@runa-ai/runa-cli 0.5.71 → 0.6.0

package/dist/lib/sql-comment-utils.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: Shared SQL Comment Stripping Utilities
+ *
+ * Purpose: Canonical implementation of SQL comment/string stripping.
+ * Used by: partition-validator, schema-detector, sql-table-extractor, sql-parser
+ *
+ * Handles:
+ * - Line comments (-- ...)
+ * - Nested block comments (PostgreSQL supports nested block comments)
+ * - Single-quoted strings with escaped quotes ('')
+ * - Double-quoted identifiers with escaped quotes ("")
+ * - Dollar-quoted strings ($tag$...$tag$)
+ * - PostgreSQL E-string literals (E'...' with backslash escapes)
+ */
+export declare function stripSqlComments(content: string): string;
+/**
+ * Replace content inside dollar-quoted strings with spaces.
+ * This prevents false-positive matches inside PL/pgSQL function bodies.
+ *
+ * Input is already comment-stripped (from stripSqlComments), so we only need to
+ * handle dollar-quoted strings — single/double quotes are already handled by the
+ * regex (they can't span multi-statement patterns).
+ */
+export declare function blankDollarQuotedBodies(content: string): string;
+//# sourceMappingURL=sql-comment-utils.d.ts.map

package/dist/license-OB7GVJQ2.js

@@ -0,0 +1,468 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { createError } from './chunk-JQXOVCOP.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { createCLILogger as createCLILogger$1 } from '@runa-ai/runa/cli-runtime';
+import { createCLILogger, CLIError } from '@runa-ai/runa';
+import { execa } from 'execa';
+
+createRequire(import.meta.url);
+
+// src/utils/license/index.ts
+init_esm_shims();
+
+// src/utils/license/allowlist-checker.ts
+init_esm_shims();
+var DEFAULT_ALLOWLIST_API_URL = "https://api.runa.dev/api/license/check";
+var ALLOWED_API_HOSTNAMES = ["api.runa.dev", "localhost", "127.0.0.1"];
+function isPrivateIP(hostname) {
+  const privateIPPatterns = [
+    /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/,
+    // 127.0.0.0/8 (loopback)
+    /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/,
+    // 10.0.0.0/8 (private class A)
+    /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/,
+    // 172.16.0.0/12 (private class B)
+    /^192\.168\.\d{1,3}\.\d{1,3}$/,
+    // 192.168.0.0/16 (private class C)
+    /^169\.254\.\d{1,3}\.\d{1,3}$/,
+    // 169.254.0.0/16 (link-local, metadata)
+    /^0\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
+    // 0.0.0.0/8 (current network)
+  ];
+  const privateIPv6Patterns = [
+    /^::1$/,
+    // IPv6 loopback
+    /^fe80:/i,
+    // IPv6 link-local
+    /^fc00:/i,
+    // IPv6 unique local (part of fd00::/8)
+    /^fd[0-9a-f]{2}:/i
+    // IPv6 unique local
+  ];
+  for (const pattern of privateIPPatterns) {
+    if (pattern.test(hostname)) {
+      return true;
+    }
+  }
+  for (const pattern of privateIPv6Patterns) {
+    if (pattern.test(hostname)) {
+      return true;
+    }
+  }
+  return false;
+}
+function validateApiUrl(urlString) {
+  const logger3 = createCLILogger("allowlist");
+  try {
+    const url = new URL(urlString);
+    const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) {
+      logger3.warn(`[allowlist] SECURITY: Rejected URL with non-HTTPS protocol: ${url.protocol}`);
+      return null;
+    }
+    if (isPrivateIP(url.hostname) && !isLocalhost) {
+      logger3.warn(`[allowlist] SECURITY: Rejected URL with private IP: ${url.hostname}`);
+      return null;
+    }
+    if (!ALLOWED_API_HOSTNAMES.includes(url.hostname.toLowerCase())) {
+      logger3.warn(
+        `[allowlist] SECURITY: Custom API hostname '${url.hostname}' is not in the allowed list. Allowed: ${ALLOWED_API_HOSTNAMES.join(", ")}`
+      );
+      return null;
+    }
+    return urlString;
+  } catch {
+    logger3.warn(`[allowlist] SECURITY: Invalid URL format: ${urlString}`);
+    return null;
+  }
+}
+function getValidatedApiUrl() {
+  const customUrl = process.env.RUNA_ALLOWLIST_API_URL;
+  if (!customUrl) {
+    return DEFAULT_ALLOWLIST_API_URL;
+  }
+  const validatedUrl = validateApiUrl(customUrl);
+  if (validatedUrl) {
+    return validatedUrl;
+  }
+  const logger3 = createCLILogger("allowlist");
+  logger3.warn("[allowlist] SECURITY: Falling back to default API URL due to invalid custom URL");
+  return DEFAULT_ALLOWLIST_API_URL;
+}
+var ALLOWLIST_API_URL = getValidatedApiUrl();
+var CACHE_TTL_MS = 4 * 60 * 60 * 1e3;
+var LAST_KNOWN_GOOD_TTL_MS = 24 * 60 * 60 * 1e3;
+var API_TIMEOUT_MS = 1e4;
+var logger = createCLILogger("allowlist");
+var cache = /* @__PURE__ */ new Map();
+async function checkAllowlist(owner) {
+  const cacheKey = owner.toLowerCase();
+  const cached = cache.get(cacheKey);
+  if (cached?.confirmed && Date.now() - cached.timestamp < CACHE_TTL_MS) {
+    logger.debug(`[allowlist] Cache hit for: ${owner} (allowed: ${cached.allowed})`);
+    return cached.allowed;
+  }
+  const url = `${ALLOWLIST_API_URL}?owner=${encodeURIComponent(owner)}`;
+  logger.debug(`[allowlist] Checking API: ${url}`);
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "runa-cli"
+      },
+      signal: controller.signal
+    });
+    clearTimeout(timeoutId);
+    if (!response.ok) {
+      throw new Error(`API returned ${response.status}: ${response.statusText}`);
+    }
+    const data = await response.json();
+    logger.debug(`[allowlist] API response: ${JSON.stringify(data)}`);
+    cache.set(cacheKey, {
+      allowed: data.allowed,
+      timestamp: Date.now(),
+      confirmed: true
+    });
+    return data.allowed;
+  } catch (error) {
+    clearTimeout(timeoutId);
+    const errorMessage = error instanceof Error && error.name === "AbortError" ? `API request timed out after ${API_TIMEOUT_MS}ms` : error instanceof Error ? error.message : "Unknown error";
+    logger.debug(`[allowlist] API error: ${errorMessage}`);
+    if (cached && Date.now() - cached.timestamp < LAST_KNOWN_GOOD_TTL_MS) {
+      logger.debug(
+        `[allowlist] Using last-known-good for: ${owner} (allowed: ${cached.allowed}, age: ${Math.round((Date.now() - cached.timestamp) / 1e3 / 60)}min)`
+      );
+      return cached.allowed;
+    }
+    throw new Error(`Allowlist check failed: ${errorMessage}`);
+  }
+}
+function clearAllowlistCache() {
+  cache.clear();
+}
+function getAllowlistCacheStats() {
+  return {
+    size: cache.size,
+    entries: Array.from(cache.keys())
+  };
+}
+
+// src/utils/license/ci-detector.ts
+init_esm_shims();
+var CI_PROVIDERS = {
+  // GitHub Actions
+  GITHUB_ACTIONS: "github-actions",
+  // GitLab CI
+  GITLAB_CI: "gitlab-ci",
+  // CircleCI
+  CIRCLECI: "circleci",
+  // Jenkins
+  JENKINS_URL: "jenkins",
+  // Travis CI
+  TRAVIS: "travis-ci",
+  // Bitbucket Pipelines
+  BITBUCKET_BUILD_NUMBER: "bitbucket-pipelines",
+  // Azure Pipelines
+  TF_BUILD: "azure-pipelines",
+  // AWS CodeBuild
+  CODEBUILD_BUILD_ID: "aws-codebuild",
+  // Google Cloud Build
+  CLOUD_BUILD_PROJECT: "google-cloud-build",
+  // Vercel
+  VERCEL: "vercel",
+  // Netlify
+  NETLIFY: "netlify"
+};
+function isCI() {
+  if (process.env.CI === "true" || process.env.CI === "1") {
+    return true;
+  }
+  for (const envVar of Object.keys(CI_PROVIDERS)) {
+    if (process.env[envVar]) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectCIProvider() {
+  for (const [envVar, provider] of Object.entries(CI_PROVIDERS)) {
+    if (process.env[envVar]) {
+      return provider;
+    }
+  }
+  if (process.env.CI === "true" || process.env.CI === "1") {
+    return "generic-ci";
+  }
+  return void 0;
+}
+function detectCI() {
+  const provider = detectCIProvider();
+  return {
+    isCI: provider !== void 0,
+    provider
+  };
+}
+
+// src/utils/license/owner-resolver.ts
+init_esm_shims();
+function parseGitRemoteUrl(url) {
+  const sshMatch = url.match(/git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (sshMatch?.[1] && sshMatch[2]) {
+    return { owner: sshMatch[1], repo: sshMatch[2] };
+  }
+  const httpsMatch = url.match(/https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (httpsMatch?.[1] && httpsMatch[2]) {
+    return { owner: httpsMatch[1], repo: httpsMatch[2] };
+  }
+  const gitlabSshMatch = url.match(/git@gitlab\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (gitlabSshMatch?.[1] && gitlabSshMatch[2]) {
+    return { owner: gitlabSshMatch[1], repo: gitlabSshMatch[2] };
+  }
+  const gitlabHttpsMatch = url.match(/https?:\/\/gitlab\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (gitlabHttpsMatch?.[1] && gitlabHttpsMatch[2]) {
+    return { owner: gitlabHttpsMatch[1], repo: gitlabHttpsMatch[2] };
+  }
+  return null;
+}
+function resolveFromGitHubActions() {
+  const githubRepo = process.env.GITHUB_REPOSITORY;
+  if (!githubRepo) return null;
+  if (process.env.GITHUB_ACTIONS !== "true") {
+    return null;
+  }
+  const [owner, repo] = githubRepo.split("/");
+  if (!owner) return null;
+  return { owner, repo, source: "github-env" };
+}
+function resolveFromGitLabCI() {
+  const projectPath = process.env.CI_PROJECT_PATH;
+  if (!projectPath) return null;
+  if (process.env.GITLAB_CI !== "true") {
+    return null;
+  }
+  const [owner, ...repoParts] = projectPath.split("/");
+  if (!owner) return null;
+  return {
+    owner,
+    repo: repoParts.join("/") || void 0,
+    source: "gitlab-env"
+  };
+}
+function resolveFromCircleCI() {
+  const owner = process.env.CIRCLE_PROJECT_USERNAME;
+  const repo = process.env.CIRCLE_PROJECT_REPONAME;
+  if (!owner) return null;
+  if (process.env.CIRCLECI !== "true") {
+    return null;
+  }
+  return { owner, repo: repo || void 0, source: "circleci-env" };
+}
+async function resolveFromGitRemote() {
+  try {
+    const { stdout } = await execa("git", ["remote", "get-url", "origin"], {
+      timeout: 5e3
+    });
+    const result = parseGitRemoteUrl(stdout.trim());
+    if (!result) return null;
+    return { owner: result.owner, repo: result.repo, source: "git-remote" };
+  } catch {
+    return null;
+  }
+}
+async function resolveGitHubOwner() {
+  const gitRemoteResult = await resolveFromGitRemote();
+  if (gitRemoteResult) return gitRemoteResult;
+  const githubResult = resolveFromGitHubActions();
+  if (githubResult) return githubResult;
+  const gitlabResult = resolveFromGitLabCI();
+  if (gitlabResult) return gitlabResult;
+  const circleciResult = resolveFromCircleCI();
+  if (circleciResult) return circleciResult;
+  return null;
+}
+
+// src/utils/license/validate-owner.ts
+init_esm_shims();
+var GITHUB_OWNER_PATTERN = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/;
+var MAX_OWNER_LENGTH = 100;
+function validateOwner(owner) {
+  if (!owner || owner.length < 1 || owner.length > MAX_OWNER_LENGTH) {
+    throw new CLIError(
+      `Invalid owner format: must be 1-${MAX_OWNER_LENGTH} characters`,
+      "INVALID_OWNER_FORMAT",
+      ["Provide a valid GitHub organization or user name"]
+    );
+  }
+  if (!GITHUB_OWNER_PATTERN.test(owner)) {
+    throw new CLIError(`Invalid owner format: "${owner}"`, "INVALID_OWNER_FORMAT", [
+      "GitHub usernames must be alphanumeric with optional hyphens",
+      "Cannot start or end with a hyphen",
+      "Example: acme-corp, myorg, user123"
+    ]);
+  }
+}
+function isValidOwner(owner) {
+  if (!owner || owner.length < 1 || owner.length > MAX_OWNER_LENGTH) {
+    return false;
+  }
+  return GITHUB_OWNER_PATTERN.test(owner);
+}
+
+// src/utils/license/admin-auth.ts
+init_esm_shims();
+var ADMIN_ORG = "r06-dev";
+var cachedAdminUser = null;
+async function getAuthenticatedUser() {
+  try {
+    const result = await execa("gh", ["api", "user", "--jq", ".login"], {
+      stdio: "pipe",
+      reject: false
+    });
+    if (result.exitCode === 0 && result.stdout.trim()) {
+      return result.stdout.trim();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function isOrgMember(username) {
+  try {
+    const result = await execa("gh", ["api", `orgs/${ADMIN_ORG}/members/${username}`, "--silent"], {
+      stdio: "pipe",
+      reject: false
+    });
+    if (result.exitCode === 0) {
+      return true;
+    }
+    const publicResult = await execa(
+      "gh",
+      ["api", `orgs/${ADMIN_ORG}/public_members/${username}`, "--silent"],
+      {
+        stdio: "pipe",
+        reject: false
+      }
+    );
+    return publicResult.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+async function getGitHubUserEmail() {
+  try {
+    const result = await execa("gh", ["api", "user", "--jq", ".email"], {
+      stdio: "pipe",
+      reject: false
+    });
+    if (result.exitCode === 0 && result.stdout.trim()) {
+      return result.stdout.trim();
+    }
+    const gitResult = await execa("git", ["config", "user.email"], {
+      stdio: "pipe",
+      reject: false
+    });
+    if (gitResult.exitCode === 0 && gitResult.stdout.trim()) {
+      return gitResult.stdout.trim();
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function verifyAdminAuth() {
+  if (cachedAdminUser) {
+    return cachedAdminUser;
+  }
+  try {
+    const authResult = await execa("gh", ["auth", "status"], {
+      stdio: "pipe",
+      reject: false
+    });
+    if (authResult.exitCode !== 0) {
+      throw new CLIError("GitHub CLI not authenticated", "ADMIN_AUTH_REQUIRED", [
+        "Admin operations require GitHub CLI authentication",
+        "Run: gh auth login"
+      ]);
+    }
+  } catch (error) {
+    if (error instanceof CLIError) throw error;
+    throw new CLIError("GitHub CLI not found", "GH_CLI_NOT_FOUND", [
+      "Admin operations require GitHub CLI (gh)",
+      "Install: brew install gh (macOS) or see https://cli.github.com/"
+    ]);
+  }
+  const username = await getAuthenticatedUser();
+  if (!username) {
+    throw new CLIError("Could not determine authenticated user", "ADMIN_AUTH_REQUIRED", [
+      "Ensure GitHub CLI is properly configured",
+      "Run: gh auth login"
+    ]);
+  }
+  const isMember = await isOrgMember(username);
+  if (!isMember) {
+    throw new CLIError(
+      `User "${username}" is not authorized for admin operations`,
+      "ADMIN_NOT_AUTHORIZED",
+      [
+        `Admin operations require membership in the "${ADMIN_ORG}" organization`,
+        "Contact organization admin if you need access"
+      ]
+    );
+  }
+  cachedAdminUser = username;
+  return username;
+}
+function clearAdminAuthCache() {
+  cachedAdminUser = null;
+}
+
+// src/utils/license/index.ts
+var TRUSTED_ORG = "r06-dev";
+var logger2 = createCLILogger$1("license");
+function isTrustedOrg(owner) {
+  return owner.toLowerCase() === TRUSTED_ORG.toLowerCase();
+}
+async function checkLicense() {
+  if (process.env.RUNA_SKIP_LICENSE_CHECK === "1") {
+    if (isCI()) {
+      logger2.warn("[license] RUNA_SKIP_LICENSE_CHECK is ignored in CI environments");
+    } else {
+      return { allowed: true, reason: "skip-flag" };
+    }
+  }
+  if (!isCI()) {
+    return { allowed: true, reason: "not-ci" };
+  }
+  const result = await resolveGitHubOwner();
+  if (!result?.owner) {
+    logger2.warn("[license] Could not determine repository owner, denying access");
+    return { allowed: false, reason: "owner-resolution-failed" };
+  }
+  const owner = result.owner;
+  if (isTrustedOrg(owner)) {
+    return { allowed: true, reason: "trusted-org", owner };
+  }
+  logger2.debug(`[license] External org detected: ${owner}`);
+  try {
+    const isAllowed = await checkAllowlist(owner);
+    if (isAllowed) {
+      return { allowed: true, reason: "allowlist", owner };
+    }
+    return { allowed: false, reason: "not-found", owner };
+  } catch (error) {
+    logger2.debug(`[license] Allowlist check failed with no fallback: ${error}`);
+    return { allowed: false, reason: "error", owner };
+  }
+}
+async function enforceLicenseInCI() {
+  const result = await checkLicense();
+  if (!result.allowed) {
+    throw createError("LICENSE_UNAUTHORIZED", { owner: result.owner ?? "unknown" });
+  }
+}
+
+export { checkAllowlist, checkLicense, clearAdminAuthCache, clearAllowlistCache, detectCI, detectCIProvider, enforceLicenseInCI, getAllowlistCacheStats, getGitHubUserEmail, isCI, isValidOwner, resolveGitHubOwner, validateOwner, verifyAdminAuth };

package/dist/link-C43JRZWY.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { emitJsonSuccess } from './chunk-UU55OH7P.js';
+import './chunk-RRGQCUKT.js';
+import './chunk-JT5SUTWE.js';
+import './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { createCLILogger, CLIError } from '@runa-ai/runa/cli-runtime';
+import { linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema } from '@runa-ai/runa/link';
+import { Command } from 'commander';
+
+createRequire(import.meta.url);
+
+// src/commands/link.ts
+init_esm_shims();
+var linkCommand = new Command("link").description("Link runa CLI globally (enables `runa` command everywhere)").action(async () => {
+  const logger = createCLILogger("link");
+  logger.section("Global CLI Linking");
+  try {
+    const result = await linkCliGlobally({ targetDir: process.cwd() });
+    if (process.env.RUNA_OUTPUT_FORMAT !== "json") {
+      logger.info(result.isRunaRepo ? "Detected: runa-repo (development)" : "Detected: pj-repo");
+      logger.success("runa CLI linked successfully");
+      logger.info("To unlink: runa unlink");
+    }
+    emitJsonSuccess(linkCommand, LinkCliOutputSchema, result);
+  } catch (error) {
+    throw new CLIError(
+      `Failed to link runa CLI: ${error instanceof Error ? error.message : "Unknown error"}`,
+      "LINK_FAILED",
+      [
+        "Manual linking:",
+        "  1. cd packages/cli (or node_modules/@runa-ai/runa-cli)",
+        "  2. pnpm link --global"
+      ],
+      error instanceof Error ? error : void 0
+    );
+  }
+});
+var unlinkCommand = new Command("unlink").description("Unlink runa CLI globally (removes `runa` command)").action(async () => {
+  const logger = createCLILogger("unlink");
+  logger.section("Global CLI Unlinking");
+  try {
+    const result = await unlinkCliGlobally();
+    if (process.env.RUNA_OUTPUT_FORMAT !== "json") {
+      logger.success("runa CLI unlinked successfully");
+      logger.info("To re-link: runa link");
+    }
+    emitJsonSuccess(unlinkCommand, UnlinkCliOutputSchema, result);
+  } catch (error) {
+    throw new CLIError(
+      `Failed to unlink runa CLI: ${error instanceof Error ? error.message : "Unknown error"}`,
+      "UNLINK_FAILED",
+      ["Check pnpm installation", "Try: pnpm unlink --global @runa-ai/runa-cli"],
+      error instanceof Error ? error : void 0
+    );
+  }
+});
+
+export { linkCommand, unlinkCommand };

package/dist/manifest-2NOQ2IMK.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { injectTestAttrsAction } from './chunk-P7U52PBY.js';
+import './chunk-DRSUEMAK.js';
+import './chunk-UU55OH7P.js';
+import './chunk-RRGQCUKT.js';
+import './chunk-JT5SUTWE.js';
+import './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { Command } from 'commander';
+
+createRequire(import.meta.url);
+
+// src/commands/manifest/index.ts
+init_esm_shims();
+var manifestCommand = new Command("manifest").description("Generate E2E manifest (manifest.json) - alias for inject-test-attrs").option("--check", "Check if manifest needs regeneration (CI mode)").option("--force", "Force regeneration even if up-to-date").option("--verbose", "Show detailed output").option("--include <patterns...>", "Glob patterns to include", [
+  "apps/**/*.tsx",
+  "apps/**/*.ts",
+  "packages/**/*.tsx",
+  "packages/**/*.ts"
+]).option("--exclude <patterns...>", "Glob patterns to exclude", [
+  "**/node_modules/**",
+  "**/.next/**",
+  "**/dist/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/*.stories.*"
+]).option("--no-manifest", "Skip manifest file generation (attributes only)").option("--manifest-dir <dir>", "Output directory for manifest files", ".runa").option("--strict-detect", "Fail when fallback machine detection is used (for deterministic CI)").action(async (options) => {
+  await injectTestAttrsAction(options, manifestCommand);
+});
+
+export { manifestCommand };