@runa-ai/runa-cli 0.5.58 → 0.5.61

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import * as path11 from 'path';
-import path11__default, { join, dirname, resolve, isAbsolute, relative, sep, basename, normalize } from 'path';
+import * as path12 from 'path';
+import path12__default, { join, dirname, resolve, isAbsolute, relative, sep, basename, normalize } from 'path';
 import { fileURLToPath } from 'url';
 import * as fs5 from 'fs';
 import fs5__default, { existsSync, readFileSync, unlinkSync, rmSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, realpathSync, promises, lstatSync, accessSync, constants, chmodSync } from 'fs';
 import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
-import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, SUPABASE_SYSTEM_SCHEMAS, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, BASE_PORTS, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, resolveAvailablePorts, calculatePortOffset, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, getPortsWithOffset, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, DATABASE_PACKAGE_CANDIDATES, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
+import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, SUPABASE_SYSTEM_SCHEMAS, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, BASE_PORTS, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, loadRunaConfigOrThrow, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, resolveAvailablePorts, calculatePortOffset, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, getPortsWithOffset, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, DATABASE_PACKAGE_CANDIDATES, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
 import fs9, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir, lstat } from 'fs/promises';
 import { promisify } from 'util';
@@ -73,7 +73,7 @@ var getFilename, getDirname, __dirname$1;
 var init_esm_shims = __esm({
   "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.6_tsx@4.21.0_typescript@5.9.3_yaml@2.8.2/node_modules/tsup/assets/esm_shims.js"() {
     getFilename = () => fileURLToPath(import.meta.url);
-    getDirname = () => path11__default.dirname(getFilename());
+    getDirname = () => path12__default.dirname(getFilename());
     __dirname$1 = /* @__PURE__ */ getDirname();
   }
 });
@@ -135,7 +135,7 @@ function parseTomlPort(content, section, key) {
   return isValidPort(parsed) ? parsed : null;
 }
 function parseTomlPorts(configRoot) {
-  const configPath = path11__default.join(configRoot, "supabase", "config.toml");
+  const configPath = path12__default.join(configRoot, "supabase", "config.toml");
   if (!existsSync(configPath)) return null;
   try {
     const content = readFileSync(configPath, "utf-8");
@@ -164,13 +164,13 @@ function detectStatus(projectRoot) {
   }
 }
 function resolveSupabaseRoot(projectRoot) {
-  const start = path11__default.resolve(projectRoot);
+  const start = path12__default.resolve(projectRoot);
   let current = start;
   while (true) {
-    if (existsSync(path11__default.join(current, "supabase", "config.toml"))) {
+    if (existsSync(path12__default.join(current, "supabase", "config.toml"))) {
       return current;
     }
-    const parent = path11__default.dirname(current);
+    const parent = path12__default.dirname(current);
     if (parent === current) {
       return start;
     }
@@ -980,11 +980,11 @@ function validateRunaConfig(config) {
   };
 }
 function hasValidDatabaseIndicators(dir) {
-  const hasPrimaryIndicator = existsSync(path11__default.join(dir, "drizzle.config.ts")) || existsSync(path11__default.join(dir, "supabase", "schemas")) || existsSync(path11__default.join(dir, "src", "schema")) || existsSync(path11__default.join(dir, "scripts", "db-sync.ts"));
+  const hasPrimaryIndicator = existsSync(path12__default.join(dir, "drizzle.config.ts")) || existsSync(path12__default.join(dir, "supabase", "schemas")) || existsSync(path12__default.join(dir, "src", "schema")) || existsSync(path12__default.join(dir, "scripts", "db-sync.ts"));
   if (hasPrimaryIndicator) {
     return true;
   }
-  const pkgJsonPath = path11__default.join(dir, "package.json");
+  const pkgJsonPath = path12__default.join(dir, "package.json");
   if (existsSync(pkgJsonPath)) {
     try {
       const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
@@ -1000,15 +1000,15 @@ function hasValidDatabaseIndicators(dir) {
 function tryResolveFromConfig(cwd) {
   try {
     const loaded = loadRunaConfigOrThrow(cwd);
-    const configDir = path11__default.dirname(loaded.configPath);
+    const configDir = path12__default.dirname(loaded.configPath);
     const config = loaded.config;
     if (config.project.monorepo === false && hasValidDatabaseIndicators(configDir)) {
       return configDir;
     }
     const dbConfig = getDatabaseConfig(config);
     const schemaPath = dbConfig.schemaPath;
-    const dbPath = schemaPath.includes("/src/") ? schemaPath.split("/src/")[0] : schemaPath.startsWith("src/") ? "." : path11__default.dirname(schemaPath);
-    const fullPath = dbPath === "." ? configDir : path11__default.join(configDir, dbPath);
+    const dbPath = schemaPath.includes("/src/") ? schemaPath.split("/src/")[0] : schemaPath.startsWith("src/") ? "." : path12__default.dirname(schemaPath);
+    const fullPath = dbPath === "." ? configDir : path12__default.join(configDir, dbPath);
     return existsSync(fullPath) ? fullPath : null;
   } catch {
     return null;
@@ -1021,9 +1021,9 @@ async function getDatabasePackagePath(cwd = process.cwd()) {
   if (dbPackage) return dbPackage;
   const baseDir = findWorkspaceRoot(cwd) || cwd;
   const conventionalPaths = [
-    path11__default.join(baseDir, "packages", "database"),
-    path11__default.join(baseDir, "packages", "db"),
-    path11__default.join(baseDir, "db"),
+    path12__default.join(baseDir, "packages", "database"),
+    path12__default.join(baseDir, "packages", "db"),
+    path12__default.join(baseDir, "db"),
     baseDir
   ];
   for (const candidate of conventionalPaths) {
@@ -1054,14 +1054,14 @@ Solutions:
 async function getSDKScriptsPath(cwd = process.cwd()) {
   const sdkPackage = findPackage("sdk", cwd);
   if (sdkPackage) {
-    const scriptsPath = path11__default.join(sdkPackage, "scripts");
+    const scriptsPath = path12__default.join(sdkPackage, "scripts");
     if (existsSync(scriptsPath)) {
       return scriptsPath;
     }
   }
   const workspaceRoot = findWorkspaceRoot(cwd);
   const baseDir = workspaceRoot || cwd;
-  const installedPath = path11__default.join(baseDir, "node_modules", "@runa-ai", "runa", "scripts");
+  const installedPath = path12__default.join(baseDir, "node_modules", "@runa-ai", "runa", "scripts");
   if (existsSync(installedPath)) {
     return installedPath;
   }
@@ -1072,14 +1072,14 @@ async function getSDKScriptsPath(cwd = process.cwd()) {
 async function getSDKTemplatesPath(cwd = process.cwd()) {
   const sdkPackage = findPackage("sdk", cwd);
   if (sdkPackage) {
-    const templatesPath = path11__default.join(sdkPackage, "templates");
+    const templatesPath = path12__default.join(sdkPackage, "templates");
     if (existsSync(templatesPath)) {
       return templatesPath;
     }
   }
   const workspaceRoot = findWorkspaceRoot(cwd);
   const baseDir = workspaceRoot || cwd;
-  const installedPath = path11__default.join(baseDir, "node_modules", "@runa-ai", "runa", "templates");
+  const installedPath = path12__default.join(baseDir, "node_modules", "@runa-ai", "runa", "templates");
   if (existsSync(installedPath)) {
     return installedPath;
   }
@@ -1161,7 +1161,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.58";
+    CLI_VERSION = "0.5.61";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -1557,7 +1557,7 @@ var init_dependency_analyzer = __esm({
       name = "DependencyAnalyzer";
       categories = ["dependency"];
       async analyze(options) {
-        const packageJsonPath = path11__default.join(options.rootDir, "package.json");
+        const packageJsonPath = path12__default.join(options.rootDir, "package.json");
         try {
           await fs9.access(packageJsonPath);
         } catch {
@@ -3311,17 +3311,17 @@ var init_typescript_analyzer = __esm({
   }
 });
 function containsPathTraversal4(inputPath) {
-  const normalized = path11__default.normalize(inputPath);
+  const normalized = path12__default.normalize(inputPath);
   if (normalized.includes("..")) return true;
   if (inputPath.includes("\0")) return true;
   return false;
 }
 function isPathWithinBoundary(filePath, boundaryDir) {
   try {
-    const resolvedFile = path11__default.resolve(filePath);
-    const resolvedBoundary = path11__default.resolve(boundaryDir);
-    const relative9 = path11__default.relative(resolvedBoundary, resolvedFile);
-    return !relative9.startsWith("..") && !path11__default.isAbsolute(relative9);
+    const resolvedFile = path12__default.resolve(filePath);
+    const resolvedBoundary = path12__default.resolve(boundaryDir);
+    const relative9 = path12__default.relative(resolvedBoundary, resolvedFile);
+    return !relative9.startsWith("..") && !path12__default.isAbsolute(relative9);
   } catch {
     return false;
   }
@@ -3330,14 +3330,14 @@ function resolvePathWithinBoundary(inputPath, boundaryDir) {
   if (containsPathTraversal4(inputPath)) {
     throw new Error(`Path contains traversal patterns: ${inputPath}`);
   }
-  const resolvedPath = path11__default.isAbsolute(inputPath) ? inputPath : path11__default.resolve(boundaryDir, inputPath);
+  const resolvedPath = path12__default.isAbsolute(inputPath) ? inputPath : path12__default.resolve(boundaryDir, inputPath);
   if (!isPathWithinBoundary(resolvedPath, boundaryDir)) {
     throw new Error(`Path is outside allowed boundary: ${inputPath}`);
   }
   return resolvedPath;
 }
 function filterPathsWithinBoundary(files, boundaryDir) {
-  const resolvedBoundary = path11__default.resolve(boundaryDir);
+  const resolvedBoundary = path12__default.resolve(boundaryDir);
   return files.filter((file) => isPathWithinBoundary(file, resolvedBoundary));
 }
 function validateGlobPatterns(patterns) {
@@ -3398,7 +3398,7 @@ var init_loader = __esm({
   }
 });
 function normalizePath(filePath) {
-  const normalized = path11__default.normalize(filePath);
+  const normalized = path12__default.normalize(filePath);
   return normalized.replace(/\\/g, "/");
 }
 function normalizeRuleId(ruleId) {
@@ -5652,7 +5652,7 @@ function pipeToSharedLog(params) {
 }
 async function ensureRunaTmpDir(cwd) {
   const root = cwd ?? process.cwd();
-  const dir = path11__default.join(root, ".runa", "tmp");
+  const dir = path12__default.join(root, ".runa", "tmp");
   await mkdir(dir, { recursive: true });
   return dir;
 }
@@ -5677,7 +5677,7 @@ var buildActor = fromPromise(
     const { repoRoot, tmpDir, hasTurbo, e2e, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path12__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       const buildEnv = { ...env2 };
       if (e2e) {
@@ -5686,7 +5686,7 @@ var buildActor = fromPromise(
         buildEnv.TURBO_FORCE = "true";
         console.log("  E2E mode enabled: NEXT_PUBLIC_E2E_TEST=true, TURBO_FORCE=true");
       }
-      const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
+      const hasApps = existsSync(path12__default.join(repoRoot, "apps"));
       let args;
       if (hasTurbo) {
         args = hasApps ? ["turbo", "run", "build", "--filter=./apps/*", "--filter=./packages/*"] : ["turbo", "run", "build"];
@@ -5699,7 +5699,7 @@ var buildActor = fromPromise(
         label: "build",
         command: "pnpm",
         args,
-        logFile: path11__default.join(fullTmpDir, "build.log")
+        logFile: path12__default.join(fullTmpDir, "build.log")
       });
       return {
         passed: true,
@@ -5938,7 +5938,7 @@ function deleteIfExists(fullPath, displayPath, verbose) {
 function deleteRootDirectories(repoRoot, dirs, verbose) {
   const deleted = [];
   for (const dir of dirs) {
-    const fullPath = path11__default.join(repoRoot, dir);
+    const fullPath = path12__default.join(repoRoot, dir);
     if (deleteIfExists(fullPath, dir, verbose)) {
       deleted.push(dir);
     }
@@ -5949,13 +5949,13 @@ function cleanMonorepoPackages(repoRoot, dirs, verbose) {
   const deleted = [];
   const subdirs = ["apps", "packages"];
   for (const subdir of subdirs) {
-    const subdirPath = path11__default.join(repoRoot, subdir);
+    const subdirPath = path12__default.join(repoRoot, subdir);
     if (!existsSync(subdirPath)) continue;
     const entries = __require("fs").readdirSync(subdirPath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       for (const dir of dirs) {
-        const targetPath = path11__default.join(subdirPath, entry.name, dir);
+        const targetPath = path12__default.join(subdirPath, entry.name, dir);
         const displayPath = `${subdir}/${entry.name}/${dir}`;
         if (deleteIfExists(targetPath, displayPath, verbose)) {
           deleted.push(displayPath);
@@ -5974,7 +5974,7 @@ var cleanActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, verbose = false } = input3;
     try {
-      await mkdir(path11__default.join(repoRoot, tmpDir), { recursive: true });
+      await mkdir(path12__default.join(repoRoot, tmpDir), { recursive: true });
       if (verbose) {
         console.log("Cleaning build caches...");
       }
@@ -5996,7 +5996,7 @@ var freshActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, verbose = false } = input3;
     try {
-      await mkdir(path11__default.join(repoRoot, tmpDir), { recursive: true });
+      await mkdir(path12__default.join(repoRoot, tmpDir), { recursive: true });
       if (verbose) {
         console.log("Fresh install: cleaning all caches and node_modules...");
       }
@@ -6068,7 +6068,7 @@ var dbSyncActor = fromPromise(
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path12__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       await runLogged({
         cwd: repoRoot,
@@ -6076,7 +6076,7 @@ var dbSyncActor = fromPromise(
         label: "db-sync",
         command: "pnpm",
         args: ["exec", "runa", "db", "sync", "--auto-approve"],
-        logFile: path11__default.join(fullTmpDir, "db-sync.log")
+        logFile: path12__default.join(fullTmpDir, "db-sync.log")
       });
       return {
         passed: true,
@@ -6112,7 +6112,7 @@ var manifestActor = fromPromise(
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     const startTime = Date.now();
     try {
-      const fullTmpDir = path11__default.join(repoRoot, tmpDir);
+      const fullTmpDir = path12__default.join(repoRoot, tmpDir);
       await mkdir(fullTmpDir, { recursive: true });
       await runLogged({
         cwd: repoRoot,
@@ -6120,7 +6120,7 @@ var manifestActor = fromPromise(
         label: "manifest",
         command: "pnpm",
         args: ["exec", "runa", "manifest"],
-        logFile: path11__default.join(fullTmpDir, "manifest.log")
+        logFile: path12__default.join(fullTmpDir, "manifest.log")
       });
       return {
         passed: true,
@@ -6384,7 +6384,7 @@ function buildOutput(typeCheckPassed, lintPassed, typeCheckDurationMs, lintDurat
 var staticChecksActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, hasTurbo, env: env2 = process.env, skipTypes, skipLint } = input3;
-    const fullTmpDir = path11__default.join(repoRoot, tmpDir);
+    const fullTmpDir = path12__default.join(repoRoot, tmpDir);
     await mkdir(fullTmpDir, { recursive: true });
     const startTime = Date.now();
     const checksToRun = [];
@@ -6398,7 +6398,7 @@ var staticChecksActor = fromPromise(
           label: "type-check",
           command: cmd.command,
           args: cmd.args,
-          logFile: path11__default.join(fullTmpDir, "type-check.log")
+          logFile: path12__default.join(fullTmpDir, "type-check.log")
         })
       );
       checkOrder.push("type-check");
@@ -6412,7 +6412,7 @@ var staticChecksActor = fromPromise(
           label: "lint",
           command: cmd.command,
           args: cmd.args,
-          logFile: path11__default.join(fullTmpDir, "lint.log")
+          logFile: path12__default.join(fullTmpDir, "lint.log")
         })
       );
       checkOrder.push("lint");
@@ -6456,14 +6456,14 @@ var validateActor = fromPromise(
     let manifestsExist = true;
     const buildOutputPaths = [
       // Single app
-      path11__default.join(repoRoot, ".next"),
-      path11__default.join(repoRoot, "dist"),
+      path12__default.join(repoRoot, ".next"),
+      path12__default.join(repoRoot, "dist"),
       // Monorepo apps
-      path11__default.join(repoRoot, "apps", "web", ".next"),
-      path11__default.join(repoRoot, "apps", "dashboard", ".next"),
+      path12__default.join(repoRoot, "apps", "web", ".next"),
+      path12__default.join(repoRoot, "apps", "dashboard", ".next"),
       // Packages
-      path11__default.join(repoRoot, "packages", "cli", "dist"),
-      path11__default.join(repoRoot, "packages", "sdk", "dist")
+      path12__default.join(repoRoot, "packages", "cli", "dist"),
+      path12__default.join(repoRoot, "packages", "sdk", "dist")
     ];
     for (const outputPath of buildOutputPaths) {
       if (existsSync(outputPath)) {
@@ -6477,7 +6477,7 @@ var validateActor = fromPromise(
       );
     }
     if (!skipManifest) {
-      const manifestPath = path11__default.join(repoRoot, ".runa", "manifests", "manifest.json");
+      const manifestPath = path12__default.join(repoRoot, ".runa", "manifests", "manifest.json");
       if (!existsSync(manifestPath)) {
         manifestsExist = false;
         warnings.push("No manifest.json found. E2E test generation may be affected.");
@@ -6536,35 +6536,35 @@ function isE2EMode({ context }) {
   return context.input.e2e;
 }
 function detectDatabase(repoRoot) {
-  const configPath = path11__default.join(repoRoot, "runa.config.ts");
+  const configPath = path12__default.join(repoRoot, "runa.config.ts");
   if (!existsSync(configPath)) {
-    const jsConfigPath = path11__default.join(repoRoot, "runa.config.js");
+    const jsConfigPath = path12__default.join(repoRoot, "runa.config.js");
     if (!existsSync(jsConfigPath)) {
       return false;
     }
   }
-  const supabaseDir = path11__default.join(repoRoot, "supabase");
+  const supabaseDir = path12__default.join(repoRoot, "supabase");
   if (existsSync(supabaseDir)) {
     return true;
   }
-  const databasePkg = path11__default.join(repoRoot, "packages", "database");
+  const databasePkg = path12__default.join(repoRoot, "packages", "database");
   if (existsSync(databasePkg)) {
     return true;
   }
   return false;
 }
 function detectManifestTask(repoRoot) {
-  const runaConfigPath = path11__default.join(repoRoot, "runa.config.ts");
+  const runaConfigPath = path12__default.join(repoRoot, "runa.config.ts");
   if (existsSync(runaConfigPath)) {
     return true;
   }
-  const rootPkgPath = path11__default.join(repoRoot, "package.json");
+  const rootPkgPath = path12__default.join(repoRoot, "package.json");
   if (hasXStateDependency(rootPkgPath)) {
     return true;
   }
   const appDirs = ["apps/web", "apps/app", "apps/dashboard", "app"];
   for (const appDir of appDirs) {
-    const appPkgPath = path11__default.join(repoRoot, appDir, "package.json");
+    const appPkgPath = path12__default.join(repoRoot, appDir, "package.json");
     if (hasXStateDependency(appPkgPath)) {
       return true;
     }
@@ -6591,7 +6591,7 @@ function hasXStateDependency(pkgPath) {
   }
 }
 function detectTurbo(repoRoot) {
-  const turboJsonPath = path11__default.join(repoRoot, "turbo.json");
+  const turboJsonPath = path12__default.join(repoRoot, "turbo.json");
   return existsSync(turboJsonPath);
 }
 var guards = {
@@ -7598,17 +7598,17 @@ function printSummary(logger16, output3) {
   }
 }
 function findRepoRoot(startDir) {
-  const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { existsSync: existsSync54, readFileSync: readFileSync31 } = __require("fs");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync54(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
-    if (existsSync53(pkgPath)) {
+    const pkgPath = join24(current, "package.json");
+    if (existsSync54(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync31(pkgPath, "utf-8"));
         if (pkg.workspaces) {
           return current;
         }
@@ -7829,6 +7829,71 @@ var DevOutputSchema = z.object({
   error: z.string().optional()
 }).strict();
 
+// src/commands/dev/commands/dev.ts
+init_local_supabase();
+
+// src/utils/env-local-bridge.ts
+init_esm_shims();
+var DEFAULT_API_PORT2 = 54321;
+var DEFAULT_DB_PORT2 = 54322;
+var RUNA_ENV_LOCAL_MARKER = "# RUNA_AUTO_GENERATED \u2014 do not edit (created by `runa db start`)";
+function envLocalPath(projectRoot) {
+  return path12__default.join(projectRoot, ".env.local");
+}
+function isNonDefaultPorts(config) {
+  return config.api !== DEFAULT_API_PORT2 || config.db !== DEFAULT_DB_PORT2;
+}
+function buildEnvLocalContent(config) {
+  const dbUrl = `postgresql://postgres:postgres@${config.host}:${config.db}/postgres`;
+  return [
+    RUNA_ENV_LOCAL_MARKER,
+    `# Supabase is running on non-default ports (default: api=${DEFAULT_API_PORT2}, db=${DEFAULT_DB_PORT2}).`,
+    "# This file overrides .env.development so that `pnpm dev` uses correct ports.",
+    "# Removed automatically by `runa db stop`. Safe to delete manually.",
+    `DATABASE_URL=${dbUrl}`,
+    `DATABASE_URL_ADMIN=${dbUrl}`,
+    `DATABASE_URL_SERVICE=${dbUrl}`,
+    `NEXT_PUBLIC_SUPABASE_URL=http://${config.host}:${config.api}`,
+    ""
+  ].join("\n");
+}
+function isRunaManagedEnvLocal(projectRoot) {
+  const filePath = envLocalPath(projectRoot);
+  try {
+    const content = readFileSync(filePath, "utf-8");
+    return content.startsWith(RUNA_ENV_LOCAL_MARKER);
+  } catch {
+    return false;
+  }
+}
+function writeEnvLocalBridge(projectRoot, config) {
+  const filePath = envLocalPath(projectRoot);
+  const fileExists = existsSync(filePath);
+  if (isNonDefaultPorts(config)) {
+    if (fileExists && !isRunaManagedEnvLocal(projectRoot)) {
+      return { written: false, reason: "user-managed" };
+    }
+    writeFileSync(filePath, buildEnvLocalContent(config), "utf-8");
+    return { written: true, ports: { api: config.api, db: config.db } };
+  }
+  if (fileExists && isRunaManagedEnvLocal(projectRoot)) {
+    unlinkSync(filePath);
+    return { written: false, reason: "stale-removed" };
+  }
+  return { written: false, reason: "default-ports" };
+}
+function removeEnvLocalBridge(projectRoot) {
+  const filePath = envLocalPath(projectRoot);
+  if (!existsSync(filePath)) {
+    return { removed: false, reason: "not-found" };
+  }
+  if (!isRunaManagedEnvLocal(projectRoot)) {
+    return { removed: false, reason: "user-managed" };
+  }
+  unlinkSync(filePath);
+  return { removed: true };
+}
+
 // src/commands/dev/machine.ts
 init_esm_shims();
 
@@ -7853,42 +7918,42 @@ function resolvePolicy(_config, _repoKind) {
   };
 }
 function detectRepoKind(repoRoot) {
-  const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
-  const hasPackages = existsSync(path11__default.join(repoRoot, "packages"));
-  const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
+  const hasApps = existsSync(path12__default.join(repoRoot, "apps"));
+  const hasPackages = existsSync(path12__default.join(repoRoot, "packages"));
+  const hasTurbo = existsSync(path12__default.join(repoRoot, "turbo.json"));
   if (hasApps || hasPackages || hasTurbo) {
     return "monorepo";
   }
-  const hasSrc = existsSync(path11__default.join(repoRoot, "src"));
-  const hasApp = existsSync(path11__default.join(repoRoot, "app"));
+  const hasSrc = existsSync(path12__default.join(repoRoot, "src"));
+  const hasApp = existsSync(path12__default.join(repoRoot, "app"));
   if (hasSrc || hasApp) {
     return "pj-repo";
   }
   return "unknown";
 }
 function hasKnownFrameworkConfig(dir) {
-  if (existsSync(path11__default.join(dir, "next.config.js")) || existsSync(path11__default.join(dir, "next.config.mjs")) || existsSync(path11__default.join(dir, "next.config.ts"))) {
+  if (existsSync(path12__default.join(dir, "next.config.js")) || existsSync(path12__default.join(dir, "next.config.mjs")) || existsSync(path12__default.join(dir, "next.config.ts"))) {
     return true;
   }
-  if (existsSync(path11__default.join(dir, "vite.config.js")) || existsSync(path11__default.join(dir, "vite.config.ts"))) {
+  if (existsSync(path12__default.join(dir, "vite.config.js")) || existsSync(path12__default.join(dir, "vite.config.ts"))) {
     return true;
   }
-  if (existsSync(path11__default.join(dir, "remix.config.js"))) {
+  if (existsSync(path12__default.join(dir, "remix.config.js"))) {
     return true;
   }
-  if (existsSync(path11__default.join(dir, "astro.config.mjs")) || existsSync(path11__default.join(dir, "astro.config.ts"))) {
+  if (existsSync(path12__default.join(dir, "astro.config.mjs")) || existsSync(path12__default.join(dir, "astro.config.ts"))) {
     return true;
   }
-  if (existsSync(path11__default.join(dir, "nuxt.config.js")) || existsSync(path11__default.join(dir, "nuxt.config.ts"))) {
+  if (existsSync(path12__default.join(dir, "nuxt.config.js")) || existsSync(path12__default.join(dir, "nuxt.config.ts"))) {
     return true;
   }
-  if (existsSync(path11__default.join(dir, "svelte.config.js"))) {
+  if (existsSync(path12__default.join(dir, "svelte.config.js"))) {
     return true;
   }
   return false;
 }
 function hasPackageJson(dir) {
-  return existsSync(path11__default.join(dir, "package.json"));
+  return existsSync(path12__default.join(dir, "package.json"));
 }
 var PORT_PATTERNS = [
   /-p\s*([0-9]+)/i,
@@ -7908,11 +7973,11 @@ function extractPortFromScript(script) {
   return null;
 }
 function readPortFromScripts(appDir) {
-  const pkgPath = path11__default.join(appDir, "package.json");
+  const pkgPath = path12__default.join(appDir, "package.json");
   if (!existsSync(pkgPath)) return 3e3;
   try {
-    const { readFileSync: readFileSync30 } = __require("fs");
-    const raw = readFileSync30(pkgPath, "utf-8");
+    const { readFileSync: readFileSync31 } = __require("fs");
+    const raw = readFileSync31(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     const scripts = parsed.scripts;
     for (const key of ["start:ci", "start", "dev"]) {
@@ -7927,30 +7992,30 @@ function readPortFromScripts(appDir) {
   return 3e3;
 }
 function findWebAppUnderApps(repoRoot) {
-  const appsDir = path11__default.join(repoRoot, "apps");
+  const appsDir = path12__default.join(repoRoot, "apps");
   if (!existsSync(appsDir)) return null;
   try {
     const { readdirSync: readdirSync12 } = __require("fs");
     const entries = readdirSync12(appsDir, { withFileTypes: true });
     const priority = ["web", "dashboard", "app", "frontend", "client"];
     for (const name of priority) {
-      const candidate = path11__default.join(appsDir, name);
+      const candidate = path12__default.join(appsDir, name);
       if (hasKnownFrameworkConfig(candidate)) return candidate;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (priority.includes(entry.name)) continue;
-      const candidate = path11__default.join(appsDir, entry.name);
+      const candidate = path12__default.join(appsDir, entry.name);
       if (hasKnownFrameworkConfig(candidate)) return candidate;
     }
     for (const name of priority) {
-      const candidate = path11__default.join(appsDir, name);
+      const candidate = path12__default.join(appsDir, name);
       if (hasPackageJson(candidate)) return candidate;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (priority.includes(entry.name)) continue;
-      const candidate = path11__default.join(appsDir, entry.name);
+      const candidate = path12__default.join(appsDir, entry.name);
       if (hasPackageJson(candidate)) return candidate;
     }
   } catch {
@@ -7959,7 +8024,7 @@ function findWebAppUnderApps(repoRoot) {
 }
 function detectApp(repoRoot, configOverride) {
   if (configOverride?.directory && configOverride.directory !== ".") {
-    const configuredDir = path11__default.join(repoRoot, configOverride.directory);
+    const configuredDir = path12__default.join(repoRoot, configOverride.directory);
     if (existsSync(configuredDir) && hasPackageJson(configuredDir)) {
       return {
         appDir: configuredDir,
@@ -8094,7 +8159,7 @@ function pipeChildOutputToLog(params) {
   return { cleanup };
 }
 async function writeEnvLocal(params) {
-  const filePath = path11__default.join(params.appDir, ".env.local");
+  const filePath = path12__default.join(params.appDir, ".env.local");
   const content = `${Object.entries(params.values).map(([k, v]) => `${k}=${v}`).join("\n")}
 `;
   await writeFile(filePath, content, "utf-8");
@@ -8176,18 +8241,18 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
   const nextCommand = mode === "dev" ? "dev" : "start";
   const rootHasCiScript = Boolean(rootScripts?.[ciScriptName]);
   const appHasCiScript = Boolean(appScripts?.[ciScriptName]);
-  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.["start"]);
-  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.["start"]);
+  const rootHasDefaultScript = mode === "start" && Boolean(rootScripts?.start);
+  const appHasDefaultScript = mode === "start" && Boolean(appScripts?.start);
   if (isMonorepo2 && (rootHasCiScript || rootHasDefaultScript)) {
     const scriptName = rootHasCiScript ? ciScriptName : "start";
     return { command: ["pnpm", scriptName], useRootScript: true };
   }
   if (appHasCiScript || appHasDefaultScript) {
     const scriptName = appHasCiScript ? ciScriptName : "start";
-    const dirArgs2 = isMonorepo2 ? ["-C", path11__default.relative(repoRoot, appDir)] : [];
+    const dirArgs2 = isMonorepo2 ? ["-C", path12__default.relative(repoRoot, appDir)] : [];
     return { command: ["pnpm", ...dirArgs2, scriptName], useRootScript: false };
   }
-  const dirArgs = isMonorepo2 ? ["-C", path11__default.relative(repoRoot, appDir)] : [];
+  const dirArgs = isMonorepo2 ? ["-C", path12__default.relative(repoRoot, appDir)] : [];
   const bundlerArgs = bundler ? [`--${bundler}`] : [];
   return {
     command: ["pnpm", ...dirArgs, "exec", "next", nextCommand, ...bundlerArgs, "-p", String(port)],
@@ -8197,8 +8262,8 @@ function determineAppCommand(mode, isMonorepo2, rootScripts, appScripts, repoRoo
 async function startAppBackground(params) {
   const mode = params.mode ?? "start";
   const isMonorepo2 = params.appDir !== params.repoRoot;
-  const rootPkgPath = path11__default.join(params.repoRoot, "package.json");
-  const appPkgPath = path11__default.join(params.appDir, "package.json");
+  const rootPkgPath = path12__default.join(params.repoRoot, "package.json");
+  const appPkgPath = path12__default.join(params.appDir, "package.json");
   const rootScripts = await readPackageScripts(rootPkgPath);
   const appScripts = isMonorepo2 ? await readPackageScripts(appPkgPath) : rootScripts;
   const { command, useRootScript } = determineAppCommand(
@@ -8211,7 +8276,7 @@ async function startAppBackground(params) {
     params.port,
     params.bundler
   );
-  const appLog = path11__default.join(params.tmpDir, "app.log");
+  const appLog = path12__default.join(params.tmpDir, "app.log");
   const out = createWriteStream(appLog, { flags: "a" });
   const commandStr = command.join(" ");
   const modeLabel = mode === "dev" ? "development (hot reload)" : "production";
@@ -8220,7 +8285,7 @@ async function startAppBackground(params) {
     `[runa] Mode: ${modeLabel}`,
     `[runa] Command: ${commandStr}`,
     `[runa] Working directory: ${params.repoRoot}`,
-    `[runa] App directory: ${path11__default.relative(params.repoRoot, params.appDir) || "."}`,
+    `[runa] App directory: ${path12__default.relative(params.repoRoot, params.appDir) || "."}`,
     useRootScript ? "[runa] Using root package.json script" : "[runa] Using app package.json script",
     "---",
     ""
@@ -8241,12 +8306,12 @@ async function startAppBackground(params) {
     streamToTerminal: params.stream
   });
   const pid = child.pid ?? -1;
-  await writeFile(path11__default.join(params.tmpDir, "app.pid"), `${pid}
+  await writeFile(path12__default.join(params.tmpDir, "app.pid"), `${pid}
 `, "utf-8");
   return { pid, cleanupStreams };
 }
 async function waitForAppReady(params) {
-  const logFilePath = params.tmpDir ? path11__default.join(params.tmpDir, "app.log") : void 0;
+  const logFilePath = params.tmpDir ? path12__default.join(params.tmpDir, "app.log") : void 0;
   await waitHttpOk({
     url: `http://127.0.0.1:${params.port}/`,
     timeoutSeconds: params.timeoutSeconds,
@@ -8421,7 +8486,7 @@ function checkPortAvailable(port) {
   });
 }
 var processCheckActor = fromPromise(async ({ input: input3 }) => {
-  const pidFile = path11__default.join(input3.repoRoot, input3.tmpDir, "app.pid");
+  const pidFile = path12__default.join(input3.repoRoot, input3.tmpDir, "app.pid");
   let pidFileContent = null;
   try {
     pidFileContent = readFileSync(pidFile, "utf-8").trim();
@@ -8429,7 +8494,7 @@ var processCheckActor = fromPromise(async ({ input: input3 }) => {
   }
   if (pidFileContent) {
     const pid = parseInt(pidFileContent, 10);
-    if (!isNaN(pid) && isProcessAlive(pid)) {
+    if (!Number.isNaN(pid) && isProcessAlive(pid)) {
       if (input3.replace) {
         await terminateAppProcessByPid({
           pid,
@@ -8453,9 +8518,9 @@ var processCheckActor = fromPromise(async ({ input: input3 }) => {
 var appStartActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, appDir, port, tmpDir, stream, bundler } = input3;
-    const fullTmpDir = path11__default.join(repoRoot, tmpDir);
+    const fullTmpDir = path12__default.join(repoRoot, tmpDir);
     await mkdir(fullTmpDir, { recursive: true });
-    const nextDir = path11__default.join(appDir, ".next");
+    const nextDir = path12__default.join(appDir, ".next");
     if (existsSync(nextDir)) {
       rmSync(nextDir, { recursive: true, force: true });
       console.log("[runa dev] Cleaned .next cache for fresh start");
@@ -8763,11 +8828,11 @@ function printSummary2(logger16, output3) {
 }
 function findRepoRoot2(startDir) {
   let current = startDir;
-  while (current !== path11__default.dirname(current)) {
-    if (existsSync(path11__default.join(current, "turbo.json"))) {
+  while (current !== path12__default.dirname(current)) {
+    if (existsSync(path12__default.join(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = path11__default.join(current, "package.json");
+    const pkgPath = path12__default.join(current, "package.json");
     if (existsSync(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
@@ -8777,7 +8842,7 @@ function findRepoRoot2(startDir) {
       } catch {
       }
     }
-    current = path11__default.dirname(current);
+    current = path12__default.dirname(current);
   }
   return startDir;
 }
@@ -8792,6 +8857,22 @@ async function runDevMachine(input3, logger16) {
       const currentState = getStateName2(snapshot2);
       if (currentState !== previousState) {
         handleStateChange2(snapshot2, previousState, logger16, input3.port);
+        if (previousState.startsWith("setup") && (currentState === "appStart" || currentState === "running") && snapshot2.context.supabaseStarted) {
+          try {
+            const bridgeResult = writeEnvLocalBridge(
+              snapshot2.context.repoRoot,
+              detectLocalSupabasePorts(snapshot2.context.repoRoot)
+            );
+            if (bridgeResult.written) {
+              logger16.info(
+                `  \u2192 .env.local written (port override: api=${bridgeResult.ports.api}, db=${bridgeResult.ports.db})`
+              );
+            } else if (bridgeResult.reason === "user-managed") {
+              logger16.warn("  \u2192 .env.local exists but is user-managed; port override skipped");
+            }
+          } catch {
+          }
+        }
         previousState = currentState;
       }
       if (isComplete2(snapshot2)) {
@@ -8983,19 +9064,19 @@ function isSupportedNodeEnv(value) {
 function findProjectRoot(from) {
   const workspaceRoot = findWorkspaceRoot(from);
   if (workspaceRoot) return workspaceRoot;
-  let current = path11__default.resolve(from);
-  const root = path11__default.parse(current).root;
+  let current = path12__default.resolve(from);
+  const root = path12__default.parse(current).root;
   let depth = 0;
   while (current !== root && depth < MAX_DIRECTORY_TRAVERSAL_DEPTH) {
-    const hasGit = existsSync(path11__default.join(current, ".git"));
-    const hasPackageJson2 = existsSync(path11__default.join(current, "package.json"));
+    const hasGit = existsSync(path12__default.join(current, ".git"));
+    const hasPackageJson2 = existsSync(path12__default.join(current, "package.json"));
     if (hasGit || hasPackageJson2) return current;
-    const parent = path11__default.dirname(current);
+    const parent = path12__default.dirname(current);
     if (parent === current) break;
     current = parent;
     depth++;
   }
-  return path11__default.resolve(from);
+  return path12__default.resolve(from);
 }
 function mapRunaEnvToVercelEnv(runaEnv) {
   if (runaEnv === "preview") return "preview";
@@ -9036,7 +9117,7 @@ function loadEnvFiles(options = {}) {
   const nodeEnv = resolveNodeEnv(options.nodeEnv);
   const projectRoot = findProjectRoot(cwd);
   const vercelEnv = options.vercelEnv ?? inferVercelEnv({ nodeEnv, runaEnv: options.runaEnv });
-  const keysFile = path11__default.join(projectRoot, ".env.keys");
+  const keysFile = path12__default.join(projectRoot, ".env.keys");
   const baseFilePaths = buildBaseEnvFilePaths({ nodeEnv, vercelEnv });
   const runaFilePaths = options.runaEnv ? buildRunaEnvFilePaths(options.runaEnv) : [];
   const allRelPaths = [...baseFilePaths, ...runaFilePaths];
@@ -9046,7 +9127,7 @@ function loadEnvFiles(options = {}) {
     const filePaths = [
       keysFile,
       // Load keys first
-      ...allRelPaths.map((rel) => path11__default.join(projectRoot, rel)).filter(existsSync)
+      ...allRelPaths.map((rel) => path12__default.join(projectRoot, rel)).filter(existsSync)
     ];
     config({
       path: filePaths,
@@ -9055,7 +9136,7 @@ function loadEnvFiles(options = {}) {
       quiet: true
       // Suppress dotenvx verbose output
     });
-    loadedFiles = allRelPaths.filter((rel) => existsSync(path11__default.join(projectRoot, rel)));
+    loadedFiles = allRelPaths.filter((rel) => existsSync(path12__default.join(projectRoot, rel)));
   } else {
     const targetEnv = { ...process.env };
     loadedFiles = [
@@ -9130,8 +9211,8 @@ function buildRunaEnvFilePaths(runaEnv) {
 function loadEnvFilesIntoTarget(params) {
   const loadedFiles = [];
   for (const relPath of params.relPaths) {
-    const fullPath = path11__default.join(params.projectRoot, relPath);
-    const resolvedPath = path11__default.resolve(fullPath);
+    const fullPath = path12__default.join(params.projectRoot, relPath);
+    const resolvedPath = path12__default.resolve(fullPath);
     if (!isPathContained(params.projectRoot, resolvedPath)) {
       continue;
     }
@@ -9399,7 +9480,7 @@ async function runTool(params) {
         exitCode,
         issueCount,
         durationMs,
-        outputPath: path11__default.relative(process.cwd(), params.outputPath)
+        outputPath: path12__default.relative(process.cwd(), params.outputPath)
       });
     });
     proc.on("error", async () => {
@@ -9418,7 +9499,7 @@ async function runTool(params) {
         exitCode: -1,
         issueCount: 0,
         durationMs,
-        outputPath: path11__default.relative(process.cwd(), params.outputPath)
+        outputPath: path12__default.relative(process.cwd(), params.outputPath)
       });
     });
   });
@@ -9450,7 +9531,7 @@ async function executeWorkflowCheck(params) {
     label: params.label,
     command: params.command,
     args: params.args,
-    outputPath: path11__default.join(params.logDir, `${params.name}-output.txt`),
+    outputPath: path12__default.join(params.logDir, `${params.name}-output.txt`),
     parseIssueCount: params.parseIssueCount
   });
   logCheckResult(result, params.isWarningOnly ?? false);
@@ -9522,7 +9603,7 @@ async function runCiChecks(options) {
   const mode = options.mode === "github-actions" ? "github-actions" : "local";
   const isCI3 = mode === "github-actions";
   const workflowsChanged = options.workflowsChanged;
-  const logDir = path11__default.join(process.cwd(), ".runa", "tmp", "workflow");
+  const logDir = path12__default.join(process.cwd(), ".runa", "tmp", "workflow");
   await mkdir(logDir, { recursive: true });
   console.log("");
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
@@ -9531,7 +9612,7 @@ async function runCiChecks(options) {
   console.log("");
   const results = await executeChecks(workflowsChanged, logDir);
   const summary = buildChecksSummary(startedAt, workflowsChanged, results);
-  const summaryPath = path11__default.join(logDir, "checks-summary.json");
+  const summaryPath = path12__default.join(logDir, "checks-summary.json");
   await writeFile(summaryPath, JSON.stringify(summary, null, 2), "utf-8");
   if (isCI3) {
     await appendGithubStepSummary(buildStepSummaryMarkdown(summary));
@@ -9598,7 +9679,7 @@ function printFinalOutput(summary, summaryPath) {
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
   console.log(`${summary.status === "failure" ? "\u274C" : "\u2705"} Workflow Checks: ${summary.status}`);
   console.log(`   Duration: ${formatDuration$1(summary.durationMs)}`);
-  console.log(`   Summary: ${path11__default.relative(process.cwd(), summaryPath)}`);
+  console.log(`   Summary: ${path12__default.relative(process.cwd(), summaryPath)}`);
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
 }
 var ciChecksCommand = new Command("checks").description("Run workflow checks (actionlint, zizmor)").option("--mode <mode>", "Execution mode (github-actions | local)", "local").option("--workflows-changed", "Indicate workflows have changed", false).action(runCiChecks);
@@ -9611,10 +9692,10 @@ init_esm_shims();
 var CiConfigSchema = z.record(z.string(), z.unknown());
 async function loadCiConfig(params) {
   const override = typeof params.overridePath === "string" && params.overridePath.trim().length > 0 ? params.overridePath.trim() : null;
-  const defaultPath = path11__default.join(params.repoRoot, ".runa", "ci.config.json");
+  const defaultPath = path12__default.join(params.repoRoot, ".runa", "ci.config.json");
   const resolvedPath = override ?? (existsSync(defaultPath) ? defaultPath : null);
   if (!resolvedPath) return { configPath: null, config: null };
-  const abs = path11__default.isAbsolute(resolvedPath) ? resolvedPath : path11__default.join(params.repoRoot, resolvedPath);
+  const abs = path12__default.isAbsolute(resolvedPath) ? resolvedPath : path12__default.join(params.repoRoot, resolvedPath);
   if (!existsSync(abs)) return { configPath: abs, config: null };
   const raw = await readFile(abs, "utf-8");
   const parsed = JSON.parse(raw);
@@ -9716,9 +9797,9 @@ var CiSummarySchema = z.object({
 async function writeCiSummary(params) {
   const cwd = params.cwd ?? process.cwd();
   const parsed = CiSummarySchema.parse(params.summary);
-  const dir = path11__default.join(cwd, ".runa", "tmp");
+  const dir = path12__default.join(cwd, ".runa", "tmp");
   await mkdir(dir, { recursive: true });
-  const filePath = path11__default.join(dir, "ci-summary.json");
+  const filePath = path12__default.join(dir, "ci-summary.json");
   await writeFile(filePath, `${JSON.stringify(parsed, null, 2)}
 `, "utf-8");
   return filePath;
@@ -10051,12 +10132,12 @@ async function detectStack(repoRoot, tmpDir, productionDbUrlAdmin) {
     label: "detect-stack",
     command: "pnpm",
     args: ["exec", "runa", "db", "detect-stack", "--quiet"],
-    logFile: path11__default.join(tmpDir, "detect-stack.log")
+    logFile: path12__default.join(tmpDir, "detect-stack.log")
   });
   return String(res.stdout ?? "").trim();
 }
 function checkIfInitialDeployment(repoRoot, productionDbUrl) {
-  const schemasDir = path11__default.join(repoRoot, "supabase", "schemas", "declarative");
+  const schemasDir = path12__default.join(repoRoot, "supabase", "schemas", "declarative");
   let schemas;
   try {
     schemas = detectAppSchemas(schemasDir, false);
@@ -10122,9 +10203,9 @@ function checkIfInitialDeployment(repoRoot, productionDbUrl) {
   }
 }
 async function showSchemaDiff(repoRoot, tmpDir) {
-  const diffLog = path11__default.join(tmpDir, "schema-diff.log");
+  const diffLog = path12__default.join(tmpDir, "schema-diff.log");
   const safeEnv = getSafeEnv();
-  const declarativeSqlPath = path11__default.join(repoRoot, "supabase/schemas/declarative");
+  const declarativeSqlPath = path12__default.join(repoRoot, "supabase/schemas/declarative");
   if (existsSync(declarativeSqlPath)) {
     await runLogged({
       cwd: repoRoot,
@@ -10138,8 +10219,8 @@ async function showSchemaDiff(repoRoot, tmpDir) {
   }
   const detected = detectDatabasePackage(repoRoot);
   if (detected) {
-    const schemaPath = path11__default.join(detected, "src", "schema");
-    if (existsSync(path11__default.join(repoRoot, schemaPath))) {
+    const schemaPath = path12__default.join(detected, "src", "schema");
+    if (existsSync(path12__default.join(repoRoot, schemaPath))) {
       await runLogged({
         cwd: repoRoot,
         env: safeEnv,
@@ -10152,8 +10233,8 @@ async function showSchemaDiff(repoRoot, tmpDir) {
     }
   }
   for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
-    const candidatePath = path11__default.join("packages", candidate, "src", "schema");
-    if (existsSync(path11__default.join(repoRoot, candidatePath))) {
+    const candidatePath = path12__default.join("packages", candidate, "src", "schema");
+    if (existsSync(path12__default.join(repoRoot, candidatePath))) {
       await runLogged({
         cwd: repoRoot,
         env: safeEnv,
@@ -10165,7 +10246,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
       return;
     }
   }
-  if (existsSync(path11__default.join(repoRoot, "src", "schema"))) {
+  if (existsSync(path12__default.join(repoRoot, "src", "schema"))) {
     await runLogged({
       cwd: repoRoot,
       env: safeEnv,
@@ -10177,7 +10258,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
   }
 }
 async function detectRisks(repoRoot, tmpDir) {
-  const logFile = path11__default.join(tmpDir, "db-risks.log");
+  const logFile = path12__default.join(tmpDir, "db-risks.log");
   try {
     const env2 = getFilteredEnv();
     await runLogged({
@@ -10191,8 +10272,8 @@ async function detectRisks(repoRoot, tmpDir) {
   } catch (error) {
     let logContent = "";
     try {
-      const { readFileSync: readFileSync30 } = await import('fs');
-      logContent = readFileSync30(logFile, "utf-8");
+      const { readFileSync: readFileSync31 } = await import('fs');
+      logContent = readFileSync31(logFile, "utf-8");
     } catch {
     }
     const isInitialDeployment = logContent.includes("No common ancestor") || logContent.includes("INITIAL DEPLOYMENT");
@@ -10223,7 +10304,7 @@ async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit) {
     label: "snapshot create production",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "create", "production", "--commit", commit],
-    logFile: path11__default.join(tmpDir, "snapshot-create.log")
+    logFile: path12__default.join(tmpDir, "snapshot-create.log")
   });
 }
 async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
@@ -10236,7 +10317,7 @@ async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
     label: "snapshot restore production (latest)",
     command: "pnpm",
     args: ["exec", "runa", "db", "snapshot", "restore", "production", "--latest", "--auto-approve"],
-    logFile: path11__default.join(tmpDir, "snapshot-restore.log")
+    logFile: path12__default.join(tmpDir, "snapshot-restore.log")
   });
 }
 function parseApplyLog(logContent) {
@@ -10300,7 +10381,7 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   if (options?.maxLockWaitMs !== void 0) {
     args.push("--max-lock-wait-ms", String(options.maxLockWaitMs));
   }
-  const logPath = path11__default.join(tmpDir, "db-apply-production.log");
+  const logPath = path12__default.join(tmpDir, "db-apply-production.log");
   const startTime = Date.now();
   await runLogged({
     cwd: repoRoot,
@@ -10320,8 +10401,8 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   const totalMs = Date.now() - startTime;
   let logContent = "";
   try {
-    const { readFileSync: readFileSync30 } = await import('fs');
-    logContent = readFileSync30(logPath, "utf-8");
+    const { readFileSync: readFileSync31 } = await import('fs');
+    logContent = readFileSync31(logPath, "utf-8");
   } catch {
   }
   const parsed = parseApplyLog(logContent);
@@ -10345,11 +10426,11 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
     label: "git log (commit message)",
     command: "git",
     args: ["log", "-1", "--pretty=format:%s"],
-    logFile: path11__default.join(tmpDir, "git-commit-message.log")
+    logFile: path12__default.join(tmpDir, "git-commit-message.log")
   });
   const commitMsg = String(msg.stdout ?? "").trim();
   const schemaPaths = [];
-  const declarativeSqlPath = path11__default.join(repoRoot, "supabase/schemas/declarative");
+  const declarativeSqlPath = path12__default.join(repoRoot, "supabase/schemas/declarative");
   if (existsSync(declarativeSqlPath)) {
     schemaPaths.push("supabase/schemas/declarative/");
   } else {
@@ -10369,7 +10450,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
     label: "git diff (schema)",
     command: "git",
     args: ["diff", "origin/main", "HEAD", "--", ...schemaPaths],
-    logFile: path11__default.join(tmpDir, "git-schema-diff.log")
+    logFile: path12__default.join(tmpDir, "git-schema-diff.log")
   });
   const diffRaw = String(diff.stdout ?? "");
   const diffLimited = diffRaw.length > 1e4 ? diffRaw.slice(0, 1e4) : diffRaw;
@@ -10398,7 +10479,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
       "--environment",
       "production"
     ],
-    logFile: path11__default.join(tmpDir, "db-audit-record.log")
+    logFile: path12__default.join(tmpDir, "db-audit-record.log")
   });
 }
 async function notifyDeployment(repoRoot, tmpDir, params) {
@@ -10426,7 +10507,7 @@ async function notifyDeployment(repoRoot, tmpDir, params) {
       "--type",
       "production-schema"
     ],
-    logFile: path11__default.join(tmpDir, "notify-deployment.log")
+    logFile: path12__default.join(tmpDir, "notify-deployment.log")
   });
 }
 
@@ -10788,7 +10869,7 @@ $$;
     label: `repair timestamps (${params.labelPrefix})`,
     command: "psql",
     args: [...psql.args, "-v", "ON_ERROR_STOP=1", "-c", sql],
-    logFile: path11__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
+    logFile: path12__default.join(params.tmpDir, `timestamp-repair-${params.labelPrefix}.log`)
   });
 }
 
@@ -11220,7 +11301,7 @@ async function runCiProdApply(params) {
     overridePath: params.options.config
   });
   if (cfg.configPath)
-    params.summary.detected.configPath = path11__default.relative(params.repoRoot, cfg.configPath);
+    params.summary.detected.configPath = path12__default.relative(params.repoRoot, cfg.configPath);
   if (cfg.config) params.summary.detected.config = cfg.config;
   requireCiAutoApprove({ mode: params.summary.mode, autoApprove: params.options.autoApprove });
   const inputs = resolveProdApplyInputs();
@@ -11313,7 +11394,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     await appendGithubStepSummary(
       buildCiProdApplyStepSummaryMarkdown({
         summary,
-        summaryPath: path11__default.relative(repoRoot, summaryPath)
+        summaryPath: path12__default.relative(repoRoot, summaryPath)
       })
     );
     if (summary.mode === "github-actions") {
@@ -11329,7 +11410,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     const summaryPath = await writeCiSummary({ summary });
     logSection("Result");
     console.log(`status: ${summary.status}`);
-    console.log(`summary: ${path11__default.relative(repoRoot, summaryPath)}`);
+    console.log(`summary: ${path12__default.relative(repoRoot, summaryPath)}`);
     logNextActions([
       "Inspect .runa/tmp logs (db-apply-production.log, snapshot-*.log)",
       "If rollback succeeded, database should be restored to pre-deploy snapshot"
@@ -11337,7 +11418,7 @@ var ciProdApplyCommand = new Command("prod-apply").description("Apply production
     await appendGithubStepSummary(
       buildCiProdApplyStepSummaryMarkdown({
         summary,
-        summaryPath: path11__default.relative(repoRoot, summaryPath)
+        summaryPath: path12__default.relative(repoRoot, summaryPath)
       })
     );
     await maybePostFailureComment({
@@ -11408,7 +11489,7 @@ function getChecks() {
 }
 async function runCheck(check, logDir) {
   const startTime = Date.now();
-  const logPath = path11__default.join(logDir, `${check.name}.log`);
+  const logPath = path12__default.join(logDir, `${check.name}.log`);
   return new Promise((resolve12) => {
     const proc = spawn(check.command, check.args, {
       cwd: process.cwd(),
@@ -11438,7 +11519,7 @@ async function runCheck(check, logDir) {
         status: exitCode === 0 ? "passed" : "failed",
         exitCode,
         durationMs,
-        logPath: path11__default.relative(process.cwd(), logPath)
+        logPath: path12__default.relative(process.cwd(), logPath)
       });
     });
     proc.on("error", async () => {
@@ -11453,7 +11534,7 @@ async function runCheck(check, logDir) {
         status: "failed",
         exitCode: 1,
         durationMs,
-        logPath: path11__default.relative(process.cwd(), logPath)
+        logPath: path12__default.relative(process.cwd(), logPath)
       });
     });
   });
@@ -11581,19 +11662,19 @@ function printFinalStaticOutput(summary, summaryPath) {
   console.log(`${summary.status === "success" ? "\u2705" : "\u274C"} Static Analysis: ${summary.status}`);
   console.log(`   Duration: ${formatDuration$1(summary.durationMs)}`);
   console.log(`   Passed: ${summary.passedCount}/${summary.checks.length}`);
-  console.log(`   Summary: ${path11__default.relative(process.cwd(), summaryPath)}`);
+  console.log(`   Summary: ${path12__default.relative(process.cwd(), summaryPath)}`);
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
 }
 async function runCiStatic(options) {
   const startedAt = /* @__PURE__ */ new Date();
   const isCI3 = options.mode === "github-actions";
-  const logDir = path11__default.join(process.cwd(), ".runa", "tmp", "workflow");
+  const logDir = path12__default.join(process.cwd(), ".runa", "tmp", "workflow");
   await mkdir(logDir, { recursive: true });
   const checksToRun = getChecksToRun(options);
   printStaticHeader(options);
   const results = options.parallel ? await runChecksParallel(checksToRun, logDir) : await runChecksSequential(checksToRun, logDir);
   const summary = buildStaticSummary(startedAt, results);
-  const summaryPath = path11__default.join(logDir, "static-summary.json");
+  const summaryPath = path12__default.join(logDir, "static-summary.json");
   await writeFile(summaryPath, JSON.stringify(summary, null, 2), "utf-8");
   if (isCI3) {
     await appendGithubStepSummary(buildStepSummaryMarkdown2(summary));
@@ -11623,9 +11704,9 @@ var appBuildActor = fromPromise(
   async ({ input: input3 }) => {
     const { repoRoot, tmpDir, env: env2 = process.env } = input3;
     try {
-      const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
-      const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
-      const hasAppsWeb = existsSync(path11__default.join(repoRoot, "apps", "web"));
+      const hasTurbo = existsSync(path12__default.join(repoRoot, "turbo.json"));
+      const hasApps = existsSync(path12__default.join(repoRoot, "apps"));
+      const hasAppsWeb = existsSync(path12__default.join(repoRoot, "apps", "web"));
       const args = hasTurbo ? hasApps && !hasAppsWeb ? ["turbo", "run", "build", "--filter=./apps/*"] : ["turbo", "run", "build"] : ["build"];
       await runLogged({
         cwd: repoRoot,
@@ -11633,7 +11714,7 @@ var appBuildActor = fromPromise(
         label: "build",
         command: "pnpm",
         args,
-        logFile: path11__default.join(tmpDir, "build.log")
+        logFile: path12__default.join(tmpDir, "build.log")
       });
       return { passed: true };
     } catch (error) {
@@ -11649,14 +11730,14 @@ var appBuildActor = fromPromise(
 init_esm_shims();
 var APP_CANDIDATES = ["web", "dashboard", "app", "frontend", "client"];
 function findExistingAppDirs(repoRoot) {
-  const appsDir = path11__default.join(repoRoot, "apps");
+  const appsDir = path12__default.join(repoRoot, "apps");
   if (!existsSync(appsDir)) return [];
   try {
     const entries = readdirSync(appsDir, { withFileTypes: true });
     const found = [];
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const pkgJson = path11__default.join(appsDir, entry.name, "package.json");
+      const pkgJson = path12__default.join(appsDir, entry.name, "package.json");
       if (existsSync(pkgJson)) {
         found.push(`apps/${entry.name}`);
       }
@@ -11676,9 +11757,9 @@ function findExistingAppDirs(repoRoot) {
   }
 }
 function validateAppDir(repoRoot, appDir) {
-  const pkgJsonPath = path11__default.join(appDir, "package.json");
+  const pkgJsonPath = path12__default.join(appDir, "package.json");
   if (!existsSync(appDir)) {
-    const relPath = path11__default.relative(repoRoot, appDir) || ".";
+    const relPath = path12__default.relative(repoRoot, appDir) || ".";
     const suggestions = findExistingAppDirs(repoRoot);
     const errorParts = [`App directory not found: ${relPath}`];
     if (suggestions.length > 0) {
@@ -11700,7 +11781,7 @@ function validateAppDir(repoRoot, appDir) {
     return errorParts.join("\n");
   }
   if (!existsSync(pkgJsonPath)) {
-    const relPath = path11__default.relative(repoRoot, appDir) || ".";
+    const relPath = path12__default.relative(repoRoot, appDir) || ".";
     return `No package.json found in app directory: ${relPath}`;
   }
   return null;
@@ -11757,9 +11838,9 @@ init_esm_shims();
 async function runAppBuild(params) {
   const { repoRoot, tmpDir, env: env2 } = params;
   try {
-    const hasTurbo = existsSync(path11__default.join(repoRoot, "turbo.json"));
-    const hasApps = existsSync(path11__default.join(repoRoot, "apps"));
-    const hasAppsWeb = existsSync(path11__default.join(repoRoot, "apps", "web"));
+    const hasTurbo = existsSync(path12__default.join(repoRoot, "turbo.json"));
+    const hasApps = existsSync(path12__default.join(repoRoot, "apps"));
+    const hasAppsWeb = existsSync(path12__default.join(repoRoot, "apps", "web"));
     const args = hasTurbo ? hasApps && !hasAppsWeb ? ["turbo", "run", "build", "--filter=./apps/*"] : ["turbo", "run", "build"] : ["build"];
     await runLogged({
       cwd: repoRoot,
@@ -11767,7 +11848,7 @@ async function runAppBuild(params) {
       label: "build",
       command: "pnpm",
       args,
-      logFile: path11__default.join(tmpDir, "build.log")
+      logFile: path12__default.join(tmpDir, "build.log")
     });
     return { passed: true };
   } catch (error) {
@@ -11786,7 +11867,7 @@ async function runManifestGenerate(params) {
       label: "manifest:generate",
       command: "pnpm",
       args: ["manifest:generate"],
-      logFile: path11__default.join(tmpDir, "manifest-generate.log")
+      logFile: path12__default.join(tmpDir, "manifest-generate.log")
     });
     return { generated: true };
   } catch (error) {
@@ -11806,7 +11887,7 @@ async function runPlaywrightInstall(params) {
       label: "playwright install",
       command: "pnpm",
       args,
-      logFile: path11__default.join(tmpDir, "playwright-install.log")
+      logFile: path12__default.join(tmpDir, "playwright-install.log")
     });
     return { installed: true };
   } catch (error) {
@@ -11879,7 +11960,7 @@ var playwrightInstallActor = fromPromise(
         label: "playwright install",
         command: "pnpm",
         args,
-        logFile: path11__default.join(tmpDir, "playwright-install.log")
+        logFile: path12__default.join(tmpDir, "playwright-install.log")
       });
       return { installed: true };
     } catch (error) {
@@ -11903,7 +11984,7 @@ var staticChecksActor2 = fromPromise(
         label: "type-check",
         command: "pnpm",
         args: ["type-check"],
-        logFile: path11__default.join(tmpDir, "type-check.log")
+        logFile: path12__default.join(tmpDir, "type-check.log")
       }),
       runLogged({
         cwd: repoRoot,
@@ -11911,7 +11992,7 @@ var staticChecksActor2 = fromPromise(
         label: "lint",
         command: "pnpm",
         args: ["lint"],
-        logFile: path11__default.join(tmpDir, "lint.log")
+        logFile: path12__default.join(tmpDir, "lint.log")
       })
     ]);
     const typeCheckPassed = typeCheckResult.status === "fulfilled";
@@ -12062,7 +12143,7 @@ var applySeedsActor = fromPromise(
         label: `db seed (${envArg})`,
         command: "pnpm",
         args: ["exec", "runa", "db", "seed", envArg, "--auto-approve"],
-        logFile: path11__default.join(tmpDir, `ci-db-seed-${envArg}.log`)
+        logFile: path12__default.join(tmpDir, `ci-db-seed-${envArg}.log`)
       });
       return { applied: true };
     } catch (error) {
@@ -12440,7 +12521,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `probe pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
-    logFile: path11__default.join(params.tmpDir, `pgtap-probe-${params.label}.log`)
+    logFile: path12__default.join(params.tmpDir, `pgtap-probe-${params.label}.log`)
   }).catch(() => null);
   const raw = String(probe?.stdout ?? "").trim();
   const [availableRaw, installedRaw] = raw.split(",");
@@ -12455,11 +12536,11 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `ensure pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-c", installSql],
-    logFile: path11__default.join(params.tmpDir, `pgtap-ensure-${params.label}.log`)
+    logFile: path12__default.join(params.tmpDir, `pgtap-ensure-${params.label}.log`)
   }).catch(async (error) => {
     try {
       await writeFile(
-        path11__default.join(params.tmpDir, `pgtap-ensure-${params.label}.failed`),
+        path12__default.join(params.tmpDir, `pgtap-ensure-${params.label}.failed`),
         `${error instanceof Error ? error.message : String(error)}
 `,
         "utf-8"
@@ -12473,7 +12554,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
     label: `probe pgtap (best-effort, ${params.label}, after)`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
-    logFile: path11__default.join(params.tmpDir, `pgtap-probe-${params.label}-after.log`)
+    logFile: path12__default.join(params.tmpDir, `pgtap-probe-${params.label}-after.log`)
   }).catch(() => null);
   const afterRaw = String(probeAfter?.stdout ?? "").trim();
   const [availableAfterRaw, installedAfterRaw] = afterRaw.split(",");
@@ -12594,14 +12675,14 @@ function extractSqlFromSchemaChanges(fullOutput) {
   return null;
 }
 function getIdempotentRoleNames(repoRoot) {
-  const idempotentDir = path11__default.join(repoRoot, "supabase", "schemas", "idempotent");
+  const idempotentDir = path12__default.join(repoRoot, "supabase", "schemas", "idempotent");
   const roles = [];
   try {
     const fs14 = __require("fs");
     if (!fs14.existsSync(idempotentDir)) return [];
     const files = fs14.readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const content = fs14.readFileSync(path11__default.join(idempotentDir, file), "utf-8");
+      const content = fs14.readFileSync(path12__default.join(idempotentDir, file), "utf-8");
       const roleMatches = content.matchAll(/CREATE\s+ROLE\s+(\w+)\s+WITH/gi);
       for (const match of roleMatches) {
         if (match[1]) roles.push(match[1].toLowerCase());
@@ -12742,7 +12823,7 @@ var productionPreviewActor = fromPromise(
       );
       return buildSkipResult(!!productionUrl);
     }
-    const logFile = path11__default.join(tmpDir, "ci-production-preview.log");
+    const logFile = path12__default.join(tmpDir, "ci-production-preview.log");
     console.log("\u25B6 production preview (dry-run): runa db apply production --check");
     try {
       const result = await execa(
@@ -12832,7 +12913,7 @@ var resetDbActor = fromPromise(
         label: "db reset (local)",
         command: "npx",
         args: ["supabase", "db", "reset", "--local"],
-        logFile: path11__default.join(tmpDir, "ci-db-reset.log")
+        logFile: path12__default.join(tmpDir, "ci-db-reset.log")
       });
       return { reset: true };
     } catch (error) {
@@ -12848,8 +12929,8 @@ var resetDbActor = fromPromise(
 init_esm_shims();
 async function hasSetupRolesScript(repoRoot) {
   const candidates = [
-    path11__default.join(repoRoot, "packages", "database", "package.json"),
-    path11__default.join(repoRoot, "package.json")
+    path12__default.join(repoRoot, "packages", "database", "package.json"),
+    path12__default.join(repoRoot, "package.json")
   ];
   for (const pkgPath of candidates) {
     if (!existsSync(pkgPath)) continue;
@@ -12887,7 +12968,7 @@ var setupRolesActor = fromPromise(
         label: "db roles setup",
         command: "pnpm",
         args: ["db:setup-roles"],
-        logFile: path11__default.join(tmpDir, "ci-db-roles-setup.log")
+        logFile: path12__default.join(tmpDir, "ci-db-roles-setup.log")
       });
       const stdout = String(result.stdout ?? "");
       const appUrlMatch = stdout.match(/APP_DATABASE_URL=["']?([^"'\n]+)["']?/);
@@ -13014,14 +13095,14 @@ function extractRolesFromSql(content) {
   return roles;
 }
 function getIdempotentRoleNames2(repoRoot) {
-  const idempotentDir = path11__default.join(repoRoot, "supabase", "schemas", "idempotent");
+  const idempotentDir = path12__default.join(repoRoot, "supabase", "schemas", "idempotent");
   const roles = [];
   try {
     const fs14 = __require("fs");
     if (!fs14.existsSync(idempotentDir)) return [];
     const files = fs14.readdirSync(idempotentDir).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const filePath = path11__default.join(idempotentDir, file);
+      const filePath = path12__default.join(idempotentDir, file);
       if (!isPathContained(idempotentDir, filePath)) {
         continue;
       }
@@ -13099,7 +13180,7 @@ var syncSchemaActor = fromPromise(
         "--auto-approve",
         // Allow DELETES_DATA hazards in preview
         "--no-seed",
-        // Seeds applied separately by applySeedsActor (avoid duplicate application)
+        // Seeds applied separately by applySeedsActor
         "--verbose"
         // Always verbose for full traceability
       ] : [
@@ -13109,11 +13190,13 @@ var syncSchemaActor = fromPromise(
         "sync",
         envArg,
         "--auto-approve",
+        "--no-seed",
+        // Seeds applied separately by applySeedsActor
         "--verbose",
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
       ];
-      const logFile = path11__default.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
+      const logFile = path12__default.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
       await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -13245,7 +13328,67 @@ init_esm_shims();
 // src/commands/ci/commands/ci-supabase-local.ts
 init_esm_shims();
 init_constants();
+function isPortAvailable(port) {
+  return new Promise((resolve12) => {
+    const server = net.createServer();
+    server.once("error", () => resolve12(false));
+    server.once("listening", () => {
+      server.close(() => resolve12(true));
+    });
+    server.listen(port);
+  });
+}
+function detectSupabaseContainers() {
+  try {
+    const result = spawnSync(
+      "docker",
+      ["ps", "--format", "{{.Names}}	{{.Ports}}	{{.Status}}", "--filter", "name=supabase"],
+      { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (result.status !== 0 || !result.stdout?.trim()) return [];
+    return result.stdout.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function checkSupabasePortConflicts(repoRoot) {
+  let dbPort = 54322;
+  try {
+    const { readFileSync: readFileSync31 } = await import('fs');
+    const configPath = path12__default.join(repoRoot, "supabase", "config.toml");
+    const content = readFileSync31(configPath, "utf-8");
+    const match = /\[db\][^[]*?port\s*=\s*(\d+)/s.exec(content);
+    if (match?.[1]) dbPort = Number.parseInt(match[1], 10);
+  } catch {
+  }
+  const available = await isPortAvailable(dbPort);
+  if (available) return;
+  const containers = detectSupabaseContainers();
+  const dbContainers = containers.filter((c) => c.includes(String(dbPort)) || c.includes("db-"));
+  console.warn("");
+  console.warn("\u26A0\uFE0F  Port conflict detected: PostgreSQL port %d is already in use", dbPort);
+  console.warn("");
+  if (dbContainers.length > 0) {
+    console.warn("   Running Supabase containers:");
+    for (const c of dbContainers) {
+      console.warn(`     ${c}`);
+    }
+  } else if (containers.length > 0) {
+    console.warn("   Running Supabase containers (no DB match):");
+    for (const c of containers.slice(0, 5)) {
+      console.warn(`     ${c}`);
+    }
+  } else {
+    console.warn("   No Supabase containers detected (port may be used by another process).");
+  }
+  console.warn("");
+  console.warn("   To fix:");
+  console.warn("     1. Stop the other instance: supabase stop (in the other project)");
+  console.warn("     2. Or use a different port in supabase/config.toml: [db] port = 54323");
+  console.warn("");
+}
 async function startSupabaseLocal(params) {
+  await checkSupabasePortConflicts(params.repoRoot);
   const exclude = process.env.RUNA_CI_SUPABASE_EXCLUDE ?? "studio,edge-runtime,storage-api,realtime,imgproxy,mailpit,logflare,vector,supavisor";
   await runLogged({
     cwd: params.repoRoot,
@@ -13253,7 +13396,7 @@ async function startSupabaseLocal(params) {
     label: "supabase start (local)",
     command: "supabase",
     args: ["start", "--exclude", exclude],
-    logFile: path11__default.join(params.tmpDir, "supabase-start-local.log")
+    logFile: path12__default.join(params.tmpDir, "supabase-start-local.log")
   });
 }
 function getDefaultLocalSupabaseUrl(repoRoot) {
@@ -13281,7 +13424,7 @@ async function resolveLocalSupabaseEnv(params) {
         label: "supabase status (json)",
         command: "supabase",
         args: ["status", "--output", "json"],
-        logFile: path11__default.join(params.tmpDir, `supabase-status-${i + 1}.log`)
+        logFile: path12__default.join(params.tmpDir, `supabase-status-${i + 1}.log`)
       });
       const parsed = JSON.parse(String(res.stdout ?? "{}"));
       const out = z.object({
@@ -13401,7 +13544,7 @@ async function findFilesRecursive(params) {
       continue;
     }
     for (const e of entries) {
-      const p = path11__default.join(dir, e.name);
+      const p = path12__default.join(dir, e.name);
       if (e.isDirectory()) stack.push(p);
       else if (e.isFile() && params.suffixes.some((s) => p.endsWith(s))) out.push(p);
     }
@@ -13415,7 +13558,7 @@ async function queryScalar(params) {
     label: `psql scalar (${params.logName})`,
     command: "psql",
     args: [params.databaseUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", params.sql],
-    logFile: path11__default.join(params.tmpDir, `psql-${params.logName}.log`)
+    logFile: path12__default.join(params.tmpDir, `psql-${params.logName}.log`)
   });
   return String(res.stdout ?? "").trim();
 }
@@ -13465,7 +13608,7 @@ AND table_schema NOT IN ('information_schema');
 SELECT COUNT(*)::int
 FROM pg_class c
 JOIN pg_namespace n ON n.oid=c.relnamespace
-WHERE c.relkind='r'
+WHERE c.relkind IN ('r','p')
 AND n.nspname NOT LIKE 'pg_%'
 AND n.nspname NOT IN ('information_schema')
 AND c.relrowsecurity;
@@ -13543,8 +13686,8 @@ function isPlaywrightIgnored(filePath) {
 async function detectGeneratedE2eCapabilities(params) {
   const caps = /* @__PURE__ */ new Set();
   const diagnostics = {};
-  const layer4Dir = path11__default.join(params.repoRoot, ".runa", "tests", "layer4");
-  const tmpDir = path11__default.join(params.repoRoot, ".runa", "tmp");
+  const layer4Dir = path12__default.join(params.repoRoot, ".runa", "tests", "layer4");
+  const tmpDir = path12__default.join(params.repoRoot, ".runa", "tmp");
   const hasLayer4Dir = await pathExists(layer4Dir);
   const hasTmpDir = await pathExists(tmpDir);
   if (!hasLayer4Dir && !hasTmpDir) {
@@ -14054,7 +14197,7 @@ init_esm_shims();
 // src/commands/ci/utils/test-parallel.ts
 init_esm_shims();
 async function readLayerResult(tmpDir, layer) {
-  const resultFile = path11__default.join(tmpDir, `vitest-layer${layer}-result.json`);
+  const resultFile = path12__default.join(tmpDir, `vitest-layer${layer}-result.json`);
   try {
     const content = await readFile(resultFile, "utf-8");
     return JSON.parse(content);
@@ -14172,8 +14315,8 @@ async function waitUntilAllFinished(params) {
 async function runLayersInParallel(params) {
   const spawned = [];
   for (const layer of params.layers) {
-    const logFile = path11__default.join(params.tmpDir, `layer${layer}.log`);
-    const exitFile = path11__default.join(params.tmpDir, `layer${layer}.exit`);
+    const logFile = path12__default.join(params.tmpDir, `layer${layer}.log`);
+    const exitFile = path12__default.join(params.tmpDir, `layer${layer}.exit`);
     const proc = runLogged({
       cwd: params.repoRoot,
       env: {
@@ -14216,7 +14359,7 @@ async function runLayersInParallel(params) {
   for (const p of spawned) {
     const codeRaw = p.exitCode ?? await p.procPromise;
     const code = Number.isNaN(codeRaw) ? 1 : codeRaw;
-    const resultFile = path11__default.join(params.tmpDir, `vitest-layer${p.layer}-result.json`);
+    const resultFile = path12__default.join(params.tmpDir, `vitest-layer${p.layer}-result.json`);
     const wasKilled = killedLayerSet.has(p.layer);
     const actualResult = waitResult.successMap.get(p.layer) ?? {
       success: code === 0,
@@ -14231,9 +14374,9 @@ async function runLayersInParallel(params) {
       skippedReason: actualResult.skippedReason,
       killed: wasKilled,
       killedBy: wasKilled ? failFastSource : void 0,
-      logPath: path11__default.relative(params.repoRoot, p.logFile),
-      exitPath: path11__default.relative(params.repoRoot, p.exitFile),
-      resultPath: path11__default.relative(params.repoRoot, resultFile),
+      logPath: path12__default.relative(params.repoRoot, p.logFile),
+      exitPath: path12__default.relative(params.repoRoot, p.exitFile),
+      resultPath: path12__default.relative(params.repoRoot, resultFile),
       // Test count information
       totalTests: actualResult.totalTests,
       passedTests: actualResult.passedTests,
@@ -17576,11 +17719,11 @@ function resolveDatabaseUrl(environment) {
     }
     case "main":
     case "production": {
-      const url = process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL || env.DATABASE_URL || process.env.DATABASE_URL;
+      const url = process.env.GH_DATABASE_URL_ADMIN || process.env.DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL || env.DATABASE_URL || process.env.DATABASE_URL;
       if (!url) {
         throw new CLIError("Production database URL not found", "PRODUCTION_DB_URL_NOT_FOUND", [
-          "Set GH_DATABASE_URL_ADMIN environment variable (for DDL/migrations)",
-          "Or set GH_DATABASE_URL / DATABASE_URL as fallback"
+          "Set DATABASE_URL_ADMIN environment variable (for DDL/migrations)",
+          "Or set GH_DATABASE_URL_ADMIN (CI) / DATABASE_URL as fallback"
         ]);
       }
       return url;
@@ -17720,16 +17863,16 @@ var ERROR_MESSAGES2 = {
   SCHEMA_NOT_FOUND: "Schema file not found"
 };
 function containsPathTraversal2(inputPath) {
-  const normalized = path11__default.normalize(inputPath);
+  const normalized = path12__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
 function isPathWithinBase(filePath, baseDir) {
   try {
-    const resolvedFile = path11__default.resolve(filePath);
-    const resolvedBase = path11__default.resolve(baseDir);
-    const normalizedFile = path11__default.normalize(resolvedFile);
-    const normalizedBase = path11__default.normalize(resolvedBase);
-    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path11__default.sep);
+    const resolvedFile = path12__default.resolve(filePath);
+    const resolvedBase = path12__default.resolve(baseDir);
+    const normalizedFile = path12__default.normalize(resolvedFile);
+    const normalizedBase = path12__default.normalize(resolvedBase);
+    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path12__default.sep);
   } catch {
     return false;
   }
@@ -17738,13 +17881,13 @@ function validateSchemaPath(dbPackagePath, projectRoot = process.cwd()) {
   if (containsPathTraversal2(dbPackagePath)) {
     throw new Error(ERROR_MESSAGES2.PATH_TRAVERSAL);
   }
-  const schemaEntry = path11__default.join(dbPackagePath, "src", "schema", "index.ts");
-  const absoluteSchemaPath = path11__default.resolve(projectRoot, schemaEntry);
+  const schemaEntry = path12__default.join(dbPackagePath, "src", "schema", "index.ts");
+  const absoluteSchemaPath = path12__default.resolve(projectRoot, schemaEntry);
   let resolvedProjectRoot;
   try {
     resolvedProjectRoot = realpathSync(projectRoot);
   } catch {
-    resolvedProjectRoot = path11__default.resolve(projectRoot);
+    resolvedProjectRoot = path12__default.resolve(projectRoot);
   }
   if (!isPathWithinBase(absoluteSchemaPath, resolvedProjectRoot)) {
     throw new Error(ERROR_MESSAGES2.PATH_TRAVERSAL);
@@ -17876,7 +18019,7 @@ function diffSchema(params) {
   };
 }
 function extractTablesFromIdempotentSql(idempotentDir, projectRoot = process.cwd()) {
-  const fullPath = path11__default.resolve(projectRoot, idempotentDir);
+  const fullPath = path12__default.resolve(projectRoot, idempotentDir);
   if (!existsSync(fullPath)) {
     return [];
   }
@@ -17885,7 +18028,7 @@ function extractTablesFromIdempotentSql(idempotentDir, projectRoot = process.cwd
   try {
     const files = readdirSync(fullPath).filter((f) => f.endsWith(".sql"));
     for (const file of files) {
-      const filePath = path11__default.join(fullPath, file);
+      const filePath = path12__default.join(fullPath, file);
       const content = readFileSync(filePath, "utf-8");
       const contentWithoutComments = content.replace(/--.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
       for (const match of contentWithoutComments.matchAll(createTablePattern)) {
@@ -19404,6 +19547,93 @@ function releaseAdvisoryLock(dbUrl, verbose) {
   }
 }
 
+// src/commands/db/apply/helpers/plan-validator.ts
+init_esm_shims();
+var PlanHazardSchema = z.object({
+  type: z.string().min(1),
+  message: z.string()
+});
+var PlanStatementSchema = z.object({
+  index: z.number().int().nonnegative(),
+  sql: z.string().min(1),
+  hazards: z.array(PlanHazardSchema)
+});
+var ValidatedPlanSchema = z.object({
+  statements: z.array(PlanStatementSchema),
+  totalStatements: z.number().int().nonnegative(),
+  rawSql: z.string().min(1)
+});
+function flushStatement(current, results) {
+  if (!current) return;
+  const sql = current.sqlLines.join("\n").trim();
+  if (!sql) return;
+  results.push({ index: current.index, sql, hazards: current.hazards });
+}
+function parseWithStatementMarkers(lines) {
+  const results = [];
+  let current = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const idxMatch = trimmed.match(/^-- Statement Idx\.\s*(\d+)/);
+    if (idxMatch) {
+      flushStatement(current, results);
+      current = { index: parseInt(idxMatch[1], 10), sqlLines: [], hazards: [] };
+      continue;
+    }
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch && current) {
+      current.hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (current && trimmed && !trimmed.startsWith("--")) {
+      current.sqlLines.push(line);
+    }
+  }
+  flushStatement(current, results);
+  return results;
+}
+function parseAsSingleStatement(lines) {
+  const sqlLines = [];
+  const hazards = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const hazardMatch = trimmed.match(/^-- Hazard (\w+): (.+)/);
+    if (hazardMatch) {
+      hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
+      continue;
+    }
+    if (trimmed && !trimmed.startsWith("--")) {
+      sqlLines.push(line);
+    }
+  }
+  const sql = sqlLines.join("\n").trim();
+  if (!sql) return [];
+  return [{ index: 0, sql, hazards }];
+}
+function parsePlanOutput(planOutput) {
+  const lines = planOutput.split("\n");
+  const hasStatementMarkers = lines.some((l) => /^-- Statement Idx\.\s*\d+/.test(l.trim()));
+  const statements = hasStatementMarkers ? parseWithStatementMarkers(lines) : parseAsSingleStatement(lines);
+  const plan = {
+    statements,
+    totalStatements: statements.length,
+    rawSql: planOutput
+  };
+  return ValidatedPlanSchema.parse(plan);
+}
+function validatePlanForExecution(plan, allowedHazardTypes) {
+  if (plan.totalStatements === 0) return;
+  const allHazards = plan.statements.flatMap((s) => s.hazards);
+  const allowedSet = new Set(allowedHazardTypes);
+  const unresolved = allHazards.filter((h) => !allowedSet.has(h.type));
+  if (unresolved.length > 0) {
+    const types = [...new Set(unresolved.map((h) => h.type))].join(", ");
+    throw new Error(
+      `Plan contains unapproved hazards: ${types}. Approved: [${allowedHazardTypes.join(", ")}]. This is a safety check \u2014 hazards must be approved before execution.`
+    );
+  }
+}
+
 // src/commands/db/apply/helpers/pg-schema-diff-helpers.ts
 init_esm_shims();
 var logger4 = createCLILogger("db:apply");
@@ -19749,49 +19979,70 @@ function calculateBackoffDelay(attempt, maxDelayMs = DEFAULT_MAX_DELAY_MS) {
 function isLockTimeoutError(errorOutput) {
   return errorOutput.includes("lock_timeout") || errorOutput.includes("canceling statement due to lock timeout") || errorOutput.includes("could not obtain lock");
 }
-async function executeApplyWithRetry(applyArgs, verbose, config) {
+async function executePlanSqlWithRetry(dbUrl, initialPlanSql, verbose, config) {
   const maxRetries = config?.maxRetries ?? MAX_RETRIES;
   const maxDelayMs = config?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
   let lastError = null;
   let totalWaitMs = 0;
+  let currentPlanSql = initialPlanSql;
   for (let attempt = 0; attempt < maxRetries; attempt++) {
     if (attempt > 0) {
       const delay = calculateBackoffDelay(attempt - 1, maxDelayMs);
       totalWaitMs += delay;
       logger5.info(`Retry ${attempt}/${maxRetries - 1} after ${Math.round(delay)}ms...`);
       await sleep(delay);
+      if (config?.rePlanFn) {
+        const freshPlan = config.rePlanFn();
+        if (freshPlan === null) {
+          return { success: true, attempts: attempt, totalWaitMs };
+        }
+        currentPlanSql = freshPlan;
+      }
     }
-    const applyResult = spawnSync("pg-schema-diff", applyArgs, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = applyResult.stdout || "";
-    const stderr = applyResult.stderr || "";
-    if (verbose) {
-      if (stdout) process.stdout.write(stdout);
-      if (stderr) process.stderr.write(stderr);
-    }
-    if (applyResult.status === 0) {
+    const plan = parsePlanOutput(currentPlanSql);
+    if (plan.totalStatements === 0) {
       return { success: true, attempts: attempt, totalWaitMs };
     }
-    const errorOutput = stderr || stdout || "Unknown error";
-    if (isLockTimeoutError(errorOutput)) {
-      logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
-      lastError = new Error(`lock_timeout: ${errorOutput}`);
-      continue;
+    if (config?.allowedHazardTypes) {
+      validatePlanForExecution(plan, config.allowedHazardTypes);
     }
-    logger5.error("pg-schema-diff apply failed:");
-    logger5.error(errorOutput);
-    const extDetection = detectMissingExtensionType(errorOutput);
-    if (extDetection.detected) {
-      logger5.error(formatExtensionErrorHint(extDetection));
+    if (verbose) {
+      logger5.debug(`Plan validated: ${plan.totalStatements} statement(s)`);
+    }
+    const planFile = join(tmpdir(), `runa-plan-${Date.now()}-${attempt}.sql`);
+    const wrappedSql = `SET lock_timeout = '50ms';
+
+${currentPlanSql}`;
+    writeFileSync(planFile, wrappedSql, "utf-8");
+    try {
+      const result = psqlSyncFile({ databaseUrl: dbUrl, filePath: planFile, onErrorStop: true });
+      if (verbose) {
+        if (result.stdout) process.stdout.write(result.stdout);
+        if (result.stderr) process.stderr.write(result.stderr);
+      }
+      if (result.status === 0) {
+        return { success: true, attempts: attempt, totalWaitMs };
+      }
+      const errorOutput = result.stderr || result.stdout || "Unknown error";
+      if (isLockTimeoutError(errorOutput)) {
+        logger5.warn(`Lock timeout on attempt ${attempt + 1}/${maxRetries}`);
+        lastError = new Error(`lock_timeout: ${errorOutput}`);
+        continue;
+      }
+      logger5.error("Plan execution failed:");
+      logger5.error(errorOutput);
+      return {
+        success: false,
+        error: new Error(`Plan execution failed: ${errorOutput}`),
+        attempts: attempt,
+        totalWaitMs
+      };
+    } finally {
+      try {
+        unlinkSync(planFile);
+      } catch {
+      }
     }
-    return {
-      success: false,
-      error: new Error(`pg-schema-diff apply failed: ${errorOutput}`),
-      attempts: attempt,
-      totalWaitMs
-    };
   }
   logger5.error(`Migration failed after ${maxRetries} attempts (total wait: ${totalWaitMs}ms)`);
   return {
@@ -20087,48 +20338,58 @@ function handleFreshDbCase(input3, dbUrl, targetDir) {
     return { sql: "", hazards: [], applied: true };
   }
 }
-async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards) {
-  logger6.step("Applying schema changes...");
+async function applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards, tempDbDsn) {
+  logger6.step("Applying schema changes (plan+psql)...");
   const lockAcquired = acquireAdvisoryLock(dbUrl, input3.verbose);
   if (!lockAcquired) {
     throw new Error(
       "Could not acquire migration lock. Another migration may be running. Wait for it to complete or manually release the lock."
     );
   }
-  const applyArgs = [
-    "apply",
-    "--from-dsn",
-    dbUrl,
-    "--to-dir",
-    schemasDir,
-    "--disable-plan-validation",
-    "--skip-confirm-prompt",
-    "-l",
-    'pattern=".*" timeout=50ms',
-    ...includeSchemas.flatMap((s) => ["--include-schema", s])
-  ];
-  const allowedHazards = buildAllowedHazards(input3);
-  if (allowedHazards.length > 0) {
-    applyArgs.push("--allow-hazards", allowedHazards.join(","));
-  }
-  const result = await executeApplyWithRetry(applyArgs, input3.verbose, {
-    maxDelayMs: input3.maxLockWaitMs
-  });
-  releaseAdvisoryLock(dbUrl, input3.verbose);
-  if (!result.success) {
-    throw result.error || new Error("Migration failed");
-  }
-  if (input3.verbose && result.attempts > 0) {
-    logger6.debug(`Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`);
+  try {
+    const allowedHazardTypes = buildAllowedHazards(input3);
+    const result = await executePlanSqlWithRetry(dbUrl, planOutput, input3.verbose, {
+      maxDelayMs: input3.maxLockWaitMs,
+      allowedHazardTypes,
+      rePlanFn: () => {
+        const { planOutput: freshPlan } = executePgSchemaDiffPlan(
+          dbUrl,
+          schemasDir,
+          includeSchemas,
+          input3.verbose,
+          { tempDbDsn }
+        );
+        if (!freshPlan.trim() || freshPlan.includes("No changes")) {
+          return null;
+        }
+        return freshPlan;
+      }
+    });
+    if (!result.success) {
+      throw result.error || new Error("Migration failed");
+    }
+    if (input3.verbose && result.attempts > 0) {
+      logger6.debug(
+        `Retry metrics: ${result.attempts} attempts, ${result.totalWaitMs}ms total wait`
+      );
+    }
+    logger6.success("Schema changes applied");
+    return {
+      sql: planOutput,
+      hazards,
+      applied: true,
+      retryAttempts: result.attempts,
+      retryWaitMs: result.totalWaitMs
+    };
+  } finally {
+    try {
+      releaseAdvisoryLock(dbUrl, input3.verbose);
+    } catch (lockError) {
+      logger6.warn(
+        `Failed to release advisory lock: ${lockError instanceof Error ? lockError.message : "Unknown error"}`
+      );
+    }
   }
-  logger6.success("Schema changes applied");
-  return {
-    sql: planOutput,
-    hazards,
-    applied: true,
-    retryAttempts: result.attempts,
-    retryWaitMs: result.totalWaitMs
-  };
 }
 var ROLE_PASSWORD_CONFIGS = [
   {
@@ -20239,45 +20500,66 @@ function shouldSkipInProduction(file, env2, verbose) {
   }
   return true;
 }
-function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose) {
+function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose, pass) {
   const filePath = join(schemasDir, file);
   if (verbose) logger6.debug(`Applying ${file}...`);
   const result = psqlSyncFile({
     databaseUrl: dbUrl,
     filePath,
     onErrorStop: true
-    // Fail fast on idempotent schemas
   });
   if (verbose) {
     if (result.stdout) process.stdout.write(result.stdout);
     if (result.stderr) process.stderr.write(result.stderr);
   }
   if (result.status !== 0) {
+    if (pass === "pre") {
+      if (verbose) {
+        logger6.warn(`Skipped ${file} (will retry in 2nd pass)`);
+      }
+      return false;
+    }
     const errorMsg = result.stderr ? maskDbCredentials(result.stderr) : "";
     throw new Error(`Failed to apply idempotent schema: ${file}
 ${errorMsg}`);
   }
+  return true;
 }
-var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir } }) => {
+var applyIdempotentSchemas = fromPromise(async ({ input: { input: input3, targetDir, pass } }) => {
   checkPasswordSecurity();
   const schemasDir = join(targetDir, "supabase/schemas/idempotent");
   const dbUrl = getDbUrl(input3);
   let filesApplied = 0;
+  let filesSkipped = 0;
   if (existsSync(schemasDir)) {
     const files = readdirSync(schemasDir).filter((f) => f.endsWith(".sql")).sort();
     if (files.length > 0) {
       for (const file of files) {
         if (shouldSkipInProduction(file, input3.env, input3.verbose)) continue;
-        applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose);
+        const applied = applySingleIdempotentFile(dbUrl, schemasDir, file, input3.verbose, pass);
+        if (applied) {
+          filesApplied++;
+        } else {
+          filesSkipped++;
+        }
+      }
+      if (filesSkipped > 0) {
+        logger6.success(
+          `Applied ${filesApplied}/${filesApplied + filesSkipped} idempotent schema(s) (${filesSkipped} deferred to 2nd pass)`
+        );
+        if (filesSkipped === files.length) {
+          logger6.warn("ALL idempotent files skipped in 1st pass.");
+          logger6.warn("This may indicate a syntax error. Check logs with --verbose.");
+        }
+      } else {
+        logger6.success(`Applied ${filesApplied} idempotent schema(s)`);
       }
-      logger6.success(`Applied ${files.length} idempotent schema(s)`);
-      filesApplied = files.length;
     }
   } else {
     logger6.info("No idempotent schemas found");
   }
   const rolePasswordsSet = setRolePasswords(dbUrl, input3.verbose);
-  return { filesApplied, rolePasswordsSet };
+  return { filesApplied, filesSkipped, rolePasswordsSet };
 });
 var applyPgSchemaDiff = fromPromise(async ({ input: { input: input3, targetDir } }) => {
   const schemasDir = join(targetDir, "supabase/schemas/declarative");
@@ -20346,7 +20628,15 @@ ${content}`;
       displayCheckModeResults(planOutput);
       return { sql: planOutput, hazards, applied: false };
     }
-    return applyWithLockAndRetry(dbUrl, schemasDir, includeSchemas, input3, planOutput, hazards);
+    return applyWithLockAndRetry(
+      dbUrl,
+      schemasDir,
+      includeSchemas,
+      input3,
+      planOutput,
+      hazards,
+      shadowDb?.dsn
+    );
   } finally {
     if (shadowDb) {
       try {
@@ -20458,6 +20748,11 @@ var DbApplyMetricsSchema = z.object({
 z.object({
   success: z.boolean(),
   idempotentSchemasApplied: z.number(),
+  /**
+   * Number of idempotent schemas deferred during 1st pass (graceful skip).
+   * These are retried in 2nd pass after declarative tables exist.
+   */
+  idempotentSchemasSkipped: z.number().optional(),
   /**
    * Number of RBAC role passwords set (drizzle_app, drizzle_service).
    * Set when DRIZZLE_APP_PASSWORD or DRIZZLE_SERVICE_PASSWORD env vars are present.
@@ -20578,7 +20873,9 @@ var dbApplyMachine = setup({
     targetDir: input3.targetDir,
     // 2-pass idempotent
     idempotentPreApplied: 0,
+    idempotentPreSkipped: 0,
     idempotentPostApplied: 0,
+    idempotentPostSkipped: 0,
     rolePasswordsSet: 0,
     schemaChangesApplied: false,
     hazards: [],
@@ -20609,11 +20906,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPreStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "pre"
+        }),
         onDone: {
           target: "applyingPgSchemaDiff",
           actions: assign({
             idempotentPreApplied: ({ event }) => event.output.filesApplied,
+            idempotentPreSkipped: ({ event }) => event.output.filesSkipped,
             rolePasswordsSet: ({ event }) => event.output.rolePasswordsSet,
             idempotentPreEndTime: () => Date.now()
           })
@@ -20672,11 +20974,16 @@ var dbApplyMachine = setup({
       entry: assign({ idempotentPostStartTime: () => Date.now() }),
       invoke: {
         src: "applyIdempotentSchemas",
-        input: ({ context }) => ({ input: context.input, targetDir: context.targetDir }),
+        input: ({ context }) => ({
+          input: context.input,
+          targetDir: context.targetDir,
+          pass: "post"
+        }),
         onDone: {
           target: "applyingSeeds",
           actions: assign({
             idempotentPostApplied: ({ event }) => event.output.filesApplied,
+            idempotentPostSkipped: ({ event }) => event.output.filesSkipped,
             idempotentPostEndTime: () => Date.now()
           })
         },
@@ -20734,9 +21041,11 @@ var dbApplyMachine = setup({
       retryAttempts: context.retryAttempts > 0 ? context.retryAttempts : void 0
     };
     const totalIdempotentApplied = context.idempotentPreApplied + context.idempotentPostApplied;
+    const totalIdempotentSkipped = context.idempotentPreSkipped + context.idempotentPostSkipped;
     return {
       success: !context.error,
       idempotentSchemasApplied: totalIdempotentApplied,
+      idempotentSchemasSkipped: totalIdempotentSkipped > 0 ? totalIdempotentSkipped : void 0,
       rolePasswordsSet: context.rolePasswordsSet > 0 ? context.rolePasswordsSet : void 0,
       schemaChangesApplied: context.schemaChangesApplied,
       hazards: context.hazards,
@@ -21421,7 +21730,7 @@ async function validateGitHubOutputPath(filePath) {
   if (!filePath || filePath.trim().length === 0) {
     return { valid: false, resolvedPath: null, error: "Empty file path" };
   }
-  const normalizedPath = path11__default.normalize(filePath);
+  const normalizedPath = path12__default.normalize(filePath);
   if (normalizedPath.includes("..")) {
     return {
       valid: false,
@@ -21429,7 +21738,7 @@ async function validateGitHubOutputPath(filePath) {
       error: "Path traversal detected (..) in file path"
     };
   }
-  const absolutePath = path11__default.resolve(normalizedPath);
+  const absolutePath = path12__default.resolve(normalizedPath);
   for (const forbidden of FORBIDDEN_PATHS) {
     if (absolutePath.startsWith(forbidden) || absolutePath.includes(forbidden)) {
       return {
@@ -21850,7 +22159,7 @@ async function analyzeSchemaChanges() {
   try {
     const { getDatabasePackagePath: getDatabasePackagePath2 } = await Promise.resolve().then(() => (init_config_loader(), config_loader_exports));
     const dbPath = await getDatabasePackagePath2();
-    const schemaPath = path11__default.join(dbPath, "src/schema/");
+    const schemaPath = path12__default.join(dbPath, "src/schema/");
     const { stdout } = await execa("git", ["diff", "--cached", "--", schemaPath]);
     const lines = stdout.split("\n");
     return parseDiffLines(lines);
@@ -22189,7 +22498,7 @@ function runDatabasePackageChecks(result, logger16, step) {
     logger16.error("Database package path is missing");
     return null;
   }
-  logger16.success(`Found database package: ${path11__default.basename(dbPackagePath)}`);
+  logger16.success(`Found database package: ${path12__default.basename(dbPackagePath)}`);
   logger16.step("Checking schema files", step.next());
   const schemaCheck = checkSchemaFiles(dbPackagePath);
   if (!schemaCheck.exists) {
@@ -22337,12 +22646,12 @@ async function testDatabaseConnection(projectRoot) {
 function checkDatabasePackage() {
   const cwd = process.cwd();
   const locations = [
-    path11__default.join(cwd, "packages", "database"),
-    path11__default.join(cwd, "packages", "db"),
-    path11__default.join(cwd, "db")
+    path12__default.join(cwd, "packages", "database"),
+    path12__default.join(cwd, "packages", "db"),
+    path12__default.join(cwd, "db")
   ];
   for (const location of locations) {
-    const configPath = path11__default.join(location, "drizzle.config.ts");
+    const configPath = path12__default.join(location, "drizzle.config.ts");
     if (existsSync(configPath)) {
       return { exists: true, path: location };
     }
@@ -22387,7 +22696,7 @@ function countTsFilesRecursive(dir) {
   try {
     const entries = readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path11__default.join(dir, entry.name);
+      const fullPath = path12__default.join(dir, entry.name);
       if (entry.isDirectory()) {
         count += countTsFilesRecursive(fullPath);
       } else if (entry.isFile() && entry.name.endsWith(".ts")) {
@@ -22399,7 +22708,7 @@ function countTsFilesRecursive(dir) {
   return count;
 }
 function checkSchemaFiles(dbPackagePath) {
-  const schemaDir = path11__default.join(dbPackagePath, "src", "schema");
+  const schemaDir = path12__default.join(dbPackagePath, "src", "schema");
   if (!existsSync(schemaDir)) {
     return { exists: false, count: 0 };
   }
@@ -22438,7 +22747,7 @@ async function runOrphanCheck(env2, dbPackagePath, result, logger16, step) {
     const { expectedTables, expectedEnums } = await extractSchemaTablesAndEnums(dbPackagePath);
     const databaseUrl = tryResolveDatabaseUrl("local") || buildLocalDatabaseUrl(process.cwd());
     const { dbTables, dbEnums } = await fetchDbTablesAndEnums(databaseUrl, {
-      schemaDir: path11__default.join(dbPackagePath, "src", "schema")
+      schemaDir: path12__default.join(dbPackagePath, "src", "schema")
     });
     let excludeFromOrphanDetection = [];
     let idempotentSqlDir = "supabase/schemas/idempotent";
@@ -22512,7 +22821,7 @@ function runExtensionConfigCheck(_result, logger16, step) {
 async function runSqlSchemaRiskCheck(result, logger16, step) {
   logger16.step("Checking SQL schema for risky patterns", step.next());
   const cwd = process.cwd();
-  const sqlDir = path11__default.join(cwd, "supabase", "schemas", "declarative");
+  const sqlDir = path12__default.join(cwd, "supabase", "schemas", "declarative");
   if (!existsSync(sqlDir)) {
     logger16.success("No SQL schema directory found (supabase/schemas/declarative/)");
     return;
@@ -22525,7 +22834,7 @@ async function runSqlSchemaRiskCheck(result, logger16, step) {
     }
     const allRisks = [];
     for (const sqlFile of sqlFiles) {
-      const filePath = path11__default.join(sqlDir, sqlFile);
+      const filePath = path12__default.join(sqlDir, sqlFile);
       const risks = await detectSchemaRisks(filePath);
       for (const risk of risks) {
         allRisks.push({ ...risk, file: sqlFile });
@@ -24305,7 +24614,7 @@ async function checkPort(port) {
   };
 }
 function detectSupabasePortsFromConfig() {
-  const configPath = path11__default.join(process.cwd(), "supabase", "config.toml");
+  const configPath = path12__default.join(process.cwd(), "supabase", "config.toml");
   const BASE_PORTS2 = { api: 54321, db: 54322, studio: 54323, inbucket: 54324 };
   if (!existsSync(configPath)) {
     return Object.values(BASE_PORTS2);
@@ -24388,6 +24697,9 @@ function diagnoseInitFailure(errorMessage) {
   return results;
 }
 
+// src/commands/db/commands/db-lifecycle.ts
+init_local_supabase();
+
 // src/utils/port-allocator.ts
 init_esm_shims();
 function getSupabasePorts(projectPath) {
@@ -24395,7 +24707,7 @@ function getSupabasePorts(projectPath) {
   return getPortsWithOffset(offset);
 }
 async function updateSupabaseConfigPortsSafe(projectPath) {
-  const configPath = path11__default.join(projectPath, "supabase", "config.toml");
+  const configPath = path12__default.join(projectPath, "supabase", "config.toml");
   const resolved = await resolveAvailablePorts(projectPath);
   if (!resolved) {
     const ports = getSupabasePorts(projectPath);
@@ -24438,7 +24750,7 @@ function getPortAllocationSummary(projectPath) {
   const ports = getSupabasePorts(projectPath);
   const offset = calculatePortOffset(projectPath);
   return [
-    `Port allocation for: ${path11__default.basename(projectPath)}`,
+    `Port allocation for: ${path12__default.basename(projectPath)}`,
     `  Slot: ${offset / 10} (hash-based, offset=${offset})`,
     `  API:     ${ports.api}`,
     `  DB:      ${ports.db}`,
@@ -24472,7 +24784,7 @@ function parseSeedPaths(configPath) {
   }
 }
 async function applySeedFile(seedPath, dbUrl) {
-  const supabaseDir = path11__default.join(process.cwd(), "supabase");
+  const supabaseDir = path12__default.join(process.cwd(), "supabase");
   const absolutePath = resolveSafePath(supabaseDir, seedPath);
   if (!existsSync(absolutePath)) {
     return;
@@ -24483,12 +24795,12 @@ async function applySeedFile(seedPath, dbUrl) {
   });
 }
 async function applySeeds2(configPath) {
-  const configFile = path11__default.join(process.cwd(), "supabase", "config.toml");
+  const configFile = path12__default.join(process.cwd(), "supabase", "config.toml");
   const seedPaths = parseSeedPaths(configFile);
   if (seedPaths.length === 0) {
     return;
   }
-  const supabaseDir = path11__default.join(process.cwd(), "supabase");
+  const supabaseDir = path12__default.join(process.cwd(), "supabase");
   const safePaths = filterSafePaths(seedPaths, supabaseDir);
   if (safePaths.length === 0) {
     return;
@@ -24615,6 +24927,20 @@ var startCommand = new Command("start").description("Start local Supabase with a
       if (options.bootstrap) {
         logger16.info("  \u2192 Bare schemas created. Run `runa db sync` to apply full schema.");
       }
+      try {
+        const bridgeResult = writeEnvLocalBridge(
+          projectRoot,
+          detectLocalSupabasePorts(projectRoot)
+        );
+        if (bridgeResult.written) {
+          logger16.info(
+            `  \u2192 .env.local written (port override: api=${bridgeResult.ports.api}, db=${bridgeResult.ports.db})`
+          );
+        } else if (bridgeResult.reason === "user-managed") {
+          logger16.warn("  \u2192 .env.local exists but is user-managed; port override skipped");
+        }
+      } catch {
+      }
       emitJsonSuccess(startCommand, DbLifecycleStartOutputSchema, result);
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);
@@ -24635,6 +24961,15 @@ var stopCommand = new Command("stop").description("Stop local Supabase").action(
     logger16.info("Stopping local Supabase...");
     const result = await dbStop({});
     logger16.success("Supabase stopped successfully");
+    try {
+      const bridgeResult = removeEnvLocalBridge(process.cwd());
+      if (bridgeResult.removed) {
+        logger16.info("  \u2192 .env.local removed (runa-managed port override)");
+      } else if (bridgeResult.reason === "user-managed") {
+        logger16.warn("  \u2192 .env.local exists but is user-managed; skipping cleanup");
+      }
+    } catch {
+    }
     emitJsonSuccess(stopCommand, DbLifecycleStopOutputSchema, result);
   } catch (error) {
     throw new CLIError(
@@ -24730,6 +25065,20 @@ var resetCommand = new Command("reset").description("Reset local database with s
     if (!options.skipSeeds) {
       logger16.info("  \u2713 Seeds applied");
     }
+    try {
+      const bridgeResult = writeEnvLocalBridge(
+        projectRoot,
+        detectLocalSupabasePorts(projectRoot)
+      );
+      if (bridgeResult.written) {
+        logger16.info(
+          `  \u2192 .env.local written (port override: api=${bridgeResult.ports.api}, db=${bridgeResult.ports.db})`
+        );
+      } else if (bridgeResult.reason === "user-managed") {
+        logger16.warn("  \u2192 .env.local exists but is user-managed; port override skipped");
+      }
+    } catch {
+    }
     emitJsonSuccess(resetCommand, DbLifecycleResetOutputSchema, {
       ...resetResult,
       stepsCompleted: allSteps
@@ -24912,7 +25261,7 @@ var validateCommand = new Command("validate").description("Validate schema files
   const logger16 = createCLILogger("db:validate");
   try {
     logger16.section("Schema Validation");
-    const schemasPath = path11__default.join(process.cwd(), "packages", "database", "src", "schema");
+    const schemasPath = path12__default.join(process.cwd(), "packages", "database", "src", "schema");
     if (!existsSync(schemasPath)) {
       throw new CLIError("Schema directory not found", "SCHEMA_DIR_NOT_FOUND", [
         `Expected location: ${schemasPath}`,
@@ -25077,8 +25426,8 @@ var generateCommand = new Command("generate").description("Generate TypeScript t
 var listCommand = new Command("list").description("List managed schemas from drizzle.config.ts").option("--sql", "Output as SQL-compatible string for IN clauses").option("--json", "Output as JSON array").action(async (options) => {
   const logger16 = createCLILogger("db:schema:list");
   try {
-    const dbPackagePath = path11__default.join(process.cwd(), "packages", "database");
-    if (!existsSync(path11__default.join(dbPackagePath, "drizzle.config.ts"))) {
+    const dbPackagePath = path12__default.join(process.cwd(), "packages", "database");
+    if (!existsSync(path12__default.join(dbPackagePath, "drizzle.config.ts"))) {
       throw new CLIError("drizzle.config.ts not found", "CONFIG_NOT_FOUND", [
         `Expected location: ${dbPackagePath}/drizzle.config.ts`,
         "Ensure you are in the project root",
@@ -26323,7 +26672,7 @@ var testGenCommand = new Command("test:gen").description("Generate pgTAP behavio
     const databaseUrl = options.db || process.env.DATABASE_URL || getLocalDbUrl();
     const schemas = options.schemas ? options.schemas.split(",") : void 0;
     const dbPackage = databasePaths.package();
-    const defaultOutputPath = path11__default.join(dbPackage, "tests/00_behavior.generated.test.sql");
+    const defaultOutputPath = path12__default.join(dbPackage, "tests/00_behavior.generated.test.sql");
     const outputPath = options.output || defaultOutputPath;
     spinner.text = "Generating pgTAP behavior tests...";
     const result = await dbGeneratePgTapTests({
@@ -26393,7 +26742,7 @@ function getTablesWithTimestamps(dbUrl, schemas) {
     JOIN pg_attribute a1 ON c.oid = a1.attrelid AND a1.attname = 'updated_at'
     JOIN pg_attribute a2 ON c.oid = a2.attrelid AND a2.attname = 'created_at'
     WHERE n.nspname IN (${schemasFilter})
-      AND c.relkind = 'r'
+      AND c.relkind IN ('r', 'p')
     ORDER BY n.nspname, c.relname;
   `;
   const conn = parsePostgresUrl(dbUrl);
@@ -27366,16 +27715,16 @@ function sanitizeErrorMessage(message) {
   return sanitized;
 }
 function containsPathTraversal3(inputPath) {
-  const normalized = path11__default.normalize(inputPath);
+  const normalized = path12__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
 function isPathWithinBase2(filePath, baseDir) {
   try {
-    const resolvedFile = path11__default.resolve(filePath);
-    const resolvedBase = path11__default.resolve(baseDir);
-    const normalizedFile = path11__default.normalize(resolvedFile);
-    const normalizedBase = path11__default.normalize(resolvedBase);
-    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path11__default.sep);
+    const resolvedFile = path12__default.resolve(filePath);
+    const resolvedBase = path12__default.resolve(baseDir);
+    const normalizedFile = path12__default.normalize(resolvedFile);
+    const normalizedBase = path12__default.normalize(resolvedBase);
+    return normalizedFile === normalizedBase || normalizedFile.startsWith(normalizedBase + path12__default.sep);
   } catch {
     return false;
   }
@@ -27384,12 +27733,12 @@ function validateCustomWorkingDir(cwdPath, projectRoot) {
   if (containsPathTraversal3(cwdPath)) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
   }
-  const absolutePath = path11__default.isAbsolute(cwdPath) ? cwdPath : path11__default.resolve(projectRoot, cwdPath);
+  const absolutePath = path12__default.isAbsolute(cwdPath) ? cwdPath : path12__default.resolve(projectRoot, cwdPath);
   let resolvedProjectRoot;
   try {
     resolvedProjectRoot = realpathSync(projectRoot);
   } catch {
-    resolvedProjectRoot = path11__default.resolve(projectRoot);
+    resolvedProjectRoot = path12__default.resolve(projectRoot);
   }
   if (!isPathWithinBase2(absolutePath, resolvedProjectRoot)) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
@@ -29638,13 +29987,13 @@ z.object({
 
 // src/commands/hotfix/metadata.ts
 function getHotfixDir(targetDir) {
-  return path11__default.join(targetDir, ".runa", "hotfix");
+  return path12__default.join(targetDir, ".runa", "hotfix");
 }
 function getCurrentFile(targetDir) {
-  return path11__default.join(getHotfixDir(targetDir), "current.json");
+  return path12__default.join(getHotfixDir(targetDir), "current.json");
 }
 function getArchiveDir(targetDir) {
-  return path11__default.join(getHotfixDir(targetDir), "archive");
+  return path12__default.join(getHotfixDir(targetDir), "archive");
 }
 async function ensureHotfixDir(targetDir) {
   await mkdir(getHotfixDir(targetDir), { recursive: true });
@@ -29654,7 +30003,7 @@ async function ensureArchiveDir(targetDir) {
 }
 async function getHotfixMetadata(input3 = {}) {
   const parsed = GetHotfixInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path12__default.resolve(parsed.targetDir) : process.cwd();
   const currentFile = getCurrentFile(targetDir);
   if (!existsSync(currentFile)) {
     return null;
@@ -29664,7 +30013,7 @@ async function getHotfixMetadata(input3 = {}) {
 }
 async function createHotfixMetadata(input3) {
   const parsed = CreateHotfixMetadataInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path12__default.resolve(parsed.targetDir) : process.cwd();
   await ensureHotfixDir(targetDir);
   const metadata = {
     branch: parsed.branch,
@@ -29681,7 +30030,7 @@ async function createHotfixMetadata(input3) {
 }
 async function updateHotfixStatus(input3) {
   const parsed = UpdateHotfixInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path12__default.resolve(parsed.targetDir) : process.cwd();
   const current = await getHotfixMetadata({ targetDir });
   if (!current) {
     throw createError("HOTFIX_NOT_FOUND");
@@ -29698,13 +30047,13 @@ async function updateHotfixStatus(input3) {
   return updated;
 }
 async function archiveHotfix(targetDir) {
-  const dir = targetDir ? path11__default.resolve(targetDir) : process.cwd();
+  const dir = targetDir ? path12__default.resolve(targetDir) : process.cwd();
   const current = await getHotfixMetadata({ targetDir: dir });
   if (!current) {
     throw createError("HOTFIX_NOT_FOUND");
   }
   await ensureArchiveDir(dir);
-  const archiveFile = path11__default.join(
+  const archiveFile = path12__default.join(
     getArchiveDir(dir),
     `${current.branch.replace(/\//g, "-")}-${Date.now()}.json`
   );
@@ -29720,7 +30069,7 @@ async function archiveHotfix(targetDir) {
   return archived;
 }
 async function cancelHotfix(targetDir) {
-  const dir = targetDir ? path11__default.resolve(targetDir) : process.cwd();
+  const dir = targetDir ? path12__default.resolve(targetDir) : process.cwd();
   await updateHotfixStatus({
     status: "cancelled",
     completedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -29730,7 +30079,7 @@ async function cancelHotfix(targetDir) {
 }
 async function listArchivedHotfixes(input3 = {}) {
   const parsed = ListArchivedHotfixesInputSchema.parse(input3);
-  const targetDir = parsed.targetDir ? path11__default.resolve(parsed.targetDir) : process.cwd();
+  const targetDir = parsed.targetDir ? path12__default.resolve(parsed.targetDir) : process.cwd();
   const archiveDir = getArchiveDir(targetDir);
   if (!existsSync(archiveDir)) {
     return { hotfixes: [] };
@@ -29739,7 +30088,7 @@ async function listArchivedHotfixes(input3 = {}) {
   const hotfixes = [];
   for (const file of files.filter((f) => f.endsWith(".json"))) {
     try {
-      const filePath = path11__default.join(archiveDir, file);
+      const filePath = path12__default.join(archiveDir, file);
       if (!isPathContained(archiveDir, filePath)) {
         continue;
       }
@@ -31209,7 +31558,7 @@ init_esm_shims();
 
 // src/constants/versions.ts
 init_esm_shims();
-var COMPATIBLE_TEMPLATES_VERSION = "0.5.56";
+var COMPATIBLE_TEMPLATES_VERSION = "0.5.61";
 var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
 var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
 
@@ -31243,13 +31592,13 @@ function validateVersion(version) {
   }
 }
 function getCacheBase() {
-  return path11__default.join(os.homedir(), ".cache", "runa", "templates");
+  return path12__default.join(os.homedir(), ".cache", "runa", "templates");
 }
 function getCacheDir(version) {
   validateVersion(version);
   const cacheBase = getCacheBase();
-  const cacheDir = path11__default.join(cacheBase, version);
-  const resolvedCacheDir = path11__default.resolve(cacheDir);
+  const cacheDir = path12__default.join(cacheBase, version);
+  const resolvedCacheDir = path12__default.resolve(cacheDir);
   if (!isPathContained(cacheBase, resolvedCacheDir)) {
     throw new CLIError(
       "Security: cache directory would escape allowed location.",
@@ -31261,7 +31610,7 @@ function getCacheDir(version) {
 }
 function isCached(version) {
   const cacheDir = getCacheDir(version);
-  const templatesDir = path11__default.join(cacheDir, "templates");
+  const templatesDir = path12__default.join(cacheDir, "templates");
   return fs5__default.existsSync(templatesDir);
 }
 var scopedAuthToken = null;
@@ -31312,13 +31661,13 @@ async function createTempPackageJson(tempDir, version) {
       [TEMPLATES_PACKAGE_NAME]: version
     }
   };
-  await writeFile(path11__default.join(tempDir, "package.json"), JSON.stringify(packageJson, null, 2));
+  await writeFile(path12__default.join(tempDir, "package.json"), JSON.stringify(packageJson, null, 2));
 }
 async function createTempNpmrc(tempDir) {
   const npmrc = `@r06-dev:registry=${GITHUB_PACKAGES_REGISTRY}
 //npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}
 `;
-  await writeFile(path11__default.join(tempDir, ".npmrc"), npmrc);
+  await writeFile(path12__default.join(tempDir, ".npmrc"), npmrc);
 }
 async function installTemplates(tempDir, authToken, verbose) {
   try {
@@ -31376,10 +31725,10 @@ async function installTemplates(tempDir, authToken, verbose) {
 async function verifyNoSymlinks(dir, baseDir) {
   const entries = await readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path11__default.join(dir, entry.name);
+    const fullPath = path12__default.join(dir, entry.name);
     const stats = await lstat(fullPath);
     if (stats.isSymbolicLink()) {
-      const relativePath = path11__default.relative(baseDir, fullPath);
+      const relativePath = path12__default.relative(baseDir, fullPath);
       throw new CLIError(
         "Security: Symlink detected in template package.",
         "SYMLINK_ATTACK_DETECTED",
@@ -31397,7 +31746,7 @@ async function verifyNoSymlinks(dir, baseDir) {
   }
 }
 async function copyToCache(tempDir, cacheDir) {
-  const sourceTemplates = path11__default.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
+  const sourceTemplates = path12__default.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
   if (!fs5__default.existsSync(sourceTemplates)) {
     throw new CLIError("Templates directory not found in package.", "TEMPLATES_DIR_NOT_FOUND", [
       `Expected: ${sourceTemplates}`,
@@ -31407,7 +31756,7 @@ async function copyToCache(tempDir, cacheDir) {
   }
   await verifyNoSymlinks(sourceTemplates, sourceTemplates);
   await mkdir(cacheDir, { recursive: true });
-  const targetTemplates = path11__default.join(cacheDir, "templates");
+  const targetTemplates = path12__default.join(cacheDir, "templates");
   await cp(sourceTemplates, targetTemplates, {
     recursive: true,
     dereference: false
@@ -31429,7 +31778,7 @@ async function fetchTemplates(options = {}) {
     };
   }
   const cacheDir = getCacheDir(version);
-  const templatesDir = path11__default.join(cacheDir, "templates");
+  const templatesDir = path12__default.join(cacheDir, "templates");
   if (!fresh && isCached(version)) {
     if (verbose) {
       console.log(`Using cached templates v${version}: ${templatesDir}`);
@@ -31445,7 +31794,7 @@ async function fetchTemplates(options = {}) {
     if (fresh && fs5__default.existsSync(cacheDir)) {
       await rm(cacheDir, { recursive: true, force: true });
     }
-    const tempDir = path11__default.join(os.tmpdir(), `runa-templates-${Date.now()}`);
+    const tempDir = path12__default.join(os.tmpdir(), `runa-templates-${Date.now()}`);
     await mkdir(tempDir, { recursive: true });
     try {
       if (verbose) {
@@ -31473,11 +31822,11 @@ async function fetchTemplates(options = {}) {
 }
 var MAX_WORKSPACE_TRAVERSAL_DEPTH = 10;
 function isLegitimateWorkspaceRoot(workspaceRoot) {
-  const pnpmWorkspaceFile = path11__default.join(workspaceRoot, "pnpm-workspace.yaml");
+  const pnpmWorkspaceFile = path12__default.join(workspaceRoot, "pnpm-workspace.yaml");
   if (!fs5__default.existsSync(pnpmWorkspaceFile)) {
     return false;
   }
-  const rootPackageFile = path11__default.join(workspaceRoot, "package.json");
+  const rootPackageFile = path12__default.join(workspaceRoot, "package.json");
   if (!fs5__default.existsSync(rootPackageFile)) {
     return false;
   }
@@ -31491,24 +31840,24 @@ function isLegitimateWorkspaceRoot(workspaceRoot) {
   }
 }
 function resolveWorkspaceTemplates() {
-  let current = path11__default.resolve(process.cwd());
-  const root = path11__default.parse(current).root;
+  let current = path12__default.resolve(process.cwd());
+  const root = path12__default.parse(current).root;
   let depth = 0;
   while (current !== root && depth < MAX_WORKSPACE_TRAVERSAL_DEPTH) {
     if (!isLegitimateWorkspaceRoot(current)) {
-      current = path11__default.dirname(current);
+      current = path12__default.dirname(current);
       depth++;
       continue;
     }
-    const packagesTemplates = path11__default.join(current, "packages", "runa-templates", "templates");
-    const normalizedTemplatesPath = path11__default.resolve(packagesTemplates);
-    if (!normalizedTemplatesPath.startsWith(current + path11__default.sep)) {
-      current = path11__default.dirname(current);
+    const packagesTemplates = path12__default.join(current, "packages", "runa-templates", "templates");
+    const normalizedTemplatesPath = path12__default.resolve(packagesTemplates);
+    if (!normalizedTemplatesPath.startsWith(current + path12__default.sep)) {
+      current = path12__default.dirname(current);
       depth++;
       continue;
     }
     if (fs5__default.existsSync(normalizedTemplatesPath)) {
-      const markerFile = path11__default.join(current, "packages", "runa-templates", "package.json");
+      const markerFile = path12__default.join(current, "packages", "runa-templates", "package.json");
       if (fs5__default.existsSync(markerFile)) {
         try {
           const pkg = JSON.parse(fs5__default.readFileSync(markerFile, "utf-8"));
@@ -31519,7 +31868,7 @@ function resolveWorkspaceTemplates() {
         }
       }
     }
-    current = path11__default.dirname(current);
+    current = path12__default.dirname(current);
     depth++;
   }
   return void 0;
@@ -31528,9 +31877,9 @@ function resolveWorkspaceTemplates() {
 // src/commands/init.ts
 function checkZodVersion(_logger) {
   const zodPaths = [
-    path11__default.join(process.cwd(), "node_modules", "zod", "package.json"),
+    path12__default.join(process.cwd(), "node_modules", "zod", "package.json"),
     // Check home directory node_modules (common source of conflicts)
-    path11__default.join(process.env.HOME ?? "", "node_modules", "zod", "package.json")
+    path12__default.join(process.env.HOME ?? "", "node_modules", "zod", "package.json")
   ];
   for (const zodPath of zodPaths) {
     if (!fs5__default.existsSync(zodPath)) continue;
@@ -31544,7 +31893,7 @@ function checkZodVersion(_logger) {
           "ZOD_VERSION_INCOMPATIBLE",
           [
             "runa SDK requires zod v4.x, but found zod v3.x",
-            `Conflicting zod found at: ${path11__default.dirname(zodPath)}`,
+            `Conflicting zod found at: ${path12__default.dirname(zodPath)}`,
             "",
             "Solutions:",
             "1. Run from a clean project directory without existing node_modules",
@@ -31796,7 +32145,7 @@ var initCommand = new Command("init").description("Initialize pj-repo with runa
   try {
     if (options.repairConfig) {
       logger16.section("Repairing runa.config.ts");
-      const projectName2 = path11__default.basename(process.cwd());
+      const projectName2 = path12__default.basename(process.cwd());
       const repairResult = repairRunaConfig(process.cwd(), projectName2);
       if (repairResult.success) {
         logger16.success("\u2705 Config file repaired successfully");
@@ -31847,7 +32196,7 @@ var initCommand = new Command("init").description("Initialize pj-repo with runa
       existingConfig,
       force: options.force === true
     });
-    const projectName = path11__default.basename(process.cwd());
+    const projectName = path12__default.basename(process.cwd());
     logger16.info(`Project: ${projectName}`);
     logger16.step("Applying templates (SDK)", 1);
     const result = await initProject({
@@ -32105,7 +32454,7 @@ function evaluateStrictDetect(diagnostics) {
 init_esm_shims();
 async function formatFilesWithBiome(files, cwd) {
   if (files.length === 0) return;
-  const relativePaths = files.map((f) => path11.relative(cwd, f));
+  const relativePaths = files.map((f) => path12.relative(cwd, f));
   try {
     await execa("pnpm", ["exec", "biome", "format", "--write", ...relativePaths], {
       cwd,
@@ -32215,7 +32564,7 @@ function ensureDirectoryExists(dirPath) {
 }
 function getGeneratorVersion() {
   try {
-    const pkgPath = path11.resolve(__dirname$1, "../../../package.json");
+    const pkgPath = path12.resolve(__dirname$1, "../../../package.json");
     if (fs5.existsSync(pkgPath)) {
       const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
       return pkg.version ?? "unknown";
@@ -32230,15 +32579,15 @@ function detectPlatform(repoRoot) {
   const nextConfigPatterns = ["next.config.ts", "next.config.js", "next.config.mjs"];
   for (const pattern of nextConfigPatterns) {
     const paths = [
-      path11.join(repoRoot, pattern),
-      path11.join(repoRoot, "apps", "web", pattern),
-      path11.join(repoRoot, "apps", "dashboard", pattern)
+      path12.join(repoRoot, pattern),
+      path12.join(repoRoot, "apps", "web", pattern),
+      path12.join(repoRoot, "apps", "dashboard", pattern)
     ];
     if (paths.some((p) => fs5.existsSync(p))) {
       return "nextjs";
     }
   }
-  const appJsonPath = path11.join(repoRoot, "app.json");
+  const appJsonPath = path12.join(repoRoot, "app.json");
   if (fs5.existsSync(appJsonPath)) {
     try {
       const appJson = JSON.parse(fs5.readFileSync(appJsonPath, "utf-8"));
@@ -32248,7 +32597,7 @@ function detectPlatform(repoRoot) {
     } catch {
     }
   }
-  if (fs5.existsSync(path11.join(repoRoot, "expo.json"))) {
+  if (fs5.existsSync(path12.join(repoRoot, "expo.json"))) {
     return "expo";
   }
   const electronPatterns = [
@@ -32257,7 +32606,7 @@ function detectPlatform(repoRoot) {
     "electron.vite.config.ts",
     "electron.vite.config.js"
   ];
-  if (electronPatterns.some((p) => fs5.existsSync(path11.join(repoRoot, p)))) {
+  if (electronPatterns.some((p) => fs5.existsSync(path12.join(repoRoot, p)))) {
     return "electron";
   }
   return "unknown";
@@ -32273,13 +32622,13 @@ function hasHonoRouteFiles(dir) {
   }
 }
 function collectRouteDirsInScope(repoRoot, scope) {
-  const scopeDir = path11.join(repoRoot, scope);
+  const scopeDir = path12.join(repoRoot, scope);
   if (!fs5.existsSync(scopeDir)) {
     return [];
   }
   try {
     const entries = fs5.readdirSync(scopeDir, { withFileTypes: true });
-    return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((entryName) => hasHonoRouteFiles(path11.join(scopeDir, entryName, "routes"))).map((entryName) => `${scope}/${entryName}/routes`);
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((entryName) => hasHonoRouteFiles(path12.join(scopeDir, entryName, "routes"))).map((entryName) => `${scope}/${entryName}/routes`);
   } catch {
     return [];
   }
@@ -32368,7 +32717,7 @@ function buildDefinitionMap(definitions) {
 function buildEnhancedMachines(e2eManifest, definitionMap, machineDefinitions) {
   const enhanced = {};
   const normalizedIdToCanonical = /* @__PURE__ */ new Map();
-  const isMachineFile = (path64) => path64.includes("machine.ts") || path64.includes("machines/") || path64.includes(".machine.ts") || path64.includes("/machine/");
+  const isMachineFile = (path65) => path65.includes("machine.ts") || path65.includes("machines/") || path65.includes(".machine.ts") || path65.includes("/machine/");
   const addMachine = (id, sourceFile, entryBuilder) => {
     const normalizedId = normalizeToCanonicalId(id).toLowerCase();
     const existingCanonical = normalizedIdToCanonical.get(normalizedId);
@@ -32438,7 +32787,7 @@ async function analyzeHonoRoutes(repoRoot, verbose, resolveSchemas = false) {
       return { apiContracts: [], schemasResolved: false };
     }
     if (verbose) {
-      console.log(`  Analyzing Hono routes in: ${path11.relative(repoRoot, routesPath)}`);
+      console.log(`  Analyzing Hono routes in: ${path12.relative(repoRoot, routesPath)}`);
       if (resolveSchemas) {
         console.log("  Schema resolution enabled (--resolve-schemas)");
       }
@@ -32498,18 +32847,18 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
   }
   const definitionMap = buildDefinitionMap(machineDefinitions);
   const enhancedMachines = buildEnhancedMachines(e2eManifest, definitionMap, machineDefinitions);
-  const absoluteManifestDir = path11.isAbsolute(manifestDir) ? manifestDir : path11.join(repoRoot, manifestDir);
+  const absoluteManifestDir = path12.isAbsolute(manifestDir) ? manifestDir : path12.join(repoRoot, manifestDir);
   if (!isPathContained(repoRoot, absoluteManifestDir)) {
     throw new Error(
       `Security error: Manifest directory '${manifestDir}' would escape the project root. The --manifest-dir must be a relative path within the project directory.`
     );
   }
   ensureDirectoryExists(absoluteManifestDir);
-  const generatedDir = path11.join(absoluteManifestDir, "generated");
+  const generatedDir = path12.join(absoluteManifestDir, "generated");
   ensureDirectoryExists(generatedDir);
-  const manifestsDir = path11.join(absoluteManifestDir, "manifests");
+  const manifestsDir = path12.join(absoluteManifestDir, "manifests");
   ensureDirectoryExists(manifestsDir);
-  const tsPath = path11.join(generatedDir, "selectors.ts");
+  const tsPath = path12.join(generatedDir, "selectors.ts");
   await fs5.promises.writeFile(tsPath, generateSelectorTypeScript(e2eManifest), "utf-8");
   const unifiedRegistry = getUnifiedRegistry();
   const machineLinks = buildMachineLinks();
@@ -32562,12 +32911,12 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
     apiContracts,
     detectionDiagnostics
   };
-  const manifestPath = path11.join(manifestsDir, "manifest.json");
+  const manifestPath = path12.join(manifestsDir, "manifest.json");
   await fs5.promises.writeFile(manifestPath, JSON.stringify(unifiedManifest, null, 2), "utf-8");
   if (verbose) {
-    console.log(`Generated selectors: ${path11.relative(repoRoot, tsPath)}`);
+    console.log(`Generated selectors: ${path12.relative(repoRoot, tsPath)}`);
     console.log(
-      `Generated manifest: ${path11.relative(repoRoot, manifestPath)} (v${manifestVersion})`
+      `Generated manifest: ${path12.relative(repoRoot, manifestPath)} (v${manifestVersion})`
     );
     console.log(`  Platform: ${platform}`);
     console.log(`  Machine definitions: ${machineDefinitions.length}`);
@@ -32586,7 +32935,7 @@ async function generateManifestFiles(manifestDir, repoRoot, verbose, resolveSche
     );
   }
   return {
-    manifestPath: path11.relative(repoRoot, tsPath),
+    manifestPath: path12.relative(repoRoot, tsPath),
     machineCount: Object.keys(enhancedMachines).length,
     machinesWithoutE2EMeta,
     detectionDiagnostics
@@ -32621,7 +32970,7 @@ function registerExistingInjections(machineIds, attrs, sourceFile) {
 }
 async function preprocessFile(filePath, repoRoot, options) {
   let code = await fs5.promises.readFile(filePath, "utf-8");
-  const relativePath = path11.relative(repoRoot, filePath);
+  const relativePath = path12.relative(repoRoot, filePath);
   collectRouteInfo(relativePath, code, options.verbose);
   const hasMarker = code.includes(CLI_INJECTION_MARKER);
   if (hasMarker && options.force) {
@@ -32666,7 +33015,7 @@ async function preprocessFile(filePath, repoRoot, options) {
   return { code, hasMarker: false, skipped: false };
 }
 function transformAndRegister(filePath, code, repoRoot, options) {
-  const relativePath = path11.relative(repoRoot, filePath);
+  const relativePath = path12.relative(repoRoot, filePath);
   const readAndParseFile = createReadAndParseFile(options.verbose);
   const resolveImportPath = createResolveImportPath();
   try {
@@ -32721,7 +33070,7 @@ async function processFileForChildInjection(filePath, repoRoot, options) {
   if (prep.skipped && prep.skipResult) return prep.skipResult;
   const result = transformAndRegister(filePath, prep.code, repoRoot, options);
   if (options.verbose && result.changed && result.injectedCount > 0) {
-    const relativePath = path11.relative(repoRoot, filePath);
+    const relativePath = path12.relative(repoRoot, filePath);
     console.log(
       `  [child] Injected ${result.injectedCount} attrs in ${relativePath} (actions: ${result.actions.join(", ")})`
     );
@@ -32741,7 +33090,7 @@ async function handleChangedFile(result, check, repoRoot, verbose, state2) {
   await fs5.promises.writeFile(result.filePath, result.transformedCode, "utf-8");
   state2.filesToFormat.push(result.filePath);
   if (verbose) {
-    const relativePath = path11.relative(repoRoot, result.filePath);
+    const relativePath = path12.relative(repoRoot, result.filePath);
     console.log(`  Injected ${result.injectedCount} attrs in ${relativePath}`);
   }
 }
@@ -32866,7 +33215,7 @@ async function processFiles(options) {
   for (const filePath of withMachineDefinitions) {
     try {
       const code = await fs5.promises.readFile(filePath, "utf-8");
-      const relativePath = path11.relative(repoRoot, filePath);
+      const relativePath = path12.relative(repoRoot, filePath);
       collectRouteInfo(relativePath, code, verbose);
     } catch {
     }
@@ -33184,7 +33533,7 @@ function assertNodeAuthToken(options) {
   }
 }
 function getPackageVersion(packagePath) {
-  const packageJsonPath = path11__default.join(packagePath, "package.json");
+  const packageJsonPath = path12__default.join(packagePath, "package.json");
   if (!existsSync(packageJsonPath)) {
     throw new CLIError(`package.json not found at ${packagePath}`, "PACKAGE_NOT_FOUND");
   }
@@ -33203,7 +33552,7 @@ function resolveWorkspaceDependencies(workspaceRoot, packages, logger16) {
   const sdkPackage = packages.find((p) => p.name === "SDK");
   const xstatePluginPackage = packages.find((p) => p.name === "xstate-test-plugin");
   if (!sdkPackage) return;
-  const cliPackagePath = path11__default.join(workspaceRoot, "packages", "cli", "package.json");
+  const cliPackagePath = path12__default.join(workspaceRoot, "packages", "cli", "package.json");
   if (!existsSync(cliPackagePath)) return;
   let content = readFileSync(cliPackagePath, "utf-8");
   let updated = false;
@@ -33232,7 +33581,7 @@ function resolveWorkspaceDependencies(workspaceRoot, packages, logger16) {
   }
 }
 function restoreWorkspaceDependencies(workspaceRoot) {
-  const cliPackagePath = path11__default.join(workspaceRoot, "packages", "cli", "package.json");
+  const cliPackagePath = path12__default.join(workspaceRoot, "packages", "cli", "package.json");
   if (!existsSync(cliPackagePath)) return;
   let content = readFileSync(cliPackagePath, "utf-8");
   content = content.replace(/"@runa-ai\/runa": "\^[\d.]+"/, '"@runa-ai/runa": "workspace:*"');
@@ -33344,7 +33693,7 @@ function collectPackageInfo(workspaceRoot, logger16, stepNum) {
   logger16.step("Collecting package info", stepNum);
   const packages = [];
   for (const pkgConfig of PUBLISHABLE_PACKAGES) {
-    const pkgPath = path11__default.join(workspaceRoot, "packages", pkgConfig.dir);
+    const pkgPath = path12__default.join(workspaceRoot, "packages", pkgConfig.dir);
     const version = getPackageVersion(pkgPath);
     const exists = checkVersionExists(pkgConfig.publishName, version);
     packages.push({
@@ -34733,8 +35082,8 @@ var compareActor = fromPromise(async ({ input: input3 }) => {
       const result = compareBothFiles(
         runaRelPath,
         templateRelPath,
-        path11.join(repoRoot, runaRelPath),
-        path11.join(templateDir, templateRelPath),
+        path12.join(repoRoot, runaRelPath),
+        path12.join(templateDir, templateRelPath),
         runaFile.category,
         options.diff ?? false
       );
@@ -35132,9 +35481,9 @@ var PATH_MAPPING_RULES = [
     category: "prompts"
   }
 ];
-function getCategoryForPath(path64) {
+function getCategoryForPath(path65) {
   for (const rule of PATH_MAPPING_RULES) {
-    if (matchGlobPattern(path64, rule.runa) || matchGlobPattern(path64, rule.template)) {
+    if (matchGlobPattern(path65, rule.runa) || matchGlobPattern(path65, rule.template)) {
       return rule.category;
     }
   }
@@ -35154,17 +35503,17 @@ function applyReverseRename(normalized, rule, isTemplate) {
   }
   return normalized;
 }
-function generateComparisonKey(path64, isTemplate) {
-  let normalized = isTemplate ? normalizeTemplatePath(path64) : path64;
+function generateComparisonKey(path65, isTemplate) {
+  let normalized = isTemplate ? normalizeTemplatePath(path65) : path65;
   for (const rule of PATH_MAPPING_RULES) {
     normalized = applyReverseRename(normalized, rule, isTemplate);
   }
   return normalized;
 }
-function matchGlobPattern(path64, pattern) {
+function matchGlobPattern(path65, pattern) {
   const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "<<DOUBLE_STAR>>").replace(/\*/g, "([^/]*)").replace(/<<DOUBLE_STAR>>/g, "(.*)");
   const regex = new RegExp(`^${regexPattern}$`);
-  const match = path64.match(regex);
+  const match = path65.match(regex);
   if (match) {
     const subPath = match[1] ?? "";
     return { matched: true, subPath };
@@ -35185,7 +35534,7 @@ var discoverActor = fromPromise(async ({ input: input3 }) => {
     const runaPattern = rule.runa;
     const runaFiles = await globFiles(repoRoot, runaPattern);
     for (const file of runaFiles) {
-      const relativePath = path11.relative(repoRoot, file.absolutePath);
+      const relativePath = path12.relative(repoRoot, file.absolutePath);
       const key = generateComparisonKey(relativePath, false);
       inventory.runaFiles.set(relativePath, {
         ...file,
@@ -35199,7 +35548,7 @@ var discoverActor = fromPromise(async ({ input: input3 }) => {
     const templatePattern = rule.template;
     const templateFiles = await globFiles(templateDir, templatePattern);
     for (const file of templateFiles) {
-      const relativePath = path11.relative(templateDir, file.absolutePath);
+      const relativePath = path12.relative(templateDir, file.absolutePath);
       const key = generateComparisonKey(relativePath, true);
       inventory.templateFiles.set(relativePath, {
         ...file,
@@ -35248,7 +35597,7 @@ async function matchDoubleWildcard(ctx, entries) {
   await walkAndMatch({ ...ctx, partIndex: ctx.partIndex + 1 });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const subDir = path11.join(ctx.currentDir, entry.name);
+      const subDir = path12.join(ctx.currentDir, entry.name);
       await walkAndMatch({ ...ctx, currentDir: subDir });
     }
   }
@@ -35257,7 +35606,7 @@ async function matchSingleWildcard(ctx, entries, pattern, isLastPart) {
   const regex = patternToRegex(pattern);
   for (const entry of entries) {
     if (regex.test(entry.name)) {
-      const entryPath = path11.join(ctx.currentDir, entry.name);
+      const entryPath = path12.join(ctx.currentDir, entry.name);
       await processEntry(ctx, entryPath, entry.isFile(), entry.isDirectory(), isLastPart);
     }
   }
@@ -35267,14 +35616,14 @@ async function matchBraceExpansion(ctx, entries, pattern, isLastPart) {
   for (const option of options) {
     for (const entry of entries) {
       if (entry.name === option) {
-        const entryPath = path11.join(ctx.currentDir, entry.name);
+        const entryPath = path12.join(ctx.currentDir, entry.name);
         await processEntry(ctx, entryPath, entry.isFile(), entry.isDirectory(), isLastPart);
       }
     }
   }
 }
 async function matchLiteral(ctx, pattern, isLastPart) {
-  const entryPath = path11.join(ctx.currentDir, pattern);
+  const entryPath = path12.join(ctx.currentDir, pattern);
   if (!fs5.existsSync(entryPath)) return;
   const stats = fs5.statSync(entryPath);
   await processEntry(ctx, entryPath, stats.isFile(), stats.isDirectory(), isLastPart);
@@ -35799,17 +36148,17 @@ function printActionsNeeded(logger16, actions) {
   );
 }
 function findRepoRoot3(startDir) {
-  const { existsSync: existsSync53, readFileSync: readFileSync30 } = __require("fs");
-  const { join: join23, dirname: dirname5 } = __require("path");
+  const { existsSync: existsSync54, readFileSync: readFileSync31 } = __require("fs");
+  const { join: join24, dirname: dirname5 } = __require("path");
   let current = startDir;
   while (current !== dirname5(current)) {
-    if (existsSync53(join23(current, "turbo.json"))) {
+    if (existsSync54(join24(current, "turbo.json"))) {
       return current;
     }
-    const pkgPath = join23(current, "package.json");
-    if (existsSync53(pkgPath)) {
+    const pkgPath = join24(current, "package.json");
+    if (existsSync54(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync30(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync31(pkgPath, "utf-8"));
         if (pkg.workspaces) {
           return current;
         }
@@ -35875,10 +36224,10 @@ function generateReportOutput(output3, isJsonMode) {
   };
 }
 function validateRunaRepo(repoRoot) {
-  const { existsSync: existsSync53 } = __require("fs");
-  const { join: join23 } = __require("path");
-  const templateDir = join23(repoRoot, "packages/runa-templates/templates");
-  if (!existsSync53(templateDir)) {
+  const { existsSync: existsSync54 } = __require("fs");
+  const { join: join24 } = __require("path");
+  const templateDir = join24(repoRoot, "packages/runa-templates/templates");
+  if (!existsSync54(templateDir)) {
     throw new CLIError("template-check is a runa-repo only command", "NOT_RUNA_REPO", [
       "This command compares runa-repo with pj-repo templates",
       "It should only be run in the runa repository",
@@ -37218,7 +37567,7 @@ async function runVerification(logger16) {
 }
 async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
   const fs14 = await import('fs/promises');
-  const path64 = await import('path');
+  const path65 = await import('path');
   const { glob: glob8 } = await import('glob');
   const result = [];
   const packageJsonPaths = await glob8("**/package.json", {
@@ -37227,7 +37576,7 @@ async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
     // Exclude root
   });
   for (const relPath of packageJsonPaths) {
-    const fullPath = path64.join(rootDir, relPath);
+    const fullPath = path65.join(rootDir, relPath);
     try {
       const content = await fs14.readFile(fullPath, "utf-8");
       const pkg = JSON.parse(content);
@@ -37240,7 +37589,7 @@ async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
       }
       if (hasAnySdkPackage) {
         result.push({
-          dir: path64.dirname(fullPath),
+          dir: path65.dirname(fullPath),
           packages: packageNames
           // All packages, not just found ones
         });
@@ -37883,7 +38232,7 @@ var SchemaWatcher = class {
       persistent: true,
       ignoreInitial: true
     });
-    this.watcher.on("add", (path64) => this.handleFileEvent("add", path64)).on("change", (path64) => this.handleFileEvent("change", path64)).on("unlink", (path64) => this.handleFileEvent("unlink", path64)).on("error", (error) => this.handleError(error));
+    this.watcher.on("add", (path65) => this.handleFileEvent("add", path65)).on("change", (path65) => this.handleFileEvent("change", path65)).on("unlink", (path65) => this.handleFileEvent("unlink", path65)).on("error", (error) => this.handleError(error));
     this.logger.success("\u2705 Schema watcher started");
     this.logger.info(chalk.dim("  Press Ctrl+C to stop\n"));
   }
@@ -37904,23 +38253,23 @@ var SchemaWatcher = class {
   /**
    * Handle file system events with debouncing
    */
-  handleFileEvent(type, path64) {
-    const existingTimer = this.debounceTimers.get(path64);
+  handleFileEvent(type, path65) {
+    const existingTimer = this.debounceTimers.get(path65);
     if (existingTimer) {
       clearTimeout(existingTimer);
     }
     const timer = setTimeout(() => {
-      this.processFileEvent({ type, path: path64, timestamp: /* @__PURE__ */ new Date() });
-      this.debounceTimers.delete(path64);
+      this.processFileEvent({ type, path: path65, timestamp: /* @__PURE__ */ new Date() });
+      this.debounceTimers.delete(path65);
     }, this.options.debounceMs);
-    this.debounceTimers.set(path64, timer);
+    this.debounceTimers.set(path65, timer);
   }
   /**
    * Process file system event
    */
   async processFileEvent(event) {
-    const { type, path: path64 } = event;
-    const fileName = path64.split("/").pop() || path64;
+    const { type, path: path65 } = event;
+    const fileName = path65.split("/").pop() || path65;
     switch (type) {
       case "add":
         this.logger.info(chalk.green(`\u2795 Added: ${fileName}`));
@@ -37933,19 +38282,19 @@ var SchemaWatcher = class {
         return;
     }
     if (this.options.autoValidate) {
-      await this.validateFile(path64);
+      await this.validateFile(path65);
     }
   }
   /**
    * Validate schema file
    */
-  async validateFile(path64) {
+  async validateFile(path65) {
     try {
       this.logger.info(chalk.dim("  Validating..."));
-      const validationResult = await validateSchemaFile(path64);
+      const validationResult = await validateSchemaFile(path65);
       if (validationResult.isValid) {
         this.logger.success(chalk.green("  \u2713 Validation passed"));
-        const risks = await detectSchemaRisks(path64);
+        const risks = await detectSchemaRisks(path65);
         if (risks.length > 0) {
           this.logger.warn(`  \u26A0\uFE0F  ${risks.length} risk(s) detected`);
           for (const risk of risks) {
@@ -37960,7 +38309,7 @@ var SchemaWatcher = class {
         if (this.options.notifyOnError) {
           await notifyDesktop({
             title: "Schema Validation Failed",
-            message: `${validationResult.errors.length} error(s) in ${path64.split("/").pop()}`,
+            message: `${validationResult.errors.length} error(s) in ${path65.split("/").pop()}`,
             type: "error"
           });
         }
@@ -38179,7 +38528,7 @@ var TestWatcher = class {
       persistent: true,
       ignoreInitial: true
     });
-    this.watcher.on("add", (path64) => this.handleFileEvent("add", path64)).on("change", (path64) => this.handleFileEvent("change", path64)).on("unlink", (path64) => this.handleFileEvent("unlink", path64)).on("error", (error) => this.handleError(error));
+    this.watcher.on("add", (path65) => this.handleFileEvent("add", path65)).on("change", (path65) => this.handleFileEvent("change", path65)).on("unlink", (path65) => this.handleFileEvent("unlink", path65)).on("error", (error) => this.handleError(error));
     this.logger.success("\u2705 Test watcher started");
     this.logger.info(chalk.dim("  Press Ctrl+C to stop\n"));
   }
@@ -38200,26 +38549,26 @@ var TestWatcher = class {
   /**
    * Handle file system events with debouncing
    */
-  handleFileEvent(type, path64) {
-    const existingTimer = this.debounceTimers.get(path64);
+  handleFileEvent(type, path65) {
+    const existingTimer = this.debounceTimers.get(path65);
     if (existingTimer) {
       clearTimeout(existingTimer);
     }
     const timer = setTimeout(() => {
-      this.processFileEvent(type, path64);
-      this.debounceTimers.delete(path64);
+      this.processFileEvent(type, path65);
+      this.debounceTimers.delete(path65);
     }, this.options.debounceMs);
-    this.debounceTimers.set(path64, timer);
+    this.debounceTimers.set(path65, timer);
   }
   /**
    * Process file system event
    */
-  async processFileEvent(type, path64) {
+  async processFileEvent(type, path65) {
     if (this.isRunning) {
       this.logger.warn(chalk.yellow("\u23F3 Tests already running, skipping..."));
       return;
     }
-    const fileName = path64.split("/").pop() || path64;
+    const fileName = path65.split("/").pop() || path65;
     switch (type) {
       case "add":
         this.logger.info(chalk.green(`\u2795 Test added: ${fileName}`));
@@ -38232,7 +38581,7 @@ var TestWatcher = class {
         return;
     }
     if (this.options.autoRun) {
-      await this.runTests(path64);
+      await this.runTests(path65);
     }
   }
   /**
@@ -38305,8 +38654,8 @@ var logger13 = createCLILogger("watch");
 function addFallbackSchemaPatterns(patterns) {
   const detected = detectDatabasePackage(process.cwd());
   if (detected) {
-    patterns.push(path11__default.join(detected, "src/schema/**/*.ts"));
-    patterns.push(path11__default.join(detected, "sql/**/*.sql"));
+    patterns.push(path12__default.join(detected, "src/schema/**/*.ts"));
+    patterns.push(path12__default.join(detected, "sql/**/*.sql"));
     return;
   }
   for (const candidate of DATABASE_PACKAGE_CANDIDATES) {
@@ -38320,8 +38669,8 @@ async function buildSchemaPatterns() {
   const patterns = ["supabase/schemas/**/*.sql"];
   try {
     const dbPackagePath = await getDatabasePackagePath();
-    patterns.push(path11__default.join(dbPackagePath, "src/schema/**/*.ts"));
-    patterns.push(path11__default.join(dbPackagePath, "sql/**/*.sql"));
+    patterns.push(path12__default.join(dbPackagePath, "src/schema/**/*.ts"));
+    patterns.push(path12__default.join(dbPackagePath, "sql/**/*.sql"));
   } catch {
     addFallbackSchemaPatterns(patterns);
   }