@runa-ai/runa-cli 0.5.72 → 0.7.0

package/dist/commands/db/utils/boundary-policy/types.d.ts

@@ -0,0 +1,105 @@
+/**
+ * AI HINT: Boundary policy type definitions and small utility functions.
+ *
+ * Purpose: Shared types for boundary-policy validation, compilation, and loading.
+ */
+export type BoundaryPolicyRiskLevel = 'high' | 'medium' | 'low';
+export type AllowlistMetadata = {
+    owner?: string;
+    ticket?: string;
+    expiresAt?: string;
+    active?: boolean;
+};
+export type DeclarativeRiskAllowlistRule = {
+    id: string;
+    filePattern: RegExp;
+    descriptionPattern: RegExp;
+    level?: BoundaryPolicyRiskLevel;
+    reason: string;
+    owner?: string;
+    ticket?: string;
+    expiresAt?: string;
+    active: boolean;
+};
+export type DirectoryPlacementAllowlistRule = {
+    id: string;
+    filePattern: RegExp;
+    messagePattern: RegExp;
+    level?: BoundaryPolicyRiskLevel;
+    lineStart?: number;
+    lineEnd?: number;
+    reason: string;
+    owner?: string;
+    ticket?: string;
+    expiresAt?: string;
+    active: boolean;
+};
+export type BoundaryPolicyRaw = {
+    version?: unknown;
+    description?: unknown;
+    strictByDefault?: unknown;
+    declarativePreferredObjects?: unknown;
+    idempotentPreferredObjects?: unknown;
+    declarativeRiskAllowlist?: unknown;
+    directoryPlacementAllowlist?: unknown;
+};
+export type RawRule = {
+    id?: unknown;
+    filePattern?: unknown;
+    descriptionPattern?: unknown;
+    messagePattern?: unknown;
+    level?: unknown;
+    reason?: unknown;
+    owner?: unknown;
+    ticket?: unknown;
+    expiresAt?: unknown;
+    active?: unknown;
+    line?: unknown;
+    lineStart?: unknown;
+    lineEnd?: unknown;
+};
+export type BoundaryPolicyMeta = {
+    source: 'default' | 'policy-file';
+    sourcePath: string;
+    fallbackUsed: boolean;
+    invalidPolicy: boolean;
+    issues: string[];
+    warningCount: number;
+};
+export type BoundaryPolicy = {
+    version: string;
+    description: string;
+    strictByDefault: boolean;
+    declarativePreferredObjects: Set<string>;
+    idempotentPreferredObjects: Set<string>;
+    declarativeRiskAllowlist: DeclarativeRiskAllowlistRule[];
+    directoryPlacementAllowlist: DirectoryPlacementAllowlistRule[];
+    __meta: BoundaryPolicyMeta;
+};
+export type PolicyValidationSeverity = 'warning' | 'error';
+export type PolicyValidationIssue = {
+    field: string;
+    message: string;
+    severity: PolicyValidationSeverity;
+};
+export type PolicyIssueFormatter = (field: string, message: string, severity?: PolicyValidationSeverity) => void;
+export declare const BOUNDARY_POLICY_FILENAME = ".boundary-policy.json";
+export declare const DEFAULT_POLICY_VERSION = "1.0";
+export declare const SAFE_REGEXP: RegExp;
+export declare const POLICY_VERSION_PATTERN: RegExp;
+export declare const OBJECT_NAME_PATTERN: RegExp;
+export declare const DATE_ISO_PATTERN: RegExp;
+export declare const FALLBACK_DECLARATIVE_OBJECTS: Set<string>;
+export declare const FALLBACK_IDEMPOTENT_OBJECTS: Set<string>;
+export declare const FALLBACK_DECLARATIVE_RISK_ALLOWLIST: DeclarativeRiskAllowlistRule[];
+export declare const FALLBACK_DIRECTORY_PLACEMENT_ALLOWLIST: DirectoryPlacementAllowlistRule[];
+export declare function isObject(value: unknown): value is Record<string, unknown>;
+export declare function isStringArray(value: unknown): value is string[];
+export declare function isPastDate(value: string, today: string): boolean;
+export declare function isAllowlistRuleUsable(rule: {
+    active: boolean;
+    expiresAt?: string;
+}): boolean;
+export declare function formatBoundaryPolicyIssue(filePath: string, issue: PolicyValidationIssue): string;
+export declare function formatAllowlistMetadata(rule: AllowlistMetadata): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/commands/db/utils/boundary-policy/validation.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AI HINT: Boundary policy validation and coercion functions.
+ *
+ * Purpose: Validate raw policy JSON and coerce individual fields
+ * into strongly typed values with issue reporting.
+ */
+import type { BoundaryPolicyRiskLevel, PolicyIssueFormatter, PolicyValidationIssue, PolicyValidationSeverity } from './types.js';
+export declare function validateBoundaryPolicy(raw: unknown): PolicyValidationIssue[];
+export declare function coercePolicyStringList(value: unknown, field: string, issueFormatter: PolicyIssueFormatter): Set<string>;
+export declare function coerceRiskLevel(level: unknown): BoundaryPolicyRiskLevel | undefined;
+export declare function compileRegExp(pattern: string, issueFormatter: PolicyIssueFormatter): RegExp;
+export declare function coerceRuleId(raw: unknown, index: number, field: string, issueFormatter: PolicyIssueFormatter): string | null;
+export declare function coerceRulePattern(raw: unknown, index: number, field: string, issueFormatter: PolicyIssueFormatter): string | null;
+export declare function coerceOptionalString(raw: unknown, index: number, field: string, issueFormatter: PolicyIssueFormatter): string | undefined;
+export declare function coerceOptionalPositiveInteger(raw: unknown, index: number, field: string, issueFormatter: PolicyIssueFormatter): number | undefined;
+export declare function coerceBoolean(raw: unknown, index: number, field: string, issueFormatter: PolicyIssueFormatter): boolean;
+export declare function coerceExpiresAt(raw: unknown, ruleId: string, index: number, field: string, issueFormatter: PolicyIssueFormatter): string | undefined;
+export declare function mapPolicyVersion(rawVersion: unknown): string;
+export declare function appendValidationIssue(issues: PolicyValidationIssue[], field: string, message: string, severity: PolicyValidationSeverity, policyFile: string, output: string[]): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/commands/db/utils/boundary-policy-runtime.d.ts

@@ -0,0 +1,28 @@
+import { loadBoundaryPolicy, type DeclarativeRiskAllowlistRule, type DirectoryPlacementAllowlistRule } from './boundary-policy.js';
+type Logger = {
+    warn: (message: string) => void;
+    info: (message: string) => void;
+};
+type BoundaryPolicy = ReturnType<typeof loadBoundaryPolicy>;
+type DeclarativeRiskLike = {
+    level: 'high' | 'medium' | 'low';
+    file: string;
+    description: string;
+};
+type DirectoryRiskLike = {
+    level: 'high' | 'medium' | 'low';
+    file: string;
+    message: string;
+    line?: number;
+};
+export declare function getBoundaryPolicy(cwd?: string): BoundaryPolicy;
+export declare function reportBoundaryPolicyState(logger: Logger, policy: BoundaryPolicy): void;
+export declare function assertBoundaryPolicyUsable(logger: Logger, policy: BoundaryPolicy): void;
+export declare function assertBoundaryPolicyQualityGate(logger: Logger, policy: BoundaryPolicy, strict: boolean): void;
+export declare function findDeclarativeRiskAllowlistMatch(risk: DeclarativeRiskLike, policy: BoundaryPolicy): DeclarativeRiskAllowlistRule | undefined;
+export declare function hasExplicitLineScope(rule: DirectoryPlacementAllowlistRule): boolean;
+export declare function entryLineScopeMatches(issueLine: number | undefined, rule: DirectoryPlacementAllowlistRule): boolean;
+export declare function findDirectoryPlacementAllowlistMatch(issue: DirectoryRiskLike, policy: BoundaryPolicy): DirectoryPlacementAllowlistRule | undefined;
+export declare function resolveProductionApplyStrictMode(policy: BoundaryPolicy, strictOption: boolean | undefined): boolean;
+export {};
+//# sourceMappingURL=boundary-policy-runtime.d.ts.map

package/dist/commands/db/utils/boundary-policy.d.ts

@@ -0,0 +1,5 @@
+import type { BoundaryPolicy } from './boundary-policy/types.js';
+export type { BoundaryPolicy, BoundaryPolicyMeta, BoundaryPolicyRiskLevel, DeclarativeRiskAllowlistRule, DirectoryPlacementAllowlistRule, } from './boundary-policy/types.js';
+export { formatAllowlistMetadata } from './boundary-policy/types.js';
+export declare function loadBoundaryPolicy(projectRoot: string, policyPath?: string): BoundaryPolicy;
+//# sourceMappingURL=boundary-policy.d.ts.map

package/dist/commands/db/utils/idempotent-risk-context.d.ts

@@ -0,0 +1,29 @@
+/**
+ * AI HINT: Idempotent Risk Context Correction
+ *
+ * Purpose: Shared constants and logic for adjusting risk severity in idempotent/ context.
+ * In idempotent/ files, DROP ... IF EXISTS is a standard cleanup-then-recreate pattern,
+ * so these are downgraded from their original severity to 'low'.
+ *
+ * Used by: preflight-check.ts, db-sync.ts
+ */
+/**
+ * Reason codes whose severity is downgraded to 'low' in idempotent context.
+ * DROP ... IF EXISTS patterns are standard cleanup-then-recreate in idempotent files.
+ * REVOKE + GRANT is a standard RBAC reset pattern in idempotent RBAC files.
+ * DO blocks are the expected pattern for conditional logic in idempotent files.
+ */
+export declare const IDEMPOTENT_DOWNGRADE_REASON_CODES: Set<string>;
+/**
+ * Reason codes whose severity is capped at 'medium' in idempotent context.
+ * DROP POLICY in idempotent files is typically a cleanup-then-recreate pattern,
+ * but still warrants review since it removes access control rules.
+ */
+export declare const IDEMPOTENT_MEDIUM_REASON_CODES: Set<string>;
+/**
+ * Correct risk severity for idempotent context.
+ *
+ * @returns adjusted severity level
+ */
+export declare function correctIdempotentRiskLevel(originalLevel: string, reasonCode: string | undefined): 'high' | 'medium' | 'low';
+//# sourceMappingURL=idempotent-risk-context.d.ts.map

package/dist/commands/db/utils/preflight-check.d.ts

@@ -7,12 +7,26 @@
  * NOTE: This is DIFFERENT from `runa db preflight` command which checks DATA QUALITY
  *   - preflight-check.ts: Environment validation (Supabase status, env vars, orphan detection)
  *   - preflight/index.ts: Data quality validation (updated_at >= created_at constraint)
+ *
+ * Structure:
+ *   - preflight-check.ts: Orchestrator, types, basic checks (this file)
+ *   - preflight-checks/supabase-checks.ts: Supabase status & DB connection
+ *   - preflight-checks/schema-risk-checks.ts: SQL schema risk scanning
+ *   - preflight-checks/orphan-checks.ts: Orphaned objects & extension config
  */
 export interface PreflightCheckResult {
     passed: boolean;
     warnings: string[];
     errors: string[];
 }
+/**
+ * Step counter for dynamic step numbering.
+ * This ensures correct sequential numbering regardless of which checks are executed.
+ */
+export declare class StepCounter {
+    private current;
+    next(): number;
+}
 /**
  * Run all preflight checks
  */

package/dist/commands/db/utils/preflight-checks/domain-naming-checks.d.ts

@@ -0,0 +1,106 @@
+/**
+ * AI HINT: Domain Naming Consistency Checker (Preflight Sub-Check)
+ *
+ * Purpose: Validate declarative SQL files follow the naming convention:
+ *          {PREFIX}_{DOMAIN}.sql → CREATE SCHEMA {DOMAIN} → {DOMAIN}.{table}
+ *
+ * Rules:
+ * 1. DOMAIN_FILENAME_SCHEMA_MISMATCH (ERROR) - file domain vs CREATE SCHEMA
+ * 2. DOMAIN_CROSS_DOMAIN_TABLE (WARNING) - table in wrong domain file
+ * 3. DOMAIN_MISSING_CREATE_SCHEMA (WARNING) - schema used but not created
+ * 4. DOMAIN_FK_PREFIX_ORDER (INFO) - FK references higher-prefix file
+ * 5. DOMAIN_FILE_TOO_LARGE (INFO) - file exceeds 2000 lines
+ * 6. DOMAIN_FK_TARGET_NOT_DECLARATIVE (ERROR) - FK target not in declarative SQL
+ * 7. DOMAIN_DUPLICATE_TABLE (ERROR) - same table defined in multiple files
+ * 8. DOMAIN_POLICY_CROSS_SCHEMA_REF (WARNING) - RLS policy references cross-schema table
+ *
+ * Reuses: schema-detector.ts, sql-boundary-parser.ts, sql-comment-utils.ts
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+import { type ParsedSqlFilename } from '../sql-filename-parser.js';
+type DomainNamingRule = 'DOMAIN_FILENAME_SCHEMA_MISMATCH' | 'DOMAIN_CROSS_DOMAIN_TABLE' | 'DOMAIN_MISSING_CREATE_SCHEMA' | 'DOMAIN_FK_PREFIX_ORDER' | 'DOMAIN_FILE_TOO_LARGE' | 'DOMAIN_FK_TARGET_NOT_DECLARATIVE' | 'DOMAIN_DUPLICATE_TABLE' | 'DOMAIN_POLICY_CROSS_SCHEMA_REF';
+export interface DomainNamingIssue {
+    file: string;
+    line?: number;
+    rule: DomainNamingRule;
+    severity: 'error' | 'warning' | 'info';
+    message: string;
+}
+interface FileAnalysis {
+    parsed: ParsedSqlFilename;
+    content: string;
+    strippedContent: string;
+    lineCount: number;
+    declaredSchemas: string[];
+    tables: TableRef[];
+    fkRefs: FkRef[];
+}
+interface TableRef {
+    schema: string;
+    table: string;
+    line: number;
+}
+interface FkRef {
+    schema: string;
+    table: string;
+    line: number;
+}
+declare function analyzeFile(sqlDir: string, filename: string): FileAnalysis | null;
+/** Rule 1: Filename ↔ Schema name mismatch */
+declare function checkFilenameSchemaMatch(analysis: FileAnalysis): DomainNamingIssue[];
+/** Rule 2: Cross-domain table definition */
+declare function checkCrossDomainTables(analysis: FileAnalysis): DomainNamingIssue[];
+/**
+ * Rule 3: Missing CREATE SCHEMA
+ * Checks against all schemas declared across the entire project,
+ * not just the current file. This supports multi-file schemas
+ * (e.g., 10_accounts.sql + 11_accounts_rls.sql sharing a schema).
+ */
+declare function checkMissingCreateSchema(analysis: FileAnalysis, allDeclaredSchemas: Set<string>): DomainNamingIssue[];
+/** Rule 4: FK dependency prefix order violation */
+declare function checkFkPrefixOrder(analysis: FileAnalysis, tableToDomain: Map<string, number>): DomainNamingIssue[];
+/** Rule 5: File too large */
+declare function checkFileSize(analysis: FileAnalysis): DomainNamingIssue[];
+/**
+ * Rule 6: FK target not in declarative SQL
+ *
+ * When a FK references a table whose schema is "managed" (has at least one
+ * table in declarative files) but the specific table is NOT defined in any
+ * declarative file, pg-schema-diff will fail because the shadow DB won't
+ * contain the referenced table.
+ *
+ * FKs to non-managed schemas (e.g. auth, extensions) are skipped — those
+ * are platform-managed and not part of the desired schema.
+ */
+declare function checkFkTargetInDeclarative(analysis: FileAnalysis, tablePrefixMap: Map<string, number>, managedSchemas: Set<string>): DomainNamingIssue[];
+/**
+ * Rule 7: Duplicate table definition across files
+ *
+ * Each table must be defined in exactly one declarative SQL file.
+ * Duplicates cause ambiguous ownership and unpredictable pg-schema-diff behavior.
+ * This is a cross-file check (operates on all analyses, not per-file).
+ */
+declare function checkDuplicateTables(analyses: FileAnalysis[]): DomainNamingIssue[];
+/**
+ * Rule 8: Cross-schema table references in RLS policies
+ *
+ * pg-schema-diff does NOT track cross-schema references inside
+ * USING/WITH CHECK expressions. A policy on schema_a.table that
+ * references schema_b.other_table via EXISTS(...) will fail if
+ * schema_b tables are created after the policy.
+ *
+ * Workaround: use PL/pgSQL wrapper functions with dynamic SQL
+ * (lazy binding). See database-known-limitations.md #11.
+ */
+declare function checkPolicyCrossSchemaRef(analysis: FileAnalysis, managedSchemas: Set<string>): DomainNamingIssue[];
+declare function buildTablePrefixMap(analyses: FileAnalysis[]): Map<string, number>;
+/**
+ * Derive the set of "managed schemas" — schemas that have at least one
+ * table defined in declarative SQL files. FK references to tables in
+ * non-managed schemas (e.g., auth, extensions) are not checked.
+ */
+declare function buildManagedSchemas(tablePrefixMap: Map<string, number>): Set<string>;
+export declare function runDomainNamingCheck(result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+export { checkFilenameSchemaMatch as _checkFilenameSchemaMatch, checkCrossDomainTables as _checkCrossDomainTables, checkMissingCreateSchema as _checkMissingCreateSchema, checkFkPrefixOrder as _checkFkPrefixOrder, checkFileSize as _checkFileSize, checkFkTargetInDeclarative as _checkFkTargetInDeclarative, checkDuplicateTables as _checkDuplicateTables, checkPolicyCrossSchemaRef as _checkPolicyCrossSchemaRef, analyzeFile as _analyzeFile, buildTablePrefixMap as _buildTablePrefixMap, buildManagedSchemas as _buildManagedSchemas, type FileAnalysis, };
+//# sourceMappingURL=domain-naming-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/orphan-checks.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AI HINT: Orphan Database Object Checks
+ *
+ * Purpose: Detect orphaned tables/enums in the database that exist
+ *          in the live database but not in the schema definition files.
+ *          Also checks PostgreSQL extension configuration.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import { type createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+interface OrphanDiff {
+    orphanTables: string[];
+    extraEnums: string[];
+}
+/**
+ * Log orphan diff details and fix suggestions.
+ */
+export declare function logOrphanDetails(diff: OrphanDiff, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>): void;
+/**
+ * Check for orphaned database objects (local only)
+ *
+ * Orphaned objects are tables/enums that exist in the database but not in the schema.
+ * This commonly happens when previous Supabase runs left behind schemas.
+ */
+export declare function runOrphanCheck(env: string, dbPackagePath: string | null, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+/**
+ * Inventory PostgreSQL extensions used in idempotent/*.sql
+ *
+ * This is an informational check (non-blocking). Extensions are managed via
+ * CREATE EXTENSION IF NOT EXISTS in idempotent/*.sql (SQL-managed).
+ * [db.extensions] in config.toml is NOT supported by Supabase CLI 2.72.7+.
+ */
+export declare function runExtensionConfigCheck(_result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): void;
+export {};
+//# sourceMappingURL=orphan-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/schema-risk-checks.d.ts

@@ -0,0 +1,22 @@
+/**
+ * AI HINT: SQL Schema Risk Checks
+ *
+ * Purpose: Scan SQL schema files for dangerous patterns
+ *          (auth.*, extensions.* references) that violate
+ *          Supabase Auth Schema Independence rules.
+ *
+ * HIGH risk violations block db sync.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+/**
+ * Scan SQL schema files for dangerous patterns (auth.*, extensions.* references)
+ *
+ * HIGH risk violations block db sync to prevent Supabase Auth Schema Independence violations
+ * per AGENTS.md rules.
+ */
+export declare function runSqlSchemaRiskCheck(result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+export { categorizeRisks } from '../../../../validators/risk-detector.js';
+//# sourceMappingURL=schema-risk-checks.d.ts.map

package/dist/commands/db/utils/preflight-checks/supabase-checks.d.ts

@@ -0,0 +1,55 @@
+/**
+ * AI HINT: Supabase Preflight Checks
+ *
+ * Purpose: Check Supabase running status, test database connection,
+ *          and provide Docker port diagnostics for local development.
+ *
+ * Extracted from preflight-check.ts for modularity.
+ */
+import type { createCLILogger } from '@runa-ai/runa';
+import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
+/**
+ * Parse supabase status output to determine if Supabase is running.
+ * Pure function for testability.
+ */
+export declare function isSupabaseStatusRunning(output: {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}): boolean;
+/**
+ * Check if Supabase is running (local only)
+ */
+export declare function checkSupabaseRunning(): Promise<{
+    running: boolean;
+    error?: string;
+}>;
+/**
+ * Test actual database connection with SELECT 1
+ *
+ * This is more reliable than just checking supabase status,
+ * as it verifies:
+ * - Correct port configuration
+ * - Database is accepting connections
+ * - Credentials are valid
+ */
+export declare function testDatabaseConnection(projectRoot?: string): Promise<{
+    connected: boolean;
+    port: number;
+    error?: string;
+}>;
+/**
+ * Get Docker container port diagnostics for supabase_db
+ * Used to detect port mismatch between supabase status and actual Docker port
+ */
+export declare function getDockerPortDiagnostics(): Promise<{
+    containerFound: boolean;
+    containerName?: string;
+    actualPort?: number;
+}>;
+/**
+ * Run Supabase-related checks for local environment.
+ * Checks: Supabase status, database connection, Docker port diagnostics.
+ */
+export declare function runSupabaseChecksIfLocal(env: string, result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
+//# sourceMappingURL=supabase-checks.d.ts.map

package/dist/commands/db/utils/risk-detector-loader.d.ts

@@ -0,0 +1,8 @@
+import type { SchemaRisk } from '../../../validators/risk-detector.js';
+export type DetectSchemaRisksFn = (filePath: string) => Promise<SchemaRisk[]>;
+type RiskDetectorModule = {
+    detectSchemaRisks: DetectSchemaRisksFn;
+};
+export declare function loadRiskDetectorModule(): Promise<RiskDetectorModule>;
+export {};
+//# sourceMappingURL=risk-detector-loader.d.ts.map

package/dist/commands/db/utils/schema-precheck-budget.d.ts

@@ -0,0 +1,17 @@
+export declare const RUNA_SCHEMA_PRECHECK_MAX_FILES: number;
+export declare const RUNA_SCHEMA_PRECHECK_MAX_TOTAL_BYTES: number;
+export declare const RUNA_SCHEMA_PRECHECK_MAX_FILE_BYTES: number;
+export declare const RUNA_PLAN_PRECHECK_MAX_BYTES: number;
+export declare const RUNA_PLAN_PRECHECK_MAX_STATEMENTS: number;
+export type SchemaPrecheckBudgetState = {
+    scannedFiles: number;
+    scannedBytes: number;
+    maxFiles: number;
+    maxBytes: number;
+    maxFileBytes: number;
+};
+export declare function formatBytes(value: number): string;
+export declare function buildBudgetExceededReason(context: string, files: number, bytes: number, maxFiles: number, maxBytes: number): string;
+export declare function createSchemaPrecheckBudgetState(): SchemaPrecheckBudgetState;
+export declare function shouldAbortSchemaPrecheckForBudget(state: SchemaPrecheckBudgetState, filePath: string): string | null;
+//# sourceMappingURL=schema-precheck-budget.d.ts.map

package/dist/commands/db/utils/sql-boundary-parser.d.ts

@@ -0,0 +1,12 @@
+export type ParsedSqlStatement = {
+    statement: string;
+    line: number;
+};
+export declare function splitSqlStatements(content: string): ParsedSqlStatement[];
+export declare function isNonDdlMaintenanceStatement(statement: string): boolean;
+export declare function isNonSchemaOperation(statement: string): boolean;
+export declare function extractDdlObject(statement: string): string | null;
+export declare function isPartitionOfCreateTable(statement: string): boolean;
+export declare function shouldReviewUnknownDeclarativeDdl(statement: string, declarativePreferredObjects: Set<string>, idempotentPreferredObjects: Set<string>): string | null;
+export declare function shouldReviewUnknownIdempotentDdl(statement: string, idempotentPreferredObjects: Set<string>, declarativePreferredObjects: Set<string>): string | null;
+//# sourceMappingURL=sql-boundary-parser.d.ts.map

package/dist/commands/db/utils/sql-file-collector.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Recursively collect `.sql` files.
+ *
+ * Uses queue + index traversal to avoid O(n^2) behavior from shift().
+ * Unreadable directories are ignored so callers can keep precheck resilient.
+ */
+export declare function collectSqlFilesRecursively(baseDir: string): Generator<string>;
+//# sourceMappingURL=sql-file-collector.d.ts.map

package/dist/commands/db/utils/sql-filename-parser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AI HINT: Declarative SQL Filename Parser
+ *
+ * Purpose: Extract prefix and domain from declarative SQL filenames
+ * Convention: {PREFIX}_{DOMAIN}.sql (e.g., 10_accounts.sql → prefix=10, domain='accounts')
+ * Used by: domain-naming-checks (preflight check)
+ */
+export interface ParsedSqlFilename {
+    prefix: number;
+    domain: string;
+    raw: string;
+}
+/**
+ * Parse declarative SQL filename: {PREFIX}_{DOMAIN}.sql
+ * Returns null if filename doesn't match the convention.
+ *
+ * Special case: 00_public.sql → domain = 'public'
+ */
+export declare function parseSqlFilename(filename: string): ParsedSqlFilename | null;
+//# sourceMappingURL=sql-filename-parser.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-ast.d.ts

@@ -0,0 +1,19 @@
+/**
+ * AI HINT: SQL Table Extractor — AST-based Parsing
+ *
+ * Purpose: Extract table definitions using libpg-query AST (primary parser)
+ * Extracted from: sql-table-extractor.ts (AST-based Parsing section)
+ *
+ * Functions:
+ * - extractTablesWithAst: Parse SQL content using libpg-query AST
+ * - convertAstColumns: Convert AST columns to ColumnDefinition array
+ * - convertAstForeignKeys: Convert AST foreign keys to ForeignKeyDefinition array
+ * - convertAstIndexes: Convert AST indexes to IndexDefinition array
+ */
+import type { TableEntry } from '@runa-ai/runa/manifests';
+import type { ResolvedOptions } from './sql-table-extractor.js';
+/**
+ * Extract tables using libpg-query AST
+ */
+export declare function extractTablesWithAst(content: string, filePath: string, opts: ResolvedOptions): Promise<TableEntry[]>;
+//# sourceMappingURL=sql-table-extractor-ast.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-regex.d.ts

@@ -0,0 +1,50 @@
+/**
+ * AI HINT: SQL Table Extractor — Regex-based Parsing
+ *
+ * Purpose: Fallback parsing when libpg-query AST is not available
+ * Extracted from: sql-table-extractor.ts (Regex-based Parsing section)
+ *
+ * Functions:
+ * - findTablesRegex: Find all CREATE TABLE statements
+ * - parseColumnsRegex: Parse column definitions from table body
+ * - parsePrimaryKeyRegex: Parse PRIMARY KEY constraints
+ * - parseForeignKeysRegex: Parse FOREIGN KEY constraints (explicit + inline)
+ * - parseIndexesRegex: Parse CREATE INDEX statements
+ * - hasRlsEnabledRegex: Check if RLS is enabled for a table
+ */
+import type { ColumnDefinition, ForeignKeyDefinition, IndexDefinition } from '@runa-ai/runa/manifests';
+import type { ParseContext, ParsedTable } from './sql-table-extractor.js';
+/**
+ * Find all CREATE TABLE statements in content (regex)
+ */
+export declare function findTablesRegex(ctx: ParseContext): ParsedTable[];
+export interface ParsedColumnDeclarationResult {
+    name: string;
+    type: string;
+    hasDefault: boolean;
+    notNull: boolean;
+    isPrimaryKey: boolean;
+    inlineReferenceTable?: string;
+    inlineReferenceColumn?: string;
+}
+/**
+ * Parse column definitions from table body (regex)
+ */
+export declare function parseColumnsRegex(tableBody: string): ColumnDefinition[];
+/**
+ * Parse PRIMARY KEY constraint (regex)
+ */
+export declare function parsePrimaryKeyRegex(tableBody: string): string[];
+/**
+ * Parse FOREIGN KEY constraints (regex)
+ */
+export declare function parseForeignKeysRegex(tableBody: string): ForeignKeyDefinition[];
+/**
+ * Parse indexes from full file content (regex)
+ */
+export declare function parseIndexesRegex(content: string, schema: string, tableName: string): IndexDefinition[];
+/**
+ * Check if RLS is enabled for table (regex)
+ */
+export declare function hasRlsEnabledRegex(content: string, schema: string, tableName: string): boolean;
+//# sourceMappingURL=sql-table-extractor-regex.d.ts.map

package/dist/commands/db/utils/sql-table-extractor-rls.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AI HINT: SQL Table Extractor — RLS Policy Parsing
+ *
+ * Purpose: Parse CREATE POLICY statements from SQL content
+ * Extracted from: sql-table-extractor.ts (RLS Policy Parsing section)
+ *
+ * Functions:
+ * - extractCreatePolicyStatements: Find all CREATE POLICY statements
+ * - parsePoliciesRegex: Parse policy details (name, command, USING, WITH CHECK)
+ */
+import type { RlsPolicyDefinition } from '@runa-ai/runa/manifests';
+export declare function parsePoliciesRegex(content: string, schema: string, tableName: string): RlsPolicyDefinition[];
+//# sourceMappingURL=sql-table-extractor-rls.d.ts.map