@runa-ai/runa-cli 0.5.43 → 0.5.44

package/dist/commands/ci/commands/ci-prod-apply.d.ts

@@ -6,5 +6,6 @@
  * - Safety sequence: stack → risks → snapshot → apply → audit → notify
  */
 import { Command } from 'commander';
-export declare const ciProdApplyCommand: Command;
+declare const ciProdApplyCommand: Command;
+export { ciProdApplyCommand };
 //# sourceMappingURL=ci-prod-apply.d.ts.map

package/dist/commands/ci/commands/ci-prod-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-prod-apply.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-prod-apply.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmUpC,eAAO,MAAM,kBAAkB,SA0G3B,CAAC"}
+{"version":3,"file":"ci-prod-apply.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-prod-apply.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsHpC,QAAA,MAAM,kBAAkB,SA0GpB,CAAC;AAEL,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/commands/ci/commands/ci-prod-types.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+/**
+ * Zod schema for ci prod-apply CLI options.
+ * Derived from commander option definitions in ci-prod-apply.ts.
+ */
+export declare const CiProdApplyActionOptionsSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        "github-actions": "github-actions";
+    }>>;
+    output: z.ZodOptional<z.ZodEnum<{
+        json: "json";
+        human: "human";
+    }>>;
+    config: z.ZodOptional<z.ZodString>;
+    autoApprove: z.ZodOptional<z.ZodBoolean>;
+    skipNotify: z.ZodOptional<z.ZodBoolean>;
+    skipGithubLabel: z.ZodOptional<z.ZodBoolean>;
+    skipRisks: z.ZodOptional<z.ZodBoolean>;
+    initialDeployment: z.ZodOptional<z.ZodBoolean>;
+    allowDataLoss: z.ZodOptional<z.ZodBoolean>;
+    confirmAuthzUpdate: z.ZodOptional<z.ZodBoolean>;
+    maxLockWaitMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type CiProdApplyActionOptions = z.infer<typeof CiProdApplyActionOptionsSchema>;
+//# sourceMappingURL=ci-prod-types.d.ts.map

package/dist/commands/ci/commands/ci-prod-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-prod-types.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-prod-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;kBAchC,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/commands/ci/commands/ci-prod-workflow.d.ts

@@ -0,0 +1,18 @@
+import { type createCLILogger } from '@runa-ai/runa';
+import type { CiSummary } from '../utils/ci-summary.js';
+import type { ProdApplyInputs } from './ci-prod-utils.js';
+import type { CiProdApplyActionOptions } from './ci-prod-types.js';
+export declare class CiProdApplyWorkflow {
+    private readonly steps;
+    private readonly ctx;
+    constructor(deps: {
+        options: CiProdApplyActionOptions;
+        logger: ReturnType<typeof createCLILogger>;
+        summary: CiSummary;
+        repoRoot: string;
+        tmpDir: string;
+        inputs: ProdApplyInputs;
+    });
+    run(): Promise<void>;
+}
+//# sourceMappingURL=ci-prod-workflow.d.ts.map

package/dist/commands/ci/commands/ci-prod-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-prod-workflow.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-prod-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAaxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAyBnE,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;gBAErC,IAAI,EAAE;QAChB,OAAO,EAAE,wBAAwB,CAAC;QAClC,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;QAC3C,OAAO,EAAE,SAAS,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,eAAe,CAAC;KACzB;IAkMK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoB3B"}

package/dist/commands/db/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/commands/db/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,aAAa,CA6DvE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;uBAKd,MAAM;;;;;;;;;;;;;;yBAuBF,MAAM;CA+ChB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;CAYhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CA0BlD,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;4CACM,MAAM,gBAAgB,MAAM;;;;;;;CAQnD,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ,CAOA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/commands/db/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,aAAa,CA6DvE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;uBASd,MAAM;;;;;;;;;;;;;;yBAuBF,MAAM;CA+ChB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;CAYhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CA0BlD,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;4CACM,MAAM,gBAAgB,MAAM;;;;;;;CAQnD,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ,CAOA"}

package/dist/commands/test/commands/test-layer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-layer.d.ts","sourceRoot":"","sources":["../../../../src/commands/test/commands/test-layer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6KpC,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AAmDvD,eAAO,MAAM,gBAAgB,SAI5B,CAAC"}
+{"version":3,"file":"test-layer.d.ts","sourceRoot":"","sources":["../../../../src/commands/test/commands/test-layer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmNpC,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AACvD,eAAO,MAAM,iBAAiB,SAAwB,CAAC;AAmDvD,eAAO,MAAM,gBAAgB,SAI5B,CAAC"}

package/dist/constants/versions.d.ts

@@ -20,7 +20,7 @@
  *
  * Sync strategy: Keep this in sync with packages/runa-templates/package.json version.
  */
-export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.43";
+export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.44";
 /**
  * Templates package name on GitHub Packages.
  * Published to npm.pkg.github.com (requires NODE_AUTH_TOKEN).

package/dist/index.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'url';
 import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import * as fs5 from 'fs';
 import fs5__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, promises, lstatSync, accessSync, constants, chmodSync, unlinkSync } from 'fs';
-import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, SUPABASE_SYSTEM_SCHEMAS, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, DATABASE_PACKAGE_CANDIDATES, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
+import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, SUPABASE_SYSTEM_SCHEMAS, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, DATABASE_PACKAGE_CANDIDATES, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
 import fs9, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir, lstat } from 'fs/promises';
 import { promisify } from 'util';
@@ -147,6 +147,10 @@ var init_constants = __esm({
     DATABASE_DEFAULTS = {
       // Supabase Local defaults (for development)
       // Note: PORT is detected from running Supabase instance
+      // AI HINT: Local Supabase Default Credentials (Non-Production)
+      // postgres:postgres is the standard default for `supabase start`.
+      // This is a documented public value, not a secret.
+      // Production uses environment variables via .env.production.
       SUPABASE_LOCAL: {
         HOST: "127.0.0.1",
         get PORT() {
@@ -925,7 +929,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.43";
+    CLI_VERSION = "0.5.44";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -9194,158 +9198,176 @@ async function writeCiSummary(params) {
   return filePath;
 }
 
-// src/commands/ci/utils/timestamp-invariants.ts
+// src/commands/ci/commands/ci-prod-github.ts
 init_esm_shims();
-async function resolveHostaddrV4(host) {
-  const ipVersion = isIP(host);
-  if (ipVersion === 4) return host;
-  if (ipVersion === 6) return void 0;
+
+// src/commands/ci/utils/github-api.ts
+init_esm_shims();
+var RepoContextSchema = z.object({
+  owner: z.string().min(1),
+  repo: z.string().min(1)
+}).strict();
+function resolveGithubToken() {
+  const token = process.env.GITHUB_TOKEN?.trim();
+  if (token && token.length > 0) return token;
+  throw new CLIError(
+    "GITHUB_TOKEN is not set (required for GitHub API operations).",
+    "GITHUB_TOKEN_MISSING",
+    [
+      "Ensure workflow permissions include issues: write / pull-requests: write",
+      "Set GITHUB_TOKEN via env"
+    ],
+    void 0,
+    10
+  );
+}
+function resolveRepoContextFromEnv() {
+  const full = process.env.GITHUB_REPOSITORY?.trim() ?? "";
+  const [owner, repo] = full.split("/");
+  return RepoContextSchema.parse({ owner, repo });
+}
+var GITHUB_API_TIMEOUT_MS = 3e4;
+async function githubRequest(params) {
+  const token = resolveGithubToken();
+  const url = new URL(`${GITHUB_API.base}${params.path}`);
+  for (const [k, v] of Object.entries(params.query ?? {})) {
+    if (v === void 0) continue;
+    url.searchParams.set(k, String(v));
+  }
+  const startTime = Date.now();
+  console.log(`[DEBUG] GitHub API: ${params.method} ${params.path} (starting)`);
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), GITHUB_API_TIMEOUT_MS);
   try {
-    const out = execFileSync("getent", ["ahostsv4", host], {
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: false,
-      encoding: "utf-8",
-      timeout: 5e3
+    const res = await fetch(url.toString(), {
+      method: params.method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: params.body === void 0 ? void 0 : JSON.stringify(params.body),
+      signal: controller.signal
     });
-    const firstLine = out.split("\n").find((l) => l.trim().length > 0);
-    if (!firstLine) return void 0;
-    const ip = firstLine.trim().split(/\s+/u)[0] ?? "";
-    return isIP(ip) === 4 ? ip : void 0;
-  } catch {
-    try {
-      const ips = await Promise.race([
-        resolve4(host),
-        new Promise(
-          (_, reject) => setTimeout(() => reject(new Error("resolve4 timeout")), 2e3)
-        )
-      ]);
-      const ip = ips[0];
-      return ip && isIP(ip) === 4 ? ip : void 0;
-    } catch {
-      return void 0;
+    clearTimeout(timeoutId);
+    const duration = Date.now() - startTime;
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      console.error(
+        `[DEBUG] GitHub API: ${params.method} ${params.path} failed (${res.status}) after ${duration}ms`
+      );
+      throw new CLIError(
+        `GitHub API request failed: ${params.method} ${params.path} (${res.status})`,
+        "GITHUB_API_FAILED",
+        ["Check workflow permissions", "Check GITHUB_TOKEN availability"],
+        new Error(text),
+        20
+      );
     }
+    console.log(
+      `[DEBUG] GitHub API: ${params.method} ${params.path} succeeded (${res.status}) in ${duration}ms`
+    );
+    if (res.status === 204) return null;
+    const json = await res.json().catch(() => null);
+    return json;
+  } catch (error) {
+    clearTimeout(timeoutId);
+    const duration = Date.now() - startTime;
+    if (error instanceof Error && error.name === "AbortError") {
+      console.error(
+        `[DEBUG] GitHub API: ${params.method} ${params.path} timed out after ${duration}ms`
+      );
+      throw new CLIError(
+        `GitHub API request timed out: ${params.method} ${params.path}`,
+        "GITHUB_API_TIMEOUT",
+        ["Request exceeded 30 second timeout", "GitHub API may be slow or unreachable"],
+        error,
+        21
+      );
+    }
+    console.error(
+      `[DEBUG] GitHub API: ${params.method} ${params.path} error after ${duration}ms: ${error instanceof Error ? error.message : String(error)}`
+    );
+    throw error;
   }
 }
-async function buildPsqlParams(databaseUrl) {
-  const url = new URL(databaseUrl);
-  const username = decodeURIComponent(url.username);
-  const password = decodeURIComponent(url.password);
-  const host = url.hostname;
-  const port = url.port || "5432";
-  const database = url.pathname.replace(/^\//u, "");
-  const hostaddrV4 = process.env.CI === "true" ? await resolveHostaddrV4(host) : void 0;
-  const sslmode = url.searchParams.get("sslmode") ?? void 0;
-  const env2 = {
-    ...process.env,
-    PGPASSWORD: password,
-    ...sslmode ? { PGSSLMODE: sslmode } : {},
-    ...hostaddrV4 ? { PGHOSTADDR: hostaddrV4 } : {}
-  };
-  const hostForPsql = hostaddrV4 ?? host;
-  const args = ["-h", hostForPsql, "-p", port, "-U", username, "-d", database];
-  return { args, env: env2 };
+z.object({
+  filename: z.string().min(1)
+}).passthrough();
+var IssueCommentSchema = z.object({
+  id: z.number().int(),
+  body: z.string().nullable()
+}).passthrough();
+async function upsertIssueComment(params) {
+  let page = 1;
+  let existingId = null;
+  while (true) {
+    const raw = await githubRequest({
+      method: "GET",
+      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/comments`,
+      query: { per_page: 100, page }
+    });
+    const arr = z.array(IssueCommentSchema).parse(raw);
+    for (const c of arr) {
+      const body = c.body ?? "";
+      if (body.includes(params.marker)) {
+        existingId = c.id;
+        break;
+      }
+    }
+    if (existingId) break;
+    if (arr.length < 100) break;
+    page += 1;
+    if (page > 20) break;
+  }
+  if (existingId) {
+    await githubRequest({
+      method: "PATCH",
+      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/comments/${existingId}`,
+      body: { body: params.body }
+    });
+    return;
+  }
+  await githubRequest({
+    method: "POST",
+    path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/comments`,
+    body: { body: params.body }
+  });
 }
-async function repairTimestampInvariants(params) {
-  const sql = `
-DO $$
-DECLARE
-  v_total integer := 0;
-  v_count integer := 0;
-  v_repaired integer := 0;
-  v_pairs integer := 0;
-  r record;
-BEGIN
-  -- Generic repair: derive (lhs >= rhs) invariants from CHECK constraints.
-  -- This avoids hardcoding schema/table/column names and works for pj-repos.
-  FOR r IN
-    WITH checks AS (
-      SELECT
-        n.nspname AS schema_name,
-        c.relname AS table_name,
-        pg_get_constraintdef(con.oid) AS constraint_def,
-        (regexp_matches(
-          pg_get_constraintdef(con.oid),
-          'CHECK\\s*\\(\\s*\\(\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*>=\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*\\)\\s*\\)\\s*\\)'
-        ))[1] AS lhs_col,
-        (regexp_matches(
-          pg_get_constraintdef(con.oid),
-          'CHECK\\s*\\(\\s*\\(\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*>=\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*\\)\\s*\\)\\s*\\)'
-        ))[2] AS rhs_col
-      FROM pg_constraint con
-      JOIN pg_class c ON c.oid = con.conrelid
-      JOIN pg_namespace n ON n.oid = c.relnamespace
-      WHERE con.contype = 'c'
-        AND pg_get_constraintdef(con.oid) ~ '>='
-    )
-    SELECT
-      schema_name,
-      table_name,
-      lhs_col,
-      rhs_col
-    FROM checks
-    WHERE lhs_col IS NOT NULL
-      AND rhs_col IS NOT NULL
-      -- Only apply to temporal column pairs (avoid touching unrelated invariants).
-      AND EXISTS (
-        SELECT 1
-        FROM pg_attribute a1
-        JOIN pg_type t1 ON t1.oid = a1.atttypid
-        WHERE a1.attrelid = to_regclass(format('%I.%I', schema_name, table_name))
-          AND a1.attname = lhs_col
-          AND t1.typname IN ('timestamptz', 'timestamp', 'date')
-      )
-      AND EXISTS (
-        SELECT 1
-        FROM pg_attribute a2
-        JOIN pg_type t2 ON t2.oid = a2.atttypid
-        WHERE a2.attrelid = to_regclass(format('%I.%I', schema_name, table_name))
-          AND a2.attname = rhs_col
-          AND t2.typname IN ('timestamptz', 'timestamp', 'date')
-      )
-      AND has_table_privilege(current_user, format('%I.%I', schema_name, table_name), 'UPDATE')
-  LOOP
-    v_pairs := v_pairs + 1;
-
-    -- Repair violations (best-effort, idempotent).
-    EXECUTE format(
-      'UPDATE %I.%I SET %I = %I WHERE %I < %I',
-      r.schema_name,
-      r.table_name,
-      r.lhs_col,
-      r.rhs_col,
-      r.lhs_col,
-      r.rhs_col
-    );
-    GET DIAGNOSTICS v_repaired = ROW_COUNT;
-
-    -- Verify remaining violations.
-    EXECUTE format(
-      'SELECT COUNT(*) FROM %I.%I WHERE %I < %I',
-      r.schema_name,
-      r.table_name,
-      r.lhs_col,
-      r.rhs_col
-    ) INTO v_count;
-    v_total := v_total + COALESCE(v_count, 0);
-  END LOOP;
-
-  RAISE NOTICE 'Repaired check-based invariants: pairs=% , remaining_violations=%', v_pairs, v_total;
-  IF v_total <> 0 THEN
-    RAISE EXCEPTION 'Timestamp invariants still violated after repair: % rows', v_total;
-  END IF;
-END
-$$;
-`.trim();
-  const psql = await buildPsqlParams(params.databaseUrl);
-  await runLogged({
-    cwd: params.repoRoot,
-    env: psql.env,
-    label: `repair timestamps (${params.labelPrefix})`,
-    command: "psql",
-    args: [...psql.args, "-v", "ON_ERROR_STOP=1", "-c", sql],
-    logFile: path10__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
+async function addIssueLabels(params) {
+  await githubRequest({
+    method: "POST",
+    path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/labels`,
+    body: { labels: params.labels }
   });
 }
+async function findPullRequestNumberForCommit(params) {
+  const token = process.env.GITHUB_TOKEN;
+  if (!token) return null;
+  const res = await fetch(GITHUB_API.commitPulls(params.repo.owner, params.repo.repo, params.sha), {
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!res.ok) return null;
+  const json = await res.json();
+  const arr = z.array(
+    z.object({
+      number: z.number().int().positive(),
+      state: z.string().optional()
+    }).passthrough()
+  ).parse(json);
+  const open = arr.find((p) => p.state === "open");
+  return (open ?? arr[0] ?? null)?.number ?? null;
+}
+function buildWorkflowRunUrl() {
+  const repository = process.env.GITHUB_REPOSITORY || "";
+  const runId = process.env.GITHUB_RUN_ID || "";
+  return `${GITHUB_API.serverUrl}/${repository}/actions/runs/${runId}`;
+}
 
 // src/commands/ci/commands/ci-prod-db-operations.ts
 init_esm_shims();
@@ -9798,177 +9820,6 @@ async function notifyDeployment(repoRoot, tmpDir, params) {
   });
 }
 
-// src/commands/ci/commands/ci-prod-github.ts
-init_esm_shims();
-
-// src/commands/ci/utils/github-api.ts
-init_esm_shims();
-var RepoContextSchema = z.object({
-  owner: z.string().min(1),
-  repo: z.string().min(1)
-}).strict();
-function resolveGithubToken() {
-  const token = process.env.GITHUB_TOKEN?.trim();
-  if (token && token.length > 0) return token;
-  throw new CLIError(
-    "GITHUB_TOKEN is not set (required for GitHub API operations).",
-    "GITHUB_TOKEN_MISSING",
-    [
-      "Ensure workflow permissions include issues: write / pull-requests: write",
-      "Set GITHUB_TOKEN via env"
-    ],
-    void 0,
-    10
-  );
-}
-function resolveRepoContextFromEnv() {
-  const full = process.env.GITHUB_REPOSITORY?.trim() ?? "";
-  const [owner, repo] = full.split("/");
-  return RepoContextSchema.parse({ owner, repo });
-}
-var GITHUB_API_TIMEOUT_MS = 3e4;
-async function githubRequest(params) {
-  const token = resolveGithubToken();
-  const url = new URL(`${GITHUB_API.base}${params.path}`);
-  for (const [k, v] of Object.entries(params.query ?? {})) {
-    if (v === void 0) continue;
-    url.searchParams.set(k, String(v));
-  }
-  const startTime = Date.now();
-  console.log(`[DEBUG] GitHub API: ${params.method} ${params.path} (starting)`);
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), GITHUB_API_TIMEOUT_MS);
-  try {
-    const res = await fetch(url.toString(), {
-      method: params.method,
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-        "Content-Type": "application/json"
-      },
-      body: params.body === void 0 ? void 0 : JSON.stringify(params.body),
-      signal: controller.signal
-    });
-    clearTimeout(timeoutId);
-    const duration = Date.now() - startTime;
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      console.error(
-        `[DEBUG] GitHub API: ${params.method} ${params.path} failed (${res.status}) after ${duration}ms`
-      );
-      throw new CLIError(
-        `GitHub API request failed: ${params.method} ${params.path} (${res.status})`,
-        "GITHUB_API_FAILED",
-        ["Check workflow permissions", "Check GITHUB_TOKEN availability"],
-        new Error(text),
-        20
-      );
-    }
-    console.log(
-      `[DEBUG] GitHub API: ${params.method} ${params.path} succeeded (${res.status}) in ${duration}ms`
-    );
-    if (res.status === 204) return null;
-    const json = await res.json().catch(() => null);
-    return json;
-  } catch (error) {
-    clearTimeout(timeoutId);
-    const duration = Date.now() - startTime;
-    if (error instanceof Error && error.name === "AbortError") {
-      console.error(
-        `[DEBUG] GitHub API: ${params.method} ${params.path} timed out after ${duration}ms`
-      );
-      throw new CLIError(
-        `GitHub API request timed out: ${params.method} ${params.path}`,
-        "GITHUB_API_TIMEOUT",
-        ["Request exceeded 30 second timeout", "GitHub API may be slow or unreachable"],
-        error,
-        21
-      );
-    }
-    console.error(
-      `[DEBUG] GitHub API: ${params.method} ${params.path} error after ${duration}ms: ${error instanceof Error ? error.message : String(error)}`
-    );
-    throw error;
-  }
-}
-z.object({
-  filename: z.string().min(1)
-}).passthrough();
-var IssueCommentSchema = z.object({
-  id: z.number().int(),
-  body: z.string().nullable()
-}).passthrough();
-async function upsertIssueComment(params) {
-  let page = 1;
-  let existingId = null;
-  while (true) {
-    const raw = await githubRequest({
-      method: "GET",
-      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/comments`,
-      query: { per_page: 100, page }
-    });
-    const arr = z.array(IssueCommentSchema).parse(raw);
-    for (const c of arr) {
-      const body = c.body ?? "";
-      if (body.includes(params.marker)) {
-        existingId = c.id;
-        break;
-      }
-    }
-    if (existingId) break;
-    if (arr.length < 100) break;
-    page += 1;
-    if (page > 20) break;
-  }
-  if (existingId) {
-    await githubRequest({
-      method: "PATCH",
-      path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/comments/${existingId}`,
-      body: { body: params.body }
-    });
-    return;
-  }
-  await githubRequest({
-    method: "POST",
-    path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/comments`,
-    body: { body: params.body }
-  });
-}
-async function addIssueLabels(params) {
-  await githubRequest({
-    method: "POST",
-    path: `/repos/${params.repo.owner}/${params.repo.repo}/issues/${params.issueNumber}/labels`,
-    body: { labels: params.labels }
-  });
-}
-async function findPullRequestNumberForCommit(params) {
-  const token = process.env.GITHUB_TOKEN;
-  if (!token) return null;
-  const res = await fetch(GITHUB_API.commitPulls(params.repo.owner, params.repo.repo, params.sha), {
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "X-GitHub-Api-Version": "2022-11-28"
-    }
-  });
-  if (!res.ok) return null;
-  const json = await res.json();
-  const arr = z.array(
-    z.object({
-      number: z.number().int().positive(),
-      state: z.string().optional()
-    }).passthrough()
-  ).parse(json);
-  const open = arr.find((p) => p.state === "open");
-  return (open ?? arr[0] ?? null)?.number ?? null;
-}
-function buildWorkflowRunUrl() {
-  const repository = process.env.GITHUB_REPOSITORY || "";
-  const runId = process.env.GITHUB_RUN_ID || "";
-  return `${GITHUB_API.serverUrl}/${repository}/actions/runs/${runId}`;
-}
-
 // src/commands/ci/commands/ci-prod-github.ts
 async function maybeNotifyExternal(params) {
   if (params.skipNotify) return;
@@ -10175,6 +10026,362 @@ function buildCiProdApplyStepSummaryMarkdown(params) {
   return lines.join("\n");
 }
 
+// src/commands/ci/commands/ci-prod-workflow.ts
+init_esm_shims();
+
+// src/commands/ci/utils/timestamp-invariants.ts
+init_esm_shims();
+async function resolveHostaddrV4(host) {
+  const ipVersion = isIP(host);
+  if (ipVersion === 4) return host;
+  if (ipVersion === 6) return void 0;
+  try {
+    const out = execFileSync("getent", ["ahostsv4", host], {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false,
+      encoding: "utf-8",
+      timeout: 5e3
+    });
+    const firstLine = out.split("\n").find((l) => l.trim().length > 0);
+    if (!firstLine) return void 0;
+    const ip = firstLine.trim().split(/\s+/u)[0] ?? "";
+    return isIP(ip) === 4 ? ip : void 0;
+  } catch {
+    try {
+      const ips = await Promise.race([
+        resolve4(host),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("resolve4 timeout")), 2e3)
+        )
+      ]);
+      const ip = ips[0];
+      return ip && isIP(ip) === 4 ? ip : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+}
+async function buildPsqlParams(databaseUrl) {
+  const url = new URL(databaseUrl);
+  const username = decodeURIComponent(url.username);
+  const password = decodeURIComponent(url.password);
+  const host = url.hostname;
+  const port = url.port || "5432";
+  const database = url.pathname.replace(/^\//u, "");
+  const hostaddrV4 = process.env.CI === "true" ? await resolveHostaddrV4(host) : void 0;
+  const sslmode = url.searchParams.get("sslmode") ?? void 0;
+  const env2 = {
+    ...process.env,
+    PGPASSWORD: password,
+    ...sslmode ? { PGSSLMODE: sslmode } : {},
+    ...hostaddrV4 ? { PGHOSTADDR: hostaddrV4 } : {}
+  };
+  const hostForPsql = hostaddrV4 ?? host;
+  const args = ["-h", hostForPsql, "-p", port, "-U", username, "-d", database];
+  return { args, env: env2 };
+}
+async function repairTimestampInvariants(params) {
+  const sql = `
+DO $$
+DECLARE
+  v_total integer := 0;
+  v_count integer := 0;
+  v_repaired integer := 0;
+  v_pairs integer := 0;
+  r record;
+BEGIN
+  -- Generic repair: derive (lhs >= rhs) invariants from CHECK constraints.
+  -- This avoids hardcoding schema/table/column names and works for pj-repos.
+  FOR r IN
+    WITH checks AS (
+      SELECT
+        n.nspname AS schema_name,
+        c.relname AS table_name,
+        pg_get_constraintdef(con.oid) AS constraint_def,
+        (regexp_matches(
+          pg_get_constraintdef(con.oid),
+          'CHECK\\s*\\(\\s*\\(\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*>=\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*\\)\\s*\\)\\s*\\)'
+        ))[1] AS lhs_col,
+        (regexp_matches(
+          pg_get_constraintdef(con.oid),
+          'CHECK\\s*\\(\\s*\\(\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*>=\\s*"?([a-zA-Z_][a-zA-Z0-9_]*)"?\\s*\\)\\s*\\)\\s*\\)'
+        ))[2] AS rhs_col
+      FROM pg_constraint con
+      JOIN pg_class c ON c.oid = con.conrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE con.contype = 'c'
+        AND pg_get_constraintdef(con.oid) ~ '>='
+    )
+    SELECT
+      schema_name,
+      table_name,
+      lhs_col,
+      rhs_col
+    FROM checks
+    WHERE lhs_col IS NOT NULL
+      AND rhs_col IS NOT NULL
+      -- Only apply to temporal column pairs (avoid touching unrelated invariants).
+      AND EXISTS (
+        SELECT 1
+        FROM pg_attribute a1
+        JOIN pg_type t1 ON t1.oid = a1.atttypid
+        WHERE a1.attrelid = to_regclass(format('%I.%I', schema_name, table_name))
+          AND a1.attname = lhs_col
+          AND t1.typname IN ('timestamptz', 'timestamp', 'date')
+      )
+      AND EXISTS (
+        SELECT 1
+        FROM pg_attribute a2
+        JOIN pg_type t2 ON t2.oid = a2.atttypid
+        WHERE a2.attrelid = to_regclass(format('%I.%I', schema_name, table_name))
+          AND a2.attname = rhs_col
+          AND t2.typname IN ('timestamptz', 'timestamp', 'date')
+      )
+      AND has_table_privilege(current_user, format('%I.%I', schema_name, table_name), 'UPDATE')
+  LOOP
+    v_pairs := v_pairs + 1;
+
+    -- Repair violations (best-effort, idempotent).
+    EXECUTE format(
+      'UPDATE %I.%I SET %I = %I WHERE %I < %I',
+      r.schema_name,
+      r.table_name,
+      r.lhs_col,
+      r.rhs_col,
+      r.lhs_col,
+      r.rhs_col
+    );
+    GET DIAGNOSTICS v_repaired = ROW_COUNT;
+
+    -- Verify remaining violations.
+    EXECUTE format(
+      'SELECT COUNT(*) FROM %I.%I WHERE %I < %I',
+      r.schema_name,
+      r.table_name,
+      r.lhs_col,
+      r.rhs_col
+    ) INTO v_count;
+    v_total := v_total + COALESCE(v_count, 0);
+  END LOOP;
+
+  RAISE NOTICE 'Repaired check-based invariants: pairs=% , remaining_violations=%', v_pairs, v_total;
+  IF v_total <> 0 THEN
+    RAISE EXCEPTION 'Timestamp invariants still violated after repair: % rows', v_total;
+  END IF;
+END
+$$;
+`.trim();
+  const psql = await buildPsqlParams(params.databaseUrl);
+  await runLogged({
+    cwd: params.repoRoot,
+    env: psql.env,
+    label: `repair timestamps (${params.labelPrefix})`,
+    command: "psql",
+    args: [...psql.args, "-v", "ON_ERROR_STOP=1", "-c", sql],
+    logFile: path10__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
+  });
+}
+
+// src/commands/ci/commands/ci-prod-workflow.ts
+var CiProdApplyWorkflow = class {
+  steps;
+  ctx;
+  constructor(deps) {
+    this.ctx = {
+      options: deps.options,
+      logger: deps.logger,
+      summary: deps.summary,
+      repoRoot: deps.repoRoot,
+      tmpDir: deps.tmpDir,
+      inputs: deps.inputs
+    };
+    this.steps = [
+      {
+        id: "stack",
+        description: "Validate stack and inputs",
+        run: async (ctx) => {
+          const stack = await detectStack(
+            ctx.repoRoot,
+            ctx.tmpDir,
+            ctx.inputs.productionDatabaseUrlAdmin
+          );
+          ctx.summary.detected.stack = stack;
+          const supportedStacks = ["drizzle", "supabase"];
+          if (!stack || !supportedStacks.includes(stack)) {
+            throw new CLIError(
+              `Production apply requires a supported database stack (detected: ${stack || "<empty>"}).`,
+              "CI_PROD_STACK_UNSUPPORTED",
+              [
+                "Supported stacks: drizzle, supabase",
+                "Run: runa init (to set up database structure)",
+                "See: packages/database or supabase/schemas/"
+              ],
+              void 0,
+              11
+            );
+          }
+        }
+      },
+      {
+        id: "schema-diff",
+        description: "Show schema diff",
+        run: async (ctx) => {
+          await showSchemaDiff(ctx.repoRoot, ctx.tmpDir);
+        }
+      },
+      {
+        id: "initial-detect",
+        description: "Detect initial deployment",
+        run: async (ctx) => {
+          const result = checkIfInitialDeployment(
+            ctx.repoRoot,
+            ctx.inputs.productionDatabaseUrlAdmin
+          );
+          ctx.initialDeploymentCheck = result;
+          if (result.checkSuccessful) {
+            if (result.isInitialDeployment) {
+              ctx.logger.info(`Initial deployment detected: ${result.reason}`);
+            } else {
+              ctx.logger.info(`Existing deployment: ${result.tableCount} table(s) found`);
+            }
+          } else {
+            ctx.logger.warn(
+              `Initial deployment check failed: ${result.reason}. Proceeding with risk analysis.`
+            );
+          }
+          const skipViaFlag = ctx.options.skipRisks === true ? "--skip-risks flag" : void 0;
+          const skipViaInitialFlag = ctx.options.initialDeployment === true ? "--initial-deployment flag" : void 0;
+          const skipViaEnv = process.env.RUNA_SKIP_SCHEMA_RISK === "1" || process.env.RUNA_SKIP_SCHEMA_RISK === "true" ? "RUNA_SKIP_SCHEMA_RISK env" : void 0;
+          const skipViaAutoDetect = result.checkSuccessful && result.isInitialDeployment ? `auto-detected initial deployment (${result.reason})` : void 0;
+          ctx.skipRisksReason = skipViaFlag ?? skipViaInitialFlag ?? skipViaEnv ?? skipViaAutoDetect ?? void 0;
+          if (ctx.skipRisksReason) {
+            ctx.logger.info(`Risk detection skipped: ${ctx.skipRisksReason}`);
+          }
+        }
+      },
+      {
+        id: "detect-risks",
+        description: "Detect risky schema changes",
+        shouldSkip: (ctx) => ctx.skipRisksReason ? { reason: ctx.skipRisksReason } : null,
+        run: async (ctx) => {
+          await detectRisks(ctx.repoRoot, ctx.tmpDir);
+        }
+      },
+      {
+        id: "snapshot",
+        description: "Create pre-deploy snapshot",
+        run: async (ctx) => {
+          await snapshotCreate(
+            ctx.repoRoot,
+            ctx.tmpDir,
+            ctx.inputs.productionDatabaseUrlAdmin,
+            ctx.inputs.githubSha
+          );
+        }
+      },
+      {
+        id: "repair-timestamps",
+        description: "Repair timestamp invariants",
+        run: async (ctx) => {
+          await repairTimestampInvariants({
+            repoRoot: ctx.repoRoot,
+            tmpDir: ctx.tmpDir,
+            databaseUrl: ctx.inputs.productionDatabaseUrlAdmin,
+            labelPrefix: "production"
+          });
+        }
+      },
+      {
+        id: "apply-schema",
+        description: "Apply production schema",
+        run: async (ctx) => {
+          try {
+            ctx.schemaApplyResult = await applyProductionSchema(
+              ctx.repoRoot,
+              ctx.tmpDir,
+              ctx.inputs.productionDatabaseUrlAdmin,
+              ctx.inputs.productionDatabaseUrl,
+              {
+                allowDataLoss: ctx.options.allowDataLoss === true,
+                confirmAuthzUpdate: ctx.options.confirmAuthzUpdate === true,
+                maxLockWaitMs: typeof ctx.options.maxLockWaitMs === "number" ? ctx.options.maxLockWaitMs : void 0
+              }
+            );
+          } catch (error) {
+            ctx.logger.error("Schema apply failed; attempting rollback from snapshot");
+            await snapshotRestoreLatest(
+              ctx.repoRoot,
+              ctx.tmpDir,
+              ctx.inputs.productionDatabaseUrlAdmin
+            );
+            throw error;
+          }
+        }
+      },
+      {
+        id: "audit",
+        description: "Record audit trail",
+        run: async (ctx) => {
+          try {
+            await auditRecord(ctx.repoRoot, ctx.tmpDir, ctx.inputs.productionDatabaseUrlAdmin, {
+              commit: ctx.inputs.githubSha,
+              author: ctx.inputs.githubActor
+            });
+          } catch (error) {
+            ctx.logger.warn(
+              error instanceof Error ? error.message : "Audit record failed (best-effort)"
+            );
+          }
+        }
+      },
+      {
+        id: "notify",
+        description: "Notify external systems",
+        run: async (ctx) => {
+          await maybeNotifyExternal({
+            logger: ctx.logger,
+            repoRoot: ctx.repoRoot,
+            tmpDir: ctx.tmpDir,
+            githubRepository: ctx.inputs.githubRepository,
+            githubSha: ctx.inputs.githubSha,
+            skipNotify: ctx.options.skipNotify === true
+          });
+        }
+      },
+      {
+        id: "github-label",
+        description: "Add GitHub labels/comments",
+        run: async (ctx) => {
+          await maybeAddGithubLabelAndComment({
+            mode: ctx.summary.mode,
+            skipGithubLabel: ctx.options.skipGithubLabel === true,
+            githubSha: ctx.inputs.githubSha,
+            schemaApplyResult: ctx.schemaApplyResult
+          });
+        }
+      }
+    ];
+  }
+  async run() {
+    logPlan(this.steps.map((step) => ({ id: step.id, description: step.description })));
+    const total = this.steps.length;
+    for (let i = 0; i < total; i++) {
+      const step = this.steps[i];
+      const prefix = `[DEBUG] Step ${i + 1}/${total}: ${step.description}`;
+      const skipResult = step.shouldSkip?.(this.ctx);
+      if (skipResult) {
+        console.log(`${prefix} SKIPPED (${skipResult.reason})`);
+        continue;
+      }
+      console.log(`${prefix}...`);
+      const startedAt = Date.now();
+      await step.run(this.ctx);
+      const duration = Date.now() - startedAt;
+      console.log(`${prefix} done (${duration}ms)`);
+    }
+  }
+};
+
 // src/commands/ci/commands/ci-resolvers.ts
 init_esm_shims();
 
@@ -10398,18 +10605,6 @@ var CiProdApplyOutputSchema = z.object({
 }).strict();
 async function runCiProdApply(params) {
   console.log("[DEBUG] runCiProdApply: starting");
-  const steps = [
-    { id: "guard", description: "Acquire deployment lock and check idempotency" },
-    { id: "stack", description: "Validate stack and inputs" },
-    { id: "risks", description: "Detect risky changes" },
-    { id: "snapshot", description: "Create pre-deploy snapshot" },
-    { id: "apply", description: "Apply production schema" },
-    { id: "audit", description: "Record audit trail (best-effort)" },
-    { id: "notify", description: "Notify external system (best-effort)" },
-    { id: "summarize", description: "Write summary JSON" }
-  ];
-  console.log("[DEBUG] runCiProdApply: logging plan");
-  logPlan(steps);
   const cfg = await loadCiConfig({
     repoRoot: params.repoRoot,
     overridePath: params.options.config
@@ -10419,7 +10614,7 @@ async function runCiProdApply(params) {
   if (cfg.config) params.summary.detected.config = cfg.config;
   requireCiAutoApprove({ mode: params.summary.mode, autoApprove: params.options.autoApprove });
   const inputs = resolveProdApplyInputs();
-  console.log("[DEBUG] Step 0/8: guardProductionDeployment...");
+  console.log("[DEBUG] Step 0: guardProductionDeployment...");
   const guardResult = guardProductionDeployment(
     inputs.productionDatabaseUrlAdmin,
     inputs.githubSha
@@ -10439,7 +10634,7 @@ async function runCiProdApply(params) {
       "If stuck, check for orphaned advisory locks in the database"
     ]);
   }
-  console.log("[DEBUG] Step 0/8: guardProductionDeployment done (lock acquired)");
+  console.log("[DEBUG] Step 0: guardProductionDeployment done (lock acquired)");
   try {
     logKeyValueTable({
       title: "Inputs",
@@ -10452,140 +10647,15 @@ async function runCiProdApply(params) {
       ]
     });
     logSection("Execute");
-    console.log("[DEBUG] Step 1/7: detectStack...");
-    const stack = await detectStack(
-      params.repoRoot,
-      params.tmpDir,
-      inputs.productionDatabaseUrlAdmin
-    );
-    console.log(`[DEBUG] Step 1/7: detectStack done (stack=${stack})`);
-    params.summary.detected.stack = stack;
-    const supportedStacks = ["drizzle", "supabase"];
-    if (!stack || !supportedStacks.includes(stack)) {
-      throw new CLIError(
-        `Production apply requires a supported database stack (detected: ${stack || "<empty>"}).`,
-        "CI_PROD_STACK_UNSUPPORTED",
-        [
-          "Supported stacks: drizzle, supabase",
-          "Run: runa init (to set up database structure)",
-          "See: packages/database or supabase/schemas/"
-        ],
-        void 0,
-        11
-      );
-    }
-    console.log("[DEBUG] Step 2/7: showSchemaDiff...");
-    await showSchemaDiff(params.repoRoot, params.tmpDir);
-    console.log("[DEBUG] Step 2/7: showSchemaDiff done");
-    console.log("[DEBUG] Step 2.5/7: checkIfInitialDeployment...");
-    const initialDeploymentCheck = checkIfInitialDeployment(
-      params.repoRoot,
-      inputs.productionDatabaseUrlAdmin
-    );
-    console.log(
-      `[DEBUG] Step 2.5/7: checkIfInitialDeployment done (isInitial=${initialDeploymentCheck.isInitialDeployment}, tables=${initialDeploymentCheck.tableCount})`
-    );
-    if (initialDeploymentCheck.checkSuccessful) {
-      if (initialDeploymentCheck.isInitialDeployment) {
-        params.logger.info(`Initial deployment detected: ${initialDeploymentCheck.reason}`);
-      } else {
-        params.logger.info(
-          `Existing deployment: ${initialDeploymentCheck.tableCount} table(s) found`
-        );
-      }
-    } else {
-      params.logger.warn(
-        `Initial deployment check failed: ${initialDeploymentCheck.reason}. Proceeding with risk analysis.`
-      );
-    }
-    const skipViaEnv = process.env.RUNA_SKIP_SCHEMA_RISK === "1" || process.env.RUNA_SKIP_SCHEMA_RISK === "true";
-    const skipViaAutoDetect = initialDeploymentCheck.checkSuccessful && initialDeploymentCheck.isInitialDeployment;
-    const shouldSkipRisks = params.options.skipRisks === true || params.options.initialDeployment === true || skipViaEnv || skipViaAutoDetect;
-    if (shouldSkipRisks) {
-      const skipReason = params.options.skipRisks ? "--skip-risks flag" : params.options.initialDeployment ? "--initial-deployment flag" : skipViaEnv ? "RUNA_SKIP_SCHEMA_RISK env" : `auto-detected initial deployment (${initialDeploymentCheck.reason})`;
-      console.log(`[DEBUG] Step 3/7: detectRisks SKIPPED (${skipReason})`);
-      params.logger.info(`Risk detection skipped: ${skipReason}`);
-    } else {
-      console.log("[DEBUG] Step 3/7: detectRisks...");
-      await detectRisks(params.repoRoot, params.tmpDir);
-      console.log("[DEBUG] Step 3/7: detectRisks done");
-    }
-    console.log("[DEBUG] Step 4/7: snapshotCreate...");
-    await snapshotCreate(
-      params.repoRoot,
-      params.tmpDir,
-      inputs.productionDatabaseUrlAdmin,
-      inputs.githubSha
-    );
-    console.log("[DEBUG] Step 4/7: snapshotCreate done");
-    console.log("[DEBUG] Step 5/7: repairTimestampInvariants...");
-    await repairTimestampInvariants({
-      repoRoot: params.repoRoot,
-      tmpDir: params.tmpDir,
-      databaseUrl: inputs.productionDatabaseUrlAdmin,
-      labelPrefix: "production"
-    });
-    console.log("[DEBUG] Step 5/7: repairTimestampInvariants done");
-    console.log("[DEBUG] Step 6/7: applyProductionSchema...");
-    let schemaApplyResult;
-    try {
-      schemaApplyResult = await applyProductionSchema(
-        params.repoRoot,
-        params.tmpDir,
-        inputs.productionDatabaseUrlAdmin,
-        // DDL operations (pg-schema-diff)
-        inputs.productionDatabaseUrl,
-        // App verification (drizzle_app)
-        {
-          allowDataLoss: params.options.allowDataLoss === true,
-          confirmAuthzUpdate: params.options.confirmAuthzUpdate === true,
-          maxLockWaitMs: typeof params.options.maxLockWaitMs === "number" ? params.options.maxLockWaitMs : void 0
-        }
-      );
-      console.log(
-        `[DEBUG] Step 6/7: applyProductionSchema done (${schemaApplyResult.changeSummary})`
-      );
-    } catch (applyError) {
-      params.logger.error("Schema apply failed; attempting rollback from snapshot");
-      await snapshotRestoreLatest(
-        params.repoRoot,
-        params.tmpDir,
-        inputs.productionDatabaseUrlAdmin
-      );
-      throw applyError;
-    }
-    console.log("[DEBUG] Step 7a/7: auditRecord...");
-    try {
-      await auditRecord(params.repoRoot, params.tmpDir, inputs.productionDatabaseUrlAdmin, {
-        commit: inputs.githubSha,
-        author: inputs.githubActor
-      });
-      console.log("[DEBUG] Step 7a/7: auditRecord done");
-    } catch (auditError) {
-      console.log("[DEBUG] Step 7a/7: auditRecord failed (non-blocking)");
-      params.logger.warn(
-        auditError instanceof Error ? auditError.message : "Audit record failed (best-effort)"
-      );
-    }
-    console.log("[DEBUG] Step 7b/7: maybeNotifyExternal...");
-    await maybeNotifyExternal({
+    const workflow = new CiProdApplyWorkflow({
+      options: params.options,
       logger: params.logger,
+      summary: params.summary,
       repoRoot: params.repoRoot,
       tmpDir: params.tmpDir,
-      githubRepository: inputs.githubRepository,
-      githubSha: inputs.githubSha,
-      skipNotify: params.options.skipNotify === true
+      inputs
     });
-    console.log("[DEBUG] Step 7b/7: maybeNotifyExternal done");
-    console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment...");
-    await maybeAddGithubLabelAndComment({
-      mode: params.summary.mode,
-      skipGithubLabel: params.options.skipGithubLabel === true,
-      githubSha: inputs.githubSha,
-      schemaApplyResult
-    });
-    console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment done");
-    console.log("[DEBUG] All steps complete, writing summary...");
+    await workflow.run();
     params.summary.status = "success";
     params.summary.endedAt = (/* @__PURE__ */ new Date()).toISOString();
     params.summary.durationMs = new Date(params.summary.endedAt).getTime() - new Date(params.summary.startedAt).getTime();
@@ -27085,7 +27155,7 @@ function parseGitHubUrl(url) {
     }
   }
   const parts = cleanUrl.split("/");
-  if (parts.length === 2 && !cleanUrl.includes(".")) {
+  if (parts.length === 2) {
     const owner = parts[0];
     const repo = parts[1];
     if (isValidGitHubOwner(owner) && isValidGitHubRepo(repo)) {
@@ -30025,7 +30095,7 @@ init_esm_shims();
 
 // src/constants/versions.ts
 init_esm_shims();
-var COMPATIBLE_TEMPLATES_VERSION = "0.5.43";
+var COMPATIBLE_TEMPLATES_VERSION = "0.5.44";
 var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
 var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
 
@@ -34777,8 +34847,9 @@ var testIntegrationCommand = new Command("test:integration").description("Run La
 
 // src/commands/test/commands/test-layer.ts
 init_esm_shims();
-function injectTestAttrsIfLayer4(layer, verbose) {
+function injectTestAttrsIfLayer4(layer, options) {
   if (layer !== 4) return;
+  const { verbose, requireManifest } = options ?? {};
   try {
     if (verbose) {
       console.log("[Layer 4] Auto-injecting XState test attributes...");
@@ -34790,14 +34861,30 @@ function injectTestAttrsIfLayer4(layer, verbose) {
     if (verbose) {
       console.log("[Layer 4] Test attributes injected successfully");
     }
-  } catch {
+  } catch (error) {
+    if (requireManifest) {
+      throw new CLIError(
+        "XState test attribute injection failed",
+        "INJECT_TEST_ATTRS_FAILED",
+        [
+          "Run `runa inject-test-attrs` manually to see detailed errors",
+          "Ensure XState machines exist in your project",
+          "Check that machines have valid meta.e2e definitions",
+          "Or remove --require-manifest flag to continue with fallback behavior"
+        ],
+        error instanceof Error ? error : void 0
+      );
+    }
     if (verbose) {
       console.warn("[Layer 4] Test attribute injection failed, continuing with tests");
     }
   }
 }
 async function runSingleLayer(params) {
-  injectTestAttrsIfLayer4(params.layer, params.options.verbose);
+  injectTestAttrsIfLayer4(params.layer, {
+    verbose: params.options.verbose,
+    requireManifest: params.options.requireManifest
+  });
   try {
     const output3 = await runTest({
       layer: params.layer,
@@ -34813,6 +34900,7 @@ async function runSingleLayer(params) {
       reviewSnapshots: params.options.reviewSnapshots,
       forceRegenerate: params.options.force,
       skipGeneration: params.options.skipGeneration,
+      requireManifest: params.options.requireManifest,
       invokedAs: `runa test:layer${params.layer}`
     });
     emitJsonSuccess(params.cmd, TestRunOutputSchema, output3);
@@ -34875,10 +34963,16 @@ function createLayerCommand(layer) {
     await runSingleLayer({ cmd, layer, options });
   });
   if (layer === 3) {
-    cmd.option("--skip-generation", "Skip auto-generation of API tests (run manual tests only)");
+    cmd.option("--skip-generation", "Skip auto-generation of API tests (run manual tests only)").option(
+      "--require-manifest",
+      "Require manifest to be present and valid (fail if missing or stale)"
+    );
   }
   if (layer >= 4) {
-    cmd.option("--generate", "Generate tests from XState before running (Layer 4)").option("--advanced", "Generate advanced tests (requires --generate)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--update-snapshots", "Update visual baselines (Layer 4)").option("--filter <pattern>", 'Filter tests by pattern (e.g., "checkout-*")').option("--review-snapshots", "Interactive review of changed visual snapshots (Layer 4)").option("--force", "Force regenerate all tests, bypassing cache");
+    cmd.option("--generate", "Generate tests from XState before running (Layer 4)").option("--advanced", "Generate advanced tests (requires --generate)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--update-snapshots", "Update visual baselines (Layer 4)").option("--filter <pattern>", 'Filter tests by pattern (e.g., "checkout-*")').option("--review-snapshots", "Interactive review of changed visual snapshots (Layer 4)").option("--force", "Force regenerate all tests, bypassing cache").option(
+      "--require-manifest",
+      "Require manifest to be present and valid (fail if missing or stale)"
+    );
   }
   return cmd;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.43",
+  "version": "0.5.44",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -53,7 +53,7 @@
     "typescript": "5.9.3",
     "xstate": "5.25.0",
     "zod": "4.3.5",
-    "@runa-ai/runa": "0.5.43",
+    "@runa-ai/runa": "0.5.44",
     "@runa-ai/runa-xstate-test-plugin": "0.5.35"
   },
   "engines": {