@runa-ai/runa-cli 0.7.0 → 0.7.2

package/dist/{template-check-3P4HZXVY.js → template-check-BDFMT6ZO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { getErrorMessage } from './chunk-IBVVGH6X.js';
+import { getErrorMessage } from './chunk-XVNDDHAF.js';
 import { findRepoRoot } from './chunk-3WDV32GA.js';
 import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
@@ -694,7 +694,11 @@ function sortResults(results) {
     return pathA.localeCompare(pathB);
   });
 }
-function filterResults(results, category) {
+function normalizeTemplatePath(templatePath) {
+  if (!templatePath) return null;
+  return `packages/runa-templates/templates/${templatePath}`;
+}
+function filterResults(results, category, paths) {
   let filtered = results.filter((r) => {
     const filePath = r.runaPath ?? r.templatePath ?? "";
     return isCodeFile(filePath);
@@ -702,6 +706,14 @@ function filterResults(results, category) {
   if (category) {
     filtered = filtered.filter((r) => r.category === category);
   }
+  if (paths && paths.length > 0) {
+    const pathSet = new Set(paths);
+    filtered = filtered.filter((r) => {
+      const runaPath = r.runaPath;
+      const templatePath = normalizeTemplatePath(r.templatePath);
+      return runaPath !== null && pathSet.has(runaPath) || templatePath !== null && pathSet.has(templatePath);
+    });
+  }
   return filtered;
 }
 var compareActor = fromPromise(async ({ input }) => {
@@ -736,7 +748,7 @@ var compareActor = fromPromise(async ({ input }) => {
     results.push(createTemplateOnlyResult(templateRelPath, templateFile.category));
   }
   sortResults(results);
-  return { results: filterResults(results, options.category) };
+  return { results: filterResults(results, options.category, options.paths) };
 });
 
 // src/commands/template-check/actors/discover.ts
@@ -1126,7 +1138,7 @@ function getCategoryForPath(path3) {
   }
   return "other";
 }
-function normalizeTemplatePath(templatePath) {
+function normalizeTemplatePath2(templatePath) {
   return templatePath.replace(/^_claude\//, ".claude/").replace(".claude/rules/sdk/", ".claude/rules/").replace(".claude/agents/sdk/", ".claude/agents/").replace(".claude/skills/sdk/", ".claude/skills/").replace(".claude/commands/sdk/", ".claude/commands/");
 }
 function applyReverseRename(normalized, rule, isTemplate) {
@@ -1141,7 +1153,7 @@ function applyReverseRename(normalized, rule, isTemplate) {
   return normalized;
 }
 function generateComparisonKey(path3, isTemplate) {
-  let normalized = isTemplate ? normalizeTemplatePath(path3) : path3;
+  let normalized = isTemplate ? normalizeTemplatePath2(path3) : path3;
   for (const rule of PATH_MAPPING_RULES) {
     normalized = applyReverseRename(normalized, rule, isTemplate);
   }
@@ -1644,6 +1656,10 @@ var AHEAD_LABELS = {
   diverged: "diverged",
   equal: ""
 };
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
+}
 var STATUS_SUFFIXES = {
   "runa-only": "(unexpected - missing in template)",
   "template-only": "(unexpected - missing in runa-repo)",
@@ -1929,11 +1945,12 @@ async function runTemplateCheckAction(options) {
 }
 var templateCheckCommand = new Command("template-check").description(
   "Compare runa-repo with SDK templates (runa-repo only)\n\n  Exit codes:\n    0 = All files in sync\n    1 = Differences detected (action needed)\n    2 = Error occurred"
-).option("--verbose", "Show all files including identical ones").option("--diff", "Show unified diff for differences").option("--category <name>", "Filter by category (rules, agents, skills, etc.)").option("--json", "Output as JSON (for CI integration)").option("--quiet", "Only show summary and actions (for pre-commit hooks)").option("--target-dir <path>", "Target directory (defaults to repo root)").action(async (options) => {
+).option("--verbose", "Show all files including identical ones").option("--diff", "Show unified diff for differences").option("--category <name>", "Filter by category (rules, agents, skills, etc.)").option("--path <file>", "Restrict results to a specific runa/template path", collectValues, []).option("--json", "Output as JSON (for CI integration)").option("--quiet", "Only show summary and actions (for pre-commit hooks)").option("--target-dir <path>", "Target directory (defaults to repo root)").action(async (options) => {
   const input = {
     verbose: options.verbose ?? false,
     diff: options.diff ?? false,
     category: options.category,
+    paths: options.path?.length ? options.path : void 0,
     json: options.json ?? false,
     quiet: options.quiet ?? false,
     targetDir: options.targetDir

package/dist/{upgrade-NUK3ZBCL.js → upgrade-BDUWBRT5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { fetchTemplates } from './chunk-SGJG3BKD.js';
+import { fetchTemplates } from './chunk-Z7A4BEWF.js';
 import { updateRunaConfigSdkVersion } from './chunk-6AALH2ED.js';
 import './chunk-DRSUEMAK.js';
 import './chunk-RZLYEO4U.js';

package/dist/utils/db-url-utils.d.ts

@@ -0,0 +1,81 @@
+/**
+ * AI HINT: Database URL normalization utilities for CI operations
+ *
+ * Purpose: Normalize database URLs for DDL operations and catalog queries
+ * Shared: These utilities match SDK's behavior for consistent handling
+ *
+ * Key transformations:
+ * 1. Port conversion: Transaction Pooler (6543) → Session Pooler (5432)
+ * 2. pgbouncer cleanup: Remove pgbouncer parameter for Session Pooler
+ * 3. IPv4 resolution: GitHub Actions runners can't reach IPv6-only hosts
+ */
+/**
+ * Resolve hostname to IPv4 address using getent (Linux).
+ *
+ * This is critical for GitHub Actions where IPv6 may not be routable to Supabase.
+ * Matches SDK's resolveHostToIPv4 behavior.
+ *
+ * @param hostname - The hostname to resolve
+ * @returns IPv4 address if resolvable, null otherwise
+ */
+export declare function resolveHostToIPv4(hostname: string): string | null;
+/**
+ * Normalize database URL for DDL reads and psql operations.
+ *
+ * Handles three critical issues:
+ * 1. Port conversion: Transaction Pooler (6543) → Session Pooler (5432)
+ *    - DDL and catalog reads are more reliable via Session Pooler
+ * 2. pgbouncer cleanup: Remove pgbouncer parameter for Session Pooler
+ *    - Session Pooler (5432) does NOT accept pgbouncer parameter
+ * 3. IPv4 resolution: GitHub Actions runners can't reach IPv6-only hosts
+ *    - This matches SDK's normalizeDatabaseUrlForDDL behavior
+ *
+ * @param databaseUrl - The database URL to normalize
+ * @returns Normalized database URL suitable for DDL operations
+ */
+export declare function normalizeDatabaseUrlForDdl(databaseUrl: string): string;
+/**
+ * Get safe database target string for logging (without password).
+ *
+ * @param databaseUrl - The database URL
+ * @returns Safe string for logging
+ */
+export declare function getSafeDatabaseTarget(databaseUrl: string): string;
+/**
+ * Escape SQL literal value for safe inclusion in SQL strings.
+ *
+ * @param value - The string value to escape
+ * @returns Escaped string safe for SQL literals
+ */
+export declare function escapeSqlLiteral(value: string): string;
+/**
+ * Parse PostgreSQL boolean result to JavaScript boolean.
+ *
+ * PostgreSQL returns 't', 'true', or '1' for true values.
+ * This utility normalizes these variants.
+ *
+ * @param value - The PostgreSQL boolean string
+ * @returns JavaScript boolean
+ */
+export declare function parseBoolish(value: string): boolean;
+/**
+ * Check if a hostname resolves ONLY to IPv6 (no IPv4).
+ *
+ * This indicates that Supabase IPv4 Add-on is not enabled.
+ * GitHub Actions cannot reach IPv6-only hosts.
+ *
+ * @param hostname - The hostname to check
+ * @returns true if hostname resolves ONLY to IPv6, false otherwise
+ */
+export declare function isIPv6Only(hostname: string): boolean;
+/**
+ * Enhance error message with actionable advice.
+ *
+ * Detects common error patterns and adds clear guidance for users.
+ *
+ * @param error - Original error message
+ * @param databaseUrl - The database URL that failed (optional)
+ * @returns Enhanced error message with guidance
+ */
+export declare function enhanceConnectionError(error: string, databaseUrl?: string): string;
+//# sourceMappingURL=db-url-utils.d.ts.map

package/dist/validators/risk-detector-plpgsql.d.ts

@@ -5,5 +5,7 @@
  * Design: Keep heavy PL/pgSQL parsing logic isolated from risk-detector-core import path.
  */
 import type { SchemaRisk } from './risk-detector-types.js';
-export declare function detectPlpgsqlDynamicExecutionRisks(content: string): SchemaRisk[];
+export declare function detectPlpgsqlDynamicExecutionRisks(content: string, options?: {
+    filePath?: string;
+}): Promise<SchemaRisk[]>;
 //# sourceMappingURL=risk-detector-plpgsql.d.ts.map

package/dist/{vuln-check-2W7N5TA2.js → vuln-check-66RXX3TO.js}

@@ -71,7 +71,7 @@ var vulnCheckCommand = new Command("vuln-check").description("Run comprehensive
   const logger = createCLILogger("vuln-check");
   const isJsonMode = getOutputFormatFromEnv() === "json" || options.format === "json";
   try {
-    const { VulnChecker } = await import('./vuln-checker-IQJ56RUV.js');
+    const { VulnChecker } = await import('./vuln-checker-FFOGOJPT.js');
     const categoryMap = {
       code: ["injection", "auth", "crypto"],
       deps: ["dependency"],

package/dist/{vuln-checker-IQJ56RUV.js → vuln-checker-FFOGOJPT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { CLI_VERSION } from './chunk-AIP6MR42.js';
+import { CLI_VERSION } from './chunk-PMXE5XOJ.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { glob } from 'glob';
 import { exec } from 'child_process';

package/dist/{watch-PNTKZYFB.js → watch-ITYW57SL.js}

@@ -284,7 +284,7 @@ function validateSqlSchema(content, errors, warnings) {
 var riskDetectorLoader = null;
 function loadRiskDetectorModule() {
   if (!riskDetectorLoader) {
-    riskDetectorLoader = import('./risk-detector-4U6ZJ2G5.js').then((module) => ({
+    riskDetectorLoader = import('./risk-detector-VO5HJR4R.js').then((module) => ({
       detectSchemaRisks: module.detectSchemaRisks
     })).catch((error) => {
       riskDetectorLoader = null;

package/dist/{workflow-H75N4BXX.js → workflow-UZIZ2JUS.js}

@@ -25,14 +25,13 @@ var DeployProductionOutputSchema = z.object({
 var deployProductionCommand = new Command("deploy-production").description("Deploy schema to production database (unified command)").requiredOption(
   "--db-url <url>",
   "Production database URL (admin/DDL)",
-  process.env.GH_DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL
+  process.env.GH_DATABASE_URL_ADMIN
 ).option("--skip-validation", "Skip schema validation (not recommended)", false).option("--skip-risk-detection", "Skip risk detection (not recommended)", false).option("--max-retries <number>", "Maximum retry attempts for schema application", "3").action(
   async (options) => {
     try {
       if (!options.dbUrl) {
         throw new CLIError("Production database URL not provided", "PRODUCTION_DB_URL_MISSING", [
-          "Set GH_DATABASE_URL_ADMIN environment variable (recommended for DDL)",
-          "Or set GH_DATABASE_URL environment variable",
+          "Set GH_DATABASE_URL_ADMIN environment variable (required for DDL)",
           "Or use --db-url <url>"
         ]);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -56,8 +56,8 @@
     "typescript": "5.9.3",
     "xstate": "5.28.0",
     "zod": "4.3.6",
-    "@runa-ai/runa": "0.7.0",
-    "@runa-ai/runa-xstate-test-plugin": "0.5.58"
+    "@runa-ai/runa-xstate-test-plugin": "0.5.58",
+    "@runa-ai/runa": "0.7.2"
   },
   "engines": {
     "node": ">=20.0.0"

package/dist/chunk-IBVVGH6X.js

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'module';
-import { init_esm_shims } from './chunk-VRXHCR5K.js';
-
-createRequire(import.meta.url);
-
-// src/internal/machines/snapshot-helpers.ts
-init_esm_shims();
-function getSnapshotStateName(snapshot) {
-  if (typeof snapshot.value === "string") {
-    return snapshot.value;
-  }
-  if (!snapshot.value || typeof snapshot.value !== "object") {
-    return "unknown";
-  }
-  const entries = Object.entries(snapshot.value);
-  if (entries.length === 0) {
-    return "unknown";
-  }
-  const [parent, child] = entries[0];
-  if (typeof child === "string") {
-    return `${parent}.${child}`;
-  }
-  return parent;
-}
-function isSnapshotComplete(snapshot) {
-  return snapshot.status === "done";
-}
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-export { getErrorMessage, getSnapshotStateName, isSnapshotComplete };

package/dist/chunk-KWX3JHCY.js

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'module';
-import { env } from './chunk-NPSRD26F.js';
-import { redactSecrets } from './chunk-II7VYQEM.js';
-import { init_local_supabase, buildLocalDatabaseUrl } from './chunk-VM3IWOT5.js';
-import { init_esm_shims } from './chunk-VRXHCR5K.js';
-import { CLIError } from '@runa-ai/runa';
-
-createRequire(import.meta.url);
-
-// src/commands/db/utils/db-target.ts
-init_esm_shims();
-init_local_supabase();
-function getLocalDatabaseUrl() {
-  return buildLocalDatabaseUrl(process.cwd());
-}
-function isLocalHostname(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "host.docker.internal";
-}
-function isLocalDatabaseUrl(url) {
-  try {
-    const parsed = new URL(url);
-    return isLocalHostname(parsed.hostname);
-  } catch {
-    return false;
-  }
-}
-function resolveDatabaseUrl(environment) {
-  switch (environment) {
-    case "local": {
-      const url = process.env.DATABASE_URL_ADMIN || getLocalDatabaseUrl();
-      if (!isLocalDatabaseUrl(url)) {
-        throw new CLIError("Local database URL appears to be a remote URL", "LOCAL_DB_URL_REMOTE", [
-          "Local operations should use the local Supabase instance",
-          // SECURITY (Issue #513): Redact credentials from database URL in error message
-          `Current URL: ${redactSecrets(url)}`,
-          "If you need to connect to a remote DB, use --env preview or --env production"
-        ]);
-      }
-      return url;
-    }
-    case "preview": {
-      const url = process.env.DATABASE_URL_ADMIN || env.DATABASE_URL || process.env.DATABASE_URL;
-      if (!url) {
-        throw new CLIError("Preview database URL not found", "PREVIEW_DB_URL_NOT_FOUND", [
-          "Set DATABASE_URL_ADMIN environment variable (for DDL/migrations)",
-          "Or set DATABASE_URL as fallback"
-        ]);
-      }
-      return url;
-    }
-    case "main":
-    case "production": {
-      const url = process.env.GH_DATABASE_URL_ADMIN || process.env.DATABASE_URL_ADMIN || process.env.GH_DATABASE_URL || env.DATABASE_URL || process.env.DATABASE_URL;
-      if (!url) {
-        throw new CLIError("Production database URL not found", "PRODUCTION_DB_URL_NOT_FOUND", [
-          "Set DATABASE_URL_ADMIN environment variable (for DDL/migrations)",
-          "Or set GH_DATABASE_URL_ADMIN (CI) / DATABASE_URL as fallback"
-        ]);
-      }
-      if (isLocalDatabaseUrl(url)) {
-        throw new CLIError(
-          "Production database URL points to localhost",
-          "PRODUCTION_DB_URL_IS_LOCAL",
-          [
-            "Use --env local for local Supabase operations",
-            "Production operations require a remote database URL",
-            "Set DATABASE_URL_ADMIN or GH_DATABASE_URL_ADMIN to the production database URL"
-          ]
-        );
-      }
-      return url;
-    }
-  }
-}
-function tryResolveDatabaseUrl(environment) {
-  try {
-    return resolveDatabaseUrl(environment);
-  } catch (error) {
-    if (error instanceof CLIError) return void 0;
-    throw error;
-  }
-}
-
-export { resolveDatabaseUrl, tryResolveDatabaseUrl };

package/dist/commands/ci/machine/actors/finalize/summary.d.ts

@@ -1,32 +0,0 @@
-/**
- * AI HINT: CI Summary Writer Actor
- *
- * Purpose: Write structured CI summary to .runa/tmp/ci-summary.json
- * Pattern: Fine-grained actor for single step
- *
- * Used in ci-pr-local mode (not ci-local):
- * - Write summary for PR
- *
- * Contract:
- * - Always writes .runa/tmp/ci-summary.json
- * - Shape is stable for AI + tooling consumption
- */
-import { type CiSummary } from '../../../utils/ci-summary.js';
-export interface WriteSummaryInput {
-    cwd?: string;
-    summary: CiSummary;
-}
-export interface WriteSummaryOutput {
-    filePath: string;
-    error?: string;
-}
-/**
- * Write CI summary to file.
- *
- * @param input - Summary data
- * @returns Path to written file
- */
-export declare const writeSummaryActor: import("xstate").PromiseActorLogic<WriteSummaryOutput, WriteSummaryInput, import("xstate").EventObject>;
-export type { CiSummary };
-export { type CiLayerStatus, CiLayerStatusSchema, type CiStepStatus, CiStepStatusSchema, CiSummarySchema, type LayerBlockingLevel, LayerBlockingLevelSchema, } from '../../../utils/ci-summary.js';
-//# sourceMappingURL=summary.d.ts.map