@runa-ai/runa-cli 0.6.0 → 0.7.0

package/dist/{ci-V3PIG2GI.js → ci-ZWRVWNFX.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, enhanceConnectionError, parseBoolish, parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, detectAppSchemas, formatSchemasForSql } from './chunk-CE3DEYFT.js';
-import { detectEnvironment } from './chunk-JMJP4A47.js';
-import { ensureRunaTmpDir, runLogged } from './chunk-7QV7U6NI.js';
+import { normalizeDatabaseUrlForDdl, enhanceConnectionError, parseBoolish, detectAppSchemas, formatSchemasForSql } from './chunk-XDCHRVE3.js';
+import { isPathContained } from './chunk-DRSUEMAK.js';
 import './chunk-QDF7QXBL.js';
 import { getSnapshotStateName, isSnapshotComplete } from './chunk-IBVVGH6X.js';
-import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
 import { writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput } from './chunk-HD74F6W2.js';
+import { psqlSyncQuery, parsePostgresUrl, buildPsqlArgs, buildPsqlEnv } from './chunk-7B5C6U2K.js';
+import { ensureRunaTmpDir, runLogged } from './chunk-6FAU4IGR.js';
+import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
+import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
 import { init_constants, detectSupabasePorts } from './chunk-VM3IWOT5.js';
-import { isPathContained } from './chunk-DRSUEMAK.js';
-import { emitJsonSuccess } from './chunk-UU55OH7P.js';
-import './chunk-RRGQCUKT.js';
-import './chunk-JT5SUTWE.js';
+import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
+import './chunk-WJXC4MVY.js';
 import { setOutputFormat } from './chunk-HKUWEGUX.js';
+import { detectEnvironment } from './chunk-JMJP4A47.js';
 import { init_esm_shims, __require } from './chunk-VRXHCR5K.js';
 import { Command } from 'commander';
 import { spawnSync, spawn, execFileSync } from 'child_process';
@@ -24,9 +25,9 @@ import { existsSync, readFileSync, readdirSync, promises, lstatSync, statSync }
 import { resolve4 } from 'dns/promises';
 import net, { isIP } from 'net';
 import { fromPromise, setup, assign, createActor } from 'xstate';
-import postgres from 'postgres';
+import { randomUUID, createHash } from 'crypto';
 import { execa } from 'execa';
-import 'crypto';
+import postgres from 'postgres';
 import { glob } from 'glob';
 
 createRequire(import.meta.url);
@@ -2498,9 +2499,429 @@ var applySeedsActor = fromPromise(
 // src/commands/ci/machine/actors/db/collect-schema-stats.ts
 init_esm_shims();
 
-// src/commands/ci/machine/actors/db/schema-stats.ts
+// src/commands/ci/machine/actors/db/schema-canonical-diff.ts
 init_esm_shims();
+function createUnavailableCanonicalSnapshot(error) {
+  return {
+    available: false,
+    objects: [],
+    error
+  };
+}
 var EXCLUDED_SCHEMAS = [
+  "pg_catalog",
+  "pg_toast",
+  "information_schema",
+  "auth",
+  "storage",
+  "realtime",
+  "_realtime",
+  "supabase_functions",
+  "supabase_migrations",
+  "vault",
+  "pgsodium",
+  "pgsodium_masks",
+  "graphql",
+  "graphql_public",
+  "extensions",
+  "net",
+  "cron",
+  "tests"
+];
+function normalizeWhitespace(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}
+function stableHash(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex").slice(0, 16);
+}
+function createCanonicalObject(kind, schema, name, label, payload, parentName) {
+  return {
+    kind,
+    schema,
+    name,
+    key: `${kind}:${schema}:${name}`,
+    label,
+    parentName,
+    signature: stableHash(payload)
+  };
+}
+function buildSchemaListSql(schemaNames) {
+  return schemaNames.map((schemaName) => `'${schemaName}'`).join(", ");
+}
+async function getUserSchemas(sql) {
+  const excludeList = buildSchemaListSql(EXCLUDED_SCHEMAS);
+  const rows = await sql`
+    SELECT nspname
+    FROM pg_namespace
+    WHERE nspname NOT IN (${sql.unsafe(excludeList)})
+      AND nspname NOT LIKE 'pg_%'
+    ORDER BY nspname
+  `;
+  return rows.map((row) => row.nspname);
+}
+async function queryTableColumns(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      a.attnum::int AS attnum,
+      a.attname AS column_name,
+      format_type(a.atttypid, a.atttypmod) AS data_type,
+      a.attnotnull AS not_null,
+      pg_get_expr(ad.adbin, ad.adrelid, true) AS default_expr,
+      NULLIF(a.attidentity, '') AS identity_kind,
+      NULLIF(a.attgenerated, '') AS generated_kind
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    JOIN pg_attribute a ON a.attrelid = c.oid
+    LEFT JOIN pg_attrdef ad ON ad.adrelid = c.oid AND ad.adnum = a.attnum
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+    ORDER BY n.nspname, c.relname, a.attnum
+  `;
+}
+async function queryTableFlags(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      c.relrowsecurity AS rls_enabled,
+      c.relforcerowsecurity AS rls_forced
+    FROM pg_class c
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+  `;
+}
+async function queryTableConstraints(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      con.conname AS constraint_name,
+      con.contype AS constraint_type,
+      pg_get_constraintdef(con.oid, true) AS definition
+    FROM pg_constraint con
+    JOIN pg_class c ON c.oid = con.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND c.relkind IN ('r', 'p')
+    ORDER BY n.nspname, c.relname, con.conname
+  `;
+}
+function buildTableObjects(columns, flags, constraints) {
+  const tables = /* @__PURE__ */ new Map();
+  for (const row of columns) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.columns.push({
+      attnum: row.attnum,
+      name: row.column_name,
+      type: normalizeWhitespace(row.data_type),
+      notNull: row.not_null,
+      default: normalizeWhitespace(row.default_expr),
+      identity: row.identity_kind ?? "",
+      generated: row.generated_kind ?? ""
+    });
+    tables.set(key, entry);
+  }
+  for (const row of flags) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.rlsEnabled = row.rls_enabled;
+    entry.rlsForced = row.rls_forced;
+    tables.set(key, entry);
+  }
+  for (const row of constraints) {
+    const key = `${row.schema_name}.${row.table_name}`;
+    const entry = tables.get(key) ?? {
+      schema: row.schema_name,
+      table: row.table_name,
+      columns: [],
+      constraints: [],
+      rlsEnabled: false,
+      rlsForced: false
+    };
+    entry.constraints.push({
+      name: row.constraint_name,
+      type: row.constraint_type,
+      definition: normalizeWhitespace(row.definition)
+    });
+    tables.set(key, entry);
+  }
+  return Array.from(tables.values()).map(
+    (table) => createCanonicalObject("table", table.schema, table.table, `${table.schema}.${table.table}`, {
+      columns: table.columns,
+      constraints: table.constraints,
+      rlsEnabled: table.rlsEnabled,
+      rlsForced: table.rlsForced
+    })
+  );
+}
+async function queryFunctions(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      p.proname AS object_name,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_key,
+      format('%I.%I(%s)', n.nspname, p.proname, pg_get_function_identity_arguments(p.oid)) AS object_label,
+      pg_get_functiondef(p.oid) AS definition
+    FROM pg_proc p
+    JOIN pg_namespace n ON p.pronamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND p.prokind = 'f'
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_depend d
+        WHERE d.objid = p.oid
+          AND d.deptype = 'e'
+      )
+      AND p.proname NOT LIKE 'supabase_%'
+      AND p.proname NOT LIKE 'postgrest_%'
+      AND p.proname NOT LIKE 'pgrst_%'
+      AND p.proname NOT LIKE '_pgrst_%'
+    ORDER BY n.nspname, p.proname
+  `;
+}
+async function queryPolicies(sql, schemaList) {
+  return await sql`
+    SELECT
+      schemaname AS schema_name,
+      policyname AS object_name,
+      format('%I.%I.%I', schemaname, tablename, policyname) AS object_key,
+      format('%I.%I policy %I', schemaname, tablename, policyname) AS object_label,
+      tablename AS parent_name,
+      jsonb_build_object(
+        'table', tablename,
+        'permissive', permissive,
+        'roles', COALESCE(roles, ARRAY[]::text[]),
+        'command', cmd,
+        'using', COALESCE(qual, ''),
+        'withCheck', COALESCE(with_check, '')
+      )::text AS definition
+    FROM pg_policies
+    WHERE schemaname IN (${sql.unsafe(schemaList)})
+    ORDER BY schemaname, tablename, policyname
+  `;
+}
+async function queryIndexes(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      i.relname AS object_name,
+      format('%I.%I', n.nspname, i.relname) AS object_key,
+      format('%I.%I on %I', n.nspname, i.relname, t.relname) AS object_label,
+      t.relname AS parent_name,
+      jsonb_build_object(
+        'table', t.relname,
+        'definition',
+        regexp_replace(pg_get_indexdef(i.oid), '^CREATE( UNIQUE)? INDEX [^ ]+ ON ', 'CREATE\\1 INDEX ON '),
+        'predicate',
+        COALESCE(pg_get_expr(idx.indpred, idx.indrelid, true), ''),
+        'unique',
+        idx.indisunique
+      )::text AS definition
+    FROM pg_index idx
+    JOIN pg_class i ON i.oid = idx.indexrelid
+    JOIN pg_class t ON t.oid = idx.indrelid
+    JOIN pg_namespace n ON n.oid = i.relnamespace
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND NOT EXISTS (
+        SELECT 1 FROM pg_constraint c
+        WHERE c.conindid = idx.indexrelid
+      )
+    ORDER BY n.nspname, t.relname, i.relname
+  `;
+}
+async function queryTriggers(sql, schemaList) {
+  return await sql`
+    SELECT
+      n.nspname AS schema_name,
+      t.tgname AS object_name,
+      format('%I.%I.%I', n.nspname, c.relname, t.tgname) AS object_key,
+      format('%I.%I trigger %I', n.nspname, c.relname, t.tgname) AS object_label,
+      c.relname AS parent_name,
+      pg_get_triggerdef(t.oid, true) AS definition
+    FROM pg_trigger t
+    JOIN pg_class c ON t.tgrelid = c.oid
+    JOIN pg_namespace n ON c.relnamespace = n.oid
+    WHERE n.nspname IN (${sql.unsafe(schemaList)})
+      AND NOT t.tgisinternal
+    ORDER BY n.nspname, c.relname, t.tgname
+  `;
+}
+function rowsToObjects(kind, rows) {
+  return rows.map(
+    (row) => createCanonicalObject(
+      kind,
+      row.schema_name,
+      row.object_key,
+      row.object_label,
+      normalizeWhitespace(row.definition),
+      row.parent_name ?? void 0
+    )
+  );
+}
+async function getCanonicalSchemaSnapshot(databaseUrl) {
+  let sql = null;
+  try {
+    const isRemoteSupabase = databaseUrl.includes(".supabase.co");
+    sql = postgres(databaseUrl, {
+      max: 1,
+      idle_timeout: 10,
+      connect_timeout: 10,
+      ...isRemoteSupabase && { ssl: "require" }
+    });
+    const userSchemas = await getUserSchemas(sql);
+    if (userSchemas.length === 0) {
+      return { available: true, objects: [] };
+    }
+    const schemaList = buildSchemaListSql(userSchemas);
+    const [columns, flags, constraints, functions, policies, indexes, triggers] = await Promise.all(
+      [
+        queryTableColumns(sql, schemaList),
+        queryTableFlags(sql, schemaList),
+        queryTableConstraints(sql, schemaList),
+        queryFunctions(sql, schemaList),
+        queryPolicies(sql, schemaList),
+        queryIndexes(sql, schemaList),
+        queryTriggers(sql, schemaList)
+      ]
+    );
+    return {
+      available: true,
+      objects: [
+        ...buildTableObjects(columns, flags, constraints),
+        ...rowsToObjects("function", functions),
+        ...rowsToObjects("policy", policies),
+        ...rowsToObjects("index", indexes),
+        ...rowsToObjects("trigger", triggers)
+      ].sort((a, b) => a.key.localeCompare(b.key))
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`[schema-canonical-diff] Could not query canonical snapshot: ${message}`);
+    return createUnavailableCanonicalSnapshot(message);
+  } finally {
+    if (sql) {
+      await sql.end();
+    }
+  }
+}
+function buildObjectMap(snapshot) {
+  return new Map(snapshot.objects.map((object) => [object.key, object]));
+}
+function buildSignatureBuckets(objects) {
+  const buckets = /* @__PURE__ */ new Map();
+  for (const object of objects) {
+    const bucketKey = `${object.kind}:${object.schema}:${object.signature}`;
+    const current = buckets.get(bucketKey) ?? [];
+    current.push(object);
+    buckets.set(bucketKey, current);
+  }
+  return buckets;
+}
+function compareCanonicalSnapshots(reference, target) {
+  const missing = [];
+  const extra = [];
+  const changed = [];
+  const renamed = [];
+  const targetByKey = buildObjectMap(target);
+  const targetSignatureBuckets = buildSignatureBuckets(target.objects);
+  const matchedTargetKeys = /* @__PURE__ */ new Set();
+  for (const referenceObject of reference.objects) {
+    const matchedTarget = targetByKey.get(referenceObject.key);
+    if (matchedTarget) {
+      matchedTargetKeys.add(matchedTarget.key);
+      if (matchedTarget.signature !== referenceObject.signature) {
+        changed.push({ reference: referenceObject, target: matchedTarget });
+      }
+      continue;
+    }
+    if (referenceObject.kind === "index") {
+      const renameBucket = targetSignatureBuckets.get(
+        `${referenceObject.kind}:${referenceObject.schema}:${referenceObject.signature}`
+      ) ?? [];
+      const renamedTarget = renameBucket.find((candidate) => !matchedTargetKeys.has(candidate.key));
+      if (renamedTarget) {
+        matchedTargetKeys.add(renamedTarget.key);
+        renamed.push({ reference: referenceObject, target: renamedTarget });
+        continue;
+      }
+    }
+    missing.push(referenceObject);
+  }
+  for (const targetObject of target.objects) {
+    if (!matchedTargetKeys.has(targetObject.key) && !reference.objects.some((candidate) => candidate.key === targetObject.key)) {
+      extra.push(targetObject);
+    }
+  }
+  return { missing, extra, changed, renamed };
+}
+function addSummaryKind(summary, kind) {
+  if (!summary.changedKinds.includes(kind)) {
+    summary.changedKinds.push(kind);
+    summary.changedKinds.sort();
+  }
+  summary.hasChanges = true;
+}
+function ensureSchemaSummary(summaries, schemaName) {
+  const existing = summaries[schemaName];
+  if (existing) return existing;
+  const created = {
+    hasChanges: false,
+    changedKinds: [],
+    counts: { missing: 0, extra: 0, changed: 0, renamed: 0 }
+  };
+  summaries[schemaName] = created;
+  return created;
+}
+function summarizeCanonicalDiffBySchema(diff) {
+  const summaries = {};
+  for (const object of diff.missing) {
+    const summary = ensureSchemaSummary(summaries, object.schema);
+    summary.counts.missing += 1;
+    addSummaryKind(summary, object.kind);
+  }
+  for (const object of diff.extra) {
+    const summary = ensureSchemaSummary(summaries, object.schema);
+    summary.counts.extra += 1;
+    addSummaryKind(summary, object.kind);
+  }
+  for (const pair of diff.changed) {
+    const summary = ensureSchemaSummary(summaries, pair.reference.schema);
+    summary.counts.changed += 1;
+    addSummaryKind(summary, pair.reference.kind);
+  }
+  for (const pair of diff.renamed) {
+    const summary = ensureSchemaSummary(summaries, pair.reference.schema);
+    summary.counts.renamed += 1;
+    addSummaryKind(summary, pair.reference.kind);
+  }
+  return summaries;
+}
+function hasCanonicalChanges(diff) {
+  return diff.missing.length > 0 || diff.extra.length > 0 || diff.changed.length > 0 || diff.renamed.length > 0;
+}
+
+// src/commands/ci/machine/actors/db/schema-stats.ts
+init_esm_shims();
+var EXCLUDED_SCHEMAS2 = [
   // PostgreSQL system schemas
   "pg_catalog",
   "pg_toast",
@@ -2604,15 +3025,18 @@ async function getDetailedIndexList(sql, schemaList) {
       t.relname as table,
       idx.indisunique as is_unique,
       idx.indpred IS NOT NULL as is_partial,
+      am.amname as access_method,
       CASE
         WHEN idx.indpred IS NOT NULL
         THEN pg_get_expr(idx.indpred, idx.indrelid, true)
         ELSE NULL
-      END as where_clause
+      END as where_clause,
+      pg_get_indexdef(i.oid) as definition
     FROM pg_index idx
     JOIN pg_class i ON i.oid = idx.indexrelid
     JOIN pg_class t ON t.oid = idx.indrelid
     JOIN pg_namespace n ON n.oid = i.relnamespace
+    JOIN pg_am am ON am.oid = i.relam
     WHERE n.nspname IN (${sql.unsafe(schemaList)})
       AND NOT EXISTS (
         SELECT 1 FROM pg_constraint c
@@ -2626,11 +3050,13 @@ async function getDetailedIndexList(sql, schemaList) {
     table: row.table,
     isUnique: row.is_unique,
     isPartial: row.is_partial,
-    whereClause: row.where_clause || void 0
+    whereClause: row.where_clause || void 0,
+    accessMethod: row.access_method || void 0,
+    definition: normalizeIndexDefinition(row.definition || void 0)
   }));
 }
-async function getUserSchemas(sql) {
-  const excludeList = EXCLUDED_SCHEMAS.map((s) => `'${s}'`).join(", ");
+async function getUserSchemas2(sql) {
+  const excludeList = EXCLUDED_SCHEMAS2.map((s) => `'${s}'`).join(", ");
   const result = await sql`
     SELECT nspname
     FROM pg_namespace
@@ -2653,7 +3079,7 @@ async function getDbSchemaStats(databaseUrl) {
       // Supabase production requires SSL; local Docker does not
       ...isRemoteSupabase && { ssl: "require" }
     });
-    const userSchemas = await getUserSchemas(sql);
+    const userSchemas = await getUserSchemas2(sql);
     if (userSchemas.length === 0) {
       return { schemas, total };
     }
@@ -2783,12 +3209,30 @@ function collectExpectedDriftReasons(schemaName, fieldDiffs, expectedDrift) {
 function compareIndexLists(reference, target) {
   const refIndexes = reference.indexList || [];
   const targetIndexes = target.indexList || [];
-  const refKeys = new Set(refIndexes.map((i) => `${i.schema}.${i.name}`));
-  const targetKeys = new Set(targetIndexes.map((i) => `${i.schema}.${i.name}`));
-  const missing = refIndexes.filter((i) => !targetKeys.has(`${i.schema}.${i.name}`));
-  const extra = targetIndexes.filter((i) => !refKeys.has(`${i.schema}.${i.name}`));
+  const buildIndexKey = (index) => [
+    index.schema,
+    index.table,
+    index.isUnique ? "unique" : "nonunique",
+    index.isPartial ? "partial" : "full",
+    normalizeDiffValue(index.whereClause),
+    normalizeDiffValue(index.accessMethod),
+    normalizeIndexDefinition(index.definition)
+  ].join(":");
+  const refKeys = new Set(refIndexes.map(buildIndexKey));
+  const targetKeys = new Set(targetIndexes.map(buildIndexKey));
+  const missing = refIndexes.filter((index) => !targetKeys.has(buildIndexKey(index)));
+  const extra = targetIndexes.filter((index) => !refKeys.has(buildIndexKey(index)));
   return { missing, extra };
 }
+function normalizeDiffValue(value) {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}
+function normalizeIndexDefinition(value) {
+  return normalizeDiffValue(value).replace(
+    /^create\s+(unique\s+)?index\s+\S+\s+on\s+/i,
+    (_match, unique = "") => `create ${unique || ""}index on `
+  );
+}
 function formatIndexInfo(index) {
   const qualifiedName = `${index.schema}.${index.name}`;
   const tags = [];
@@ -2805,7 +3249,16 @@ function hasIndexDiff(diff) {
 function emptyStats() {
   return {
     schemas: {},
-    total: { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 }
+    total: { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 },
+    available: true
+  };
+}
+function unavailableStats(error) {
+  return {
+    ...emptyStats(),
+    available: false,
+    error,
+    canonicalSnapshot: createUnavailableCanonicalSnapshot(error)
   };
 }
 function logSchemaStats(label, stats, includeSchemas = false) {
@@ -2817,42 +3270,117 @@ function logSchemaStats(label, stats, includeSchemas = false) {
   const schemas = Object.keys(stats.schemas);
   console.log(`${base} (schemas: ${schemas.join(", ")})`);
 }
-function createStatsTask(dbUrl, label, includeSchemas = false) {
+async function collectEnvironmentStats(dbUrl, label, includeSchemas = false) {
   if (!dbUrl) {
-    return Promise.resolve(null);
+    return null;
   }
-  return getDbSchemaStats(dbUrl).then((stats) => {
-    logSchemaStats(label, stats, includeSchemas);
-    return stats;
-  });
+  const stats = await getDbSchemaStats(dbUrl);
+  stats.canonicalSnapshot = await getCanonicalSchemaSnapshot(dbUrl);
+  stats.available = true;
+  logSchemaStats(label, stats, includeSchemas);
+  return stats;
 }
 function resolveSettledStats(result, failureLabel) {
   if (result.status === "fulfilled" && result.value) {
     return result.value;
   }
+  const reason = result.status === "rejected" ? String(result.reason) : `${failureLabel} database URL is not available for schema comparison`;
   if (result.status === "rejected") {
     console.warn(`[schema-stats] Failed to query ${failureLabel} database: ${result.reason}`);
   }
-  return emptyStats();
+  return unavailableStats(reason);
 }
 function resolveSettledProductionStats(result) {
   if (result.status === "fulfilled") {
     return result.value;
   }
   console.warn(`[schema-stats] Failed to query production database: ${result.reason}`);
-  return null;
+  return unavailableStats(String(result.reason));
+}
+function buildAdminDsn(sourceDbUrl) {
+  const conn = parsePostgresUrl(sourceDbUrl);
+  const password = conn.password ? `:${encodeURIComponent(conn.password)}` : "";
+  return `postgresql://${conn.user}${password}@${conn.host}:${conn.port}/postgres`;
+}
+function buildShadowDsn(sourceDbUrl, dbName) {
+  const conn = parsePostgresUrl(sourceDbUrl);
+  const password = conn.password ? `:${encodeURIComponent(conn.password)}` : "";
+  return `postgresql://${conn.user}${password}@${conn.host}:${conn.port}/${dbName}`;
+}
+function createReferenceDb(sourceDbUrl) {
+  const dbName = `ci_schema_ref_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+  const adminDsn = buildAdminDsn(sourceDbUrl);
+  const createResult = psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `CREATE DATABASE ${dbName}`,
+    timeout: 3e4
+  });
+  if (createResult.status !== 0) {
+    throw new Error(
+      `Failed to create reference database: ${createResult.stderr || createResult.stdout}`
+    );
+  }
+  return { dsn: buildShadowDsn(sourceDbUrl, dbName), dbName };
+}
+function dropReferenceDb(sourceDbUrl, dbName) {
+  const adminDsn = buildAdminDsn(sourceDbUrl);
+  psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `
+      SELECT pg_terminate_backend(pid)
+      FROM pg_stat_activity
+      WHERE datname = '${dbName}' AND pid <> pg_backend_pid()
+    `,
+    timeout: 1e4
+  });
+  psqlSyncQuery({
+    databaseUrl: adminDsn,
+    sql: `DROP DATABASE IF EXISTS ${dbName}`,
+    timeout: 3e4
+  });
+}
+async function buildReferenceStats(repoRoot, tmpDir, sourceDbUrl) {
+  if (!sourceDbUrl) return null;
+  const referenceDb = createReferenceDb(sourceDbUrl);
+  const logFile = path4.join(tmpDir, "ci-reference-db-apply.log");
+  try {
+    const result = await execa(
+      "pnpm",
+      ["exec", "runa", "db", "apply", "preview", "--auto-approve", "--no-seed", "--verbose"],
+      {
+        cwd: repoRoot,
+        env: {
+          ...process.env,
+          DATABASE_URL_ADMIN: referenceDb.dsn,
+          DATABASE_URL: referenceDb.dsn
+        },
+        reject: false
+      }
+    );
+    const fullOutput = `${result.stdout || ""}
+${result.stderr || ""}`;
+    if (result.exitCode !== 0) {
+      throw new Error(`Failed to build reference DB: ${fullOutput.substring(0, 1e3)}`);
+    }
+    await (await import('fs/promises')).writeFile(logFile, fullOutput);
+    return collectEnvironmentStats(referenceDb.dsn, "Reference", true);
+  } finally {
+    dropReferenceDb(sourceDbUrl, referenceDb.dbName);
+  }
 }
 var collectSchemaStatsActor = fromPromise(
   async ({ input }) => {
-    const { localDbUrl, ciDbUrl, queryProduction } = input;
-    console.log("[schema-stats] Collecting schema statistics (DB query mode, parallel)...");
+    const { repoRoot, referenceDbUrl, ciDbUrl, queryProduction, tmpDir } = input;
+    console.log(
+      "[schema-stats] Collecting schema statistics (Reference/CI/Production, parallel)..."
+    );
     const productionUrl = process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL;
-    const [localResult, ciResult, productionResult] = await Promise.allSettled([
-      createStatsTask(localDbUrl, "Local", true),
-      createStatsTask(ciDbUrl, "CI"),
-      createStatsTask(queryProduction ? productionUrl ?? null : null, "Production")
+    const [referenceResult, ciResult, productionResult] = await Promise.allSettled([
+      buildReferenceStats(repoRoot, tmpDir, referenceDbUrl),
+      collectEnvironmentStats(ciDbUrl, "CI"),
+      collectEnvironmentStats(queryProduction ? productionUrl ?? null : null, "Production")
     ]);
-    const local = resolveSettledStats(localResult, "local");
+    const local = resolveSettledStats(referenceResult, "reference");
     const ci = resolveSettledStats(ciResult, "CI");
     const production = resolveSettledProductionStats(productionResult);
     return {
@@ -3611,6 +4139,25 @@ function parseSchemaChangeStats(sqlInput, logPath, repoRoot) {
   stats.hazards = parseHazards(sql, idempotentRoles);
   return stats;
 }
+function isCheckSummaryOutput(output) {
+  return output.includes("check complete") || output.includes("Check Summary");
+}
+function isSchemaOutOfSyncOutput(output) {
+  const lowerOutput = output.toLowerCase();
+  return lowerOutput.includes("database schema is out of sync") || lowerOutput.includes("db_schema_out_of_sync");
+}
+function countResidualStatements(stats) {
+  return stats.creates.tables + stats.creates.indexes + stats.creates.policies + stats.creates.functions + stats.creates.other + stats.alters + stats.drops;
+}
+function analyzePostCheckResult(params) {
+  const hasSchemaOutOfSync = isSchemaOutOfSyncOutput(params.output);
+  const hasDrift = hasSchemaOutOfSync || countResidualStatements(params.residualStats) > 0;
+  const checkSucceeded = params.exitCode === 0 || isCheckSummaryOutput(params.output) || hasSchemaOutOfSync;
+  return {
+    hasDrift: hasDrift || params.residualStats.hazards.length > 0,
+    commandFailed: !checkSucceeded
+  };
+}
 var syncSchemaActor = fromPromise(
   async ({ input }) => {
     const { repoRoot, tmpDir, databaseUrl, mode, skipCodegen } = input;
@@ -3649,7 +4196,18 @@ var syncSchemaActor = fromPromise(
         // Always verbose for full traceability
         ...skipCodegen ? ["--skip-codegen"] : []
       ];
+      const checkArgs = useDbApply ? ["exec", "runa", "db", "apply", envArg, "--check", "--no-seed", "--verbose"] : [
+        "exec",
+        "runa",
+        "db",
+        "sync",
+        envArg,
+        "--check",
+        "--verbose",
+        ...skipCodegen ? ["--skip-codegen"] : []
+      ];
       const logFile = path4.join(tmpDir, `ci-db-${useDbApply ? "apply" : "sync"}-${envArg}.log`);
+      const afterCheckLogFile = path4.join(tmpDir, `ci-db-check-${envArg}.log`);
       await runLogged({
         cwd: repoRoot,
         env: baseEnv,
@@ -3658,23 +4216,54 @@ var syncSchemaActor = fromPromise(
         args: syncArgs,
         logFile
       });
+      const postCheckResult = await runLogged({
+        cwd: repoRoot,
+        env: baseEnv,
+        label: `db ${useDbApply ? "apply" : "sync"} check (${envArg})`,
+        command: "pnpm",
+        args: checkArgs,
+        logFile: afterCheckLogFile,
+        reject: false
+      });
       let logContent = "";
+      let afterCheckLogContent = "";
       try {
         logContent = readFileSync(logFile, "utf-8");
       } catch {
       }
+      try {
+        afterCheckLogContent = readFileSync(afterCheckLogFile, "utf-8");
+      } catch {
+      }
       const changeStats = parseSchemaChangeStats(logContent, null, repoRoot);
+      const residualStats = parseSchemaChangeStats(afterCheckLogContent, null, repoRoot);
+      const fullPostCheckOutput = `${postCheckResult.stdout || ""}
+${postCheckResult.stderr || ""}`;
+      const postCheckAnalysis = analyzePostCheckResult({
+        exitCode: postCheckResult.exitCode ?? 1,
+        output: fullPostCheckOutput,
+        residualStats
+      });
+      if (postCheckAnalysis.commandFailed) {
+        throw new Error(
+          `Schema post-check failed (${postCheckResult.exitCode}): ${fullPostCheckOutput.substring(
+            0,
+            1e3
+          )}`
+        );
+      }
       const schemaDrift = {
         beforeSql: logContent.substring(0, 5e3),
         // Truncate for comment
-        afterSql: null,
-        hasDrift: false,
+        afterSql: postCheckAnalysis.hasDrift ? afterCheckLogContent.substring(0, 5e3) : "",
+        checkExecuted: true,
+        hasDrift: postCheckAnalysis.hasDrift,
         changeStats,
         gitDiff,
         logs: {
           beforeCheckLogPath: logFile,
           applyLogPath: logFile,
-          afterCheckLogPath: logFile
+          afterCheckLogPath: afterCheckLogFile
         }
       };
       return { applied: true, schemaDrift };
@@ -3682,6 +4271,7 @@ var syncSchemaActor = fromPromise(
       const schemaDrift = {
         beforeSql: null,
         afterSql: null,
+        checkExecuted: false,
         hasDrift: false,
         changeStats: null,
         gitDiff,
@@ -4345,6 +4935,213 @@ function safeReadFile(filePath) {
     return null;
   }
 }
+function buildSanitizeState() {
+  return {
+    inSingle: false,
+    inDouble: false,
+    inTemplate: false,
+    inLineComment: false,
+    inBlockComment: false
+  };
+}
+function applySanitizeStep(state, stateUpdate) {
+  return { ...state, ...stateUpdate };
+}
+function processLineCommentState(char) {
+  return {
+    output: char === "\n" ? "\n" : " ",
+    nextIndex: 1,
+    state: {
+      inLineComment: char !== "\n"
+    }
+  };
+}
+function processBlockCommentState(char, next) {
+  if (char === "*" && next === "/") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inBlockComment: false }
+    };
+  }
+  return {
+    output: char === "\n" ? "\n" : " ",
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processSingleQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === "'") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inSingle: false }
+    };
+  }
+  return {
+    output: stripStrings ? " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processDoubleQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === '"') {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inDouble: false }
+    };
+  }
+  return {
+    output: stripStrings ? " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processTemplateQuoteState(content, i, stripStrings) {
+  const char = content[i] ?? "";
+  if (char === "\\") {
+    return {
+      output: stripStrings ? "  " : `${char}${content[i + 1] ?? ""}`,
+      nextIndex: 2,
+      state: {}
+    };
+  }
+  if (char === "`") {
+    return {
+      output: "`",
+      nextIndex: 1,
+      state: { inTemplate: false }
+    };
+  }
+  return {
+    output: stripStrings ? char === "\n" ? "\n" : " " : char,
+    nextIndex: 1,
+    state: {}
+  };
+}
+function processQuoteState(content, i, stripStrings, quote) {
+  if (quote === "'") return processSingleQuoteState(content, i, stripStrings);
+  if (quote === '"') return processDoubleQuoteState(content, i, stripStrings);
+  return processTemplateQuoteState(content, i, stripStrings);
+}
+function processDefaultState(char, next) {
+  if (char === "/" && next === "/") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inLineComment: true }
+    };
+  }
+  if (char === "/" && next === "*") {
+    return {
+      output: "  ",
+      nextIndex: 2,
+      state: { inBlockComment: true }
+    };
+  }
+  if (char === "'") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inSingle: true }
+    };
+  }
+  if (char === '"') {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inDouble: true }
+    };
+  }
+  if (char === "`") {
+    return {
+      output: char,
+      nextIndex: 1,
+      state: { inTemplate: true }
+    };
+  }
+  return { output: char, nextIndex: 1, state: {} };
+}
+function runSanitizeStep(step, state, result, currentIndex) {
+  return {
+    i: currentIndex + step.nextIndex,
+    result: `${result}${step.output}`,
+    state: applySanitizeStep(state, step.state)
+  };
+}
+function sanitizeTsContent(content, options = {}) {
+  const { stripStrings = false } = options;
+  let result = "";
+  let i = 0;
+  let state = buildSanitizeState();
+  while (i < content.length) {
+    const char = content[i] ?? "";
+    const next = content[i + 1] ?? "";
+    if (state.inLineComment) {
+      const step2 = processLineCommentState(char);
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inBlockComment) {
+      const step2 = processBlockCommentState(char, next);
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inSingle) {
+      const step2 = processQuoteState(content, i, stripStrings, "'");
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inDouble) {
+      const step2 = processQuoteState(content, i, stripStrings, '"');
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    if (state.inTemplate) {
+      const step2 = processQuoteState(content, i, stripStrings, "`");
+      const nextState2 = runSanitizeStep(step2, state, result, i);
+      i = nextState2.i;
+      result = nextState2.result;
+      state = nextState2.state;
+      continue;
+    }
+    const step = processDefaultState(char, next);
+    const nextState = runSanitizeStep(step, state, result, i);
+    i = nextState.i;
+    result = nextState.result;
+    state = nextState.state;
+  }
+  return result;
+}
 function readManifest(manifestPath) {
   try {
     if (!existsSync(manifestPath)) {
@@ -4389,11 +5186,12 @@ async function detectLayer1Content(repoRoot, manifest) {
       const filePath = join(repoRoot, file);
       const content = safeReadFile(filePath);
       if (!content) continue;
+      const codeOnly = sanitizeTsContent(content, { stripStrings: true });
       const xstatePatterns = [
         /(?:export\s+)?(?:const|let|var)\s+\w+\s*=\s*createMachine\s*\(/,
         /(?:export\s+)?(?:const|let|var)\s+\w+\s*=\s*setup\s*\([^)]*\)\s*\.createMachine\s*\(/
       ];
-      const hasXStateMachine = xstatePatterns.some((p) => p.test(content));
+      const hasXStateMachine = xstatePatterns.some((p) => p.test(codeOnly));
       if (hasXStateMachine) {
         machineCount++;
       }
@@ -4523,6 +5321,41 @@ async function detectLayer4Content(repoRoot, manifest) {
   }
   return createSkipStatus(base, "No user-facing pages found");
 }
+var detectStaticLayer = async (_repoRoot, _manifest) => ({
+  layer: 0,
+  hasContent: true,
+  contentType: "machines",
+  // Not really, but L0 always runs
+  count: 1,
+  source: "filesystem"
+});
+var layerDetectors = {
+  0: detectStaticLayer,
+  1: detectLayer1Content,
+  2: detectLayer2Content,
+  3: detectLayer3Content,
+  4: detectLayer4Content
+};
+function getUnknownLayerStatus(layer) {
+  return {
+    layer,
+    hasContent: false,
+    contentType: "machines",
+    count: 0,
+    source: "filesystem",
+    skipReason: `Unknown layer ${layer}`
+  };
+}
+async function detectLayerStatus(layer, repoRoot, manifest) {
+  const detector = layerDetectors[layer];
+  if (!detector) {
+    return getUnknownLayerStatus(layer);
+  }
+  if (layer === 0) {
+    return detectStaticLayer();
+  }
+  return detector(repoRoot, manifest);
+}
 async function detectLayerContent(repoRoot, selectedLayers, manifestPath) {
   const effectiveManifestPath = join(repoRoot, ".runa/manifests/manifest.json");
   const manifest = readManifest(effectiveManifestPath);
@@ -4530,40 +5363,7 @@ async function detectLayerContent(repoRoot, selectedLayers, manifestPath) {
   const skippedLayers = [];
   const runnableLayers = [];
   for (const layer of selectedLayers) {
-    let status;
-    switch (layer) {
-      case 0:
-        status = {
-          layer: 0,
-          hasContent: true,
-          contentType: "machines",
-          // Not really, but L0 always runs
-          count: 1,
-          source: "filesystem"
-        };
-        break;
-      case 1:
-        status = await detectLayer1Content(repoRoot, manifest);
-        break;
-      case 2:
-        status = await detectLayer2Content(repoRoot);
-        break;
-      case 3:
-        status = await detectLayer3Content(repoRoot, manifest);
-        break;
-      case 4:
-        status = await detectLayer4Content(repoRoot, manifest);
-        break;
-      default:
-        status = {
-          layer,
-          hasContent: false,
-          contentType: "machines",
-          count: 0,
-          source: "filesystem",
-          skipReason: `Unknown layer ${layer}`
-        };
-    }
+    const status = await detectLayerStatus(layer, repoRoot, manifest);
     layers[layer] = status;
     if (status.hasContent) {
       runnableLayers.push(layer);
@@ -5248,38 +6048,70 @@ init_esm_shims();
 function emptyStats2() {
   return { tables: 0, functions: 0, policies: 0, indexes: 0, triggers: 0 };
 }
-function formatLocalCell(stats) {
+function isStatsAvailable(stats) {
+  return stats != null && stats.available !== false;
+}
+function isSemanticSnapshotAvailable(stats) {
+  return stats != null && stats.available !== false && stats.canonicalSnapshot?.available === true;
+}
+function formatUnavailableCell(stats) {
+  if (stats == null) return "n/a";
+  return stats.error ? `\u26AA unavailable` : "n/a";
+}
+function formatReferenceCell(stats, isAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
   return formatSchemaStatsCompact(stats, true);
 }
-function formatCiCellWithDiff(stats, reference) {
-  if (hasDisplayedStatsDiff(stats, reference)) {
+function formatCiCellWithDiff(stats, reference, semanticSummary, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
+  if (!referenceAvailable) return formatSchemaStatsCompact(stats, true);
+  if (hasDisplayedStatsDiff(stats, reference) || semanticSummary?.hasChanges) {
     return `\u26A0\uFE0F ${formatSchemaStatsWithDiff(stats, reference)}`;
   }
   return formatSchemaStatsCompact(stats, true);
 }
-function formatProdCellWithDiff(stats, reference, schemaName, expectedDrift) {
-  if (!hasDisplayedStatsDiff(stats, reference)) {
+function formatProdCellWithDiff(stats, reference, schemaName, expectedDrift, semanticSummary, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "\u26AA unavailable";
+  if (!referenceAvailable) return formatSchemaStatsCompact(stats, true);
+  if (!hasDisplayedStatsDiff(stats, reference) && !semanticSummary?.hasChanges) {
     return formatSchemaStatsCompact(stats, true);
   }
   const fieldDiffs = getFieldDiffs(stats, reference);
-  const allExpected = expectedDrift.length > 0 && isAllDriftExpected(schemaName, fieldDiffs, expectedDrift);
+  const allExpected = !semanticSummary?.hasChanges && expectedDrift.length > 0 && isAllDriftExpected(schemaName, fieldDiffs, expectedDrift);
   const marker = allExpected ? "\u{1F4CB}" : "\u{1F4DD}";
   return `${marker} ${formatSchemaStatsWithDiff(stats, reference)}`;
 }
-function formatCiTotalCellWithDiff(stats, reference) {
+function formatCiTotalCellWithDiff(stats, reference, hasSemanticChanges, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "**\u26AA unavailable**";
+  if (!referenceAvailable) return `**${formatSchemaStatsCompact(stats, true)}**`;
   const formatted = formatSchemaStatsCompact(stats, true);
-  if (hasDisplayedStatsDiff(stats, reference)) {
+  if (hasDisplayedStatsDiff(stats, reference) || hasSemanticChanges) {
     return `\u26A0\uFE0F **${formatted}**`;
   }
   return `**${formatted}**`;
 }
-function formatProdTotalCellWithDiff(stats, reference) {
+function formatProdTotalCellWithDiff(stats, reference, hasSemanticChanges, isAvailable, referenceAvailable) {
+  if (!isAvailable) return "**\u26AA unavailable**";
+  if (!referenceAvailable) return `**${formatSchemaStatsCompact(stats, true)}**`;
   const formatted = formatSchemaStatsCompact(stats, true);
-  if (hasDisplayedStatsDiff(stats, reference)) {
+  if (hasDisplayedStatsDiff(stats, reference) || hasSemanticChanges) {
     return `\u{1F4DD} **${formatted}**`;
   }
   return `**${formatted}**`;
 }
+function buildCanonicalDiffs(schemaStats) {
+  const referenceSnapshot = schemaStats.local.canonicalSnapshot;
+  const ciSnapshot = schemaStats.ci.canonicalSnapshot;
+  const productionSnapshot = schemaStats.production?.canonicalSnapshot;
+  const ciDiff = isSemanticSnapshotAvailable(schemaStats.local) && isSemanticSnapshotAvailable(schemaStats.ci) ? compareCanonicalSnapshots(referenceSnapshot, ciSnapshot) : null;
+  const productionDiff = isSemanticSnapshotAvailable(schemaStats.local) && isSemanticSnapshotAvailable(schemaStats.production) ? compareCanonicalSnapshots(referenceSnapshot, productionSnapshot) : null;
+  return {
+    ci: ciDiff,
+    production: productionDiff,
+    ciBySchema: ciDiff ? summarizeCanonicalDiffBySchema(ciDiff) : {},
+    productionBySchema: productionDiff ? summarizeCanonicalDiffBySchema(productionDiff) : {}
+  };
+}
 function getSortedActiveSchemas(schemaStats) {
   const allSchemas = /* @__PURE__ */ new Set([
     ...getActiveSchemas(schemaStats.local),
@@ -5292,37 +6124,67 @@ function getSortedActiveSchemas(schemaStats) {
     return a.localeCompare(b);
   });
 }
-function generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift) {
+function generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift, ciDiffBySchema, productionDiffBySchema) {
   const lines = [];
   for (const schemaName of sortedSchemas) {
     const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats2();
     const ciStats = schemaStats.ci.schemas[schemaName] ?? emptyStats2();
     const prodStats = schemaStats.production?.schemas[schemaName] ?? null;
-    const localCell = formatLocalCell(localStats);
-    const ciCell = formatCiCellWithDiff(ciStats, localStats);
-    const prodCell = prodStats !== null ? formatProdCellWithDiff(prodStats, localStats, schemaName, expectedDrift) : null;
+    const localCell = formatReferenceCell(localStats, isStatsAvailable(schemaStats.local));
+    const ciCell = formatCiCellWithDiff(
+      ciStats,
+      localStats,
+      ciDiffBySchema[schemaName],
+      isStatsAvailable(schemaStats.ci),
+      isStatsAvailable(schemaStats.local)
+    );
+    const prodCell = prodStats !== null ? formatProdCellWithDiff(
+      prodStats,
+      localStats,
+      schemaName,
+      expectedDrift,
+      productionDiffBySchema[schemaName],
+      isStatsAvailable(schemaStats.production),
+      isStatsAvailable(schemaStats.local)
+    ) : formatUnavailableCell(schemaStats.production);
     lines.push(
       hasProduction ? `| ${schemaName} | ${localCell} | ${ciCell} | ${prodCell ?? "n/a"} |` : `| ${schemaName} | ${localCell} | ${ciCell} |`
     );
   }
   return lines;
 }
-function generateSchemaMatrixSummary(localTotal, ciTotal, prodTotal) {
-  const ciSynced = !hasDisplayedStatsDiff(localTotal, ciTotal);
-  const prodSynced = prodTotal === null || !hasDisplayedStatsDiff(localTotal, prodTotal);
-  if (ciSynced && prodSynced) {
-    return `\u{1F4CA} **Local:** ${formatTotalStatsCompact(localTotal)}`;
+function generateSchemaMatrixSummary(localTotal, ciTotal, prodTotal, hasCiSemanticDiff, hasProdSemanticDiff, localAvailable, ciAvailable, prodAvailable) {
+  if (!localAvailable) {
+    const parts2 = ["\u{1F4CA} **Reference:** unavailable"];
+    if (ciAvailable) parts2.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
+    else parts2.push("| **CI:** unavailable");
+    if (prodTotal !== null) {
+      parts2.push(
+        prodAvailable ? `| **Prod:** ${formatTotalStatsCompact(prodTotal)}` : "| **Prod:** unavailable"
+      );
+    }
+    return parts2.join(" ");
+  }
+  const ciSynced = ciAvailable && !hasDisplayedStatsDiff(localTotal, ciTotal) && !hasCiSemanticDiff;
+  const prodSynced = prodTotal === null || prodAvailable && !hasDisplayedStatsDiff(localTotal, prodTotal) && !hasProdSemanticDiff;
+  if (ciSynced && prodSynced && ciAvailable && (prodTotal === null || prodAvailable)) {
+    return `\u{1F4CA} **Reference:** ${formatTotalStatsCompact(localTotal)}`;
   }
-  const parts = [`\u{1F4CA} **Local:** ${formatTotalStatsCompact(localTotal)}`];
-  if (!ciSynced) parts.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
+  const parts = [`\u{1F4CA} **Reference:** ${formatTotalStatsCompact(localTotal)}`];
+  if (!ciAvailable) parts.push("| **CI:** unavailable");
+  else if (!ciSynced) parts.push(`| **CI:** ${formatTotalStatsCompact(ciTotal)}`);
   if (prodTotal !== null && !prodSynced) {
-    parts.push(`| **Prod:** \u{1F4DD} ${formatTotalStatsCompact(prodTotal)}`);
+    parts.push(
+      prodAvailable ? `| **Prod:** \u{1F4DD} ${formatTotalStatsCompact(prodTotal)}` : "| **Prod:** unavailable"
+    );
   }
   return parts.join(" ");
 }
 function generateIndexDiffSection(schemaStats) {
-  if (!schemaStats.production) return [];
-  const diff = compareIndexLists(schemaStats.local, schemaStats.production);
+  if (!isStatsAvailable(schemaStats.local) || !isStatsAvailable(schemaStats.production)) return [];
+  const productionStats = schemaStats.production;
+  if (!productionStats) return [];
+  const diff = compareIndexLists(schemaStats.local, productionStats);
   if (!hasIndexDiff(diff)) return [];
   const lines = [];
   if (diff.missing.length > 0) {
@@ -5342,8 +6204,85 @@ function generateIndexDiffSection(schemaStats) {
   }
   return lines;
 }
+function appendAvailabilityNote(lines, label, error, kind) {
+  const scope = kind === "stats" ? "schema stats" : "semantic diff";
+  lines.push(`> \u26AA **${label} ${scope} unavailable:** ${error ?? "unknown error"}`);
+}
+function generateAvailabilityNotes(schemaStats) {
+  const lines = [];
+  const appendNotesForEnv = (label, stats) => {
+    if (stats == null) return;
+    if (!isStatsAvailable(stats)) {
+      appendAvailabilityNote(lines, label, stats.error, "stats");
+      return;
+    }
+    if (stats.canonicalSnapshot?.available === false) {
+      appendAvailabilityNote(lines, label, stats.canonicalSnapshot.error, "semantic");
+    }
+  };
+  appendNotesForEnv("Reference", schemaStats.local);
+  appendNotesForEnv("CI", schemaStats.ci);
+  appendNotesForEnv("Prod", schemaStats.production);
+  if (lines.length === 0) return [];
+  return ["", ...lines, ">"];
+}
+function describeObject(object) {
+  switch (object.kind) {
+    case "index":
+      return `index \`${object.label}\``;
+    case "policy":
+      return `policy \`${object.label}\``;
+    case "trigger":
+      return `trigger \`${object.label}\``;
+    case "function":
+      return `function \`${object.label}\``;
+    case "table":
+      return `table \`${object.label}\``;
+  }
+}
+function appendObjectLines(lines, prefix, objects, label) {
+  if (objects.length === 0) return;
+  lines.push(`> ${prefix} **${label}:**`);
+  for (const object of objects.slice(0, 6)) {
+    lines.push(`> - ${describeObject(object)}`);
+  }
+  if (objects.length > 6) {
+    lines.push(`> - ... \u4ED6${objects.length - 6}\u4EF6`);
+  }
+  lines.push(">");
+}
+function appendChangedObjectLines(lines, prefix, pairs, label) {
+  if (pairs.length === 0) return;
+  lines.push(`> ${prefix} **${label}:**`);
+  for (const pair of pairs.slice(0, 6)) {
+    lines.push(`> - ${describeObject(pair.reference)}`);
+  }
+  if (pairs.length > 6) {
+    lines.push(`> - ... \u4ED6${pairs.length - 6}\u4EF6`);
+  }
+  lines.push(">");
+}
+function generateSemanticDiffSection(title, prefix, diff) {
+  if (!diff || !hasCanonicalChanges(diff)) return [];
+  const lines = ["", `> ${prefix} **${title} semantic diff:**`, ">"];
+  appendObjectLines(lines, prefix, diff.missing, "missing objects");
+  appendObjectLines(lines, prefix, diff.extra, "extra objects");
+  appendChangedObjectLines(lines, prefix, diff.changed, "changed objects");
+  if (diff.renamed.length > 0) {
+    lines.push(`> ${prefix} **renamed indexes:**`);
+    for (const pair of diff.renamed.slice(0, 6)) {
+      lines.push(`> - \`${pair.reference.label}\` -> \`${pair.target.label}\``);
+    }
+    if (diff.renamed.length > 6) {
+      lines.push(`> - ... \u4ED6${diff.renamed.length - 6}\u4EF6`);
+    }
+    lines.push(">");
+  }
+  return lines;
+}
 function generateExpectedDriftFootnotes(schemaStats, sortedSchemas, expectedDrift) {
   if (expectedDrift.length === 0 || !schemaStats.production) return [];
+  if (!isStatsAvailable(schemaStats.local) || !isStatsAvailable(schemaStats.production)) return [];
   const allReasons = /* @__PURE__ */ new Set();
   for (const schemaName of sortedSchemas) {
     const localStats = schemaStats.local.schemas[schemaName] ?? emptyStats2();
@@ -5370,33 +6309,69 @@ function formatSchemaMatrix(schemaStats, gitDiff, expectedDrift = []) {
   const hasGitChanges = gitDiff && gitDiff.filesChanged.length > 0;
   const header = hasGitChanges ? `### \u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1 (+${gitDiff.linesAdded}/-${gitDiff.linesDeleted} PR\u5185)` : "### \u30B9\u30AD\u30FC\u30DE\u72B6\u6CC1";
   const sortedSchemas = getSortedActiveSchemas(schemaStats);
+  const availabilityNotes = generateAvailabilityNotes(schemaStats);
   if (sortedSchemas.length === 0) {
-    return [header, "", "_\u30B9\u30AD\u30FC\u30DE\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u304C\u3042\u308A\u307E\u305B\u3093_", ""];
+    return [header, "", ...availabilityNotes, "_\u30B9\u30AD\u30FC\u30DE\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u304C\u3042\u308A\u307E\u305B\u3093_", ""];
   }
   const hasProduction = schemaStats.production !== null;
-  const tableHeader = hasProduction ? ["| Schema | \u{1F4C4} Local | \u{1F52C} CI | \u{1F3ED} Prod |", "|--------|:--------:|:-----:|:-------:|"] : ["| Schema | \u{1F4C4} Local | \u{1F52C} CI |", "|--------|:--------:|:-----:|"];
-  const rows = generateSchemaTableRows(schemaStats, sortedSchemas, hasProduction, expectedDrift);
+  const canonicalDiffs = buildCanonicalDiffs(schemaStats);
+  const tableHeader = hasProduction ? ["| Schema | \u{1F4C4} Reference | \u{1F52C} CI | \u{1F3ED} Prod |", "|--------|:------------:|:-----:|:-------:|"] : ["| Schema | \u{1F4C4} Reference | \u{1F52C} CI |", "|--------|:------------:|:-----:|"];
+  const rows = generateSchemaTableRows(
+    schemaStats,
+    sortedSchemas,
+    hasProduction,
+    expectedDrift,
+    canonicalDiffs.ciBySchema,
+    canonicalDiffs.productionBySchema
+  );
   const { local, ci, production } = schemaStats;
-  const localTotalCell = `**${formatSchemaStatsCompact(local.total, true)}**`;
-  const ciTotalCell = formatCiTotalCellWithDiff(ci.total, local.total);
-  const prodTotalCell = production ? formatProdTotalCellWithDiff(production.total, local.total) : null;
+  const localTotalCell = isStatsAvailable(local) ? `**${formatSchemaStatsCompact(local.total, true)}**` : "**\u26AA unavailable**";
+  const ciTotalCell = formatCiTotalCellWithDiff(
+    ci.total,
+    local.total,
+    canonicalDiffs.ci ? hasCanonicalChanges(canonicalDiffs.ci) : false,
+    isStatsAvailable(ci),
+    isStatsAvailable(local)
+  );
+  const prodTotalCell = production ? formatProdTotalCellWithDiff(
+    production.total,
+    local.total,
+    canonicalDiffs.production ? hasCanonicalChanges(canonicalDiffs.production) : false,
+    isStatsAvailable(production),
+    isStatsAvailable(local)
+  ) : null;
   const totalRow = hasProduction ? `| **Total** | ${localTotalCell} | ${ciTotalCell} | ${prodTotalCell ?? "n/a"} |` : `| **Total** | ${localTotalCell} | ${ciTotalCell} |`;
-  const summary = generateSchemaMatrixSummary(local.total, ci.total, production?.total ?? null);
+  const summary = generateSchemaMatrixSummary(
+    local.total,
+    ci.total,
+    production?.total ?? null,
+    canonicalDiffs.ci ? hasCanonicalChanges(canonicalDiffs.ci) : false,
+    canonicalDiffs.production ? hasCanonicalChanges(canonicalDiffs.production) : false,
+    isStatsAvailable(local),
+    isStatsAvailable(ci),
+    isStatsAvailable(production)
+  );
   const indexDiffSection = generateIndexDiffSection(schemaStats);
   const expectedDriftNotes = generateExpectedDriftFootnotes(
     schemaStats,
     sortedSchemas,
     expectedDrift
   );
+  const semanticDiffSection = [
+    ...generateSemanticDiffSection("CI", "\u26A0\uFE0F", canonicalDiffs.ci),
+    ...generateSemanticDiffSection("Prod", "\u{1F4DD}", canonicalDiffs.production)
+  ];
   return [
     header,
     "",
+    ...availabilityNotes,
     ...tableHeader,
     ...rows,
     totalRow,
     "",
     summary,
     ...indexDiffSection,
+    ...semanticDiffSection,
     ...expectedDriftNotes,
     "",
     "<sub>T=\u30C6\u30FC\u30D6\u30EB F=\u95A2\u6570 P=\u30DD\u30EA\u30B7\u30FC I=\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9 Tr=\u30C8\u30EA\u30AC\u30FC</sub>",
@@ -5406,8 +6381,8 @@ function formatSchemaMatrix(schemaStats, gitDiff, expectedDrift = []) {
 
 // src/commands/ci/machine/formatters/sections/final-comment.ts
 function formatDriftStatus(drift) {
-  if (drift == null) {
-    return "_n/a_";
+  if (drift == null || !drift.checkExecuted) {
+    return "_\u672A\u691C\u8A3C_";
   }
   return drift.hasDrift ? "**\u274C \u30C9\u30EA\u30D5\u30C8\u691C\u51FA (schemas \u2194 CI DB)**" : "**\u2705 \u30C9\u30EA\u30D5\u30C8\u306A\u3057 (schemas \u2194 CI DB)**";
 }
@@ -5534,6 +6509,8 @@ function classifyPreviewError(error) {
 }
 function generateIndexDiffWarning(schemaStats) {
   if (!schemaStats?.local || !schemaStats?.production) return [];
+  if (schemaStats.local.available === false || schemaStats.production.available === false)
+    return [];
   const indexDiff = compareIndexLists(schemaStats.local, schemaStats.production);
   if (!hasIndexDiff(indexDiff)) return [];
   const diffParts = [];
@@ -6410,7 +7387,7 @@ function createBuildAndPlaywrightInput(context) {
       enablePublicE2EFlag: true
     }),
     isCI: context.input.isCI ?? false,
-    skipPlaywright: context.selectedLayers.includes(4) ? false : true
+    skipPlaywright: !context.selectedLayers.includes(4)
   };
 }
 function createAppStartInput(context) {
@@ -6845,11 +7822,12 @@ var ciMachine = setup({
       invoke: {
         src: "collectSchemaStats",
         input: ({ context }) => ({
-          // In CI mode, local and CI both use the Docker Supabase
-          localDbUrl: context.supabase?.databaseUrlRaw ?? null,
+          repoRoot: context.repoRoot ?? process.cwd(),
+          referenceDbUrl: context.supabase?.databaseUrlRaw ?? null,
           ciDbUrl: context.supabase?.databaseUrlRaw ?? null,
           // Query production only in ci-pr modes
-          queryProduction: context.mode !== "ci-local"
+          queryProduction: context.mode !== "ci-local",
+          tmpDir: context.tmpDir ?? process.cwd()
         }),
         onDone: {
           target: "decidePath",
@@ -7704,16 +8682,13 @@ var stateLogHandlers = {
     logger.info(`Running: ${ctx.selectedLayers.map((l) => `test layer${l}`).join(", ")}`);
   }
 };
-stateLogHandlers["setup.resolving"] = stateLogHandlers.setup;
-stateLogHandlers["setup.local"] = stateLogHandlers.setup;
-function handleStateChange(snapshot, prevState, logger) {
-  const state = getStateName(snapshot);
-  if (state === prevState) return;
-  const handler = stateLogHandlers[state];
-  if (handler) {
-    handler(snapshot.context, logger);
-  }
-}
+var handleStateChange = createMachineStateChangeLogger({
+  getState: getStateName,
+  getContext: (snapshot) => snapshot.context,
+  handlers: stateLogHandlers,
+  useParentState: true,
+  handlerArgumentOrder: "context-first"
+});
 function printSummary(logger, output) {
   endCurrentGroup();
   logSection2("Summary");
@@ -8052,6 +9027,7 @@ function logPlan2(steps) {
     console.log("");
   }
 }
+var CI_PR_UNKNOWN_STATE_LOG_SKIP = /* @__PURE__ */ new Set(["decidePath", "done", "failed"]);
 var stateLogHandlers2 = {
   // ─── Setup Phase ───────────────────────────────────────────
   setup: (_ctx, _logger) => {
@@ -8186,18 +9162,18 @@ var stateLogHandlers2 = {
     logSection3("Finalize: Post GitHub Comment");
   }
 };
-stateLogHandlers2["setup.resolving"] = stateLogHandlers2.setup;
-stateLogHandlers2["finalize.writeSummary"] = stateLogHandlers2.finalize;
-function handleStateChange2(snapshot, prevState, logger) {
-  const state = getStateName(snapshot);
-  if (state === prevState) return;
-  const handler = stateLogHandlers2[state];
-  if (handler) {
-    handler(snapshot.context, logger);
-  } else if (cliOutputFormat !== "json" && state !== "decidePath" && state !== "done" && state !== "failed") {
-    logger.info(`State: ${state}`);
+var handleStateChange2 = createMachineStateChangeLogger({
+  getState: getStateName,
+  getContext: (snapshot) => snapshot.context,
+  handlers: stateLogHandlers2,
+  useParentState: true,
+  handlerArgumentOrder: "context-first",
+  onUnknownState: (state, logger) => {
+    if (cliOutputFormat !== "json" && !CI_PR_UNKNOWN_STATE_LOG_SKIP.has(state)) {
+      logger.info(`State: ${state}`);
+    }
   }
-}
+});
 function printSummary2(logger, output) {
   logSection3("Summary");
   logger.info(`Mode: ${output.mode}`);