+        "ci pr": "ci pr";
+        "ci prod-apply": "ci prod-apply";
+    }>;
+    status: z.ZodEnum<{
+        timeout: "timeout";
+        success: "success";
+        failure: "failure";
+        cancelled: "cancelled";
+    }>;
+    startedAt: z.ZodString;
+    endedAt: z.ZodString;
+    durationMs: z.ZodNumber;
+    repoKind: z.ZodEnum<{
+        unknown: "unknown";
+        monorepo: "monorepo";
+        "pj-repo": "pj-repo";
+    }>;
+    detected: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    steps: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        status: z.ZodEnum<{
+            timeout: "timeout";
+            passed: "passed";
+            failed: "failed";
+            skipped: "skipped";
+            killed: "killed";
+        }>;
+        exitCode: z.ZodOptional<z.ZodNumber>;
+        logPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    layers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        status: z.ZodEnum<{
+            timeout: "timeout";
+            passed: "passed";
+            failed: "failed";
+            skipped: "skipped";
+            killed: "killed";
+        }>;
+        exitCode: z.ZodNumber;
+        logPath: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        passed: z.ZodOptional<z.ZodNumber>;
+        total: z.ZodOptional<z.ZodNumber>;
+        level: z.ZodOptional<z.ZodEnum<{
+            blocking: "blocking";
+            warning: "warning";
+            reportOnly: "reportOnly";
+        }>>;
+    }, z.core.$strict>>>;
+    errors: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        step: z.ZodString;
+        details: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    blockingPolicy: z.ZodOptional<z.ZodObject<{
+        profile: z.ZodOptional<z.ZodEnum<{
+            "runa-strict": "runa-strict";
+            "pj-stable": "pj-stable";
+        }>>;
+        blockingLayers: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        warningLayers: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        reportOnlyLayers: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        dbDeployAllowed: z.ZodOptional<z.ZodBoolean>;
+        exitCode: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CiSummary = z.output<typeof CiSummarySchema>;
+export declare function writeCiSummary(params: {
+    cwd?: string;
+    summary: CiSummary;
+}): Promise<string>;
+//# sourceMappingURL=ci-summary.d.ts.map

package/dist/commands/ci/utils/ci-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-summary.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/ci-summary.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;EAA+D,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEjE,eAAO,MAAM,wBAAwB;;;;EAAgD,CAAC;AACtF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE3E,eAAO,MAAM,kBAAkB;;;;;;EAA+D,CAAC;AAC/F,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE/D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0EjB,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAEzD,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlB"}

package/dist/commands/ci/utils/config-readers.d.ts

@@ -0,0 +1,46 @@
+/**
+ * AI HINT: Config reader utility functions
+ *
+ * Purpose: Type-safe nested config value readers
+ * Used by: ci-resolvers.ts and other config-dependent modules
+ *
+ * Functions:
+ * - readNestedBoolean: Read boolean at nested path
+ * - readNestedString: Read string at nested path
+ * - readNestedNumber: Read number at nested path
+ * - readNestedNumberArray: Read number[] at nested path
+ */
+/**
+ * Read a boolean value from a nested config path.
+ * Returns null if path doesn't exist or value is not a boolean.
+ */
+export declare function readNestedBoolean(params: {
+    value: unknown;
+    keyPath: string[];
+}): boolean | null;
+/**
+ * Read a string value from a nested config path.
+ * Returns null if path doesn't exist or value is not a string.
+ */
+export declare function readNestedString(params: {
+    value: unknown;
+    keyPath: string[];
+}): string | null;
+/**
+ * Read a number value from a nested config path.
+ * Returns null if path doesn't exist or value is not a number.
+ */
+export declare function readNestedNumber(params: {
+    value: unknown;
+    keyPath: string[];
+}): number | null;
+/**
+ * Read a number array from a nested config path.
+ * Returns null if path doesn't exist, value is not an array,
+ * or any element is not a finite number.
+ */
+export declare function readNestedNumberArray(params: {
+    value: unknown;
+    keyPath: string[];
+}): number[] | null;
+//# sourceMappingURL=config-readers.d.ts.map

package/dist/commands/ci/utils/config-readers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-readers.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/config-readers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,GAAG,IAAI,CAE/F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAE7F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAE7F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,MAAM,EAAE,GAAG,IAAI,CAElB"}

package/dist/commands/ci/utils/db-url-utils.d.ts

@@ -0,0 +1,81 @@
+/**
+ * AI HINT: Database URL normalization utilities for CI operations
+ *
+ * Purpose: Normalize database URLs for DDL operations and catalog queries
+ * Shared: These utilities match SDK's behavior for consistent handling
+ *
+ * Key transformations:
+ * 1. Port conversion: Transaction Pooler (6543) → Session Pooler (5432)
+ * 2. pgbouncer cleanup: Remove pgbouncer parameter for Session Pooler
+ * 3. IPv4 resolution: GitHub Actions runners can't reach IPv6-only hosts
+ */
+/**
+ * Resolve hostname to IPv4 address using getent (Linux).
+ *
+ * This is critical for GitHub Actions where IPv6 may not be routable to Supabase.
+ * Matches SDK's resolveHostToIPv4 behavior.
+ *
+ * @param hostname - The hostname to resolve
+ * @returns IPv4 address if resolvable, null otherwise
+ */
+export declare function resolveHostToIPv4(hostname: string): string | null;
+/**
+ * Normalize database URL for DDL reads and psql operations.
+ *
+ * Handles three critical issues:
+ * 1. Port conversion: Transaction Pooler (6543) → Session Pooler (5432)
+ *    - DDL and catalog reads are more reliable via Session Pooler
+ * 2. pgbouncer cleanup: Remove pgbouncer parameter for Session Pooler
+ *    - Session Pooler (5432) does NOT accept pgbouncer parameter
+ * 3. IPv4 resolution: GitHub Actions runners can't reach IPv6-only hosts
+ *    - This matches SDK's normalizeDatabaseUrlForDDL behavior
+ *
+ * @param databaseUrl - The database URL to normalize
+ * @returns Normalized database URL suitable for DDL operations
+ */
+export declare function normalizeDatabaseUrlForDdl(databaseUrl: string): string;
+/**
+ * Get safe database target string for logging (without password).
+ *
+ * @param databaseUrl - The database URL
+ * @returns Safe string for logging
+ */
+export declare function getSafeDatabaseTarget(databaseUrl: string): string;
+/**
+ * Escape SQL literal value for safe inclusion in SQL strings.
+ *
+ * @param value - The string value to escape
+ * @returns Escaped string safe for SQL literals
+ */
+export declare function escapeSqlLiteral(value: string): string;
+/**
+ * Parse PostgreSQL boolean result to JavaScript boolean.
+ *
+ * PostgreSQL returns 't', 'true', or '1' for true values.
+ * This utility normalizes these variants.
+ *
+ * @param value - The PostgreSQL boolean string
+ * @returns JavaScript boolean
+ */
+export declare function parseBoolish(value: string): boolean;
+/**
+ * Check if a hostname resolves ONLY to IPv6 (no IPv4).
+ *
+ * This indicates that Supabase IPv4 Add-on is not enabled.
+ * GitHub Actions cannot reach IPv6-only hosts.
+ *
+ * @param hostname - The hostname to check
+ * @returns true if hostname resolves ONLY to IPv6, false otherwise
+ */
+export declare function isIPv6Only(hostname: string): boolean;
+/**
+ * Enhance error message with actionable advice.
+ *
+ * Detects common error patterns and adds clear guidance for users.
+ *
+ * @param error - Original error message
+ * @param databaseUrl - The database URL that failed (optional)
+ * @returns Enhanced error message with guidance
+ */
+export declare function enhanceConnectionError(error: string, databaseUrl?: string): string;
+//# sourceMappingURL=db-url-utils.d.ts.map

package/dist/commands/ci/utils/db-url-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-url-utils.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/db-url-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAwBtE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAWjE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAgClF"}

package/dist/commands/ci/utils/e2e-auth-setup.d.ts

@@ -0,0 +1,78 @@
+/**
+ * AI HINT: E2E test authentication setup utilities
+ *
+ * Purpose: Create and configure test users for E2E tests in preview/branch databases
+ * Strategy: Inline SQL first, fallback to seed file if needed
+ *
+ * Design decisions:
+ * - Uses configurable test user (env vars → runa.config.ts → defaults)
+ * - Generates deterministic UUIDs from email for consistency
+ * - Uses inline SQL for better error handling and reliability
+ * - Falls back to file-based approach when inline SQL fails
+ *
+ * Zero Hardcode Principle:
+ * - Email/password: TEST_USER_EMAIL, TEST_USER_PASSWORD env vars
+ * - Or: runa.config.ts testing.e2e.auth.credentials section
+ * - UUIDs: Generated deterministically from email (no hardcoding needed)
+ */
+export interface E2ETestUser {
+    id: string;
+    email: string;
+    password: string;
+    passwordHash: string;
+    identityId: string;
+}
+/**
+ * Get E2E test user configuration.
+ *
+ * Priority chain (Zero Hardcode Principle):
+ * 1. Environment variables (TEST_USER_EMAIL, TEST_USER_PASSWORD)
+ * 2. runa.config.ts testing.e2e.auth.credentials section
+ * 3. Default values (test@example.com, password)
+ *
+ * UUIDs are generated deterministically from the email, so they don't
+ * need to be configured separately.
+ *
+ * @param repoRoot - Repository root directory
+ * @returns Fully resolved E2E test user
+ */
+export declare function getE2ETestUser(repoRoot: string): E2ETestUser;
+export interface ApplyAuthUsersParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+}
+/**
+ * Apply auth users seed for E2E tests.
+ *
+ * This function creates the E2E test user directly using inline SQL,
+ * avoiding dependencies on seed_uuid() or other helper functions.
+ *
+ * DESIGN DECISIONS:
+ * 1. Uses hardcoded UUIDs instead of seed_uuid() for reliability in Branch DB
+ * 2. Uses inline SQL instead of file-based approach for better error handling
+ * 3. Verifies user creation after insert
+ * 4. Handles both auth.users and auth.identities tables
+ *
+ * Why not use GoTrue Admin API?
+ * - Would require service_role_key which isn't exposed in Branch DB context
+ * - Direct SQL works with the database URL we already have
+ *
+ * @param params - Parameters including repo root, temp dir, and database URL
+ */
+export declare function applyAuthUsersForE2E(params: ApplyAuthUsersParams): Promise<void>;
+export interface ExportMetadataParams {
+    repoRoot: string;
+    tmpDir: string;
+}
+export interface ExportMetadataResult {
+    rootId: string | null;
+}
+/**
+ * Export primary root ID from seed metadata.
+ *
+ * @param params - Parameters including repo root and temp dir
+ * @returns Result containing root ID or null
+ */
+export declare function exportPrimaryRootIdFromMetadata(params: ExportMetadataParams): Promise<ExportMetadataResult>;
+//# sourceMappingURL=e2e-auth-setup.d.ts.map

package/dist/commands/ci/utils/e2e-auth-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-auth-setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/e2e-auth-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4DH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CA4B5D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HtF;AA4CD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAyC/B"}

package/dist/commands/ci/utils/execa-helpers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * AI HINT: Execa helpers for CI orchestration
+ */
+import { type ResultPromise } from 'execa';
+export declare function ensureRunaTmpDir(cwd?: string): Promise<string>;
+export declare function runLogged(params: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    label: string;
+    command: string;
+    args: string[];
+    logFile: string;
+}): ResultPromise;
+//# sourceMappingURL=execa-helpers.d.ts.map

package/dist/commands/ci/utils/execa-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execa-helpers.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/execa-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAAS,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAyDlD,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,aAAa,CAsBhB"}

package/dist/commands/ci/utils/exit-code-computation.d.ts

@@ -0,0 +1,62 @@
+/**
+ * AI HINT: Exit Code Constants and Computation for Layer Blocking Policy
+ * Purpose: Graduated exit codes that distinguish blocking vs warning failures
+ * Semantics:
+ *   0 = All passed (DB deploy allowed)
+ *   1 = Blocking layer failed (DB deploy blocked)
+ *   2 = Warning/reportOnly layers failed only (DB deploy allowed)
+ * Used by: ci-pr.ts to determine final exit code
+ */
+import type { LayerClassification } from '@runa-ai/runa';
+import type { CiSummary } from './ci-summary.js';
+/**
+ * CI Exit Codes for layer blocking policy
+ */
+export declare const CI_EXIT_CODES: {
+    /** All layers passed */
+    readonly SUCCESS: 0;
+    /** At least one blocking layer failed - DB deploy blocked */
+    readonly BLOCKING_FAILED: 1;
+    /** Only warning/reportOnly layers failed - DB deploy allowed */
+    readonly WARNING_FAILED: 2;
+    /** Test execution timed out */
+    readonly TIMEOUT: 41;
+    /** User cancelled execution */
+    readonly CANCELLED: 42;
+};
+export type CiExitCode = (typeof CI_EXIT_CODES)[keyof typeof CI_EXIT_CODES];
+/**
+ * Result of exit code computation with detailed breakdown
+ */
+export interface ComputeExitCodeResult {
+    /** Final exit code (0, 1, or 2) */
+    exitCode: CiExitCode;
+    /** Whether any blocking layer failed */
+    blockingFailed: boolean;
+    /** Whether any warning layer failed */
+    warningFailed: boolean;
+    /** Whether any reportOnly layer failed */
+    reportOnlyFailed: boolean;
+    /** List of failed blocking layer numbers */
+    failedBlockingLayers: number[];
+    /** List of failed warning layer numbers */
+    failedWarningLayers: number[];
+    /** List of failed reportOnly layer numbers */
+    failedReportOnlyLayers: number[];
+    /** Whether DB deploy is allowed based on blocking layer results */
+    dbDeployAllowed: boolean;
+}
+/**
+ * Compute exit code based on layer results and classification
+ *
+ * Exit code semantics:
+ * - 0: All layers passed (or skipped)
+ * - 1: At least one blocking layer failed
+ * - 2: Only warning/reportOnly layers failed (blocking layers passed)
+ */
+export declare function computeExitCode(summary: CiSummary, classification: LayerClassification[]): ComputeExitCodeResult;
+/**
+ * Get summary message for exit code result
+ */
+export declare function getExitCodeSummaryMessage(result: ComputeExitCodeResult): string;
+//# sourceMappingURL=exit-code-computation.d.ts.map

package/dist/commands/ci/utils/exit-code-computation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code-computation.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/exit-code-computation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAMjD;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,wBAAwB;;IAGxB,6DAA6D;;IAG7D,gEAAgE;;IAGhE,+BAA+B;;IAG/B,+BAA+B;;CAEvB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAM5E;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,UAAU,CAAC;IAErB,wCAAwC;IACxC,cAAc,EAAE,OAAO,CAAC;IAExB,uCAAuC;IACvC,aAAa,EAAE,OAAO,CAAC;IAEvB,0CAA0C;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAE1B,4CAA4C;IAC5C,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAE/B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAE9B,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAEjC,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,cAAc,EAAE,mBAAmB,EAAE,GACpC,qBAAqB,CAyDvB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CA0B/E"}

package/dist/commands/ci/utils/github-api.d.ts

@@ -0,0 +1,54 @@
+/**
+ * AI HINT: Minimal GitHub REST API client (no Octokit dependency)
+ *
+ * Used to move GitHub Script logic (comments/labels/PR files) from YAML to TS.
+ * Uses centralized GITHUB_API endpoints from @runa-ai/runa.
+ */
+import { z } from 'zod';
+declare const RepoContextSchema: z.ZodObject<{
+    owner: z.ZodString;
+    repo: z.ZodString;
+}, z.core.$strict>;
+export type RepoContext = z.output<typeof RepoContextSchema>;
+export declare function resolveRepoContextFromEnv(): RepoContext;
+export declare function listPullRequestFiles(params: {
+    repo: RepoContext;
+    pullNumber: number;
+}): Promise<string[]>;
+export declare function upsertIssueComment(params: {
+    repo: RepoContext;
+    issueNumber: number;
+    marker: string;
+    body: string;
+}): Promise<void>;
+export declare function addIssueLabels(params: {
+    repo: RepoContext;
+    issueNumber: number;
+    labels: string[];
+}): Promise<void>;
+export declare function findPullRequestNumberForCommit(params: {
+    repo: RepoContext;
+    sha: string;
+}): Promise<number | null>;
+/**
+ * Post a new comment to an issue/PR (no upsert, always creates new).
+ */
+export declare function postIssueComment(params: {
+    repo: RepoContext;
+    issueNumber: number;
+    body: string;
+}): Promise<void>;
+/**
+ * Add a reaction to an issue comment.
+ */
+export declare function addCommentReaction(params: {
+    repo: RepoContext;
+    commentId: number;
+    reaction: 'rocket' | '+1' | '-1' | 'laugh' | 'confused' | 'heart' | 'hooray' | 'eyes';
+}): Promise<void>;
+/**
+ * Build a workflow run URL.
+ */
+export declare function buildWorkflowRunUrl(): string;
+export {};
+//# sourceMappingURL=github-api.d.ts.map

package/dist/commands/ci/utils/github-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-api.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/github-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,iBAAiB;;;kBAKZ,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAiB7D,wBAAgB,yBAAyB,IAAI,WAAW,CAIvD;AA8FD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBpB;AASD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BzB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;CACvF,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C"}

package/dist/commands/ci/utils/github.d.ts

@@ -0,0 +1,43 @@
+/**
+ * AI HINT: GitHub Actions utilities (consolidated)
+ *
+ * This file consolidates GitHub Actions-related utilities:
+ * - Step summary writing
+ * - Output file writing
+ * - Environment file writing
+ * - PR context parsing
+ *
+ * All functions are no-op when not running in GitHub Actions.
+ */
+/**
+ * Append markdown to GitHub Actions step summary.
+ * No-op when not running in GitHub Actions.
+ */
+export declare function appendGithubStepSummary(markdown: string): Promise<void>;
+/**
+ * Write key-value pairs to GitHub Actions output file.
+ * Do NOT write secrets into GITHUB_OUTPUT.
+ * No-op when not running in GitHub Actions.
+ */
+export declare function writeGithubOutput(values: Record<string, string>): Promise<void>;
+/**
+ * Write key-value pairs to GitHub Actions environment file.
+ * Use for propagating secret-like values within a job.
+ * No-op when not running in GitHub Actions.
+ */
+export declare function writeGithubEnv(values: Record<string, string>): Promise<void>;
+/**
+ * Add a value to the GitHub Actions mask list.
+ * Masked values are redacted from logs.
+ */
+export declare function addGithubMask(value: string | undefined): void;
+export type GithubPrContext = {
+    prNumber: number;
+    action: string | null;
+};
+/**
+ * Read PR context from GitHub Actions event payload.
+ * Throws if GITHUB_EVENT_PATH is not set.
+ */
+export declare function readGithubPrContext(): Promise<GithubPrContext>;
+//# sourceMappingURL=github.d.ts.map

package/dist/commands/ci/utils/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAMD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;AAMD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI7D;AAeD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,eAAe,CAAC,CAcpE"}

package/dist/commands/ci/utils/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: CI utilities barrel export
+ *
+ * This module provides centralized exports for all CI-related utilities.
+ * Import from this index for cleaner imports in command files.
+ */
+export * from './ai-report.js';
+export { type ProcessLogger, terminateAppProcessByPid, terminateAppProcessFromFile, } from './app-process.js';
+export * from './app-runtime.js';
+export * from './ci-config.js';
+export * from './ci-logging.js';
+export * from './ci-summary.js';
+export { enhanceConnectionError, escapeSqlLiteral, getSafeDatabaseTarget, isIPv6Only, normalizeDatabaseUrlForDdl, resolveHostToIPv4, } from './db-url-utils.js';
+export { type ApplyAuthUsersParams, applyAuthUsersForE2E, type ExportMetadataParams, type ExportMetadataResult, exportPrimaryRootIdFromMetadata, } from './e2e-auth-setup.js';
+export * from './execa-helpers.js';
+export * from './exit-code-computation.js';
+export * from './github.js';
+export * from './github-api.js';
+export { type PgTapInstallParams, type PgTapInstallResult, tryEnsurePgTapInstalled, } from './pgtap-installer.js';
+export { type QueryScalarParams, queryScalar, type VerifyPgTapAccessParams, type VerifyRlsAlignmentParams, type VerifyServiceTestParams, verifyDbRlsRoleAlignment, verifyPgTapAccess, verifyServiceTestPrerequisites, } from './rls-verification.js';
+export { type ApplyLocalSchemaParams, type ApplySchemaParams, applyLocalSchemaAndSeeds, applyPreviewSchemaAndPgtap, } from './schema-operations.js';
+export { type ApplySeedsParams, type ApplySeedsResult, applyPreviewSeeds, type FullSeedWorkflowParams, type FullSeedWorkflowResult, type GenerateSeedsParams, type GenerateSeedsResult, generatePreviewSeedsIfPossible, readSchemaSnapshot, runFullSeedWorkflow, type SchemaSnapshotParams, type SchemaSnapshotResult, type VerifySeedsParams, type VerifySeedsResult, verifySeedsNeeded, } from './seed-operations.js';
+export * from './test-parallel.js';
+export * from './timestamp-invariants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/ci/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EACL,KAAK,aAAa,EAClB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,UAAU,EACV,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AAEnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,iBAAiB,EACtB,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,8BAA8B,EAC9B,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/commands/ci/utils/pgtap-installer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * AI HINT: pgTAP installation utilities for CI operations
+ *
+ * Purpose: Best-effort pgTAP installation for Layer 2 (pgtap) tests
+ * Strategy: If pgTAP is unavailable or not permitted, Layer 2 can be skipped
+ *
+ * Design decisions:
+ * - Avoid hardcoding repo-specific roles/tables
+ * - Only probe standard Supabase roles (authenticated, service_role)
+ * - Best-effort: never fail CI if pgTAP is unavailable
+ */
+export interface PgTapInstallResult {
+    available: boolean;
+    installed: boolean;
+}
+export interface PgTapInstallParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+    label: 'preview' | 'local';
+    allowRemediation: boolean;
+}
+/**
+ * Try to ensure pgTAP is installed in the database.
+ *
+ * This is best-effort: pj-repos (or Supabase plans) may not ship pgTAP.
+ * - If pgTAP is available: install into dedicated schema `pgtap` and grant execute when roles exist.
+ * - If not available or not permitted: do NOT fail the whole CI (Layer2 can be skipped).
+ *
+ * @param params - Installation parameters
+ * @returns Result indicating availability and installation status
+ */
+export declare function tryEnsurePgTapInstalled(params: PgTapInstallParams): Promise<PgTapInstallResult>;
+//# sourceMappingURL=pgtap-installer.d.ts.map

package/dist/commands/ci/utils/pgtap-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pgtap-installer.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/pgtap-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CA6G7B"}