@runa-ai/runa-cli 0.5.51 → 0.5.53

package/dist/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import * as path10 from 'path';
-import path10__default, { join, dirname, resolve, relative, basename, sep, isAbsolute, normalize } from 'path';
+import * as path11 from 'path';
+import path11__default, { join, dirname, resolve, relative, basename, sep, isAbsolute, normalize } from 'path';
 import { fileURLToPath } from 'url';
-import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import * as fs5 from 'fs';
 import fs5__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, renameSync, promises, lstatSync, accessSync, constants, chmodSync, unlinkSync } from 'fs';
+import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, SUPABASE_SYSTEM_SCHEMAS, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, DATABASE_PACKAGE_CANDIDATES, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
 import fs9, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir, lstat } from 'fs/promises';
@@ -33,7 +33,7 @@ import { createJiti } from 'jiti';
 import ora from 'ora';
 import { stdout, stdin } from 'process';
 import * as readline from 'readline/promises';
-import { clearInjectionRegistry, clearUnifiedRegistry, postProcessRegistries, isPageFile, collectPageInfo, isLayoutFile, collectLayoutInfo, isApiRouteFile, collectApiRouteInfo, isMiddlewareFile, collectAuthBoundaries, hasMachineDefinition, collectMachineDefinition, getInjectionRegistry, buildManifest, getAllMachineDefinitions, generateSelectorTypeScript, getUnifiedRegistry, buildMachineLinks, createReadAndParseFile, createResolveImportPath, transformSync, registerInjection } from '@runa-ai/runa-xstate-test-plugin/standalone';
+import { clearInjectionRegistry, clearUnifiedRegistry, postProcessRegistries, isPageFile, collectPageInfo, isLayoutFile, collectLayoutInfo, isApiRouteFile, collectApiRouteInfo, isMiddlewareFile, collectAuthBoundaries, hasMachineDefinition, collectMachineDefinition, createReadAndParseFile, createResolveImportPath, transformSync, getInjectionRegistry, buildManifest, getAllMachineDefinitions, generateSelectorTypeScript, getUnifiedRegistry, buildMachineLinks, registerInjection } from '@runa-ai/runa-xstate-test-plugin/standalone';
 import { listSessions, formatDuration as formatDuration$2, cleanupStaleSessions, removeSession, isSessionCheckDisabled, getCurrentSessionId, checkActiveSessions, createSession, addActivity, checkConflicts, formatConflictDetails } from '@runa-ai/runa/session';
 import { render, Box, Text } from 'ink';
 import Spinner from 'ink-spinner';
@@ -73,10 +73,230 @@ var getFilename, getDirname, __dirname$1;
 var init_esm_shims = __esm({
   "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.6_tsx@4.21.0_typescript@5.9.3_yaml@2.8.2/node_modules/tsup/assets/esm_shims.js"() {
     getFilename = () => fileURLToPath(import.meta.url);
-    getDirname = () => path10__default.dirname(getFilename());
+    getDirname = () => path11__default.dirname(getFilename());
     __dirname$1 = /* @__PURE__ */ getDirname();
   }
 });
+function isValidPort(value) {
+  if (typeof value !== "number") {
+    return false;
+  }
+  return Number.isInteger(value) && value > 0 && value < 65536;
+}
+function asPort(value, fallback) {
+  const parsed = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
+  return isValidPort(parsed) ? parsed : fallback;
+}
+function asHost(value) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function getStatusValue(status, keys) {
+  for (const key of keys) {
+    const value = status[key];
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return null;
+}
+function extractHost(rawUrl) {
+  if (!rawUrl) return null;
+  try {
+    return new URL(rawUrl).hostname;
+  } catch {
+    return null;
+  }
+}
+function extractPort(rawUrl) {
+  if (!rawUrl) return null;
+  try {
+    const port = new URL(rawUrl).port;
+    if (!port) return null;
+    const parsed = Number.parseInt(port, 10);
+    return isValidPort(parsed) ? parsed : null;
+  } catch {
+    const match = rawUrl.match(/:(\d+)\//);
+    if (!match) return null;
+    const parsed = Number.parseInt(match[1], 10);
+    return isValidPort(parsed) ? parsed : null;
+  }
+}
+function parseTomlPort(content, section, key) {
+  const sectionRegex = new RegExp(`\\[${section}\\]([\\s\\S]*?)(?=\\n\\[|$)`, "m");
+  const sectionMatch = sectionRegex.exec(content);
+  if (!sectionMatch) return null;
+  const sectionContent = sectionMatch[1];
+  const keyRegex = new RegExp(`^\\s*${key}\\s*=\\s*(\\d+)`, "m");
+  const keyMatch = keyRegex.exec(sectionContent);
+  if (!keyMatch) return null;
+  const parsed = Number.parseInt(keyMatch[1], 10);
+  return isValidPort(parsed) ? parsed : null;
+}
+function parseTomlPorts(configRoot) {
+  const configPath = path11__default.join(configRoot, "supabase", "config.toml");
+  if (!existsSync(configPath)) return null;
+  try {
+    const content = readFileSync(configPath, "utf-8");
+    return {
+      api: parseTomlPort(content, "api", "port"),
+      db: parseTomlPort(content, "db", "port")
+    };
+  } catch {
+    return null;
+  }
+}
+function detectStatus(projectRoot) {
+  try {
+    const result = spawnSync("supabase", ["status", "--output", "json"], {
+      cwd: projectRoot,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    if (result.status !== 0 || !result.stdout) return null;
+    const jsonMatch = result.stdout.match(/\{[\s\S]*\}/);
+    if (!jsonMatch) return null;
+    return JSON.parse(jsonMatch[0]);
+  } catch {
+    return null;
+  }
+}
+function resolveSupabaseRoot(projectRoot) {
+  const start = path11__default.resolve(projectRoot);
+  let current = start;
+  while (true) {
+    if (existsSync(path11__default.join(current, "supabase", "config.toml"))) {
+      return current;
+    }
+    const parent = path11__default.dirname(current);
+    if (parent === current) {
+      return start;
+    }
+    current = parent;
+  }
+}
+function isAllowedLocalhostHost(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
+}
+function readSupabaseOverrides() {
+  return {
+    host: asHost(process.env.LOCAL_SUPABASE_HOST),
+    api: asPort(process.env.LOCAL_SUPABASE_API_PORT, DEFAULT_API_PORT),
+    db: asPort(process.env.LOCAL_SUPABASE_DB_PORT, DEFAULT_DB_PORT),
+    studio: asPort(process.env.LOCAL_SUPABASE_STUDIO_PORT, DEFAULT_STUDIO_PORT)
+  };
+}
+function detectLocalSupabasePorts(projectRoot = process.cwd()) {
+  const resolvedRoot = resolveSupabaseRoot(projectRoot);
+  const overrides = readSupabaseOverrides();
+  const status = detectStatus(resolvedRoot);
+  const tomlPorts = parseTomlPorts(resolvedRoot);
+  const statusApiUrl = status ? getStatusValue(status, ["API_URL", "API URL", "api_url"]) : null;
+  const statusDbUrl = status ? getStatusValue(status, ["DB_URL", "DB URL", "db_url"]) : null;
+  const statusStudioUrl = status ? getStatusValue(status, ["STUDIO_URL", "Studio URL", "studio_url"]) : null;
+  const detectedHost = asHost(
+    overrides.host ?? extractHost(statusApiUrl) ?? extractHost(statusDbUrl) ?? extractHost(statusStudioUrl)
+  );
+  const detectedApiPort = asPort(
+    overrides.api !== DEFAULT_API_PORT ? overrides.api : void 0,
+    extractPort(statusApiUrl) ?? tomlPorts?.api ?? DEFAULT_API_PORT
+  );
+  const detectedDbPort = asPort(
+    overrides.db !== DEFAULT_DB_PORT ? overrides.db : void 0,
+    extractPort(statusDbUrl) ?? tomlPorts?.db ?? DEFAULT_DB_PORT
+  );
+  const detectedStudioPort = asPort(
+    overrides.studio !== DEFAULT_STUDIO_PORT ? overrides.studio : void 0,
+    extractPort(statusStudioUrl) ?? detectedApiPort + 2
+  );
+  return {
+    host: detectedHost ?? DEFAULT_HOST,
+    api: detectedApiPort,
+    db: detectedDbPort,
+    studio: detectedStudioPort
+  };
+}
+function buildLocalSupabaseUrl(projectRoot = process.cwd()) {
+  const config = detectLocalSupabasePorts(projectRoot);
+  return `http://${config.host}:${config.api}`;
+}
+function buildLocalDatabaseUrl(projectRoot = process.cwd()) {
+  const config = detectLocalSupabasePorts(projectRoot);
+  return `postgresql://postgres:postgres@${config.host}:${config.db}/postgres`;
+}
+function getLocalSupabaseEnvValues(projectRoot = process.cwd()) {
+  const config = detectLocalSupabasePorts(projectRoot);
+  const supabaseUrl = buildLocalSupabaseUrl(projectRoot);
+  const databaseUrl = buildLocalDatabaseUrl(projectRoot);
+  return {
+    LOCAL_SUPABASE_HOST: config.host,
+    LOCAL_SUPABASE_API_PORT: String(config.api),
+    LOCAL_SUPABASE_DB_PORT: String(config.db),
+    DATABASE_URL: databaseUrl,
+    DATABASE_URL_ADMIN: databaseUrl,
+    DATABASE_URL_SERVICE: databaseUrl,
+    NEXT_PUBLIC_SUPABASE_URL: supabaseUrl,
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: LOCAL_SUPABASE_ANON_KEY,
+    SUPABASE_SERVICE_ROLE_KEY: LOCAL_SUPABASE_SERVICE_ROLE_KEY
+  };
+}
+function getLocalValueDescriptions(projectRoot = process.cwd()) {
+  const config = detectLocalSupabasePorts(projectRoot);
+  return {
+    LOCAL_SUPABASE_HOST: `supabase local host ${config.host}`,
+    LOCAL_SUPABASE_API_PORT: `supabase local api port ${config.api}`,
+    LOCAL_SUPABASE_DB_PORT: `supabase local db port ${config.db}`,
+    DATABASE_URL: `supabase local DB ${config.host}:${config.db}`,
+    DATABASE_URL_ADMIN: `supabase local DB ${config.host}:${config.db}`,
+    DATABASE_URL_SERVICE: `supabase local DB ${config.host}:${config.db}`,
+    NEXT_PUBLIC_SUPABASE_URL: `supabase local API ${config.host}:${config.api}`,
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: "local anon key (supabase-demo)",
+    SUPABASE_SERVICE_ROLE_KEY: "local service key (supabase-demo)"
+  };
+}
+function validateLocalhostValues(envValues) {
+  const urlKeys = [
+    "DATABASE_URL",
+    "DATABASE_URL_ADMIN",
+    "DATABASE_URL_SERVICE",
+    "NEXT_PUBLIC_SUPABASE_URL"
+  ];
+  const invalidEntries = [];
+  for (const key of urlKeys) {
+    const value = envValues[key];
+    if (!value) continue;
+    try {
+      const hostname = new URL(value).hostname;
+      if (!isAllowedLocalhostHost(hostname)) {
+        invalidEntries.push(key);
+      }
+    } catch {
+      invalidEntries.push(key);
+    }
+  }
+  if (invalidEntries.length > 0) {
+    throw new Error(
+      `Local Supabase replacement aborted: not a local endpoint. The following keys are not local: ${invalidEntries.join(", ")}`
+    );
+  }
+}
+var DEFAULT_HOST, DEFAULT_API_PORT, DEFAULT_DB_PORT, DEFAULT_STUDIO_PORT, LOCAL_SUPABASE_ANON_KEY, LOCAL_SUPABASE_SERVICE_ROLE_KEY, LOCAL_SUPABASE_ENV_VALUES;
+var init_local_supabase = __esm({
+  "src/commands/env/constants/local-supabase.ts"() {
+    init_esm_shims();
+    DEFAULT_HOST = "127.0.0.1";
+    DEFAULT_API_PORT = 54321;
+    DEFAULT_DB_PORT = 54322;
+    DEFAULT_STUDIO_PORT = 54323;
+    LOCAL_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0";
+    LOCAL_SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImV4cCI6MTk4MzgxMjk5Nn0.EGIM96RAZx35lJzdJsyH-qQwv8Hdp7fsn3W0YpN81IU";
+    LOCAL_SUPABASE_ENV_VALUES = getLocalSupabaseEnvValues();
+    getLocalValueDescriptions();
+    validateLocalhostValues(LOCAL_SUPABASE_ENV_VALUES);
+  }
+});
 
 // src/commands/db/constants.ts
 var constants_exports = {};
@@ -113,7 +333,7 @@ function detectSupabasePorts(projectRoot) {
   const apiUrl = status.API_URL || status["API URL"] || status.api_url;
   const dbUrl = status.DB_URL || status["DB URL"] || status.db_url;
   const studioUrl = status.STUDIO_URL || status["Studio URL"] || status.studio_url;
-  const extractPort = (url) => {
+  const extractPort2 = (url) => {
     try {
       const parsed = new URL(url);
       return parsed.port ? Number.parseInt(parsed.port, 10) : null;
@@ -122,28 +342,38 @@ function detectSupabasePorts(projectRoot) {
       return match ? Number.parseInt(match[1], 10) : null;
     }
   };
-  const apiPort = apiUrl ? extractPort(apiUrl) : null;
-  const dbPort = dbUrl ? extractPort(dbUrl) : null;
-  const studioPort = studioUrl ? extractPort(studioUrl) : null;
+  const apiPort = apiUrl ? extractPort2(apiUrl) : null;
+  const dbPort = dbUrl ? extractPort2(dbUrl) : null;
+  const studioPort = studioUrl ? extractPort2(studioUrl) : null;
   if (!apiPort || !dbPort) {
     throw new Error(
       "Could not detect Supabase ports from status output.\n\nTry restarting Supabase: supabase stop && supabase start"
     );
   }
-  return { api: apiPort, db: dbPort, studio: studioPort ?? apiPort + 2 };
+  return {
+    api: apiPort,
+    db: dbPort,
+    studio: studioPort ?? apiPort + 2
+  };
 }
 function getSupabaseAccessPoints(projectRoot) {
-  const ports = detectSupabasePorts(projectRoot);
+  const ports = detectLocalSupabasePorts(projectRoot);
+  const buildSupabaseUrl = (port) => {
+    const url = new URL(buildLocalSupabaseUrl(projectRoot));
+    url.port = String(port);
+    return url.toString().replace(/\/$/, "");
+  };
   return {
-    studio: `http://127.0.0.1:${ports.studio}`,
-    api: `http://127.0.0.1:${ports.api}`,
-    db: `postgresql://postgres:postgres@127.0.0.1:${ports.db}/postgres`
+    studio: buildSupabaseUrl(ports.studio),
+    api: buildLocalSupabaseUrl(projectRoot),
+    db: buildLocalDatabaseUrl(projectRoot)
   };
 }
 var DATABASE_DEFAULTS, SEED_DEFAULTS, SCRIPT_LOCATIONS, ERROR_MESSAGES;
 var init_constants = __esm({
   "src/commands/db/constants.ts"() {
     init_esm_shims();
+    init_local_supabase();
     DATABASE_DEFAULTS = {
       // Supabase Local defaults (for development)
       // Note: PORT is detected from running Supabase instance
@@ -152,7 +382,9 @@ var init_constants = __esm({
       // This is a documented public value, not a secret.
       // Production uses environment variables via .env.production.
       SUPABASE_LOCAL: {
-        HOST: "127.0.0.1",
+        get HOST() {
+          return detectLocalSupabasePorts().host;
+        },
         get PORT() {
           return detectSupabasePorts().db;
         },
@@ -186,15 +418,15 @@ var init_constants = __esm({
         if (databaseUrl) {
           try {
             const url2 = new URL(databaseUrl);
-            const isLocalhost = url2.hostname === "127.0.0.1" || url2.hostname === "localhost";
+            const isLocalhost = url2.hostname === "127.0.0.1" || url2.hostname === "localhost" || url2.hostname === "host.docker.internal";
             if (isLocalhost) {
               return databaseUrl;
             }
           } catch {
           }
         }
-        const host = process.env.LOCAL_DB_HOST || process.env.DB_HOST || this.SUPABASE_LOCAL.HOST;
-        const port = process.env.LOCAL_DB_PORT || process.env.DB_PORT || String(this.SUPABASE_LOCAL.PORT);
+        const host = process.env.LOCAL_DB_HOST || process.env.DB_HOST || process.env.LOCAL_SUPABASE_HOST || this.SUPABASE_LOCAL.HOST;
+        const port = process.env.LOCAL_DB_PORT || process.env.DB_PORT || process.env.LOCAL_SUPABASE_DB_PORT || String(this.SUPABASE_LOCAL.PORT);
         const user = process.env.LOCAL_DB_USER || process.env.DB_USER || this.SUPABASE_LOCAL.USER;
         const password = process.env.LOCAL_DB_PASSWORD || process.env.DB_PASSWORD || this.SUPABASE_LOCAL.PASSWORD;
         const database = process.env.LOCAL_DB_NAME || process.env.DB_NAME || this.SUPABASE_LOCAL.DATABASE;
@@ -748,11 +980,11 @@ function validateRunaConfig(config) {
   };
 }
 function hasValidDatabaseIndicators(dir) {
-  const hasPrimaryIndicator = existsSync(path10__default.join(dir, "drizzle.config.ts")) || existsSync(path10__default.join(dir, "supabase", "schemas")) || existsSync(path10__default.join(dir, "src", "schema")) || existsSync(path10__default.join(dir, "scripts", "db-sync.ts"));
+  const hasPrimaryIndicator = existsSync(path11__default.join(dir, "drizzle.config.ts")) || existsSync(path11__default.join(dir, "supabase", "schemas")) || existsSync(path11__default.join(dir, "src", "schema")) || existsSync(path11__default.join(dir, "scripts", "db-sync.ts"));
   if (hasPrimaryIndicator) {
     return true;
   }
-  const pkgJsonPath = path10__default.join(dir, "package.json");
+  const pkgJsonPath = path11__default.join(dir, "package.json");
   if (existsSync(pkgJsonPath)) {
     try {
       const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
@@ -768,15 +1000,15 @@ function hasValidDatabaseIndicators(dir) {
 function tryResolveFromConfig(cwd) {
   try {
     const loaded = loadRunaConfigOrThrow(cwd);
-    const configDir = path10__default.dirname(loaded.configPath);
+    const configDir = path11__default.dirname(loaded.configPath);
     const config = loaded.config;
     if (config.project.monorepo === false && hasValidDatabaseIndicators(configDir)) {
       return configDir;
     }
     const dbConfig = getDatabaseConfig(config);
     const schemaPath = dbConfig.schemaPath;
-    const dbPath = schemaPath.includes("/src/") ? schemaPath.split("/src/")[0] : schemaPath.startsWith("src/") ? "." : path10__default.dirname(schemaPath);
-    const fullPath = dbPath === "." ? configDir : path10__default.join(configDir, dbPath);
+    const dbPath = schemaPath.includes("/src/") ? schemaPath.split("/src/")[0] : schemaPath.startsWith("src/") ? "." : path11__default.dirname(schemaPath);
+    const fullPath = dbPath === "." ? configDir : path11__default.join(configDir, dbPath);
     return existsSync(fullPath) ? fullPath : null;
   } catch {
     return null;
@@ -789,9 +1021,9 @@ async function getDatabasePackagePath(cwd = process.cwd()) {
   if (dbPackage) return dbPackage;
   const baseDir = findWorkspaceRoot(cwd) || cwd;
   const conventionalPaths = [
-    path10__default.join(baseDir, "packages", "database"),
-    path10__default.join(baseDir, "packages", "db"),
-    path10__default.join(baseDir, "db"),
+    path11__default.join(baseDir, "packages", "database"),
+    path11__default.join(baseDir, "packages", "db"),
+    path11__default.join(baseDir, "db"),
     baseDir
   ];
   for (const candidate of conventionalPaths) {
@@ -822,14 +1054,14 @@ Solutions:
 async function getSDKScriptsPath(cwd = process.cwd()) {
   const sdkPackage = findPackage("sdk", cwd);
   if (sdkPackage) {
-    const scriptsPath = path10__default.join(sdkPackage, "scripts");
+    const scriptsPath = path11__default.join(sdkPackage, "scripts");
     if (existsSync(scriptsPath)) {
       return scriptsPath;
     }
   }
   const workspaceRoot = findWorkspaceRoot(cwd);
   const baseDir = workspaceRoot || cwd;
-  const installedPath = path10__default.join(baseDir, "node_modules", "@runa-ai", "runa", "scripts");
+  const installedPath = path11__default.join(baseDir, "node_modules", "@runa-ai", "runa", "scripts");
   if (existsSync(installedPath)) {
     return installedPath;
   }
@@ -840,14 +1072,14 @@ async function getSDKScriptsPath(cwd = process.cwd()) {
 async function getSDKTemplatesPath(cwd = process.cwd()) {
   const sdkPackage = findPackage("sdk", cwd);
   if (sdkPackage) {
-    const templatesPath = path10__default.join(sdkPackage, "templates");
+    const templatesPath = path11__default.join(sdkPackage, "templates");
     if (existsSync(templatesPath)) {
       return templatesPath;
     }
   }
   const workspaceRoot = findWorkspaceRoot(cwd);
   const baseDir = workspaceRoot || cwd;
-  const installedPath = path10__default.join(baseDir, "node_modules", "@runa-ai", "runa", "templates");
+  const installedPath = path11__default.join(baseDir, "node_modules", "@runa-ai", "runa", "templates");
   if (existsSync(installedPath)) {
     return installedPath;
   }
@@ -929,7 +1161,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.51";
+    CLI_VERSION = "0.5.53";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -1325,7 +1557,7 @@ var init_dependency_analyzer = __esm({
       name = "DependencyAnalyzer";
       categories = ["dependency"];
       async analyze(options) {
-        const packageJsonPath = path10__default.join(options.rootDir, "package.json");
+        const packageJsonPath = path11__default.join(options.rootDir, "package.json");
         try {
           await fs9.access(packageJsonPath);
         } catch {
@@ -3079,17 +3311,17 @@ var init_typescript_analyzer = __esm({
   }
 });
 function containsPathTraversal4(inputPath) {
-  const normalized = path10__default.normalize(inputPath);
+  const normalized = path11__default.normalize(inputPath);
   if (normalized.includes("..")) return true;
   if (inputPath.includes("\0")) return true;
   return false;
 }
 function isPathWithinBoundary(filePath, boundaryDir) {
   try {
-    const resolvedFile = path10__default.resolve(filePath);
-    const resolvedBoundary = path10__default.resolve(boundaryDir);
-    const relative9 = path10__default.relative(resolvedBoundary, resolvedFile);
-    return !relative9.startsWith("..") && !path10__default.isAbsolute(relative9);
+    const resolvedFile = path11__default.resolve(filePath);
+    const resolvedBoundary = path11__default.resolve(boundaryDir);
+    const relative9 = path11__default.relative(resolvedBoundary, resolvedFile);
+    return !relative9.startsWith("..") && !path11__default.isAbsolute(relative9);
   } catch {
     return false;
   }
@@ -3098,14 +3330,14 @@ function resolvePathWithinBoundary(inputPath, boundaryDir) {
   if (containsPathTraversal4(inputPath)) {
     throw new Error(`Path contains traversal patterns: ${inputPath}`);
   }
-  const resolvedPath = path10__default.isAbsolute(inputPath) ? inputPath : path10__default.resolve(boundaryDir, inputPath);
+  const resolvedPath = path11__default.isAbsolute(inputPath) ? inputPath : path11__default.resolve(boundaryDir, inputPath);
   if (!isPathWithinBoundary(resolvedPath, boundaryDir)) {
     throw new Error(`Path is outside allowed boundary: ${inputPath}`);
   }
   return resolvedPath;
 }
 function filterPathsWithinBoundary(files, boundaryDir) {
-  const resolvedBoundary = path10__default.resolve(boundaryDir);
+  const resolvedBoundary = path11__default.resolve(boundaryDir);
   return files.filter((file) => isPathWithinBoundary(file, resolvedBoundary));
 }
 function validateGlobPatterns(patterns) {
@@ -3166,7 +3398,7 @@ var init_loader = __esm({
   }
 });
 function normalizePath(filePath) {
-  const normalized = path10__default.normalize(filePath);
+  const normalized = path11__default.normalize(filePath);
   return normalized.replace(/\\/g, "/");
 }
 function normalizeRuleId(ruleId) {
@@ -5119,6 +5351,87 @@ var BuildOutputSchema = z.object({
 // src/commands/build/machine.ts
 init_esm_shims();
 
+// src/internal/machines/index.ts
+init_esm_shims();
+
+// src/internal/machines/machine-runner.ts
+init_esm_shims();
+function getOutputOrThrow(snapshot2) {
+  const s = snapshot2;
+  if (s.output === void 0) {
+    throw new CLIError("Machine completed without output", "MACHINE_NO_OUTPUT", [
+      "Ensure the machine defines an `output:` function."
+    ]);
+  }
+  return s.output;
+}
+async function runMachine(params) {
+  const timeoutMs = params.timeoutMs ?? 10 * 60 * 1e3;
+  return new Promise((resolve12, reject) => {
+    const actor = createActor(params.machine, { input: params.input });
+    const timer = setTimeout(() => {
+      try {
+        actor.stop?.();
+      } catch {
+      }
+      reject(
+        new CLIError("Machine execution timed out", "MACHINE_TIMEOUT", [
+          `Timeout: ${timeoutMs}ms`,
+          "Consider increasing timeoutMs for long-running operations."
+        ])
+      );
+    }, timeoutMs);
+    const sub = actor.subscribe((snapshot2) => {
+      try {
+        params.onSnapshot?.(snapshot2);
+        const stateName = params.helpers.getStateName(snapshot2);
+        params.onTransition?.(stateName);
+        if (params.helpers.isComplete(snapshot2)) {
+          clearTimeout(timer);
+          sub.unsubscribe();
+          const out = getOutputOrThrow(snapshot2);
+          resolve12(out);
+        }
+      } catch (err) {
+        clearTimeout(timer);
+        sub.unsubscribe();
+        reject(err);
+      }
+    });
+    try {
+      actor.start();
+      actor.send({ type: "START" });
+    } catch (err) {
+      clearTimeout(timer);
+      sub.unsubscribe();
+      reject(err);
+    }
+  });
+}
+
+// src/internal/machines/snapshot-helpers.ts
+init_esm_shims();
+function getSnapshotStateName(snapshot2) {
+  if (typeof snapshot2.value === "string") {
+    return snapshot2.value;
+  }
+  if (!snapshot2.value || typeof snapshot2.value !== "object") {
+    return "unknown";
+  }
+  const entries = Object.entries(snapshot2.value);
+  if (entries.length === 0) {
+    return "unknown";
+  }
+  const [parent, child] = entries[0];
+  if (typeof child === "string") {
+    return `${parent}.${child}`;
+  }
+  return parent;
+}
+function isSnapshotComplete(snapshot2) {
+  return snapshot2.status === "done";
+}
+
 // src/commands/build/actors/index.ts
 init_esm_shims();
 
@@ -5329,7 +5642,7 @@ function pipeToSharedLog(params) {
 }
 async function ensureRunaTmpDir(cwd) {
   const root = cwd ?? process.cwd();
-  const dir = path10__default.join(root, ".runa", "tmp");
+  const dir = path11__default.join(root, ".runa", "tmp");
   await mkdir(dir, { recursive: true });
   return dir;
 }
@@ -5354,7 +5667,7 @@ var buildActor = fromPromise(
     const { repoRoot, tmpDir, hasTurbo, e2e, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path10__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       const buildEnv = { ...env2 };
       if (e2e) {
@@ -5363,7 +5676,7 @@ var buildActor = fromPromise(
         buildEnv.TURBO_FORCE = "true";
         console.log("  E2E mode enabled: NEXT_PUBLIC_E2E_TEST=true, TURBO_FORCE=true");
       }
-      const hasApps = existsSync(path10__default.join(repoRoot, "apps"));
+      const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
       let args;
       if (hasTurbo) {
         args = hasApps ? ["turbo", "run", "build", "--filter=./apps/*", "--filter=./packages/*"] : ["turbo", "run", "build"];
@@ -5376,7 +5689,7 @@ var buildActor = fromPromise(
         label: "build",
         command: "pnpm",
         args,
-        logFile: path10__default.join(fullTmpDir, "build.log")
+        logFile: path11__default.join(fullTmpDir, "build.log")
       });
       return {
         passed: true,
@@ -5615,7 +5928,7 @@ function deleteIfExists(fullPath, displayPath, verbose) {
 function deleteRootDirectories(repoRoot, dirs, verbose) {
   const deleted = [];
   for (const dir of dirs) {
-    const fullPath = path10__default.join(repoRoot, dir);
+    const fullPath = path11__default.join(repoRoot, dir);
     if (deleteIfExists(fullPath, dir, verbose)) {
       deleted.push(dir);
     }
@@ -5626,13 +5939,13 @@ function cleanMonorepoPackages(repoRoot, dirs, verbose) {
   const deleted = [];
   const subdirs = ["apps", "packages"];
   for (const subdir of subdirs) {
-    const subdirPath = path10__default.join(repoRoot, subdir);
+    const subdirPath = path11__default.join(repoRoot, subdir);
     if (!existsSync(subdirPath)) continue;
     const entries = __require("fs").readdirSync(subdirPath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       for (const dir of dirs) {
-        const targetPath = path10__default.join(subdirPath, entry.name, dir);
+        const targetPath = path11__default.join(subdirPath, entry.name, dir);
         const displayPath = `${subdir}/${entry.name}/${dir}`;
         if (deleteIfExists(targetPath, displayPath, verbose)) {
           deleted.push(displayPath);
@@ -5651,7 +5964,7 @@ var cleanActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, verbose = false } = input3;
     try {
-      await mkdir(path10__default.join(repoRoot, tmpDir), { recursive: true });
+      await mkdir(path11__default.join(repoRoot, tmpDir), { recursive: true });
       if (verbose) {
         console.log("Cleaning build caches...");
       }
@@ -5673,7 +5986,7 @@ var freshActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, verbose = false } = input3;
     try {
-      await mkdir(path10__default.join(repoRoot, tmpDir), { recursive: true });
+      await mkdir(path11__default.join(repoRoot, tmpDir), { recursive: true });
       if (verbose) {
         console.log("Fresh install: cleaning all caches and node_modules...");
       }
@@ -5745,7 +6058,7 @@ var dbSyncActor = fromPromise(
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path10__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       await runLogged({
         cwd: repoRoot,
@@ -5753,7 +6066,7 @@ var dbSyncActor = fromPromise(
         label: "db-sync",
         command: "pnpm",
         args: ["exec", "runa", "db", "sync", "--auto-approve"],
-        logFile: path10__default.join(fullTmpDir, "db-sync.log")
+        logFile: path11__default.join(fullTmpDir, "db-sync.log")
       });
       return {
         passed: true,
@@ -5789,7 +6102,7 @@ var manifestActor = fromPromise(
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path10__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       await runLogged({
         cwd: repoRoot,
@@ -5797,7 +6110,7 @@ var manifestActor = fromPromise(
         label: "manifest",
         command: "pnpm",
         args: ["exec", "runa", "manifest"],
-        logFile: path10__default.join(fullTmpDir, "manifest.log")
+        logFile: path11__default.join(fullTmpDir, "manifest.log")
       });
       return {
         passed: true,
@@ -6061,7 +6374,7 @@ function buildOutput(typeCheckPassed, lintPassed, typeCheckDurationMs, lintDurat
 var staticChecksActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, hasTurbo, env: env2 = process.env, skipTypes, skipLint } = input3;
-    const fullTmpDir = path10__default.join(repoRoot, tmpDir);
+    const fullTmpDir = path11__default.join(repoRoot, tmpDir);
     await mkdir(fullTmpDir, { recursive: true });
     const startTime = Date.now();
     const checksToRun = [];
@@ -6075,7 +6388,7 @@ var staticChecksActor = fromPromise(
           label: "type-check",
           command: cmd.command,
           args: cmd.args,
-          logFile: path10__default.join(fullTmpDir, "type-check.log")
+          logFile: path11__default.join(fullTmpDir, "type-check.log")
         })
       );
       checkOrder.push("type-check");
@@ -6089,7 +6402,7 @@ var staticChecksActor = fromPromise(
           label: "lint",
           command: cmd.command,
           args: cmd.args,
-          logFile: path10__default.join(fullTmpDir, "lint.log")
+          logFile: path11__default.join(fullTmpDir, "lint.log")
         })
       );
       checkOrder.push("lint");
@@ -6133,14 +6446,14 @@ var validateActor = fromPromise(
     let manifestsExist = true;
     const buildOutputPaths = [
       // Single app
-      path10__default.join(repoRoot, ".next"),
-      path10__default.join(repoRoot, "dist"),
+      path11__default.join(repoRoot, ".next"),
+      path11__default.join(repoRoot, "dist"),
       // Monorepo apps
-      path10__default.join(repoRoot, "apps", "web", ".next"),
-      path10__default.join(repoRoot, "apps", "dashboard", ".next"),
+      path11__default.join(repoRoot, "apps", "web", ".next"),
+      path11__default.join(repoRoot, "apps", "dashboard", ".next"),
       // Packages
-      path10__default.join(repoRoot, "packages", "cli", "dist"),
-      path10__default.join(repoRoot, "packages", "sdk", "dist")
+      path11__default.join(repoRoot, "packages", "cli", "dist"),
+      path11__default.join(repoRoot, "packages", "sdk", "dist")
     ];
     for (const outputPath of buildOutputPaths) {
       if (existsSync(outputPath)) {
@@ -6154,7 +6467,7 @@ var validateActor = fromPromise(
       );
     }
     if (!skipManifest) {
-      const manifestPath = path10__default.join(repoRoot, ".runa", "manifests", "manifest.json");
+      const manifestPath = path11__default.join(repoRoot, ".runa", "manifests", "manifest.json");
       if (!existsSync(manifestPath)) {
         manifestsExist = false;
         warnings.push("No manifest.json found. E2E test generation may be affected.");
@@ -6213,35 +6526,35 @@ function isE2EMode({ context }) {
   return context.input.e2e;
 }
 function detectDatabase(repoRoot) {
-  const configPath = path10__default.join(repoRoot, "runa.config.ts");
+  const configPath = path11__default.join(repoRoot, "runa.config.ts");
   if (!existsSync(configPath)) {
-    const jsConfigPath = path10__default.join(repoRoot, "runa.config.js");
+    const jsConfigPath = path11__default.join(repoRoot, "runa.config.js");
     if (!existsSync(jsConfigPath)) {
       return false;
     }
   }
-  const supabaseDir = path10__default.join(repoRoot, "supabase");
+  const supabaseDir = path11__default.join(repoRoot, "supabase");
   if (existsSync(supabaseDir)) {
     return true;
   }
-  const databasePkg = path10__default.join(repoRoot, "packages", "database");
+  const databasePkg = path11__default.join(repoRoot, "packages", "database");
   if (existsSync(databasePkg)) {
     return true;
   }
   return false;
 }
 function detectManifestTask(repoRoot) {
-  const runaConfigPath = path10__default.join(repoRoot, "runa.config.ts");
+  const runaConfigPath = path11__default.join(repoRoot, "runa.config.ts");
   if (existsSync(runaConfigPath)) {
     return true;
   }
-  const rootPkgPath = path10__default.join(repoRoot, "package.json");
+  const rootPkgPath = path11__default.join(repoRoot, "package.json");
   if (hasXStateDependency(rootPkgPath)) {
     return true;
   }
   const appDirs = ["apps/web", "apps/app", "apps/dashboard", "app"];
   for (const appDir of appDirs) {
-    const appPkgPath = path10__default.join(repoRoot, appDir, "package.json");
+    const appPkgPath = path11__default.join(repoRoot, appDir, "package.json");
     if (hasXStateDependency(appPkgPath)) {
       return true;
     }
@@ -6268,7 +6581,7 @@ function hasXStateDependency(pkgPath) {
   }
 }
 function detectTurbo(repoRoot) {
-  const turboJsonPath = path10__default.join(repoRoot, "turbo.json");
+  const turboJsonPath = path11__default.join(repoRoot, "turbo.json");
   return existsSync(turboJsonPath);
 }
 var guards = {
@@ -7118,20 +7431,10 @@ var buildMachine = setup({
   output: ({ context }) => createOutput(context)
 });
 function getStateName(snapshot2) {
-  if (typeof snapshot2.value === "string") {
-    return snapshot2.value;
-  }
-  const topLevel = Object.keys(snapshot2.value)[0];
-  if (topLevel && typeof snapshot2.value === "object") {
-    const nested = snapshot2.value[topLevel];
-    if (nested && typeof nested === "string") {
-      return `${topLevel}.${nested}`;
-    }
-  }
-  return topLevel ?? "unknown";
+  return getSnapshotStateName(snapshot2);
 }
 function isComplete(snapshot2) {
-  return snapshot2.status === "done";
+  return isSnapshotComplete(snapshot2);
 }
 
 // src/commands/build/commands/build.ts
@@ -7276,15 +7579,15 @@ function printSummary(logger16, output3) {
   }
 }
 function findRepoRoot(startDir) {
-  const { existsSync: existsSync51, readFileSync: readFileSync29 } = __require("fs");
+  const { existsSync: existsSync52, readFileSync: readFileSync29 } = __require("fs");
   const { join: join23, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync51(join23(current, "turbo.json"))) {
+    if (existsSync52(join23(current, "turbo.json"))) {
       return current;
     }
     const pkgPath = join23(current, "package.json");
-    if (existsSync51(pkgPath)) {
+    if (existsSync52(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
         if (pkg.workspaces) {
@@ -7527,42 +7830,42 @@ function resolvePolicy(_config, _repoKind) {
   };
 }
 function detectRepoKind(repoRoot) {
-  const hasApps = existsSync(path10__default.join(repoRoot, "apps"));
-  const hasPackages = existsSync(path10__default.join(repoRoot, "packages"));
-  const hasTurbo = existsSync(path10__default.join(repoRoot, "turbo.json"));
+  const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
+  const hasPackages = existsSync(path11__default.join(repoRoot, "packages"));
+  const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
   if (hasApps || hasPackages || hasTurbo) {
     return "monorepo";
   }
-  const hasSrc = existsSync(path10__default.join(repoRoot, "src"));
-  const hasApp = existsSync(path10__default.join(repoRoot, "app"));
+  const hasSrc = existsSync(path11__default.join(repoRoot, "src"));
+  const hasApp = existsSync(path11__default.join(repoRoot, "app"));
   if (hasSrc || hasApp) {
     return "pj-repo";
   }
   return "unknown";
 }
 function hasKnownFrameworkConfig(dir) {
-  if (existsSync(path10__default.join(dir, "next.config.js")) || existsSync(path10__default.join(dir, "next.config.mjs")) || existsSync(path10__default.join(dir, "next.config.ts"))) {
+  if (existsSync(path11__default.join(dir, "next.config.js")) || existsSync(path11__default.join(dir, "next.config.mjs")) || existsSync(path11__default.join(dir, "next.config.ts"))) {
     return true;
   }
-  if (existsSync(path10__default.join(dir, "vite.config.js")) || existsSync(path10__default.join(dir, "vite.config.ts"))) {
+  if (existsSync(path11__default.join(dir, "vite.config.js")) || existsSync(path11__default.join(dir, "vite.config.ts"))) {
     return true;
   }
-  if (existsSync(path10__default.join(dir, "remix.config.js"))) {
+  if (existsSync(path11__default.join(dir, "remix.config.js"))) {
     return true;
   }
-  if (existsSync(path10__default.join(dir, "astro.config.mjs")) || existsSync(path10__default.join(dir, "astro.config.ts"))) {
+  if (existsSync(path11__default.join(dir, "astro.config.mjs")) || existsSync(path11__default.join(dir, "astro.config.ts"))) {
     return true;
   }
-  if (existsSync(path10__default.join(dir, "nuxt.config.js")) || existsSync(path10__default.join(dir, "nuxt.config.ts"))) {
+  if (existsSync(path11__default.join(dir, "nuxt.config.js")) || existsSync(path11__default.join(dir, "nuxt.config.ts"))) {
     return true;
   }
-  if (existsSync(path10__default.join(dir, "svelte.config.js"))) {
+  if (existsSync(path11__default.join(dir, "svelte.config.js"))) {
     return true;
   }
   return false;
 }
 function hasPackageJson(dir) {
-  return existsSync(path10__default.join(dir, "package.json"));
+  return existsSync(path11__default.join(dir, "package.json"));
 }
 var PORT_PATTERNS = [
   /-p\s*([0-9]+)/i,
@@ -7582,7 +7885,7 @@ function extractPortFromScript(script) {
   return null;
 }
 function readPortFromScripts(appDir) {
-  const pkgPath = path10__default.join(appDir, "package.json");
+  const pkgPath = path11__default.join(appDir, "package.json");
   if (!existsSync(pkgPath)) return 3e3;
   try {
     const { readFileSync: readFileSync29 } = __require("fs");
@@ -7601,30 +7904,30 @@ function readPortFromScripts(appDir) {
   return 3e3;
 }
 function findWebAppUnderApps(repoRoot) {
-  const appsDir = path10__default.join(repoRoot, "apps");
+  const appsDir = path11__default.join(repoRoot, "apps");
   if (!existsSync(appsDir)) return null;
   try {
     const { readdirSync: readdirSync12 } = __require("fs");
     const entries = readdirSync12(appsDir, { withFileTypes: true });
     const priority = ["web", "dashboard", "app", "frontend", "client"];
     for (const name of priority) {
-      const candidate = path10__default.join(appsDir, name);
+      const candidate = path11__default.join(appsDir, name);
       if (hasKnownFrameworkConfig(candidate)) return candidate;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (priority.includes(entry.name)) continue;
-      const candidate = path10__default.join(appsDir, entry.name);
+      const candidate = path11__default.join(appsDir, entry.name);
       if (hasKnownFrameworkConfig(candidate)) return candidate;
     }
     for (const name of priority) {
-      const candidate = path10__default.join(appsDir, name);
+      const candidate = path11__default.join(appsDir, name);
       if (hasPackageJson(candidate)) return candidate;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (priority.includes(entry.name)) continue;
-      const candidate = path10__default.join(appsDir, entry.name);
+      const candidate = path11__default.join(appsDir, entry.name);
       if (hasPackageJson(candidate)) return candidate;
     }
   } catch {
@@ -7633,7 +7936,7 @@ function findWebAppUnderApps(repoRoot) {
 }
 function detectApp(repoRoot, configOverride) {
   if (configOverride?.directory && configOverride.directory !== ".") {
-    const configuredDir = path10__default.join(repoRoot, configOverride.directory);
+    const configuredDir = path11__default.join(repoRoot, configOverride.directory);
     if (existsSync(configuredDir) && hasPackageJson(configuredDir)) {
       return {
         appDir: configuredDir,
@@ -7768,7 +8071,7 @@ function pipeChildOutputToLog(params) {
   return { cleanup };
 }
 async function writeEnvLocal(params) {
-  const filePath = path10__default.join(params.appDir, ".env.local");
+  const filePath = path11__default.join(params.appDir, ".env.local");
   const content = `${Object.entries(params.values).map(([k, v]) => `${k}=${v}`).join("\n")}
 `;
   await writeFile(filePath, content, "utf-8");
@@ -7858,10 +8161,10 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
   }
   if (appHasCiScript || appHasDefaultScript) {
     const scriptName = appHasCiScript ? ciScriptName : "start";
-    const dirArgs2 = isMonorepo2 ? ["-C", path10__default.relative(repoRoot, appDir)] : [];
+    const dirArgs2 = isMonorepo2 ? ["-C", path11__default.relative(repoRoot, appDir)] : [];
     return { command: ["pnpm", ...dirArgs2, scriptName], useRootScript: false };
   }
-  const dirArgs = isMonorepo2 ? ["-C", path10__default.relative(repoRoot, appDir)] : [];
+  const dirArgs = isMonorepo2 ? ["-C", path11__default.relative(repoRoot, appDir)] : [];
   return {
     command: ["pnpm", ...dirArgs, "exec", "next", nextCommand, "-p", String(port)],
     useRootScript: false
@@ -7869,17 +8172,17 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
 }
 var NEXT_CRITICAL_FILES = ["routes-manifest.json", "build-manifest.json"];
 function cleanStaleNextDevState(appDir) {
-  const nextDir = path10__default.join(appDir, ".next");
+  const nextDir = path11__default.join(appDir, ".next");
   if (!existsSync(nextDir)) {
     return { cleaned: false };
   }
   for (const file of NEXT_CRITICAL_FILES) {
-    if (!existsSync(path10__default.join(nextDir, file))) {
+    if (!existsSync(path11__default.join(nextDir, file))) {
       cleanNextDir(nextDir, `Missing ${file}`);
       return { cleaned: true, reason: `Missing ${file}` };
     }
   }
-  const serverDir = path10__default.join(nextDir, "server");
+  const serverDir = path11__default.join(nextDir, "server");
   if (!existsSync(serverDir)) {
     try {
       const nextStat = statSync(nextDir);
@@ -7901,7 +8204,7 @@ function cleanNextDir(nextDir, reason) {
     console.log("[runa] Cleanup complete");
   } catch {
     const staleDir = `${nextDir}-stale-${Date.now()}`;
-    console.log(`[runa] Could not remove .next, quarantining to ${path10__default.basename(staleDir)}`);
+    console.log(`[runa] Could not remove .next, quarantining to ${path11__default.basename(staleDir)}`);
     try {
       renameSync(nextDir, staleDir);
     } catch {
@@ -7912,8 +8215,8 @@ function cleanNextDir(nextDir, reason) {
 async function startAppBackground(params) {
   const mode = params.mode ?? "start";
   const isMonorepo2 = params.appDir !== params.repoRoot;
-  const rootPkgPath = path10__default.join(params.repoRoot, "package.json");
-  const appPkgPath = path10__default.join(params.appDir, "package.json");
+  const rootPkgPath = path11__default.join(params.repoRoot, "package.json");
+  const appPkgPath = path11__default.join(params.appDir, "package.json");
   const rootScripts = await readPackageScripts(rootPkgPath);
   const appScripts = isMonorepo2 ? await readPackageScripts(appPkgPath) : rootScripts;
   const { command, useRootScript } = determineAppCommand(
@@ -7925,7 +8228,7 @@ async function startAppBackground(params) {
     params.appDir,
     params.port
   );
-  const appLog = path10__default.join(params.tmpDir, "app.log");
+  const appLog = path11__default.join(params.tmpDir, "app.log");
   const out = createWriteStream(appLog, { flags: "a" });
   const commandStr = command.join(" ");
   const modeLabel = mode === "dev" ? "development (hot reload)" : "production";
@@ -7934,7 +8237,7 @@ async function startAppBackground(params) {
     `[runa] Mode: ${modeLabel}`,
     `[runa] Command: ${commandStr}`,
     `[runa] Working directory: ${params.repoRoot}`,
-    `[runa] App directory: ${path10__default.relative(params.repoRoot, params.appDir) || "."}`,
+    `[runa] App directory: ${path11__default.relative(params.repoRoot, params.appDir) || "."}`,
     useRootScript ? "[runa] Using root package.json script" : "[runa] Using app package.json script",
     "---",
     ""
@@ -7955,12 +8258,12 @@ async function startAppBackground(params) {
     streamToTerminal: params.stream
   });
   const pid = child.pid ?? -1;
-  await writeFile(path10__default.join(params.tmpDir, "app.pid"), `${pid}
+  await writeFile(path11__default.join(params.tmpDir, "app.pid"), `${pid}
 `, "utf-8");
   return { pid, cleanupStreams };
 }
 async function waitForAppReady(params) {
-  const logFilePath = params.tmpDir ? path10__default.join(params.tmpDir, "app.log") : void 0;
+  const logFilePath = params.tmpDir ? path11__default.join(params.tmpDir, "app.log") : void 0;
   await waitHttpOk({
     url: `http://127.0.0.1:${params.port}/`,
     timeoutSeconds: params.timeoutSeconds,
@@ -8100,7 +8403,7 @@ var e2eMeta2 = {
 var appStartActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, appDir, port, tmpDir, stream } = input3;
-    const fullTmpDir = path10__default.join(repoRoot, tmpDir);
+    const fullTmpDir = path11__default.join(repoRoot, tmpDir);
     await mkdir(fullTmpDir, { recursive: true });
     cleanStaleNextDevState(appDir);
     const result = await startAppBackground({
@@ -8368,11 +8671,11 @@ function printSummary2(logger16, output3) {
 }
 function findRepoRoot2(startDir) {
   let current = startDir;
-  while (current !== path10__default.dirname(current)) {
-    if (existsSync(path10__default.join(current, "turbo.json"))) {
+  while (current !== path11__default.dirname(current)) {
+    if (existsSync(path11__default.join(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = path10__default.join(current, "package.json");
+    const pkgPath = path11__default.join(current, "package.json");
     if (existsSync(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
@@ -8382,7 +8685,7 @@ function findRepoRoot2(startDir) {
       } catch {
       }
     }
-    current = path10__default.dirname(current);
+    current = path11__default.dirname(current);
   }
   return startDir;
 }
@@ -8569,19 +8872,19 @@ function isSupportedNodeEnv(value) {
 function findProjectRoot(from) {
   const workspaceRoot = findWorkspaceRoot(from);
   if (workspaceRoot) return workspaceRoot;
-  let current = path10__default.resolve(from);
-  const root = path10__default.parse(current).root;
+  let current = path11__default.resolve(from);
+  const root = path11__default.parse(current).root;
   let depth = 0;
   while (current !== root && depth < MAX_DIRECTORY_TRAVERSAL_DEPTH) {
-    const hasGit = existsSync(path10__default.join(current, ".git"));
-    const hasPackageJson2 = existsSync(path10__default.join(current, "package.json"));
+    const hasGit = existsSync(path11__default.join(current, ".git"));
+    const hasPackageJson2 = existsSync(path11__default.join(current, "package.json"));
     if (hasGit || hasPackageJson2) return current;
-    const parent = path10__default.dirname(current);
+    const parent = path11__default.dirname(current);
     if (parent === current) break;
     current = parent;
     depth++;
   }
-  return path10__default.resolve(from);
+  return path11__default.resolve(from);
 }
 function mapRunaEnvToVercelEnv(runaEnv) {
   if (runaEnv === "preview") return "preview";
@@ -8622,7 +8925,7 @@ function loadEnvFiles(options = {}) {
   const nodeEnv = resolveNodeEnv(options.nodeEnv);
   const projectRoot = findProjectRoot(cwd);
   const vercelEnv = options.vercelEnv ?? inferVercelEnv({ nodeEnv, runaEnv: options.runaEnv });
-  const keysFile = path10__default.join(projectRoot, ".env.keys");
+  const keysFile = path11__default.join(projectRoot, ".env.keys");
   const baseFilePaths = buildBaseEnvFilePaths({ nodeEnv, vercelEnv });
   const runaFilePaths = options.runaEnv ? buildRunaEnvFilePaths(options.runaEnv) : [];
   const allRelPaths = [...baseFilePaths, ...runaFilePaths];
@@ -8632,7 +8935,7 @@ function loadEnvFiles(options = {}) {
     const filePaths = [
       keysFile,
       // Load keys first
-      ...allRelPaths.map((rel) => path10__default.join(projectRoot, rel)).filter(existsSync)
+      ...allRelPaths.map((rel) => path11__default.join(projectRoot, rel)).filter(existsSync)
     ];
     config({
       path: filePaths,
@@ -8641,7 +8944,7 @@ function loadEnvFiles(options = {}) {
       quiet: true
       // Suppress dotenvx verbose output
     });
-    loadedFiles = allRelPaths.filter((rel) => existsSync(path10__default.join(projectRoot, rel)));
+    loadedFiles = allRelPaths.filter((rel) => existsSync(path11__default.join(projectRoot, rel)));
   } else {
     const targetEnv = { ...process.env };
     loadedFiles = [
@@ -8716,8 +9019,8 @@ function buildRunaEnvFilePaths(runaEnv) {
 function loadEnvFilesIntoTarget(params) {
   const loadedFiles = [];
   for (const relPath of params.relPaths) {
-    const fullPath = path10__default.join(params.projectRoot, relPath);
-    const resolvedPath = path10__default.resolve(fullPath);
+    const fullPath = path11__default.join(params.projectRoot, relPath);
+    const resolvedPath = path11__default.resolve(fullPath);
     if (!isPathContained(params.projectRoot, resolvedPath)) {
       continue;
     }
@@ -8985,7 +9288,7 @@ async function runTool(params) {
         exitCode,
         issueCount,
         durationMs,
-        outputPath: path10__default.relative(process.cwd(), params.outputPath)
+        outputPath: path11__default.relative(process.cwd(), params.outputPath)
       });
     });
     proc.on("error", async () => {
@@ -9004,7 +9307,7 @@ async function runTool(params) {
         exitCode: -1,
         issueCount: 0,
         durationMs,
-        outputPath: path10__default.relative(process.cwd(), params.outputPath)
+        outputPath: path11__default.relative(process.cwd(), params.outputPath)
       });
     });
   });
@@ -9036,7 +9339,7 @@ async function executeWorkflowCheck(params) {
     label: params.label,
     command: params.command,
     args: params.args,
-    outputPath: path10__default.join(params.logDir, `${params.name}-output.txt`),
+    outputPath: path11__default.join(params.logDir, `${params.name}-output.txt`),
     parseIssueCount: params.parseIssueCount
   });
   logCheckResult(result, params.isWarningOnly ?? false);
@@ -9108,7 +9411,7 @@ async function runCiChecks(options) {
   const mode = options.mode === "github-actions" ? "github-actions" : "local";
   const isCI3 = mode === "github-actions";
   const workflowsChanged = options.workflowsChanged;
-  const logDir = path10__default.join(process.cwd(), ".runa", "tmp", "workflow");
+  const logDir = path11__default.join(process.cwd(), ".runa", "tmp", "workflow");
   await mkdir(logDir, { recursive: true });
   console.log("");
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
@@ -9117,7 +9420,7 @@ async function runCiChecks(options) {
   console.log("");
   const results = await executeChecks(workflowsChanged, logDir);
   const summary = buildChecksSummary(startedAt, workflowsChanged, results);
-  const summaryPath = path10__default.join(logDir, "checks-summary.json");
+  const summaryPath = path11__default.join(logDir, "checks-summary.json");
   await writeFile(summaryPath, JSON.stringify(summary, null, 2), "utf-8");
   if (isCI3) {
     await appendGithubStepSummary(buildStepSummaryMarkdown(summary));
@@ -9184,7 +9487,7 @@ function printFinalOutput(summary, summaryPath) {
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
   console.log(`${summary.status === "failure" ? "\u274C" : "\u2705"} Workflow Checks: ${summary.status}`);
   console.log(`   Duration: ${formatDuration$1(summary.durationMs)}`);
-  console.log(`   Summary: ${path10__default.relative(process.cwd(), summaryPath)}`);
+  console.log(`   Summary: ${path11__default.relative(process.cwd(), summaryPath)}`);
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
 }
 var ciChecksCommand = new Command("checks").description("Run workflow checks (actionlint, zizmor)").option("--mode <mode>", "Execution mode (github-actions | local)", "local").option("--workflows-changed", "Indicate workflows have changed", false).action(runCiChecks);
@@ -9197,10 +9500,10 @@ init_esm_shims();
 var CiConfigSchema = z.record(z.string(), z.unknown());
 async function loadCiConfig(params) {
   const override = typeof params.overridePath === "string" && params.overridePath.trim().length > 0 ? params.overridePath.trim() : null;
-  const defaultPath = path10__default.join(params.repoRoot, ".runa", "ci.config.json");
+  const defaultPath = path11__default.join(params.repoRoot, ".runa", "ci.config.json");
   const resolvedPath = override ?? (existsSync(defaultPath) ? defaultPath : null);
   if (!resolvedPath) return { configPath: null, config: null };
-  const abs = path10__default.isAbsolute(resolvedPath) ? resolvedPath : path10__default.join(params.repoRoot, resolvedPath);
+  const abs = path11__default.isAbsolute(resolvedPath) ? resolvedPath : path11__default.join(params.repoRoot, resolvedPath);
   if (!existsSync(abs)) return { configPath: abs, config: null };
   const raw = await readFile(abs, "utf-8");
   const parsed = JSON.parse(raw);
@@ -9302,9 +9605,9 @@ var CiSummarySchema = z.object({
 async function writeCiSummary(params) {
   const cwd = params.cwd ?? process.cwd();
   const parsed = CiSummarySchema.parse(params.summary);
-  const dir = path10__default.join(cwd, ".runa", "tmp");
+  const dir = path11__default.join(cwd, ".runa", "tmp");
   await mkdir(dir, { recursive: true });
-  const filePath = path10__default.join(dir, "ci-summary.json");
+  const filePath = path11__default.join(dir, "ci-summary.json");
   await writeFile(filePath, `${JSON.stringify(parsed, null, 2)}
 `, "utf-8");
   return filePath;
@@ -9509,6 +9812,89 @@ var EXCLUDED_SCHEMAS = /* @__PURE__ */ new Set([
   "pgbouncer",
   "cron"
 ]);
+function stripSqlCommentsPreserveStrings(content) {
+  let result = "";
+  let i = 0;
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inDollarQuote = false;
+  let dollarTag = "";
+  while (i < content.length) {
+    const char = content[i] ?? "";
+    const next = content[i + 1] ?? "";
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && char === "-" && next === "-") {
+      while (i < content.length && content[i] !== "\n") {
+        result += " ";
+        i++;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && char === "/" && next === "*") {
+      result += " ";
+      result += " ";
+      i += 2;
+      while (i < content.length) {
+        const blockChar = content[i] ?? "";
+        const blockNext = content[i + 1] ?? "";
+        if (blockChar === "*" && blockNext === "/") {
+          result += " ";
+          result += " ";
+          i += 2;
+          break;
+        }
+        result += blockChar === "\n" ? "\n" : " ";
+        i++;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && char === "$") {
+      if (inDollarQuote) {
+        const closeTag = `$${dollarTag}$`;
+        if (content.slice(i).startsWith(closeTag)) {
+          result += closeTag;
+          i += closeTag.length;
+          inDollarQuote = false;
+          dollarTag = "";
+          continue;
+        }
+      } else {
+        const tagMatch = content.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+        if (tagMatch) {
+          inDollarQuote = true;
+          dollarTag = tagMatch[1] ?? "";
+          result += tagMatch[0];
+          i += tagMatch[0].length;
+          continue;
+        }
+      }
+    }
+    if (!inDoubleQuote && !inDollarQuote && char === "'") {
+      if (inSingleQuote && next === "'") {
+        result += "''";
+        i += 2;
+        continue;
+      }
+      inSingleQuote = !inSingleQuote;
+      result += char;
+      i++;
+      continue;
+    }
+    if (!inSingleQuote && !inDollarQuote && char === '"') {
+      if (inDoubleQuote && next === '"') {
+        result += '""';
+        i += 2;
+        continue;
+      }
+      inDoubleQuote = !inDoubleQuote;
+      result += char;
+      i++;
+      continue;
+    }
+    result += char;
+    i++;
+  }
+  return result;
+}
 function detectAppSchemas(schemasDir, verbose) {
   const schemas = /* @__PURE__ */ new Set(["public"]);
   if (!existsSync(schemasDir)) {
@@ -9517,12 +9903,13 @@ function detectAppSchemas(schemasDir, verbose) {
   const files = readdirSync(schemasDir).filter((f) => f.endsWith(".sql"));
   for (const file of files) {
     const content = readFileSync(join(schemasDir, file), "utf-8");
-    const contentWithoutComments = content.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+    const contentWithoutComments = stripSqlCommentsPreserveStrings(content);
     const matches = contentWithoutComments.matchAll(
-      /^\s*CREATE\s+SCHEMA\s+(?:IF\s+NOT\s+EXISTS\s+)?(\w+)/gim
+      /^\s*CREATE\s+SCHEMA\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"((?:[^"]|"")*)"|([a-zA-Z_][a-zA-Z0-9_]*))/gim
     );
     for (const match of Array.from(matches)) {
-      const schemaName = match[1].toLowerCase();
+      const schemaNameRaw = (match[1] ?? match[2] ?? "").replace(/""/g, '"');
+      const schemaName = schemaNameRaw.toLowerCase();
       if (!EXCLUDED_SCHEMAS.has(schemaName)) {
         schemas.add(schemaName);
       }
@@ -9553,12 +9940,12 @@ async function detectStack(repoRoot, tmpDir, productionDbUrlAdmin) {
     label: "detect-stack",
     command: "pnpm",
     args: ["exec", "runa", "db", "detect-stack", "--quiet"],
-    logFile: path10__default.join(tmpDir, "detect-stack.log")
+    logFile: path11__default.join(tmpDir, "detect-stack.log")
   });
   return String(res.stdout ?? "").trim();
 }
 function checkIfInitialDeployment(repoRoot, productionDbUrl) {
-  const schemasDir = path10__default.join(repoRoot, "supabase", "schemas", "declarative");
+  const schemasDir = path11__default.join(repoRoot, "supabase", "schemas", "declarative");
   let schemas;
   try {
     schemas = detectAppSchemas(schemasDir, false);
@@ -9624,9 +10011,9 @@ function checkIfInitialDeployment(repoRoot, productionDbUrl) {
   }
 }
 async function showSchemaDiff(repoRoot, tmpDir) {
-  const diffLog = path10__default.join(tmpDir, "schema-diff.log");
+  const diffLog = path11__default.join(tmpDir, "schema-diff.log");
   const safeEnv = getSafeEnv();
-  const declarativeSqlPath = path10__default.join(repoRoot, "supabase/schemas/declarative");
+  const declarativeSqlPath = path11__default.join(repoRoot, "supabase/schemas/declarative");
   if (existsSync(declarativeSqlPath)) {
     await runLogged({
       cwd: repoRoot,
@@ -9640,8 +10027,8 @@ async function showSchemaDiff(repoRoot, tmpDir) {
   }
   const detected = detectDatabasePackage(repoRoot);
   if (detected) {
-    const schemaPath = path10__default.join(detected, "src", "schema");
-    if (existsSync(path10__default.join(repoRoot, schemaPath))) {
+    const schemaPath = path11__default.join(detected, "src", "schema");
+    if (existsSync(path11__default.join(repoRoot, schemaPath))) {
       await runLogged({
         cwd: repoRoot,
         env: safeEnv,
@@ -9654,8 +10041,8 @@ async function showSchemaDiff(repoRoot, tmpDir) {
     }
   }
   for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
-    const candidatePath = path10__default.join("packages", candidate, "src", "schema");
-    if (existsSync(path10__default.join(repoRoot, candidatePath))) {
+    const candidatePath = path11__default.join("packages", candidate, "src", "schema");
+    if (existsSync(path11__default.join(repoRoot, candidatePath))) {
       await runLogged({
         cwd: repoRoot,
         env: safeEnv,
@@ -9667,7 +10054,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
       return;
     }
   }
-  if (existsSync(path10__default.join(repoRoot, "src", "schema"))) {
+  if (existsSync(path11__default.join(repoRoot, "src", "schema"))) {
     await runLogged({
       cwd: repoRoot,
       env: safeEnv,
@@ -9679,7 +10066,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
   }
 }
 async function detectRisks(repoRoot, tmpDir) {
-  const logFile = path10__default.join(tmpDir, "db-risks.log");
+  const logFile = path11__default.join(tmpDir, "db-risks.log");
   try {
     const env2 = getFilteredEnv();
     await runLogged({
@@ -9725,7 +10112,7 @@ async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit) {
     label: "snapshot create production",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "create", "production", "--commit", commit],
-    logFile: path10__default.join(tmpDir, "snapshot-create.log")
+    logFile: path11__default.join(tmpDir, "snapshot-create.log")
   });
 }
 async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
@@ -9738,7 +10125,7 @@ async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
     label: "snapshot restore production (latest)",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "restore", "production", "--latest", "--auto-approve"],
-    logFile: path10__default.join(tmpDir, "snapshot-restore.log")
+    logFile: path11__default.join(tmpDir, "snapshot-restore.log")
   });
 }
 function parseApplyLog(logContent) {
@@ -9802,7 +10189,7 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   if (options?.maxLockWaitMs !== void 0) {
     args.push("--max-lock-wait-ms", String(options.maxLockWaitMs));
   }
-  const logPath = path10__default.join(tmpDir, "db-apply-production.log");
+  const logPath = path11__default.join(tmpDir, "db-apply-production.log");
   const startTime = Date.now();
   await runLogged({
     cwd: repoRoot,
@@ -9847,11 +10234,11 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
     label: "git log (commit message)",
     command: "git",
     args: ["log", "-1", "--pretty=format:%s"],
-    logFile: path10__default.join(tmpDir, "git-commit-message.log")
+    logFile: path11__default.join(tmpDir, "git-commit-message.log")
   });
   const commitMsg = String(msg.stdout ?? "").trim();
   const schemaPaths = [];
-  const declarativeSqlPath = path10__default.join(repoRoot, "supabase/schemas/declarative");
+  const declarativeSqlPath = path11__default.join(repoRoot, "supabase/schemas/declarative");
   if (existsSync(declarativeSqlPath)) {
     schemaPaths.push("supabase/schemas/declarative/");
   } else {
@@ -9871,7 +10258,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
     label: "git diff (schema)",
     command: "git",
     args: ["diff", "origin/main", "HEAD", "--", ...schemaPaths],
-    logFile: path10__default.join(tmpDir, "git-schema-diff.log")
+    logFile: path11__default.join(tmpDir, "git-schema-diff.log")
   });
   const diffRaw = String(diff.stdout ?? "");
   const diffLimited = diffRaw.length > 1e4 ? diffRaw.slice(0, 1e4) : diffRaw;
@@ -9900,7 +10287,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
       "--environment",
       "production"
     ],
-    logFile: path10__default.join(tmpDir, "db-audit-record.log")
+    logFile: path11__default.join(tmpDir, "db-audit-record.log")
   });
 }
 async function notifyDeployment(repoRoot, tmpDir, params) {
@@ -9928,7 +10315,7 @@ async function notifyDeployment(repoRoot, tmpDir, params) {
       "--type",
       "production-schema"
     ],
-    logFile: path10__default.join(tmpDir, "notify-deployment.log")
+    logFile: path11__default.join(tmpDir, "notify-deployment.log")
   });
 }
 
@@ -10290,7 +10677,7 @@ $$;
     label: `repair timestamps (${params.labelPrefix})`,
     command: "psql",
     args: [...psql.args, "-v", "ON_ERROR_STOP=1", "-c", sql],
-    logFile: path10__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
+    logFile: path11__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
   });
 }
 
@@ -10722,7 +11109,7 @@ async function runCiProdApply(params) {
     overridePath: params.options.config
   });
   if (cfg.configPath)
-    params.summary.detected.configPath = path10__default.relative(params.repoRoot, cfg.configPath);
+    params.summary.detected.configPath = path11__default.relative(params.repoRoot, cfg.configPath);
   if (cfg.config) params.summary.detected.config = cfg.config;
   requireCiAutoApprove({ mode: params.summary.mode, autoApprove: params.options.autoApprove });
   const inputs = resolveProdApplyInputs();
@@ -10815,7 +11202,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     await appendGithubStepSummary(
       buildCiProdApplyStepSummaryMarkdown({
         summary,
-        summaryPath: path10__default.relative(repoRoot, summaryPath)
+        summaryPath: path11__default.relative(repoRoot, summaryPath)
       })
     );
     if (summary.mode === "github-actions") {
@@ -10831,7 +11218,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     const summaryPath = await writeCiSummary({ summary });
     logSection("Result");
     console.log(`status: ${summary.status}`);
-    console.log(`summary: ${path10__default.relative(repoRoot, summaryPath)}`);
+    console.log(`summary: ${path11__default.relative(repoRoot, summaryPath)}`);
     logNextActions([
       "Inspect .runa/tmp logs (db-apply-production.log, snapshot-*.log)",
       "If rollback succeeded, database should be restored to pre-deploy snapshot"
@@ -10839,7 +11226,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     await appendGithubStepSummary(
       buildCiProdApplyStepSummaryMarkdown({
         summary,
-        summaryPath: path10__default.relative(repoRoot, summaryPath)
+        summaryPath: path11__default.relative(repoRoot, summaryPath)
       })
     );
     await maybePostFailureComment({
@@ -10910,7 +11297,7 @@ function getChecks() {
 }
 async function runCheck(check, logDir) {
   const startTime = Date.now();
-  const logPath = path10__default.join(logDir, `${check.name}.log`);
+  const logPath = path11__default.join(logDir, `${check.name}.log`);
   return new Promise((resolve12) => {
     const proc = spawn(check.command, check.args, {
       cwd: process.cwd(),
@@ -10940,7 +11327,7 @@ async function runCheck(check, logDir) {
         status: exitCode === 0 ? "passed" : "failed",
         exitCode,
         durationMs,
-        logPath: path10__default.relative(process.cwd(), logPath)
+        logPath: path11__default.relative(process.cwd(), logPath)
       });
     });
     proc.on("error", async () => {
@@ -10955,7 +11342,7 @@ async function runCheck(check, logDir) {
         status: "failed",
         exitCode: 1,
         durationMs,
-        logPath: path10__default.relative(process.cwd(), logPath)
+        logPath: path11__default.relative(process.cwd(), logPath)
       });
     });
   });
@@ -11083,19 +11470,19 @@ function printFinalStaticOutput(summary, summaryPath) {
   console.log(`${summary.status === "success" ? "\u2705" : "\u274C"} Static Analysis: ${summary.status}`);
   console.log(`   Duration: ${formatDuration$1(summary.durationMs)}`);
   console.log(`   Passed: ${summary.passedCount}/${summary.checks.length}`);
-  console.log(`   Summary: ${path10__default.relative(process.cwd(), summaryPath)}`);
+  console.log(`   Summary: ${path11__default.relative(process.cwd(), summaryPath)}`);
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
 }
 async function runCiStatic(options) {
   const startedAt = /* @__PURE__ */ new Date();
   const isCI3 = options.mode === "github-actions";
-  const logDir = path10__default.join(process.cwd(), ".runa", "tmp", "workflow");
+  const logDir = path11__default.join(process.cwd(), ".runa", "tmp", "workflow");
   await mkdir(logDir, { recursive: true });
   const checksToRun = getChecksToRun(options);
   printStaticHeader(options);
   const results = options.parallel ? await runChecksParallel(checksToRun, logDir) : await runChecksSequential(checksToRun, logDir);
   const summary = buildStaticSummary(startedAt, results);
-  const summaryPath = path10__default.join(logDir, "static-summary.json");
+  const summaryPath = path11__default.join(logDir, "static-summary.json");
   await writeFile(summaryPath, JSON.stringify(summary, null, 2), "utf-8");
   if (isCI3) {
     await appendGithubStepSummary(buildStepSummaryMarkdown2(summary));
@@ -11125,9 +11512,9 @@ var appBuildActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     try {
-      const hasTurbo = existsSync(path10__default.join(repoRoot, "turbo.json"));
-      const hasApps = existsSync(path10__default.join(repoRoot, "apps"));
-      const hasAppsWeb = existsSync(path10__default.join(repoRoot, "apps", "web"));
+      const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
+      const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
+      const hasAppsWeb = existsSync(path11__default.join(repoRoot, "apps", "web"));
       const args = hasTurbo ? hasApps && !hasAppsWeb ? ["turbo", "run", "build", "--filter=./apps/*"] : ["turbo", "run", "build"] : ["build"];
       await runLogged({
         cwd: repoRoot,
@@ -11135,7 +11522,7 @@ var appBuildActor = fromPromise(
         label: "build",
         command: "pnpm",
         args,
-        logFile: path10__default.join(tmpDir, "build.log")
+        logFile: path11__default.join(tmpDir, "build.log")
       });
       return { passed: true };
     } catch (error) {
@@ -11151,14 +11538,14 @@ var appBuildActor = fromPromise(
 init_esm_shims();
 var APP_CANDIDATES = ["web", "dashboard", "app", "frontend", "client"];
 function findExistingAppDirs(repoRoot) {
-  const appsDir = path10__default.join(repoRoot, "apps");
+  const appsDir = path11__default.join(repoRoot, "apps");
   if (!existsSync(appsDir)) return [];
   try {
     const entries = readdirSync(appsDir, { withFileTypes: true });
     const found = [];
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const pkgJson = path10__default.join(appsDir, entry.name, "package.json");
+      const pkgJson = path11__default.join(appsDir, entry.name, "package.json");
       if (existsSync(pkgJson)) {
         found.push(`apps/${entry.name}`);
       }
@@ -11178,9 +11565,9 @@ function findExistingAppDirs(repoRoot) {
   }
 }
 function validateAppDir(repoRoot, appDir) {
-  const pkgJsonPath = path10__default.join(appDir, "package.json");
+  const pkgJsonPath = path11__default.join(appDir, "package.json");
   if (!existsSync(appDir)) {
-    const relPath = path10__default.relative(repoRoot, appDir) || ".";
+    const relPath = path11__default.relative(repoRoot, appDir) || ".";
     const suggestions = findExistingAppDirs(repoRoot);
     const errorParts = [`App directory not found: ${relPath}`];
     if (suggestions.length > 0) {
@@ -11202,7 +11589,7 @@ function validateAppDir(repoRoot, appDir) {
     return errorParts.join("\n");
   }
   if (!existsSync(pkgJsonPath)) {
-    const relPath = path10__default.relative(repoRoot, appDir) || ".";
+    const relPath = path11__default.relative(repoRoot, appDir) || ".";
     return `No package.json found in app directory: ${relPath}`;
   }
   return null;
@@ -11259,9 +11646,9 @@ init_esm_shims();
 async function runAppBuild(params) {
   const { repoRoot, tmpDir, env: env2 } = params;
   try {
-    const hasTurbo = existsSync(path10__default.join(repoRoot, "turbo.json"));
-    const hasApps = existsSync(path10__default.join(repoRoot, "apps"));
-    const hasAppsWeb = existsSync(path10__default.join(repoRoot, "apps", "web"));
+    const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
+    const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
+    const hasAppsWeb = existsSync(path11__default.join(repoRoot, "apps", "web"));
     const args = hasTurbo ? hasApps && !hasAppsWeb ? ["turbo", "run", "build", "--filter=./apps/*"] : ["turbo", "run", "build"] : ["build"];
     await runLogged({
       cwd: repoRoot,
@@ -11269,7 +11656,7 @@ async function runAppBuild(params) {
       label: "build",
       command: "pnpm",
       args,
-      logFile: path10__default.join(tmpDir, "build.log")
+      logFile: path11__default.join(tmpDir, "build.log")
     });
     return { passed: true };
   } catch (error) {
@@ -11288,7 +11675,7 @@ async function runManifestGenerate(params) {
       label: "manifest:generate",
       command: "pnpm",
       args: ["manifest:generate"],
-      logFile: path10__default.join(tmpDir, "manifest-generate.log")
+      logFile: path11__default.join(tmpDir, "manifest-generate.log")
     });
     return { generated: true };
   } catch (error) {
@@ -11308,7 +11695,7 @@ async function runPlaywrightInstall(params) {
       label: "playwright install",
       command: "pnpm",
       args,
-      logFile: path10__default.join(tmpDir, "playwright-install.log")
+      logFile: path11__default.join(tmpDir, "playwright-install.log")
     });
     return { installed: true };
   } catch (error) {
@@ -11381,7 +11768,7 @@ var playwrightInstallActor = fromPromise(
         label: "playwright install",
         command: "pnpm",
         args,
-        logFile: path10__default.join(tmpDir, "playwright-install.log")
+        logFile: path11__default.join(tmpDir, "playwright-install.log")
       });
       return { installed: true };
     } catch (error) {
@@ -11405,7 +11792,7 @@ var staticChecksActor2 = fromPromise(
         label: "type-check",
         command: "pnpm",
         args: ["type-check"],
-        logFile: path10__default.join(tmpDir, "type-check.log")
+        logFile: path11__default.join(tmpDir, "type-check.log")
       }),
       runLogged({
         cwd: repoRoot,
@@ -11413,7 +11800,7 @@ var staticChecksActor2 = fromPromise(
         label: "lint",
         command: "pnpm",
         args: ["lint"],
-        logFile: path10__default.join(tmpDir, "lint.log")
+        logFile: path11__default.join(tmpDir, "lint.log")
       })
     ]);
     const typeCheckPassed = typeCheckResult.status === "fulfilled";
@@ -11564,7 +11951,7 @@ var applySeedsActor = fromPromise(
         label: `db seed (${envArg})`,
         command: "pnpm",
         args: ["exec", "runa", "db", "seed", envArg, "--auto-approve"],
-        logFile: path10__default.join(tmpDir, `ci-db-seed-${envArg}.log`)
+        logFile: path11__default.join(tmpDir, `ci-db-seed-${envArg}.log`)
       });
       return { applied: true };
     } catch (error) {
@@ -11942,7 +12329,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `probe pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
-    logFile: path10__default.join(params.tmpDir, `pgtap-probe-${params.label}.log`)
+    logFile: path11__default.join(params.tmpDir, `pgtap-probe-${params.label}.log`)
   }).catch(() => null);
   const raw = String(probe?.stdout ?? "").trim();
   const [availableRaw, installedRaw] = raw.split(",");
@@ -11957,11 +12344,11 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `ensure pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-c", installSql],
-    logFile: path10__default.join(params.tmpDir, `pgtap-ensure-${params.label}.log`)
+    logFile: path11__default.join(params.tmpDir, `pgtap-ensure-${params.label}.log`)
   }).catch(async (error) => {
     try {
       await writeFile(
-        path10__default.join(params.tmpDir, `pgtap-ensure-${params.label}.failed`),
+        path11__default.join(params.tmpDir, `pgtap-ensure-${params.label}.failed`),
         `${error instanceof Error ? error.message : String(error)}
 `,
         "utf-8"
@@ -11975,7 +12362,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `probe pgtap (best-effort, ${params.label}, after)`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
-    logFile: path10__default.join(params.tmpDir, `pgtap-probe-${params.label}-after.log`)
+    logFile: path11__default.join(params.tmpDir, `pgtap-probe-${params.label}-after.log`)
   }).catch(() => null);
   const afterRaw = String(probeAfter?.stdout ?? "").trim();
   const [availableAfterRaw, installedAfterRaw] = afterRaw.split(",");
@@ -12096,14 +12483,14 @@ function extractSqlFromSchemaChanges(fullOutput) {
   return null;
 }
 function getIdempotentRoleNames(repoRoot) {
-  const idempotentDir = path10__default.join(repoRoot, "supabase", "schemas", "idempotent");
+  const idempotentDir = path11__default.join(repoRoot, "supabase", "schemas", "idempotent");
   const roles = [];
   try {
     const fs14 = __require("fs");
     if (!fs14.existsSync(idempotentDir)) return [];
     const files = fs14.readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const content = fs14.readFileSync(path10__default.join(idempotentDir, file), "utf-8");
+      const content = fs14.readFileSync(path11__default.join(idempotentDir, file), "utf-8");
       const roleMatches = content.matchAll(/CREATE\s+ROLE\s+(\w+)\s+WITH/gi);
       for (const match of roleMatches) {
         if (match[1]) roles.push(match[1].toLowerCase());
@@ -12244,7 +12631,7 @@ var productionPreviewActor = fromPromise(
       );
       return buildSkipResult(!!productionUrl);
     }
-    const logFile = path10__default.join(tmpDir, "ci-production-preview.log");
+    const logFile = path11__default.join(tmpDir, "ci-production-preview.log");
     console.log("\u25B6 production preview (dry-run): runa db apply production --check");
     try {
       const result = await execa(
@@ -12334,7 +12721,7 @@ var resetDbActor = fromPromise(
         label: "db reset (local)",
         command: "npx",
         args: ["supabase", "db", "reset", "--local"],
-        logFile: path10__default.join(tmpDir, "ci-db-reset.log")
+        logFile: path11__default.join(tmpDir, "ci-db-reset.log")
       });
       return { reset: true };
     } catch (error) {
@@ -12350,8 +12737,8 @@ var resetDbActor = fromPromise(
 init_esm_shims();
 async function hasSetupRolesScript(repoRoot) {
   const candidates = [
-    path10__default.join(repoRoot, "packages", "database", "package.json"),
-    path10__default.join(repoRoot, "package.json")
+    path11__default.join(repoRoot, "packages", "database", "package.json"),
+    path11__default.join(repoRoot, "package.json")
   ];
   for (const pkgPath of candidates) {
     if (!existsSync(pkgPath)) continue;
@@ -12389,7 +12776,7 @@ var setupRolesActor = fromPromise(
         label: "db roles setup",
         command: "pnpm",
         args: ["db:setup-roles"],
-        logFile: path10__default.join(tmpDir, "ci-db-roles-setup.log")
+        logFile: path11__default.join(tmpDir, "ci-db-roles-setup.log")
       });
       const stdout = String(result.stdout ?? "");
       const appUrlMatch = stdout.match(/APP_DATABASE_URL=["']?([^"'\n]+)["']?/);
@@ -12502,14 +12889,14 @@ function getSchemaGitDiff(repoRoot) {
   }
 }
 function getIdempotentRoleNames2(repoRoot) {
-  const idempotentDir = path10__default.join(repoRoot, "supabase", "schemas", "idempotent");
+  const idempotentDir = path11__default.join(repoRoot, "supabase", "schemas", "idempotent");
   const roles = [];
   try {
     const fs14 = __require("fs");
     if (!fs14.existsSync(idempotentDir)) return [];
     const files = fs14.readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const content = fs14.readFileSync(path10__default.join(idempotentDir, file), "utf-8");
+      const content = fs14.readFileSync(path11__default.join(idempotentDir, file), "utf-8");
       const roleMatches = content.matchAll(/CREATE\s+ROLE\s+(\w+)\s+WITH/gi);
       for (const match of roleMatches) {
         if (match[1]) roles.push(match[1].toLowerCase());
@@ -12606,7 +12993,7 @@ var syncSchemaActor = fromPromise(
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
       ];
-      const logFile = path10__default.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
+      const logFile = path11__default.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
       await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -12746,7 +13133,7 @@ async function startSupabaseLocal(params) {
     label: "supabase start (local)",
     command: "supabase",
     args: ["start", "--exclude", exclude],
-    logFile: path10__default.join(params.tmpDir, "supabase-start-local.log")
+    logFile: path11__default.join(params.tmpDir, "supabase-start-local.log")
   });
 }
 function getDefaultLocalSupabaseUrl(repoRoot) {
@@ -12774,7 +13161,7 @@ async function resolveLocalSupabaseEnv(params) {
         label: "supabase status (json)",
         command: "supabase",
         args: ["status", "--output", "json"],
-        logFile: path10__default.join(params.tmpDir, `supabase-status-${i + 1}.log`)
+        logFile: path11__default.join(params.tmpDir, `supabase-status-${i + 1}.log`)
       });
       const parsed = JSON.parse(String(res.stdout ?? "{}"));
       const out = z.object({
@@ -12894,7 +13281,7 @@ async function findFilesRecursive(params) {
       continue;
     }
     for (const e of entries) {
-      const p = path10__default.join(dir, e.name);
+      const p = path11__default.join(dir, e.name);
       if (e.isDirectory()) stack.push(p);
       else if (e.isFile() && params.suffixes.some((s) => p.endsWith(s))) out.push(p);
     }
@@ -12908,7 +13295,7 @@ async function queryScalar(params) {
     label: `psql scalar (${params.logName})`,
     command: "psql",
     args: [params.databaseUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", params.sql],
-    logFile: path10__default.join(params.tmpDir, `psql-${params.logName}.log`)
+    logFile: path11__default.join(params.tmpDir, `psql-${params.logName}.log`)
   });
   return String(res.stdout ?? "").trim();
 }
@@ -13036,8 +13423,8 @@ function isPlaywrightIgnored(filePath) {
 async function detectGeneratedE2eCapabilities(params) {
   const caps = /* @__PURE__ */ new Set();
   const diagnostics = {};
-  const layer4Dir = path10__default.join(params.repoRoot, ".runa", "tests", "layer4");
-  const tmpDir = path10__default.join(params.repoRoot, ".runa", "tmp");
+  const layer4Dir = path11__default.join(params.repoRoot, ".runa", "tests", "layer4");
+  const tmpDir = path11__default.join(params.repoRoot, ".runa", "tmp");
   const hasLayer4Dir = await pathExists(layer4Dir);
   const hasTmpDir = await pathExists(tmpDir);
   if (!hasLayer4Dir && !hasTmpDir) {
@@ -13547,7 +13934,7 @@ init_esm_shims();
 // src/commands/ci/utils/test-parallel.ts
 init_esm_shims();
 async function readLayerResult(tmpDir, layer) {
-  const resultFile = path10__default.join(tmpDir, `vitest-layer${layer}-result.json`);
+  const resultFile = path11__default.join(tmpDir, `vitest-layer${layer}-result.json`);
   try {
     const content = await readFile(resultFile, "utf-8");
     return JSON.parse(content);
@@ -13665,8 +14052,8 @@ async function waitUntilAllFinished(params) {
 async function runLayersInParallel(params) {
   const spawned = [];
   for (const layer of params.layers) {
-    const logFile = path10__default.join(params.tmpDir, `layer${layer}.log`);
-    const exitFile = path10__default.join(params.tmpDir, `layer${layer}.exit`);
+    const logFile = path11__default.join(params.tmpDir, `layer${layer}.log`);
+    const exitFile = path11__default.join(params.tmpDir, `layer${layer}.exit`);
     const proc = runLogged({
       cwd: params.repoRoot,
       env: {
@@ -13709,7 +14096,7 @@ async function runLayersInParallel(params) {
   for (const p of spawned) {
     const codeRaw = p.exitCode ?? await p.procPromise;
     const code = Number.isNaN(codeRaw) ? 1 : codeRaw;
-    const resultFile = path10__default.join(params.tmpDir, `vitest-layer${p.layer}-result.json`);
+    const resultFile = path11__default.join(params.tmpDir, `vitest-layer${p.layer}-result.json`);
     const wasKilled = killedLayerSet.has(p.layer);
     const actualResult = waitResult.successMap.get(p.layer) ?? {
       success: code === 0,
@@ -13724,9 +14111,9 @@ async function runLayersInParallel(params) {
       skippedReason: actualResult.skippedReason,
       killed: wasKilled,
       killedBy: wasKilled ? failFastSource : void 0,
-      logPath: path10__default.relative(params.repoRoot, p.logFile),
-      exitPath: path10__default.relative(params.repoRoot, p.exitFile),
-      resultPath: path10__default.relative(params.repoRoot, resultFile),
+      logPath: path11__default.relative(params.repoRoot, p.logFile),
+      exitPath: path11__default.relative(params.repoRoot, p.exitFile),
+      resultPath: path11__default.relative(params.repoRoot, resultFile),
       // Test count information
       totalTests: actualResult.totalTests,
       passedTests: actualResult.passedTests,
@@ -14835,6 +15222,24 @@ function getSupabaseUrlWithFallback(context) {
 function getSupabaseAnonKeyWithFallback(context) {
   return context.supabase?.anonKey || DEFAULT_LOCAL_ANON_KEY;
 }
+function buildRuntimeEnv(context, options = {}) {
+  const env2 = {
+    ...context.input.runtimeEnv ?? {},
+    DATABASE_URL: getDatabaseUrlForRuntime(context),
+    NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context)
+  };
+  if (options.enablePublicE2EFlag) {
+    env2.NEXT_PUBLIC_E2E_TEST = "true";
+  }
+  if (options.enableServerE2EFlag) {
+    env2.E2E_TEST = "true";
+  }
+  if (options.baseUrl) {
+    env2.BASE_URL = options.baseUrl;
+  }
+  return env2;
+}
 function computeExitCodeFromLayerResults(layerResults) {
   const classification = getClassificationForProfile("runa-strict");
   const classificationMap = new Map(classification.map((c) => [c.layer, c.level]));
@@ -15323,7 +15728,7 @@ ${generateProgressCommentBody(progressInput)}`;
           tmpDir: assertTmpDir(context),
           // Execute if GH_DATABASE_URL_ADMIN is set (dry-run will determine if changes exist)
           // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable)
-          shouldExecute: !!(process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL)
+          shouldExecute: Boolean(context.input.productionDatabaseUrl?.trim())
         }),
         onDone: {
           target: "collectSchemaStats",
@@ -15515,14 +15920,10 @@ ${generateProgressCommentBody(progressInput)}`;
         input: ({ context }) => ({
           repoRoot: assertRepoRoot(context),
           tmpDir: assertTmpDir(context),
-          env: {
-            ...process.env,
-            DATABASE_URL: getDatabaseUrlForRuntime(context),
-            NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
-            NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context),
-            // CRITICAL: Required for XState Test Plugin to inject data-state attributes
-            NEXT_PUBLIC_E2E_TEST: "true"
-          },
+          env: buildRuntimeEnv(context, {
+            // Required for XState Test Plugin to inject data-state attributes.
+            enablePublicE2EFlag: true
+          }),
           isCI: context.input.isCI ?? false,
           skipPlaywright: shouldSkipPlaywrightInstall(context)
         }),
@@ -15573,16 +15974,11 @@ ${generateProgressCommentBody(progressInput)}`;
           tmpDir: assertTmpDir(context),
           appDir: context.app?.appDir ?? assertRepoRoot(context),
           port: context.app?.port ?? 3e3,
-          env: {
-            ...process.env,
-            DATABASE_URL: getDatabaseUrlForRuntime(context),
-            NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
-            NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context),
-            // CRITICAL: Required for middleware to bypass auth in E2E tests
-            // E2E_TEST is server-only (proxy.ts), NEXT_PUBLIC_E2E_TEST is for build-time (xstate-test-plugin)
-            E2E_TEST: "true",
-            NEXT_PUBLIC_E2E_TEST: "true"
-          }
+          env: buildRuntimeEnv(context, {
+            // E2E_TEST is server-only (proxy.ts), NEXT_PUBLIC_E2E_TEST is for build-time.
+            enableServerE2EFlag: true,
+            enablePublicE2EFlag: true
+          })
         }),
         onDone: [
           {
@@ -15687,12 +16083,7 @@ ${generateProgressCommentBody(progressInput)}`;
           // ci-local: all selected layers, ci-pr: only core layers (1,2,3)
           layers: getLayersForCorePhase(context.selectedLayers, context.mode),
           baseUrl: context.baseUrl ?? `http://localhost:${context.app?.port ?? 3e3}`,
-          env: {
-            ...process.env,
-            DATABASE_URL: getDatabaseUrlForRuntime(context),
-            NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
-            NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context)
-          },
+          env: buildRuntimeEnv(context),
           failFast: true
         }),
         onDone: [
@@ -15846,15 +16237,10 @@ ${generateCommentBody(commentInput)}`;
                     tmpDir: assertTmpDir(context),
                     layers: [E2E_LAYER],
                     baseUrl: e2eBaseUrl,
-                    env: {
-                      ...process.env,
-                      DATABASE_URL: getDatabaseUrlForRuntime(context),
-                      NEXT_PUBLIC_SUPABASE_URL: getSupabaseUrlWithFallback(context),
-                      NEXT_PUBLIC_SUPABASE_ANON_KEY: getSupabaseAnonKeyWithFallback(context),
-                      // CRITICAL: Set BASE_URL for Playwright config and test fixtures
-                      // This ensures cookies are set on the same domain Playwright uses
-                      BASE_URL: e2eBaseUrl
-                    },
+                    env: buildRuntimeEnv(context, {
+                      // Ensures cookies are set on the same domain Playwright uses.
+                      baseUrl: e2eBaseUrl
+                    }),
                     failFast: false
                     // Don't fail-fast for E2E (warning-only)
                   };
@@ -16048,19 +16434,10 @@ ${generateCommentBody(commentInput)}`;
   output: ({ context }) => createOutput3(context)
 });
 function getStateName3(snapshot2) {
-  const value = snapshot2.value;
-  if (typeof value === "string") return value;
-  const keys = Object.keys(value);
-  if (keys.length > 0) {
-    const parent = keys[0];
-    const child = value[parent];
-    if (typeof child === "string") return `${parent}.${child}`;
-    return parent;
-  }
-  return "unknown";
+  return getSnapshotStateName(snapshot2);
 }
 function isComplete3(snapshot2) {
-  return snapshot2.status === "done";
+  return isSnapshotComplete(snapshot2);
 }
 
 // src/commands/ci/machine/commands/machine-runner.ts
@@ -16309,6 +16686,18 @@ async function flushAndExit(exitCode) {
   process.exit(exitCode);
 }
 
+// src/commands/ci/machine/commands/runtime-env.ts
+init_esm_shims();
+function captureRuntimeEnv(source = process.env) {
+  const captured = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value !== void 0) {
+      captured[key] = value;
+    }
+  }
+  return captured;
+}
+
 // src/commands/ci/machine/commands/ci-local.ts
 var isGitHubActionsMode = false;
 var currentGroup = null;
@@ -16430,7 +16819,8 @@ function buildMachineInput(options) {
     dbMode: void 0,
     // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg_dump)
     productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL,
-    databaseUrl: process.env.DATABASE_URL
+    databaseUrl: process.env.DATABASE_URL,
+    runtimeEnv: captureRuntimeEnv()
   };
 }
 function handleCiError(error, logger16) {
@@ -16496,6 +16886,8 @@ z.object({
   productionDatabaseUrl: z.string().optional(),
   /** Local database URL */
   databaseUrl: z.string().optional(),
+  /** Sanitized process.env captured at entry point */
+  runtimeEnv: z.record(z.string(), z.string()).optional(),
   // === GitHub Actions Environment ===
   /** GitHub ref (e.g., refs/pull/123/merge) */
   githubRef: z.string().optional(),
@@ -16947,6 +17339,7 @@ function optionsToMachineInput(options) {
     databaseUrl: process.env.DATABASE_URL,
     // PRD: GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg-schema-diff dry-run)
     productionDatabaseUrl: process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL,
+    runtimeEnv: captureRuntimeEnv(),
     githubRef: process.env.GITHUB_REF,
     // FIX: Read action from GITHUB_EVENT_PATH JSON, not non-existent GITHUB_EVENT_ACTION env var
     githubEventAction: getGitHubEventAction(),
@@ -17022,13 +17415,20 @@ init_esm_shims();
 // src/commands/db/utils/db-target.ts
 init_esm_shims();
 init_env();
-init_constants();
+init_local_supabase();
 function getLocalDatabaseUrl() {
-  const ports = detectSupabasePorts(process.cwd());
-  return `postgresql://postgres:postgres@localhost:${ports.db}/postgres`;
+  return buildLocalDatabaseUrl(process.cwd());
+}
+function isLocalHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "host.docker.internal";
 }
 function isLocalDatabaseUrl(url) {
-  return url.includes("localhost") || url.includes("127.0.0.1") || url.includes("host.docker.internal");
+  try {
+    const parsed = new URL(url);
+    return isLocalHostname(parsed.hostname);
+  } catch {
+    return false;
+  }
 }
 function resolveDatabaseUrl(environment) {
   switch (environment) {
@@ -17186,21 +17586,35 @@ async function getSqlParserUtils() {
   await isAstParserAvailable();
   return sqlParserUtils;
 }
+var SQL_IDENTIFIER = String.raw`(?:"(?:[^"]|"")*"|[a-zA-Z_][a-zA-Z0-9_]*)`;
 var SQL_PATTERNS = {
   // CREATE TABLE [IF NOT EXISTS] schema.table_name (
-  createTable: /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(\w+)\.(\w+)\s*\(/gi,
+  createTable: new RegExp(
+    `CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})\\s*\\(`,
+    "gi"
+  ),
   // PRIMARY KEY (columns)
   primaryKey: /PRIMARY\s+KEY\s*\(([^)]+)\)/gi,
   // FOREIGN KEY (column) REFERENCES schema.table(column) [ON DELETE|UPDATE ...]
-  foreignKey: /FOREIGN\s+KEY\s*\((\w+)\)\s*REFERENCES\s+(\w+)\.(\w+)\s*\((\w+)\)(?:\s+ON\s+DELETE\s+(\w+(?:\s+\w+)?))?(?:\s+ON\s+UPDATE\s+(\w+(?:\s+\w+)?))?/gi,
+  foreignKey: new RegExp(
+    `FOREIGN\\s+KEY\\s*\\((${SQL_IDENTIFIER})\\)\\s*REFERENCES\\s+(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})\\s*\\((${SQL_IDENTIFIER})\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?(?:\\s+ON\\s+UPDATE\\s+(\\w+(?:\\s+\\w+)?))?`,
+    "gi"
+  ),
   // REFERENCES schema.table(column) - inline column constraint
-  inlineReference: /(\w+)\s+\w+[^,]*REFERENCES\s+(\w+)\.(\w+)\s*\((\w+)\)/gi,
+  inlineReference: new RegExp(
+    `(${SQL_IDENTIFIER})\\s+\\w+[\\w\\s()]*REFERENCES\\s+(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})\\s*\\((${SQL_IDENTIFIER})\\)`,
+    "gi"
+  ),
   // CREATE [UNIQUE] INDEX name ON schema.table (columns)
-  createIndex: /CREATE\s+(UNIQUE\s+)?INDEX\s+(?:IF\s+NOT\s+EXISTS\s+)?(\w+)\s+ON\s+(\w+)\.(\w+)\s*\(([^)]+)\)/gi,
+  createIndex: new RegExp(
+    `CREATE\\s+(UNIQUE\\s+)?INDEX\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${SQL_IDENTIFIER})\\s+ON\\s+(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})\\s*\\(([^)]+)\\)`,
+    "gi"
+  ),
   // ALTER TABLE ... ENABLE ROW LEVEL SECURITY
-  enableRls: /ALTER\s+TABLE\s+(\w+)\.(\w+)\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi,
-  // CREATE POLICY name ON schema.table FOR command USING (...) [WITH CHECK (...)]
-  createPolicy: /CREATE\s+POLICY\s+"?(\w+)"?\s+ON\s+(\w+)\.(\w+)\s+(?:AS\s+\w+\s+)?FOR\s+(\w+)\s+(?:TO\s+\w+\s+)?(?:USING\s*\(([^)]+)\))?(?:\s+WITH\s+CHECK\s*\(([^)]+)\))?/gi
+  enableRls: new RegExp(
+    `ALTER\\s+TABLE\\s+(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})\\s+ENABLE\\s+ROW\\s+LEVEL\\s+SECURITY`,
+    "gi"
+  )
 };
 function snakeToCamel2(str) {
   return str.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
@@ -17235,6 +17649,96 @@ function extractTableBody(content, startPos) {
 function normalizeType(type) {
   return type.trim().replace(/\s+/g, " ").toLowerCase().replace("character varying", "varchar").replace("timestamp with time zone", "timestamptz").replace("timestamp without time zone", "timestamp");
 }
+function unquoteIdentifier(identifier) {
+  const trimmed = identifier.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1).replace(/""/g, '"');
+  }
+  return trimmed;
+}
+function stripSqlCommentsPreserveStrings2(content) {
+  let result = "";
+  let i = 0;
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inDollarQuote = false;
+  let dollarTag = "";
+  while (i < content.length) {
+    const char = content[i] ?? "";
+    const next = content[i + 1] ?? "";
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && char === "-" && next === "-") {
+      while (i < content.length && content[i] !== "\n") {
+        result += " ";
+        i++;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && char === "/" && next === "*") {
+      result += " ";
+      result += " ";
+      i += 2;
+      while (i < content.length) {
+        const blockChar = content[i] ?? "";
+        const blockNext = content[i + 1] ?? "";
+        if (blockChar === "*" && blockNext === "/") {
+          result += " ";
+          result += " ";
+          i += 2;
+          break;
+        }
+        result += blockChar === "\n" ? "\n" : " ";
+        i++;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && char === "$") {
+      if (inDollarQuote) {
+        const closeTag = `$${dollarTag}$`;
+        if (content.slice(i).startsWith(closeTag)) {
+          result += closeTag;
+          i += closeTag.length;
+          inDollarQuote = false;
+          dollarTag = "";
+          continue;
+        }
+      } else {
+        const tagMatch = content.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+        if (tagMatch) {
+          inDollarQuote = true;
+          dollarTag = tagMatch[1] ?? "";
+          result += tagMatch[0];
+          i += tagMatch[0].length;
+          continue;
+        }
+      }
+    }
+    if (!inDoubleQuote && !inDollarQuote && char === "'") {
+      if (inSingleQuote && next === "'") {
+        result += "''";
+        i += 2;
+        continue;
+      }
+      inSingleQuote = !inSingleQuote;
+      result += char;
+      i++;
+      continue;
+    }
+    if (!inSingleQuote && !inDollarQuote && char === '"') {
+      if (inDoubleQuote && next === '"') {
+        result += '""';
+        i += 2;
+        continue;
+      }
+      inDoubleQuote = !inDoubleQuote;
+      result += char;
+      i++;
+      continue;
+    }
+    result += char;
+    i++;
+  }
+  return result;
+}
 function parseIndexColumns(rawColumns) {
   return rawColumns.split(",").map((col) => {
     const trimmed = col.trim();
@@ -17271,8 +17775,8 @@ function findTablesRegex(ctx) {
   const tables = [];
   const regex = new RegExp(SQL_PATTERNS.createTable.source, "gi");
   for (const match of ctx.content.matchAll(regex)) {
-    const schema = match[1] ?? "";
-    const name = match[2] ?? "";
+    const schema = unquoteIdentifier(match[1] ?? "");
+    const name = unquoteIdentifier(match[2] ?? "");
     if (!schema || !name) continue;
     const lineNumber = getLineNumber(ctx.content, match.index ?? 0);
     const tableBody = extractTableBody(ctx.content, match.index ?? 0);
@@ -17294,10 +17798,10 @@ function parseColumnsRegex(tableBody) {
     const trimmed = line.trim();
     if (shouldSkipColumnLine(trimmed)) continue;
     const columnMatch = trimmed.match(
-      /^(\w+)\s+([\w\s()]+?)(?:\s+(NOT\s+NULL|NULL))?(?:\s+DEFAULT\s+[^,]+)?(?:\s+REFERENCES)?(?:,|$)/i
+      /^((?:"(?:[^"]|"")*"|[a-zA-Z_][a-zA-Z0-9_]*))\s+([\w\s()]+?)(?:\s+(NOT\s+NULL|NULL))?(?:\s+DEFAULT\s+[^,]+)?(?:\s+REFERENCES)?(?:,|$)/i
     );
     if (columnMatch) {
-      const name = columnMatch[1] ?? "";
+      const name = unquoteIdentifier(columnMatch[1] ?? "");
       if (!name || seen.has(name) || isReservedKeyword(name)) continue;
       seen.add(name);
       const rawType = columnMatch[2] ?? "";
@@ -17319,7 +17823,7 @@ function parsePrimaryKeyRegex(tableBody) {
   const regex = new RegExp(SQL_PATTERNS.primaryKey.source, "gi");
   const match = regex.exec(tableBody);
   if (match) {
-    return match[1]?.split(",").map((col) => col.trim());
+    return match[1]?.split(",").map((col) => unquoteIdentifier(col.trim())).filter(Boolean) ?? [];
   }
   return [];
 }
@@ -17327,12 +17831,12 @@ function parseExplicitForeignKeys(tableBody) {
   const fks = [];
   const fkRegex = new RegExp(SQL_PATTERNS.foreignKey.source, "gi");
   for (const match of tableBody.matchAll(fkRegex)) {
-    const column = match[1] ?? "";
-    const refTable = match[4] ?? "";
+    const column = unquoteIdentifier(match[1] ?? "");
+    const refTable = unquoteIdentifier(match[4] ?? "");
     if (!column || !refTable) continue;
     fks.push({
       column,
-      referencesTable: `${match[2] ?? ""}.${match[3] ?? ""}`,
+      referencesTable: `${unquoteIdentifier(match[2] ?? "")}.${unquoteIdentifier(match[3] ?? "")}`,
       referencesColumn: refTable,
       onDelete: normalizeOnAction(match[5]),
       onUpdate: normalizeOnAction(match[6])
@@ -17344,13 +17848,13 @@ function parseInlineForeignKeys(tableBody, existingColumns) {
   const fks = [];
   const inlineRegex = new RegExp(SQL_PATTERNS.inlineReference.source, "gi");
   for (const match of tableBody.matchAll(inlineRegex)) {
-    const inlineCol = match[1] ?? "";
+    const inlineCol = unquoteIdentifier(match[1] ?? "");
     if (existingColumns.has(inlineCol)) continue;
-    const inlineRefCol = match[4] ?? "";
+    const inlineRefCol = unquoteIdentifier(match[4] ?? "");
     if (!inlineCol || !inlineRefCol) continue;
     fks.push({
       column: inlineCol,
-      referencesTable: `${match[2] ?? ""}.${match[3] ?? ""}`,
+      referencesTable: `${unquoteIdentifier(match[2] ?? "")}.${unquoteIdentifier(match[3] ?? "")}`,
       referencesColumn: inlineRefCol
     });
   }
@@ -17366,8 +17870,10 @@ function parseIndexesRegex(content, schema, tableName) {
   const indexes = [];
   const regex = new RegExp(SQL_PATTERNS.createIndex.source, "gi");
   for (const match of content.matchAll(regex)) {
-    if (match[3] === schema && match[4] === tableName) {
-      const indexName = match[2] ?? "";
+    const indexSchema = unquoteIdentifier(match[3] ?? "");
+    const indexTable = unquoteIdentifier(match[4] ?? "");
+    if (indexSchema === schema && indexTable === tableName) {
+      const indexName = unquoteIdentifier(match[2] ?? "");
       if (!indexName) continue;
       const rawColumns = match[5] ?? "";
       indexes.push({
@@ -17382,26 +17888,200 @@ function parseIndexesRegex(content, schema, tableName) {
 function hasRlsEnabledRegex(content, schema, tableName) {
   const regex = new RegExp(SQL_PATTERNS.enableRls.source, "gi");
   for (const match of content.matchAll(regex)) {
-    if (match[1] === schema && match[2] === tableName) {
+    const matchSchema = unquoteIdentifier(match[1] ?? "");
+    const matchTable = unquoteIdentifier(match[2] ?? "");
+    if (matchSchema === schema && matchTable === tableName) {
       return true;
     }
   }
   return false;
 }
+function extractCreatePolicyStatements(content) {
+  const statements = [];
+  const startRegex = /\bCREATE\s+POLICY\b/gi;
+  let match;
+  while ((match = startRegex.exec(content)) !== null) {
+    const startIndex = match.index ?? 0;
+    const endIndex = findSqlStatementEndForPolicy(content, startIndex);
+    statements.push(content.slice(startIndex, endIndex).trim());
+  }
+  return statements;
+}
+function findSqlStatementEndForPolicy(content, startIndex) {
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inDollarQuote = false;
+  let dollarTag = "";
+  for (let i = startIndex; i < content.length; i++) {
+    const char = content[i] ?? "";
+    const next = content[i + 1] ?? "";
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote) {
+      if (char === "-" && next === "-") {
+        const newlineIndex = content.indexOf("\n", i);
+        if (newlineIndex === -1) return content.length;
+        i = newlineIndex;
+        continue;
+      }
+      if (char === "/" && next === "*") {
+        const closeIndex = content.indexOf("*/", i + 2);
+        if (closeIndex === -1) return content.length;
+        i = closeIndex + 1;
+        continue;
+      }
+    }
+    if (!inSingleQuote && !inDoubleQuote && char === "$") {
+      if (inDollarQuote) {
+        const closeTag = `$${dollarTag}$`;
+        if (content.slice(i).startsWith(closeTag)) {
+          i += closeTag.length - 1;
+          inDollarQuote = false;
+          dollarTag = "";
+          continue;
+        }
+      } else {
+        const tagMatch = content.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+        if (tagMatch) {
+          inDollarQuote = true;
+          dollarTag = tagMatch[1] ?? "";
+          i += tagMatch[0].length - 1;
+          continue;
+        }
+      }
+    }
+    if (!inDoubleQuote && !inDollarQuote && char === "'") {
+      if (inSingleQuote) {
+        if (next === "'") {
+          i++;
+          continue;
+        }
+        inSingleQuote = false;
+      } else {
+        inSingleQuote = true;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDollarQuote && char === '"') {
+      if (inDoubleQuote) {
+        if (next === '"') {
+          i++;
+          continue;
+        }
+        inDoubleQuote = false;
+      } else {
+        inDoubleQuote = true;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && char === ";") {
+      return i + 1;
+    }
+  }
+  return content.length;
+}
+function extractBalancedClause(statement, startIndex) {
+  const openParenIndex = statement.indexOf("(", startIndex);
+  if (openParenIndex === -1) return void 0;
+  let depth = 0;
+  let clauseStart = -1;
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inDollarQuote = false;
+  let dollarTag = "";
+  for (let i = openParenIndex; i < statement.length; i++) {
+    const char = statement[i] ?? "";
+    const next = statement[i + 1] ?? "";
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote) {
+      if (char === "-" && next === "-") {
+        const newlineIndex = statement.indexOf("\n", i);
+        if (newlineIndex === -1) break;
+        i = newlineIndex;
+        continue;
+      }
+      if (char === "/" && next === "*") {
+        const closeIndex = statement.indexOf("*/", i + 2);
+        if (closeIndex === -1) break;
+        i = closeIndex + 1;
+        continue;
+      }
+    }
+    if (!inSingleQuote && !inDoubleQuote && char === "$") {
+      if (inDollarQuote) {
+        const closeTag = `$${dollarTag}$`;
+        if (statement.slice(i).startsWith(closeTag)) {
+          i += closeTag.length - 1;
+          inDollarQuote = false;
+          dollarTag = "";
+          continue;
+        }
+      } else {
+        const tagMatch = statement.slice(i).match(/^\$([a-zA-Z_][a-zA-Z0-9_]*)?\$/);
+        if (tagMatch) {
+          inDollarQuote = true;
+          dollarTag = tagMatch[1] ?? "";
+          i += tagMatch[0].length - 1;
+          continue;
+        }
+      }
+    }
+    if (!inDoubleQuote && !inDollarQuote && char === "'") {
+      if (inSingleQuote) {
+        if (next === "'") {
+          i++;
+          continue;
+        }
+        inSingleQuote = false;
+      } else {
+        inSingleQuote = true;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDollarQuote && char === '"') {
+      if (inDoubleQuote) {
+        if (next === '"') {
+          i++;
+          continue;
+        }
+        inDoubleQuote = false;
+      } else {
+        inDoubleQuote = true;
+      }
+      continue;
+    }
+    if (inSingleQuote || inDoubleQuote || inDollarQuote) continue;
+    if (char === "(") {
+      if (depth === 0) clauseStart = i + 1;
+      depth++;
+    } else if (char === ")") {
+      depth--;
+      if (depth === 0 && clauseStart !== -1) {
+        return statement.slice(clauseStart, i).trim();
+      }
+    }
+  }
+  return void 0;
+}
 function parsePoliciesRegex(content, schema, tableName) {
   const policies = [];
-  const regex = new RegExp(SQL_PATTERNS.createPolicy.source, "gi");
-  for (const match of content.matchAll(regex)) {
-    const policyName = match[1] ?? "";
-    if (!policyName) continue;
-    if (match[2] === schema && match[3] === tableName) {
-      policies.push({
-        name: policyName,
-        command: match[4]?.toUpperCase(),
-        using: match[5] || void 0,
-        withCheck: match[6] || void 0
-      });
-    }
+  const statements = extractCreatePolicyStatements(content);
+  const headerRegex = new RegExp(
+    `^\\s*CREATE\\s+POLICY\\s+(?:"((?:[^"]|"")*)"|([a-zA-Z_][a-zA-Z0-9_]*))\\s+ON\\s+(${SQL_IDENTIFIER})\\.(${SQL_IDENTIFIER})(?:\\s+AS\\s+\\w+)?(?:\\s+FOR\\s+(\\w+))?`,
+    "i"
+  );
+  for (const statement of statements) {
+    const match = statement.match(headerRegex);
+    if (!match) continue;
+    const policyName = unquoteIdentifier(match[1] ?? match[2] ?? "");
+    const policySchema = unquoteIdentifier(match[3] ?? "");
+    const policyTable = unquoteIdentifier(match[4] ?? "");
+    if (!policyName || policySchema !== schema || policyTable !== tableName) continue;
+    const usingIndex = statement.search(/\bUSING\s*\(/i);
+    const withCheckIndex = statement.search(/\bWITH\s+CHECK\s*\(/i);
+    policies.push({
+      name: policyName,
+      command: (match[5] || "ALL").toUpperCase(),
+      using: usingIndex !== -1 ? extractBalancedClause(statement, usingIndex) : void 0,
+      withCheck: withCheckIndex !== -1 ? extractBalancedClause(statement, withCheckIndex) : void 0
+    });
   }
   return policies;
 }
@@ -17502,7 +18182,8 @@ function buildTableEntryRegex(table, content, filePath, opts) {
   };
 }
 function processTablesFromFileRegex(filePath, opts, seen) {
-  const content = readFileSync(filePath, "utf-8");
+  const rawContent = readFileSync(filePath, "utf-8");
+  const content = stripSqlCommentsPreserveStrings2(rawContent);
   const ctx = { content, lines: content.split("\n") };
   const tables = findTablesRegex(ctx);
   const entries = [];
@@ -18329,6 +19010,60 @@ function handleHazards(hazards, input3) {
     );
   }
 }
+var TYPE_TO_EXTENSION = {
+  geometry: "postgis",
+  geography: "postgis",
+  box2d: "postgis",
+  box3d: "postgis",
+  raster: "postgis_raster",
+  vector: "vector",
+  halfvec: "vector",
+  sparsevec: "vector",
+  cube: "cube",
+  hstore: "hstore",
+  ltree: "ltree",
+  citext: "citext"
+};
+function detectMissingExtensionType(errorOutput) {
+  const typePattern = /type ["']?(\w+)["']? does not exist/gi;
+  const matches = [...errorOutput.matchAll(typePattern)];
+  const missingTypes = [...new Set(matches.map((m) => m[1].toLowerCase()))];
+  if (missingTypes.length === 0) {
+    return { detected: false, missingTypes: [], suggestedExtensions: [] };
+  }
+  const extensions = /* @__PURE__ */ new Set();
+  for (const type of missingTypes) {
+    const ext = TYPE_TO_EXTENSION[type];
+    if (ext) extensions.add(ext);
+  }
+  return {
+    detected: true,
+    missingTypes,
+    suggestedExtensions: [...extensions]
+  };
+}
+function formatExtensionErrorHint(detection) {
+  if (!detection.detected) return "";
+  const lines = [];
+  lines.push("");
+  lines.push("Missing extension type(s) detected:");
+  for (const type of detection.missingTypes) {
+    const ext = TYPE_TO_EXTENSION[type];
+    lines.push(`  type "${type}" \u2192 extension: ${ext ?? "unknown"}`);
+  }
+  if (detection.suggestedExtensions.length > 0) {
+    lines.push("");
+    lines.push("Fix 1: Add to supabase/schemas/idempotent/00_extensions.sql:");
+    for (const ext of detection.suggestedExtensions) {
+      lines.push(`  CREATE EXTENSION IF NOT EXISTS ${ext};`);
+    }
+    const extList = detection.suggestedExtensions.map((e) => `'${e}'`).join(", ");
+    lines.push("");
+    lines.push("Fix 2: Configure shadow DB in runa.config.ts:");
+    lines.push(`  database: { pgSchemaDiff: { shadowDbExtensions: [${extList}] } }`);
+  }
+  return lines.join("\n");
+}
 function executePgSchemaDiffPlan(dbUrl, schemasDir, includeSchemas, verbose, options) {
   const planArgs = [
     "plan",
@@ -18364,6 +19099,10 @@ function executePgSchemaDiffPlan(dbUrl, schemasDir, includeSchemas, verbose, opt
     logger4.error(`Exit code: ${planResult.status}`);
     logger4.error(`Signal: ${planResult.signal || "none"}`);
     logger4.error(`Stderr: ${planStderr || "(empty)"}`);
+    const extDetection = detectMissingExtensionType(planStderr || planOutput);
+    if (extDetection.detected) {
+      logger4.error(formatExtensionErrorHint(extDetection));
+    }
     throw new Error(
       `pg-schema-diff plan failed (exit ${planResult.status}): ${planStderr || "(no output)"}`
     );
@@ -18421,6 +19160,10 @@ async function executeApplyWithRetry(applyArgs, verbose, config) {
     }
     logger5.error("pg-schema-diff apply failed:");
     logger5.error(errorOutput);
+    const extDetection = detectMissingExtensionType(errorOutput);
+    if (extDetection.detected) {
+      logger5.error(formatExtensionErrorHint(extDetection));
+    }
     return {
       success: false,
       error: new Error(`pg-schema-diff apply failed: ${errorOutput}`),
@@ -19887,16 +20630,16 @@ var ERROR_MESSAGES2 = {
   SCHEMA_NOT_FOUND: "Schema file not found"
 };
 function containsPathTraversal2(inputPath) {
-  const normalized = path10__default.normalize(inputPath);
+  const normalized = path11__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
 function isPathWithinBase(filePath, baseDir) {
   try {
-    const resolvedFile = path10__default.resolve(filePath);
-    const resolvedBase = path10__default.resolve(baseDir);
-    const normalizedFile = path10__default.normalize(resolvedFile);
-    const normalizedBase = path10__default.normalize(resolvedBase);
-    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path10__default.sep);
+    const resolvedFile = path11__default.resolve(filePath);
+    const resolvedBase = path11__default.resolve(baseDir);
+    const normalizedFile = path11__default.normalize(resolvedFile);
+    const normalizedBase = path11__default.normalize(resolvedBase);
+    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path11__default.sep);
   } catch {
     return false;
   }
@@ -19905,13 +20648,13 @@ function validateSchemaPath(dbPackagePath, projectRoot = process.cwd()) {
   if (containsPathTraversal2(dbPackagePath)) {
     throw new Error(ERROR_MESSAGES2.PATH_TRAVERSAL);
   }
-  const schemaEntry = path10__default.join(dbPackagePath, "src", "schema", "index.ts");
-  const absoluteSchemaPath = path10__default.resolve(projectRoot, schemaEntry);
+  const schemaEntry = path11__default.join(dbPackagePath, "src", "schema", "index.ts");
+  const absoluteSchemaPath = path11__default.resolve(projectRoot, schemaEntry);
   let resolvedProjectRoot;
   try {
     resolvedProjectRoot = realpathSync(projectRoot);
   } catch {
-    resolvedProjectRoot = path10__default.resolve(projectRoot);
+    resolvedProjectRoot = path11__default.resolve(projectRoot);
   }
   if (!isPathWithinBase(absoluteSchemaPath, resolvedProjectRoot)) {
     throw new Error(ERROR_MESSAGES2.PATH_TRAVERSAL);
@@ -20043,7 +20786,7 @@ function diffSchema(params) {
   };
 }
 function extractTablesFromIdempotentSql(idempotentDir, projectRoot = process.cwd()) {
-  const fullPath = path10__default.resolve(projectRoot, idempotentDir);
+  const fullPath = path11__default.resolve(projectRoot, idempotentDir);
   if (!existsSync(fullPath)) {
     return [];
   }
@@ -20052,7 +20795,7 @@ function extractTablesFromIdempotentSql(idempotentDir, projectRoot = process.cwd
   try {
     const files = readdirSync(fullPath).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const filePath = path10__default.join(fullPath, file);
+      const filePath = path11__default.join(fullPath, file);
       const content = readFileSync(filePath, "utf-8");
       const contentWithoutComments = content.replace(/--.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
       for (const match of contentWithoutComments.matchAll(createTablePattern)) {
@@ -20275,7 +21018,7 @@ async function validateGitHubOutputPath(filePath) {
   if (!filePath || filePath.trim().length === 0) {
     return { valid: false, resolvedPath: null, error: "Empty file path" };
   }
-  const normalizedPath = path10__default.normalize(filePath);
+  const normalizedPath = path11__default.normalize(filePath);
   if (normalizedPath.includes("..")) {
     return {
       valid: false,
@@ -20283,7 +21026,7 @@ async function validateGitHubOutputPath(filePath) {
       error: "Path traversal detected (..) in file path"
     };
   }
-  const absolutePath = path10__default.resolve(normalizedPath);
+  const absolutePath = path11__default.resolve(normalizedPath);
   for (const forbidden of FORBIDDEN_PATHS) {
     if (absolutePath.startsWith(forbidden) || absolutePath.includes(forbidden)) {
       return {
@@ -20637,64 +21380,6 @@ var diffVisualCommand = new Command("diff-visual").description("Visualize schema
 // src/commands/db/commands/db-drizzle.ts
 init_esm_shims();
 
-// src/internal/machines/index.ts
-init_esm_shims();
-
-// src/internal/machines/machine-runner.ts
-init_esm_shims();
-function getOutputOrThrow(snapshot2) {
-  const s = snapshot2;
-  if (s.output === void 0) {
-    throw new CLIError("Machine completed without output", "MACHINE_NO_OUTPUT", [
-      "Ensure the machine defines an `output:` function."
-    ]);
-  }
-  return s.output;
-}
-async function runMachine(params) {
-  const timeoutMs = params.timeoutMs ?? 10 * 60 * 1e3;
-  return new Promise((resolve12, reject) => {
-    const actor = createActor(params.machine, { input: params.input });
-    const timer = setTimeout(() => {
-      try {
-        actor.stop?.();
-      } catch {
-      }
-      reject(
-        new CLIError("Machine execution timed out", "MACHINE_TIMEOUT", [
-          `Timeout: ${timeoutMs}ms`,
-          "Consider increasing timeoutMs for long-running operations."
-        ])
-      );
-    }, timeoutMs);
-    const sub = actor.subscribe((snapshot2) => {
-      try {
-        params.onSnapshot?.(snapshot2);
-        const stateName = params.helpers.getStateName(snapshot2);
-        params.onTransition?.(stateName);
-        if (params.helpers.isComplete(snapshot2)) {
-          clearTimeout(timer);
-          sub.unsubscribe();
-          const out = getOutputOrThrow(snapshot2);
-          resolve12(out);
-        }
-      } catch (err) {
-        clearTimeout(timer);
-        sub.unsubscribe();
-        reject(err);
-      }
-    });
-    try {
-      actor.start();
-      actor.send({ type: "START" });
-    } catch (err) {
-      clearTimeout(timer);
-      sub.unsubscribe();
-      reject(err);
-    }
-  });
-}
-
 // src/utils/execution-plan.ts
 init_esm_shims();
 function getChangeIcon(type) {
@@ -20762,7 +21447,7 @@ async function analyzeSchemaChanges() {
   try {
     const { getDatabasePackagePath: getDatabasePackagePath2 } = await Promise.resolve().then(() => (init_config_loader(), config_loader_exports));
     const dbPath = await getDatabasePackagePath2();
-    const schemaPath = path10__default.join(dbPath, "src/schema/");
+    const schemaPath = path11__default.join(dbPath, "src/schema/");
     const { stdout } = await execa("git", ["diff", "--cached", "--", schemaPath]);
     const lines = stdout.split("\n");
     return parseDiffLines(lines);
@@ -20965,6 +21650,10 @@ var RISK_PATTERNS = [
 function normalizeContent(content) {
   return content.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\s+/g, " ").trim();
 }
+function stripSqlCommentsPreserveLines(content) {
+  const lineMasked = content.replace(/--[^\n]*/g, (match) => " ".repeat(match.length));
+  return lineMasked.replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "));
+}
 function maskWrapperFunctions(content) {
   const wrapperPattern = /CREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+(?:public\.)?runa_auth_\w+\s*\([^)]*\)[^$]*(\$[a-zA-Z_]*\$)[\s\S]*?\1;?/gi;
   return content.replace(wrapperPattern, "/* WRAPPER_FUNCTION_MASKED */");
@@ -20979,6 +21668,9 @@ function findLineNumber(originalContent, matchText) {
   const beforeMatch = originalContent.substring(0, match.index);
   return beforeMatch.split("\n").length;
 }
+function lineNumberFromIndex(content, index) {
+  return content.substring(0, Math.max(0, index)).split("\n").length;
+}
 function detectRisksFromContent(normalizedContent, originalContent) {
   const risks = [];
   const seenDescriptions = /* @__PURE__ */ new Set();
@@ -21001,18 +21693,18 @@ function detectRisksFromContent(normalizedContent, originalContent) {
   }
   return risks;
 }
-function detectForeignKeyRisks(lines) {
+function detectForeignKeyRisks(originalContent) {
   const risks = [];
-  const fkPattern = /REFERENCES\s+[\w."]+\s*\(/i;
-  for (let i = 0; i < lines.length; i++) {
-    if (fkPattern.test(lines[i])) {
-      risks.push({
-        level: "low",
-        description: "Foreign key columns should have indexes",
-        mitigation: "Add index on foreign key column for better performance",
-        line: i + 1
-      });
-    }
+  const fkPattern = /REFERENCES\s+[\w."]+\s*\(/gi;
+  const contentWithoutComments = stripSqlCommentsPreserveLines(originalContent);
+  let match;
+  while ((match = fkPattern.exec(contentWithoutComments)) !== null) {
+    risks.push({
+      level: "low",
+      description: "Foreign key columns should have indexes",
+      mitigation: "Add index on foreign key column for better performance",
+      line: lineNumberFromIndex(originalContent, match.index ?? 0)
+    });
   }
   return risks;
 }
@@ -21024,9 +21716,8 @@ async function detectSchemaRisks(filePath) {
     const content = await readFile(filePath, "utf-8");
     const maskedContent = maskWrapperFunctions(content);
     const normalizedContent = normalizeContent(maskedContent);
-    const lines = content.split("\n");
     const contentRisks = detectRisksFromContent(normalizedContent, content);
-    const fkRisks = detectForeignKeyRisks(lines);
+    const fkRisks = detectForeignKeyRisks(content);
     return [...contentRisks, ...fkRisks];
   } catch (_error) {
     return [];
@@ -21041,7 +21732,7 @@ function categorizeRisks(risks) {
 }
 
 // src/commands/db/utils/preflight-check.ts
-init_constants();
+init_local_supabase();
 init_config_loader();
 function createInitialResult() {
   return {
@@ -21095,7 +21786,7 @@ function runDatabasePackageChecks(result, logger16, step) {
     logger16.error("Database package path is missing");
     return null;
   }
-  logger16.success(`Found database package: ${path10__default.basename(dbPackagePath)}`);
+  logger16.success(`Found database package: ${path11__default.basename(dbPackagePath)}`);
   logger16.step("Checking schema files", step.next());
   const schemaCheck = checkSchemaFiles(dbPackagePath);
   if (!schemaCheck.exists) {
@@ -21219,9 +21910,9 @@ ${stderr}`.toLowerCase();
   }
 }
 async function testDatabaseConnection(projectRoot) {
-  const ports = detectSupabasePorts(projectRoot);
-  const dbPort = ports.db;
-  const connectionUrl = `postgresql://postgres:postgres@127.0.0.1:${dbPort}/postgres`;
+  const resolvedRoot = process.cwd();
+  const connectionUrl = buildLocalDatabaseUrl(resolvedRoot);
+  const dbPort = detectLocalSupabasePorts(resolvedRoot).db;
   let sql = null;
   try {
     sql = postgres(connectionUrl, {
@@ -21243,12 +21934,12 @@ async function testDatabaseConnection(projectRoot) {
 function checkDatabasePackage() {
   const cwd = process.cwd();
   const locations = [
-    path10__default.join(cwd, "packages", "database"),
-    path10__default.join(cwd, "packages", "db"),
-    path10__default.join(cwd, "db")
+    path11__default.join(cwd, "packages", "database"),
+    path11__default.join(cwd, "packages", "db"),
+    path11__default.join(cwd, "db")
   ];
   for (const location of locations) {
-    const configPath = path10__default.join(location, "drizzle.config.ts");
+    const configPath = path11__default.join(location, "drizzle.config.ts");
     if (existsSync(configPath)) {
       return { exists: true, path: location };
     }
@@ -21293,7 +21984,7 @@ function countTsFilesRecursive(dir) {
   try {
     const entries = readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path10__default.join(dir, entry.name);
+      const fullPath = path11__default.join(dir, entry.name);
       if (entry.isDirectory()) {
         count += countTsFilesRecursive(fullPath);
       } else if (entry.isFile() && entry.name.endsWith(".ts")) {
@@ -21305,7 +21996,7 @@ function countTsFilesRecursive(dir) {
   return count;
 }
 function checkSchemaFiles(dbPackagePath) {
-  const schemaDir = path10__default.join(dbPackagePath, "src", "schema");
+  const schemaDir = path11__default.join(dbPackagePath, "src", "schema");
   if (!existsSync(schemaDir)) {
     return { exists: false, count: 0 };
   }
@@ -21342,9 +22033,9 @@ async function runOrphanCheck(env2, dbPackagePath, result, logger16, step) {
   logger16.step("Checking for orphaned database objects", step.next());
   try {
     const { expectedTables, expectedEnums } = await extractSchemaTablesAndEnums(dbPackagePath);
-    const databaseUrl = tryResolveDatabaseUrl("local") || "postgresql://postgres:postgres@localhost:54322/postgres";
+    const databaseUrl = tryResolveDatabaseUrl("local") || buildLocalDatabaseUrl(process.cwd());
     const { dbTables, dbEnums } = await fetchDbTablesAndEnums(databaseUrl, {
-      schemaDir: path10__default.join(dbPackagePath, "src", "schema")
+      schemaDir: path11__default.join(dbPackagePath, "src", "schema")
     });
     let excludeFromOrphanDetection = [];
     let idempotentSqlDir = "supabase/schemas/idempotent";
@@ -21386,31 +22077,39 @@ function runExtensionConfigCheck(_result, logger16, step) {
   logger16.step("Checking PostgreSQL extension configuration", step.next());
   try {
     const extensionResult = checkExtensionConfig(process.cwd());
-    if (extensionResult.usedExtensions.length === 0) {
+    if (!extensionResult || typeof extensionResult !== "object") {
+      logger16.warn("Extension config check returned invalid result");
+      return;
+    }
+    const usedExtensions = extensionResult.usedExtensions ?? [];
+    if (usedExtensions.length === 0) {
       logger16.success("No extensions detected in SQL files");
       return;
     }
+    const sqlManaged = extensionResult.sqlManagedExtensions ?? [];
+    const supabaseManaged = extensionResult.supabaseManagedExtensions ?? [];
     const parts = [];
-    if (extensionResult.sqlManagedExtensions.length > 0) {
-      parts.push(`${extensionResult.sqlManagedExtensions.length} SQL-managed`);
+    if (sqlManaged.length > 0) {
+      parts.push(`${sqlManaged.length} SQL-managed`);
     }
-    if (extensionResult.supabaseManagedExtensions.length > 0) {
-      parts.push(`${extensionResult.supabaseManagedExtensions.length} Supabase-managed`);
+    if (supabaseManaged.length > 0) {
+      parts.push(`${supabaseManaged.length} Supabase-managed`);
     }
     const summary = parts.join(", ");
-    logger16.success(`${extensionResult.usedExtensions.length} extension(s) found (${summary})`);
-    for (const note of extensionResult.notes) {
+    logger16.success(`${usedExtensions.length} extension(s) found (${summary})`);
+    const notes = extensionResult.notes ?? [];
+    for (const note of notes) {
       logger16.info(`  ${note}`);
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
-    logger16.warn(`Extension config check skipped: ${message}`);
+    logger16.warn(`Extension config check failed: ${message}`);
   }
 }
 async function runSqlSchemaRiskCheck(result, logger16, step) {
   logger16.step("Checking SQL schema for risky patterns", step.next());
   const cwd = process.cwd();
-  const sqlDir = path10__default.join(cwd, "supabase", "schemas", "declarative");
+  const sqlDir = path11__default.join(cwd, "supabase", "schemas", "declarative");
   if (!existsSync(sqlDir)) {
     logger16.success("No SQL schema directory found (supabase/schemas/declarative/)");
     return;
@@ -21423,7 +22122,7 @@ async function runSqlSchemaRiskCheck(result, logger16, step) {
     }
     const allRisks = [];
     for (const sqlFile of sqlFiles) {
-      const filePath = path10__default.join(sqlDir, sqlFile);
+      const filePath = path11__default.join(sqlDir, sqlFile);
       const risks = await detectSchemaRisks(filePath);
       for (const risk of risks) {
         allRisks.push({ ...risk, file: sqlFile });
@@ -23175,7 +23874,7 @@ async function checkPort(port) {
   };
 }
 function detectSupabasePortsFromConfig() {
-  const configPath = path10__default.join(process.cwd(), "supabase", "config.toml");
+  const configPath = path11__default.join(process.cwd(), "supabase", "config.toml");
   const BASE_PORTS = { api: 54321, db: 54322, studio: 54323, inbucket: 54324 };
   if (!existsSync(configPath)) {
     return Object.values(BASE_PORTS);
@@ -23264,7 +23963,7 @@ var BASE_PORT = 54321;
 var PORTS_PER_SLOT = 10;
 var TOTAL_SLOTS = 100;
 function calculatePortOffset(projectPath) {
-  const normalizedPath = path10__default.resolve(projectPath);
+  const normalizedPath = path11__default.resolve(projectPath);
   const hash = createHash("md5").update(normalizedPath).digest("hex");
   return parseInt(hash.slice(0, 8), 16) % TOTAL_SLOTS;
 }
@@ -23285,7 +23984,7 @@ function getSupabasePorts(projectPath) {
 }
 function updateSupabaseConfigPorts(projectPath) {
   const ports = getSupabasePorts(projectPath);
-  const configPath = path10__default.join(projectPath, "supabase", "config.toml");
+  const configPath = path11__default.join(projectPath, "supabase", "config.toml");
   if (!existsSync(configPath)) {
     return { updated: false, ports, configPath };
   }
@@ -23320,7 +24019,7 @@ function getPortAllocationSummary(projectPath) {
   const ports = getSupabasePorts(projectPath);
   const offset = calculatePortOffset(projectPath);
   return [
-    `Port allocation for: ${path10__default.basename(projectPath)}`,
+    `Port allocation for: ${path11__default.basename(projectPath)}`,
     `  Slot: ${offset} (hash-based)`,
     `  API:     ${ports.api}`,
     `  DB:      ${ports.db}`,
@@ -23354,7 +24053,7 @@ function parseSeedPaths(configPath) {
   }
 }
 async function applySeedFile(seedPath, dbUrl) {
-  const supabaseDir = path10__default.join(process.cwd(), "supabase");
+  const supabaseDir = path11__default.join(process.cwd(), "supabase");
   const absolutePath = resolveSafePath(supabaseDir, seedPath);
   if (!existsSync(absolutePath)) {
     return;
@@ -23365,12 +24064,12 @@ async function applySeedFile(seedPath, dbUrl) {
   });
 }
 async function applySeeds2(configPath) {
-  const configFile = path10__default.join(process.cwd(), "supabase", "config.toml");
+  const configFile = path11__default.join(process.cwd(), "supabase", "config.toml");
   const seedPaths = parseSeedPaths(configFile);
   if (seedPaths.length === 0) {
     return;
   }
-  const supabaseDir = path10__default.join(process.cwd(), "supabase");
+  const supabaseDir = path11__default.join(process.cwd(), "supabase");
   const safePaths = filterSafePaths(seedPaths, supabaseDir);
   if (safePaths.length === 0) {
     return;
@@ -23788,7 +24487,7 @@ var validateCommand = new Command("validate").description("Validate schema files
   const logger16 = createCLILogger("db:validate");
   try {
     logger16.section("Schema Validation");
-    const schemasPath = path10__default.join(process.cwd(), "packages", "database", "src", "schema");
+    const schemasPath = path11__default.join(process.cwd(), "packages", "database", "src", "schema");
     if (!existsSync(schemasPath)) {
       throw new CLIError("Schema directory not found", "SCHEMA_DIR_NOT_FOUND", [
         `Expected location: ${schemasPath}`,
@@ -23953,8 +24652,8 @@ var generateCommand = new Command("generate").description("Generate TypeScript t
 var listCommand = new Command("list").description("List managed schemas from drizzle.config.ts").option("--sql", "Output as SQL-compatible string for IN clauses").option("--json", "Output as JSON array").action(async (options) => {
   const logger16 = createCLILogger("db:schema:list");
   try {
-    const dbPackagePath = path10__default.join(process.cwd(), "packages", "database");
-    if (!existsSync(path10__default.join(dbPackagePath, "drizzle.config.ts"))) {
+    const dbPackagePath = path11__default.join(process.cwd(), "packages", "database");
+    if (!existsSync(path11__default.join(dbPackagePath, "drizzle.config.ts"))) {
       throw new CLIError("drizzle.config.ts not found", "CONFIG_NOT_FOUND", [
         `Expected location: ${dbPackagePath}/drizzle.config.ts`,
         "Ensure you are in the project root",
@@ -25193,7 +25892,7 @@ var testGenCommand = new Command("test:gen").description("Generate pgTAP behavio
     const databaseUrl = options.db || process.env.DATABASE_URL || getLocalDbUrl();
     const schemas = options.schemas ? options.schemas.split(",") : void 0;
     const dbPackage = databasePaths.package();
-    const defaultOutputPath = path10__default.join(dbPackage, "tests/00_behavior.generated.test.sql");
+    const defaultOutputPath = path11__default.join(dbPackage, "tests/00_behavior.generated.test.sql");
     const outputPath = options.output || defaultOutputPath;
     spinner.text = "Generating pgTAP behavior tests...";
     const result = await dbGeneratePgTapTests({
@@ -26205,108 +26904,8 @@ async function getVercelRootDirectory() {
   return info?.rootDirectory ?? null;
 }
 
-// src/commands/env/constants/local-supabase.ts
-init_esm_shims();
-var DEFAULT_API_PORT = 54321;
-var DEFAULT_DB_PORT = 54322;
-function parsePortFromToml(content, section, key) {
-  const sectionRegex = new RegExp(`\\[${section}\\]([\\s\\S]*?)(?=\\n\\[|$)`, "g");
-  const sectionMatch = sectionRegex.exec(content);
-  if (!sectionMatch) return null;
-  const sectionContent = sectionMatch[1];
-  const keyRegex = new RegExp(`^\\s*${key}\\s*=\\s*(\\d+)`, "m");
-  const keyMatch = keyRegex.exec(sectionContent);
-  if (!keyMatch) return null;
-  const port = Number.parseInt(keyMatch[1], 10);
-  return Number.isFinite(port) && port > 0 && port < 65536 ? port : null;
-}
-function readPortsFromConfigToml(projectRoot) {
-  const configPath = path10__default.join(projectRoot, "supabase", "config.toml");
-  try {
-    const content = readFileSync(configPath, "utf-8");
-    const apiPort = parsePortFromToml(content, "api", "port");
-    const dbPort = parsePortFromToml(content, "db", "port");
-    if (apiPort !== null || dbPort !== null) {
-      return {
-        api: apiPort ?? DEFAULT_API_PORT,
-        db: dbPort ?? DEFAULT_DB_PORT
-      };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function detectLocalSupabasePorts(projectRoot = process.cwd()) {
-  const configPorts = readPortsFromConfigToml(projectRoot);
-  if (configPorts) {
-    return configPorts;
-  }
-  return {
-    api: DEFAULT_API_PORT,
-    db: DEFAULT_DB_PORT
-  };
-}
-var LOCAL_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0";
-var LOCAL_SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImV4cCI6MTk4MzgxMjk5Nn0.EGIM96RAZx35lJzdJsyH-qQwv8Hdp7fsn3W0YpN81IU";
-function buildLocalSupabaseUrl(projectRoot = process.cwd()) {
-  const ports = detectLocalSupabasePorts(projectRoot);
-  return `http://127.0.0.1:${ports.api}`;
-}
-function buildLocalDatabaseUrl(projectRoot = process.cwd()) {
-  const ports = detectLocalSupabasePorts(projectRoot);
-  return `postgresql://postgres:postgres@127.0.0.1:${ports.db}/postgres`;
-}
-function getLocalSupabaseEnvValues(projectRoot = process.cwd()) {
-  const supabaseUrl = buildLocalSupabaseUrl(projectRoot);
-  const databaseUrl = buildLocalDatabaseUrl(projectRoot);
-  return {
-    // Database URLs
-    DATABASE_URL: databaseUrl,
-    DATABASE_URL_ADMIN: databaseUrl,
-    DATABASE_URL_SERVICE: databaseUrl,
-    // Supabase URLs and keys
-    NEXT_PUBLIC_SUPABASE_URL: supabaseUrl,
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: LOCAL_SUPABASE_ANON_KEY,
-    SUPABASE_SERVICE_ROLE_KEY: LOCAL_SUPABASE_SERVICE_ROLE_KEY
-  };
-}
-function getLocalValueDescriptions(projectRoot = process.cwd()) {
-  const ports = detectLocalSupabasePorts(projectRoot);
-  return {
-    DATABASE_URL: `localhost:${ports.db} (PostgreSQL)`,
-    DATABASE_URL_ADMIN: `localhost:${ports.db} (PostgreSQL)`,
-    DATABASE_URL_SERVICE: `localhost:${ports.db} (PostgreSQL)`,
-    NEXT_PUBLIC_SUPABASE_URL: `localhost:${ports.api} (Supabase API)`,
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: "local anon key (supabase-demo)",
-    SUPABASE_SERVICE_ROLE_KEY: "local service key (supabase-demo)"
-  };
-}
-var LOCAL_SUPABASE_ENV_VALUES = getLocalSupabaseEnvValues();
-getLocalValueDescriptions();
-function validateLocalhostValues(envValues) {
-  const urlKeys = [
-    "DATABASE_URL",
-    "DATABASE_URL_ADMIN",
-    "DATABASE_URL_SERVICE",
-    "NEXT_PUBLIC_SUPABASE_URL"
-  ];
-  const invalidEntries = [];
-  for (const key of urlKeys) {
-    const value = envValues[key];
-    if (value && !value.includes("127.0.0.1") && !value.includes("localhost")) {
-      invalidEntries.push(key);
-    }
-  }
-  if (invalidEntries.length > 0) {
-    throw new Error(
-      `LOCAL_SUPABASE_ENV_VALUES safety check failed: The following keys do not point to localhost: ${invalidEntries.join(", ")}. This is a safety feature to prevent accidental production database connections during local development.`
-    );
-  }
-}
-validateLocalhostValues(LOCAL_SUPABASE_ENV_VALUES);
-
 // src/commands/env/commands/env-pull.ts
+init_local_supabase();
 var ERROR_MESSAGES3 = {
   INVALID_PATH: "Invalid working directory path",
   PATH_TRAVERSAL: "Working directory path validation failed",
@@ -26338,16 +26937,16 @@ function sanitizeErrorMessage(message) {
   return sanitized;
 }
 function containsPathTraversal3(inputPath) {
-  const normalized = path10__default.normalize(inputPath);
+  const normalized = path11__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
 function isPathWithinBase2(filePath, baseDir) {
   try {
-    const resolvedFile = path10__default.resolve(filePath);
-    const resolvedBase = path10__default.resolve(baseDir);
-    const normalizedFile = path10__default.normalize(resolvedFile);
-    const normalizedBase = path10__default.normalize(resolvedBase);
-    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path10__default.sep);
+    const resolvedFile = path11__default.resolve(filePath);
+    const resolvedBase = path11__default.resolve(baseDir);
+    const normalizedFile = path11__default.normalize(resolvedFile);
+    const normalizedBase = path11__default.normalize(resolvedBase);
+    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path11__default.sep);
   } catch {
     return false;
   }
@@ -26356,12 +26955,12 @@ function validateCustomWorkingDir(cwdPath, projectRoot) {
   if (containsPathTraversal3(cwdPath)) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
   }
-  const absolutePath = path10__default.isAbsolute(cwdPath) ? cwdPath : path10__default.resolve(projectRoot, cwdPath);
+  const absolutePath = path11__default.isAbsolute(cwdPath) ? cwdPath : path11__default.resolve(projectRoot, cwdPath);
   let resolvedProjectRoot;
   try {
     resolvedProjectRoot = realpathSync(projectRoot);
   } catch {
-    resolvedProjectRoot = path10__default.resolve(projectRoot);
+    resolvedProjectRoot = path11__default.resolve(projectRoot);
   }
   if (!isPathWithinBase2(absolutePath, resolvedProjectRoot)) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
@@ -26388,6 +26987,27 @@ function validateAppDirectory2(appName, projectRoot) {
   }
   return appDir;
 }
+var LOCAL_BOOTSTRAP_REQUIRED_KEYS = [
+  "LOCAL_SUPABASE_HOST",
+  "LOCAL_SUPABASE_API_PORT",
+  "LOCAL_SUPABASE_DB_PORT"
+];
+function getMissingLocalBootstrapKeys(parsed) {
+  return LOCAL_BOOTSTRAP_REQUIRED_KEYS.filter((key) => !(key in parsed));
+}
+function getLocalBootstrapStatusFromParsed(parsed) {
+  const missing = getMissingLocalBootstrapKeys(parsed);
+  return {
+    status: missing.length === 0 ? "ok" : "partial",
+    missing
+  };
+}
+function missingLocalBootstrapReport() {
+  return {
+    status: "missing",
+    missing: [...LOCAL_BOOTSTRAP_REQUIRED_KEYS]
+  };
+}
 var EnvPullOutputSchema = z.object({
   results: z.array(
     z.object({
@@ -26401,6 +27021,10 @@ var EnvPullOutputSchema = z.object({
   totalPulled: z.number(),
   totalFailed: z.number(),
   totalEncrypted: z.number().optional(),
+  localBootstrap: z.object({
+    status: z.enum(["ok", "partial", "missing"]),
+    missing: z.array(z.string())
+  }).optional(),
   /** Vercel Root Directory sync result */
   vercelSync: z.object({
     detected: z.boolean(),
@@ -26533,60 +27157,74 @@ function removePrivateKeysFromEnvFile(filePath) {
   writeFileSync(filePath, `${newContent}
 `, "utf-8");
 }
-function replaceWithLocalValues(filePath, logger16, dryRun = false) {
+function replaceWithLocalValues(filePath, workDir, logger16, dryRun = false) {
   if (!existsSync(filePath)) {
     logger16.warn("  \u26A0\uFE0F  .env.development not found (was pull successful?)");
-    return;
+    return missingLocalBootstrapReport();
   }
   const content = readFileSync(filePath, "utf-8");
   if (!content.trim()) {
     logger16.warn("  \u26A0\uFE0F  .env.development is empty (no env vars in Vercel?)");
-    return;
+    return missingLocalBootstrapReport();
   }
   const parsed = parse(content);
   if (Object.keys(parsed).length === 0) {
     logger16.warn("  \u26A0\uFE0F  No valid env vars found in .env.development (check syntax)");
-    return;
+    return missingLocalBootstrapReport();
   }
-  const projectRoot = process.cwd();
-  const localEnvValues = getLocalSupabaseEnvValues(projectRoot);
-  const localDescriptions = getLocalValueDescriptions(projectRoot);
+  const localEnvValues = getLocalSupabaseEnvValues(workDir);
+  const localDescriptions = getLocalValueDescriptions(workDir);
   const replacementKeys = Object.keys(localEnvValues);
   const replacedKeys = [];
+  const hasAnySupabaseKey = Object.keys(parsed).some((key) => key.includes("SUPABASE") || key.includes("DATABASE_URL")) || replacementKeys.some((key) => key in parsed);
   for (const key of replacementKeys) {
-    if (key in parsed && localEnvValues[key]) {
+    if (key in parsed || hasAnySupabaseKey) {
       parsed[key] = localEnvValues[key];
       replacedKeys.push(key);
     }
   }
   if (replacedKeys.length === 0) {
-    const hasAnySupabaseKey = Object.keys(parsed).some(
+    const hasAnySupabaseKey2 = Object.keys(parsed).some(
       (k) => k.includes("SUPABASE") || k.includes("DATABASE_URL")
     );
-    if (hasAnySupabaseKey) {
+    if (hasAnySupabaseKey2) {
       logger16.warn("  \u26A0\uFE0F  Found Supabase keys but none matched local replacement patterns");
     } else {
       logger16.info("  No Supabase variables found (may be expected for new projects)");
     }
-    return;
+    return getLocalBootstrapStatusFromParsed(parsed);
   }
+  const bootstrapStatus = getLocalBootstrapStatusFromParsed(parsed);
+  if (bootstrapStatus.missing.length > 0) {
+    logger16.warn(
+      `  \u26A0\uFE0F  Some local bootstrap keys were not updated: ${bootstrapStatus.missing.join(", ")}`
+    );
+  }
+  const ensureRequired = bootstrapStatus.status === "ok";
   const newContent = Object.entries(parsed).map(([key, value]) => `${key}=${formatEnvValue(value)}`).join("\n");
   if (dryRun) {
-    logger16.info(`  \u{1F3E0} Would replace ${replacedKeys.length} variables with localhost values:`);
+    logger16.info(`  \u{1F3E0} Would replace ${replacedKeys.length} variables with local values:`);
     for (const key of replacedKeys) {
       const description = localDescriptions[key] || "localhost";
       logger16.info(`     ${key} \u2192 ${description}`);
     }
+    logger16.info(
+      `  ${ensureRequired ? "\u2705" : "\u26A0\uFE0F"}  Local bootstrap keys ready: ${ensureRequired ? "yes" : "partial"}`
+    );
     logger16.info("  (dry-run: no files modified)");
-    return;
+    return bootstrapStatus;
   }
   writeFileSync(filePath, `${newContent}
 `, "utf-8");
-  logger16.success(`  \u{1F3E0} Replaced ${replacedKeys.length} variables with localhost values:`);
+  logger16.success(`  \u{1F3E0} Replaced ${replacedKeys.length} variables with local values:`);
   for (const key of replacedKeys) {
     const description = localDescriptions[key] || "localhost";
     logger16.info(`     ${key} \u2192 ${description}`);
   }
+  logger16.info(
+    `  ${ensureRequired ? "\u2705" : "\u26A0\uFE0F"}  Local bootstrap keys ready: ${ensureRequired ? "yes" : "partial"}`
+  );
+  return bootstrapStatus;
 }
 async function encryptFile2(workDir, filePath, logger16) {
   if (!existsSync(filePath)) {
@@ -26818,13 +27456,20 @@ async function runEnvPullAction(options) {
   }
   logger16.info("");
   const results = await pullAllEnvironments(workDir, environments, auth, logger16);
-  if (!options.productionAll) {
+  const shouldEvaluateLocalBootstrap = !options.productionAll && (!options.environment || options.environment === "development");
+  let localBootstrap;
+  if (shouldEvaluateLocalBootstrap) {
     const devResult = results.find((r) => r.environment === "development" && r.success);
     if (devResult) {
       logger16.info("");
       logger16.info("Applying local Supabase values to .env.development...");
-      replaceWithLocalValues(devResult.outputPath, logger16, options.check);
+      localBootstrap = replaceWithLocalValues(devResult.outputPath, workDir, logger16, options.check);
+    } else {
+      localBootstrap = missingLocalBootstrapReport();
+      logger16.warn("  LOCAL_BOOTSTRAP: skipped (development env pull failed or missing)");
     }
+  } else {
+    localBootstrap = void 0;
   }
   if (options.encrypt && !options.check) {
     await encryptPulledFiles(workDir, results, logger16);
@@ -26845,6 +27490,7 @@ async function runEnvPullAction(options) {
     totalPulled,
     totalFailed,
     totalEncrypted: options.encrypt ? totalEncrypted : void 0,
+    localBootstrap,
     vercelSync: vercelSyncResult
   });
   if (totalFailed > 0) {
@@ -28584,13 +29230,13 @@ z.object({
 
 // src/commands/hotfix/metadata.ts
 function getHotfixDir(targetDir) {
-  return path10__default.join(targetDir, ".runa", "hotfix");
+  return path11__default.join(targetDir, ".runa", "hotfix");
 }
 function getCurrentFile(targetDir) {
-  return path10__default.join(getHotfixDir(targetDir), "current.json");
+  return path11__default.join(getHotfixDir(targetDir), "current.json");
 }
 function getArchiveDir(targetDir) {
-  return path10__default.join(getHotfixDir(targetDir), "archive");
+  return path11__default.join(getHotfixDir(targetDir), "archive");
 }
 async function ensureHotfixDir(targetDir) {
   await mkdir(getHotfixDir(targetDir), { recursive: true });
@@ -28600,7 +29246,7 @@ async function ensureArchiveDir(targetDir) {
 }
 async function getHotfixMetadata(input3 = {}) {
   const parsed = GetHotfixInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path10__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
   const currentFile = getCurrentFile(targetDir);
   if (!existsSync(currentFile)) {
     return null;
@@ -28610,7 +29256,7 @@ async function getHotfixMetadata(input3 = {}) {
 }
 async function createHotfixMetadata(input3) {
   const parsed = CreateHotfixMetadataInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path10__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
   await ensureHotfixDir(targetDir);
   const metadata = {
     branch: parsed.branch,
@@ -28627,7 +29273,7 @@ async function createHotfixMetadata(input3) {
 }
 async function updateHotfixStatus(input3) {
   const parsed = UpdateHotfixInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path10__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
   const current = await getHotfixMetadata({ targetDir });
   if (!current) {
     throw createError("HOTFIX_NOT_FOUND");
@@ -28644,13 +29290,13 @@ async function updateHotfixStatus(input3) {
   return updated;
 }
 async function archiveHotfix(targetDir) {
-  const dir = targetDir ? path10__default.resolve(targetDir) : process.cwd();
+  const dir = targetDir ? path11__default.resolve(targetDir) : process.cwd();
   const current = await getHotfixMetadata({ targetDir: dir });
   if (!current) {
     throw createError("HOTFIX_NOT_FOUND");
   }
   await ensureArchiveDir(dir);
-  const archiveFile = path10__default.join(
+  const archiveFile = path11__default.join(
     getArchiveDir(dir),
     `${current.branch.replace(/\//g, "-")}-${Date.now()}.json`
   );
@@ -28666,7 +29312,7 @@ async function archiveHotfix(targetDir) {
   return archived;
 }
 async function cancelHotfix(targetDir) {
-  const dir = targetDir ? path10__default.resolve(targetDir) : process.cwd();
+  const dir = targetDir ? path11__default.resolve(targetDir) : process.cwd();
   await updateHotfixStatus({
     status: "cancelled",
     completedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -28676,7 +29322,7 @@ async function cancelHotfix(targetDir) {
 }
 async function listArchivedHotfixes(input3 = {}) {
   const parsed = ListArchivedHotfixesInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path10__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
   const archiveDir = getArchiveDir(targetDir);
   if (!existsSync(archiveDir)) {
     return { hotfixes: [] };
@@ -28685,7 +29331,7 @@ async function listArchivedHotfixes(input3 = {}) {
   const hotfixes = [];
   for (const file of files.filter((f) => f.endsWith(".json"))) {
     try {
-      const content = await readFile(path10__default.join(archiveDir, file), "utf-8");
+      const content = await readFile(path11__default.join(archiveDir, file), "utf-8");
       hotfixes.push(HotfixMetadataSchema.parse(JSON.parse(content)));
     } catch {
     }
@@ -30185,13 +30831,13 @@ function validateVersion(version) {
   }
 }
 function getCacheBase() {
-  return path10__default.join(os.homedir(), ".cache", "runa", "templates");
+  return path11__default.join(os.homedir(), ".cache", "runa", "templates");
 }
 function getCacheDir(version) {
   validateVersion(version);
   const cacheBase = getCacheBase();
-  const cacheDir = path10__default.join(cacheBase, version);
-  const resolvedCacheDir = path10__default.resolve(cacheDir);
+  const cacheDir = path11__default.join(cacheBase, version);
+  const resolvedCacheDir = path11__default.resolve(cacheDir);
   if (!isPathContained(cacheBase, resolvedCacheDir)) {
     throw new CLIError(
       "Security: cache directory would escape allowed location.",
@@ -30203,7 +30849,7 @@ function getCacheDir(version) {
 }
 function isCached(version) {
   const cacheDir = getCacheDir(version);
-  const templatesDir = path10__default.join(cacheDir, "templates");
+  const templatesDir = path11__default.join(cacheDir, "templates");
   return fs5__default.existsSync(templatesDir);
 }
 var scopedAuthToken = null;
@@ -30254,13 +30900,13 @@ async function createTempPackageJson(tempDir, version) {
       [TEMPLATES_PACKAGE_NAME]: version
     }
   };
-  await writeFile(path10__default.join(tempDir, "package.json"), JSON.stringify(packageJson, null, 2));
+  await writeFile(path11__default.join(tempDir, "package.json"), JSON.stringify(packageJson, null, 2));
 }
 async function createTempNpmrc(tempDir) {
   const npmrc = `@r06-dev:registry=${GITHUB_PACKAGES_REGISTRY}
 //npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}
 `;
-  await writeFile(path10__default.join(tempDir, ".npmrc"), npmrc);
+  await writeFile(path11__default.join(tempDir, ".npmrc"), npmrc);
 }
 async function installTemplates(tempDir, authToken, verbose) {
   try {
@@ -30318,10 +30964,10 @@ async function installTemplates(tempDir, authToken, verbose) {
 async function verifyNoSymlinks(dir, baseDir) {
   const entries = await readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path10__default.join(dir, entry.name);
+    const fullPath = path11__default.join(dir, entry.name);
     const stats = await lstat(fullPath);
     if (stats.isSymbolicLink()) {
-      const relativePath = path10__default.relative(baseDir, fullPath);
+      const relativePath = path11__default.relative(baseDir, fullPath);
       throw new CLIError(
         "Security: Symlink detected in template package.",
         "SYMLINK_ATTACK_DETECTED",
@@ -30339,7 +30985,7 @@ async function verifyNoSymlinks(dir, baseDir) {
   }
 }
 async function copyToCache(tempDir, cacheDir) {
-  const sourceTemplates = path10__default.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
+  const sourceTemplates = path11__default.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
   if (!fs5__default.existsSync(sourceTemplates)) {
     throw new CLIError("Templates directory not found in package.", "TEMPLATES_DIR_NOT_FOUND", [
       `Expected: ${sourceTemplates}`,
@@ -30349,7 +30995,7 @@ async function copyToCache(tempDir, cacheDir) {
   }
   await verifyNoSymlinks(sourceTemplates, sourceTemplates);
   await mkdir(cacheDir, { recursive: true });
-  const targetTemplates = path10__default.join(cacheDir, "templates");
+  const targetTemplates = path11__default.join(cacheDir, "templates");
   await cp(sourceTemplates, targetTemplates, {
     recursive: true,
     dereference: false
@@ -30371,7 +31017,7 @@ async function fetchTemplates(options = {}) {
     };
   }
   const cacheDir = getCacheDir(version);
-  const templatesDir = path10__default.join(cacheDir, "templates");
+  const templatesDir = path11__default.join(cacheDir, "templates");
   if (!fresh && isCached(version)) {
     if (verbose) {
       console.log(`Using cached templates v${version}: ${templatesDir}`);
@@ -30387,7 +31033,7 @@ async function fetchTemplates(options = {}) {
     if (fresh && fs5__default.existsSync(cacheDir)) {
       await rm(cacheDir, { recursive: true, force: true });
     }
-    const tempDir = path10__default.join(os.tmpdir(), `runa-templates-${Date.now()}`);
+    const tempDir = path11__default.join(os.tmpdir(), `runa-templates-${Date.now()}`);
     await mkdir(tempDir, { recursive: true });
     try {
       if (verbose) {
@@ -30415,11 +31061,11 @@ async function fetchTemplates(options = {}) {
 }
 var MAX_WORKSPACE_TRAVERSAL_DEPTH = 10;
 function isLegitimateWorkspaceRoot(workspaceRoot) {
-  const pnpmWorkspaceFile = path10__default.join(workspaceRoot, "pnpm-workspace.yaml");
+  const pnpmWorkspaceFile = path11__default.join(workspaceRoot, "pnpm-workspace.yaml");
   if (!fs5__default.existsSync(pnpmWorkspaceFile)) {
     return false;
   }
-  const rootPackageFile = path10__default.join(workspaceRoot, "package.json");
+  const rootPackageFile = path11__default.join(workspaceRoot, "package.json");
   if (!fs5__default.existsSync(rootPackageFile)) {
     return false;
   }
@@ -30433,24 +31079,24 @@ function isLegitimateWorkspaceRoot(workspaceRoot) {
   }
 }
 function resolveWorkspaceTemplates() {
-  let current = path10__default.resolve(process.cwd());
-  const root = path10__default.parse(current).root;
+  let current = path11__default.resolve(process.cwd());
+  const root = path11__default.parse(current).root;
   let depth = 0;
   while (current !== root && depth < MAX_WORKSPACE_TRAVERSAL_DEPTH) {
     if (!isLegitimateWorkspaceRoot(current)) {
-      current = path10__default.dirname(current);
+      current = path11__default.dirname(current);
       depth++;
       continue;
     }
-    const packagesTemplates = path10__default.join(current, "packages", "runa-templates", "templates");
-    const normalizedTemplatesPath = path10__default.resolve(packagesTemplates);
-    if (!normalizedTemplatesPath.startsWith(current + path10__default.sep)) {
-      current = path10__default.dirname(current);
+    const packagesTemplates = path11__default.join(current, "packages", "runa-templates", "templates");
+    const normalizedTemplatesPath = path11__default.resolve(packagesTemplates);
+    if (!normalizedTemplatesPath.startsWith(current + path11__default.sep)) {
+      current = path11__default.dirname(current);
       depth++;
       continue;
     }
     if (fs5__default.existsSync(normalizedTemplatesPath)) {
-      const markerFile = path10__default.join(current, "packages", "runa-templates", "package.json");
+      const markerFile = path11__default.join(current, "packages", "runa-templates", "package.json");
       if (fs5__default.existsSync(markerFile)) {
         try {
           const pkg = JSON.parse(fs5__default.readFileSync(markerFile, "utf-8"));
@@ -30461,7 +31107,7 @@ function resolveWorkspaceTemplates() {
         }
       }
     }
-    current = path10__default.dirname(current);
+    current = path11__default.dirname(current);
     depth++;
   }
   return void 0;
@@ -30470,9 +31116,9 @@ function resolveWorkspaceTemplates() {
 // src/commands/init.ts
 function checkZodVersion(_logger) {
   const zodPaths = [
-    path10__default.join(process.cwd(), "node_modules", "zod", "package.json"),
+    path11__default.join(process.cwd(), "node_modules", "zod", "package.json"),
     // Check home directory node_modules (common source of conflicts)
-    path10__default.join(process.env.HOME ?? "", "node_modules", "zod", "package.json")
+    path11__default.join(process.env.HOME ?? "", "node_modules", "zod", "package.json")
   ];
   for (const zodPath of zodPaths) {
     if (!fs5__default.existsSync(zodPath)) continue;
@@ -30486,7 +31132,7 @@ function checkZodVersion(_logger) {
           "ZOD_VERSION_INCOMPATIBLE",
           [
             "runa SDK requires zod v4.x, but found zod v3.x",
-            `Conflicting zod found at: ${path10__default.dirname(zodPath)}`,
+            `Conflicting zod found at: ${path11__default.dirname(zodPath)}`,
             "",
             "Solutions:",
             "1. Run from a clean project directory without existing node_modules",
@@ -30738,7 +31384,7 @@ var initCommand = new Command("init").description("Initialize pj-repo with runa
   try {
     if (options.repairConfig) {
       logger16.section("Repairing runa.config.ts");
-      const projectName2 = path10__default.basename(process.cwd());
+      const projectName2 = path11__default.basename(process.cwd());
       const repairResult = repairRunaConfig(process.cwd(), projectName2);
       if (repairResult.success) {
         logger16.success("\u2705 Config file repaired successfully");
@@ -30789,7 +31435,7 @@ var initCommand = new Command("init").description("Initialize pj-repo with runa
       existingConfig,
       force: options.force === true
     });
-    const projectName = path10__default.basename(process.cwd());
+    const projectName = path11__default.basename(process.cwd());
     logger16.info(`Project: ${projectName}`);
     logger16.step("Applying templates (SDK)", 1);
     const result = await initProject({
@@ -30886,7 +31532,9 @@ var InjectTestAttrsInputSchema = z.object({
   /** Manifest output directory */
   manifestDir: z.string().default(".runa"),
   /** Resolve Zod schemas to JSON Schema (v7+) for API contracts */
-  resolveSchemas: z.boolean().default(false)
+  resolveSchemas: z.boolean().default(false),
+  /** Fail when heuristic fallback detection is used */
+  strictDetect: z.boolean().default(false)
 }).strict();
 var FileChangeSchema = z.object({
   filePath: z.string(),
@@ -30898,6 +31546,51 @@ var MachineWithoutE2EMetaSchema = z.object({
   id: z.string(),
   sourceFile: z.string()
 });
+var DetectionScanSummarySchema = z.object({
+  totalFiles: z.number().int().nonnegative(),
+  filesWithMachineDefinitions: z.number().int().nonnegative(),
+  filesWithMachineHooks: z.number().int().nonnegative(),
+  filesWithJsxOnly: z.number().int().nonnegative()
+}).strict();
+var MachineResolutionDetailSchema = z.object({
+  filePath: z.string(),
+  machineRef: z.string(),
+  resolvedId: z.string(),
+  source: z.enum(["explicit", "import", "inline", "fallback"])
+}).strict();
+var DetectionDiagnosticsSchema = z.object({
+  schemaVersion: z.literal(1),
+  scan: DetectionScanSummarySchema,
+  resolution: z.object({
+    totalMachineUsages: z.number().int().nonnegative(),
+    bySource: z.object({
+      explicit: z.number().int().nonnegative(),
+      import: z.number().int().nonnegative(),
+      inline: z.number().int().nonnegative(),
+      fallback: z.number().int().nonnegative()
+    }).strict(),
+    fallbackRate: z.number().min(0).max(1),
+    fallbackExamples: z.array(MachineResolutionDetailSchema)
+  }).strict(),
+  coverage: z.object({
+    totalManifestMachines: z.number().int().nonnegative(),
+    linkedManifestMachines: z.number().int().nonnegative(),
+    unlinkedManifestMachines: z.number().int().nonnegative(),
+    machineLinkCoverage: z.number().min(0).max(1),
+    unlinkedManifestMachineIds: z.array(z.string())
+  }).strict(),
+  warnings: z.array(
+    z.object({
+      severity: z.enum(["warning", "info", "hint"]),
+      message: z.string()
+    }).strict()
+  )
+}).strict();
+var StrictDetectStatusSchema = z.object({
+  enabled: z.literal(true),
+  passed: z.boolean(),
+  reasons: z.array(z.string())
+}).strict();
 var InjectTestAttrsOutputSchema = z.object({
   totalFiles: z.number(),
   changedFiles: z.number(),
@@ -30909,17 +31602,98 @@ var InjectTestAttrsOutputSchema = z.object({
   /** Number of machines in manifest */
   manifestMachineCount: z.number().optional(),
   /** Machines without meta.e2e annotation (opt-in warning) */
-  machinesWithoutE2EMeta: z.array(MachineWithoutE2EMetaSchema).optional()
+  machinesWithoutE2EMeta: z.array(MachineWithoutE2EMetaSchema).optional(),
+  /** Structured diagnostics for detection quality */
+  detectionDiagnostics: DetectionDiagnosticsSchema.optional(),
+  /** Strict detection mode result */
+  strictDetect: StrictDetectStatusSchema.optional()
 }).strict();
 
 // src/commands/inject-test-attrs/processor.ts
 init_esm_shims();
 
+// src/commands/inject-test-attrs/detection-diagnostics.ts
+init_esm_shims();
+var MAX_EXAMPLES = 20;
+function normalizeMachineId(id) {
+  return id.replace(/-([a-z])/g, (_, char) => char.toUpperCase()).replace(/Machine$/i, "").toLowerCase();
+}
+function buildDetectionDiagnostics(params) {
+  const bySource = {
+    explicit: 0,
+    import: 0,
+    inline: 0,
+    fallback: 0
+  };
+  const fallbackExamples = [];
+  for (const detail of params.resolutionDetails) {
+    bySource[detail.source] += 1;
+    if (detail.source === "fallback" && fallbackExamples.length < MAX_EXAMPLES) {
+      fallbackExamples.push(detail);
+    }
+  }
+  const linkedMachineIds = new Set(
+    params.machineLinks.filter((link) => link.usedIn.length > 0).map((link) => normalizeMachineId(link.machineName))
+  );
+  const linkedManifestMachineIds = [];
+  const unlinkedManifestMachineIds = [];
+  for (const machineId of params.manifestMachineIds) {
+    if (linkedMachineIds.has(normalizeMachineId(machineId))) {
+      linkedManifestMachineIds.push(machineId);
+      continue;
+    }
+    unlinkedManifestMachineIds.push(machineId);
+  }
+  const totalMachineUsages = params.resolutionDetails.length;
+  const fallbackRate = totalMachineUsages > 0 ? bySource.fallback / totalMachineUsages : 0;
+  const totalManifestMachines = params.manifestMachineIds.length;
+  const linkedManifestMachines = linkedManifestMachineIds.length;
+  const machineLinkCoverage = totalManifestMachines > 0 ? linkedManifestMachines / totalManifestMachines : 1;
+  return {
+    schemaVersion: 1,
+    scan: params.scanSummary,
+    resolution: {
+      totalMachineUsages,
+      bySource,
+      fallbackRate,
+      fallbackExamples
+    },
+    coverage: {
+      totalManifestMachines,
+      linkedManifestMachines,
+      unlinkedManifestMachines: totalManifestMachines - linkedManifestMachines,
+      machineLinkCoverage,
+      unlinkedManifestMachineIds: unlinkedManifestMachineIds.slice(0, MAX_EXAMPLES)
+    },
+    warnings: params.warnings
+  };
+}
+function evaluateStrictDetect(diagnostics) {
+  const reasons = [];
+  const fallbackCount = diagnostics.resolution.bySource.fallback;
+  if (fallbackCount > 0) {
+    reasons.push(`fallback machine resolution detected (${fallbackCount})`);
+  }
+  if (diagnostics.scan.filesWithMachineHooks > 0 && diagnostics.resolution.totalMachineUsages === 0) {
+    reasons.push(
+      `machine hooks were detected in ${diagnostics.scan.filesWithMachineHooks} files, but no machine usages were resolved`
+    );
+  }
+  if (diagnostics.resolution.totalMachineUsages > 0 && diagnostics.coverage.totalManifestMachines > 0 && diagnostics.coverage.linkedManifestMachines === 0) {
+    reasons.push("machine usages were detected, but no machines were linked to routes/pages");
+  }
+  return {
+    enabled: true,
+    passed: reasons.length === 0,
+    reasons
+  };
+}
+
 // src/commands/inject-test-attrs/formatter.ts
 init_esm_shims();
 async function formatFilesWithBiome(files, cwd) {
   if (files.length === 0) return;
-  const relativePaths = files.map((f) => path10.relative(cwd, f));
+  const relativePaths = files.map((f) => path11.relative(cwd, f));
   try {
     await execa("pnpm", ["exec", "biome", "format", "--write", ...relativePaths], {
       cwd,
@@ -31011,7 +31785,8 @@ function emptyResult(filePath) {
     changed: false,
     actions: [],
     fields: [],
-    testIds: []
+    testIds: [],
+    resolutionDetails: []
   };
 }
 function ensureDirectoryExists(dirPath) {
@@ -31021,7 +31796,7 @@ function ensureDirectoryExists(dirPath) {
 }
 function getGeneratorVersion() {
   try {
-    const pkgPath = path10.resolve(__dirname$1, "../../../package.json");
+    const pkgPath = path11.resolve(__dirname$1, "../../../package.json");
     if (fs5.existsSync(pkgPath)) {
       const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
       return pkg.version ?? "unknown";
@@ -31036,15 +31811,15 @@ function detectPlatform(repoRoot) {
   const nextConfigPatterns = ["next.config.ts", "next.config.js", "next.config.mjs"];
   for (const pattern of nextConfigPatterns) {
     const paths = [
-      path10.join(repoRoot, pattern),
-      path10.join(repoRoot, "apps", "web", pattern),
-      path10.join(repoRoot, "apps", "dashboard", pattern)
+      path11.join(repoRoot, pattern),
+      path11.join(repoRoot, "apps", "web", pattern),
+      path11.join(repoRoot, "apps", "dashboard", pattern)
     ];
     if (paths.some((p) => fs5.existsSync(p))) {
       return "nextjs";
     }
   }
-  const appJsonPath = path10.join(repoRoot, "app.json");
+  const appJsonPath = path11.join(repoRoot, "app.json");
   if (fs5.existsSync(appJsonPath)) {
     try {
       const appJson = JSON.parse(fs5.readFileSync(appJsonPath, "utf-8"));
@@ -31054,7 +31829,7 @@ function detectPlatform(repoRoot) {
     } catch {
     }
   }
-  if (fs5.existsSync(path10.join(repoRoot, "expo.json"))) {
+  if (fs5.existsSync(path11.join(repoRoot, "expo.json"))) {
     return "expo";
   }
   const electronPatterns = [
@@ -31063,56 +31838,38 @@ function detectPlatform(repoRoot) {
     "electron.vite.config.ts",
     "electron.vite.config.js"
   ];
-  if (electronPatterns.some((p) => fs5.existsSync(path10.join(repoRoot, p)))) {
+  if (electronPatterns.some((p) => fs5.existsSync(path11.join(repoRoot, p)))) {
     return "electron";
   }
   return "unknown";
 }
-function findPossibleHonoDirs(repoRoot) {
-  const possibleDirs = [];
-  const appsDir = path10.join(repoRoot, "apps");
-  if (fs5.existsSync(appsDir)) {
-    try {
-      const apps = fs5.readdirSync(appsDir, { withFileTypes: true });
-      for (const app of apps) {
-        if (app.isDirectory()) {
-          const routesDir = path10.join(appsDir, app.name, "routes");
-          if (fs5.existsSync(routesDir)) {
-            const files = fs5.readdirSync(routesDir);
-            const hasRouteFiles = files.some(
-              (f) => f.endsWith(".ts") && !f.endsWith(".test.ts") && !f.endsWith(".spec.ts")
-            );
-            if (hasRouteFiles) {
-              possibleDirs.push(`apps/${app.name}/routes`);
-            }
-          }
-        }
-      }
-    } catch {
-    }
+function hasHonoRouteFiles(dir) {
+  try {
+    const files = fs5.readdirSync(dir);
+    return files.some(
+      (file) => file.endsWith(".ts") && !file.endsWith(".test.ts") && !file.endsWith(".spec.ts")
+    );
+  } catch {
+    return false;
   }
-  const packagesDir = path10.join(repoRoot, "packages");
-  if (fs5.existsSync(packagesDir)) {
-    try {
-      const packages = fs5.readdirSync(packagesDir, { withFileTypes: true });
-      for (const pkg of packages) {
-        if (pkg.isDirectory()) {
-          const routesDir = path10.join(packagesDir, pkg.name, "routes");
-          if (fs5.existsSync(routesDir)) {
-            const files = fs5.readdirSync(routesDir);
-            const hasRouteFiles = files.some(
-              (f) => f.endsWith(".ts") && !f.endsWith(".test.ts") && !f.endsWith(".spec.ts")
-            );
-            if (hasRouteFiles) {
-              possibleDirs.push(`packages/${pkg.name}/routes`);
-            }
-          }
-        }
-      }
-    } catch {
-    }
+}
+function collectRouteDirsInScope(repoRoot, scope) {
+  const scopeDir = path11.join(repoRoot, scope);
+  if (!fs5.existsSync(scopeDir)) {
+    return [];
   }
-  return possibleDirs;
+  try {
+    const entries = fs5.readdirSync(scopeDir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((entryName) => hasHonoRouteFiles(path11.join(scopeDir, entryName, "routes"))).map((entryName) => `${scope}/${entryName}/routes`);
+  } catch {
+    return [];
+  }
+}
+function findPossibleHonoDirs(repoRoot) {
+  return [
+    ...collectRouteDirsInScope(repoRoot, "apps"),
+    ...collectRouteDirsInScope(repoRoot, "packages")
+  ];
 }
 function collectManifestWarnings(repoRoot, platform, apiContracts, machinesWithoutE2EMeta, totalMachines) {
   const warnings = [];
@@ -31163,15 +31920,18 @@ function printManifestWarnings(warnings, verbose) {
       for (const detail of warning.details) {
         console.log(detail);
       }
-      if (warning.details.length < warning._totalCount) {
-        console.log(`  ... and more`);
-      }
     }
     if (warning.fix) {
       console.log(`   \u2192 ${warning.fix}`);
     }
   }
 }
+function toDetectionWarnings(warnings) {
+  return warnings.map((warning) => ({
+    severity: warning.severity,
+    message: warning.message
+  }));
+}
 function normalizeToCanonicalId(id) {
   return id.replace(/-([a-z])/g, (_, c) => c.toUpperCase()).replace(/Machine$/i, "");
 }
@@ -31259,7 +32019,7 @@ async function analyzeHonoRoutes(repoRoot, verbose, resolveSchemas = false) {
       return { apiContracts: [], schemasResolved: false };
     }
     if (verbose) {
-      console.log(`  Analyzing Hono routes in: ${path10.relative(repoRoot, routesPath)}`);
+      console.log(`  Analyzing Hono routes in: ${path11.relative(repoRoot, routesPath)}`);
       if (resolveSchemas) {
         console.log("  Schema resolution enabled (--resolve-schemas)");
       }
@@ -31305,7 +32065,7 @@ async function analyzeHonoRoutes(repoRoot, verbose, resolveSchemas = false) {
     return { apiContracts: [], schemasResolved: false };
   }
 }
-async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSchemas = false) {
+async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSchemas = false, diagnosticsInput) {
   const registry = getInjectionRegistry();
   const generatorVersion = getGeneratorVersion();
   const e2eManifest = buildManifest(registry, generatorVersion);
@@ -31319,18 +32079,18 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
   }
   const definitionMap = buildDefinitionMap(machineDefinitions);
   const enhancedMachines = buildEnhancedMachines(e2eManifest, definitionMap, machineDefinitions);
-  const absoluteManifestDir = path10.isAbsolute(manifestDir) ? manifestDir : path10.join(repoRoot, manifestDir);
+  const absoluteManifestDir = path11.isAbsolute(manifestDir) ? manifestDir : path11.join(repoRoot, manifestDir);
   if (!isPathContained(repoRoot, absoluteManifestDir)) {
     throw new Error(
       `Security error: Manifest directory '${manifestDir}' would escape the project root. The --manifest-dir must be a relative path within the project directory.`
     );
   }
   ensureDirectoryExists(absoluteManifestDir);
-  const generatedDir = path10.join(absoluteManifestDir, "generated");
+  const generatedDir = path11.join(absoluteManifestDir, "generated");
   ensureDirectoryExists(generatedDir);
-  const manifestsDir = path10.join(absoluteManifestDir, "manifests");
+  const manifestsDir = path11.join(absoluteManifestDir, "manifests");
   ensureDirectoryExists(manifestsDir);
-  const tsPath = path10.join(generatedDir, "selectors.ts");
+  const tsPath = path11.join(generatedDir, "selectors.ts");
   await fs5.promises.writeFile(tsPath, generateSelectorTypeScript(e2eManifest), "utf-8");
   const unifiedRegistry = getUnifiedRegistry();
   const machineLinks = buildMachineLinks();
@@ -31345,6 +32105,29 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
   const jstOffset = 9 * 60 * 60 * 1e3;
   const jst = new Date(now.getTime() + jstOffset);
   const generatedAtJST = `${jst.getUTCFullYear()}-${String(jst.getUTCMonth() + 1).padStart(2, "0")}-${String(jst.getUTCDate()).padStart(2, "0")}T${String(jst.getUTCHours()).padStart(2, "0")}:${String(jst.getUTCMinutes()).padStart(2, "0")}:${String(jst.getUTCSeconds()).padStart(2, "0")}+09:00`;
+  const machinesWithoutE2EMeta = machineDefinitions.filter(
+    (def) => !def.hasE2EMeta && typeof def.id === "string"
+  ).map((def) => ({ id: def.id, sourceFile: def.sourceFile }));
+  const warnings = collectManifestWarnings(
+    repoRoot,
+    platform,
+    apiContracts,
+    machinesWithoutE2EMeta,
+    machineDefinitions.length
+  );
+  printManifestWarnings(warnings, verbose);
+  const detectionDiagnostics = buildDetectionDiagnostics({
+    scanSummary: diagnosticsInput?.scanSummary ?? {
+      totalFiles: 0,
+      filesWithMachineDefinitions: 0,
+      filesWithMachineHooks: 0,
+      filesWithJsxOnly: 0
+    },
+    resolutionDetails: diagnosticsInput?.resolutionDetails ?? [],
+    manifestMachineIds: Object.keys(enhancedMachines),
+    machineLinks,
+    warnings: toDetectionWarnings(warnings)
+  });
   const unifiedManifest = {
     version: manifestVersion,
     generatedAt: generatedAtJST,
@@ -31357,17 +32140,15 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
     authBoundaries: unifiedRegistry.authBoundaries,
     machineDefinitions: unifiedRegistry.machineDefinitions,
     machineLinks,
-    apiContracts
+    apiContracts,
+    detectionDiagnostics
   };
-  const manifestPath = path10.join(manifestsDir, "manifest.json");
+  const manifestPath = path11.join(manifestsDir, "manifest.json");
   await fs5.promises.writeFile(manifestPath, JSON.stringify(unifiedManifest, null, 2), "utf-8");
-  const machinesWithoutE2EMeta = machineDefinitions.filter(
-    (def) => !def.hasE2EMeta && typeof def.id === "string"
-  ).map((def) => ({ id: def.id, sourceFile: def.sourceFile }));
   if (verbose) {
-    console.log(`Generated selectors: ${path10.relative(repoRoot, tsPath)}`);
+    console.log(`Generated selectors: ${path11.relative(repoRoot, tsPath)}`);
     console.log(
-      `Generated manifest: ${path10.relative(repoRoot, manifestPath)} (v${manifestVersion})`
+      `Generated manifest: ${path11.relative(repoRoot, manifestPath)} (v${manifestVersion})`
     );
     console.log(`  Platform: ${platform}`);
     console.log(`  Machine definitions: ${machineDefinitions.length}`);
@@ -31381,19 +32162,15 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
       `  API contracts: ${apiContracts.length}${schemasResolved ? " (with schemas)" : ""}`
     );
     console.log(`  Machine links: ${machineLinks.length}`);
+    console.log(
+      `  Detection: fallback=${detectionDiagnostics.resolution.bySource.fallback}, linkCoverage=${(detectionDiagnostics.coverage.machineLinkCoverage * 100).toFixed(1)}%`
+    );
   }
-  const warnings = collectManifestWarnings(
-    repoRoot,
-    platform,
-    apiContracts,
-    machinesWithoutE2EMeta,
-    machineDefinitions.length
-  );
-  printManifestWarnings(warnings, verbose);
   return {
-    manifestPath: path10.relative(repoRoot, tsPath),
+    manifestPath: path11.relative(repoRoot, tsPath),
     machineCount: Object.keys(enhancedMachines).length,
-    machinesWithoutE2EMeta
+    machinesWithoutE2EMeta,
+    detectionDiagnostics
   };
 }
 
@@ -31425,7 +32202,7 @@ function registerExistingInjections(machineIds, attrs, sourceFile) {
 }
 async function preprocessFile(filePath, repoRoot, options) {
   let code = await fs5.promises.readFile(filePath, "utf-8");
-  const relativePath = path10.relative(repoRoot, filePath);
+  const relativePath = path11.relative(repoRoot, filePath);
   collectRouteInfo(relativePath, code, options.verbose);
   const hasMarker = code.includes(CLI_INJECTION_MARKER);
   if (hasMarker && options.force) {
@@ -31456,14 +32233,15 @@ async function preprocessFile(filePath, repoRoot, options) {
         injectedCount: 0,
         machineIds,
         changed: false,
-        ...attrs
+        ...attrs,
+        resolutionDetails: []
       }
     };
   }
   return { code, hasMarker: false, skipped: false };
 }
 function transformAndRegister(filePath, code, repoRoot, options) {
-  const relativePath = path10.relative(repoRoot, filePath);
+  const relativePath = path11.relative(repoRoot, filePath);
   const readAndParseFile = createReadAndParseFile(options.verbose);
   const resolveImportPath = createResolveImportPath();
   try {
@@ -31479,6 +32257,14 @@ function transformAndRegister(filePath, code, repoRoot, options) {
     const transformedCode = markerComment + result.code;
     const { actions, fields, testIds } = extractInjectedAttributes(transformedCode);
     const machineIds = [...result.resolvedIds.values()];
+    const resultWithResolution = result;
+    const rawResolutionDetails = Array.isArray(resultWithResolution.resolutionDetails) ? resultWithResolution.resolutionDetails : [];
+    const resolutionDetails = rawResolutionDetails.map((detail) => ({
+      filePath: relativePath,
+      machineRef: detail.machineRef,
+      resolvedId: detail.resolvedId,
+      source: detail.source
+    }));
     registerExistingInjections(machineIds, { actions, fields, testIds }, relativePath);
     return {
       filePath,
@@ -31488,7 +32274,8 @@ function transformAndRegister(filePath, code, repoRoot, options) {
       transformedCode,
       actions,
       fields,
-      testIds
+      testIds,
+      resolutionDetails
     };
   } catch (error) {
     if (options.verbose) {
@@ -31509,7 +32296,7 @@ async function processFileForChildInjection(filePath, repoRoot, options) {
   if (prep.skipped && prep.skipResult) return prep.skipResult;
   const result = transformAndRegister(filePath, prep.code, repoRoot, options);
   if (options.verbose && result.changed && result.injectedCount > 0) {
-    const relativePath = path10.relative(repoRoot, filePath);
+    const relativePath = path11.relative(repoRoot, filePath);
     console.log(
       `  [child] Injected ${result.injectedCount} attrs in ${relativePath} (actions: ${result.actions.join(", ")})`
     );
@@ -31529,7 +32316,7 @@ async function handleChangedFile(result, check, repoRoot, verbose, state2) {
   await fs5.promises.writeFile(result.filePath, result.transformedCode, "utf-8");
   state2.filesToFormat.push(result.filePath);
   if (verbose) {
-    const relativePath = path10.relative(repoRoot, result.filePath);
+    const relativePath = path11.relative(repoRoot, result.filePath);
     console.log(`  Injected ${result.injectedCount} attrs in ${relativePath}`);
   }
 }
@@ -31540,6 +32327,60 @@ async function formatChangedFiles(filesToFormat, repoRoot, verbose) {
   }
   await formatFilesWithBiome(filesToFormat, repoRoot);
 }
+function createScanSummary(params) {
+  return {
+    totalFiles: params.files.length,
+    filesWithMachineDefinitions: params.withMachineDefinitions.length,
+    filesWithMachineHooks: params.withMachineHooks.length,
+    filesWithJsxOnly: params.withJsxOnly.length
+  };
+}
+async function resolveManifestArtifacts(params) {
+  let manifestPath;
+  let manifestMachineCount;
+  let machinesWithoutE2EMeta;
+  let detectionDiagnostics;
+  if (params.manifest && !params.check) {
+    const diagnosticsInput = {
+      scanSummary: params.scanSummary,
+      resolutionDetails: params.resolutionDetails
+    };
+    const manifestResult = await generateManifestFiles(
+      params.manifestDir,
+      params.repoRoot,
+      params.verbose,
+      params.resolveSchemas,
+      diagnosticsInput
+    );
+    manifestPath = manifestResult.manifestPath;
+    manifestMachineCount = manifestResult.machineCount;
+    machinesWithoutE2EMeta = manifestResult.machinesWithoutE2EMeta;
+    detectionDiagnostics = manifestResult.detectionDiagnostics;
+  } else if (params.manifest && params.check) {
+    const warnings = [];
+    detectionDiagnostics = buildDetectionDiagnostics({
+      scanSummary: params.scanSummary,
+      resolutionDetails: params.resolutionDetails,
+      manifestMachineIds: [],
+      machineLinks: [],
+      warnings
+    });
+  }
+  const strictDetectStatus = params.strictDetect ? detectionDiagnostics ? evaluateStrictDetect(detectionDiagnostics) : {
+    enabled: true,
+    passed: false,
+    reasons: [
+      "strict detect requires manifest diagnostics, but diagnostics were unavailable"
+    ]
+  } : void 0;
+  return {
+    manifestPath,
+    manifestMachineCount,
+    machinesWithoutE2EMeta,
+    detectionDiagnostics,
+    strictDetectStatus
+  };
+}
 function mightContainMachineDefinition(code) {
   return code.includes("createMachine");
 }
@@ -31563,13 +32404,34 @@ async function categorizeFiles(files) {
   return { withMachineDefinitions, withMachineHooks, withJsxOnly };
 }
 async function processFiles(options) {
-  const { repoRoot, check, verbose, include, exclude, manifest, manifestDir, resolveSchemas } = options;
+  const {
+    repoRoot,
+    check,
+    verbose,
+    include,
+    exclude,
+    manifest,
+    manifestDir,
+    resolveSchemas,
+    strictDetect
+  } = options;
   clearInjectionRegistry();
   clearUnifiedRegistry();
   const files = await discoverFiles(repoRoot, include, exclude);
   if (verbose) console.log(`Found ${files.length} files to process`);
-  const state2 = { changes: [], filesToFormat: [], totalInjections: 0 };
+  const state2 = {
+    changes: [],
+    filesToFormat: [],
+    totalInjections: 0,
+    resolutionDetails: []
+  };
   const { withMachineDefinitions, withMachineHooks, withJsxOnly } = await categorizeFiles(files);
+  const scanSummary = createScanSummary({
+    files,
+    withMachineDefinitions,
+    withMachineHooks,
+    withJsxOnly
+  });
   if (verbose) {
     console.log(`  Files with machine definitions: ${withMachineDefinitions.length}`);
     console.log(`  Files with machine hooks: ${withMachineHooks.length}`);
@@ -31579,46 +32441,50 @@ async function processFiles(options) {
   for (const filePath of withMachineDefinitions) {
     try {
       const code = await fs5.promises.readFile(filePath, "utf-8");
-      const relativePath = path10.relative(repoRoot, filePath);
+      const relativePath = path11.relative(repoRoot, filePath);
       collectRouteInfo(relativePath, code, verbose);
     } catch {
     }
   }
   for (const filePath of withMachineHooks) {
     const result = await processFile(filePath, repoRoot, processOpts);
+    state2.resolutionDetails.push(...result.resolutionDetails);
     await handleChangedFile(result, check, repoRoot, verbose, state2);
   }
   for (const filePath of withJsxOnly) {
     const result = await processFileForChildInjection(filePath, repoRoot, processOpts);
+    state2.resolutionDetails.push(...result.resolutionDetails);
     await handleChangedFile(result, check, repoRoot, verbose, state2);
   }
   if (!check) {
     await formatChangedFiles(state2.filesToFormat, repoRoot, verbose);
   }
   postProcessRegistries();
-  let manifestPath;
-  let manifestMachineCount;
-  let machinesWithoutE2EMeta;
-  if (manifest && !check) {
-    const manifestResult = await generateManifestFiles(
-      manifestDir,
-      repoRoot,
-      verbose,
-      resolveSchemas ?? false
-    );
-    manifestPath = manifestResult.manifestPath;
-    manifestMachineCount = manifestResult.machineCount;
-    machinesWithoutE2EMeta = manifestResult.machinesWithoutE2EMeta;
-  }
+  const manifestArtifacts = await resolveManifestArtifacts({
+    manifest,
+    check,
+    manifestDir,
+    repoRoot,
+    verbose,
+    resolveSchemas: resolveSchemas ?? false,
+    strictDetect: strictDetect ?? false,
+    scanSummary,
+    resolutionDetails: state2.resolutionDetails
+  });
+  const hasCheckFailure = check && state2.changes.length > 0;
+  const hasStrictDetectFailure = manifestArtifacts.strictDetectStatus?.passed === false;
+  const exitCode = hasCheckFailure || hasStrictDetectFailure ? 1 : 0;
   return {
     totalFiles: files.length,
     changedFiles: state2.changes.length,
     totalInjections: state2.totalInjections,
     changes: state2.changes,
-    exitCode: check && state2.changes.length > 0 ? 1 : 0,
-    manifestPath,
-    manifestMachineCount,
-    machinesWithoutE2EMeta
+    exitCode,
+    manifestPath: manifestArtifacts.manifestPath,
+    manifestMachineCount: manifestArtifacts.manifestMachineCount,
+    machinesWithoutE2EMeta: manifestArtifacts.machinesWithoutE2EMeta,
+    detectionDiagnostics: manifestArtifacts.detectionDiagnostics,
+    strictDetect: manifestArtifacts.strictDetectStatus
   };
 }
 
@@ -31678,6 +32544,35 @@ function logMachinesWithoutE2EMeta(result, logger16) {
   logger16.info("    }");
   logger16.info("  See: .claude/rules/xstate-design.md#meta.e2e");
 }
+function logDetectionDiagnostics(result, logger16) {
+  if (!result.detectionDiagnostics) return;
+  const diagnostics = result.detectionDiagnostics;
+  const fallbackCount = diagnostics.resolution.bySource.fallback;
+  const fallbackRate = (diagnostics.resolution.fallbackRate * 100).toFixed(1);
+  const coverage = (diagnostics.coverage.machineLinkCoverage * 100).toFixed(1);
+  logger16.info("");
+  logger16.info(
+    `Detection diagnostics: usages=${diagnostics.resolution.totalMachineUsages}, fallback=${fallbackCount} (${fallbackRate}%), linkCoverage=${coverage}%`
+  );
+  if (fallbackCount > 0) {
+    for (const item of diagnostics.resolution.fallbackExamples.slice(0, 5)) {
+      logger16.warn(
+        `  fallback: ${item.filePath} :: ${item.machineRef} -> ${item.resolvedId} (${item.source})`
+      );
+    }
+  }
+}
+function logStrictDetect(result, logger16) {
+  if (!result.strictDetect) return;
+  if (result.strictDetect.passed) {
+    logger16.success("Strict detect passed (no fallback resolution)");
+    return;
+  }
+  logger16.error("Strict detect failed");
+  for (const reason of result.strictDetect.reasons) {
+    logger16.error(`  - ${reason}`);
+  }
+}
 async function injectTestAttrsAction(rawOptions, command) {
   const logger16 = createCLILogger("manifest");
   const parseResult = InjectTestAttrsInputSchema.safeParse(rawOptions);
@@ -31688,6 +32583,20 @@ async function injectTestAttrsAction(rawOptions, command) {
     ]);
   }
   const options = parseResult.data;
+  if (options.strictDetect && options.check) {
+    throw new CLIError(
+      "--strict-detect cannot be used with --check",
+      "STRICT_DETECT_CHECK_UNSUPPORTED",
+      ["Run without --check to evaluate strict detection against manifest diagnostics"]
+    );
+  }
+  if (options.strictDetect && !options.manifest) {
+    throw new CLIError(
+      "--strict-detect requires manifest generation",
+      "STRICT_DETECT_MANIFEST_REQUIRED",
+      ["Remove --no-manifest, or disable --strict-detect"]
+    );
+  }
   const repoRoot = findProjectRoot$1() ?? process.cwd();
   if (!options.check) {
     logger16.section("Generating manifest (manifest.json)");
@@ -31706,6 +32615,8 @@ async function injectTestAttrsAction(rawOptions, command) {
   logResultSummary(result, options, logger16);
   logManifestInfo(result, logger16);
   logMachinesWithoutE2EMeta(result, logger16);
+  logDetectionDiagnostics(result, logger16);
+  logStrictDetect(result, logger16);
   emitJsonSuccess(command, InjectTestAttrsOutputSchema, result);
   if (result.exitCode !== 0) {
     process.exit(result.exitCode);
@@ -31725,7 +32636,7 @@ var injectTestAttrsCommand = new Command("inject-test-attrs").description("Injec
   "**/*.test.*",
   "**/*.spec.*",
   "**/*.stories.*"
-]).option("--no-manifest", "Skip E2E selector manifest generation").option("--manifest-dir <dir>", "Output directory for manifest files", ".runa").action(async (rawOptions) => {
+]).option("--no-manifest", "Skip E2E selector manifest generation").option("--manifest-dir <dir>", "Output directory for manifest files", ".runa").option("--strict-detect", "Fail when fallback machine detection is used (for deterministic CI)").action(async (rawOptions) => {
   await injectTestAttrsAction(rawOptions, injectTestAttrsCommand);
 });
 
@@ -31789,7 +32700,7 @@ var manifestCommand = new Command("manifest").description("Generate E2E manifest
   "**/*.test.*",
   "**/*.spec.*",
   "**/*.stories.*"
-]).option("--no-manifest", "Skip manifest file generation (attributes only)").option("--manifest-dir <dir>", "Output directory for manifest files", ".runa").action(async (options) => {
+]).option("--no-manifest", "Skip manifest file generation (attributes only)").option("--manifest-dir <dir>", "Output directory for manifest files", ".runa").option("--strict-detect", "Fail when fallback machine detection is used (for deterministic CI)").action(async (options) => {
   await injectTestAttrsAction(options, manifestCommand);
 });
 
@@ -31848,7 +32759,7 @@ function assertNodeAuthToken(options) {
   }
 }
 function getPackageVersion(packagePath) {
-  const packageJsonPath = path10__default.join(packagePath, "package.json");
+  const packageJsonPath = path11__default.join(packagePath, "package.json");
   if (!existsSync(packageJsonPath)) {
     throw new CLIError(`package.json not found at ${packagePath}`, "PACKAGE_NOT_FOUND");
   }
@@ -31867,7 +32778,7 @@ function resolveWorkspaceDependencies(workspaceRoot, packages, logger16) {
   const sdkPackage = packages.find((p) => p.name === "SDK");
   const xstatePluginPackage = packages.find((p) => p.name === "xstate-test-plugin");
   if (!sdkPackage) return;
-  const cliPackagePath = path10__default.join(workspaceRoot, "packages", "cli", "package.json");
+  const cliPackagePath = path11__default.join(workspaceRoot, "packages", "cli", "package.json");
   if (!existsSync(cliPackagePath)) return;
   let content = readFileSync(cliPackagePath, "utf-8");
   let updated = false;
@@ -31896,7 +32807,7 @@ function resolveWorkspaceDependencies(workspaceRoot, packages, logger16) {
   }
 }
 function restoreWorkspaceDependencies(workspaceRoot) {
-  const cliPackagePath = path10__default.join(workspaceRoot, "packages", "cli", "package.json");
+  const cliPackagePath = path11__default.join(workspaceRoot, "packages", "cli", "package.json");
   if (!existsSync(cliPackagePath)) return;
   let content = readFileSync(cliPackagePath, "utf-8");
   content = content.replace(/"@runa-ai\/runa": "\^[\d.]+"/, '"@runa-ai/runa": "workspace:*"');
@@ -32008,7 +32919,7 @@ function collectPackageInfo(workspaceRoot, logger16, stepNum) {
   logger16.step("Collecting package info", stepNum);
   const packages = [];
   for (const pkgConfig of PUBLISHABLE_PACKAGES) {
-    const pkgPath = path10__default.join(workspaceRoot, "packages", pkgConfig.dir);
+    const pkgPath = path11__default.join(workspaceRoot, "packages", pkgConfig.dir);
     const version = getPackageVersion(pkgPath);
     const exists = checkVersionExists(pkgConfig.publishName, version);
     packages.push({
@@ -33397,8 +34308,8 @@ var compareActor = fromPromise(async ({ input: input3 }) => {
       const result = compareBothFiles(
         runaRelPath,
         templateRelPath,
-        path10.join(repoRoot, runaRelPath),
-        path10.join(templateDir, templateRelPath),
+        path11.join(repoRoot, runaRelPath),
+        path11.join(templateDir, templateRelPath),
         runaFile.category,
         options.diff ?? false
       );
@@ -33849,7 +34760,7 @@ var discoverActor = fromPromise(async ({ input: input3 }) => {
     const runaPattern = rule.runa;
     const runaFiles = await globFiles(repoRoot, runaPattern);
     for (const file of runaFiles) {
-      const relativePath = path10.relative(repoRoot, file.absolutePath);
+      const relativePath = path11.relative(repoRoot, file.absolutePath);
       const key = generateComparisonKey(relativePath, false);
       inventory.runaFiles.set(relativePath, {
         ...file,
@@ -33863,7 +34774,7 @@ var discoverActor = fromPromise(async ({ input: input3 }) => {
     const templatePattern = rule.template;
     const templateFiles = await globFiles(templateDir, templatePattern);
     for (const file of templateFiles) {
-      const relativePath = path10.relative(templateDir, file.absolutePath);
+      const relativePath = path11.relative(templateDir, file.absolutePath);
       const key = generateComparisonKey(relativePath, true);
       inventory.templateFiles.set(relativePath, {
         ...file,
@@ -33912,7 +34823,7 @@ async function matchDoubleWildcard(ctx, entries) {
   await walkAndMatch({ ...ctx, partIndex: ctx.partIndex + 1 });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const subDir = path10.join(ctx.currentDir, entry.name);
+      const subDir = path11.join(ctx.currentDir, entry.name);
       await walkAndMatch({ ...ctx, currentDir: subDir });
     }
   }
@@ -33921,7 +34832,7 @@ async function matchSingleWildcard(ctx, entries, pattern, isLastPart) {
   const regex = patternToRegex(pattern);
   for (const entry of entries) {
     if (regex.test(entry.name)) {
-      const entryPath = path10.join(ctx.currentDir, entry.name);
+      const entryPath = path11.join(ctx.currentDir, entry.name);
       await processEntry(ctx, entryPath, entry.isFile(), entry.isDirectory(), isLastPart);
     }
   }
@@ -33931,14 +34842,14 @@ async function matchBraceExpansion(ctx, entries, pattern, isLastPart) {
   for (const option of options) {
     for (const entry of entries) {
       if (entry.name === option) {
-        const entryPath = path10.join(ctx.currentDir, entry.name);
+        const entryPath = path11.join(ctx.currentDir, entry.name);
         await processEntry(ctx, entryPath, entry.isFile(), entry.isDirectory(), isLastPart);
       }
     }
   }
 }
 async function matchLiteral(ctx, pattern, isLastPart) {
-  const entryPath = path10.join(ctx.currentDir, pattern);
+  const entryPath = path11.join(ctx.currentDir, pattern);
   if (!fs5.existsSync(entryPath)) return;
   const stats = fs5.statSync(entryPath);
   await processEntry(ctx, entryPath, stats.isFile(), stats.isDirectory(), isLastPart);
@@ -34463,15 +35374,15 @@ function printActionsNeeded(logger16, actions) {
   );
 }
 function findRepoRoot3(startDir) {
-  const { existsSync: existsSync51, readFileSync: readFileSync29 } = __require("fs");
+  const { existsSync: existsSync52, readFileSync: readFileSync29 } = __require("fs");
   const { join: join23, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync51(join23(current, "turbo.json"))) {
+    if (existsSync52(join23(current, "turbo.json"))) {
       return current;
     }
     const pkgPath = join23(current, "package.json");
-    if (existsSync51(pkgPath)) {
+    if (existsSync52(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
         if (pkg.workspaces) {
@@ -34539,10 +35450,10 @@ function generateReportOutput(output3, isJsonMode) {
   };
 }
 function validateRunaRepo(repoRoot) {
-  const { existsSync: existsSync51 } = __require("fs");
+  const { existsSync: existsSync52 } = __require("fs");
   const { join: join23 } = __require("path");
   const templateDir = join23(repoRoot, "packages/runa-templates/templates");
-  if (!existsSync51(templateDir)) {
+  if (!existsSync52(templateDir)) {
     throw new CLIError("template-check is a runa-repo only command", "NOT_RUNA_REPO", [
       "This command compares runa-repo with pj-repo templates",
       "It should only be run in the runa repository",
@@ -34644,11 +35555,29 @@ init_esm_shims();
 
 // src/commands/test/commands/test.ts
 init_esm_shims();
+function resolveEffectiveRequireManifest(options) {
+  if (options.requireManifest && options.allowManifestFallback) {
+    throw new CLIError(
+      "--require-manifest and --allow-manifest-fallback are mutually exclusive",
+      "TEST_MANIFEST_FLAGS_EXCLUSIVE",
+      ["Use strict mode (default) OR explicitly allow fallback, but not both"]
+    );
+  }
+  if (options.allowManifestFallback) return false;
+  return options.requireManifest;
+}
 var testCommand = new Command("test").description("Run tests (compat). Prefer: test:layer0..4 or test:static/service/integration.").option("--layer <number>", "Run specific layer (0-4)").option("--from <number>", "Run from layer N to 4").option("--to <number>", "Run from layer 0 to N").option("--ci", "CI mode (fail fast, no interactive)").option("--verbose", "Verbose output").option("--record", "Record test results to database", true).option(
   "--report-json <path>",
   "Export test report as JSON. If <path> is a bare filename, it will be written under .runa/tmp/."
-).option("--generate", "Generate tests from XState before running (integration)").option("--advanced", "Generate advanced tests (integration)").option("--auto", "Zero-config auto-generation (integration)").option("--base-url <url>", "Override base URL (integration)").option("--changed", "Run only impacted layers based on git diff (service)").option("--base <ref>", "Base ref for --changed (service)").option("--skip-missing", "Skip layers with missing dependencies instead of failing").action(async (options) => {
+).option("--generate", "Generate tests from XState before running (integration)").option("--advanced", "Generate advanced tests (integration)").option("--auto", "Zero-config auto-generation (integration)").option("--base-url <url>", "Override base URL (integration)").option("--changed", "Run only impacted layers based on git diff (service)").option("--base <ref>", "Base ref for --changed (service)").option("--skip-missing", "Skip layers with missing dependencies instead of failing").option(
+  "--require-manifest",
+  "Require manifest to be present and valid for Layer 3/4 tests (strict behavior)"
+).option(
+  "--allow-manifest-fallback",
+  "Allow fallback behavior when manifest is missing/invalid (disables Layer 4 strict default)"
+).action(async (options) => {
   try {
+    const effectiveRequireManifest = resolveEffectiveRequireManifest(options);
     const output3 = await runTest({
       layer: options.layer !== void 0 ? Number.parseInt(options.layer, 10) : void 0,
       from: options.from !== void 0 ? Number.parseInt(options.from, 10) : void 0,
@@ -34663,7 +35592,8 @@ var testCommand = new Command("test").description("Run tests (compat). Prefer: t
       baseUrl: options.baseUrl,
       changed: options.changed,
       base: options.base,
-      skipMissing: options.skipMissing
+      skipMissing: options.skipMissing,
+      requireManifest: effectiveRequireManifest
     });
     emitJsonSuccess(testCommand, TestRunOutputSchema, output3);
   } catch (error) {
@@ -34761,11 +35691,29 @@ var testApiCommand = new Command("test:api").description("Run Layer 3: API tests
 
 // src/commands/test/commands/test-e2e.ts
 init_esm_shims();
+function resolveEffectiveRequireManifest2(options) {
+  if (options.requireManifest && options.allowManifestFallback) {
+    throw new CLIError(
+      "--require-manifest and --allow-manifest-fallback are mutually exclusive",
+      "TEST_E2E_MANIFEST_FLAGS_EXCLUSIVE",
+      ["Use strict mode (default) OR explicitly allow fallback, but not both"]
+    );
+  }
+  if (options.allowManifestFallback) return false;
+  return options.requireManifest;
+}
 var testE2ECommand = new Command("test:e2e").description("Run Layer 4: E2E tests (Playwright) - Requires browser").option("--generate", "Generate tests from XState before running").option("--advanced", "Generate advanced tests (context-aware, guards, invariants, etc.)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--base-url <url>", "Explicit base URL for E2E (disables auto dev server start)").option(
+  "--require-manifest",
+  "Require manifest to be present and valid (strict behavior; enabled by default for Layer 4)"
+).option(
+  "--allow-manifest-fallback",
+  "Allow fallback behavior when manifest is missing/invalid (disables Layer 4 strict default)"
+).option(
   "--report-json <path>",
   "Export test report as JSON. If <path> is a bare filename, it will be written under .runa/tmp/."
 ).option("--verbose", "Verbose output (full error details, environment info)").action(async (options) => {
   try {
+    const effectiveRequireManifest = resolveEffectiveRequireManifest2(options);
     const output3 = await runTestIntegration({
       ci: options.ci ?? false,
       record: options.record,
@@ -34775,6 +35723,7 @@ var testE2ECommand = new Command("test:e2e").description("Run Layer 4: E2E tests
       advanced: options.advanced,
       auto: options.auto,
       baseUrl: options.baseUrl,
+      requireManifest: effectiveRequireManifest,
       invokedAs: "runa test:e2e"
     });
     emitJsonSuccess(testE2ECommand, TestIntegrationOutputSchema, output3);
@@ -34795,8 +35744,15 @@ var testE2ECommand = new Command("test:e2e").description("Run Layer 4: E2E tests
     );
   }
 });
-var testBrowserCommand = new Command("test:browser").description("Run Layer 4: Browser tests (Playwright E2E) - Alias for test:e2e").option("--generate", "Generate tests from XState before running").option("--advanced", "Generate advanced tests").option("--auto", "Zero-config auto-generation").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--base-url <url>", "Explicit base URL for E2E").option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").action(async (options) => {
+var testBrowserCommand = new Command("test:browser").description("Run Layer 4: Browser tests (Playwright E2E) - Alias for test:e2e").option("--generate", "Generate tests from XState before running").option("--advanced", "Generate advanced tests").option("--auto", "Zero-config auto-generation").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--base-url <url>", "Explicit base URL for E2E").option(
+  "--require-manifest",
+  "Require manifest to be present and valid (strict behavior; enabled by default for Layer 4)"
+).option(
+  "--allow-manifest-fallback",
+  "Allow fallback behavior when manifest is missing/invalid (disables Layer 4 strict default)"
+).option("--report-json <path>", "Export test report as JSON").option("--verbose", "Verbose output").action(async (options) => {
   try {
+    const effectiveRequireManifest = resolveEffectiveRequireManifest2(options);
     const output3 = await runTestIntegration({
       ci: options.ci ?? false,
       record: options.record,
@@ -34806,6 +35762,7 @@ var testBrowserCommand = new Command("test:browser").description("Run Layer 4: B
       advanced: options.advanced,
       auto: options.auto,
       baseUrl: options.baseUrl,
+      requireManifest: effectiveRequireManifest,
       invokedAs: "runa test:browser"
     });
     emitJsonSuccess(testBrowserCommand, TestIntegrationOutputSchema, output3);
@@ -34878,11 +35835,29 @@ var testLintCommand = new Command("test:lint").description("Run Layer 0: Lint (t
 
 // src/commands/test/commands/test-integration.ts
 init_esm_shims();
+function resolveEffectiveRequireManifest3(options) {
+  if (options.requireManifest && options.allowManifestFallback) {
+    throw new CLIError(
+      "--require-manifest and --allow-manifest-fallback are mutually exclusive",
+      "TEST_INTEGRATION_MANIFEST_FLAGS_EXCLUSIVE",
+      ["Use strict mode (default) OR explicitly allow fallback, but not both"]
+    );
+  }
+  if (options.allowManifestFallback) return false;
+  return options.requireManifest;
+}
 var testIntegrationCommand = new Command("test:integration").description("Run Layer 4: Integration tests (E2E) with auto-generation").option("--generate", "Generate tests from XState before running").option("--advanced", "Generate advanced tests (context-aware, guards, invariants, etc.)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--ci", "CI mode (fail fast, no interactive)").option("--record", "Record test results to database", true).option("--base-url <url>", "Explicit base URL for E2E/Security (disables auto dev server start)").option(
+  "--require-manifest",
+  "Require manifest to be present and valid (strict behavior; enabled by default for Layer 4)"
+).option(
+  "--allow-manifest-fallback",
+  "Allow fallback behavior when manifest is missing/invalid (disables Layer 4 strict default)"
+).option(
   "--report-json <path>",
   "Export test report as JSON. If <path> is a bare filename, it will be written under .runa/tmp/."
 ).option("--verbose", "Verbose output (full error details, environment info)").action(async (options) => {
   try {
+    const effectiveRequireManifest = resolveEffectiveRequireManifest3(options);
     const output3 = await runTestIntegration({
       ci: options.ci ?? false,
       record: options.record,
@@ -34892,6 +35867,7 @@ var testIntegrationCommand = new Command("test:integration").description("Run La
       advanced: options.advanced,
       auto: options.auto,
       baseUrl: options.baseUrl,
+      requireManifest: effectiveRequireManifest,
       invokedAs: "runa test:integration"
     });
     emitJsonSuccess(testIntegrationCommand, TestIntegrationOutputSchema, output3);
@@ -34937,7 +35913,7 @@ function injectTestAttrsIfLayer4(layer, options) {
           "Run `runa inject-test-attrs` manually to see detailed errors",
           "Ensure XState machines exist in your project",
           "Check that machines have valid meta.e2e definitions",
-          "Or remove --require-manifest flag to continue with fallback behavior"
+          "Or pass --allow-manifest-fallback to continue with fallback behavior"
         ],
         error instanceof Error ? error : void 0
       );
@@ -34947,10 +35923,17 @@ function injectTestAttrsIfLayer4(layer, options) {
     }
   }
 }
+function resolveEffectiveRequireManifest4(layer, options) {
+  if (options.allowManifestFallback) return false;
+  if (options.requireManifest !== void 0) return options.requireManifest;
+  if (layer === 4 && process.env.RUNA_LAYER4_ALLOW_MANIFEST_FALLBACK !== "true") return true;
+  return void 0;
+}
 async function runSingleLayer(params) {
+  const effectiveRequireManifest = resolveEffectiveRequireManifest4(params.layer, params.options);
   injectTestAttrsIfLayer4(params.layer, {
     verbose: params.options.verbose,
-    requireManifest: params.options.requireManifest
+    requireManifest: effectiveRequireManifest
   });
   try {
     const output3 = await runTest({
@@ -34967,7 +35950,7 @@ async function runSingleLayer(params) {
       reviewSnapshots: params.options.reviewSnapshots,
       forceRegenerate: params.options.force,
       skipGeneration: params.options.skipGeneration,
-      requireManifest: params.options.requireManifest,
+      requireManifest: effectiveRequireManifest,
       invokedAs: `runa test:layer${params.layer}`
     });
     emitJsonSuccess(params.cmd, TestRunOutputSchema, output3);
@@ -35001,6 +35984,13 @@ function validateGenerationFlags(layer, opts) {
       ["Use --auto (implementation-driven) OR --generate/--advanced (XState-driven)"]
     );
   }
+  if (layer === 4 && opts.requireManifest && opts.allowManifestFallback) {
+    throw new CLIError(
+      "--require-manifest and --allow-manifest-fallback are mutually exclusive",
+      "TEST_LAYER_MANIFEST_FLAGS_EXCLUSIVE",
+      ["Use strict mode (default) OR explicitly allow fallback, but not both"]
+    );
+  }
 }
 function validateSnapshotFlags(opts) {
   if (opts.reviewSnapshots && opts.ci) {
@@ -35039,6 +36029,9 @@ function createLayerCommand(layer) {
     cmd.option("--generate", "Generate tests from XState before running (Layer 4)").option("--advanced", "Generate advanced tests (requires --generate)").option("--auto", "Zero-config auto-generation (implementation-driven)").option("--update-snapshots", "Update visual baselines (Layer 4)").option("--filter <pattern>", 'Filter tests by pattern (e.g., "checkout-*")').option("--review-snapshots", "Interactive review of changed visual snapshots (Layer 4)").option("--force", "Force regenerate all tests, bypassing cache").option(
       "--require-manifest",
       "Require manifest to be present and valid (fail if missing or stale)"
+    ).option(
+      "--allow-manifest-fallback",
+      "Allow fallback behavior when manifest is missing/invalid (disables Layer 4 strict default)"
     );
   }
   return cmd;
@@ -36887,8 +37880,8 @@ var logger13 = createCLILogger("watch");
 function addFallbackSchemaPatterns(patterns) {
   const detected = detectDatabasePackage(process.cwd());
   if (detected) {
-    patterns.push(path10__default.join(detected, "src/schema/**/*.ts"));
-    patterns.push(path10__default.join(detected, "sql/**/*.sql"));
+    patterns.push(path11__default.join(detected, "src/schema/**/*.ts"));
+    patterns.push(path11__default.join(detected, "sql/**/*.sql"));
     return;
   }
   for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
@@ -36902,8 +37895,8 @@ async function buildSchemaPatterns() {
   const patterns = ["supabase/schemas/**/*.sql"];
   try {
     const dbPackagePath = await getDatabasePackagePath();
-    patterns.push(path10__default.join(dbPackagePath, "src/schema/**/*.ts"));
-    patterns.push(path10__default.join(dbPackagePath, "sql/**/*.sql"));
+    patterns.push(path11__default.join(dbPackagePath, "src/schema/**/*.ts"));
+    patterns.push(path11__default.join(dbPackagePath, "sql/**/*.sql"));
   } catch {
     addFallbackSchemaPatterns(patterns);
   }