@runa-ai/runa-cli 0.7.3 → 0.9.0

package/dist/commands/db/apply/helpers/plan-ast-sql-helpers.d.ts

@@ -0,0 +1,19 @@
+export declare function stripLeadingSetStatements(sql: string): string;
+export declare function extractStringValue(node: Record<string, unknown> | undefined): string | undefined;
+export declare function readIdentifierList(items: unknown[] | undefined): string[];
+export declare function qualifyName(parts: readonly string[], fallbackSchema?: string): string | null;
+export declare function rangeVarToQualifiedName(node: Record<string, unknown> | undefined): string | null;
+export declare function relationRecordToQualifiedName(record: Record<string, unknown> | undefined): string | null;
+export declare function optionDefElems(options: unknown[] | undefined): Array<Record<string, unknown>>;
+export declare function walkPgNode(node: unknown, visit: (record: Record<string, unknown>) => void): void;
+export declare function collectReferencedRelations(node: unknown, exclude: ReadonlySet<string>): string[];
+export declare function collectFunctionNames(node: unknown): string[];
+export declare function normalizeDbProconfig(entries: string[]): string;
+export declare function extractFunctionConfigFromSql(sql: string): string;
+export declare function extractFunctionOptions(createFunction: Record<string, unknown>): {
+    language: string;
+    body: string;
+    config: string;
+};
+export declare function extractFunctionIdentity(createFunction: Record<string, unknown>): string | null;
+//# sourceMappingURL=plan-ast-sql-helpers.d.ts.map

package/dist/commands/db/apply/helpers/plan-ast.d.ts

@@ -1,4 +1,5 @@
 import type { PlanStatement, ValidatedPlan } from './plan-validator.js';
+export { stripLeadingSetStatements } from './plan-ast-sql-helpers.js';
 export type PlanObjectKind = 'schema' | 'relation' | 'function' | 'function-privilege' | 'type' | 'other';
 export interface AnalyzedPlanStatement {
     statement: PlanStatement;
@@ -41,7 +42,6 @@ export interface PlanAnalysisSession {
     analyzePlpgsqlBody(body: string): Promise<CachedPlpgsqlBodyAnalysis>;
 }
 export declare function createPlanAnalysisSession(): PlanAnalysisSession;
-export declare function stripLeadingSetStatements(sql: string): string;
 export declare function analyzePlanStatement(statement: PlanStatement, session?: PlanAnalysisSession): Promise<AnalyzedPlanStatement>;
 export declare function analyzeValidatedPlan(plan: ValidatedPlan, session?: PlanAnalysisSession): Promise<AnalyzedPlan>;
 export declare function stabilizeAnalyzedPlanOrder(analyzedPlan: AnalyzedPlan): {
@@ -52,5 +52,4 @@ export declare function normalizeFunctionDefinitionAst(analyzed: Pick<AnalyzedPl
     normalizedDefinition: string;
     normalizedConfig: string;
 } | null;
-export {};
 //# sourceMappingURL=plan-ast.d.ts.map

package/dist/commands/db/apply/helpers/plan-check-filter.d.ts

@@ -1,26 +1,23 @@
+import type { DbApplyPlanSummary } from '../contract.js';
 import type { IdempotentProtectedObjects } from './idempotent-object-registry.js';
 import type { PlanStatement, ValidatedPlan } from './plan-validator.js';
 export interface CheckModeFilterResult {
     filteredPlan: ValidatedPlan;
     removedDropStatements: PlanStatement[];
     removedAuthzStatements: PlanStatement[];
+    removedRlsStatements: PlanStatement[];
 }
-declare function parseRolesFromAuthzStatement(sql: string): string[];
 export declare function stripLeadingSessionStatements(sql: string): string;
-type AuthzTarget = {
-    kind: 'function';
-    schema: string;
-    fullName: string;
-} | {
-    kind: 'schema' | 'sequence' | 'table';
-    schema: string;
-    fullName: string;
-} | null;
-declare function parseAuthzTarget(sql: string): AuthzTarget;
 export declare function isIdempotentManagedAuthzStatement(sql: string, schemasDir?: string): boolean;
+export declare function isIdempotentManagedRlsStatement(sql: string, schemasDir?: string): boolean;
 export declare function filterCheckModePlanStatements(plan: ValidatedPlan, protectedTables: string[], protectedObjects: IdempotentProtectedObjects, schemasDir?: string): CheckModeFilterResult;
+export declare function buildCheckModePlanSummary(params: {
+    rawStatementCount: number;
+    filteredPlan: ValidatedPlan;
+    removedDropStatements: readonly PlanStatement[];
+    removedAuthzStatements: readonly PlanStatement[];
+    removedRlsStatements: readonly PlanStatement[];
+    suppressedFunctionStatements?: readonly PlanStatement[];
+}): DbApplyPlanSummary;
 export declare function resetManagedAuthzCache(): void;
-export declare const _parseRolesFromAuthzStatement: typeof parseRolesFromAuthzStatement;
-export declare const _parseAuthzTarget: typeof parseAuthzTarget;
-export {};
 //# sourceMappingURL=plan-check-filter.d.ts.map

package/dist/commands/db/apply/helpers/plan-validator.d.ts

@@ -90,6 +90,40 @@ export declare function validateStatementTypes(plan: ValidatedPlan): void;
  * @throws Error if unresolved hazards are found
  */
 export declare function validatePlanForExecution(plan: ValidatedPlan, allowedHazardTypes: string[]): void;
+/**
+ * Validate that plan SQL doesn't have ALTER POLICY referencing a function
+ * that is CREATE'd later in the same plan.
+ *
+ * This catches pg-schema-diff ordering bugs where ALTER POLICY (phase 50)
+ * is emitted before CREATE FUNCTION (phase 60), causing "function does not exist"
+ * errors at execution time.
+ *
+ * Called during plan generation (check mode) so issues are caught before deploy.
+ */
+/**
+ * Validate dependency order from raw SQL string.
+ * More reliable than ValidatedPlan-based check because it works regardless
+ * of how parsePlanOutput splits statements (marker-based vs SET-based).
+ */
+export declare function validateDependencyOrderFromRawSql(rawSql: string): string[];
+/**
+ * Reorder raw plan SQL to fix ALTER POLICY before CREATE FUNCTION ordering.
+ *
+ * Moves policy chunks that reference functions created later in the plan
+ * to after those function definitions. This is the actual fix that makes
+ * deploy succeed, not just detection.
+ */
+export declare function reorderRawSqlDependencies(rawSql: string): {
+    sql: string;
+    reordered: boolean;
+    movedCount: number;
+};
+export declare function validateDependencyOrder(plan: ValidatedPlan): string[];
+/**
+ * Determine whether pg-schema-diff plan output represents "no changes needed".
+ * Returns true if the output is empty, contains "No changes", or has zero statements.
+ */
+export declare function isNoChangePlanOutput(planOutput: string): boolean;
 export type { FilterResult } from './plan-drop-protection.js';
 export { filterIdempotentProtectedStatements, isDropStatementForProtectedObject, _isDropStatementForProtected, _extractProtectedSchemas, _isDropSchemaForProtected, } from './plan-drop-protection.js';
 //# sourceMappingURL=plan-validator.d.ts.map

package/dist/commands/db/apply/helpers/planner-artifact.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import { type RunaDbEnv } from '../../utils/db-target.js';
+import { type DbApplyInput, type DbApplyOutput, type DbApplyPlanner } from '../contract.js';
+export declare const DbPlanArtifactSchema: z.ZodObject<{
+    version: z.ZodLiteral<"1">;
+    environment: z.ZodEnum<{
+        local: "local";
+        preview: "preview";
+        production: "production";
+    }>;
+    mode: z.ZodLiteral<"check">;
+    previewProfile: z.ZodEnum<{
+        full: "full";
+        "compare-only": "compare-only";
+    }>;
+    createdAt: z.ZodString;
+    hasChanges: z.ZodBoolean;
+    planSql: z.ZodString;
+    filteredPlanSql: z.ZodString;
+    planSummary: z.ZodOptional<z.ZodObject<{
+        rawStatements: z.ZodNumber;
+        effectiveStatements: z.ZodNumber;
+        noiseStatements: z.ZodNumber;
+        categories: z.ZodObject<{
+            idempotentDrop: z.ZodNumber;
+            idempotentAuthz: z.ZodNumber;
+            idempotentRls: z.ZodNumber;
+            suppressedFunction: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    hazards: z.ZodArray<z.ZodString>;
+    sourceFingerprint: z.ZodString;
+    targetFingerprint: z.ZodString;
+    toolMetadata: z.ZodObject<{
+        cliVersion: z.ZodString;
+        pgSchemaDiffVersion: z.ZodOptional<z.ZodString>;
+        nodeVersion: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type DbPlanArtifact = z.infer<typeof DbPlanArtifactSchema>;
+export declare function detectPlannerSchemas(repoRoot: string): string[];
+export declare function buildTargetFingerprint(params: {
+    databaseUrl: string;
+    includeSchemas: string[];
+}): string;
+export declare function getDbPlanArtifactPath(params: {
+    repoRoot: string;
+    environment: RunaDbEnv;
+    previewProfile: 'compare-only' | 'full';
+}): string;
+export declare function persistDbPlanArtifact(params: {
+    repoRoot: string;
+    input: Pick<DbApplyInput, 'env' | 'check' | 'compareOnly' | 'databaseUrl'>;
+    output: Pick<DbApplyOutput, 'planSql' | 'filteredPlanSql' | 'planSummary' | 'hazards'>;
+}): DbApplyPlanner;
+export declare function tryReuseDbPlanArtifact(params: {
+    repoRoot: string;
+    artifactPath: string;
+    input: Pick<DbApplyInput, 'env' | 'databaseUrl'>;
+    precomputedTargetFingerprint?: string;
+}): {
+    artifact: DbPlanArtifact | null;
+    planner: DbApplyPlanner;
+};
+//# sourceMappingURL=planner-artifact.d.ts.map

package/dist/commands/db/apply/helpers/retry-logic.d.ts

@@ -84,6 +84,11 @@ export interface PlanSqlRetryConfig extends RetryConfig {
      * Recommended for production to avoid executing ambiguous SQL plans.
      */
     failOnLowParseConfidence?: boolean;
+    /**
+     * Fail immediately when a retryable lock error occurs but re-planning is not allowed.
+     * Used by checked planner artifact reuse to avoid replaying stale SQL after partial execution.
+     */
+    retryRequiresReplanMessage?: string;
 }
 /**
  * Execute plan SQL via psql with retry logic.

package/dist/commands/db/apply/machine.d.ts

@@ -1,10 +1,44 @@
+/**
+ * AI HINT: db apply State Machine (Declarative Schema Management)
+ *
+ * Purpose: Orchestrate schema application to any DB (local, Branch DB, Production)
+ *
+ * User Journey (2-pass idempotent):
+ * 1. Apply idempotent schemas (1st pass: extensions, roles - may skip dependent tables)
+ * 2. Run pg-schema-diff (current DB → desired state)
+ * 3. Apply idempotent schemas (2nd pass: dependent tables now succeed)
+ * 4. Validate partitions (non-blocking drift detection)
+ * 5. Apply seeds
+ *
+ * Why 2-pass idempotent?
+ * - Some idempotent SQL depends on declarative tables (e.g., areas → floors)
+ * - 1st pass: extensions/roles succeed, dependent tables are skipped (no error)
+ * - 2nd pass: dependent tables succeed because declarative tables now exist
+ *
+ * Architecture:
+ * - No migration files needed
+ * - pg-schema-diff runs at runtime against actual DB state
+ * - Same logic for all environments
+ *
+ * E2E Test Mapping (CLI observable behavior):
+ * - idle → expect(log).toContain('Starting db apply')
+ * - applyingIdempotentPre → expect(log).toContain('Applied idempotent schema')
+ * - applyingPgSchemaDiff → expect(log).toContain('pg-schema-diff')
+ * - applyingIdempotentPost → expect(log).toContain('Applied idempotent schema')
+ * - validatingPartitions → expect(log).toContain('partition')
+ * - applyingSeeds → expect(log).toContain('Applying seeds')
+ * - done → expect(exitCode).toBe(0)
+ * - failed → expect(exitCode).toBe(1)
+ */
+import { type CommandWarning } from '@runa-ai/runa';
 import { type SnapshotFrom } from 'xstate';
 import * as actors from './actors.js';
-import type { DbApplyInput } from './contract.js';
+import type { DbApplyInput, DbApplyPlanner, DbApplyPlanSummary } from './contract.js';
 interface DbApplyContext {
     input: DbApplyInput;
     targetDir: string;
     lockAcquired: boolean;
+    preIdempotentTargetFingerprint: string | null;
     idempotentPreApplied: number;
     idempotentPreSkipped: number;
     idempotentPostApplied: number;
@@ -18,7 +52,10 @@ interface DbApplyContext {
     error: string | null;
     planSql: string | null;
     filteredPlanSql: string | null;
+    planSummary: DbApplyPlanSummary | null;
+    planner: DbApplyPlanner | null;
     ssotWarning: string | null;
+    nonCriticalWarnings: CommandWarning[];
     idempotentFiles: string[];
     idempotentRisks: {
         high: number;
@@ -35,7 +72,14 @@ interface DbApplyContext {
     seedStartTime: number | null;
     seedEndTime: number | null;
     retryAttempts: number;
+    retryWaitMs: number;
 }
+interface DbApplyFailureMetadata {
+    code: string;
+    retryable: boolean;
+}
+export declare function classifyDbApplyFailure(errorMessage: string): DbApplyFailureMetadata;
+export declare function createMachineWarning(code: string, message: string, phase: string): CommandWarning;
 export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContext, {
     type: "START";
 } | {
@@ -43,11 +87,6 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     error: Error;
 }, {
     [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
-        applied: boolean;
-    }, {
-        input: DbApplyInput;
-        targetDir: string;
-    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
         acquired: boolean;
     }, {
         input: DbApplyInput;
@@ -63,22 +102,23 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.PgSchemaDiffResult, {
         input: DbApplyInput;
         targetDir: string;
+        preIdempotentTargetFingerprint?: string | null;
     }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
         warnings: string[];
     }, {
         input: DbApplyInput;
         targetDir: string;
-    }, import("xstate").EventObject>> | undefined;
-}, {
-    src: "applySeeds";
-    logic: import("xstate").PromiseActorLogic<{
+    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
         applied: boolean;
+        warnings: string[];
     }, {
         input: DbApplyInput;
         targetDir: string;
-    }, import("xstate").EventObject>;
-    id: string | undefined;
-} | {
+    }, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<string | null, {
+        input: DbApplyInput;
+        targetDir: string;
+    }, import("xstate").EventObject>> | undefined;
+}, {
     src: "acquireLock";
     logic: import("xstate").PromiseActorLogic<{
         acquired: boolean;
@@ -112,6 +152,7 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     logic: import("xstate").PromiseActorLogic<actors.PgSchemaDiffResult, {
         input: DbApplyInput;
         targetDir: string;
+        preIdempotentTargetFingerprint?: string | null;
     }, import("xstate").EventObject>;
     id: string | undefined;
 } | {
@@ -123,10 +164,30 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
         targetDir: string;
     }, import("xstate").EventObject>;
     id: string | undefined;
+} | {
+    src: "applySeeds";
+    logic: import("xstate").PromiseActorLogic<{
+        applied: boolean;
+        warnings: string[];
+    }, {
+        input: DbApplyInput;
+        targetDir: string;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
+} | {
+    src: "captureTargetFingerprint";
+    logic: import("xstate").PromiseActorLogic<string | null, {
+        input: DbApplyInput;
+        targetDir: string;
+    }, import("xstate").EventObject>;
+    id: string | undefined;
 }, {
+    type: "assignPgSchemaDiffResult";
+    params: import("xstate").NonReducibleUnknown;
+} | {
     type: "releaseAdvisoryLockOnFailure";
     params: unknown;
-}, never, never, "done" | "failed" | "idle" | "acquiringLock" | "previewingIdempotent" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "validatingPartitions" | "releasingLock" | "applyingSeeds", string, {
+}, never, never, "done" | "failed" | "idle" | "acquiringLock" | "previewingIdempotent" | "capturingTargetFingerprint" | "applyingIdempotentPre" | "applyingPgSchemaDiff" | "applyingIdempotentPost" | "validatingPartitions" | "releasingLock" | "applyingSeeds", string, {
     input: DbApplyInput;
     targetDir: string;
 }, {
@@ -196,7 +257,19 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
     error?: string | undefined;
     planSql?: string | undefined;
     filteredPlanSql?: string | undefined;
+    planSummary?: {
+        rawStatements: number;
+        effectiveStatements: number;
+        noiseStatements: number;
+        categories: {
+            idempotentDrop: number;
+            idempotentAuthz: number;
+            idempotentRls: number;
+            suppressedFunction: number;
+        };
+    } | undefined;
     checkOnly?: boolean | undefined;
+    previewProfile?: "full" | "compare-only" | undefined;
     dataViolations?: number | undefined;
     ssotWarning?: string | undefined;
     partitionWarnings?: string[] | undefined;
@@ -212,12 +285,25 @@ export declare const dbApplyMachine: import("xstate").StateMachine<DbApplyContex
         applyMs?: number | undefined;
         seedMs?: number | undefined;
         retryAttempts?: number | undefined;
+        retryWaitMs?: number | undefined;
+    } | undefined;
+    planner?: {
+        source: "inline" | "artifact";
+        path?: string | undefined;
+        reuseAttempted?: boolean | undefined;
+        reuseReason?: "artifact_missing" | "artifact_invalid" | "profile_ineligible" | "source_fingerprint_mismatch" | "target_fingerprint_unavailable" | "target_fingerprint_mismatch" | "tool_version_mismatch" | undefined;
+        reuseMessage?: string | undefined;
+        sourceFingerprint?: string | undefined;
+        targetFingerprint?: string | undefined;
+        targetFingerprintMatched?: boolean | undefined;
+        hasChanges?: boolean | undefined;
     } | undefined;
 }, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "dbApply";
     states: {
         readonly idle: {};
         readonly acquiringLock: {};
+        readonly capturingTargetFingerprint: {};
         readonly previewingIdempotent: {};
         readonly applyingIdempotentPre: {};
         readonly applyingPgSchemaDiff: {};

package/dist/commands/db/commands/db-apply-error.d.ts

@@ -1,5 +1,10 @@
 import { CLIError } from '@runa-ai/runa';
+import type { DbPreviewProfile } from '../apply/contract.js';
 type DbApplyEnvironment = 'local' | 'preview' | 'production';
-export declare function buildDbApplyCliError(errorMessage: string, environment: DbApplyEnvironment): CLIError;
+interface DbApplyCliErrorOptions {
+    previewProfile?: DbPreviewProfile | null;
+    fromPlan?: boolean;
+}
+export declare function buildDbApplyCliError(errorMessage: string, environment: DbApplyEnvironment, options?: DbApplyCliErrorOptions): CLIError;
 export {};
 //# sourceMappingURL=db-apply-error.d.ts.map

package/dist/commands/db/commands/db-apply.d.ts

@@ -14,6 +14,11 @@ export interface DbApplyOptions {
     compareOnly?: boolean;
     maxLockWaitMs?: number;
     freshDbCheckSql?: string;
+    commandLabel?: string;
+    /** Reuse a checked plan artifact generated by `runa db plan`. */
+    fromPlan?: string;
+    /** Persist the checked plan artifact after a successful full preview. */
+    persistPlanArtifact?: boolean;
 }
 /**
  * Run db apply workflow

package/dist/commands/db/commands/db-plan.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const planCommand: Command;
+//# sourceMappingURL=db-plan.d.ts.map

package/dist/commands/db/commands/db-preview-profile.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import { type DbApplyOutput, type DbPreviewProfile } from '../apply/contract.js';
+export declare const DEFAULT_DB_PREVIEW_PROFILE: DbPreviewProfile;
+export declare const DbPreviewEnvironmentSchema: z.ZodEnum<{
+    local: "local";
+    preview: "preview";
+    production: "production";
+}>;
+export declare const LEGACY_DB_APPLY_CHECK_REMOVAL_TARGET = "the next major CLI release";
+export declare function parseDbPreviewProfile(value: string): DbPreviewProfile;
+export type DbPreviewEnvironment = z.infer<typeof DbPreviewEnvironmentSchema>;
+export declare function resolveDbPreviewEnvironment(value: string): DbPreviewEnvironment | null;
+export declare function resolveDbPreviewProfile(params: {
+    check?: boolean;
+    compareOnly?: boolean;
+}): DbPreviewProfile | null;
+export declare function isCompareOnlyPreviewProfile(profile: DbPreviewProfile): boolean;
+export declare function getDbPreviewModeLabel(profile: DbPreviewProfile): string;
+export declare function buildDbPreviewCommandLabel(env: string, profile: DbPreviewProfile): string;
+export declare function buildDbPlanCommandLabel(env: string): string;
+export declare function getDbPreviewIdempotentSchemaCount(result: Pick<DbApplyOutput, 'idempotentFiles' | 'idempotentSchemasApplied'>): number;
+export declare function buildLegacyDbApplyCheckWarning(profile: DbPreviewProfile): string;
+//# sourceMappingURL=db-preview-profile.d.ts.map

package/dist/commands/db/commands/db-preview.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const previewCommand: Command;
+//# sourceMappingURL=db-preview.d.ts.map

package/dist/commands/db/sync/actors.d.ts

@@ -74,6 +74,7 @@ export interface SyncInput {
 export declare const syncSchema: import("xstate").PromiseActorLogic<{
     applied: boolean;
     stepsCompleted: string[];
+    applyCommitted?: boolean | undefined;
     error?: string | undefined;
 }, SyncInput, import("xstate").EventObject>;
 export interface ReportInput {

package/dist/commands/db/sync/contract.d.ts

@@ -13,6 +13,7 @@
  * - runa db sync --check      # Dry-run mode
  */
 import { z } from 'zod';
+import type { BoundaryGuidanceWarning, LocalBlindSpotBlocker, RuntimeContradictionIssue, RuntimeWarningIssue, SchemaGuardrailReport, SchemaManagedBlockKind, SchemaGuardrailFailureCode, SchemaGuardrailPhaseId, SemanticDuplicateCandidate, SemanticDuplicateEvidence, SemanticDuplicateWarning } from './schema-guardrail-types.js';
 /**
  * Environment type for db sync
  */
@@ -89,6 +90,7 @@ export type SnapshotResult = z.infer<typeof SnapshotResultSchema>;
  */
 export declare const SyncResultSchema: z.ZodObject<{
     applied: z.ZodBoolean;
+    applyCommitted: z.ZodOptional<z.ZodBoolean>;
     stepsCompleted: z.ZodArray<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -123,6 +125,18 @@ export declare const StepContextSchema: z.ZodObject<{
     configTimeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type StepContext = z.infer<typeof StepContextSchema>;
+export declare const SchemaManagedBlockKindSchema: z.ZodType<SchemaManagedBlockKind>;
+export declare const SchemaGuardrailPhaseIdSchema: z.ZodType<SchemaGuardrailPhaseId>;
+export declare const SchemaGuardrailFailureCodeSchema: z.ZodType<SchemaGuardrailFailureCode>;
+export declare const RuntimeWarningIssueSchema: z.ZodType<RuntimeWarningIssue>;
+export declare const RuntimeContradictionIssueSchema: z.ZodType<RuntimeContradictionIssue>;
+export declare const SemanticDuplicateEvidenceSchema: z.ZodType<SemanticDuplicateEvidence>;
+export declare const SemanticDuplicateCandidateSchema: z.ZodType<SemanticDuplicateCandidate>;
+export declare const SemanticDuplicateWarningSchema: z.ZodType<SemanticDuplicateWarning>;
+export declare const BoundaryGuidanceWarningSchema: z.ZodType<BoundaryGuidanceWarning>;
+export declare const LocalBlindSpotBlockerSchema: z.ZodType<LocalBlindSpotBlocker>;
+export declare const SchemaGuardrailReportSchema: z.ZodType<SchemaGuardrailReport>;
+export type { RuntimeContradictionIssue, RuntimeWarningIssue, SchemaGuardrailReport, SchemaManagedBlockKind, SchemaGuardrailFailureCode, SchemaGuardrailPhaseId, SemanticDuplicateCandidate, SemanticDuplicateEvidence, SemanticDuplicateWarning, } from './schema-guardrail-types.js';
 /**
  * DB sync command result
  */
@@ -137,10 +151,12 @@ export declare const DbSyncOutputSchema: z.ZodObject<{
     preflightPassed: z.ZodBoolean;
     snapshotCreated: z.ZodBoolean;
     applied: z.ZodBoolean;
+    applyCommitted: z.ZodOptional<z.ZodBoolean>;
     stepsCompleted: z.ZodArray<z.ZodString>;
     reportJsonPath: z.ZodOptional<z.ZodString>;
     exitCode: z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<1>]>;
     error: z.ZodOptional<z.ZodString>;
+    guardrail: z.ZodOptional<z.ZodType<SchemaGuardrailReport, unknown, z.core.$ZodTypeInternals<SchemaGuardrailReport, unknown>>>;
     outcome: z.ZodObject<{
         command: z.ZodString;
         exitMode: z.ZodEnum<{

package/dist/commands/db/sync/guardrail-orchestrator.d.ts

@@ -0,0 +1,15 @@
+import type { DbSyncOutput } from './contract.js';
+import type { DbCommandOptions } from '../types.js';
+type GuardrailLogger = {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+};
+export declare function runDbSyncWithGuardrail(params: {
+    env: string;
+    options: DbCommandOptions;
+    logger: GuardrailLogger;
+    runDbSyncMachine: () => Promise<DbSyncOutput>;
+}): Promise<DbSyncOutput>;
+export {};
+//# sourceMappingURL=guardrail-orchestrator.d.ts.map

package/dist/commands/db/sync/guardrail-reporting.d.ts

@@ -0,0 +1,12 @@
+import type { DbSyncOutput, SchemaGuardrailReport } from './contract.js';
+export type GuardrailSummaryEntry = {
+    level: 'info' | 'warn' | 'error';
+    message: string;
+};
+export declare function buildGuardrailSummaryEntries(report: SchemaGuardrailReport): GuardrailSummaryEntry[];
+export declare function buildGuardrailPreApplyEntries(report: SchemaGuardrailReport): GuardrailSummaryEntry[];
+export declare function writeMergedDbSyncReportJson(params: {
+    filePath?: string;
+    result: DbSyncOutput;
+}): void;
+//# sourceMappingURL=guardrail-reporting.d.ts.map

package/dist/commands/db/sync/index.d.ts

@@ -6,5 +6,9 @@
  */
 export * from './actors.js';
 export * from './contract.js';
+export * from './guardrail-orchestrator.js';
+export * from './guardrail-reporting.js';
 export * from './machine.js';
+export type * from './schema-guardrail-types.js';
+export { createGuardrailOutcomePhases, createSyncApplyFailureReport, runSchemaGuardrailRuntime, runSchemaGuardrailStatic, } from './schema-guardrail.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/db/sync/machine.d.ts

@@ -31,6 +31,7 @@ interface DbSyncContext {
     preflightPassed: boolean;
     snapshotCreated: boolean;
     applied: boolean;
+    applyCommitted: boolean;
     stepsCompleted: string[];
     reportWritten: boolean;
     error: string | null;
@@ -51,17 +52,18 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     }, actors.SnapshotInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
         applied: boolean;
         stepsCompleted: string[];
+        applyCommitted?: boolean | undefined;
         error?: string | undefined;
     }, actors.SyncInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
-        passed: boolean;
-        warnings?: string[] | undefined;
-        error?: string | undefined;
-    }, actors.PreflightInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
         passed: boolean;
         databaseUrl?: string | undefined;
         dbPackagePath?: string | undefined;
         error?: string | undefined;
-    }, actors.ReconcileInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.SetupOutput, actors.SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.ReportOutput, actors.ReportInput, import("xstate").EventObject>> | undefined;
+    }, actors.ReconcileInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<{
+        passed: boolean;
+        warnings?: string[] | undefined;
+        error?: string | undefined;
+    }, actors.PreflightInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.SetupOutput, actors.SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<actors.ReportOutput, actors.ReportInput, import("xstate").EventObject>> | undefined;
 }, {
     src: "snapshot";
     logic: import("xstate").PromiseActorLogic<{
@@ -76,25 +78,26 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     logic: import("xstate").PromiseActorLogic<{
         applied: boolean;
         stepsCompleted: string[];
+        applyCommitted?: boolean | undefined;
         error?: string | undefined;
     }, actors.SyncInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
-    src: "preflight";
+    src: "reconcile";
     logic: import("xstate").PromiseActorLogic<{
         passed: boolean;
-        warnings?: string[] | undefined;
+        databaseUrl?: string | undefined;
+        dbPackagePath?: string | undefined;
         error?: string | undefined;
-    }, actors.PreflightInput, import("xstate").EventObject>;
+    }, actors.ReconcileInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
-    src: "reconcile";
+    src: "preflight";
     logic: import("xstate").PromiseActorLogic<{
         passed: boolean;
-        databaseUrl?: string | undefined;
-        dbPackagePath?: string | undefined;
+        warnings?: string[] | undefined;
         error?: string | undefined;
-    }, actors.ReconcileInput, import("xstate").EventObject>;
+    }, actors.PreflightInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
     src: "setupContext";
@@ -104,7 +107,7 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     src: "writeReport";
     logic: import("xstate").PromiseActorLogic<actors.ReportOutput, actors.ReportInput, import("xstate").EventObject>;
     id: string | undefined;
-}, never, never, never, "done" | "failed" | "sync" | "setup" | "idle" | "snapshot" | "report" | "preflight" | "reconcile", string, {
+}, never, never, never, "done" | "failed" | "sync" | "setup" | "idle" | "snapshot" | "reconcile" | "report" | "preflight", string, {
     env?: "local" | "preview" | "production" | undefined;
     check?: boolean | undefined;
     force?: boolean | undefined;
@@ -187,8 +190,10 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
         };
         nextActions?: string[] | undefined;
     };
+    applyCommitted?: boolean | undefined;
     reportJsonPath?: string | undefined;
     error?: string | undefined;
+    guardrail?: import("./schema-guardrail-types.js").SchemaGuardrailReport | undefined;
 }, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "dbSync";
     states: {