@runa-ai/runa-cli 0.5.58 → 0.5.60

package/dist/commands/ci/commands/ci-supabase-local.d.ts

@@ -6,6 +6,11 @@
  * Note:
  * - This module used to be named `ci-pr-supabase-local.ts`. It is now shared across CI commands.
  */
+/**
+ * Pre-flight check for port conflicts before starting Supabase.
+ * Warns if DB port is already occupied by another Supabase instance.
+ */
+export declare function checkSupabasePortConflicts(repoRoot: string): Promise<void>;
 export declare function startSupabaseLocal(params: {
     repoRoot: string;
     tmpDir: string;

package/dist/commands/ci/commands/ci-supabase-local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-supabase-local.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-supabase-local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CASpE;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,8JAC0H,CAAC;AAE9J,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDpD;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DtC"}
+{"version":3,"file":"ci-supabase-local.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/commands/ci-supabase-local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6CH;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChF;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CASpE;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,8JAC0H,CAAC;AAE9J,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDpD;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DtC"}

package/dist/commands/ci/machine/actors/db/sync-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-schema.d.ts","sourceRoot":"","sources":["../../../../../../src/commands/ci/machine/actors/db/sync-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,OAAO,KAAK,EAAE,MAAM,EAAqB,mBAAmB,EAAiB,MAAM,gBAAgB,CAAC;AAEpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAmQD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,qGAwG3B,CAAC"}
+{"version":3,"file":"sync-schema.d.ts","sourceRoot":"","sources":["../../../../../../src/commands/ci/machine/actors/db/sync-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,OAAO,KAAK,EAAE,MAAM,EAAqB,mBAAmB,EAAiB,MAAM,gBAAgB,CAAC;AAEpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAmQD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,qGA0G3B,CAAC"}

package/dist/commands/db/apply/actors.d.ts

@@ -1,6 +1,7 @@
 import type { DbApplyInput } from './contract.js';
 export interface ApplyResult {
     filesApplied: number;
+    filesSkipped: number;
     rolePasswordsSet: number;
 }
 export interface PgSchemaDiffResult {
@@ -18,10 +19,13 @@ export interface PgSchemaDiffResult {
  * Flow:
  * 1. Apply idempotent/*.sql files (includes 15_rbac_roles.sql for ROLE creation)
  * 2. Set passwords for drizzle_app/drizzle_service if env vars present
+ *
+ * @param pass - 'pre' = 1st pass (graceful skip on error), 'post' = 2nd pass (strict)
  */
 export declare const applyIdempotentSchemas: import("xstate").PromiseActorLogic<ApplyResult, {
     input: DbApplyInput;
     targetDir: string;
+    pass: "pre" | "post";
 }, import("xstate").EventObject>;
 /**
  * Apply schema changes using pg-schema-diff (or direct psql for fresh DB).

package/dist/commands/db/apply/actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/actors.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA4ElD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAwwBD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;WAExB,YAAY;eAAa,MAAM;gCAgCxC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;WAEnB,YAAY;eAAa,MAAM;gCA2GxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;aACV,OAAO;;WACT,YAAY;eAAa,MAAM;gCAqDxC,CAAC"}
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/actors.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA4ElD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2yBD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;WAExB,YAAY;eAAa,MAAM;UAAQ,KAAK,GAAG,MAAM;gCA+C9D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;WAEnB,YAAY;eAAa,MAAM;gCAmHxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;aACV,OAAO;;WACT,YAAY;eAAa,MAAM;gCAqDxC,CAAC"}

package/dist/commands/db/apply/contract.d.ts

@@ -43,6 +43,7 @@ export type DbApplyMetrics = z.infer<typeof DbApplyMetricsSchema>;
 export declare const DbApplyOutputSchema: z.ZodObject<{
     success: z.ZodBoolean;
     idempotentSchemasApplied: z.ZodNumber;
+    idempotentSchemasSkipped: z.ZodOptional<z.ZodNumber>;
     rolePasswordsSet: z.ZodOptional<z.ZodNumber>;
     schemaChangesApplied: z.ZodBoolean;
     hazards: z.ZodArray<z.ZodString>;

package/dist/commands/db/apply/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;kBAoCpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;iBAwB9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;kBAoCpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBA6B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/commands/db/apply/helpers/index.d.ts

@@ -4,10 +4,12 @@
  * Purpose: Export all helper functions for db apply actors
  */
 export { acquireAdvisoryLock, MIGRATION_LOCK_ID, releaseAdvisoryLock, } from './advisory-lock.js';
+export type { PlanHazard, PlanStatement, ValidatedPlan } from './plan-validator.js';
+export { parsePlanOutput, validatePlanForExecution } from './plan-validator.js';
 export type { ParsedHazard, PgSchemaDiffPlanOptions } from './pg-schema-diff-helpers.js';
 export type { ShadowDbConfig, ShadowDbResult } from './shadow-db-manager.js';
 export { buildAllowedHazards, displayCheckModeResults, displayHazards, displayHazardsWithContext, executePgSchemaDiffPlan, filterFalsePositiveHazards, getIdempotentRoles, handleHazards, handleHazardsWithContext, handleProductionAuthzProtection, handleProductionDataProtection, isIdempotentRoleHazard, parseHazardsFromOutput, parseHazardsWithContext, resetIdempotentRolesCache, verifyDatabaseConnection, verifyPgSchemaDiffBinary, } from './pg-schema-diff-helpers.js';
-export type { RetryConfig, RetryResult } from './retry-logic.js';
-export { BASE_DELAY_MS, calculateBackoffDelay, DEFAULT_MAX_DELAY_MS, executeApplyWithRetry, isLockTimeoutError, MAX_RETRIES, sleep, } from './retry-logic.js';
+export type { PlanSqlRetryConfig, RetryConfig, RetryResult } from './retry-logic.js';
+export { BASE_DELAY_MS, calculateBackoffDelay, DEFAULT_MAX_DELAY_MS, executeApplyWithRetry, executePlanSqlWithRetry, isLockTimeoutError, MAX_RETRIES, sleep, } from './retry-logic.js';
 export { createShadowDbWithExtensions, needsShadowDb } from './shadow-db-manager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/db/apply/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,KAAK,GACN,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAErF,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,KAAK,GACN,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/commands/db/apply/helpers/plan-validator.d.ts

@@ -0,0 +1,61 @@
+/**
+ * AI HINT: pg-schema-diff Plan Output Validator
+ *
+ * Purpose: Parse pg-schema-diff plan output into structured statements and
+ *          validate with Zod before psql execution (safety gate).
+ *
+ * Pattern: plan → Zod validation → psql execution
+ *
+ * Safety layers:
+ *   1. handleHazards() in actors.ts → blocks unapproved hazards (primary)
+ *   2. validatePlanForExecution() → defense-in-depth hazard check
+ *   3. Zod structural validation → ensures plan is well-formed
+ */
+import { z } from 'zod';
+export declare const PlanHazardSchema: z.ZodObject<{
+    type: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+export declare const PlanStatementSchema: z.ZodObject<{
+    index: z.ZodNumber;
+    sql: z.ZodString;
+    hazards: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ValidatedPlanSchema: z.ZodObject<{
+    statements: z.ZodArray<z.ZodObject<{
+        index: z.ZodNumber;
+        sql: z.ZodString;
+        hazards: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            message: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    totalStatements: z.ZodNumber;
+    rawSql: z.ZodString;
+}, z.core.$strip>;
+export type PlanHazard = z.infer<typeof PlanHazardSchema>;
+export type PlanStatement = z.infer<typeof PlanStatementSchema>;
+export type ValidatedPlan = z.infer<typeof ValidatedPlanSchema>;
+/**
+ * Parse pg-schema-diff plan output into structured statements.
+ *
+ * Handles two formats:
+ * 1. With `-- Statement Idx. N` markers → split into individual statements
+ * 2. Without markers → treat as single statement
+ *
+ * @throws ZodError if parsed result fails structural validation
+ */
+export declare function parsePlanOutput(planOutput: string): ValidatedPlan;
+/**
+ * Validate that all hazards in the plan are in the allowed list.
+ *
+ * Defense-in-depth: handleHazards() in actors.ts is the primary check.
+ * This is a secondary safety gate right before psql execution.
+ *
+ * @throws Error if unresolved hazards are found
+ */
+export declare function validatePlanForExecution(plan: ValidatedPlan, allowedHazardTypes: string[]): void;
+//# sourceMappingURL=plan-validator.d.ts.map

package/dist/commands/db/apply/helpers/plan-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-validator.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/plan-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAiFhE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CAgBjE;AAMD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,CAehG"}

package/dist/commands/db/apply/helpers/retry-logic.d.ts

@@ -48,4 +48,29 @@ export declare function isLockTimeoutError(errorOutput: string): boolean;
  * Enhanced with configurable options and metrics.
  */
 export declare function executeApplyWithRetry(applyArgs: string[], verbose: boolean, config?: RetryConfig): Promise<RetryResult>;
+/**
+ * Options for plan+psql execution with retry.
+ */
+export interface PlanSqlRetryConfig extends RetryConfig {
+    /**
+     * Re-generate plan SQL on retry to handle partial execution safely.
+     * Returns fresh plan SQL, or null if all changes are already applied.
+     */
+    rePlanFn?: () => string | null;
+    /**
+     * Allowed hazard types for defense-in-depth validation.
+     * Plan SQL is validated against this list before each psql execution.
+     * If omitted, hazard validation is skipped (primary check in actors.ts handles it).
+     */
+    allowedHazardTypes?: string[];
+}
+/**
+ * Execute plan SQL via psql with retry logic.
+ *
+ * Replaces pg-schema-diff apply to avoid creating temp DB on the production server,
+ * which exhausts connections on Supabase (max_connections=60).
+ *
+ * On retry: calls rePlanFn() to regenerate plan (handles partial execution safely).
+ */
+export declare function executePlanSqlWithRetry(dbUrl: string, initialPlanSql: string, verbose: boolean, config?: PlanSqlRetryConfig): Promise<RetryResult>;
 //# sourceMappingURL=retry-logic.d.ts.map

package/dist/commands/db/apply/helpers/retry-logic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retry-logic.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/retry-logic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,SAAuB,GAAG,MAAM,CAIhG;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAqEtB"}
+{"version":3,"file":"retry-logic.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/retry-logic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,SAAuB,GAAG,MAAM,CAIhG;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAqEtB;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CA0FtB"}

package/dist/commands/db/apply/machine.d.ts

@@ -35,7 +35,9 @@ interface DbApplyContext {
     input: DbApplyInput;
     targetDir: string;
     idempotentPreApplied: number;
+    idempotentPreSkipped: number;
     idempotentPostApplied: number;
+    idempotentPostSkipped: number;
     rolePasswordsSet: number;
     schemaChangesApplied: boolean;
     hazards: string[];
@@ -67,6 +69,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.ApplyResult, {
         input: DbApplyInput;
         targetDir: string;
+        pass: "pre" | "post";
     }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.PgSchemaDiffResult, {
         input: DbApplyInput;
         targetDir: string;
@@ -85,6 +88,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     logic: import("xstate").PromiseActorLogic<actors.ApplyResult, {
         input: DbApplyInput;
         targetDir: string;
+        pass: "pre" | "post";
     }, import("xstate").EventObject>;
     id: string | undefined;
 } | {
@@ -103,6 +107,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     schemaChangesApplied: boolean;
     hazards: string[];
     seedsApplied: boolean;
+    idempotentSchemasSkipped?: number | undefined;
     rolePasswordsSet?: number | undefined;
     error?: string | undefined;
     planSql?: string | undefined;

package/dist/commands/db/apply/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/machine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAU,KAAK,YAAY,EAAS,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAiC,MAAM,eAAe,CAAC;AA6FjF,UAAU,cAAc;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAElB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,cAAc;UAFC,OAAO;;UAAa,gBAAgB;WAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAI1D,YAAY;eAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6NjD,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAErE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEpE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAExE"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/machine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAU,KAAK,YAAY,EAAS,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAiC,MAAM,eAAe,CAAC;AA6FjF,UAAU,cAAc;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAElB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,cAAc;UAFC,OAAO;;UAAa,gBAAgB;WAAS,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAI1D,YAAY;eAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2OjD,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;AAGlE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAErE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAEpE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAExE"}

package/dist/constants/versions.d.ts

@@ -20,7 +20,7 @@
  *
  * Sync strategy: Keep this in sync with packages/runa-templates/package.json version.
  */
-export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.56";
+export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.60";
 /**
  * Templates package name on GitHub Packages.
  * Published to npm.pkg.github.com (requires NODE_AUTH_TOKEN).

package/dist/index.js

@@ -1161,7 +1161,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.58";
+    CLI_VERSION = "0.5.60";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -7599,13 +7599,13 @@ function printSummary(logger16, output3) {
 }
 function findRepoRoot(startDir) {
   const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync53(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
+    const pkgPath = join24(current, "package.json");
     if (existsSync53(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
@@ -8176,8 +8176,8 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
   const nextCommand = mode === "dev" ? "dev" : "start";
   const rootHasCiScript = Boolean(rootScripts?.[ciScriptName]);
   const appHasCiScript = Boolean(appScripts?.[ciScriptName]);
-  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.["start"]);
-  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.["start"]);
+  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.start);
+  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.start);
   if (isMonorepo2 && (rootHasCiScript || rootHasDefaultScript)) {
     const scriptName = rootHasCiScript ? ciScriptName : "start";
     return { command: ["pnpm", scriptName], useRootScript: true };
@@ -8429,7 +8429,7 @@ var processCheckActor = fromPromise(async ({ input: input3 }) => {
   }
   if (pidFileContent) {
     const pid = parseInt(pidFileContent, 10);
-    if (!isNaN(pid) && isProcessAlive(pid)) {
+    if (!Number.isNaN(pid) && isProcessAlive(pid)) {
       if (input3.replace) {
         await terminateAppProcessByPid({
           pid,
@@ -13099,7 +13099,7 @@ var syncSchemaActor = fromPromise(
         "--auto-approve",
         // Allow DELETES_DATA hazards in preview
         "--no-seed",
-        // Seeds applied separately by applySeedsActor (avoid duplicate application)
+        // Seeds applied separately by applySeedsActor
         "--verbose"
         // Always verbose for full traceability
       ] : [
@@ -13109,6 +13109,8 @@ var syncSchemaActor = fromPromise(
         "sync",
         envArg,
         "--auto-approve",
+        "--no-seed",
+        // Seeds applied separately by applySeedsActor
         "--verbose",
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
@@ -13245,7 +13247,67 @@ init_esm_shims();
 // src/commands/ci/commands/ci-supabase-local.ts
 init_esm_shims();
 init_constants();
+function isPortAvailable(port) {
+  return new Promise((resolve12) => {
+    const server = net.createServer();
+    server.once("error", () => resolve12(false));
+    server.once("listening", () => {
+      server.close(() => resolve12(true));
+    });
+    server.listen(port);
+  });
+}
+function detectSupabaseContainers() {
+  try {
+    const result = spawnSync(
+      "docker",
+      ["ps", "--format", "{{.Names}}	{{.Ports}}	{{.Status}}", "--filter", "name=supabase"],
+      { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (result.status !== 0 || !result.stdout?.trim()) return [];
+    return result.stdout.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function checkSupabasePortConflicts(repoRoot) {
+  let dbPort = 54322;
+  try {
+    const { readFileSync: readFileSync30 } = await import('fs');
+    const configPath = path11__default.join(repoRoot, "supabase", "config.toml");
+    const content = readFileSync30(configPath, "utf-8");
+    const match = /\[db\][^[]*?port\s*=\s*(\d+)/s.exec(content);
+    if (match?.[1]) dbPort = Number.parseInt(match[1], 10);
+  } catch {
+  }
+  const available = await isPortAvailable(dbPort);
+  if (available) return;
+  const containers = detectSupabaseContainers();
+  const dbContainers = containers.filter((c) => c.includes(String(dbPort)) || c.includes("db-"));
+  console.warn("");
+  console.warn("\u26A0\uFE0F  Port conflict detected: PostgreSQL port %d is already in use", dbPort);
+  console.warn("");
+  if (dbContainers.length > 0) {
+    console.warn("   Running Supabase containers:");
+    for (const c of dbContainers) {
+      console.warn(`     ${c}`);
+    }
+  } else if (containers.length > 0) {
+    console.warn("   Running Supabase containers (no DB match):");
+    for (const c of containers.slice(0, 5)) {
+      console.warn(`     ${c}`);
+    }
+  } else {
+    console.warn("   No Supabase containers detected (port may be used by another process).");
+  }
+  console.warn("");
+  console.warn("   To fix:");
+  console.warn("     1. Stop the other instance: supabase stop (in the other project)");
+  console.warn("     2. Or use a different port in supabase/config.toml: [db] port = 54323");
+  console.warn("");
+}
 async function startSupabaseLocal(params) {
+  await checkSupabasePortConflicts(params.repoRoot);
   const exclude = process.env.RUNA_CI_SUPABASE_EXCLUDE ?? "studio,edge-runtime,storage-api,realtime,imgproxy,mailpit,logflare,vector,supavisor";
   await runLogged({
     cwd: params.repoRoot,
@@ -13465,7 +13527,7 @@ AND table_schema NOT IN ('information_schema');
 SELECT COUNT(*)::int
 FROM pg_class c
 JOIN pg_namespace n ON n.oid=c.relnamespace
-WHERE c.relkind='r'
+WHERE c.relkind IN ('r','p')
 AND n.nspname NOT LIKE 'pg_%'
 AND n.nspname NOT IN ('information_schema')
 AND c.relrowsecurity;
@@ -19404,6 +19466,93 @@ function releaseAdvisoryLock(dbUrl, verbose) {
   }
 }
 
+// src/commands/db/apply/helpers/plan-validator.ts
+init_esm_shims();
+var PlanHazardSchema = z.object({
+  type: z.string().min(1),
+  message: z.string()
+});
+var PlanStatementSchema = z.object({
+  index: z.number().int().nonnegative(),
+  sql: z.string().min(1),
+  hazards: z.array(PlanHazardSchema)
+});
+var ValidatedPlanSchema = z.object({
+  statements: z.array(PlanStatementSchema),
+  totalStatements: z.number().int().nonnegative(),
+  rawSql: z.string().min(1)
+});
+function flushStatement(current, results) {
+  if (!current) return;
+  const sql = current.sqlLines.join("\n").trim();
+  if (!sql) return;
+  results.push({ index: current.index, sql, hazards: current.hazards });
+}
+function parseWithStatementMarkers(lines) {
+  const results = [];
+  let current = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const idxMatch = trimmed.match(/^-- Statement Idx\.\s*(\d+)/);
+    if (idxMatch) {
+      flushStatement(current, results);
+      current = { index: parseInt(idxMatch[1], 10), sqlLines: [], hazards: [] };
+      continue;
+    }
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch && current) {
+      current.hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (current && trimmed && !trimmed.startsWith("--")) {
+      current.sqlLines.push(line);
+    }
+  }
+  flushStatement(current, results);
+  return results;
+}
+function parseAsSingleStatement(lines) {
+  const sqlLines = [];
+  const hazards = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch) {
+      hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (trimmed && !trimmed.startsWith("--")) {
+      sqlLines.push(line);
+    }
+  }
+  const sql = sqlLines.join("\n").trim();
+  if (!sql) return [];
+  return [{ index: 0, sql, hazards }];
+}
+function parsePlanOutput(planOutput) {
+  const lines = planOutput.split("\n");
+  const hasStatementMarkers = lines.some((l) => /^-- Statement Idx\.\s*\d+/.test(l.trim()));
+  const statements = hasStatementMarkers ? parseWithStatementMarkers(lines) : parseAsSingleStatement(lines);
+  const plan = {
+    statements,
+    totalStatements: statements.length,
+    rawSql: planOutput
+  };
+  return ValidatedPlanSchema.parse(plan);
+}
+function validatePlanForExecution(plan, allowedHazardTypes) {
+  if (plan.totalStatements === 0) return;
+  const allHazards = plan.statements.flatMap((s) => s.hazards);
+  const allowedSet = new Set(allowedHazardTypes);
+  const unresolved = allHazards.filter((h) => !allowedSet.has(h.type));
+  if (unresolved.length > 0) {
+    const types = [...new Set(unresolved.map((h) => h.type))].join(", ");
+    throw new Error(
+      `Plan contains unapproved hazards: ${types}. Approved: [${allowedHazardTypes.join(", ")}]. This is a safety check \u2014 hazards must be approved before execution.`
+    );
+  }
+}
+
 // src/commands/db/apply/helpers/pg-schema-diff-helpers.ts
 init_esm_shims();
 var logger4 = createCLILogger("db:apply");
@@ -19749,49 +19898,70 @@ function calculateBackoffDelay(attempt, maxDelayMs = DEFAULT_MAX_DELAY_MS) {
 function isLockTimeoutError(errorOutput) {
   return errorOutput.includes("lock_timeout") || errorOutput.includes("canceling statement due to lock timeout") || errorOutput.includes("could not obtain lock");
 }
-async function executeApplyWithRetry(applyArgs, verbose, config) {
+async function executePlanSqlWithRetry(dbUrl, initialPlanSql, verbose, config) {
   const maxRetries = config?.maxRetries ?? MAX_RETRIES;
   const maxDelayMs = config?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
   let lastError = null;
   let totalWaitMs = 0;
+  let currentPlanSql = initialPlanSql;
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     if (attempt > 0) {
       const delay = calculateBackoffDelay(attempt - 1, maxDelayMs);
       totalWaitMs += delay;
       logger5.info(`Retry ${attempt}/${maxRetries - 1} after ${Math.round(delay)}ms...`);
       await sleep(delay);
+      if (config?.rePlanFn) {
+        const freshPlan = config.rePlanFn();
+        if (freshPlan === null) {
+          return { success: true, attempts: attempt, totalWaitMs };
+        }
+        currentPlanSql = freshPlan;
+      }
     }
-    const applyResult = spawnSync("pg-schema-diff", applyArgs, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = applyResult.stdout || "";
-    const stderr = applyResult.stderr || "";
-    if (verbose) {
-      if (stdout) process.stdout.write(stdout);
-      if (stderr) process.stderr.write(stderr);
-    }
-    if (applyResult.status === 0) {
+    const plan = parsePlanOutput(currentPlanSql);
+    if (plan.totalStatements === 0) {
       return { success: true, attempts: attempt, totalWaitMs };
     }
-    const errorOutput = stderr || stdout || "Unknown error";
-    if (isLockTimeoutError(errorOutput)) {
-      logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
-      lastError = new Error(`lock_timeout: ${errorOutput}`);
-      continue;
+    if (config?.allowedHazardTypes) {
+      validatePlanForExecution(plan, config.allowedHazardTypes);
     }
-    logger5.error("pg-schema-diff apply failed:");
-    logger5.error(errorOutput);
-    const extDetection = detectMissingExtensionType(errorOutput);
-    if (extDetection.detected) {
-      logger5.error(formatExtensionErrorHint(extDetection));
+    if (verbose) {
+      logger5.debug(`Plan validated: ${plan.totalStatements} statement(s)`);
+    }
+    const planFile = join(tmpdir(), `runa-plan-${Date.now()}-${attempt}.sql`);
+    const wrappedSql = `SET lock_timeout = '50ms';
+
+${currentPlanSql}`;
+    writeFileSync(planFile, wrappedSql, "utf-8");
+    try {
+      const result = psqlSyncFile({ databaseUrl: dbUrl, filePath: planFile, onErrorStop: true });
+      if (verbose) {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      }
+      if (result.status === 0) {
+        return { success: true, attempts: attempt, totalWaitMs };
+      }
+      const errorOutput = result.stderr || result.stdout || "Unknown error";
+      if (isLockTimeoutError(errorOutput)) {
+        logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
+        lastError = new Error(`lock_timeout: ${errorOutput}`);
+        continue;
+      }
+      logger5.error("Plan execution failed:");
+      logger5.error(errorOutput);
+      return {
+        success: false,
+        error: new Error(`Plan execution failed: ${errorOutput}`),
+        attempts: attempt,
+        totalWaitMs
+      };
+    } finally {
+      try {
+        unlinkSync(planFile);
+      } catch {
+      }
     }
-    return {
-      success: false,
-      error: new Error(`pg-schema-diff apply failed: ${errorOutput}`),
-      attempts: attempt,
-      totalWaitMs
-    };
   }
   logger5.error(`Migration failed after ${maxRetries} attempts (total wait: ${totalWaitMs}ms)`);
   return {
@@ -20087,48 +20257,58 @@ function handleFreshDbCase(input3, dbUrl, targetDir) {
     return { sql: "", hazards: [], applied: true };
   }
 }
-async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards) {
-  logger6.step("Applying schema changes...");
+async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards, tempDbDsn) {
+  logger6.step("Applying schema changes (plan+psql)...");
   const lockAcquired = acquireAdvisoryLock(dbUrl, input3.verbose);
   if (!lockAcquired) {
     throw new Error(
       "Could not acquire migration lock. Another migration may be running. Wait for it to complete or manually release the lock."
     );
   }
-  const applyArgs = [
-    "apply",
-    "--from-dsn",
-    dbUrl,
-    "--to-dir",
-    schemasDir,
-    "--disable-plan-validation",
-    "--skip-confirm-prompt",
-    "-l",
-    'pattern=".*" timeout=50ms',
-    ...includeSchemas.flatMap((s) => ["--include-schema", s])
-  ];
-  const allowedHazards = buildAllowedHazards(input3);
-  if (allowedHazards.length > 0) {
-    applyArgs.push("--allow-hazards", allowedHazards.join(","));
-  }
-  const result = await executeApplyWithRetry(applyArgs, input3.verbose, {
-    maxDelayMs: input3.maxLockWaitMs
-  });
-  releaseAdvisoryLock(dbUrl, input3.verbose);
-  if (!result.success) {
-    throw result.error || new Error("Migration failed");
-  }
-  if (input3.verbose && result.attempts > 0) {
-    logger6.debug(`Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`);
+  try {
+    const allowedHazardTypes = buildAllowedHazards(input3);
+    const result = await executePlanSqlWithRetry(dbUrl, planOutput, input3.verbose, {
+      maxDelayMs: input3.maxLockWaitMs,
+      allowedHazardTypes,
+      rePlanFn: () => {
+        const { planOutput: freshPlan } = executePgSchemaDiffPlan(
+          dbUrl,
+          schemasDir,
+          includeSchemas,
+          input3.verbose,
+          { tempDbDsn }
+        );
+        if (!freshPlan.trim() || freshPlan.includes("No changes")) {
+          return null;
+        }
+        return freshPlan;
+      }
+    });
+    if (!result.success) {
+      throw result.error || new Error("Migration failed");
+    }
+    if (input3.verbose && result.attempts > 0) {
+      logger6.debug(
+        `Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`
+      );
+    }
+    logger6.success("Schema changes applied");
+    return {
+      sql: planOutput,
+      hazards,
+      applied: true,
+      retryAttempts: result.attempts,
+      retryWaitMs: result.totalWaitMs
+    };
+  } finally {
+    try {
+      releaseAdvisoryLock(dbUrl, input3.verbose);
+    } catch (lockError) {
+      logger6.warn(
+        `Failed to release advisory lock: ${lockError instanceof Error ? lockError.message : "Unknown error"}`
+      );
+    }
   }
-  logger6.success("Schema changes applied");
-  return {
-    sql: planOutput,
-    hazards,
-    applied: true,
-    retryAttempts: result.attempts,
-    retryWaitMs: result.totalWaitMs
-  };
 }
 var ROLE_PASSWORD_CONFIGS = [
   {
@@ -20239,45 +20419,66 @@ function shouldSkipInProduction(file, env2, verbose) {
   }
   return true;
 }
-function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose) {
+function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose, pass) {
   const filePath = join(schemasDir, file);
   if (verbose) logger6.debug(`Applying ${file}...`);
   const result = psqlSyncFile({
     databaseUrl: dbUrl,
     filePath,
     onErrorStop: true
-    // Fail fast on idempotent schemas
   });
   if (verbose) {
     if (result.stdout) process.stdout.write(result.stdout);
     if (result.stderr) process.stderr.write(result.stderr);
   }
   if (result.status !== 0) {
+    if (pass === "pre") {
+      if (verbose) {
+        logger6.warn(`Skipped ${file} (will retry in 2nd pass)`);
+      }
+      return false;
+    }
     const errorMsg = result.stderr ? maskDbCredentials(result.stderr) : "";
     throw new Error(`Failed to apply idempotent schema: ${file}
 ${errorMsg}`);
   }
+  return true;
 }
-var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir } }) => {
+var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir, pass } }) => {
   checkPasswordSecurity();
   const schemasDir = join(targetDir, "supabase/schemas/idempotent");
   const dbUrl = getDbUrl(input3);
   let filesApplied = 0;
+  let filesSkipped = 0;
   if (existsSync(schemasDir)) {
     const files = readdirSync(schemasDir).filter((f) => f.endsWith(".sql")).sort();
     if (files.length > 0) {
       for (const file of files) {
         if (shouldSkipInProduction(file, input3.env, input3.verbose)) continue;
-        applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose);
+        const applied = applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose, pass);
+        if (applied) {
+          filesApplied++;
+        } else {
+          filesSkipped++;
+        }
+      }
+      if (filesSkipped > 0) {
+        logger6.success(
+          `Applied ${filesApplied}/${filesApplied + filesSkipped} idempotent schema(s) (${filesSkipped} deferred to 2nd pass)`
+        );
+        if (filesSkipped === files.length) {
+          logger6.warn("ALL idempotent files skipped in 1st pass.");
+          logger6.warn("This may indicate a syntax error. Check logs with --verbose.");
+        }
+      } else {
+        logger6.success(`Applied ${filesApplied} idempotent schema(s)`);
       }
-      logger6.success(`Applied ${files.length} idempotent schema(s)`);
-      filesApplied = files.length;
     }
   } else {
     logger6.info("No idempotent schemas found");
   }
   const rolePasswordsSet = setRolePasswords(dbUrl, input3.verbose);
-  return { filesApplied, rolePasswordsSet };
+  return { filesApplied, filesSkipped, rolePasswordsSet };
 });
 var applyPgSchemaDiff = fromPromise(async ({ input: { input: input3, targetDir } }) => {
   const schemasDir = join(targetDir, "supabase/schemas/declarative");
@@ -20346,7 +20547,15 @@ ${content}`;
       displayCheckModeResults(planOutput);
       return { sql: planOutput, hazards, applied: false };
     }
-    return applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards);
+    return applyWithLockAndRetry(
+      dbUrl,
+      schemasDir,
+      includeSchemas,
+      input3,
+      planOutput,
+      hazards,
+      shadowDb?.dsn
+    );
   } finally {
     if (shadowDb) {
       try {
@@ -20458,6 +20667,11 @@ var DbApplyMetricsSchema = z.object({
 z.object({
   success: z.boolean(),
   idempotentSchemasApplied: z.number(),
+  /**
+   * Number of idempotent schemas deferred during 1st pass (graceful skip).
+   * These are retried in 2nd pass after declarative tables exist.
+   */
+  idempotentSchemasSkipped: z.number().optional(),
   /**
    * Number of RBAC role passwords set (drizzle_app, drizzle_service).
    * Set when DRIZZLE_APP_PASSWORD or DRIZZLE_SERVICE_PASSWORD env vars are present.
@@ -20578,7 +20792,9 @@ var dbApplyMachine = setup({
     targetDir: input3.targetDir,
     // 2-pass idempotent
     idempotentPreApplied: 0,
+    idempotentPreSkipped: 0,
     idempotentPostApplied: 0,
+    idempotentPostSkipped: 0,
     rolePasswordsSet: 0,
     schemaChangesApplied: false,
     hazards: [],
@@ -20609,11 +20825,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPreStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "pre"
+        }),
         onDone: {
           target: "applyingPgSchemaDiff",
           actions: assign({
             idempotentPreApplied: ({ event }) => event.output.filesApplied,
+            idempotentPreSkipped: ({ event }) => event.output.filesSkipped,
             rolePasswordsSet: ({ event }) => event.output.rolePasswordsSet,
             idempotentPreEndTime: () => Date.now()
           })
@@ -20672,11 +20893,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPostStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "post"
+        }),
         onDone: {
           target: "applyingSeeds",
           actions: assign({
             idempotentPostApplied: ({ event }) => event.output.filesApplied,
+            idempotentPostSkipped: ({ event }) => event.output.filesSkipped,
             idempotentPostEndTime: () => Date.now()
           })
         },
@@ -20734,9 +20960,11 @@ var dbApplyMachine = setup({
       retryAttempts: context.retryAttempts > 0 ? context.retryAttempts : void 0
     };
     const totalIdempotentApplied = context.idempotentPreApplied + context.idempotentPostApplied;
+    const totalIdempotentSkipped = context.idempotentPreSkipped + context.idempotentPostSkipped;
     return {
       success: !context.error,
       idempotentSchemasApplied: totalIdempotentApplied,
+      idempotentSchemasSkipped: totalIdempotentSkipped > 0 ? totalIdempotentSkipped : void 0,
       rolePasswordsSet: context.rolePasswordsSet > 0 ? context.rolePasswordsSet : void 0,
       schemaChangesApplied: context.schemaChangesApplied,
       hazards: context.hazards,
@@ -26393,7 +26621,7 @@ function getTablesWithTimestamps(dbUrl, schemas) {
     JOIN pg_attribute a1 ON c.oid = a1.attrelid AND a1.attname = 'updated_at'
     JOIN pg_attribute a2 ON c.oid = a2.attrelid AND a2.attname = 'created_at'
     WHERE n.nspname IN (${schemasFilter})
-      AND c.relkind = 'r'
+      AND c.relkind IN ('r', 'p')
     ORDER BY n.nspname, c.relname;
   `;
   const conn = parsePostgresUrl(dbUrl);
@@ -31209,7 +31437,7 @@ init_esm_shims();
 
 // src/constants/versions.ts
 init_esm_shims();
-var COMPATIBLE_TEMPLATES_VERSION = "0.5.56";
+var COMPATIBLE_TEMPLATES_VERSION = "0.5.60";
 var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
 var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
 
@@ -35800,13 +36028,13 @@ function printActionsNeeded(logger16, actions) {
 }
 function findRepoRoot3(startDir) {
   const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync53(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
+    const pkgPath = join24(current, "package.json");
     if (existsSync53(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
@@ -35876,8 +36104,8 @@ function generateReportOutput(output3, isJsonMode) {
 }
 function validateRunaRepo(repoRoot) {
   const { existsSync: existsSync53 } = __require("fs");
-  const { join: join23 } = __require("path");
-  const templateDir = join23(repoRoot, "packages/runa-templates/templates");
+  const { join: join24 } = __require("path");
+  const templateDir = join24(repoRoot, "packages/runa-templates/templates");
   if (!existsSync53(templateDir)) {
     throw new CLIError("template-check is a runa-repo only command", "NOT_RUNA_REPO", [
       "This command compares runa-repo with pj-repo templates",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.58",
+  "version": "0.5.60",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -53,7 +53,7 @@
     "typescript": "5.9.3",
     "xstate": "5.28.0",
     "zod": "4.3.6",
-    "@runa-ai/runa": "0.5.58",
+    "@runa-ai/runa": "0.5.60",
     "@runa-ai/runa-xstate-test-plugin": "0.5.58"
   },
   "engines": {