@runa-ai/runa-cli 0.5.57 → 0.5.60

package/dist/index.js

@@ -4,7 +4,7 @@ import * as path11 from 'path';
 import path11__default, { join, dirname, resolve, isAbsolute, relative, sep, basename, normalize } from 'path';
 import { fileURLToPath } from 'url';
 import * as fs5 from 'fs';
-import fs5__default, { existsSync, rmSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, realpathSync, promises, lstatSync, accessSync, constants, chmodSync, unlinkSync } from 'fs';
+import fs5__default, { existsSync, readFileSync, unlinkSync, rmSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, realpathSync, promises, lstatSync, accessSync, constants, chmodSync } from 'fs';
 import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, SUPABASE_SYSTEM_SCHEMAS, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, BASE_PORTS, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, resolveAvailablePorts, calculatePortOffset, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, getPortsWithOffset, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, DATABASE_PACKAGE_CANDIDATES, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
@@ -17,12 +17,12 @@ import { minimatch } from 'minimatch';
 import { Command } from 'commander';
 import { fromPromise, setup, assign, createActor } from 'xstate';
 import { execa } from 'execa';
+import net, { isIP } from 'net';
 import chalk from 'chalk';
 import { config } from '@dotenvx/dotenvx';
 import { parse } from 'dotenv';
 import { expand } from 'dotenv-expand';
 import { resolve4 } from 'dns/promises';
-import { isIP } from 'net';
 import postgres from 'postgres';
 import crypto, { randomBytes } from 'crypto';
 import os, { tmpdir } from 'os';
@@ -1161,7 +1161,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.57";
+    CLI_VERSION = "0.5.60";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -7598,17 +7598,17 @@ function printSummary(logger16, output3) {
   }
 }
 function findRepoRoot(startDir) {
-  const { existsSync: existsSync53, readFileSync: readFileSync29 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync53(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
+    const pkgPath = join24(current, "package.json");
     if (existsSync53(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
         if (pkg.workspaces) {
           return current;
         }
@@ -7809,7 +7809,11 @@ var DevInputSchema = z.object({
   /** Stream app output to terminal (in addition to log file). Default: true */
   stream: z.boolean().default(true),
   /** Target directory (defaults to cwd) */
-  targetDir: z.string().optional()
+  targetDir: z.string().optional(),
+  /** Replace existing runa dev process if already running */
+  replace: z.boolean().default(false),
+  /** Bundler to use for Next.js dev server */
+  bundler: z.enum(["turbopack", "webpack"]).optional()
 }).strict();
 z.enum(["pending", "running", "passed", "failed", "skipped"]);
 var DevOutputSchema = z.object({
@@ -7907,8 +7911,8 @@ function readPortFromScripts(appDir) {
   const pkgPath = path11__default.join(appDir, "package.json");
   if (!existsSync(pkgPath)) return 3e3;
   try {
-    const { readFileSync: readFileSync29 } = __require("fs");
-    const raw = readFileSync29(pkgPath, "utf-8");
+    const { readFileSync: readFileSync30 } = __require("fs");
+    const raw = readFileSync30(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     const scripts = parsed.scripts;
     for (const key of ["start:ci", "start", "dev"]) {
@@ -8167,13 +8171,13 @@ async function readPackageScripts(pkgPath) {
     return null;
   }
 }
-function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoot, appDir, port) {
+function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoot, appDir, port, bundler) {
   const ciScriptName = mode === "dev" ? "dev:ci" : "start:ci";
   const nextCommand = mode === "dev" ? "dev" : "start";
   const rootHasCiScript = Boolean(rootScripts?.[ciScriptName]);
   const appHasCiScript = Boolean(appScripts?.[ciScriptName]);
-  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.["start"]);
-  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.["start"]);
+  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.start);
+  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.start);
   if (isMonorepo2 && (rootHasCiScript || rootHasDefaultScript)) {
     const scriptName = rootHasCiScript ? ciScriptName : "start";
     return { command: ["pnpm", scriptName], useRootScript: true };
@@ -8184,8 +8188,9 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
     return { command: ["pnpm", ...dirArgs2, scriptName], useRootScript: false };
   }
   const dirArgs = isMonorepo2 ? ["-C", path11__default.relative(repoRoot, appDir)] : [];
+  const bundlerArgs = bundler ? [`--${bundler}`] : [];
   return {
-    command: ["pnpm", ...dirArgs, "exec", "next", nextCommand, "-p", String(port)],
+    command: ["pnpm", ...dirArgs, "exec", "next", nextCommand, ...bundlerArgs, "-p", String(port)],
     useRootScript: false
   };
 }
@@ -8203,7 +8208,8 @@ async function startAppBackground(params) {
     appScripts,
     params.repoRoot,
     params.appDir,
-    params.port
+    params.port,
+    params.bundler
   );
   const appLog = path11__default.join(params.tmpDir, "app.log");
   const out = createWriteStream(appLog, { flags: "a" });
@@ -8317,7 +8323,16 @@ var e2eMeta2 = {
       log: "Starting dev"
     },
     assertions: ["expect(log).toContain('Starting dev')", "expect(state).toBe('idle')"],
-    nextStates: ["setup"]
+    nextStates: ["processCheck"]
+  },
+  processCheck: {
+    description: "Check for existing runa dev process and port availability",
+    severity: "blocking",
+    observables: {
+      log: "Checking for existing processes"
+    },
+    assertions: ["expect(log).toContain('Checking for existing processes')"],
+    nextStates: ["setup", "failed"]
   },
   setup: {
     description: "Setup phase: deps, env, Supabase",
@@ -8377,9 +8392,67 @@ var e2eMeta2 = {
     nextStates: []
   }
 };
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkPortAvailable(port) {
+  return new Promise((resolve12, reject) => {
+    const server = net.createServer();
+    server.once("error", (err) => {
+      if (err.code === "EADDRINUSE") {
+        reject(
+          new Error(
+            `Port ${port} is already in use. Use --port <number> to specify a different port, or --replace to restart.`
+          )
+        );
+      } else {
+        reject(err);
+      }
+    });
+    server.once("listening", () => {
+      server.close(() => resolve12());
+    });
+    server.listen(port);
+  });
+}
+var processCheckActor = fromPromise(async ({ input: input3 }) => {
+  const pidFile = path11__default.join(input3.repoRoot, input3.tmpDir, "app.pid");
+  let pidFileContent = null;
+  try {
+    pidFileContent = readFileSync(pidFile, "utf-8").trim();
+  } catch {
+  }
+  if (pidFileContent) {
+    const pid = parseInt(pidFileContent, 10);
+    if (!Number.isNaN(pid) && isProcessAlive(pid)) {
+      if (input3.replace) {
+        await terminateAppProcessByPid({
+          pid,
+          logger: { info: console.log, warn: console.warn }
+        });
+      } else {
+        throw new Error(
+          `runa dev is already running (PID: ${pid}). Use --replace to restart, or stop the existing process first.`
+        );
+      }
+    }
+    try {
+      unlinkSync(pidFile);
+    } catch {
+    }
+  }
+  if (!input3.skipApp) {
+    await checkPortAvailable(input3.port);
+  }
+});
 var appStartActor = fromPromise(
   async ({ input: input3 }) => {
-    const { repoRoot, appDir, port, tmpDir, stream } = input3;
+    const { repoRoot, appDir, port, tmpDir, stream, bundler } = input3;
     const fullTmpDir = path11__default.join(repoRoot, tmpDir);
     await mkdir(fullTmpDir, { recursive: true });
     const nextDir = path11__default.join(appDir, ".next");
@@ -8394,7 +8467,8 @@ var appStartActor = fromPromise(
       env: process.env,
       tmpDir: fullTmpDir,
       mode: "dev",
-      stream
+      stream,
+      bundler
     });
     await waitForAppReady({
       port,
@@ -8427,6 +8501,7 @@ function normalizeDevMachineInput(input3) {
 var devMachine = setup({
   types: {},
   actors: {
+    processCheck: processCheckActor,
     depsInstall: depsInstallActor,
     envCheck: envCheckActor,
     supabaseStart: supabaseStartActor,
@@ -8461,7 +8536,30 @@ var devMachine = setup({
     idle: {
       meta: { e2e: e2eMeta2.idle },
       on: {
-        START: { target: "setup" }
+        START: { target: "processCheck" }
+      }
+    },
+    // ============================================================
+    // Process Check Phase
+    // ============================================================
+    processCheck: {
+      meta: { e2e: e2eMeta2.processCheck },
+      invoke: {
+        src: "processCheck",
+        input: ({ context }) => ({
+          repoRoot: context.repoRoot,
+          tmpDir: context.tmpDir,
+          port: context.input.port,
+          replace: context.input.replace,
+          skipApp: context.input.skipApp
+        }),
+        onDone: { target: "setup" },
+        onError: {
+          target: "failed",
+          actions: assign({
+            error: ({ event }) => event.error instanceof Error ? event.error.message : String(event.error)
+          })
+        }
       }
     },
     // ============================================================
@@ -8537,7 +8635,8 @@ var devMachine = setup({
             appDir: detected?.appDir ?? context.repoRoot,
             port: context.input.port,
             tmpDir: context.tmpDir,
-            stream: context.input.stream
+            stream: context.input.stream,
+            bundler: context.input.bundler
           };
         },
         onDone: {
@@ -8615,6 +8714,9 @@ var stateLogHandlers2 = {
     logger16.section("Dev Server");
     logger16.info("Starting development environment...");
   },
+  processCheck: (logger16) => {
+    logger16.info("Checking for existing processes...");
+  },
   setup: (logger16) => {
     logger16.section("Phase 0: Setup");
     logger16.info("Checking environment prerequisites...");
@@ -8740,14 +8842,16 @@ async function runDevAction(options, cmd) {
     );
   }
 }
-var devCommand = new Command("dev").description("Start development server (Supabase + Next.js)").option("--port <number>", "Port for Next.js dev server", (val) => Number.parseInt(val, 10), 3e3).option("--skip-db", "Skip Supabase start").option("--skip-app", "Start Supabase only (no app server)").option("--verbose", "Show detailed output").option("--no-stream", "Disable streaming app output to terminal (log to file only)").option("--target-dir <path>", "Target directory (defaults to repo root)").action(async (options, cmd) => {
+var devCommand = new Command("dev").description("Start development server (Supabase + Next.js)").option("--port <number>", "Port for Next.js dev server", (val) => Number.parseInt(val, 10), 3e3).option("--skip-db", "Skip Supabase start").option("--skip-app", "Start Supabase only (no app server)").option("--verbose", "Show detailed output").option("--no-stream", "Disable streaming app output to terminal (log to file only)").option("--target-dir <path>", "Target directory (defaults to repo root)").option("--replace", "Replace existing runa dev process if already running").option("--bundler <type>", "Bundler for Next.js dev server (turbopack or webpack)").action(async (options, cmd) => {
   const input3 = {
     port: options.port,
     skipDb: options.skipDb ?? false,
     skipApp: options.skipApp ?? false,
     verbose: options.verbose ?? false,
     stream: options.stream ?? true,
-    targetDir: options.targetDir
+    targetDir: options.targetDir,
+    replace: options.replace ?? false,
+    bundler: options.bundler
   };
   await runDevAction(input3, cmd);
 });
@@ -10087,8 +10191,8 @@ async function detectRisks(repoRoot, tmpDir) {
   } catch (error) {
     let logContent = "";
     try {
-      const { readFileSync: readFileSync29 } = await import('fs');
-      logContent = readFileSync29(logFile, "utf-8");
+      const { readFileSync: readFileSync30 } = await import('fs');
+      logContent = readFileSync30(logFile, "utf-8");
     } catch {
     }
     const isInitialDeployment = logContent.includes("No common ancestor") || logContent.includes("INITIAL DEPLOYMENT");
@@ -10216,8 +10320,8 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   const totalMs = Date.now() - startTime;
   let logContent = "";
   try {
-    const { readFileSync: readFileSync29 } = await import('fs');
-    logContent = readFileSync29(logPath, "utf-8");
+    const { readFileSync: readFileSync30 } = await import('fs');
+    logContent = readFileSync30(logPath, "utf-8");
   } catch {
   }
   const parsed = parseApplyLog(logContent);
@@ -12995,7 +13099,7 @@ var syncSchemaActor = fromPromise(
         "--auto-approve",
         // Allow DELETES_DATA hazards in preview
         "--no-seed",
-        // Seeds applied separately by applySeedsActor (avoid duplicate application)
+        // Seeds applied separately by applySeedsActor
         "--verbose"
         // Always verbose for full traceability
       ] : [
@@ -13005,6 +13109,8 @@ var syncSchemaActor = fromPromise(
         "sync",
         envArg,
         "--auto-approve",
+        "--no-seed",
+        // Seeds applied separately by applySeedsActor
         "--verbose",
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
@@ -13141,7 +13247,67 @@ init_esm_shims();
 // src/commands/ci/commands/ci-supabase-local.ts
 init_esm_shims();
 init_constants();
+function isPortAvailable(port) {
+  return new Promise((resolve12) => {
+    const server = net.createServer();
+    server.once("error", () => resolve12(false));
+    server.once("listening", () => {
+      server.close(() => resolve12(true));
+    });
+    server.listen(port);
+  });
+}
+function detectSupabaseContainers() {
+  try {
+    const result = spawnSync(
+      "docker",
+      ["ps", "--format", "{{.Names}}	{{.Ports}}	{{.Status}}", "--filter", "name=supabase"],
+      { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (result.status !== 0 || !result.stdout?.trim()) return [];
+    return result.stdout.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function checkSupabasePortConflicts(repoRoot) {
+  let dbPort = 54322;
+  try {
+    const { readFileSync: readFileSync30 } = await import('fs');
+    const configPath = path11__default.join(repoRoot, "supabase", "config.toml");
+    const content = readFileSync30(configPath, "utf-8");
+    const match = /\[db\][^[]*?port\s*=\s*(\d+)/s.exec(content);
+    if (match?.[1]) dbPort = Number.parseInt(match[1], 10);
+  } catch {
+  }
+  const available = await isPortAvailable(dbPort);
+  if (available) return;
+  const containers = detectSupabaseContainers();
+  const dbContainers = containers.filter((c) => c.includes(String(dbPort)) || c.includes("db-"));
+  console.warn("");
+  console.warn("\u26A0\uFE0F  Port conflict detected: PostgreSQL port %d is already in use", dbPort);
+  console.warn("");
+  if (dbContainers.length > 0) {
+    console.warn("   Running Supabase containers:");
+    for (const c of dbContainers) {
+      console.warn(`     ${c}`);
+    }
+  } else if (containers.length > 0) {
+    console.warn("   Running Supabase containers (no DB match):");
+    for (const c of containers.slice(0, 5)) {
+      console.warn(`     ${c}`);
+    }
+  } else {
+    console.warn("   No Supabase containers detected (port may be used by another process).");
+  }
+  console.warn("");
+  console.warn("   To fix:");
+  console.warn("     1. Stop the other instance: supabase stop (in the other project)");
+  console.warn("     2. Or use a different port in supabase/config.toml: [db] port = 54323");
+  console.warn("");
+}
 async function startSupabaseLocal(params) {
+  await checkSupabasePortConflicts(params.repoRoot);
   const exclude = process.env.RUNA_CI_SUPABASE_EXCLUDE ?? "studio,edge-runtime,storage-api,realtime,imgproxy,mailpit,logflare,vector,supavisor";
   await runLogged({
     cwd: params.repoRoot,
@@ -13361,7 +13527,7 @@ AND table_schema NOT IN ('information_schema');
 SELECT COUNT(*)::int
 FROM pg_class c
 JOIN pg_namespace n ON n.oid=c.relnamespace
-WHERE c.relkind='r'
+WHERE c.relkind IN ('r','p')
 AND n.nspname NOT LIKE 'pg_%'
 AND n.nspname NOT IN ('information_schema')
 AND c.relrowsecurity;
@@ -19300,6 +19466,93 @@ function releaseAdvisoryLock(dbUrl, verbose) {
   }
 }
 
+// src/commands/db/apply/helpers/plan-validator.ts
+init_esm_shims();
+var PlanHazardSchema = z.object({
+  type: z.string().min(1),
+  message: z.string()
+});
+var PlanStatementSchema = z.object({
+  index: z.number().int().nonnegative(),
+  sql: z.string().min(1),
+  hazards: z.array(PlanHazardSchema)
+});
+var ValidatedPlanSchema = z.object({
+  statements: z.array(PlanStatementSchema),
+  totalStatements: z.number().int().nonnegative(),
+  rawSql: z.string().min(1)
+});
+function flushStatement(current, results) {
+  if (!current) return;
+  const sql = current.sqlLines.join("\n").trim();
+  if (!sql) return;
+  results.push({ index: current.index, sql, hazards: current.hazards });
+}
+function parseWithStatementMarkers(lines) {
+  const results = [];
+  let current = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const idxMatch = trimmed.match(/^-- Statement Idx\.\s*(\d+)/);
+    if (idxMatch) {
+      flushStatement(current, results);
+      current = { index: parseInt(idxMatch[1], 10), sqlLines: [], hazards: [] };
+      continue;
+    }
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch && current) {
+      current.hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (current && trimmed && !trimmed.startsWith("--")) {
+      current.sqlLines.push(line);
+    }
+  }
+  flushStatement(current, results);
+  return results;
+}
+function parseAsSingleStatement(lines) {
+  const sqlLines = [];
+  const hazards = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch) {
+      hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (trimmed && !trimmed.startsWith("--")) {
+      sqlLines.push(line);
+    }
+  }
+  const sql = sqlLines.join("\n").trim();
+  if (!sql) return [];
+  return [{ index: 0, sql, hazards }];
+}
+function parsePlanOutput(planOutput) {
+  const lines = planOutput.split("\n");
+  const hasStatementMarkers = lines.some((l) => /^-- Statement Idx\.\s*\d+/.test(l.trim()));
+  const statements = hasStatementMarkers ? parseWithStatementMarkers(lines) : parseAsSingleStatement(lines);
+  const plan = {
+    statements,
+    totalStatements: statements.length,
+    rawSql: planOutput
+  };
+  return ValidatedPlanSchema.parse(plan);
+}
+function validatePlanForExecution(plan, allowedHazardTypes) {
+  if (plan.totalStatements === 0) return;
+  const allHazards = plan.statements.flatMap((s) => s.hazards);
+  const allowedSet = new Set(allowedHazardTypes);
+  const unresolved = allHazards.filter((h) => !allowedSet.has(h.type));
+  if (unresolved.length > 0) {
+    const types = [...new Set(unresolved.map((h) => h.type))].join(", ");
+    throw new Error(
+      `Plan contains unapproved hazards: ${types}. Approved: [${allowedHazardTypes.join(", ")}]. This is a safety check \u2014 hazards must be approved before execution.`
+    );
+  }
+}
+
 // src/commands/db/apply/helpers/pg-schema-diff-helpers.ts
 init_esm_shims();
 var logger4 = createCLILogger("db:apply");
@@ -19645,49 +19898,70 @@ function calculateBackoffDelay(attempt, maxDelayMs = DEFAULT_MAX_DELAY_MS) {
 function isLockTimeoutError(errorOutput) {
   return errorOutput.includes("lock_timeout") || errorOutput.includes("canceling statement due to lock timeout") || errorOutput.includes("could not obtain lock");
 }
-async function executeApplyWithRetry(applyArgs, verbose, config) {
+async function executePlanSqlWithRetry(dbUrl, initialPlanSql, verbose, config) {
   const maxRetries = config?.maxRetries ?? MAX_RETRIES;
   const maxDelayMs = config?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
   let lastError = null;
   let totalWaitMs = 0;
+  let currentPlanSql = initialPlanSql;
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     if (attempt > 0) {
       const delay = calculateBackoffDelay(attempt - 1, maxDelayMs);
       totalWaitMs += delay;
       logger5.info(`Retry ${attempt}/${maxRetries - 1} after ${Math.round(delay)}ms...`);
       await sleep(delay);
+      if (config?.rePlanFn) {
+        const freshPlan = config.rePlanFn();
+        if (freshPlan === null) {
+          return { success: true, attempts: attempt, totalWaitMs };
+        }
+        currentPlanSql = freshPlan;
+      }
     }
-    const applyResult = spawnSync("pg-schema-diff", applyArgs, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = applyResult.stdout || "";
-    const stderr = applyResult.stderr || "";
-    if (verbose) {
-      if (stdout) process.stdout.write(stdout);
-      if (stderr) process.stderr.write(stderr);
-    }
-    if (applyResult.status === 0) {
+    const plan = parsePlanOutput(currentPlanSql);
+    if (plan.totalStatements === 0) {
       return { success: true, attempts: attempt, totalWaitMs };
     }
-    const errorOutput = stderr || stdout || "Unknown error";
-    if (isLockTimeoutError(errorOutput)) {
-      logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
-      lastError = new Error(`lock_timeout: ${errorOutput}`);
-      continue;
+    if (config?.allowedHazardTypes) {
+      validatePlanForExecution(plan, config.allowedHazardTypes);
     }
-    logger5.error("pg-schema-diff apply failed:");
-    logger5.error(errorOutput);
-    const extDetection = detectMissingExtensionType(errorOutput);
-    if (extDetection.detected) {
-      logger5.error(formatExtensionErrorHint(extDetection));
+    if (verbose) {
+      logger5.debug(`Plan validated: ${plan.totalStatements} statement(s)`);
+    }
+    const planFile = join(tmpdir(), `runa-plan-${Date.now()}-${attempt}.sql`);
+    const wrappedSql = `SET lock_timeout = '50ms';
+
+${currentPlanSql}`;
+    writeFileSync(planFile, wrappedSql, "utf-8");
+    try {
+      const result = psqlSyncFile({ databaseUrl: dbUrl, filePath: planFile, onErrorStop: true });
+      if (verbose) {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      }
+      if (result.status === 0) {
+        return { success: true, attempts: attempt, totalWaitMs };
+      }
+      const errorOutput = result.stderr || result.stdout || "Unknown error";
+      if (isLockTimeoutError(errorOutput)) {
+        logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
+        lastError = new Error(`lock_timeout: ${errorOutput}`);
+        continue;
+      }
+      logger5.error("Plan execution failed:");
+      logger5.error(errorOutput);
+      return {
+        success: false,
+        error: new Error(`Plan execution failed: ${errorOutput}`),
+        attempts: attempt,
+        totalWaitMs
+      };
+    } finally {
+      try {
+        unlinkSync(planFile);
+      } catch {
+      }
     }
-    return {
-      success: false,
-      error: new Error(`pg-schema-diff apply failed: ${errorOutput}`),
-      attempts: attempt,
-      totalWaitMs
-    };
   }
   logger5.error(`Migration failed after ${maxRetries} attempts (total wait: ${totalWaitMs}ms)`);
   return {
@@ -19983,48 +20257,58 @@ function handleFreshDbCase(input3, dbUrl, targetDir) {
     return { sql: "", hazards: [], applied: true };
   }
 }
-async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards) {
-  logger6.step("Applying schema changes...");
+async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards, tempDbDsn) {
+  logger6.step("Applying schema changes (plan+psql)...");
   const lockAcquired = acquireAdvisoryLock(dbUrl, input3.verbose);
   if (!lockAcquired) {
     throw new Error(
       "Could not acquire migration lock. Another migration may be running. Wait for it to complete or manually release the lock."
     );
   }
-  const applyArgs = [
-    "apply",
-    "--from-dsn",
-    dbUrl,
-    "--to-dir",
-    schemasDir,
-    "--disable-plan-validation",
-    "--skip-confirm-prompt",
-    "-l",
-    'pattern=".*" timeout=50ms',
-    ...includeSchemas.flatMap((s) => ["--include-schema", s])
-  ];
-  const allowedHazards = buildAllowedHazards(input3);
-  if (allowedHazards.length > 0) {
-    applyArgs.push("--allow-hazards", allowedHazards.join(","));
-  }
-  const result = await executeApplyWithRetry(applyArgs, input3.verbose, {
-    maxDelayMs: input3.maxLockWaitMs
-  });
-  releaseAdvisoryLock(dbUrl, input3.verbose);
-  if (!result.success) {
-    throw result.error || new Error("Migration failed");
-  }
-  if (input3.verbose && result.attempts > 0) {
-    logger6.debug(`Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`);
+  try {
+    const allowedHazardTypes = buildAllowedHazards(input3);
+    const result = await executePlanSqlWithRetry(dbUrl, planOutput, input3.verbose, {
+      maxDelayMs: input3.maxLockWaitMs,
+      allowedHazardTypes,
+      rePlanFn: () => {
+        const { planOutput: freshPlan } = executePgSchemaDiffPlan(
+          dbUrl,
+          schemasDir,
+          includeSchemas,
+          input3.verbose,
+          { tempDbDsn }
+        );
+        if (!freshPlan.trim() || freshPlan.includes("No changes")) {
+          return null;
+        }
+        return freshPlan;
+      }
+    });
+    if (!result.success) {
+      throw result.error || new Error("Migration failed");
+    }
+    if (input3.verbose && result.attempts > 0) {
+      logger6.debug(
+        `Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`
+      );
+    }
+    logger6.success("Schema changes applied");
+    return {
+      sql: planOutput,
+      hazards,
+      applied: true,
+      retryAttempts: result.attempts,
+      retryWaitMs: result.totalWaitMs
+    };
+  } finally {
+    try {
+      releaseAdvisoryLock(dbUrl, input3.verbose);
+    } catch (lockError) {
+      logger6.warn(
+        `Failed to release advisory lock: ${lockError instanceof Error ? lockError.message : "Unknown error"}`
+      );
+    }
   }
-  logger6.success("Schema changes applied");
-  return {
-    sql: planOutput,
-    hazards,
-    applied: true,
-    retryAttempts: result.attempts,
-    retryWaitMs: result.totalWaitMs
-  };
 }
 var ROLE_PASSWORD_CONFIGS = [
   {
@@ -20135,45 +20419,66 @@ function shouldSkipInProduction(file, env2, verbose) {
   }
   return true;
 }
-function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose) {
+function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose, pass) {
   const filePath = join(schemasDir, file);
   if (verbose) logger6.debug(`Applying ${file}...`);
   const result = psqlSyncFile({
     databaseUrl: dbUrl,
     filePath,
     onErrorStop: true
-    // Fail fast on idempotent schemas
   });
   if (verbose) {
     if (result.stdout) process.stdout.write(result.stdout);
     if (result.stderr) process.stderr.write(result.stderr);
   }
   if (result.status !== 0) {
+    if (pass === "pre") {
+      if (verbose) {
+        logger6.warn(`Skipped ${file} (will retry in 2nd pass)`);
+      }
+      return false;
+    }
     const errorMsg = result.stderr ? maskDbCredentials(result.stderr) : "";
     throw new Error(`Failed to apply idempotent schema: ${file}
 ${errorMsg}`);
   }
+  return true;
 }
-var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir } }) => {
+var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir, pass } }) => {
   checkPasswordSecurity();
   const schemasDir = join(targetDir, "supabase/schemas/idempotent");
   const dbUrl = getDbUrl(input3);
   let filesApplied = 0;
+  let filesSkipped = 0;
   if (existsSync(schemasDir)) {
     const files = readdirSync(schemasDir).filter((f) => f.endsWith(".sql")).sort();
     if (files.length > 0) {
       for (const file of files) {
         if (shouldSkipInProduction(file, input3.env, input3.verbose)) continue;
-        applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose);
+        const applied = applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose, pass);
+        if (applied) {
+          filesApplied++;
+        } else {
+          filesSkipped++;
+        }
+      }
+      if (filesSkipped > 0) {
+        logger6.success(
+          `Applied ${filesApplied}/${filesApplied + filesSkipped} idempotent schema(s) (${filesSkipped} deferred to 2nd pass)`
+        );
+        if (filesSkipped === files.length) {
+          logger6.warn("ALL idempotent files skipped in 1st pass.");
+          logger6.warn("This may indicate a syntax error. Check logs with --verbose.");
+        }
+      } else {
+        logger6.success(`Applied ${filesApplied} idempotent schema(s)`);
       }
-      logger6.success(`Applied ${files.length} idempotent schema(s)`);
-      filesApplied = files.length;
     }
   } else {
     logger6.info("No idempotent schemas found");
   }
   const rolePasswordsSet = setRolePasswords(dbUrl, input3.verbose);
-  return { filesApplied, rolePasswordsSet };
+  return { filesApplied, filesSkipped, rolePasswordsSet };
 });
 var applyPgSchemaDiff = fromPromise(async ({ input: { input: input3, targetDir } }) => {
   const schemasDir = join(targetDir, "supabase/schemas/declarative");
@@ -20242,7 +20547,15 @@ ${content}`;
       displayCheckModeResults(planOutput);
       return { sql: planOutput, hazards, applied: false };
     }
-    return applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards);
+    return applyWithLockAndRetry(
+      dbUrl,
+      schemasDir,
+      includeSchemas,
+      input3,
+      planOutput,
+      hazards,
+      shadowDb?.dsn
+    );
   } finally {
     if (shadowDb) {
       try {
@@ -20354,6 +20667,11 @@ var DbApplyMetricsSchema = z.object({
 z.object({
   success: z.boolean(),
   idempotentSchemasApplied: z.number(),
+  /**
+   * Number of idempotent schemas deferred during 1st pass (graceful skip).
+   * These are retried in 2nd pass after declarative tables exist.
+   */
+  idempotentSchemasSkipped: z.number().optional(),
   /**
    * Number of RBAC role passwords set (drizzle_app, drizzle_service).
    * Set when DRIZZLE_APP_PASSWORD or DRIZZLE_SERVICE_PASSWORD env vars are present.
@@ -20474,7 +20792,9 @@ var dbApplyMachine = setup({
     targetDir: input3.targetDir,
     // 2-pass idempotent
     idempotentPreApplied: 0,
+    idempotentPreSkipped: 0,
     idempotentPostApplied: 0,
+    idempotentPostSkipped: 0,
     rolePasswordsSet: 0,
     schemaChangesApplied: false,
     hazards: [],
@@ -20505,11 +20825,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPreStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "pre"
+        }),
         onDone: {
           target: "applyingPgSchemaDiff",
           actions: assign({
             idempotentPreApplied: ({ event }) => event.output.filesApplied,
+            idempotentPreSkipped: ({ event }) => event.output.filesSkipped,
             rolePasswordsSet: ({ event }) => event.output.rolePasswordsSet,
             idempotentPreEndTime: () => Date.now()
           })
@@ -20568,11 +20893,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPostStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "post"
+        }),
         onDone: {
           target: "applyingSeeds",
           actions: assign({
             idempotentPostApplied: ({ event }) => event.output.filesApplied,
+            idempotentPostSkipped: ({ event }) => event.output.filesSkipped,
             idempotentPostEndTime: () => Date.now()
           })
         },
@@ -20630,9 +20960,11 @@ var dbApplyMachine = setup({
       retryAttempts: context.retryAttempts > 0 ? context.retryAttempts : void 0
     };
     const totalIdempotentApplied = context.idempotentPreApplied + context.idempotentPostApplied;
+    const totalIdempotentSkipped = context.idempotentPreSkipped + context.idempotentPostSkipped;
     return {
       success: !context.error,
       idempotentSchemasApplied: totalIdempotentApplied,
+      idempotentSchemasSkipped: totalIdempotentSkipped > 0 ? totalIdempotentSkipped : void 0,
       rolePasswordsSet: context.rolePasswordsSet > 0 ? context.rolePasswordsSet : void 0,
       schemaChangesApplied: context.schemaChangesApplied,
       hazards: context.hazards,
@@ -26289,7 +26621,7 @@ function getTablesWithTimestamps(dbUrl, schemas) {
     JOIN pg_attribute a1 ON c.oid = a1.attrelid AND a1.attname = 'updated_at'
     JOIN pg_attribute a2 ON c.oid = a2.attrelid AND a2.attname = 'created_at'
     WHERE n.nspname IN (${schemasFilter})
-      AND c.relkind = 'r'
+      AND c.relkind IN ('r', 'p')
     ORDER BY n.nspname, c.relname;
   `;
   const conn = parsePostgresUrl(dbUrl);
@@ -31105,7 +31437,7 @@ init_esm_shims();
 
 // src/constants/versions.ts
 init_esm_shims();
-var COMPATIBLE_TEMPLATES_VERSION = "0.5.56";
+var COMPATIBLE_TEMPLATES_VERSION = "0.5.60";
 var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
 var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
 
@@ -35695,17 +36027,17 @@ function printActionsNeeded(logger16, actions) {
   );
 }
 function findRepoRoot3(startDir) {
-  const { existsSync: existsSync53, readFileSync: readFileSync29 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync53(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
+    const pkgPath = join24(current, "package.json");
     if (existsSync53(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
         if (pkg.workspaces) {
           return current;
         }
@@ -35772,8 +36104,8 @@ function generateReportOutput(output3, isJsonMode) {
 }
 function validateRunaRepo(repoRoot) {
   const { existsSync: existsSync53 } = __require("fs");
-  const { join: join23 } = __require("path");
-  const templateDir = join23(repoRoot, "packages/runa-templates/templates");
+  const { join: join24 } = __require("path");
+  const templateDir = join24(repoRoot, "packages/runa-templates/templates");
   if (!existsSync53(templateDir)) {
     throw new CLIError("template-check is a runa-repo only command", "NOT_RUNA_REPO", [
       "This command compares runa-repo with pj-repo templates",