@runa-ai/runa-cli 0.7.2 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. package/dist/{chunk-Z7A4BEWF.js → chunk-3JO6YP3T.js} +1 -1
  2. package/dist/chunk-6E2DRXIL.js +452 -0
  3. package/dist/{chunk-PMXE5XOJ.js → chunk-GHQH6UC5.js} +1 -1
  4. package/dist/{chunk-LCK2LGVR.js → chunk-PAWNJA3N.js} +1 -1
  5. package/dist/{chunk-FWMGC5FP.js → chunk-RB2ZUS76.js} +249 -12
  6. package/dist/{chunk-CKRLVEIO.js → chunk-ZYT7OQJB.js} +16 -11
  7. package/dist/{ci-Z4525QW6.js → ci-ZK3LKYFX.js} +305 -429
  8. package/dist/{cli-Q2XIQDRS.js → cli-ZY5VRIJA.js} +13 -13
  9. package/dist/commands/ci/commands/ci-resolvers.d.ts +1 -2
  10. package/dist/commands/ci/machine/actors/setup/pr-common.d.ts +1 -1
  11. package/dist/commands/ci/machine/contract.d.ts +6 -1
  12. package/dist/commands/ci/machine/guards.d.ts +16 -0
  13. package/dist/commands/ci/machine/machine.d.ts +11 -3
  14. package/dist/commands/db/apply/actors/seed-actors.d.ts +1 -0
  15. package/dist/commands/db/apply/contract.d.ts +23 -0
  16. package/dist/commands/db/apply/helpers/fresh-db-handler.d.ts +2 -1
  17. package/dist/commands/db/apply/helpers/hazard-handler.d.ts +19 -8
  18. package/dist/commands/db/apply/helpers/index.d.ts +2 -1
  19. package/dist/commands/db/apply/helpers/no-change-plan.d.ts +2 -0
  20. package/dist/commands/db/apply/helpers/plan-check-filter.d.ts +11 -0
  21. package/dist/commands/db/apply/machine.d.ts +52 -1
  22. package/dist/commands/db/utils/boundary-policy/types.d.ts +2 -0
  23. package/dist/commands/db/utils/duplicate-function-ownership.d.ts +35 -0
  24. package/dist/commands/db/utils/plan-size-guard.d.ts +16 -0
  25. package/dist/commands/db/utils/preflight-checks/duplicate-function-ownership-checks.d.ts +4 -0
  26. package/dist/constants/versions.d.ts +1 -1
  27. package/dist/{db-BPQ2TEQM.js → db-EPI2DQYN.js} +1203 -410
  28. package/dist/{dev-MLRKIP7F.js → dev-GB5ERUVR.js} +1 -1
  29. package/dist/{env-WNHJVLOT.js → env-WP74UUMO.js} +1 -1
  30. package/dist/{hotfix-Z5EGVSMH.js → hotfix-TOSGTVCW.js} +1 -1
  31. package/dist/index.js +3 -3
  32. package/dist/{init-S2ATHLJ6.js → init-35JLDFHI.js} +1 -1
  33. package/dist/{risk-detector-VO5HJR4R.js → risk-detector-S7XQF4I2.js} +1 -1
  34. package/dist/{risk-detector-core-7WZJZ5ZI.js → risk-detector-core-TGFKWHRS.js} +1 -1
  35. package/dist/{risk-detector-plpgsql-ULV7NLDB.js → risk-detector-plpgsql-O32TUR34.js} +103 -5
  36. package/dist/{upgrade-BDUWBRT5.js → upgrade-7L4JIE4K.js} +1 -1
  37. package/dist/{vuln-check-66RXX3TO.js → vuln-check-G6I4YYDC.js} +1 -1
  38. package/dist/{vuln-checker-FFOGOJPT.js → vuln-checker-CT2AYPIS.js} +1 -1
  39. package/dist/{watch-ITYW57SL.js → watch-AL4LCBRM.js} +1 -1
  40. package/package.json +3 -3
  41. package/dist/chunk-4XHZQRRK.js +0 -215
@@ -2,7 +2,7 @@
2
2
  import { createRequire } from 'module';
3
3
  import { enableNonInteractiveMode } from './chunk-6Y3LAUGL.js';
4
4
  import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
5
- import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-PMXE5XOJ.js';
5
+ import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-GHQH6UC5.js';
6
6
  import { emitDefaultSuccessIfNeeded } from './chunk-WJXC4MVY.js';
7
7
  import { parseOutputFormat, setOutputFormat, getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
8
8
  import { init_esm_shims } from './chunk-VRXHCR5K.js';
@@ -145,7 +145,7 @@ function isTestCommand(requested) {
145
145
  async function registerProjectLifecycleCommands(program, requested, loadAllCommands) {
146
146
  if (!loadAllCommands && requested) {
147
147
  if (requested === "init") {
148
- const { initCommand: initCommand2 } = await import('./init-S2ATHLJ6.js');
148
+ const { initCommand: initCommand2 } = await import('./init-35JLDFHI.js');
149
149
  program.addCommand(initCommand2);
150
150
  return;
151
151
  }
@@ -155,7 +155,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
155
155
  return;
156
156
  }
157
157
  if (requested === "upgrade") {
158
- const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-BDUWBRT5.js');
158
+ const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-7L4JIE4K.js');
159
159
  program.addCommand(upgradeCommand2);
160
160
  return;
161
161
  }
@@ -170,7 +170,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
170
170
  return;
171
171
  }
172
172
  if (requested === "dev") {
173
- const { devCommand: devCommand2 } = await import('./dev-MLRKIP7F.js');
173
+ const { devCommand: devCommand2 } = await import('./dev-GB5ERUVR.js');
174
174
  program.addCommand(devCommand2);
175
175
  return;
176
176
  }
@@ -183,12 +183,12 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
183
183
  { buildCommand },
184
184
  { devCommand }
185
185
  ] = await Promise.all([
186
- import('./init-S2ATHLJ6.js'),
186
+ import('./init-35JLDFHI.js'),
187
187
  import('./prepare-32DOVHTE.js'),
188
- import('./upgrade-BDUWBRT5.js'),
188
+ import('./upgrade-7L4JIE4K.js'),
189
189
  import('./validate-CAAW4Y44.js'),
190
190
  import('./build-HQMSVN6N.js'),
191
- import('./dev-MLRKIP7F.js')
191
+ import('./dev-GB5ERUVR.js')
192
192
  ]);
193
193
  program.addCommand(initCommand);
194
194
  program.addCommand(prepareCommand);
@@ -462,11 +462,11 @@ async function registerFocusedStatusUtilityCommand(program, requested) {
462
462
  return false;
463
463
  }
464
464
  async function registerCiCommand(program) {
465
- const { ciCommand } = await import('./ci-Z4525QW6.js');
465
+ const { ciCommand } = await import('./ci-ZK3LKYFX.js');
466
466
  program.addCommand(ciCommand);
467
467
  }
468
468
  async function registerDbCommand(program) {
469
- const { dbCommand } = await import('./db-BPQ2TEQM.js');
469
+ const { dbCommand } = await import('./db-EPI2DQYN.js');
470
470
  program.addCommand(dbCommand);
471
471
  }
472
472
  async function registerServicesCommand(program) {
@@ -474,11 +474,11 @@ async function registerServicesCommand(program) {
474
474
  program.addCommand(servicesCommand);
475
475
  }
476
476
  async function registerEnvCommand(program) {
477
- const { envCommand } = await import('./env-WNHJVLOT.js');
477
+ const { envCommand } = await import('./env-WP74UUMO.js');
478
478
  program.addCommand(envCommand);
479
479
  }
480
480
  async function registerHotfixCommand(program) {
481
- const { hotfixCommand } = await import('./hotfix-Z5EGVSMH.js');
481
+ const { hotfixCommand } = await import('./hotfix-TOSGTVCW.js');
482
482
  program.addCommand(hotfixCommand);
483
483
  }
484
484
  async function registerSdkCommand(program) {
@@ -490,7 +490,7 @@ async function registerUiCommand(program) {
490
490
  program.addCommand(uiCommand);
491
491
  }
492
492
  async function registerWatchCommand(program) {
493
- const { watchCommand } = await import('./watch-ITYW57SL.js');
493
+ const { watchCommand } = await import('./watch-AL4LCBRM.js');
494
494
  program.addCommand(watchCommand);
495
495
  }
496
496
  async function registerWorkflowCommand(program) {
@@ -498,7 +498,7 @@ async function registerWorkflowCommand(program) {
498
498
  program.addCommand(workflowCommand);
499
499
  }
500
500
  async function registerVulnCheckCommand(program) {
501
- const { vulnCheckCommand } = await import('./vuln-check-66RXX3TO.js');
501
+ const { vulnCheckCommand } = await import('./vuln-check-G6I4YYDC.js');
502
502
  program.addCommand(vulnCheckCommand);
503
503
  }
504
504
  async function registerTemplateCheckCommand(program) {
@@ -16,8 +16,7 @@ export type CiDbMode = 'auto' | 'local';
16
16
  export type CiPrProfile = 'runa-strict' | 'pj-stable';
17
17
  export type CiPrPolicy = {
18
18
  allowLocalFallback: boolean;
19
- allowPartialPhases: boolean;
20
- source: 'default:runa-repo' | 'default:pj-repo' | 'default:unknown' | 'config';
19
+ source: 'default' | 'config';
21
20
  };
22
21
  export declare function resolveMode(modeRaw: unknown): 'github-actions' | 'local';
23
22
  export declare function resolvePhase(phaseRaw: unknown): CiPrPhase;
@@ -37,7 +37,7 @@ export declare function resolvePrContext(input: PrContextInput): PrContext;
37
37
  /**
38
38
  * Resolve CI policy from config or defaults.
39
39
  */
40
- export declare function resolvePolicy(_config: unknown, _repoKind: RepoKind): CiPrPolicy;
40
+ export declare function resolvePolicy(config: unknown, repoKind: RepoKind): CiPrPolicy;
41
41
  /**
42
42
  * Detect repo kind from directory structure.
43
43
  */
@@ -34,6 +34,8 @@ export type CiExecutionEnv = z.infer<typeof CiExecutionEnvSchema>;
34
34
  export declare const CiPhaseSchema: z.ZodEnum<{
35
35
  all: "all";
36
36
  test: "test";
37
+ blocking: "blocking";
38
+ observability: "observability";
37
39
  }>;
38
40
  export type CiPhase = z.infer<typeof CiPhaseSchema>;
39
41
  export declare const CiDbModeSchema: z.ZodEnum<{
@@ -109,6 +111,8 @@ export declare const CiInputSchema: z.ZodObject<{
109
111
  phase: z.ZodOptional<z.ZodEnum<{
110
112
  all: "all";
111
113
  test: "test";
114
+ blocking: "blocking";
115
+ observability: "observability";
112
116
  }>>;
113
117
  dbMode: z.ZodOptional<z.ZodEnum<{
114
118
  auto: "auto";
@@ -147,6 +151,8 @@ export declare const SetupResultSchema: z.ZodObject<{
147
151
  phase: z.ZodEnum<{
148
152
  all: "all";
149
153
  test: "test";
154
+ blocking: "blocking";
155
+ observability: "observability";
150
156
  }>;
151
157
  repoKind: z.ZodEnum<{
152
158
  unknown: "unknown";
@@ -424,7 +430,6 @@ export type PrContext = z.infer<typeof PrContextSchema>;
424
430
  */
425
431
  export declare const CiPrPolicySchema: z.ZodObject<{
426
432
  allowLocalFallback: z.ZodBoolean;
427
- allowPartialPhases: z.ZodBoolean;
428
433
  source: z.ZodEnum<{
429
434
  default: "default";
430
435
  config: "config";
@@ -91,10 +91,26 @@ export declare function shouldSetupRoles(context: CiContext): boolean;
91
91
  * Check if GitHub comment should be posted.
92
92
  */
93
93
  export declare function shouldPostGitHubComment(context: CiContext): boolean;
94
+ /**
95
+ * Check if ci-pr is running in blocking-only phase.
96
+ */
97
+ export declare function isBlockingPhase(context: CiContext): boolean;
98
+ /**
99
+ * Check if ci-pr is running in observability-only phase.
100
+ */
101
+ export declare function isObservabilityPhase(context: CiContext): boolean;
94
102
  /**
95
103
  * Check if ci-pr is running in test-only phase.
96
104
  */
97
105
  export declare function isTestPhase(context: CiContext): boolean;
106
+ /**
107
+ * Check if the ci-pr execution branch should run.
108
+ */
109
+ export declare function shouldRunPrExecutionPhase(context: CiContext): boolean;
110
+ /**
111
+ * Check if the ci-pr observability branch should run.
112
+ */
113
+ export declare function shouldRunPrObservabilityPhase(context: CiContext): boolean;
98
114
  /**
99
115
  * Check if context has an error.
100
116
  */
@@ -159,6 +159,12 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
159
159
  } | {
160
160
  type: "shouldPostGitHubComment";
161
161
  params: unknown;
162
+ } | {
163
+ type: "shouldRunPrExecutionPhase";
164
+ params: unknown;
165
+ } | {
166
+ type: "shouldRunPrObservabilityPhase";
167
+ params: unknown;
162
168
  } | {
163
169
  type: "hasError";
164
170
  params: unknown;
@@ -171,8 +177,8 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
171
177
  finalize: "complete" | "writeSummary" | "postComment";
172
178
  } | {
173
179
  postSeedPr: {
174
- observability: "done" | "productionPreview" | "collectSchemaStats";
175
- execution: "done" | "failed" | "staticChecks" | "capabilities" | "appStart" | "setupRoles" | "buildAndPlaywright" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
180
+ observability: "done" | "productionPreview" | "collectSchemaStats" | "gate";
181
+ execution: "done" | "failed" | "staticChecks" | "capabilities" | "appStart" | "setupRoles" | "buildAndPlaywright" | "gate" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
176
182
  e2ePhase: {
177
183
  intermediateComment: "done" | "checking" | "posting";
178
184
  e2eTests: "done" | "running";
@@ -210,7 +216,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
210
216
  executionMode?: "local" | "github-actions" | undefined;
211
217
  output?: "json" | "human" | undefined;
212
218
  config?: string | undefined;
213
- phase?: "all" | "test" | undefined;
219
+ phase?: "all" | "test" | "blocking" | "observability" | undefined;
214
220
  dbMode?: "auto" | "local" | undefined;
215
221
  branchName?: string | undefined;
216
222
  skipStaticChecks?: boolean | undefined;
@@ -279,6 +285,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
279
285
  states: {
280
286
  readonly execution: {
281
287
  states: {
288
+ readonly gate: {};
282
289
  readonly setupRoles: {};
283
290
  readonly staticChecks: {};
284
291
  readonly buildAndPlaywright: {};
@@ -310,6 +317,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
310
317
  };
311
318
  readonly observability: {
312
319
  states: {
320
+ readonly gate: {};
313
321
  readonly productionPreview: {};
314
322
  readonly collectSchemaStats: {};
315
323
  readonly done: {};
@@ -4,6 +4,7 @@ import type { DbApplyInput } from '../contract.js';
4
4
  */
5
5
  export declare const applySeeds: import("xstate").PromiseActorLogic<{
6
6
  applied: boolean;
7
+ warnings: string[];
7
8
  }, {
8
9
  input: DbApplyInput;
9
10
  targetDir: string;
@@ -41,6 +41,18 @@ export declare const DbApplyMetricsSchema: z.ZodObject<{
41
41
  retryAttempts: z.ZodOptional<z.ZodNumber>;
42
42
  }, z.core.$strip>;
43
43
  export type DbApplyMetrics = z.infer<typeof DbApplyMetricsSchema>;
44
+ export declare const DbApplyPlanSummarySchema: z.ZodObject<{
45
+ rawStatements: z.ZodNumber;
46
+ effectiveStatements: z.ZodNumber;
47
+ noiseStatements: z.ZodNumber;
48
+ categories: z.ZodObject<{
49
+ idempotentDrop: z.ZodNumber;
50
+ idempotentAuthz: z.ZodNumber;
51
+ idempotentRls: z.ZodNumber;
52
+ suppressedFunction: z.ZodNumber;
53
+ }, z.core.$strict>;
54
+ }, z.core.$strict>;
55
+ export type DbApplyPlanSummary = z.infer<typeof DbApplyPlanSummarySchema>;
44
56
  export declare const DbApplyOutputSchema: z.ZodObject<{
45
57
  success: z.ZodBoolean;
46
58
  idempotentSchemasApplied: z.ZodNumber;
@@ -52,6 +64,17 @@ export declare const DbApplyOutputSchema: z.ZodObject<{
52
64
  error: z.ZodOptional<z.ZodString>;
53
65
  planSql: z.ZodOptional<z.ZodString>;
54
66
  filteredPlanSql: z.ZodOptional<z.ZodString>;
67
+ planSummary: z.ZodOptional<z.ZodObject<{
68
+ rawStatements: z.ZodNumber;
69
+ effectiveStatements: z.ZodNumber;
70
+ noiseStatements: z.ZodNumber;
71
+ categories: z.ZodObject<{
72
+ idempotentDrop: z.ZodNumber;
73
+ idempotentAuthz: z.ZodNumber;
74
+ idempotentRls: z.ZodNumber;
75
+ suppressedFunction: z.ZodNumber;
76
+ }, z.core.$strict>;
77
+ }, z.core.$strict>>;
55
78
  checkOnly: z.ZodOptional<z.ZodBoolean>;
56
79
  dataViolations: z.ZodOptional<z.ZodNumber>;
57
80
  ssotWarning: z.ZodOptional<z.ZodString>;
@@ -10,12 +10,13 @@
10
10
  *
11
11
  * Safety: Fail-safe — if all detection fails, assumes existing DB (uses pg-schema-diff).
12
12
  */
13
- import type { DbApplyInput } from '../contract.js';
13
+ import type { DbApplyInput, DbApplyPlanSummary } from '../contract.js';
14
14
  export interface PgSchemaDiffResult {
15
15
  sql: string;
16
16
  hazards: string[];
17
17
  applied: boolean;
18
18
  filteredPlanSql?: string;
19
+ planSummary?: DbApplyPlanSummary;
19
20
  retryAttempts?: number;
20
21
  retryWaitMs?: number;
21
22
  dataViolations?: number;
@@ -12,6 +12,7 @@
12
12
  * - INDEX_BUILD / INDEX_DROPPED: Index operations
13
13
  */
14
14
  import type { DbApplyInput } from '../contract.js';
15
+ import type { DbApplyPlanSummary } from '../contract.js';
15
16
  import { type ParsedHazard } from './idempotent-object-registry.js';
16
17
  /**
17
18
  * Parse hazards from pg-schema-diff output with context.
@@ -48,13 +49,23 @@ export declare function handleHazardsWithContext(planOutput: string, input: DbAp
48
49
  hasDeletesData: boolean;
49
50
  hasAuthzUpdate: boolean;
50
51
  };
51
- export declare function displayCheckModeResults(planOutput: string, filterInfo?: {
52
- filteredPlanSql: string;
53
- removedDropStatements: {
54
- sql: string;
55
- }[];
56
- removedAuthzStatements: {
57
- sql: string;
58
- }[];
52
+ export declare function displayCheckModeResults(planOutput: string, options?: {
53
+ verbose?: boolean;
54
+ filterInfo?: {
55
+ filteredPlanSql: string;
56
+ removedDropStatements: {
57
+ sql: string;
58
+ }[];
59
+ removedAuthzStatements: {
60
+ sql: string;
61
+ }[];
62
+ removedRlsStatements: {
63
+ sql: string;
64
+ }[];
65
+ suppressedFunctionStatements?: {
66
+ sql: string;
67
+ }[];
68
+ planSummary?: DbApplyPlanSummary;
69
+ };
59
70
  }): void;
60
71
  //# sourceMappingURL=hazard-handler.d.ts.map
@@ -6,10 +6,11 @@
6
6
  export { acquireAdvisoryLock, MIGRATION_LOCK_ID, releaseAdvisoryLock, } from './advisory-lock.js';
7
7
  export type { PlanHazard, PlanStatement, ValidatedPlan } from './plan-validator.js';
8
8
  export { ALLOWED_DDL_PREFIXES, BLOCKED_SQL_PATTERNS, parsePlanOutput, validatePlanForExecution, validateStatementTypes, } from './plan-validator.js';
9
+ export { isNoChangePlanOutput } from './no-change-plan.js';
9
10
  export type { FilterResult } from './plan-drop-protection.js';
10
11
  export { filterIdempotentProtectedStatements, isDropStatementForProtectedObject, } from './plan-drop-protection.js';
11
12
  export type { CheckModeFilterResult } from './plan-check-filter.js';
12
- export { filterCheckModePlanStatements, isIdempotentManagedAuthzStatement, resetManagedAuthzCache, stripLeadingSessionStatements, } from './plan-check-filter.js';
13
+ export { buildCheckModePlanSummary, filterCheckModePlanStatements, isIdempotentManagedAuthzStatement, isIdempotentManagedRlsStatement, resetManagedAuthzCache, stripLeadingSessionStatements, } from './plan-check-filter.js';
13
14
  export type { IdempotentProtectedObjects, ParsedHazard } from './idempotent-object-registry.js';
14
15
  export { filterFalsePositiveHazards, getIdempotentProtectedObjects, getIdempotentProtectedTables, getIdempotentRoles, isIdempotentRoleHazard, resetIdempotentRolesCache, } from './idempotent-object-registry.js';
15
16
  export { buildAllowedHazards, displayCheckModeResults, displayHazardsWithContext, handleHazardsWithContext, handleProductionAuthzProtection, handleProductionDataProtection, parseHazardsWithContext, } from './hazard-handler.js';
@@ -0,0 +1,2 @@
1
+ export declare function isNoChangePlanOutput(planOutput: string): boolean;
2
+ //# sourceMappingURL=no-change-plan.d.ts.map
@@ -1,9 +1,11 @@
1
+ import type { DbApplyPlanSummary } from '../contract.js';
1
2
  import type { IdempotentProtectedObjects } from './idempotent-object-registry.js';
2
3
  import type { PlanStatement, ValidatedPlan } from './plan-validator.js';
3
4
  export interface CheckModeFilterResult {
4
5
  filteredPlan: ValidatedPlan;
5
6
  removedDropStatements: PlanStatement[];
6
7
  removedAuthzStatements: PlanStatement[];
8
+ removedRlsStatements: PlanStatement[];
7
9
  }
8
10
  declare function parseRolesFromAuthzStatement(sql: string): string[];
9
11
  export declare function stripLeadingSessionStatements(sql: string): string;
@@ -18,7 +20,16 @@ type AuthzTarget = {
18
20
  } | null;
19
21
  declare function parseAuthzTarget(sql: string): AuthzTarget;
20
22
  export declare function isIdempotentManagedAuthzStatement(sql: string, schemasDir?: string): boolean;
23
+ export declare function isIdempotentManagedRlsStatement(sql: string, schemasDir?: string): boolean;
21
24
  export declare function filterCheckModePlanStatements(plan: ValidatedPlan, protectedTables: string[], protectedObjects: IdempotentProtectedObjects, schemasDir?: string): CheckModeFilterResult;
25
+ export declare function buildCheckModePlanSummary(params: {
26
+ rawStatementCount: number;
27
+ filteredPlan: ValidatedPlan;
28
+ removedDropStatements: readonly PlanStatement[];
29
+ removedAuthzStatements: readonly PlanStatement[];
30
+ removedRlsStatements: readonly PlanStatement[];
31
+ suppressedFunctionStatements?: readonly PlanStatement[];
32
+ }): DbApplyPlanSummary;
22
33
  export declare function resetManagedAuthzCache(): void;
23
34
  export declare const _parseRolesFromAuthzStatement: typeof parseRolesFromAuthzStatement;
24
35
  export declare const _parseAuthzTarget: typeof parseAuthzTarget;
@@ -1,6 +1,39 @@
1
+ /**
2
+ * AI HINT: db apply State Machine (Declarative Schema Management)
3
+ *
4
+ * Purpose: Orchestrate schema application to any DB (local, Branch DB, Production)
5
+ *
6
+ * User Journey (2-pass idempotent):
7
+ * 1. Apply idempotent schemas (1st pass: extensions, roles - may skip dependent tables)
8
+ * 2. Run pg-schema-diff (current DB → desired state)
9
+ * 3. Apply idempotent schemas (2nd pass: dependent tables now succeed)
10
+ * 4. Validate partitions (non-blocking drift detection)
11
+ * 5. Apply seeds
12
+ *
13
+ * Why 2-pass idempotent?
14
+ * - Some idempotent SQL depends on declarative tables (e.g., areas → floors)
15
+ * - 1st pass: extensions/roles succeed, dependent tables are skipped (no error)
16
+ * - 2nd pass: dependent tables succeed because declarative tables now exist
17
+ *
18
+ * Architecture:
19
+ * - No migration files needed
20
+ * - pg-schema-diff runs at runtime against actual DB state
21
+ * - Same logic for all environments
22
+ *
23
+ * E2E Test Mapping (CLI observable behavior):
24
+ * - idle → expect(log).toContain('Starting db apply')
25
+ * - applyingIdempotentPre → expect(log).toContain('Applied idempotent schema')
26
+ * - applyingPgSchemaDiff → expect(log).toContain('pg-schema-diff')
27
+ * - applyingIdempotentPost → expect(log).toContain('Applied idempotent schema')
28
+ * - validatingPartitions → expect(log).toContain('partition')
29
+ * - applyingSeeds → expect(log).toContain('Applying seeds')
30
+ * - done → expect(exitCode).toBe(0)
31
+ * - failed → expect(exitCode).toBe(1)
32
+ */
33
+ import { type CommandWarning } from '@runa-ai/runa';
1
34
  import { type SnapshotFrom } from 'xstate';
2
35
  import * as actors from './actors.js';
3
- import type { DbApplyInput } from './contract.js';
36
+ import type { DbApplyInput, DbApplyPlanSummary } from './contract.js';
4
37
  interface DbApplyContext {
5
38
  input: DbApplyInput;
6
39
  targetDir: string;
@@ -18,7 +51,9 @@ interface DbApplyContext {
18
51
  error: string | null;
19
52
  planSql: string | null;
20
53
  filteredPlanSql: string | null;
54
+ planSummary: DbApplyPlanSummary | null;
21
55
  ssotWarning: string | null;
56
+ nonCriticalWarnings: CommandWarning[];
22
57
  idempotentFiles: string[];
23
58
  idempotentRisks: {
24
59
  high: number;
@@ -44,6 +79,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
44
79
  }, {
45
80
  [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
46
81
  applied: boolean;
82
+ warnings: string[];
47
83
  }, {
48
84
  input: DbApplyInput;
49
85
  targetDir: string;
@@ -73,6 +109,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
73
109
  src: "applySeeds";
74
110
  logic: import("xstate").PromiseActorLogic<{
75
111
  applied: boolean;
112
+ warnings: string[];
76
113
  }, {
77
114
  input: DbApplyInput;
78
115
  targetDir: string;
@@ -124,6 +161,9 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
124
161
  }, import("xstate").EventObject>;
125
162
  id: string | undefined;
126
163
  }, {
164
+ type: "assignPgSchemaDiffResult";
165
+ params: import("xstate").NonReducibleUnknown;
166
+ } | {
127
167
  type: "releaseAdvisoryLockOnFailure";
128
168
  params: unknown;
129
169
  }, never, never, "done" | "failed" | "idle" | "acquiringLock" | "previewingIdempotent" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "validatingPartitions" | "releasingLock" | "applyingSeeds", string, {
@@ -196,6 +236,17 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
196
236
  error?: string | undefined;
197
237
  planSql?: string | undefined;
198
238
  filteredPlanSql?: string | undefined;
239
+ planSummary?: {
240
+ rawStatements: number;
241
+ effectiveStatements: number;
242
+ noiseStatements: number;
243
+ categories: {
244
+ idempotentDrop: number;
245
+ idempotentAuthz: number;
246
+ idempotentRls: number;
247
+ suppressedFunction: number;
248
+ };
249
+ } | undefined;
199
250
  checkOnly?: boolean | undefined;
200
251
  dataViolations?: number | undefined;
201
252
  ssotWarning?: string | undefined;
@@ -27,6 +27,7 @@ export type DirectoryPlacementAllowlistRule = {
27
27
  id: string;
28
28
  filePattern: RegExp;
29
29
  messagePattern: RegExp;
30
+ objectPattern?: RegExp;
30
31
  level?: BoundaryPolicyRiskLevel;
31
32
  lineStart?: number;
32
33
  lineEnd?: number;
@@ -65,6 +66,7 @@ export type RawRule = {
65
66
  code?: unknown;
66
67
  filePattern?: unknown;
67
68
  anchorPattern?: unknown;
69
+ objectPattern?: unknown;
68
70
  descriptionPattern?: unknown;
69
71
  messagePattern?: unknown;
70
72
  level?: unknown;
@@ -0,0 +1,35 @@
1
+ import { type SqlLayer } from './declarative-dependency-sql-utils.js';
2
+ export interface FunctionOwnershipDefinition {
3
+ qualifiedName: string;
4
+ signature: string | null;
5
+ file: string;
6
+ line: number;
7
+ layer: SqlLayer;
8
+ }
9
+ export interface DuplicateFunctionOwnershipFinding {
10
+ code: 'DUPLICATE_FUNCTION_OWNERSHIP' | 'DUPLICATE_FUNCTION_OWNERSHIP_AMBIGUOUS';
11
+ qualifiedName: string;
12
+ signature: string | null;
13
+ message: string;
14
+ suggestion: string;
15
+ declarativeDefinitions: FunctionOwnershipDefinition[];
16
+ idempotentDefinitions: FunctionOwnershipDefinition[];
17
+ }
18
+ export interface DuplicateFunctionOwnershipAnalysisResult {
19
+ contractNote: string;
20
+ findings: DuplicateFunctionOwnershipFinding[];
21
+ definitions: {
22
+ declarative: FunctionOwnershipDefinition[];
23
+ idempotent: FunctionOwnershipDefinition[];
24
+ };
25
+ }
26
+ export interface FormattedDuplicateFunctionOwnershipFinding {
27
+ summary: string;
28
+ declarativeLocations: string[];
29
+ idempotentLocations: string[];
30
+ suggestion: string;
31
+ }
32
+ export declare const DUPLICATE_FUNCTION_OWNERSHIP_NOTE = "Function ownership belongs to declarative SQL; idempotent 2nd pass must not redefine declarative-managed functions.";
33
+ export declare function analyzeDuplicateFunctionOwnership(targetDir: string): DuplicateFunctionOwnershipAnalysisResult;
34
+ export declare function formatDuplicateFunctionOwnershipFinding(finding: DuplicateFunctionOwnershipFinding): FormattedDuplicateFunctionOwnershipFinding;
35
+ //# sourceMappingURL=duplicate-function-ownership.d.ts.map
@@ -0,0 +1,16 @@
1
+ import type { DbApplyPlanSummary } from '../apply/contract.js';
2
+ export declare const PLAN_SIZE_WARNING_THRESHOLD: {
3
+ readonly effectiveStatements: 200;
4
+ readonly rawStatements: 500;
5
+ };
6
+ export declare const PLAN_SIZE_BLOCKER_THRESHOLD: {
7
+ readonly effectiveStatements: 500;
8
+ readonly rawStatements: 1000;
9
+ };
10
+ export interface PlanSizeAssessment {
11
+ severity: 'ok' | 'warning' | 'blocker';
12
+ reasons: string[];
13
+ }
14
+ export declare function assessPlanSize(summary: DbApplyPlanSummary | undefined): PlanSizeAssessment;
15
+ export declare function formatPlanSizeSummary(summary: DbApplyPlanSummary): string;
16
+ //# sourceMappingURL=plan-size-guard.d.ts.map
@@ -0,0 +1,4 @@
1
+ import type { createCLILogger } from '@runa-ai/runa';
2
+ import type { PreflightCheckResult, StepCounter } from '../preflight-check.js';
3
+ export declare function runDuplicateFunctionOwnershipCheck(result: PreflightCheckResult, logger: ReturnType<typeof createCLILogger>, step: StepCounter): Promise<void>;
4
+ //# sourceMappingURL=duplicate-function-ownership-checks.d.ts.map
@@ -20,7 +20,7 @@
20
20
  *
21
21
  * Sync strategy: Keep this in sync with packages/runa-templates/package.json version.
22
22
  */
23
- export declare const COMPATIBLE_TEMPLATES_VERSION = "0.7.2";
23
+ export declare const COMPATIBLE_TEMPLATES_VERSION = "0.7.3";
24
24
  /**
25
25
  * Templates package name on GitHub Packages.
26
26
  * Published to npm.pkg.github.com (requires NODE_AUTH_TOKEN).