@runa-ai/runa-cli 0.7.0 → 0.7.1

package/dist/{cli-2JNBJUBB.js → cli-UZA4RBNQ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import { enableNonInteractiveMode } from './chunk-6Y3LAUGL.js';
 import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
-import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-AIP6MR42.js';
+import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-AFY3TX4I.js';
 import { emitDefaultSuccessIfNeeded } from './chunk-WJXC4MVY.js';
 import { parseOutputFormat, setOutputFormat, getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
@@ -145,7 +145,7 @@ function isTestCommand(requested) {
 async function registerProjectLifecycleCommands(program, requested, loadAllCommands) {
   if (!loadAllCommands && requested) {
     if (requested === "init") {
-      const { initCommand: initCommand2 } = await import('./init-ZIL6LRFO.js');
+      const { initCommand: initCommand2 } = await import('./init-U4VCRHTD.js');
       program.addCommand(initCommand2);
       return;
     }
@@ -155,7 +155,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
       return;
     }
     if (requested === "upgrade") {
-      const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-NUK3ZBCL.js');
+      const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-7TWORWBV.js');
       program.addCommand(upgradeCommand2);
       return;
     }
@@ -165,7 +165,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
       return;
     }
     if (requested === "build") {
-      const { buildCommand: buildCommand2 } = await import('./build-V66FAQXB.js');
+      const { buildCommand: buildCommand2 } = await import('./build-HUDIP6KU.js');
       program.addCommand(buildCommand2);
       return;
     }
@@ -183,11 +183,11 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
     { buildCommand },
     { devCommand }
   ] = await Promise.all([
-    import('./init-ZIL6LRFO.js'),
+    import('./init-U4VCRHTD.js'),
     import('./prepare-32DOVHTE.js'),
-    import('./upgrade-NUK3ZBCL.js'),
+    import('./upgrade-7TWORWBV.js'),
     import('./validate-CAAW4Y44.js'),
-    import('./build-V66FAQXB.js'),
+    import('./build-HUDIP6KU.js'),
     import('./dev-5YXNPTCJ.js')
   ]);
   program.addCommand(initCommand);
@@ -444,11 +444,11 @@ async function registerStatusCheckAndUtilityCommands(program, requested, loadAll
   program.addCommand(unlinkCommand);
 }
 async function registerCiCommand(program) {
-  const { ciCommand } = await import('./ci-ZWRVWNFX.js');
+  const { ciCommand } = await import('./ci-XY6IKEDC.js');
   program.addCommand(ciCommand);
 }
 async function registerDbCommand(program) {
-  const { dbCommand } = await import('./db-XULCILOU.js');
+  const { dbCommand } = await import('./db-Q3GF7JWP.js');
   program.addCommand(dbCommand);
 }
 async function registerServicesCommand(program) {
@@ -456,11 +456,11 @@ async function registerServicesCommand(program) {
   program.addCommand(servicesCommand);
 }
 async function registerEnvCommand(program) {
-  const { envCommand } = await import('./env-SS66PZ4B.js');
+  const { envCommand } = await import('./env-GMB3THRG.js');
   program.addCommand(envCommand);
 }
 async function registerHotfixCommand(program) {
-  const { hotfixCommand } = await import('./hotfix-YA3DGLOM.js');
+  const { hotfixCommand } = await import('./hotfix-NDTPY2T4.js');
   program.addCommand(hotfixCommand);
 }
 async function registerSdkCommand(program) {
@@ -480,11 +480,11 @@ async function registerWorkflowCommand(program) {
   program.addCommand(workflowCommand);
 }
 async function registerVulnCheckCommand(program) {
-  const { vulnCheckCommand } = await import('./vuln-check-2W7N5TA2.js');
+  const { vulnCheckCommand } = await import('./vuln-check-6CMNPSBR.js');
   program.addCommand(vulnCheckCommand);
 }
 async function registerTemplateCheckCommand(program) {
-  const { templateCheckCommand } = await import('./template-check-3P4HZXVY.js');
+  const { templateCheckCommand } = await import('./template-check-FFJVDLBF.js');
   program.addCommand(templateCheckCommand);
 }
 async function registerSessionCommands(program) {

package/dist/commands/ci/machine/actors/db/collect-schema-stats.d.ts

@@ -5,7 +5,7 @@
  * Pattern: Fine-grained actor for single step
  *
  * Comparison strategy:
- * - Reference stats: Build a temporary reference DB from repo SQL, then query it
+ * - Reference stats: Build a temporary reference DB from repo SQL, or reuse the synced CI DB
  * - CI stats: Query CI database (Docker Supabase or Branch DB)
  * - Production stats: Query Production DB (if GH_DATABASE_URL_ADMIN set)
  *
@@ -16,6 +16,7 @@
  * Results are used for PR comment Schema Status table.
  */
 import { type SchemaStatsSnapshot } from './schema-stats.js';
+export type ReferenceStatsStrategy = 'rebuild' | 'reuse-ci';
 export interface CollectSchemaStatsInput {
     /** Repository root (used to build a reference DB from repo SQL) */
     repoRoot: string;
@@ -23,6 +24,8 @@ export interface CollectSchemaStatsInput {
     referenceDbUrl: string | null;
     /** CI database URL (Docker Supabase or Branch DB) */
     ciDbUrl: string | null;
+    /** How to resolve the reference schema snapshot */
+    referenceStrategy?: ReferenceStatsStrategy;
     /** Whether to query production (requires GH_DATABASE_URL_ADMIN) */
     queryProduction: boolean;
     /** Temporary directory for logs */

package/dist/commands/ci/machine/actors/db/production-preview.d.ts

@@ -21,6 +21,16 @@ export interface ProductionPreviewInput {
 export interface ProductionPreviewOutput {
     preview: ProductionPreview;
 }
+export type SchemaChangeState = 'changes' | 'no-changes' | 'unknown';
+/**
+ * Detect whether db apply --check output indicates schema changes.
+ *
+ * Important:
+ * - "No changes were applied (check mode)" is always true in check mode and MUST NOT
+ *   be treated as "schema changes = none".
+ * - We prefer explicit change/no-change summary lines from db apply output.
+ */
+export declare function detectSchemaChangeState(fullOutput: string): SchemaChangeState;
 /**
  * Run production schema preview (dry-run).
  *

package/dist/commands/ci/machine/actors/db/schema-canonical-diff.d.ts

@@ -48,8 +48,30 @@ export interface SchemaSemanticSummary {
 }
 export type CanonicalDiffBySchema = Record<string, SchemaSemanticSummary>;
 export declare function createUnavailableCanonicalSnapshot(error: string): CanonicalSchemaSnapshot;
+interface TableColumnRow {
+    schema_name: string;
+    table_name: string;
+    attnum: number;
+    column_name: string;
+    data_type: string;
+    not_null: boolean;
+    default_expr?: string | null;
+    identity_kind?: string | null;
+    generated_kind?: string | null;
+}
+interface CanonicalTableColumnPayload {
+    name: string;
+    type: string;
+    notNull: boolean;
+    default: string;
+    identity: string;
+    generated: string;
+}
+export declare function createCanonicalTableColumnPayload(row: Pick<TableColumnRow, 'column_name' | 'data_type' | 'not_null' | 'default_expr' | 'identity_kind' | 'generated_kind'>): CanonicalTableColumnPayload;
+export declare function sortCanonicalTableColumns(columns: readonly CanonicalTableColumnPayload[]): CanonicalTableColumnPayload[];
 export declare function getCanonicalSchemaSnapshot(databaseUrl: string): Promise<CanonicalSchemaSnapshot>;
 export declare function compareCanonicalSnapshots(reference: CanonicalSchemaSnapshot, target: CanonicalSchemaSnapshot): CanonicalSchemaDiff;
 export declare function summarizeCanonicalDiffBySchema(diff: CanonicalSchemaDiff): CanonicalDiffBySchema;
 export declare function hasCanonicalChanges(diff: CanonicalSchemaDiff): boolean;
+export {};
 //# sourceMappingURL=schema-canonical-diff.d.ts.map

package/dist/commands/ci/machine/commands/machine-runner.d.ts

@@ -10,8 +10,10 @@
  * - Fire-and-forget pattern (non-blocking)
  */
 import type { CLILogger } from '@runa-ai/runa';
+import { type CiStep } from '../formatters/github-comment.js';
 import { type CiSnapshot } from '../machine.js';
 import type { CiInput, CiOutput, LayerResult } from '../types.js';
+export declare function resolveStepForState(state: string): CiStep | undefined;
 /**
  * State change callback type.
  */

package/dist/commands/ci/machine/formatters/sections/production-schema-status.d.ts

@@ -0,0 +1,30 @@
+import { type ExpectedDriftEntry, type IndexDiff, type SchemaStats, type SchemaStatsSnapshot } from '../../actors/db/schema-stats.js';
+import { type CanonicalSchemaDiff } from '../../actors/db/schema-canonical-diff.js';
+import type { ProductionPreview } from '../../types.js';
+export interface ProductionSchemaSignals {
+    previewHasChanges: boolean;
+    indexDiff: IndexDiff | null;
+    semanticDiff: CanonicalSchemaDiff | null;
+    countDiffs: CountDiffEntry[];
+    hasIndexChanges: boolean;
+    hasUnexpectedIndexChanges: boolean;
+    hasSemanticChanges: boolean;
+    hasCountChanges: boolean;
+    hasUnexpectedCountChanges: boolean;
+    hasKnownDriftOnly: boolean;
+    knownDriftReasons: string[];
+    requiresDeploy: boolean;
+    previewMissedChanges: boolean;
+    previewOnlyChanges: boolean;
+}
+export interface CountDiffEntry {
+    schema: string;
+    field: keyof SchemaStats;
+    value: number;
+    reference: number;
+    delta: number;
+    expected: boolean;
+    reason?: string;
+}
+export declare function getProductionSchemaSignals(productionPreview: ProductionPreview | null, schemaStats: SchemaStatsSnapshot | null, expectedDrift?: ExpectedDriftEntry[]): ProductionSchemaSignals;
+//# sourceMappingURL=production-schema-status.d.ts.map

package/dist/commands/ci/machine/helpers.d.ts

@@ -29,6 +29,14 @@ export declare function getLayersForCorePhase(selectedLayers: number[], mode: st
  * Check if E2E layer (4) is selected.
  */
 export declare function hasE2ELayer(selectedLayers: number[]): boolean;
+/**
+ * Determine whether schema stats can safely reuse the synced CI database
+ * instead of rebuilding a temporary reference database.
+ *
+ * This optimization is only valid for PR CI runs where local-only overlays
+ * such as ci.custom.sql are never applied.
+ */
+export declare function shouldReuseCiReferenceStats(context: CiContext): boolean;
 /** Layer result status type */
 export type LayerStatus = 'passed' | 'failed' | 'skipped' | 'timeout' | 'killed';
 /**

package/dist/commands/ci/machine/machine.d.ts

@@ -8,9 +8,10 @@
  * 1. idle → START → setup (mode-aware: localSetup or prLocalSetup)
  * 2. [ci-local] setup → dbReset → pullProduction? → syncSchema → applySeeds
  *              → productionPreview → collectSchemaStats → installPgTap → runCoreTests → done
- * 3. [ci-pr] setup → initialComment → syncSchema → applySeeds → productionPreview
- *           → collectSchemaStats → setupRoles → staticChecks → buildAndPlaywright
- *           → appStart → capabilities → runCoreTests → e2ePhase → finalize → done
+ * 3. [ci-pr] setup → initialComment → syncSchema → applySeeds → postSeedPr
+ *           execution: setupRoles → staticChecks → buildAndPlaywright → appStart
+ *                    → capabilities → runCoreTests → e2ePhase → finalize → done
+ *           observability: productionPreview ∥ collectSchemaStats
  *
  * State Flow (detailed):
  *   idle → setup → initialComment? → dbReset? → pullProduction? → syncSchema → applySeeds
@@ -168,10 +169,20 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
 } | {
     type: "allTestsPassed";
     params: unknown;
-}, never, "done" | "failed" | "staticChecks" | "idle" | "capabilities" | "appStart" | "syncSchema" | "applySeeds" | "productionPreview" | "pullProduction" | "collectSchemaStats" | "setupRoles" | "installPgTap" | "buildAndPlaywright" | "initialComment" | "dbReset" | "decidePath" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
+}, never, "done" | "failed" | "staticChecks" | "idle" | "capabilities" | "appStart" | "syncSchema" | "applySeeds" | "productionPreview" | "pullProduction" | "collectSchemaStats" | "setupRoles" | "installPgTap" | "buildAndPlaywright" | "initialComment" | "dbReset" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | "decidePath" | {
     setup: "local" | "resolving" | "prLocal" | "complete";
 } | {
     finalize: "writeSummary" | "complete" | "postComment";
+} | {
+    postSeedPr: {
+        execution: "done" | "failed" | "staticChecks" | "capabilities" | "appStart" | "setupRoles" | "buildAndPlaywright" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
+            e2ePhase: {
+                intermediateComment: "done" | "checking" | "posting";
+                e2eTests: "done" | "running";
+            };
+        };
+        observability: "done" | "productionPreview" | "collectSchemaStats";
+    };
 } | {
     e2ePhase: {
         intermediateComment: "done" | "checking" | "posting";
@@ -257,6 +268,48 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
         readonly pullProduction: {};
         readonly syncSchema: {};
         readonly applySeeds: {};
+        readonly postSeedPr: {
+            states: {
+                readonly execution: {
+                    states: {
+                        readonly setupRoles: {};
+                        readonly staticChecks: {};
+                        readonly buildAndPlaywright: {};
+                        readonly appStart: {};
+                        readonly capabilities: {};
+                        readonly runCoreTests: {};
+                        readonly coreTestsComplete: {};
+                        readonly coreTestsFailed: {};
+                        readonly e2ePhase: {
+                            states: {
+                                readonly intermediateComment: {
+                                    states: {
+                                        readonly checking: {};
+                                        readonly posting: {};
+                                        readonly done: {};
+                                    };
+                                };
+                                readonly e2eTests: {
+                                    states: {
+                                        readonly running: {};
+                                        readonly done: {};
+                                    };
+                                };
+                            };
+                        };
+                        readonly failed: {};
+                        readonly done: {};
+                    };
+                };
+                readonly observability: {
+                    states: {
+                        readonly productionPreview: {};
+                        readonly collectSchemaStats: {};
+                        readonly done: {};
+                    };
+                };
+            };
+        };
         readonly productionPreview: {};
         readonly collectSchemaStats: {};
         readonly decidePath: {};

package/dist/commands/template-check/commands/template-check.d.ts

@@ -9,6 +9,7 @@
  * - runa template-check --verbose          # Show all files including identical
  * - runa template-check --diff             # Show unified diff for differences
  * - runa template-check --category rules   # Filter by category
+ * - runa template-check --path <file>      # Restrict to specific paths
  * - runa template-check --json             # Output as JSON (for CI)
  * - runa template-check --quiet            # Only summary + actions (for pre-commit)
  */

package/dist/commands/template-check/contract.d.ts

@@ -17,6 +17,7 @@ export declare const SyncCheckInputSchema: z.ZodObject<{
     verbose: z.ZodDefault<z.ZodBoolean>;
     diff: z.ZodDefault<z.ZodBoolean>;
     category: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
     json: z.ZodDefault<z.ZodBoolean>;
     targetDir: z.ZodOptional<z.ZodString>;
     quiet: z.ZodDefault<z.ZodBoolean>;

package/dist/constants/versions.d.ts

@@ -20,7 +20,7 @@
  *
  * Sync strategy: Keep this in sync with packages/runa-templates/package.json version.
  */
-export declare const COMPATIBLE_TEMPLATES_VERSION = "0.5.71";
+export declare const COMPATIBLE_TEMPLATES_VERSION = "0.7.1";
 /**
  * Templates package name on GitHub Packages.
  * Published to npm.pkg.github.com (requires NODE_AUTH_TOKEN).

package/dist/{db-XULCILOU.js → db-Q3GF7JWP.js}

@@ -3,8 +3,8 @@ import { createRequire } from 'module';
 import { detectDatabaseStack, getStackPaths } from './chunk-CCKG5R4Y.js';
 import './chunk-ZZOXM6Q4.js';
 import { createError } from './chunk-JQXOVCOP.js';
-import { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-KWX3JHCY.js';
-export { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-KWX3JHCY.js';
+import { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-AKZAN4BC.js';
+export { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-AKZAN4BC.js';
 import { detectAppSchemas, normalizeDatabaseUrlForDdl, formatSchemasForSql } from './chunk-XDCHRVE3.js';
 import './chunk-NPSRD26F.js';
 import { categorizeRisks, detectSchemaRisks } from './chunk-H2AHNI75.js';
@@ -12,7 +12,7 @@ import { loadEnvFiles } from './chunk-644FVGIQ.js';
 import { diagnoseSupabaseStart } from './chunk-AAIE4F2U.js';
 import { validateUserFilePath, filterSafePaths, resolveSafePath } from './chunk-DRSUEMAK.js';
 import { runMachine } from './chunk-QDF7QXBL.js';
-import './chunk-IBVVGH6X.js';
+import './chunk-EMB6IZFT.js';
 import { extractSchemaTablesAndEnums, fetchDbTablesAndEnums, extractTablesFromIdempotentSql, diffSchema, generateTablesManifest, writeEnvLocalBridge, removeEnvLocalBridge } from './chunk-FHG3ILE4.js';
 import { parsePostgresUrl, buildPsqlEnv, buildPsqlArgs, psqlSyncQuery, blankDollarQuotedBodies, stripSqlComments, psqlSyncFile, psqlExec, psqlQuery } from './chunk-7B5C6U2K.js';
 import { redactSecrets } from './chunk-II7VYQEM.js';
@@ -223,11 +223,39 @@ function flushStatement(current, results) {
   if (!sql) return;
   results.push({ index: current.index, sql, hazards: current.hazards });
 }
+function stripBlockComments(line, inBlockComment) {
+  let index = 0;
+  let text = "";
+  let isInsideBlockComment = inBlockComment;
+  while (index < line.length) {
+    if (isInsideBlockComment) {
+      const endIndex = line.indexOf("*/", index);
+      if (endIndex === -1) {
+        return { text, inBlockComment: true };
+      }
+      index = endIndex + 2;
+      isInsideBlockComment = false;
+      continue;
+    }
+    const startIndex = line.indexOf("/*", index);
+    if (startIndex === -1) {
+      text += line.slice(index);
+      break;
+    }
+    text += line.slice(index, startIndex);
+    index = startIndex + 2;
+    isInsideBlockComment = true;
+  }
+  return { text, inBlockComment: isInsideBlockComment };
+}
 function parseWithStatementMarkers(lines) {
   const results = [];
   let current = null;
+  let inBlockComment = false;
   for (const line of lines) {
-    const trimmed = line.trim();
+    const stripped = stripBlockComments(line, inBlockComment);
+    inBlockComment = stripped.inBlockComment;
+    const trimmed = stripped.text.trim();
     const idxMatch = trimmed.match(STATEMENT_IDX_REGEX);
     if (idxMatch) {
       flushStatement(current, results);
@@ -240,7 +268,7 @@ function parseWithStatementMarkers(lines) {
       continue;
     }
     if (current && trimmed && !trimmed.startsWith("--")) {
-      current.sqlLines.push(line);
+      current.sqlLines.push(stripped.text);
     }
   }
   flushStatement(current, results);
@@ -249,15 +277,18 @@ function parseWithStatementMarkers(lines) {
 function parseAsSingleStatement(lines) {
   const sqlLines = [];
   const hazards = [];
+  let inBlockComment = false;
   for (const line of lines) {
-    const trimmed = line.trim();
+    const stripped = stripBlockComments(line, inBlockComment);
+    inBlockComment = stripped.inBlockComment;
+    const trimmed = stripped.text.trim();
     const hazardMatch = trimmed.match(HAZARD_REGEX);
     if (hazardMatch) {
       hazards.push({ type: hazardMatch[1], message: hazardMatch[2] });
       continue;
     }
     if (trimmed && !trimmed.startsWith("--")) {
-      sqlLines.push(line);
+      sqlLines.push(stripped.text);
     }
   }
   const sql = sqlLines.join("\n").trim();
@@ -9228,8 +9259,8 @@ var seedValidateCommand = new Command("validate").description("Validate seed SQL
     const output = await dbSeedValidate({});
     emitJsonSuccess(seedValidateCommand, DbSeedValidateOutputSchema, output);
     if (!output.valid) {
-      const missing = output.missingFiles ? `Missing: ${output.missingFiles.join(", ")}` : "Invalid SQL content";
-      throw new CLIError("Seed validation failed", "SEED_VALIDATION_FAILED", [missing]);
+      const details = output.missingFiles ? [`Missing: ${output.missingFiles.join(", ")}`] : output.violations && output.violations.length > 0 ? output.violations : ["Invalid SQL content"];
+      throw new CLIError("Seed validation failed", "SEED_VALIDATION_FAILED", details);
     }
   } catch (error) {
     if (error instanceof CLIError) {
@@ -13028,9 +13059,9 @@ function formatCollectedDeclarativeRisks(collected, allowlist) {
     allowlist: dedupeAndSort(allowlist)
   };
 }
-function formatCollectedIdempotentRisks(collected) {
+function formatCollectedIdempotentRisks(collected, allowlist) {
   if (collected.length === 0) {
-    return { blockers: [], warnings: [] };
+    return { blockers: [], warnings: [], allowlist: dedupeAndSort(allowlist) };
   }
   const high = collected.filter((r) => r.level === "high");
   const medium = collected.filter((r) => r.level === "medium");
@@ -13044,7 +13075,8 @@ function formatCollectedIdempotentRisks(collected) {
   }
   return {
     blockers: dedupeAndSort(blockers),
-    warnings: dedupeAndSort(warnings)
+    warnings: dedupeAndSort(warnings),
+    allowlist: dedupeAndSort(allowlist)
   };
 }
 function collectDeclarativeRiskItemsForFile(params) {
@@ -13138,11 +13170,13 @@ async function collectDeclarativeRiskReport() {
 async function collectIdempotentRiskReport() {
   const idempotentDir = path6.join(process.cwd(), "supabase", "schemas", "idempotent");
   if (!existsSync(idempotentDir)) {
-    return { blockers: [], warnings: [] };
+    return { blockers: [], warnings: [], allowlist: [] };
   }
+  const policy = getBoundaryPolicy();
   const sqlFiles = collectSqlFilesRecursively(idempotentDir);
   let hasSqlFile = false;
   const collected = [];
+  const allowlist = [];
   let detectSchemaRisks2;
   const scanBudget = createSchemaPrecheckBudgetState();
   for (const file of sqlFiles) {
@@ -13151,7 +13185,9 @@ async function collectIdempotentRiskReport() {
       reason: shouldAbortSchemaPrecheckForBudget(scanBudget, file) ?? void 0,
       scanBudget
     });
-    if (budgetAbortReport) return budgetAbortReport;
+    if (budgetAbortReport) {
+      return { ...budgetAbortReport, allowlist: budgetAbortReport.allowlist ?? [] };
+    }
     hasSqlFile = true;
     const detectorResult = await ensureRiskDetectorOrReport({
       detector: detectSchemaRisks2,
@@ -13159,7 +13195,7 @@ async function collectIdempotentRiskReport() {
       onUninitialized: buildIdempotentRiskUninitializedReport
     });
     if (detectorResult.kind === "report") {
-      return detectorResult.report;
+      return { ...detectorResult.report, allowlist: detectorResult.report.allowlist ?? [] };
     }
     detectSchemaRisks2 = detectorResult.detector;
     const risks = await detectSchemaRisks2(file);
@@ -13167,13 +13203,28 @@ async function collectIdempotentRiskReport() {
     const relPath = path6.relative(process.cwd(), file);
     for (const risk of risks) {
       const level = correctIdempotentRiskLevel(risk.level, risk.reasonCode);
-      collected.push({ ...risk, level, file: relPath });
+      const scopedRisk = { ...risk, level, file: relPath };
+      const matched = findDeclarativeRiskAllowlistMatch(scopedRisk, policy);
+      if (matched) {
+        if (SHOW_ALLOWLIST_REPORT) {
+          allowlist.push(
+            formatAllowlistReason({
+              label: "idempotent-risk",
+              ruleId: matched.id,
+              rule: matched,
+              reason: `${scopedRisk.file}: ${scopedRisk.description} (${matched.reason})`
+            })
+          );
+        }
+        continue;
+      }
+      collected.push(scopedRisk);
     }
   }
   if (!hasSqlFile || collected.length === 0) {
-    return { blockers: [], warnings: [] };
+    return { blockers: [], warnings: [], allowlist: dedupeAndSort(allowlist) };
   }
-  return formatCollectedIdempotentRisks(collected);
+  return formatCollectedIdempotentRisks(collected, allowlist);
 }
 function countSyncIssues(diff) {
   return diff.missingTables.length + diff.orphanTables.length + diff.missingEnums.length + diff.extraEnums.length + diff.enumValueMismatches.length;
@@ -13875,6 +13926,15 @@ function printResults(result, logger15) {
     console.log("");
     return;
   }
+  if (result.error) {
+    console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+    logger15.error("DATA QUALITY CHECK COULD NOT BE COMPLETED");
+    console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+    console.log("");
+    logger15.error(result.error);
+    console.log("");
+    return;
+  }
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
   logger15.error("DATA QUALITY CHECK FAILED");
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");

package/dist/{env-SS66PZ4B.js → env-GMB3THRG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { tryResolveDatabaseUrl } from './chunk-KWX3JHCY.js';
+import { tryResolveDatabaseUrl } from './chunk-AKZAN4BC.js';
 import { registerCleanup } from './chunk-TYIAD6SB.js';
 import { isNonInteractiveEnabled } from './chunk-6Y3LAUGL.js';
 import './chunk-NPSRD26F.js';

package/dist/{hotfix-YA3DGLOM.js → hotfix-NDTPY2T4.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import './chunk-ZZOXM6Q4.js';
 import { createError } from './chunk-JQXOVCOP.js';
-import { tryResolveDatabaseUrl } from './chunk-KWX3JHCY.js';
+import { tryResolveDatabaseUrl } from './chunk-AKZAN4BC.js';
 import './chunk-NPSRD26F.js';
 import { loadEnvFiles } from './chunk-644FVGIQ.js';
 import { isPathContained } from './chunk-DRSUEMAK.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
-import { CLI_VERSION } from './chunk-AIP6MR42.js';
+import { CLI_VERSION } from './chunk-AFY3TX4I.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { realpathSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -36,7 +36,7 @@ async function getProgram(options) {
   };
   const nextKey = getProgramCacheKey(resolvedOptions);
   if (!programInstance || programCacheKey !== nextKey) {
-    const { createProgram } = await import('./cli-2JNBJUBB.js');
+    const { createProgram } = await import('./cli-UZA4RBNQ.js');
     programInstance = await createProgram(resolvedOptions);
     programCacheKey = nextKey;
   }
@@ -60,7 +60,7 @@ async function runCliFromProcessArgv() {
     return;
   }
   const { setupSignalHandlers } = await import('./signal-handler-DO3OANW5.js');
-  const { executeProgram } = await import('./cli-2JNBJUBB.js');
+  const { executeProgram } = await import('./cli-UZA4RBNQ.js');
   setupSignalHandlers();
   const options = getProgramLoadOptions(argv);
   const program = await getProgram(options);

package/dist/{init-ZIL6LRFO.js → init-U4VCRHTD.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import { diagnoseInitFailure } from './chunk-AAIE4F2U.js';
 import { getVercelRootDirectory } from './chunk-MXRWBNIY.js';
-import { fetchTemplates } from './chunk-SGJG3BKD.js';
+import { fetchTemplates } from './chunk-CCW3PLQY.js';
 import { syncRunaConfigWithVercel } from './chunk-6AALH2ED.js';
 import './chunk-DRSUEMAK.js';
 import './chunk-RZLYEO4U.js';