@runa-ai/runa-cli 0.5.71 → 0.6.0

package/dist/commands/db/utils/preflight-checks/domain-naming-checks.d.ts

@@ -0,0 +1,106 @@
+/**
+ * AI HINT: Domain Naming Consistency Checker (Preflight Sub-Check)
+ *
+ * Purpose: Validate declarative SQL files follow the naming convention:
+ *          {PREFIX}_{DOMAIN}.sql → CREATE SCHEMA {DOMAIN} → {DOMAIN}.{table}
+ *
+ * Rules:
+ * 1. DOMAIN_FILENAME_SCHEMA_MISMATCH (ERROR) - file domain vs CREATE SCHEMA
+ * 2. DOMAIN_CROSS_DOMAIN_TABLE (WARNING) - table in wrong domain file
+ * 3. DOMAIN_MISSING_CREATE_SCHEMA (WARNING) - schema used but not created
+ * 4. DOMAIN_FK_PREFIX_ORDER (INFO) - FK references higher-prefix file
+ * 5. DOMAIN_FILE_TOO_LARGE (INFO) - file exceeds 2000 lines
+ * 6. DOMAIN_FK_TARGET_NOT_DECLARATIVE (ERROR) - FK target not in declarative SQL
+ * 7. DOMAIN_DUPLICATE_TABLE (ERROR) - same table defined in multiple files
+ * 8. DOMAIN_POLICY_CROSS_SCHEMA_REF (WARNING) - RLS policy references cross-schema table
+ *
+ * Reuses: schema-detector.ts, sql-boundary-parser.ts, sql-comment-utils.ts
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+import { type ParsedSqlFilename } from '../sql-filename-parser.js';
+type DomainNamingRule = 'DOMAIN_FILENAME_SCHEMA_MISMATCH' | 'DOMAIN_CROSS_DOMAIN_TABLE' | 'DOMAIN_MISSING_CREATE_SCHEMA' | 'DOMAIN_FK_PREFIX_ORDER' | 'DOMAIN_FILE_TOO_LARGE' | 'DOMAIN_FK_TARGET_NOT_DECLARATIVE' | 'DOMAIN_DUPLICATE_TABLE' | 'DOMAIN_POLICY_CROSS_SCHEMA_REF';
+export interface DomainNamingIssue {
+    file: string;
+    line?: number;
+    rule: DomainNamingRule;
+    severity: 'error' | 'warning' | 'info';
+    message: string;
+}
+interface FileAnalysis {
+    parsed: ParsedSqlFilename;
+    content: string;
+    strippedContent: string;
+    lineCount: number;
+    declaredSchemas: string[];
+    tables: TableRef[];
+    fkRefs: FkRef[];
+}
+interface TableRef {
+    schema: string;
+    table: string;
+    line: number;
+}
+interface FkRef {
+    schema: string;
+    table: string;
+    line: number;
+}
+declare function analyzeFile(sqlDir: string, filename: string): FileAnalysis | null;
+/** Rule 1: Filename ↔ Schema name mismatch */
+declare function checkFilenameSchemaMatch(analysis: FileAnalysis): DomainNamingIssue[];
+/** Rule 2: Cross-domain table definition */
+declare function checkCrossDomainTables(analysis: FileAnalysis): DomainNamingIssue[];
+/**
+ * Rule 3: Missing CREATE SCHEMA
+ * Checks against all schemas declared across the entire project,
+ * not just the current file. This supports multi-file schemas
+ * (e.g., 10_accounts.sql + 11_accounts_rls.sql sharing a schema).
+ */
+declare function checkMissingCreateSchema(analysis: FileAnalysis, allDeclaredSchemas: Set<string>): DomainNamingIssue[];
+/** Rule 4: FK dependency prefix order violation */
+declare function checkFkPrefixOrder(analysis: FileAnalysis, tableToDomain: Map<string, number>): DomainNamingIssue[];
+/** Rule 5: File too large */
+declare function checkFileSize(analysis: FileAnalysis): DomainNamingIssue[];
+/**
+ * Rule 6: FK target not in declarative SQL
+ *
+ * When a FK references a table whose schema is "managed" (has at least one
+ * table in declarative files) but the specific table is NOT defined in any
+ * declarative file, pg-schema-diff will fail because the shadow DB won't
+ * contain the referenced table.
+ *
+ * FKs to non-managed schemas (e.g. auth, extensions) are skipped — those
+ * are platform-managed and not part of the desired schema.
+ */
+declare function checkFkTargetInDeclarative(analysis: FileAnalysis, tablePrefixMap: Map<string, number>, managedSchemas: Set<string>): DomainNamingIssue[];
+/**
+ * Rule 7: Duplicate table definition across files
+ *
+ * Each table must be defined in exactly one declarative SQL file.
+ * Duplicates cause ambiguous ownership and unpredictable pg-schema-diff behavior.
+ * This is a cross-file check (operates on all analyses, not per-file).
+ */
+declare function checkDuplicateTables(analyses: FileAnalysis[]): DomainNamingIssue[];
+/**
+ * Rule 8: Cross-schema table references in RLS policies
+ *
+ * pg-schema-diff does NOT track cross-schema references inside
+ * USING/WITH CHECK expressions. A policy on schema_a.table that
+ * references schema_b.other_table via EXISTS(...) will fail if
+ * schema_b tables are created after the policy.
+ *
+ * Workaround: use PL/pgSQL wrapper functions with dynamic SQL
+ * (lazy binding). See database-known-limitations.md #11.
+ */
+declare function checkPolicyCrossSchemaRef(analysis: FileAnalysis, managedSchemas: Set<string>): DomainNamingIssue[];
+declare function buildTablePrefixMap(analyses: FileAnalysis[]): Map<string, number>;
+/**
+ * Derive the set of "managed schemas" — schemas that have at least one
+ * table defined in declarative SQL files. FK references to tables in
+ * non-managed schemas (e.g., auth, extensions) are not checked.
+ */
+declare function buildManagedSchemas(tablePrefixMap: Map<string, number>): Set<string>;
+export declare function runDomainNamingCheck(result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+export { checkFilenameSchemaMatch as _checkFilenameSchemaMatch, checkCrossDomainTables as _checkCrossDomainTables, checkMissingCreateSchema as _checkMissingCreateSchema, checkFkPrefixOrder as _checkFkPrefixOrder, checkFileSize as _checkFileSize, checkFkTargetInDeclarative as _checkFkTargetInDeclarative, checkDuplicateTables as _checkDuplicateTables, checkPolicyCrossSchemaRef as _checkPolicyCrossSchemaRef, analyzeFile as _analyzeFile, buildTablePrefixMap as _buildTablePrefixMap, buildManagedSchemas as _buildManagedSchemas, type FileAnalysis, };
+//# sourceMappingURL=domain-naming-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/orphan-checks.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AI HINT: Orphan Database Object Checks
+ *
+ * Purpose: Detect orphaned tables/enums in the database that exist
+ *          in the live database but not in the schema definition files.
+ *          Also checks PostgreSQL extension configuration.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import { type createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+interface OrphanDiff {
+    orphanTables: string[];
+    extraEnums: string[];
+}
+/**
+ * Log orphan diff details and fix suggestions.
+ */
+export declare function logOrphanDetails(diff: OrphanDiff, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>): void;
+/**
+ * Check for orphaned database objects (local only)
+ *
+ * Orphaned objects are tables/enums that exist in the database but not in the schema.
+ * This commonly happens when previous Supabase runs left behind schemas.
+ */
+export declare function runOrphanCheck(env: string, dbPackagePath: string | null, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+/**
+ * Inventory PostgreSQL extensions used in idempotent/*.sql
+ *
+ * This is an informational check (non-blocking). Extensions are managed via
+ * CREATE EXTENSION IF NOT EXISTS in idempotent/*.sql (SQL-managed).
+ * [db.extensions] in config.toml is NOT supported by Supabase CLI 2.72.7+.
+ */
+export declare function runExtensionConfigCheck(_result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): void;
+export {};
+//# sourceMappingURL=orphan-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/schema-risk-checks.d.ts

@@ -0,0 +1,22 @@
+/**
+ * AI HINT: SQL Schema Risk Checks
+ *
+ * Purpose: Scan SQL schema files for dangerous patterns
+ *          (auth.*, extensions.* references) that violate
+ *          Supabase Auth Schema Independence rules.
+ *
+ * HIGH risk violations block db sync.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+/**
+ * Scan SQL schema files for dangerous patterns (auth.*, extensions.* references)
+ *
+ * HIGH risk violations block db sync to prevent Supabase Auth Schema Independence violations
+ * per AGENTS.md rules.
+ */
+export declare function runSqlSchemaRiskCheck(result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+export { categorizeRisks } from '../../../../validators/risk-detector.js';
+//# sourceMappingURL=schema-risk-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/supabase-checks.d.ts

@@ -0,0 +1,55 @@
+/**
+ * AI HINT: Supabase Preflight Checks
+ *
+ * Purpose: Check Supabase running status, test database connection,
+ *          and provide Docker port diagnostics for local development.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+/**
+ * Parse supabase status output to determine if Supabase is running.
+ * Pure function for testability.
+ */
+export declare function isSupabaseStatusRunning(output: {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}): boolean;
+/**
+ * Check if Supabase is running (local only)
+ */
+export declare function checkSupabaseRunning(): Promise<{
+    running: boolean;
+    error?: string;
+}>;
+/**
+ * Test actual database connection with SELECT 1
+ *
+ * This is more reliable than just checking supabase status,
+ * as it verifies:
+ * - Correct port configuration
+ * - Database is accepting connections
+ * - Credentials are valid
+ */
+export declare function testDatabaseConnection(projectRoot?: string): Promise<{
+    connected: boolean;
+    port: number;
+    error?: string;
+}>;
+/**
+ * Get Docker container port diagnostics for supabase_db
+ * Used to detect port mismatch between supabase status and actual Docker port
+ */
+export declare function getDockerPortDiagnostics(): Promise<{
+    containerFound: boolean;
+    containerName?: string;
+    actualPort?: number;
+}>;
+/**
+ * Run Supabase-related checks for local environment.
+ * Checks: Supabase status, database connection, Docker port diagnostics.
+ */
+export declare function runSupabaseChecksIfLocal(env: string, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+//# sourceMappingURL=supabase-checks.d.ts.map

package/dist/commands/db/utils/risk-detector-loader.d.ts

@@ -0,0 +1,8 @@
+import type { SchemaRisk } from '../../../validators/risk-detector.js';
+export type DetectSchemaRisksFn = (filePath: string) => Promise<SchemaRisk[]>;
+type RiskDetectorModule = {
+    detectSchemaRisks: DetectSchemaRisksFn;
+};
+export declare function loadRiskDetectorModule(): Promise<RiskDetectorModule>;
+export {};
+//# sourceMappingURL=risk-detector-loader.d.ts.map

package/dist/commands/db/utils/schema-precheck-budget.d.ts

@@ -0,0 +1,17 @@
+export declare const RUNA_SCHEMA_PRECHECK_MAX_FILES: number;
+export declare const RUNA_SCHEMA_PRECHECK_MAX_TOTAL_BYTES: number;
+export declare const RUNA_SCHEMA_PRECHECK_MAX_FILE_BYTES: number;
+export declare const RUNA_PLAN_PRECHECK_MAX_BYTES: number;
+export declare const RUNA_PLAN_PRECHECK_MAX_STATEMENTS: number;
+export type SchemaPrecheckBudgetState = {
+    scannedFiles: number;
+    scannedBytes: number;
+    maxFiles: number;
+    maxBytes: number;
+    maxFileBytes: number;
+};
+export declare function formatBytes(value: number): string;
+export declare function buildBudgetExceededReason(context: string, files: number, bytes: number, maxFiles: number, maxBytes: number): string;
+export declare function createSchemaPrecheckBudgetState(): SchemaPrecheckBudgetState;
+export declare function shouldAbortSchemaPrecheckForBudget(state: SchemaPrecheckBudgetState, filePath: string): string | null;
+//# sourceMappingURL=schema-precheck-budget.d.ts.map

package/dist/commands/db/utils/sql-boundary-parser.d.ts

@@ -0,0 +1,12 @@
+export type ParsedSqlStatement = {
+    statement: string;
+    line: number;
+};
+export declare function splitSqlStatements(content: string): ParsedSqlStatement[];
+export declare function isNonDdlMaintenanceStatement(statement: string): boolean;
+export declare function isNonSchemaOperation(statement: string): boolean;
+export declare function extractDdlObject(statement: string): string | null;
+export declare function isPartitionOfCreateTable(statement: string): boolean;
+export declare function shouldReviewUnknownDeclarativeDdl(statement: string, declarativePreferredObjects: Set<string>, idempotentPreferredObjects: Set<string>): string | null;
+export declare function shouldReviewUnknownIdempotentDdl(statement: string, idempotentPreferredObjects: Set<string>, declarativePreferredObjects: Set<string>): string | null;
+//# sourceMappingURL=sql-boundary-parser.d.ts.map

package/dist/commands/db/utils/sql-file-collector.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Recursively collect `.sql` files.
+ *
+ * Uses queue + index traversal to avoid O(n^2) behavior from shift().
+ * Unreadable directories are ignored so callers can keep precheck resilient.
+ */
+export declare function collectSqlFilesRecursively(baseDir: string): Generator<string>;
+//# sourceMappingURL=sql-file-collector.d.ts.map

package/dist/commands/db/utils/sql-filename-parser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AI HINT: Declarative SQL Filename Parser
+ *
+ * Purpose: Extract prefix and domain from declarative SQL filenames
+ * Convention: {PREFIX}_{DOMAIN}.sql (e.g., 10_accounts.sql → prefix=10, domain='accounts')
+ * Used by: domain-naming-checks (preflight check)
+ */
+export interface ParsedSqlFilename {
+    prefix: number;
+    domain: string;
+    raw: string;
+}
+/**
+ * Parse declarative SQL filename: {PREFIX}_{DOMAIN}.sql
+ * Returns null if filename doesn't match the convention.
+ *
+ * Special case: 00_public.sql → domain = 'public'
+ */
+export declare function parseSqlFilename(filename: string): ParsedSqlFilename | null;
+//# sourceMappingURL=sql-filename-parser.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-ast.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AI HINT: SQL Table Extractor — AST-based Parsing
+ *
+ * Purpose: Extract table definitions using libpg-query AST (primary parser)
+ * Extracted from: sql-table-extractor.ts (AST-based Parsing section)
+ *
+ * Functions:
+ * - extractTablesWithAst: Parse SQL content using libpg-query AST
+ * - convertAstColumns: Convert AST columns to ColumnDefinition array
+ * - convertAstForeignKeys: Convert AST foreign keys to ForeignKeyDefinition array
+ * - convertAstIndexes: Convert AST indexes to IndexDefinition array
+ */
+import type { TableEntry } from '@runa-ai/runa/manifests';
+import type { ResolvedOptions } from './sql-table-extractor.js';
+/**
+ * Extract tables using libpg-query AST
+ */
+export declare function extractTablesWithAst(content: string, filePath: string, opts: ResolvedOptions): Promise<TableEntry[]>;
+//# sourceMappingURL=sql-table-extractor-ast.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-regex.d.ts

@@ -0,0 +1,50 @@
+/**
+ * AI HINT: SQL Table Extractor — Regex-based Parsing
+ *
+ * Purpose: Fallback parsing when libpg-query AST is not available
+ * Extracted from: sql-table-extractor.ts (Regex-based Parsing section)
+ *
+ * Functions:
+ * - findTablesRegex: Find all CREATE TABLE statements
+ * - parseColumnsRegex: Parse column definitions from table body
+ * - parsePrimaryKeyRegex: Parse PRIMARY KEY constraints
+ * - parseForeignKeysRegex: Parse FOREIGN KEY constraints (explicit + inline)
+ * - parseIndexesRegex: Parse CREATE INDEX statements
+ * - hasRlsEnabledRegex: Check if RLS is enabled for a table
+ */
+import type { ColumnDefinition, ForeignKeyDefinition, IndexDefinition } from '@runa-ai/runa/manifests';
+import type { ParseContext, ParsedTable } from './sql-table-extractor.js';
+/**
+ * Find all CREATE TABLE statements in content (regex)
+ */
+export declare function findTablesRegex(ctx: ParseContext): ParsedTable[];
+export interface ParsedColumnDeclarationResult {
+    name: string;
+    type: string;
+    hasDefault: boolean;
+    notNull: boolean;
+    isPrimaryKey: boolean;
+    inlineReferenceTable?: string;
+    inlineReferenceColumn?: string;
+}
+/**
+ * Parse column definitions from table body (regex)
+ */
+export declare function parseColumnsRegex(tableBody: string): ColumnDefinition[];
+/**
+ * Parse PRIMARY KEY constraint (regex)
+ */
+export declare function parsePrimaryKeyRegex(tableBody: string): string[];
+/**
+ * Parse FOREIGN KEY constraints (regex)
+ */
+export declare function parseForeignKeysRegex(tableBody: string): ForeignKeyDefinition[];
+/**
+ * Parse indexes from full file content (regex)
+ */
+export declare function parseIndexesRegex(content: string, schema: string, tableName: string): IndexDefinition[];
+/**
+ * Check if RLS is enabled for table (regex)
+ */
+export declare function hasRlsEnabledRegex(content: string, schema: string, tableName: string): boolean;
+//# sourceMappingURL=sql-table-extractor-regex.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-rls.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AI HINT: SQL Table Extractor — RLS Policy Parsing
+ *
+ * Purpose: Parse CREATE POLICY statements from SQL content
+ * Extracted from: sql-table-extractor.ts (RLS Policy Parsing section)
+ *
+ * Functions:
+ * - extractCreatePolicyStatements: Find all CREATE POLICY statements
+ * - parsePoliciesRegex: Parse policy details (name, command, USING, WITH CHECK)
+ */
+import type { RlsPolicyDefinition } from '@runa-ai/runa/manifests';
+export declare function parsePoliciesRegex(content: string, schema: string, tableName: string): RlsPolicyDefinition[];
+//# sourceMappingURL=sql-table-extractor-rls.d.ts.map

package/dist/commands/db/utils/sql-table-extractor.d.ts

@@ -16,11 +16,82 @@
  * Architecture:
  * - Primary: libpg-query AST parsing (accurate, handles edge cases)
  * - Fallback: Regex parsing (for pj-repos without libpg-query)
+ * - Split modules: regex, rls, ast (see sql-table-extractor-*.ts)
  *
  * Note: This is a lightweight parser for manifest generation.
  * For full SQL parsing, use pg_catalog queries (see introspectColumns).
  */
-import type { TableEntry } from '@runa-ai/runa/manifests';
+import type { ForeignKeyDefinition, TableEntry } from '@runa-ai/runa/manifests';
+type SqlParserUtils = Awaited<ReturnType<typeof import('@runa-ai/runa/ast').loadSqlParserUtils>>;
+/**
+ * Get SQL parser utilities (requires AST to be available)
+ */
+export declare function getSqlParserUtils(): Promise<SqlParserUtils | null>;
+/**
+ * Regex patterns for SQL parsing (used as fallback when libpg-query unavailable)
+ */
+export declare const SQL_IDENTIFIER = "(?:\"(?:[^\"]|\"\")*\"|[a-zA-Z_][a-zA-Z0-9_]*)";
+export declare const TABLE_REFERENCE = "(?:\"(?:[^\"]|\"\")*\"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\\s*\\.\\s*(?:\"(?:[^\"]|\"\")*\"|[a-zA-Z_][a-zA-Z0-9_]*))?";
+export declare const SQL_PATTERNS: {
+    readonly createTable: RegExp;
+    readonly primaryKey: RegExp;
+    readonly foreignKey: RegExp;
+    readonly createIndex: RegExp;
+    readonly enableRls: RegExp;
+};
+export interface ParsedTable {
+    schema: string;
+    name: string;
+    lineNumber: number;
+    tableBody: string;
+}
+export interface ParseContext {
+    filePath: string;
+    content: string;
+    lines: string[];
+}
+export declare function splitTopLevelSqlStatements(content: string): string[];
+export declare function splitTopLevelCsv(content: string): string[];
+/**
+ * Convert snake_case to camelCase
+ */
+export declare function snakeToCamel(str: string): string;
+/**
+ * Get line number from character position
+ */
+export declare function getLineNumber(content: string, position: number): number;
+/**
+ * Extract table body (content between parentheses)
+ */
+export declare function extractTableBody(content: string, startPos: number): string;
+/**
+ * Normalize PostgreSQL data type
+ */
+export declare function normalizeType(type: string): string;
+/**
+ * Unquote PostgreSQL identifier and unescape doubled quotes.
+ */
+export declare function unquoteIdentifier(identifier: string): string;
+export declare function parseTableReference(ref: string): {
+    schema: string;
+    name: string;
+} | null;
+/**
+ * Strip SQL comments while preserving quoted text and line structure.
+ */
+/**
+ * Parse index column names from raw SQL fragment
+ *
+ * Handles:
+ * - Quoted identifiers: "timestamp" → timestamp
+ * - Sort directions: created_at DESC → created_at
+ * - Mixed: "user_id" ASC, "created_at" DESC → [user_id, created_at]
+ */
+export declare function parseIndexColumns(rawColumns: string): string[];
+/**
+ * Normalize ON DELETE/UPDATE action
+ */
+export declare function normalizeOnAction(action: string | undefined): ForeignKeyDefinition['onDelete'];
 export interface ExtractOptions {
     /** Include column definitions */
     includeColumns?: boolean;
@@ -31,6 +102,12 @@ export interface ExtractOptions {
     /** Include RLS policies */
     includeRlsPolicies?: boolean;
 }
+export interface ResolvedOptions {
+    includeColumns: boolean;
+    includeForeignKeys: boolean;
+    includeIndexes: boolean;
+    includeRlsPolicies: boolean;
+}
 /**
  * Extract table definitions from SQL files
  *
@@ -53,4 +130,5 @@ export declare function extractTablesFromSqlDir(sqlDir: string, options?: Extrac
  * Uses libpg-query AST parsing when available, falls back to regex parsing.
  */
 export declare function extractTablesFromSqlFile(filePath: string, options?: ExtractOptions): Promise<TableEntry[]>;
+export {};
 //# sourceMappingURL=sql-table-extractor.d.ts.map

package/dist/commands/db/utils/table-registry-introspection.d.ts

@@ -0,0 +1,68 @@
+/**
+ * AI HINT: Table Registry - DB Introspection Module
+ *
+ * Purpose: Database introspection logic for table registry manifest generation
+ * Pattern: DB Introspection PRIMARY, SQL regex FALLBACK
+ *
+ * Extracted from table-registry.ts to reduce file size.
+ * Contains:
+ * - SQL injection prevention helpers (validatePgIdentifier, buildSafeSchemaInClause)
+ * - introspectTablesFromDb (PRIMARY source via PostgreSQL system catalogs)
+ * - Lookup map builders (FK, index, RLS, check constraints, triggers, PK)
+ * - convertIntrospectionToTableEntries
+ * - crossCheckWithDrizzle (Drizzle validation)
+ * - introspectColumns (enriched column info from DB)
+ *
+ * @see table-registry.ts - Main manifest generation and load/save
+ */
+import type { TableEntry } from '@runa-ai/runa/manifests';
+/**
+ * SECURITY (Issue #535): Build safe SQL IN clause for schema names.
+ *
+ * Each schema name is:
+ * 1. Validated to be a safe PostgreSQL identifier
+ * 2. Escaped as a string literal (defense-in-depth)
+ *
+ * @param schemas - Array of schema names to include
+ * @returns SQL fragment like "'public','accounts'" (without parentheses)
+ * @throws Error if any schema name is invalid
+ */
+export declare function buildSafeSchemaInClause(schemas: string[]): string;
+/**
+ * Introspect tables from database using PostgreSQL system catalogs
+ *
+ * This is the PRIMARY source for table metadata (when database is available).
+ * PostgreSQL system catalogs are 100% accurate because PostgreSQL itself
+ * parsed and stored the schema information.
+ *
+ * @param databaseUrl - PostgreSQL connection string
+ * @param schemas - Schema names to include (default: auto-detect non-system schemas)
+ * @returns TableEntry[] with accurate metadata from database
+ * @throws Error if database connection or introspection fails
+ */
+export declare function introspectTablesFromDb(databaseUrl: string, schemas?: string[]): Promise<TableEntry[]>;
+/**
+ * Cross-check SQL tables with Drizzle schema
+ *
+ * Uses dynamic import to load Drizzle schema and verify table names match.
+ * Returns discrepancies if any.
+ *
+ * Note: This is for validation only. SQL is the SSOT.
+ */
+export declare function crossCheckWithDrizzle(sqlTables: TableEntry[], drizzleSchemaPath: string): Promise<{
+    matched: TableEntry[];
+    sqlOnly: TableEntry[];
+    drizzleOnly: string[];
+}>;
+/**
+ * Introspect column information from database
+ *
+ * Zero Hardcode: All info from pg_catalog
+ * This enriches SQL-extracted data with runtime database metadata.
+ *
+ * @param databaseUrl - PostgreSQL connection string
+ * @param tables - Tables to introspect
+ * @returns Tables with enriched column information
+ */
+export declare function introspectColumns(databaseUrl: string, tables: TableEntry[]): Promise<TableEntry[]>;
+//# sourceMappingURL=table-registry-introspection.d.ts.map

package/dist/commands/db/utils/table-registry.d.ts

@@ -20,46 +20,10 @@
  * @see packages/sdk/src/core/manifests/types.ts - TablesManifest type definition
  * @see packages/sdk/src/test/generator/introspectors/db-introspector.ts - DB introspection
  * @see packages/cli/src/commands/db/utils/sql-table-extractor.ts - SQL parser (fallback)
+ * @see table-registry-introspection.ts - DB introspection logic (extracted)
  */
-import type { TableEntry, TablesManifest } from '@runa-ai/runa/manifests';
+import type { TablesManifest } from '@runa-ai/runa/manifests';
 import { type MappingOptions } from './semantic-mapper.js';
-/**
- * Introspect tables from database using PostgreSQL system catalogs
- *
- * This is the PRIMARY source for table metadata (when database is available).
- * PostgreSQL system catalogs are 100% accurate because PostgreSQL itself
- * parsed and stored the schema information.
- *
- * @param databaseUrl - PostgreSQL connection string
- * @param schemas - Schema names to include (default: auto-detect non-system schemas)
- * @returns TableEntry[] with accurate metadata from database
- * @throws Error if database connection or introspection fails
- */
-export declare function introspectTablesFromDb(databaseUrl: string, schemas?: string[]): Promise<TableEntry[]>;
-/**
- * Cross-check SQL tables with Drizzle schema
- *
- * Uses dynamic import to load Drizzle schema and verify table names match.
- * Returns discrepancies if any.
- *
- * Note: This is for validation only. SQL is the SSOT.
- */
-export declare function crossCheckWithDrizzle(sqlTables: TableEntry[], drizzleSchemaPath: string): Promise<{
-    matched: TableEntry[];
-    sqlOnly: TableEntry[];
-    drizzleOnly: string[];
-}>;
-/**
- * Introspect column information from database
- *
- * Zero Hardcode: All info from pg_catalog
- * This enriches SQL-extracted data with runtime database metadata.
- *
- * @param databaseUrl - PostgreSQL connection string
- * @param tables - Tables to introspect
- * @returns Tables with enriched column information
- */
-export declare function introspectColumns(databaseUrl: string, tables: TableEntry[]): Promise<TableEntry[]>;
 export interface GenerateManifestOptions {
     /** SQL directory (default: supabase/schemas/declarative) */
     sqlDir?: string;
@@ -113,4 +77,5 @@ export declare function loadTablesManifest(projectRoot: string): TablesManifest
 export type { TableEntry, TablesManifest } from '@runa-ai/runa/manifests';
 export { applyMappingToTables, generateMapping, generateSemanticName, type MappingOptions, type MappingResult, snakeToCamel, snakeToPascal, validateCompleteness, validateMapping, } from './semantic-mapper.js';
 export { extractTablesFromSqlDir, extractTablesFromSqlFile } from './sql-table-extractor.js';
+export { crossCheckWithDrizzle, introspectColumns, introspectTablesFromDb, } from './table-registry-introspection.js';
 //# sourceMappingURL=table-registry.d.ts.map

package/dist/commands/dev/actors/app-lifecycle.d.ts

@@ -0,0 +1,18 @@
+export interface AppStartInput {
+    repoRoot: string;
+    appDir: string;
+    port: number;
+    tmpDir: string;
+    stream: boolean;
+    bundler?: 'turbopack' | 'webpack';
+}
+export interface AppStartOutput {
+    pid: number;
+    cleanupStreams: () => void;
+}
+export interface ShutdownInput {
+    pid: number;
+}
+export declare const appStartActor: import("xstate").PromiseActorLogic<AppStartOutput, AppStartInput, import("xstate").EventObject>;
+export declare const shutdownActor: import("xstate").PromiseActorLogic<void, ShutdownInput, import("xstate").EventObject>;
+//# sourceMappingURL=app-lifecycle.d.ts.map

package/dist/commands/dev/actors/index.d.ts

@@ -1,14 +1,19 @@
 /**
  * AI HINT: Dev Command Actors
  *
- * Purpose: Re-export actors from build and ci commands
- * Pattern: Actor reuse for dev workflow
+ * Purpose: Re-export all actors for the dev workflow
  *
  * Actors:
  * - depsInstallActor: Check/install dependencies
  * - envCheckActor: Check environment variables
  * - supabaseStartActor: Start Supabase local
+ * - processCheckActor: Check for existing processes and port availability
  * - appStartActor: Start Next.js dev server
+ * - shutdownActor: Gracefully shut down dev server
  */
 export { depsInstallActor, envCheckActor, supabaseStartActor, } from '../../build/actors/setup.js';
+export { processCheckActor } from './process-check.js';
+export type { ProcessCheckInput, ProcessCheckOutput } from './process-check.js';
+export { appStartActor, shutdownActor } from './app-lifecycle.js';
+export type { AppStartInput, AppStartOutput, ShutdownInput } from './app-lifecycle.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/dev/actors/process-check.d.ts

@@ -0,0 +1,12 @@
+export interface ProcessCheckInput {
+    repoRoot: string;
+    tmpDir: string;
+    port: number;
+    replace: boolean;
+    skipApp: boolean;
+}
+export interface ProcessCheckOutput {
+    staleProcessRecovered: boolean;
+}
+export declare const processCheckActor: import("xstate").PromiseActorLogic<ProcessCheckOutput, ProcessCheckInput, import("xstate").EventObject>;
+//# sourceMappingURL=process-check.d.ts.map