@runa-ai/runa-cli 0.5.72 → 0.7.0

package/dist/commands/db/apply/helpers/pg-schema-diff-patterns.d.ts

@@ -0,0 +1,55 @@
+/**
+ * AI HINT: pg-schema-diff Version-Sensitive Patterns
+ *
+ * Purpose: Centralize all regex patterns that depend on pg-schema-diff output format.
+ * When pg-schema-diff changes its output format, update ONLY this file.
+ *
+ * VERSION SENSITIVE: Tested against pg-schema-diff v0.9.x – v0.11.x
+ */
+/**
+ * Regex to detect statement index markers in plan output.
+ * VERSION SENSITIVE: pg-schema-diff v0.9.x uses "-- Statement Idx. N"
+ * Future versions may use different formats.
+ */
+export declare const STATEMENT_IDX_REGEX: RegExp;
+/**
+ * Test if a line is a statement index marker.
+ */
+export declare function isStatementMarker(line: string): boolean;
+/**
+ * Regex to parse hazard comments from plan output.
+ * VERSION SENSITIVE: pg-schema-diff v0.9.x uses "-- Hazard TYPE: message"
+ */
+export declare const HAZARD_REGEX: RegExp;
+/**
+ * Parse a hazard comment line. Returns null if not a hazard.
+ */
+export declare function parseHazardLine(line: string): {
+    type: string;
+    message: string;
+} | null;
+/**
+ * Map of type names to their required PostgreSQL extensions.
+ * VERSION SENSITIVE: pg-schema-diff reports these as type errors in shadow DB.
+ */
+export declare const EXTENSION_TYPE_MAP: Record<string, string>;
+/**
+ * Detect if a pg-schema-diff error is caused by a missing extension type.
+ * Returns the extension name if detected, null otherwise.
+ */
+export declare function detectExtensionTypeError(stderr: string): string | null;
+/**
+ * Regex to detect the pg-schema-diff partition privilege error.
+ * VERSION SENSITIVE: pg-schema-diff v1.0.5 uses this exact message.
+ */
+export declare const PARTITION_PRIVILEGE_ERROR_REGEX: RegExp;
+/**
+ * Check if a pg-schema-diff error is the known partition privilege limitation.
+ */
+export declare function isPartitionPrivilegeError(stderr: string): boolean;
+/**
+ * Check if stderr contains hazard-like content that wasn't parsed by the
+ * standard hazard regex. Used as a fallback warning mechanism.
+ */
+export declare function hasUnparsedHazardHints(stderr: string): boolean;
+//# sourceMappingURL=pg-schema-diff-patterns.d.ts.map

package/dist/commands/db/apply/helpers/pg-schema-diff-version.d.ts

@@ -0,0 +1,50 @@
+/**
+ * AI HINT: pg-schema-diff Version Detection & Compatibility
+ *
+ * Purpose: Detect installed pg-schema-diff version and enforce compatibility.
+ * In strict mode (production), incompatible/undetectable versions are blocked.
+ */
+/**
+ * Known compatible pg-schema-diff version range.
+ * Update this when testing against new pg-schema-diff releases.
+ */
+export declare const SUPPORTED_PG_SCHEMA_DIFF_VERSIONS: {
+    minMajor: number;
+    minMinor: number;
+    maxMajor: number;
+    maxMinor: number;
+};
+export interface PgSchemaDiffVersion {
+    raw: string;
+    major: number;
+    minor: number;
+    patch: number;
+}
+export interface VerifyPgSchemaDiffVersionOptions {
+    strict?: boolean;
+}
+/**
+ * Parse a version string into components.
+ * Supports formats:
+ *   - "v0.9.0", "0.10.1" (legacy --version output)
+ *   - "version=v1.0.5" (v1.x+ `version` subcommand output)
+ *   - "pg-schema-diff version v0.9.3" (verbose output)
+ */
+export declare function parseVersion(raw: string): PgSchemaDiffVersion | null;
+/**
+ * Check if a version is within the supported range.
+ */
+export declare function isVersionSupported(version: PgSchemaDiffVersion): boolean;
+/**
+ * Detect the installed pg-schema-diff version by running the binary.
+ * Tries `version` subcommand first (v1.x+), falls back to `--version` (v0.x).
+ * Returns null if the binary is not found or version cannot be parsed.
+ */
+export declare function detectPgSchemaDiffVersion(binaryPath: string): PgSchemaDiffVersion | null;
+/**
+ * Verify pg-schema-diff version compatibility.
+ * strict=true: throw on unknown/incompatible version (fail-closed).
+ * strict=false: warn only (best effort).
+ */
+export declare function verifyPgSchemaDiffVersion(binaryPath: string, options?: VerifyPgSchemaDiffVersionOptions): void;
+//# sourceMappingURL=pg-schema-diff-version.d.ts.map

package/dist/commands/db/apply/helpers/plan-validator.d.ts

@@ -36,6 +36,10 @@ export declare const ValidatedPlanSchema: z.ZodObject<{
     }, z.core.$strip>>;
     totalStatements: z.ZodNumber;
     rawSql: z.ZodString;
+    parseConfidence: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        low: "low";
+    }>>;
 }, z.core.$strip>;
 export type PlanHazard = z.infer<typeof PlanHazardSchema>;
 export type PlanStatement = z.infer<typeof PlanStatementSchema>;
@@ -54,16 +58,6 @@ export interface FilterResult {
     filteredPlan: ValidatedPlan;
     removedStatements: PlanStatement[];
 }
-/**
- * Check if a DROP statement targets a protected (idempotent-managed) table or index.
- *
- * Matching rules:
- * - DROP TABLE [IF EXISTS] schema.table → exact match or glob match
- * - DROP INDEX [IF EXISTS] schema.idx_* → index in same schema as protected table
- *
- * Glob support: patterns with `*` (e.g., `location_data.location_events_*`)
- * are converted to regex for matching partition child tables.
- */
 declare function isDropStatementForProtected(sql: string, protectedTables: string[]): boolean;
 /**
  * Check if a DROP FUNCTION/TRIGGER/VIEW/TYPE/SEQUENCE targets a protected object.

package/dist/commands/db/apply/helpers/rbac-password-manager.d.ts

@@ -0,0 +1,34 @@
+/**
+ * AI HINT: RBAC Role Password Manager
+ *
+ * Purpose: Set passwords for RBAC roles (drizzle_app, drizzle_service) by
+ * extracting credentials from DATABASE_URL and DATABASE_URL_SERVICE.
+ *
+ * 3-Role Architecture:
+ * - postgres: DDL (schema migrations via db sync/apply)
+ * - drizzle_app: DML + RLS enforced (user API requests)
+ * - drizzle_service: DML + RLS bypassed (webhooks, background jobs)
+ *
+ * Security:
+ * - Role names validated against alphanumeric pattern
+ * - Passwords passed via psql command (not in logs)
+ * - Same-password warning detects RBAC bypass risk
+ */
+/**
+ * Parse database URL credentials safely.
+ */
+export declare function parseDbCredentials(url: string): {
+    username: string;
+    password: string;
+} | null;
+/**
+ * Check if drizzle_app and postgres roles use the same password.
+ * Logs a warning if they do (security risk).
+ */
+export declare function checkPasswordSecurity(): void;
+/**
+ * Set passwords for RBAC roles by extracting from DATABASE_URL and DATABASE_URL_SERVICE.
+ * Returns the number of role passwords that were successfully set.
+ */
+export declare function setRolePasswords(dbUrl: string, verbose: boolean): number;
+//# sourceMappingURL=rbac-password-manager.d.ts.map

package/dist/commands/db/apply/helpers/retry-logic.d.ts

@@ -4,7 +4,7 @@
  * Purpose: Retry pg-schema-diff operations on lock_timeout errors
  * Pattern: Exponential backoff with jitter (configurable max delay)
  */
-import { type IdempotentProtectedObjects } from './pg-schema-diff-helpers.js';
+import type { IdempotentProtectedObjects } from './pg-schema-diff-helpers.js';
 export declare const MAX_RETRIES = 5;
 export declare const BASE_DELAY_MS = 1000;
 export declare const DEFAULT_MAX_DELAY_MS = 30000;
@@ -41,7 +41,16 @@ export declare function sleep(ms: number): Promise<void>;
  */
 export declare function calculateBackoffDelay(attempt: number, maxDelayMs?: number): number;
 /**
- * Check if error is a lock_timeout error.
+ * Check if error is a lock_timeout error (retryable DDL lock contention).
+ *
+ * Matches PostgreSQL error patterns for DDL lock failures:
+ * - "lock_timeout" — GUC name appearing in error context
+ * - "canceling statement due to lock timeout" — explicit lock timeout message
+ * - "could not obtain lock on relation" — DDL lock acquisition failure
+ * - "deadlock detected" — deadlock between concurrent DDL
+ *
+ * NOTE: "could not obtain lock" (without "on relation") is intentionally NOT matched
+ * because it can fire for advisory lock failures or other non-DDL lock types.
  */
 export declare function isLockTimeoutError(errorOutput: string): boolean;
 /**
@@ -79,6 +88,11 @@ export interface PlanSqlRetryConfig extends RetryConfig {
      * Extends table protection to functions, triggers, views, types, and sequences.
      */
     protectedObjects?: IdempotentProtectedObjects;
+    /**
+     * Fail-closed when plan parser confidence is low.
+     * Recommended for production to avoid executing ambiguous SQL plans.
+     */
+    failOnLowParseConfidence?: boolean;
 }
 /**
  * Execute plan SQL via psql with retry logic.

package/dist/commands/db/apply/helpers/shadow-db-manager.d.ts

@@ -79,5 +79,5 @@ export declare function createShadowDbWithExtensions(config: ShadowDbConfig): Pr
 /**
  * Check if shadow DB with extensions is needed based on config.
  */
-export declare function needsShadowDb(extensions: string[] | undefined): boolean;
+export declare function needsShadowDb(extensions: string[] | undefined): extensions is [string, ...string[]];
 //# sourceMappingURL=shadow-db-manager.d.ts.map

package/dist/commands/db/apply/helpers/sql-utils.d.ts

@@ -0,0 +1,26 @@
+/**
+ * AI HINT: Shared SQL Utility Functions
+ *
+ * Purpose: Common SQL utilities used across db apply helpers.
+ * Eliminates duplication of identifier quoting and validation.
+ */
+/**
+ * Validate that a name is a safe SQL identifier (no injection risk).
+ * Accepts: alphanumeric + underscore, must start with letter or underscore.
+ */
+export declare function isValidIdentifier(name: string): boolean;
+/**
+ * Quote an SQL identifier (double-quote escaping).
+ * Escapes embedded double-quotes by doubling them.
+ */
+export declare function quoteIdent(name: string): string;
+/**
+ * Build a fully qualified table name: "schema"."table"
+ */
+export declare function qualifiedTable(schema: string, table: string): string;
+/**
+ * Mask database credentials and sensitive information in error messages.
+ * Prevents accidental exposure of passwords, hosts, and ports in logs.
+ */
+export declare function maskDbCredentials(message: string): string;
+//# sourceMappingURL=sql-utils.d.ts.map

package/dist/commands/db/apply/machine.d.ts

@@ -36,6 +36,7 @@ import type { DbApplyInput } from './contract.js';
 interface DbApplyContext {
     input: DbApplyInput;
     targetDir: string;
+    lockAcquired: boolean;
     idempotentPreApplied: number;
     idempotentPreSkipped: number;
     idempotentPostApplied: number;
@@ -48,7 +49,14 @@ interface DbApplyContext {
     partitionWarnings: string[];
     error: string | null;
     planSql: string | null;
+    filteredPlanSql: string | null;
     ssotWarning: string | null;
+    idempotentFiles: string[];
+    idempotentRisks: {
+        high: number;
+        medium: number;
+        low: number;
+    } | null;
     startTime: number;
     idempotentPreStartTime: number | null;
     idempotentPreEndTime: number | null;
@@ -71,6 +79,15 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     }, {
         input: DbApplyInput;
         targetDir: string;
+    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
+        acquired: boolean;
+    }, {
+        input: DbApplyInput;
+    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<void, {
+        input: DbApplyInput;
+    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.IdempotentPreviewResult, {
+        input: DbApplyInput;
+        targetDir: string;
     }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.ApplyResult, {
         input: DbApplyInput;
         targetDir: string;
@@ -93,6 +110,27 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
         targetDir: string;
     }, import("xstate").EventObject>;
     id: string | undefined;
+} | {
+    src: "acquireLock";
+    logic: import("xstate").PromiseActorLogic<{
+        acquired: boolean;
+    }, {
+        input: DbApplyInput;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
+} | {
+    src: "releaseLock";
+    logic: import("xstate").PromiseActorLogic<void, {
+        input: DbApplyInput;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
+} | {
+    src: "previewIdempotentSchemas";
+    logic: import("xstate").PromiseActorLogic<actors.IdempotentPreviewResult, {
+        input: DbApplyInput;
+        targetDir: string;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
 } | {
     src: "applyIdempotentSchemas";
     logic: import("xstate").PromiseActorLogic<actors.ApplyResult, {
@@ -117,7 +155,10 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
         targetDir: string;
     }, import("xstate").EventObject>;
     id: string | undefined;
-}, never, never, never, "failed" | "done" | "idle" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "validatingPartitions" | "applyingSeeds", string, {
+}, {
+    type: "releaseAdvisoryLockOnFailure";
+    params: unknown;
+}, never, never, "done" | "failed" | "idle" | "acquiringLock" | "previewingIdempotent" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "validatingPartitions" | "releasingLock" | "applyingSeeds", string, {
     input: DbApplyInput;
     targetDir: string;
 }, {
@@ -130,10 +171,17 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     rolePasswordsSet?: number | undefined;
     error?: string | undefined;
     planSql?: string | undefined;
+    filteredPlanSql?: string | undefined;
     checkOnly?: boolean | undefined;
     dataViolations?: number | undefined;
     ssotWarning?: string | undefined;
     partitionWarnings?: string[] | undefined;
+    idempotentFiles?: string[] | undefined;
+    idempotentRisks?: {
+        high: number;
+        medium: number;
+        low: number;
+    } | undefined;
     metrics?: {
         totalMs: number;
         idempotentMs?: number | undefined;
@@ -145,10 +193,13 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     id: "dbApply";
     states: {
         readonly idle: {};
+        readonly acquiringLock: {};
+        readonly previewingIdempotent: {};
         readonly applyingIdempotentPre: {};
         readonly applyingPgSchemaDiff: {};
         readonly applyingIdempotentPost: {};
         readonly validatingPartitions: {};
+        readonly releasingLock: {};
         readonly applyingSeeds: {};
         readonly done: {};
         readonly failed: {};

package/dist/commands/db/commands/db-apply.d.ts

@@ -1,4 +1,22 @@
 import { Command } from 'commander';
+import { type DbApplyOutput } from '../apply/index.js';
+export interface DbApplyOptions {
+    verbose?: boolean;
+    /** Commander pairs --seed/--no-seed into this single property */
+    seed?: boolean;
+    databaseUrl?: string;
+    autoApprove?: boolean;
+    allowDataLoss?: boolean;
+    confirmAuthzUpdate?: boolean;
+    check?: boolean;
+    skipDataCheck?: boolean;
+    maxLockWaitMs?: number;
+    freshDbCheckSql?: string;
+}
+/**
+ * Run db apply workflow
+ */
+export declare function runDbApply(env: string, options: DbApplyOptions): Promise<DbApplyOutput>;
 /**
  * db:apply command - Apply schema changes using pg-schema-diff at runtime
  */

package/dist/commands/db/commands/db-sync/boundary-classifier.d.ts

@@ -0,0 +1,21 @@
+/**
+ * AI HINT: Boundary Classifier for db-sync precheck
+ *
+ * Purpose: Classify DDL statements as belonging to declarative or idempotent
+ * directories, and detect misplacement risks. Works with the boundary policy
+ * to determine which DDL objects are expected in which directory.
+ */
+import type { getBoundaryPolicy } from '../../utils/boundary-policy-runtime.js';
+import type { DirectoryRiskEntry } from './types.js';
+import { GRANT_STATEMENT_RULE_TEXT, PLAN_BOUNDARY_CONTEXT_FILE } from './types.js';
+export { PLAN_BOUNDARY_CONTEXT_FILE, GRANT_STATEMENT_RULE_TEXT };
+export declare function isBoundaryRelevantDdlStatement(statement: string): boolean;
+export declare function isPlanBoundaryAmbiguous(statement: string): boolean;
+export declare function classifyUnknownObjectBoundary(file: string, object: string, fileType: 'declarative' | 'idempotent', policy: ReturnType<typeof getBoundaryPolicy>): DirectoryRiskEntry | null;
+export declare function classifyPlanStatementBoundaryCandidates(statement: string, statementIndex: number, boundaryPolicy: ReturnType<typeof getBoundaryPolicy>, options?: {
+    skipDefault?: boolean;
+}): DirectoryRiskEntry[];
+export declare function classifyPlanStatementBoundaryRisk(statement: string, statementIndex: number, boundaryPolicy: ReturnType<typeof getBoundaryPolicy>): DirectoryRiskEntry | undefined;
+export declare function classifyDeclarativeMisplacementRisk(file: string, content: string, boundaryPolicy: ReturnType<typeof getBoundaryPolicy>): DirectoryRiskEntry[];
+export declare function classifyIdempotentMisplacementRisk(file: string, content: string, boundaryPolicy: ReturnType<typeof getBoundaryPolicy>): DirectoryRiskEntry[];
+//# sourceMappingURL=boundary-classifier.d.ts.map

package/dist/commands/db/commands/db-sync/error-classifier.d.ts

@@ -0,0 +1,9 @@
+import { type RunaDbEnv } from '../../utils/db-target.js';
+export interface DbSyncCommandFailure {
+    code: string;
+    message: string;
+    suggestions: string[];
+}
+export declare function classifyDbSyncCommandFailure(error: unknown, environment: RunaDbEnv): DbSyncCommandFailure | null;
+export declare function getDbSyncFallbackSuggestions(): string[];
+//# sourceMappingURL=error-classifier.d.ts.map

package/dist/commands/db/commands/db-sync/plan-hazard-analyzer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AI HINT: Plan Hazard Analyzer for db-sync precheck
+ *
+ * Purpose: Analyze pg-schema-diff plan output for hazards (DELETES_DATA,
+ * AUTHZ_UPDATE, etc.) and classify their boundary risk level.
+ */
+import type { PlanHazard, PlanStatement } from '../../apply/helpers/plan-validator.js';
+import { type DirectoryRiskEntry, type DirectoryRiskLevel } from './types.js';
+export declare function parseHazardType(hazard: string): string;
+export declare function getPlanHazardBoundaryLevel(type: string): DirectoryRiskLevel;
+export declare function buildPlanHazardBoundaryMessage(statement: string, statementIndex: number, hazard: PlanHazard): string;
+export declare function classifyPlanStatementHazards(statement: PlanStatement): DirectoryRiskEntry[];
+//# sourceMappingURL=plan-hazard-analyzer.d.ts.map

package/dist/commands/db/commands/db-sync/risk-reporter.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AI HINT: Risk Reporter for db-sync precheck
+ *
+ * Purpose: Format, deduplicate, and display risk findings from declarative
+ * risk analysis, directory placement checks, and plan boundary reconciliation.
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { CompactFinding, DeclarativeRiskItem, DirectoryRiskEntry, DirectoryRiskLevel } from './types.js';
+export declare function getDirectoryRiskWeight(level: DirectoryRiskLevel): number;
+export declare function compareDirectoryRiskPriority(left: DirectoryRiskEntry, right: DirectoryRiskEntry): number;
+export declare function selectHighestPriorityRisk(entries: DirectoryRiskEntry[]): DirectoryRiskEntry | undefined;
+export declare function buildDirectoryRiskKey(entry: DirectoryRiskEntry): string;
+export declare function dedupeDirectoryRisksBySeverity(entries: DirectoryRiskEntry[]): DirectoryRiskEntry[];
+export declare function printList(title: string, items: string[], logger: ReturnType<typeof createCLILogger>): void;
+export declare function stripCommonPrefix(filePath: string): string;
+export declare function formatDeclarativeRiskMessage(risk: DeclarativeRiskItem): string;
+export declare function buildCompactFindingSummary(rawItems: string[]): CompactFinding[];
+export declare function printCompactSummary(logger: ReturnType<typeof createCLILogger>, title: string, rawItems: string[], topLimit: number): void;
+//# sourceMappingURL=risk-reporter.d.ts.map

package/dist/commands/db/commands/db-sync/sql-parser.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI HINT: SQL Parser for db-sync precheck
+ *
+ * Purpose: Low-level SQL text parsing utilities for embedded SQL extraction
+ * and directory placement analysis. These parsers handle dollar-quoted literals,
+ * single-quoted literals, and PL/pgSQL embedded SQL patterns.
+ */
+export declare function isWordChar(char: string): boolean;
+export declare function isWhitespaceChar(char: string): boolean;
+export declare function parseWordAt(statement: string, start: number): {
+    value: string;
+    start: number;
+    end: number;
+} | null;
+export declare function skipWhitespaceAndComments(statement: string, start: number): number;
+export declare function getPreviousWord(statement: string, start: number): string;
+export declare function parseDollarQuotedLiteral(statement: string, start: number): {
+    body: string;
+    next: number;
+} | null;
+export declare function extractEmbeddableSqlFragments(statement: string): string[];
+export declare function normalizeSqlForPlacementCheck(content: string): string;
+export declare function isPartitionOfCreateTable(statement: string): boolean;
+export declare function dedupeAndSort(lines: string[]): string[];
+//# sourceMappingURL=sql-parser.d.ts.map

package/dist/commands/db/commands/db-sync/types.d.ts

@@ -0,0 +1,47 @@
+import type { SchemaRisk } from '../../../../validators/risk-detector.js';
+export type DeclarativeRiskItem = SchemaRisk & {
+    file: string;
+};
+export type DirectoryRiskLevel = 'high' | 'medium' | 'low';
+export declare const DIRECTORY_RISK_ORDER: readonly ["high", "medium", "low"];
+export type DirectoryRiskEntry = {
+    file: string;
+    level: DirectoryRiskLevel;
+    message: string;
+    line?: number;
+};
+export type DirectoryRiskRule = {
+    level: DirectoryRiskLevel;
+    pattern: RegExp | ((statement: string) => boolean);
+    message: string;
+};
+export type ExtensionCheckReport = {
+    blockers: string[];
+    warnings: string[];
+};
+export type AllowlistAwareReport = ExtensionCheckReport & {
+    allowlist: string[];
+    stats?: {
+        parsedStatements: number;
+        planHazards: number;
+        classifiedHazardStatements: number;
+        classifiedRiskStatements: number;
+        allowlistSuppressed: number;
+        parseWarnings: number;
+        unclassifiedStatements: number;
+    };
+};
+export type CompactFinding = {
+    message: string;
+    count: number;
+    samples: string[];
+};
+export type SyncOptions = {
+    json?: boolean;
+    showImportImpact?: boolean;
+    withProductionApplyCheck?: boolean;
+    strict?: boolean;
+};
+export declare const PLAN_BOUNDARY_CONTEXT_FILE = "pg-schema-diff plan.sql";
+export declare const GRANT_STATEMENT_RULE_TEXT = "Grant/REVOKE statements are usually idempotent/bootstrap ACL setup and should be treated as such";
+//# sourceMappingURL=types.d.ts.map

package/dist/commands/db/commands/db-sync.d.ts

@@ -1,3 +1,17 @@
+/**
+ * AI HINT: db-sync command — Schema sync check + production apply precheck
+ *
+ * Purpose: Compare TypeScript schema vs database, detect schema drift,
+ * and run production apply prechecks (declarative risk, directory placement,
+ * plan boundary reconciliation).
+ *
+ * Submodules (db-sync/):
+ *   types.ts               — Shared type definitions
+ *   sql-parser.ts          — SQL text parsing & embedded SQL extraction
+ *   boundary-classifier.ts — DDL statement boundary classification
+ *   plan-hazard-analyzer.ts— pg-schema-diff plan hazard analysis
+ *   risk-reporter.ts       — Risk formatting, deduplication, display
+ */
 import { Command } from 'commander';
 export declare const checkCommand: Command;
 //# sourceMappingURL=db-sync.d.ts.map

package/dist/commands/db/sync/contract.d.ts

@@ -36,6 +36,7 @@ export declare const DbSyncInputSchema: z.ZodObject<{
     autoApprove: z.ZodDefault<z.ZodBoolean>;
     verbose: z.ZodDefault<z.ZodBoolean>;
     skipCodegen: z.ZodDefault<z.ZodBoolean>;
+    strictIntrospect: z.ZodDefault<z.ZodBoolean>;
     targetDir: z.ZodOptional<z.ZodString>;
     fromProduction: z.ZodDefault<z.ZodBoolean>;
     autoSnapshot: z.ZodDefault<z.ZodBoolean>;
@@ -46,9 +47,9 @@ export type DbSyncInput = z.infer<typeof DbSyncInputSchema>;
  * Step result type
  */
 export declare const StepResultSchema: z.ZodEnum<{
-    passed: "passed";
-    failed: "failed";
     skipped: "skipped";
+    failed: "failed";
+    passed: "passed";
 }>;
 export type StepResult = z.infer<typeof StepResultSchema>;
 /**
@@ -104,8 +105,10 @@ export declare const StepContextSchema: z.ZodObject<{
     }>;
     check: z.ZodBoolean;
     force: z.ZodBoolean;
+    autoApprove: z.ZodBoolean;
     verbose: z.ZodBoolean;
     skipCodegen: z.ZodBoolean;
+    strictIntrospect: z.ZodBoolean;
     fromProduction: z.ZodBoolean;
     autoSnapshot: z.ZodBoolean;
     noSeed: z.ZodBoolean;
@@ -148,6 +151,7 @@ export declare const DbSyncMachineInputSchema: z.ZodObject<{
     autoApprove: z.ZodOptional<z.ZodBoolean>;
     verbose: z.ZodOptional<z.ZodBoolean>;
     skipCodegen: z.ZodOptional<z.ZodBoolean>;
+    strictIntrospect: z.ZodOptional<z.ZodBoolean>;
     targetDir: z.ZodOptional<z.ZodString>;
     fromProduction: z.ZodOptional<z.ZodBoolean>;
     autoSnapshot: z.ZodOptional<z.ZodBoolean>;

package/dist/commands/db/sync/machine.d.ts

@@ -104,13 +104,14 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     src: "writeReport";
     logic: import("xstate").PromiseActorLogic<actors.ReportOutput, actors.ReportInput, import("xstate").EventObject>;
     id: string | undefined;
-}, never, never, never, "failed" | "done" | "sync" | "setup" | "idle" | "snapshot" | "preflight" | "reconcile" | "report", string, {
+}, never, never, never, "done" | "failed" | "sync" | "setup" | "idle" | "snapshot" | "preflight" | "reconcile" | "report", string, {
     env?: "local" | "preview" | "production" | undefined;
     check?: boolean | undefined;
     force?: boolean | undefined;
     autoApprove?: boolean | undefined;
     verbose?: boolean | undefined;
     skipCodegen?: boolean | undefined;
+    strictIntrospect?: boolean | undefined;
     targetDir?: string | undefined;
     fromProduction?: boolean | undefined;
     autoSnapshot?: boolean | undefined;

package/dist/commands/db/types.d.ts

@@ -77,6 +77,8 @@ export interface DbCommandOptions {
     verbose?: boolean;
     /** CI optimization: skip TypeScript + Zod generation during db sync */
     skipCodegen?: boolean;
+    /** Fail when generated schema still contains unresolved unknown(...) columns */
+    strictIntrospect?: boolean;
     json?: boolean;
     sql?: boolean;
     format?: string;

package/dist/commands/db/utils/boundary-policy/rule-compiler.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AI HINT: Boundary policy rule compiler.
+ *
+ * Purpose: Convert raw policy JSON arrays into typed allowlist rules
+ * and normalize a full policy object with fallback defaults.
+ */
+import type { BoundaryPolicy, BoundaryPolicyMeta, DeclarativeRiskAllowlistRule, DirectoryPlacementAllowlistRule, PolicyIssueFormatter } from './types.js';
+export declare function toDeclarativeRiskRules(rawList: unknown, issueFormatter: PolicyIssueFormatter): DeclarativeRiskAllowlistRule[];
+export declare function toDirectoryPlacementRules(rawList: unknown, issueFormatter: PolicyIssueFormatter): DirectoryPlacementAllowlistRule[];
+export declare function normalizePolicySource(raw: unknown, source: BoundaryPolicyMeta['source'], sourcePath: string, issueFormatter: PolicyIssueFormatter): BoundaryPolicy;
+//# sourceMappingURL=rule-compiler.d.ts.map