@runa-ai/runa-cli 0.5.72 → 0.6.0

package/dist/workflow-ZB5Q2PFY.js

@@ -0,0 +1,898 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { detectDatabaseStack, getStackPaths } from './chunk-CCKG5R4Y.js';
+import { loadRunaConfig, getAppConfig } from './chunk-5NKWR4FF.js';
+import { detectEnvironment } from './chunk-JMJP4A47.js';
+import { emitJsonSuccess } from './chunk-UU55OH7P.js';
+import './chunk-RRGQCUKT.js';
+import './chunk-JT5SUTWE.js';
+import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
+import { init_esm_shims } from './chunk-VRXHCR5K.js';
+import { Command } from 'commander';
+import { CLIError, deploySchemaToProduction, createCLILogger, WorkflowNotifyOutputSchema, devopsSync, DevOpsSyncOutputSchema, workflowSync, WorkflowSyncOutputSchema, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, workflowNotify } from '@runa-ai/runa';
+import { z } from 'zod';
+import { appendFile } from 'fs/promises';
+
+createRequire(import.meta.url);
+
+// src/commands/workflow/index.ts
+init_esm_shims();
+
+// src/commands/workflow/commands/deploy-production.ts
+init_esm_shims();
+var DeployProductionOutputSchema = z.object({
+  stepsCompleted: z.array(z.string()).min(1)
+});
+var deployProductionCommand = new Command("deploy-production").description("Deploy schema to production database (unified command)").requiredOption(
+  "--db-url <url>",
+  "Production database URL (admin/DDL)",
+  process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL
+).option("--skip-validation", "Skip schema validation (not recommended)", false).option("--skip-risk-detection", "Skip risk detection (not recommended)", false).option("--max-retries <number>", "Maximum retry attempts for schema application", "3").action(
+  async (options) => {
+    try {
+      if (!options.dbUrl) {
+        throw new CLIError("Production database URL not provided", "PRODUCTION_DB_URL_MISSING", [
+          "Set GH_DATABASE_URL_ADMIN environment variable (recommended for DDL)",
+          "Or set GH_DATABASE_URL environment variable",
+          "Or use --db-url <url>"
+        ]);
+      }
+      const config = {
+        productionDatabaseUrl: options.dbUrl,
+        skipValidation: options.skipValidation,
+        skipRiskDetection: options.skipRiskDetection,
+        maxRetries: options.maxRetries ? Number.parseInt(options.maxRetries, 10) : 3
+      };
+      const result = await deploySchemaToProduction(config);
+      emitJsonSuccess(deployProductionCommand, DeployProductionOutputSchema, result);
+    } catch (error) {
+      if (error instanceof CLIError) {
+        throw error;
+      }
+      throw new CLIError(
+        "Production deployment error",
+        "PRODUCTION_DEPLOY_ERROR",
+        ["Check error details above", "Review deployment logs"],
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+);
+
+// src/commands/workflow/commands/final-status.ts
+init_esm_shims();
+var JobResultSchema = z.enum(["success", "failure", "cancelled", "skipped"]);
+var FinalStatusSchema = z.enum(["success", "failure", "cancelled"]);
+var WorkflowFinalStatusOutputSchema = z.object({
+  status: FinalStatusSchema,
+  errorMessage: z.string(),
+  cleanupResult: JobResultSchema.optional()
+}).strict();
+async function writeGitHubOutput(values) {
+  const outFile = process.env.GITHUB_OUTPUT;
+  if (!outFile) {
+    throw new CLIError(
+      "GITHUB_OUTPUT is not set",
+      "GITHUB_OUTPUT_MISSING",
+      ["Run in GitHub Actions or set GITHUB_OUTPUT to a file path"],
+      void 0,
+      2
+    );
+  }
+  const lines = Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n");
+  await appendFile(outFile, `${lines}
+`, "utf-8");
+}
+function parseJobResult(name, raw) {
+  const value = (raw || "").trim();
+  const parsed = JobResultSchema.safeParse(value);
+  if (parsed.success) return parsed.data;
+  throw new CLIError(
+    `${name} is required and must be one of: success, failure, cancelled, skipped`,
+    "WORKFLOW_FINAL_STATUS_INVALID_INPUT",
+    [`Set ${name} env var from needs.<job>.result`],
+    void 0,
+    2
+  );
+}
+function computeFinalStatus(params) {
+  if (params.deployPreview === "failure" || params.integrationTests === "failure") {
+    return {
+      status: "failure",
+      errorMessage: `One or more jobs failed. View logs: ${params.serverUrl}/${params.repo}/actions/runs/${params.runId}`,
+      cleanupResult: params.cleanup
+    };
+  }
+  if (params.deployPreview === "cancelled" || params.integrationTests === "cancelled") {
+    return {
+      status: "cancelled",
+      errorMessage: "Workflow was cancelled",
+      cleanupResult: params.cleanup
+    };
+  }
+  return {
+    status: "success",
+    errorMessage: "",
+    cleanupResult: params.cleanup
+  };
+}
+var workflowFinalStatusCommand = new Command("final-status").description("Aggregate job results into a final workflow status (GitHub Actions helper)").option("--github-output", "Write outputs to $GITHUB_OUTPUT (GitHub Actions)", false).action(async (options) => {
+  const deployPreview = parseJobResult(
+    "DEPLOY_PREVIEW_RESULT",
+    process.env.DEPLOY_PREVIEW_RESULT
+  );
+  const integrationTests = parseJobResult(
+    "INTEGRATION_TESTS_RESULT",
+    process.env.INTEGRATION_TESTS_RESULT
+  );
+  const cleanupRaw = (process.env.CLEANUP_RESULT || "").trim();
+  const cleanup = cleanupRaw.length > 0 ? parseJobResult("CLEANUP_RESULT", cleanupRaw) : void 0;
+  const repo = (process.env.GITHUB_REPOSITORY || "").trim();
+  const runId = (process.env.GITHUB_RUN_ID || "").trim();
+  const serverUrl = (process.env.GITHUB_SERVER_URL || "").trim();
+  if (!repo || !runId || !serverUrl) {
+    throw new CLIError(
+      "GITHUB_REPOSITORY, GITHUB_RUN_ID, and GITHUB_SERVER_URL are required",
+      "WORKFLOW_FINAL_STATUS_MISSING_GITHUB_ENV",
+      ["Run in GitHub Actions context"],
+      void 0,
+      2
+    );
+  }
+  const out = computeFinalStatus({
+    deployPreview,
+    integrationTests,
+    cleanup,
+    repo,
+    runId,
+    serverUrl
+  });
+  if (options.githubOutput === true) {
+    await writeGitHubOutput({ status: out.status, error_message: out.errorMessage });
+  }
+  if (getOutputFormatFromEnv() === "json") {
+    emitJsonSuccess(workflowFinalStatusCommand, WorkflowFinalStatusOutputSchema, out);
+  }
+});
+
+// src/commands/workflow/commands/log.ts
+init_esm_shims();
+var LOG_EVENTS = [
+  "schema-consistency:start",
+  "schema-management:start",
+  "db-roles:start",
+  "seed-apply:start",
+  "seed-verify:start",
+  "infra-complete:start"
+];
+function parseLogEvent(value) {
+  const trimmed = value.trim();
+  const found = LOG_EVENTS.find((e) => e === trimmed);
+  if (found) return found;
+  throw new CLIError(
+    `Unknown workflow log event: ${trimmed}`,
+    "WORKFLOW_LOG_UNKNOWN_EVENT",
+    [
+      `Allowed events: ${LOG_EVENTS.join(", ")}`,
+      "Use `runa workflow log <event>` with one of the supported values"
+    ],
+    void 0,
+    2
+  );
+}
+function printSection(title) {
+  process.stdout.write("\n");
+  process.stdout.write("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n");
+  process.stdout.write(`${title}
+`);
+  process.stdout.write("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n");
+  process.stdout.write("\n");
+}
+function printLines(lines) {
+  for (const line of lines) {
+    process.stdout.write(`${line}
+`);
+  }
+}
+function handleLogEvent(event) {
+  switch (event) {
+    case "schema-consistency:start": {
+      printSection("\u{1F50D} Schema Consistency Validation");
+      printLines([
+        "   Validating Drizzle schema files...",
+        "   Checks:",
+        "     1. pgEnum usage requires pgEnum import",
+        "     2. No schema.enum() pattern (incompatible with drizzle-kit)",
+        "     3. biome-ignore comments present",
+        "     4. Naming conventions (snake_case)",
+        ""
+      ]);
+      return;
+    }
+    case "schema-management:start": {
+      printSection("\u{1F535} Schema Management");
+      printLines([
+        "   Stack: SQL-First Architecture (pg-schema-diff)",
+        "   Operation: SQL Schema Sync",
+        "   Method: SQL schema \u2192 pg-schema-diff \u2192 Apply \u2192 TypeScript gen",
+        "   Process:",
+        "     1. Read SQL schemas (supabase/schemas/declarative/*.sql)",
+        "     2. Compare with current DB state via pg-schema-diff",
+        "     3. Apply incremental changes",
+        "     4. Generate TypeScript via drizzle-kit introspect",
+        "",
+        "\u{1F527} Applying schema changes (via runa CLI)...",
+        ""
+      ]);
+      return;
+    }
+    case "db-roles:start": {
+      printSection("\u{1F510} Setting up DB roles (drizzle_app)");
+      printLines([
+        "   - Creates drizzle_app (DML-only) + grants privileges",
+        "   - Ensures app DATABASE_URL can safely use restricted role",
+        ""
+      ]);
+      return;
+    }
+    case "seed-apply:start": {
+      printSection("\u{1F331} Auto-Generated Seed Application");
+      printLines([
+        "   Environment: preview (minimal CI test data)",
+        "   Method: TypeScript \u2192 SQL (auto-generated)",
+        "   Purpose: Provide test data for E2E tests",
+        "",
+        "   \u{1F4DD} Seed was auto-generated by db:sync",
+        "      Location: supabase/seeds/preview.sql",
+        "      Generator: packages/database/scripts/generate-seeds.ts",
+        "",
+        "\u{1F527} Applying preview seed data...",
+        ""
+      ]);
+      return;
+    }
+    case "seed-verify:start": {
+      process.stdout.write("\u{1F527} Running seed verification (via runa CLI)...\n");
+      return;
+    }
+    case "infra-complete:start": {
+      printSection("\u2705 Infrastructure Setup Complete");
+      return;
+    }
+  }
+}
+var workflowLogCommand = new Command("log").description("Print standardized workflow log messages (no side effects)").argument("<event>", "Event name (e.g., schema-management:start)").action((eventRaw) => {
+  const event = parseLogEvent(eventRaw);
+  handleLogEvent(event);
+});
+
+// src/commands/workflow/commands/notify.ts
+init_esm_shims();
+async function sendNotification(config, logger) {
+  logger.debug(`Sending notification to ${config.runaAppUrl}`);
+  logger.debug(`Event type: ${config.eventType ?? "runa-workflow-update"}`);
+  logger.debug(`Status: ${config.status}`);
+  const result = await workflowNotify({
+    runaAppUrl: config.runaAppUrl,
+    apiToken: config.apiToken,
+    repositoryFullName: config.repositoryFullName,
+    prNumber: config.prNumber,
+    commitSha: config.commitSha,
+    status: config.status,
+    errorMessage: config.errorMessage,
+    eventType: config.eventType
+  });
+  if (result.success) logger.success(`Notification sent successfully (HTTP ${result.httpCode})`);
+  else logger.error(`Notification failed (HTTP ${result.httpCode})`);
+  return result;
+}
+var startCommand = new Command("start").description("Notify runa-app of workflow start").requiredOption("--url <url>", "runa-app webhook URL", process.env.RUNA_APP_URL).requiredOption("--token <token>", "runa-app API token", process.env.RUNA_APP_API_TOKEN).requiredOption(
+  "--repo <name>",
+  "Repository full name (owner/repo)",
+  process.env.GITHUB_REPOSITORY
+).requiredOption("--pr <number>", "Pull request number").requiredOption("--sha <sha>", "Commit SHA").action(
+  async (options) => {
+    const logger = createCLILogger("workflow:notify:start");
+    try {
+      if (!options.url) {
+        throw new CLIError("runa-app URL not provided", "RUNA_APP_URL_MISSING", [
+          "Set RUNA_APP_URL environment variable",
+          "Or use --url <url>"
+        ]);
+      }
+      if (!options.token) {
+        throw new CLIError("runa-app API token not provided", "RUNA_APP_TOKEN_MISSING", [
+          "Set RUNA_APP_API_TOKEN environment variable",
+          "Or use --token <token>"
+        ]);
+      }
+      if (!options.repo || !options.pr || !options.sha) {
+        throw new CLIError("Missing required parameters", "REQUIRED_PARAMS_MISSING", [
+          "Provide --repo <owner/repo>",
+          "Provide --pr <number>",
+          "Provide --sha <sha>"
+        ]);
+      }
+      const config = {
+        runaAppUrl: options.url,
+        apiToken: options.token,
+        repositoryFullName: options.repo,
+        prNumber: Number.parseInt(options.pr, 10),
+        commitSha: options.sha,
+        status: "in_progress"
+      };
+      const result = await sendNotification(config, logger);
+      emitJsonSuccess(startCommand, WorkflowNotifyOutputSchema, result);
+      if (!result.success) {
+        throw new CLIError("Failed to send workflow start notification", "NOTIFICATION_FAILED", [
+          "Check runa-app URL is accessible",
+          "Verify API token is valid",
+          "Check network connectivity"
+        ]);
+      }
+    } catch (error) {
+      if (error instanceof CLIError) {
+        throw error;
+      }
+      throw new CLIError(
+        "Workflow start notification error",
+        "NOTIFICATION_ERROR",
+        ["Check error details above", "Verify all parameters are correct"],
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+);
+var completeCommand = new Command("complete").description("Notify runa-app of workflow completion").requiredOption("--url <url>", "runa-app webhook URL", process.env.RUNA_APP_URL).requiredOption("--token <token>", "runa-app API token", process.env.RUNA_APP_API_TOKEN).requiredOption(
+  "--repo <name>",
+  "Repository full name (owner/repo)",
+  process.env.GITHUB_REPOSITORY
+).requiredOption("--pr <number>", "Pull request number").requiredOption("--sha <sha>", "Commit SHA").requiredOption(
+  "--status <status>",
+  "Workflow status (success, failure, cancelled)",
+  process.env.WORKFLOW_STATUS
+).option("--error <message>", "Error message (for failures)", process.env.ERROR_MESSAGE).action(
+  async (options) => {
+    const logger = createCLILogger("workflow:notify:complete");
+    try {
+      if (!options.url) {
+        throw new CLIError("runa-app URL not provided", "RUNA_APP_URL_MISSING", [
+          "Set RUNA_APP_URL environment variable",
+          "Or use --url <url>"
+        ]);
+      }
+      if (!options.token) {
+        throw new CLIError("runa-app API token not provided", "RUNA_APP_TOKEN_MISSING", [
+          "Set RUNA_APP_API_TOKEN environment variable",
+          "Or use --token <token>"
+        ]);
+      }
+      if (!options.repo || !options.pr || !options.sha || !options.status) {
+        throw new CLIError("Missing required parameters", "REQUIRED_PARAMS_MISSING", [
+          "Provide --repo <owner/repo>",
+          "Provide --pr <number>",
+          "Provide --sha <sha>",
+          "Provide --status <status>"
+        ]);
+      }
+      const validStatuses = ["success", "failure", "cancelled"];
+      if (!validStatuses.includes(options.status)) {
+        throw new CLIError("Invalid workflow status", "INVALID_STATUS", [
+          "Status must be one of: success, failure, cancelled"
+        ]);
+      }
+      const config = {
+        runaAppUrl: options.url,
+        apiToken: options.token,
+        repositoryFullName: options.repo,
+        prNumber: Number.parseInt(options.pr, 10),
+        commitSha: options.sha,
+        status: options.status,
+        errorMessage: options.error
+      };
+      const result = await sendNotification(config, logger);
+      emitJsonSuccess(completeCommand, WorkflowNotifyOutputSchema, result);
+      if (!result.success) {
+        throw new CLIError(
+          "Failed to send workflow completion notification",
+          "NOTIFICATION_FAILED",
+          [
+            "Check runa-app URL is accessible",
+            "Verify API token is valid",
+            "Check network connectivity"
+          ]
+        );
+      }
+    } catch (error) {
+      if (error instanceof CLIError) {
+        throw error;
+      }
+      throw new CLIError(
+        "Workflow completion notification error",
+        "NOTIFICATION_ERROR",
+        ["Check error details above", "Verify all parameters are correct"],
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+);
+var deploymentCommand = new Command("deployment").description("Notify runa-app of deployment event (production schema, etc.)").requiredOption("--url <url>", "runa-app webhook URL", process.env.RUNA_APP_URL).requiredOption("--token <token>", "runa-app API token", process.env.RUNA_APP_API_TOKEN).requiredOption(
+  "--repo <name>",
+  "Repository full name (owner/repo)",
+  process.env.GITHUB_REPOSITORY
+).requiredOption("--sha <sha>", "Commit SHA").requiredOption(
+  "--status <status>",
+  "Deployment status (success, failure, cancelled)",
+  process.env.JOB_STATUS
+).option("--error <message>", "Error message (for failures)", process.env.ERROR_MESSAGE).option("--type <type>", "Deployment type (e.g., production-schema)", "production-schema").action(
+  async (options) => {
+    const logger = createCLILogger("workflow:notify:deployment");
+    try {
+      if (!options.url) {
+        throw new CLIError("runa-app URL not provided", "RUNA_APP_URL_MISSING", [
+          "Set RUNA_APP_URL environment variable",
+          "Or use --url <url>"
+        ]);
+      }
+      if (!options.token) {
+        throw new CLIError("runa-app API token not provided", "RUNA_APP_TOKEN_MISSING", [
+          "Set RUNA_APP_API_TOKEN environment variable",
+          "Or use --token <token>"
+        ]);
+      }
+      if (!options.repo || !options.sha || !options.status) {
+        throw new CLIError("Missing required parameters", "REQUIRED_PARAMS_MISSING", [
+          "Provide --repo <owner/repo>",
+          "Provide --sha <sha>",
+          "Provide --status <status>"
+        ]);
+      }
+      const validStatuses = ["success", "failure", "cancelled"];
+      if (!validStatuses.includes(options.status)) {
+        throw new CLIError("Invalid deployment status", "INVALID_STATUS", [
+          "Status must be one of: success, failure, cancelled"
+        ]);
+      }
+      const config = {
+        runaAppUrl: options.url,
+        apiToken: options.token,
+        repositoryFullName: options.repo,
+        commitSha: options.sha,
+        status: options.status,
+        errorMessage: options.error,
+        eventType: "runa-deployment"
+      };
+      const result = await sendNotification(config, logger);
+      emitJsonSuccess(deploymentCommand, WorkflowNotifyOutputSchema, result);
+      if (!result.success) {
+        throw new CLIError("Failed to send deployment notification", "NOTIFICATION_FAILED", [
+          "Check runa-app URL is accessible",
+          "Verify API token is valid",
+          "Check network connectivity"
+        ]);
+      }
+    } catch (error) {
+      if (error instanceof CLIError) {
+        throw error;
+      }
+      throw new CLIError(
+        "Deployment notification error",
+        "NOTIFICATION_ERROR",
+        ["Check error details above", "Verify all parameters are correct"],
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+);
+var notifyCommand = new Command("notify").description("Notify runa-app of workflow events").addCommand(startCommand).addCommand(completeCommand).addCommand(deploymentCommand);
+
+// src/commands/workflow/commands/paths.ts
+init_esm_shims();
+var WorkflowPathsOutputSchema = z.object({
+  appDir: z.string().min(1),
+  dbStack: z.enum(["drizzle", "supabase"]),
+  dbRoot: z.string().min(1)
+}).strict();
+async function writeGitHubOutput2(values) {
+  const outFile = process.env.GITHUB_OUTPUT;
+  if (!outFile) {
+    throw new CLIError(
+      "GITHUB_OUTPUT is not set",
+      "GITHUB_OUTPUT_MISSING",
+      ["Run in GitHub Actions or set GITHUB_OUTPUT to a file path"],
+      void 0,
+      2
+    );
+  }
+  const lines = Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n");
+  await appendFile(outFile, `${lines}
+`, "utf-8");
+}
+var workflowPathsCommand = new Command("paths").description("Detect project paths for GitHub Actions (app dir / db stack / db root)").option("--github-output", "Write outputs to $GITHUB_OUTPUT (GitHub Actions)", false).action(async (options) => {
+  try {
+    const config = loadRunaConfig(process.cwd());
+    const app = getAppConfig(config);
+    const stackResult = await detectDatabaseStack();
+    const paths = await getStackPaths(stackResult.stack);
+    const out = {
+      appDir: app.directory || ".",
+      dbStack: stackResult.stack,
+      dbRoot: paths.rootDir
+    };
+    if (options.githubOutput === true) {
+      await writeGitHubOutput2({
+        app_dir: out.appDir,
+        db_stack: out.dbStack,
+        db_root: out.dbRoot
+      });
+    }
+    if (getOutputFormatFromEnv() === "json") {
+      emitJsonSuccess(workflowPathsCommand, WorkflowPathsOutputSchema, out);
+      return;
+    }
+  } catch (error) {
+    if (error instanceof CLIError) throw error;
+    throw new CLIError(
+      error instanceof Error ? error.message : "Failed to detect workflow paths",
+      "WORKFLOW_PATHS_FAILED",
+      [
+        "Ensure runa.config.ts exists",
+        "Run: runa init",
+        "Run: runa db detect-stack (to verify database structure)"
+      ],
+      error instanceof Error ? error : void 0,
+      1
+    );
+  }
+});
+
+// src/commands/workflow/commands/sync.ts
+init_esm_shims();
+function isRunaRepo() {
+  const env = detectEnvironment();
+  return env === "runa-repo";
+}
+var checkCommand = new Command("check").description("Check if files match SDK templates (for pre-commit)").option("--strict", "Exit with error if out of sync (runa-repo)", false).option("--all", "Check all distributed files (workflows/actions/zap/seeds)", false).option("--seeds", "Check database seed infrastructure files", false).action(async (options) => {
+  const logger = createCLILogger("workflow:check");
+  try {
+    await handleWorkflowCheck({ options, logger });
+  } catch (error) {
+    if (error instanceof CLIError) {
+      throw error;
+    }
+    throw new CLIError(
+      "Workflow check failed",
+      "WORKFLOW_CHECK_FAILED",
+      ["Check error details above", "Verify @runa-ai/runa is installed"],
+      error instanceof Error ? error : void 0
+    );
+  }
+});
+var syncCommand = new Command("sync").description("Sync SDK templates to project").option("--check", "Check sync status without modifying files", false).option("--all", "Sync all distributed files (workflows/actions/zap/seeds)", false).option("--seeds", "Sync database seed infrastructure files", false).action(async (options) => {
+  const logger = createCLILogger("workflow:sync");
+  try {
+    await handleWorkflowSync({ options, logger });
+  } catch (error) {
+    if (error instanceof CLIError) {
+      throw error;
+    }
+    throw new CLIError(
+      "Workflow sync operation failed",
+      "WORKFLOW_SYNC_OPERATION_FAILED",
+      ["Check error details above", "Verify @runa-ai/runa is installed"],
+      error instanceof Error ? error : void 0
+    );
+  }
+});
+async function handleWorkflowCheck(params) {
+  const isRuna = isRunaRepo();
+  const strict = params.options.strict ?? isRuna;
+  const all = params.options.all === true;
+  const seeds = params.options.seeds === true;
+  const target = all ? "all" : seeds ? "database:seeds" : "workflow:runa";
+  if (all || seeds) {
+    await handleDevOpsCheckAll({ isRuna, strict, target, logger: params.logger });
+    return;
+  }
+  await handleWorkflowCheckSingle({ isRuna, strict, logger: params.logger });
+}
+async function handleDevOpsCheckAll(params) {
+  const result = await devopsSync({
+    mode: "check",
+    target: params.target,
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd(),
+    strict: params.strict
+  });
+  emitJsonSuccess(checkCommand, DevOpsSyncOutputSchema, result);
+  if (result.inSync) {
+    params.logger.success("Files match templates");
+    return;
+  }
+  params.logger.warn("Files differ from templates");
+  if (params.strict) {
+    throw new CLIError("Files out of sync", "FILES_OUT_OF_SYNC", [
+      `Run: runa workflow sync --${params.target === "database:seeds" ? "seeds" : "all"}`,
+      "To sync with latest templates"
+    ]);
+  }
+}
+async function handleWorkflowCheckSingle(params) {
+  const result = await workflowSync({
+    mode: "check",
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd(),
+    strict: params.strict
+  });
+  emitJsonSuccess(checkCommand, WorkflowSyncOutputSchema, result);
+  if (result.inSync) {
+    params.logger.success("Workflow matches template");
+    return;
+  }
+  params.logger.warn("Workflow differs from template");
+  if (params.strict) {
+    throw new CLIError("Workflow out of sync", "WORKFLOW_OUT_OF_SYNC", [
+      "Run: runa workflow sync",
+      "Or update template in packages/sdk/templates/.github/workflows/runa.yml"
+    ]);
+  }
+}
+async function handleWorkflowSync(params) {
+  const isRuna = isRunaRepo();
+  const all = params.options.all === true;
+  const seeds = params.options.seeds === true;
+  const target = all ? "all" : seeds ? "database:seeds" : "workflow:runa";
+  if (params.options.check) {
+    if (all || seeds) {
+      await handleDevOpsCheckForSync({ isRuna, target, logger: params.logger });
+      return;
+    }
+    await handleWorkflowCheckSingleForSync({ isRuna, logger: params.logger });
+    return;
+  }
+  if (all || seeds) {
+    await handleDevOpsSyncTarget({ isRuna, target, logger: params.logger });
+    return;
+  }
+  await handleWorkflowSyncSingle({ isRuna, logger: params.logger });
+}
+async function handleDevOpsCheckForSync(params) {
+  const result = await devopsSync({
+    mode: "check",
+    target: params.target,
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd()
+  });
+  emitJsonSuccess(syncCommand, DevOpsSyncOutputSchema, result);
+  if (result.inSync) {
+    params.logger.success("Files match templates");
+    return;
+  }
+  throw new CLIError("Files out of sync", "FILES_OUT_OF_SYNC", [
+    `Run: runa workflow sync --${params.target === "database:seeds" ? "seeds" : "all"}`,
+    "To sync with latest templates"
+  ]);
+}
+async function handleWorkflowCheckSingleForSync(params) {
+  const result = await workflowSync({
+    mode: "check",
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd()
+  });
+  emitJsonSuccess(syncCommand, WorkflowSyncOutputSchema, result);
+  if (result.inSync) {
+    params.logger.success("Workflow matches template");
+    return;
+  }
+  throw new CLIError("Workflow out of sync", "WORKFLOW_OUT_OF_SYNC", [
+    "Run: runa workflow sync",
+    "To sync with latest template"
+  ]);
+}
+async function handleDevOpsSyncTarget(params) {
+  const result = await devopsSync({
+    mode: "sync",
+    target: params.target,
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd()
+  });
+  emitJsonSuccess(syncCommand, DevOpsSyncOutputSchema, result);
+  params.logger.success("Files synced successfully");
+  params.logger.info(`Files: ${result.files.length}`);
+  const created = result.files.filter((f) => f.action === "created");
+  const updated = result.files.filter((f) => f.action === "updated");
+  if (created.length > 0) {
+    params.logger.info(`Created: ${created.length}`);
+  }
+  if (updated.length > 0) {
+    params.logger.info(`Updated: ${updated.length}`);
+  }
+}
+async function handleWorkflowSyncSingle(params) {
+  const result = await workflowSync({
+    mode: "sync",
+    isRunaRepo: params.isRuna,
+    targetDir: process.cwd()
+  });
+  emitJsonSuccess(syncCommand, WorkflowSyncOutputSchema, result);
+  if (result.inSync) {
+    params.logger.success("Workflow synced successfully");
+    params.logger.info(`Template: ${result.templatePath}`);
+    params.logger.info(`Target: ${result.targetPath}`);
+    return;
+  }
+  throw new CLIError("Workflow sync failed", "WORKFLOW_SYNC_FAILED", [
+    "Check error details above",
+    "Verify file permissions"
+  ]);
+}
+
+// src/commands/workflow/commands/validate.ts
+init_esm_shims();
+function parseValidateOptions(options) {
+  if (!options.previewUrl) {
+    throw new CLIError("Preview URL must be provided", "VALIDATION_NO_URLS", [
+      "Use --preview-url <url>",
+      "Or set PREVIEW_URL environment variable"
+    ]);
+  }
+  return {
+    previewUrl: options.previewUrl,
+    maxRetries: options.maxRetries ? Number.parseInt(options.maxRetries, 10) : 5,
+    retryDelaySeconds: options.retryDelay ? Number.parseInt(options.retryDelay, 10) : 15
+  };
+}
+function toFailureDetails(result) {
+  const details = [];
+  if (result.previewUrl && !result.previewUrl.valid) {
+    details.push(`previewUrl: ${result.previewUrl.error ?? "Invalid"}`);
+  }
+  return details;
+}
+var validateCommand = new Command("validate").description("Validate infrastructure setup (Preview URL accessibility)").option("--preview-url <url>", "Preview URL to validate", process.env.PREVIEW_URL).option("--max-retries <n>", "Max retries for accessibility check", "5").option("--retry-delay <seconds>", "Delay between retries (seconds)", "15").option("--report-json <path>", "Export report to JSON file").action(async (options) => {
+  const logger = createCLILogger("workflow:validate");
+  const startTime = Date.now();
+  const ci = process.env.CI === "true";
+  const command = "runa workflow validate";
+  try {
+    const config = parseValidateOptions(options);
+    logger.section("Infrastructure Validation");
+    const result = await validateInfrastructure(config);
+    const totalDurationMs = Date.now() - startTime;
+    const stages = [];
+    if (config.previewUrl) {
+      stages.push({
+        name: "previewUrl",
+        status: result.previewUrl?.valid ? "passed" : "failed",
+        durationMs: 0,
+        errorDetails: result.previewUrl?.error
+      });
+    }
+    if (!result.valid) {
+      const details = toFailureDetails(result);
+      const failedStages = stages.filter((s) => s.status === "failed").map((s) => s.name);
+      emitWorkflowValidateFailureCapsule({
+        command,
+        ci,
+        failedStages,
+        errorDetails: details.join("\n")
+      });
+      emitWorkflowAnnotations({
+        command,
+        success: false,
+        failedStages
+      });
+      writeWorkflowValidateStepSummary({
+        command,
+        ci,
+        totalDurationMs,
+        stages,
+        success: false,
+        reportJsonPath: options.reportJson
+      });
+      if (options.reportJson) {
+        exportWorkflowReportJson({
+          command,
+          domain: "workflow",
+          tier: "validate",
+          ci,
+          totalDurationMs,
+          stages: stages.map((s) => ({
+            name: s.name,
+            status: s.status,
+            durationMs: s.durationMs,
+            errorDetails: s.errorDetails
+          })),
+          success: false,
+          filePath: options.reportJson
+        });
+      }
+      throw new CLIError("Infrastructure validation failed", "VALIDATION_FAILED", [
+        ...details.map((d) => `Fix: ${d}`),
+        "Fix infrastructure issues and retry"
+      ]);
+    }
+    writeWorkflowValidateStepSummary({
+      command,
+      ci,
+      totalDurationMs,
+      stages,
+      success: true,
+      reportJsonPath: options.reportJson
+    });
+    if (options.reportJson) {
+      exportWorkflowReportJson({
+        command,
+        domain: "workflow",
+        tier: "validate",
+        ci,
+        totalDurationMs,
+        stages: stages.map((s) => ({ name: s.name, status: s.status, durationMs: s.durationMs })),
+        success: true,
+        filePath: options.reportJson
+      });
+      logger.info(`\u{1F4CA} Report JSON: ${options.reportJson}`);
+    }
+    emitJsonSuccess(validateCommand, WorkflowValidateInfrastructureOutputSchema, result);
+    logger.success("Validation complete");
+  } catch (error) {
+    if (error instanceof CLIError) {
+      throw error;
+    }
+    throw new CLIError(
+      "Validation failed",
+      "VALIDATION_ERROR",
+      ["Check error details above", "Verify URLs are accessible"],
+      error instanceof Error ? error : void 0
+    );
+  }
+});
+
+// src/commands/workflow/commands/verify-credentials.ts
+init_esm_shims();
+function requireNonEmpty(name) {
+  const value = (process.env[name] || "").trim();
+  if (value.length > 0) return value;
+  throw new CLIError(
+    `${name} is required`,
+    "WORKFLOW_CREDENTIALS_MISSING",
+    [
+      `Ensure ${name} is set in the workflow step env`,
+      "Re-run workflow after fixing upstream step outputs"
+    ],
+    void 0,
+    1
+  );
+}
+var verifyCredentialsCommand = new Command("verify-credentials").description("Verify required workflow credentials are available (GitHub Actions helper)").option(
+  "--require <NAME>",
+  "Additional required environment variable name (repeatable)",
+  (value, previous) => [...previous, value],
+  []
+).action(async (options) => {
+  const required = [
+    "SUPABASE_URL",
+    "SUPABASE_ANON_KEY",
+    "RUNA_PRIMARY_ROOT_ID",
+    ...options.require ?? []
+  ];
+  for (const key of required) {
+    requireNonEmpty(key);
+  }
+});
+
+// src/commands/workflow/index.ts
+var workflowCommand = new Command("workflow").description(
+  "GitHub Actions workflow utilities"
+);
+workflowCommand.addCommand(notifyCommand);
+workflowCommand.addCommand(syncCommand);
+workflowCommand.addCommand(checkCommand);
+workflowCommand.addCommand(workflowPathsCommand);
+workflowCommand.addCommand(verifyCredentialsCommand);
+workflowCommand.addCommand(workflowFinalStatusCommand);
+workflowCommand.addCommand(workflowLogCommand);
+workflowCommand.addCommand(validateCommand);
+workflowCommand.addCommand(deployProductionCommand);
+
+export { workflowCommand };