@runa-ai/runa-cli 0.5.38 → 0.5.40

package/dist/commands/db/apply/actors.d.ts

@@ -25,6 +25,14 @@ export declare const applyIdempotentSchemas: import("xstate").PromiseActorLogic<
 }, import("xstate").EventObject>;
 /**
  * Apply schema changes using pg-schema-diff (or direct psql for fresh DB).
+ *
+ * Extension Support:
+ * If pgSchemaDiff.shadowDbExtensions is configured in runa.config.ts,
+ * creates a shadow database with those extensions installed for type resolution.
+ * This enables pg-schema-diff to recognize extension-defined types like
+ * PostGIS geometry or pgvector vector.
+ *
+ * @see https://github.com/stripe/pg-schema-diff/pull/194
  */
 export declare const applyPgSchemaDiff: import("xstate").PromiseActorLogic<PgSchemaDiffResult, {
     input: DbApplyInput;

package/dist/commands/db/apply/actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/actors.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAuElD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAwwBD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;WAExB,YAAY;eAAa,MAAM;gCAgCxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB;WAEnB,YAAY;eAAa,MAAM;gCA6DxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;aACV,OAAO;;WACT,YAAY;eAAa,MAAM;gCAqDxC,CAAC"}
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/actors.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA4ElD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAwwBD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;WAExB,YAAY;eAAa,MAAM;gCAgCxC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;WAEnB,YAAY;eAAa,MAAM;gCA2GxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;aACV,OAAO;;WACT,YAAY;eAAa,MAAM;gCAqDxC,CAAC"}

package/dist/commands/db/apply/helpers/index.d.ts

@@ -4,8 +4,10 @@
  * Purpose: Export all helper functions for db apply actors
  */
 export { acquireAdvisoryLock, MIGRATION_LOCK_ID, releaseAdvisoryLock, } from './advisory-lock.js';
-export type { ParsedHazard } from './pg-schema-diff-helpers.js';
+export type { ParsedHazard, PgSchemaDiffPlanOptions } from './pg-schema-diff-helpers.js';
+export type { ShadowDbConfig, ShadowDbResult } from './shadow-db-manager.js';
 export { buildAllowedHazards, displayCheckModeResults, displayHazards, displayHazardsWithContext, executePgSchemaDiffPlan, filterFalsePositiveHazards, getIdempotentRoles, handleHazards, handleHazardsWithContext, handleProductionAuthzProtection, handleProductionDataProtection, isIdempotentRoleHazard, parseHazardsFromOutput, parseHazardsWithContext, resetIdempotentRolesCache, verifyDatabaseConnection, verifyPgSchemaDiffBinary, } from './pg-schema-diff-helpers.js';
 export type { RetryConfig, RetryResult } from './retry-logic.js';
 export { BASE_DELAY_MS, calculateBackoffDelay, DEFAULT_MAX_DELAY_MS, executeApplyWithRetry, isLockTimeoutError, MAX_RETRIES, sleep, } from './retry-logic.js';
+export { createShadowDbWithExtensions, needsShadowDb } from './shadow-db-manager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/db/apply/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,KAAK,GACN,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,KAAK,GACN,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/commands/db/apply/helpers/pg-schema-diff-helpers.d.ts

@@ -116,10 +116,32 @@ export declare function handleHazardsWithContext(planOutput: string, input: DbAp
     hasDeletesData: boolean;
     hasAuthzUpdate: boolean;
 };
+/**
+ * Options for pg-schema-diff plan execution.
+ */
+export interface PgSchemaDiffPlanOptions {
+    /**
+     * Shadow DB DSN for extension type resolution.
+     *
+     * When specified, pg-schema-diff uses this database for parsing
+     * extension-defined types (PostGIS geometry, pgvector vector, etc.).
+     *
+     * This is passed as --temp-db-dsn to pg-schema-diff.
+     *
+     * @see https://github.com/stripe/pg-schema-diff/pull/194
+     */
+    tempDbDsn?: string;
+}
 /**
  * Execute pg-schema-diff plan and handle errors.
+ *
+ * @param dbUrl - Source database URL (--from-dsn)
+ * @param schemasDir - Directory containing declarative SQL schemas (--to-dir)
+ * @param includeSchemas - Schemas to include in diff
+ * @param verbose - Enable verbose logging
+ * @param options - Additional options (tempDbDsn for extension support)
  */
-export declare function executePgSchemaDiffPlan(dbUrl: string, schemasDir: string, includeSchemas: string[], verbose: boolean): {
+export declare function executePgSchemaDiffPlan(dbUrl: string, schemasDir: string, includeSchemas: string[], verbose: boolean, options?: PgSchemaDiffPlanOptions): {
     planOutput: string;
     planStderr: string;
 };

package/dist/commands/db/apply/helpers/pg-schema-diff-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pg-schema-diff-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/pg-schema-diff-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAqBnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CA0BzF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EAAE,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,cAAc,EAAE,YAAY,EAAE,CAAA;CAAE,CAa9D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAa/C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAe5D;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE,CA8B1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,OAAO,GACf;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAgCtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAOzD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAgB3E;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAmBjF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAchE;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAyBjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAsB1E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,YAAY,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAsDzE;AAMD;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,EAAE,OAAO,GACf;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2C5C"}
+{"version":3,"file":"pg-schema-diff-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/pg-schema-diff-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAqBnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CA0BzF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EAAE,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,cAAc,EAAE,YAAY,EAAE,CAAA;CAAE,CAa9D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAa/C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAe5D;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE,CA8B1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,OAAO,GACf;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAgCtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAOzD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAgB3E;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAmBjF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAchE;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAyBjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAsB1E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,YAAY,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAsDzE;AAMD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAChC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAgD5C"}

package/dist/commands/db/apply/helpers/shadow-db-manager.d.ts

@@ -0,0 +1,70 @@
+/**
+ * AI HINT: Shadow DB Manager for pg-schema-diff Extension Support
+ *
+ * Purpose: Create and manage a shadow database with extensions installed
+ * for pg-schema-diff type resolution.
+ *
+ * Background:
+ * pg-schema-diff cannot recognize extension-defined types (PostGIS geometry,
+ * pgvector vector, etc.) when parsing SQL schema files. This module creates
+ * a temporary shadow database with the required extensions installed, which
+ * pg-schema-diff can use via --temp-db-dsn for type resolution.
+ *
+ * This is a temporary solution until pg-schema-diff PR #194 is merged:
+ * @see https://github.com/stripe/pg-schema-diff/pull/194
+ *
+ * Flow:
+ * 1. Create temp database (pg_schema_diff_shadow_{timestamp})
+ * 2. Install extensions from config
+ * 3. Return DSN for --temp-db-dsn
+ * 4. Cleanup on completion (DROP DATABASE)
+ *
+ * Security:
+ * - Uses psqlSyncQuery for safe SQL execution (no command injection)
+ * - Database name is sanitized (alphanumeric + underscore only)
+ * - Cleanup is always attempted in finally block
+ */
+export interface ShadowDbConfig {
+    /** Extensions to install in shadow DB */
+    extensions: string[];
+    /** Database URL to derive connection params from */
+    sourceDbUrl: string;
+}
+export interface ShadowDbResult {
+    /** DSN for pg-schema-diff --temp-db-dsn */
+    dsn: string;
+    /** Created database name */
+    dbName: string;
+    /** Cleanup function to drop the shadow database */
+    cleanup: () => Promise<void>;
+}
+/**
+ * Create a shadow database with specified extensions installed.
+ *
+ * The shadow database is used by pg-schema-diff via --temp-db-dsn
+ * to resolve extension-defined types (geometry, vector, etc.).
+ *
+ * @param config - Shadow DB configuration
+ * @returns Shadow DB result with DSN and cleanup function
+ *
+ * @example
+ * ```typescript
+ * const shadow = await createShadowDbWithExtensions({
+ *   extensions: ['postgis', 'vector'],
+ *   sourceDbUrl: 'postgresql://postgres:postgres@localhost:54322/postgres',
+ * });
+ *
+ * try {
+ *   // Use shadow.dsn with pg-schema-diff --temp-db-dsn
+ *   executePgSchemaDiff({ tempDbDsn: shadow.dsn });
+ * } finally {
+ *   await shadow.cleanup();
+ * }
+ * ```
+ */
+export declare function createShadowDbWithExtensions(config: ShadowDbConfig): Promise<ShadowDbResult>;
+/**
+ * Check if shadow DB with extensions is needed based on config.
+ */
+export declare function needsShadowDb(extensions: string[] | undefined): boolean;
+//# sourceMappingURL=shadow-db-manager.d.ts.map

package/dist/commands/db/apply/helpers/shadow-db-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shadow-db-manager.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/shadow-db-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAWH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAiID;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEvE"}

package/dist/commands/db/apply/machine.d.ts

@@ -3,10 +3,16 @@
  *
  * Purpose: Orchestrate schema application to any DB (local, Branch DB, Production)
  *
- * User Journey:
- * 1. Apply idempotent schemas (extensions, cleanup)
+ * User Journey (2-pass idempotent):
+ * 1. Apply idempotent schemas (1st pass: extensions, roles - may skip dependent tables)
  * 2. Run pg-schema-diff (current DB → desired state)
- * 3. Apply seeds
+ * 3. Apply idempotent schemas (2nd pass: dependent tables now succeed)
+ * 4. Apply seeds
+ *
+ * Why 2-pass idempotent?
+ * - Some idempotent SQL depends on declarative tables (e.g., areas → floors)
+ * - 1st pass: extensions/roles succeed, dependent tables are skipped (no error)
+ * - 2nd pass: dependent tables succeed because declarative tables now exist
  *
  * Architecture:
  * - No migration files needed
@@ -15,8 +21,9 @@
  *
  * E2E Test Mapping (CLI observable behavior):
  * - idle → expect(log).toContain('Starting db apply')
- * - applyingIdempotent → expect(log).toContain('Applied idempotent schema')
+ * - applyingIdempotentPre → expect(log).toContain('Applied idempotent schema')
  * - applyingPgSchemaDiff → expect(log).toContain('pg-schema-diff')
+ * - applyingIdempotentPost → expect(log).toContain('Applied idempotent schema')
  * - applyingSeeds → expect(log).toContain('Applying seeds')
  * - done → expect(exitCode).toBe(0)
  * - failed → expect(exitCode).toBe(1)
@@ -27,7 +34,8 @@ import type { DbApplyInput } from './contract.js';
 interface DbApplyContext {
     input: DbApplyInput;
     targetDir: string;
-    idempotentSchemasApplied: number;
+    idempotentPreApplied: number;
+    idempotentPostApplied: number;
     rolePasswordsSet: number;
     schemaChangesApplied: boolean;
     hazards: string[];
@@ -35,10 +43,12 @@ interface DbApplyContext {
     error: string | null;
     planSql: string | null;
     startTime: number;
-    idempotentStartTime: number | null;
-    idempotentEndTime: number | null;
+    idempotentPreStartTime: number | null;
+    idempotentPreEndTime: number | null;
     pgSchemaDiffStartTime: number | null;
     pgSchemaDiffEndTime: number | null;
+    idempotentPostStartTime: number | null;
+    idempotentPostEndTime: number | null;
     seedStartTime: number | null;
     seedEndTime: number | null;
     retryAttempts: number;
@@ -84,7 +94,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
         targetDir: string;
     }, import("xstate").EventObject>;
     id: string | undefined;
-}, never, never, never, "failed" | "done" | "idle" | "applyingIdempotent" | "applyingPgSchemaDiff" | "applyingSeeds", string, {
+}, never, never, never, "failed" | "done" | "idle" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "applyingSeeds", string, {
     input: DbApplyInput;
     targetDir: string;
 }, {
@@ -110,8 +120,9 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     id: "dbApply";
     states: {
         readonly idle: {};
-        readonly applyingIdempotent: {};
+        readonly applyingIdempotentPre: {};
         readonly applyingPgSchemaDiff: {};
+        readonly applyingIdempotentPost: {};
         readonly applyingSeeds: {};
         readonly done: {};
         readonly failed: {};

package/dist/commands/db/apply/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/machine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAU,KAAK,YAAY,EAAS,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAiC,MAAM,eAAe,CAAC;AA+EjF,UAAU,cAAc;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,cAAc;UAFC,OAAO;;UAAa,gBAAgB;WAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAI1D,YAAY;eAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkLjD,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAErE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEpE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAExE"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/machine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAU,KAAK,YAAY,EAAS,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAiC,MAAM,eAAe,CAAC;AA6FjF,UAAU,cAAc;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAElB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,cAAc;UAFC,OAAO;;UAAa,gBAAgB;WAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAI1D,YAAY;eAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6NjD,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAErE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEpE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAExE"}

package/dist/commands/db/commands/db-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-cleanup.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4MpC,eAAO,MAAM,cAAc,SAMoE,CAAC"}
+{"version":3,"file":"db-cleanup.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4NpC,eAAO,MAAM,cAAc,SAMoE,CAAC"}

package/dist/commands/db/commands/db-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-sync.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuJpC,eAAO,MAAM,YAAY,SAIgE,CAAC"}
+{"version":3,"file":"db-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-sync.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsKpC,eAAO,MAAM,YAAY,SAIgE,CAAC"}

package/dist/commands/db/preflight/actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/preflight/actors.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAe,gBAAgB,EAAE,iBAAiB,EAAa,MAAM,eAAe,CAAC;AA2GjG;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAuD5B"}
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/preflight/actors.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAe,gBAAgB,EAAE,iBAAiB,EAAa,MAAM,eAAe,CAAC;AA4HjG;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAuD5B"}

package/dist/commands/db/sync/actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/sync/actors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH,OAAO,KAAK,EACV,kBAAkB,EAIlB,WAAW,EAEZ,MAAM,eAAe,CAAC;AAMvB,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AA+CD;;GAEG;AACH,eAAO,MAAM,YAAY,2FAuBxB,CAAC;AAMF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;gDAgErB,CAAC;AAMF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,SAAS;;;;gDA2BrB,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ;;;;;+CAsCpB,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;2CA8BtB,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,6FA0FvB,CAAC"}
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/sync/actors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuBH,OAAO,KAAK,EACV,kBAAkB,EAIlB,WAAW,EAEZ,MAAM,eAAe,CAAC;AAMvB,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AA+CD;;GAEG;AACH,eAAO,MAAM,YAAY,2FAuBxB,CAAC;AAMF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,SAAS;;;;;gDA+ErB,CAAC;AAMF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,SAAS;;;;gDA2BrB,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ;;;;;+CAsCpB,CAAC;AAMF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;;;;2CA8BtB,CAAC;AAMF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,6FA0FvB,CAAC"}

package/dist/commands/db/utils/preflight-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight-check.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/preflight-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAspBD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAenF"}
+{"version":3,"file":"preflight-check.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/preflight-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiBH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAqqBD;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAenF"}

package/dist/commands/db/utils/schema-sync.d.ts

@@ -50,10 +50,30 @@ export declare function fetchDbTablesAndEnums(databaseUrl: string, options?: {
     dbTables: Set<string>;
     dbEnums: Map<string, EnumDefinition>;
 }>;
+/**
+ * Compute schema diff between expected (Drizzle) and actual (database).
+ *
+ * @param params.excludeFromOrphanDetection - Tables to exclude from orphan detection.
+ *   Use for tables managed by extensions (e.g., PostGIS spatial_ref_sys) or
+ *   tables created via idempotent SQL. Format: 'schema.table' or 'table'.
+ *   Supports glob patterns (e.g., 'public.spatial_*').
+ *
+ * @example
+ * diffSchema({
+ *   expectedTables: new Set(['public.users', 'public.posts']),
+ *   expectedEnums: new Map(),
+ *   dbTables: new Set(['public.users', 'public.posts', 'public.spatial_ref_sys']),
+ *   dbEnums: new Map(),
+ *   excludeFromOrphanDetection: ['public.spatial_ref_sys'],
+ * });
+ * // orphanTables will be [] (not ['public.spatial_ref_sys'])
+ */
 export declare function diffSchema(params: {
     expectedTables: Set<string>;
     expectedEnums: Map<string, EnumDefinition>;
     dbTables: Set<string>;
     dbEnums: Map<string, EnumDefinition>;
+    /** Tables to exclude from orphan detection (supports glob patterns) */
+    excludeFromOrphanDetection?: string[];
 }): SyncDiff;
 //# sourceMappingURL=schema-sync.d.ts.map

package/dist/commands/db/utils/schema-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-sync.ts"],"names":[],"mappings":"AA0KA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAErC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,MAAsB,GAClC,OAAO,CAAC;IACT,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC5C,CAAC,CAoCD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,CAAC,CAoDD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,GAAG,QAAQ,CAuCX"}
+{"version":3,"file":"schema-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-sync.ts"],"names":[],"mappings":"AA0KA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAErC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,MAAsB,GAClC,OAAO,CAAC;IACT,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC5C,CAAC,CAoCD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,CAAC,CAoDD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrC,uEAAuE;IACvE,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;CACvC,GAAG,QAAQ,CA0DX"}

package/dist/commands/inject-test-attrs/manifest-generator.d.ts

@@ -3,6 +3,12 @@
  *
  * Purpose: Generate E2E selector manifest and API contracts
  * Pattern: Build unified manifest from XState machines and Hono routes
+ *
+ * Security:
+ * - Validates manifest output directory is within project root
+ * - Prevents path traversal attacks via --manifest-dir argument
+ *
+ * @see Issue #... - Manifest file path traversal vulnerability
  */
 import type { MachineWithoutE2EMeta } from './contract.js';
 /**

package/dist/commands/inject-test-attrs/manifest-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-generator.d.ts","sourceRoot":"","sources":["../../../src/commands/inject-test-attrs/manifest-generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAqY3D;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;CACjD,CAAC,CAyHD"}
+{"version":3,"file":"manifest-generator.d.ts","sourceRoot":"","sources":["../../../src/commands/inject-test-attrs/manifest-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAqY3D;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,cAAc,GAAE,OAAe,GAC9B,OAAO,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;CACjD,CAAC,CAkID"}

package/dist/constants/versions.d.ts

@@ -20,7 +20,7 @@
  *
  * Sync strategy: Keep this in sync with packages/runa-templates/package.json version.
  */
-export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.38";
+export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.40";
 /**
  * Templates package name on GitHub Packages.
  * Published to npm.pkg.github.com (requires NODE_AUTH_TOKEN).