@runa-ai/runa-cli 0.7.3 → 0.9.0

package/dist/commands/db/sync/schema-guardrail-config-test-support.d.ts

@@ -0,0 +1,15 @@
+import type { SchemaGuardrailConfig } from './schema-guardrail-types.js';
+type GuardrailConfigNormalizers = {
+    normalizeAllowlistSignature(value: string): string;
+    normalizeFileList(files: Iterable<string>): string[];
+    normalizeFunctionQualifiedName(value: string): string;
+    normalizePathForMatch(filePath: string): string;
+    normalizeSuppressionPair(value: string): string;
+};
+export declare function tryLoadSchemaGuardrailConfigFromText(params: {
+    targetDir: string;
+    defaults: SchemaGuardrailConfig;
+    normalizers: GuardrailConfigNormalizers;
+}): SchemaGuardrailConfig | null;
+export {};
+//# sourceMappingURL=schema-guardrail-config-test-support.d.ts.map

package/dist/commands/db/sync/schema-guardrail-config.d.ts

@@ -0,0 +1,11 @@
+import type { SchemaGuardrailConfig } from './schema-guardrail-types.js';
+export declare const DEFAULT_TABLE_HEADER_MAX_WIDTH = 160;
+export declare const DEFAULT_SEMANTIC_WARNING_THRESHOLD = 0.55;
+export declare const DEFAULT_SEMANTIC_WARNING_MAX_CANDIDATES = 3;
+export declare const GENERIC_SIMILARITY_COLUMNS: Set<string>;
+export declare function normalizePathForMatch(filePath: string): string;
+export declare function normalizeFunctionQualifiedName(value: string): string;
+export declare function normalizeAllowlistSignature(value: string): string;
+export declare function normalizeSuppressionPair(value: string): string;
+export declare function loadSchemaGuardrailConfig(targetDir: string): SchemaGuardrailConfig;
+//# sourceMappingURL=schema-guardrail-config.d.ts.map

package/dist/commands/db/sync/schema-guardrail-ddl-order.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AI HINT: Schema Guardrail - DDL Order Validation
+ *
+ * Purpose: Detect policy→function dependency ordering issues that would
+ * cause "function does not exist" errors during production pg-schema-diff apply.
+ *
+ * Why this matters:
+ * - Local `runa db sync` runs against a fresh DB (all CREATE, no ALTER)
+ * - Production `runa db apply` generates ALTER POLICY for changed policies
+ * - pg-schema-diff may order ALTER POLICY (phase 50) before CREATE FUNCTION (phase 60)
+ * - This check catches the issue statically from SQL files, without needing a live DB
+ *
+ * Detection: For each CREATE POLICY/ALTER POLICY with a schema-qualified function call,
+ * verify the function is defined BEFORE the policy in file ordering (by file prefix number).
+ */
+export interface DdlOrderWarning {
+    policyFile: string;
+    policyLine: number;
+    functionRef: string;
+    functionFile: string;
+    message: string;
+}
+/**
+ * Scan declarative SQL files for policy→function ordering risks.
+ *
+ * Returns warnings when a policy references a function that is defined
+ * in a later-ordered file (by numeric prefix), which means pg-schema-diff
+ * may generate ALTER POLICY before CREATE FUNCTION during incremental apply.
+ */
+export declare function detectDdlOrderRisks(declarativeDir: string): DdlOrderWarning[];
+/**
+ * Run DDL order check and log warnings.
+ * Called from guardrail orchestrator during `runa db sync`.
+ */
+export declare function runDdlOrderCheck(targetDir: string): DdlOrderWarning[];
+//# sourceMappingURL=schema-guardrail-ddl-order.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph-guidance.d.ts

@@ -0,0 +1,15 @@
+/**
+ * AI HINT: Schema Guardrail Graph - Boundary Guidance Warnings
+ *
+ * Purpose: Generate guidance warnings for schema boundary violations,
+ * security definer issues, trigger ownership, and managed schema access
+ */
+import type { SchemaGuardrailReport, SchemaGraphFunctionClaim, SchemaGraphFileNode, SchemaGraphSchemaNode } from './schema-guardrail-types.js';
+declare function buildBoundaryGuidanceWarnings(params: {
+    fileNodes: SchemaGraphFileNode[];
+    schemaNodes: SchemaGraphSchemaNode[];
+    functionClaims: SchemaGraphFunctionClaim[];
+    ownerFileByTable: Map<string, string>;
+}): SchemaGuardrailReport['boundaryGuidanceWarnings'];
+export { buildBoundaryGuidanceWarnings };
+//# sourceMappingURL=schema-guardrail-graph-guidance.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph-metadata.d.ts

@@ -0,0 +1,41 @@
+/**
+ * AI HINT: Schema Guardrail Graph - Metadata Analysis
+ *
+ * Purpose: Function ownership hashing, allowlist checking, and
+ * defined function/boundary metadata extraction
+ */
+import { type DuplicateFunctionOwnershipFinding } from '../utils/duplicate-function-ownership.js';
+import { type SqlFile } from '../utils/declarative-dependency-sql-utils.js';
+import { type DefinedFunctionMetadata, type ManagedBoundaryMetadata } from './schema-guardrail-graph-types.js';
+import type { SchemaGuardrailConfig } from './schema-guardrail-types.js';
+declare function normalizeFunctionStatementForHash(statement: string): string;
+declare function buildFunctionBodyHashMap(files: SqlFile[], layer: 'declarative' | 'idempotent'): Map<string, string>;
+declare function isAllowlistedDuplicateFunction(params: {
+    finding: DuplicateFunctionOwnershipFinding;
+    allowlist: SchemaGuardrailConfig['allowedDuplicateFunctions'];
+    bodyHashes: Map<string, string>;
+}): boolean;
+/**
+ * Collect qualified object references from SQL function bodies
+ */
+declare function normalizeQualifiedObjectRef(schema: string, name: string, isFunctionCall: boolean): string;
+declare function collectQualifiedObjectRefs(params: {
+    content: string;
+    allowedSchemas: ReadonlySet<string>;
+    includeFunctionCalls: boolean;
+}): {
+    refs: string[];
+    schemas: string[];
+};
+/**
+ * Check if function body has SET search_path locked
+ */
+declare function isSearchPathLocked(statement: string): boolean;
+declare function buildDefinedFunctionMetadataByFile(params: {
+    files: SqlFile[];
+    layer: 'declarative' | 'idempotent';
+    managedSchemas: Set<string>;
+}): Map<string, DefinedFunctionMetadata[]>;
+declare function buildManagedBoundaryMetadataByFile(files: SqlFile[]): Map<string, ManagedBoundaryMetadata>;
+export { normalizeFunctionStatementForHash, buildFunctionBodyHashMap, isAllowlistedDuplicateFunction, normalizeQualifiedObjectRef, collectQualifiedObjectRefs, isSearchPathLocked, buildDefinedFunctionMetadataByFile, buildManagedBoundaryMetadataByFile, };
+//# sourceMappingURL=schema-guardrail-graph-metadata.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph-nodes.d.ts

@@ -0,0 +1,61 @@
+/**
+ * AI HINT: Schema Guardrail Graph - Node Building
+ *
+ * Purpose: Build graph nodes from declarative SQL files
+ * Includes: Trigger extraction, declarative file parsing,
+ * table/FK/dependency/file node construction
+ */
+import { type SqlFile } from '../utils/declarative-dependency-sql-utils.js';
+import { type DeclarativeFileRecord, type DefinedFunctionMetadata, type ManagedBoundaryMetadata, type IdempotentTouchMetadata } from './schema-guardrail-graph-types.js';
+import type { SchemaGuardrailConfig, SchemaGraphFileDependencyEdge, SchemaGraphFileNode, SchemaGraphFunctionClaim, SchemaGraphPolicyClaim, SchemaGraphPolicyRef, SchemaGraphTableNode, SchemaGraphTriggerRef, SchemaGuardrailReport } from './schema-guardrail-types.js';
+declare function parseCreateTriggerStatement(statement: string): {
+    qualifiedTable: string;
+    trigger: SchemaGraphTriggerRef;
+} | null;
+declare function appendTriggerRef(triggerMap: Map<string, SchemaGraphTriggerRef[]>, qualifiedTable: string, trigger: SchemaGraphTriggerRef): void;
+declare function extractCreateTriggers(content: string): Map<string, SchemaGraphTriggerRef[]>;
+declare function buildDeclarativeFileRecord(file: SqlFile): Promise<DeclarativeFileRecord>;
+declare function collectDeclarativeClaims(records: DeclarativeFileRecord[]): {
+    tableOwnerClaims: Map<string, Set<string>>;
+    schemaClaims: Map<string, Set<string>>;
+    createSchemaClaims: Map<string, Set<string>>;
+    tablePolicies: Map<string, SchemaGraphPolicyRef[]>;
+    policyClaims: SchemaGraphPolicyClaim[];
+};
+declare function createDuplicateTableOwners(tableOwnerClaims: Map<string, Set<string>>): SchemaGuardrailReport['duplicateTableOwners'];
+declare function buildFunctionValidationArtifacts(params: {
+    targetDir: string;
+    config: SchemaGuardrailConfig;
+    declarativeFiles: SqlFile[];
+    idempotentFiles: SqlFile[];
+}): {
+    duplicateFunctionOwners: SchemaGuardrailReport['duplicateFunctionOwners'];
+    functionClaims: SchemaGraphFunctionClaim[];
+};
+declare function buildOwnerFileByTable(tableOwnerClaims: Map<string, Set<string>>): Map<string, string>;
+declare function buildPolicyOwnershipConflicts(params: {
+    policyClaims: SchemaGraphPolicyClaim[];
+    ownerFileByTable: Map<string, string>;
+}): SchemaGuardrailReport['policyOwnershipConflicts'];
+declare function buildTableNodesByName(params: {
+    records: DeclarativeFileRecord[];
+    tablePolicies: Map<string, SchemaGraphPolicyRef[]>;
+}): Map<string, SchemaGraphTableNode>;
+declare function attachInboundForeignKeys(tableNodesByName: Map<string, SchemaGraphTableNode>): void;
+declare function buildFileDependencies(params: {
+    tableNodesByName: Map<string, SchemaGraphTableNode>;
+    ownerFileByTable: Map<string, string>;
+}): SchemaGraphFileDependencyEdge[];
+declare function normalizeTriggerFunctionToken(value: string | undefined): string | null;
+declare function buildFileNodes(params: {
+    records: DeclarativeFileRecord[];
+    idempotentFiles: SqlFile[];
+    idempotentTouchMetadata: Map<string, IdempotentTouchMetadata>;
+    definedFunctionMetadataByFile: Map<string, DefinedFunctionMetadata[]>;
+    managedBoundaryMetadataByFile: Map<string, ManagedBoundaryMetadata>;
+    config: SchemaGuardrailConfig;
+    fileDependencies: SchemaGraphFileDependencyEdge[];
+    managedSchemas: Set<string>;
+}): SchemaGraphFileNode[];
+export { parseCreateTriggerStatement, appendTriggerRef, extractCreateTriggers, buildDeclarativeFileRecord, collectDeclarativeClaims, createDuplicateTableOwners, buildFunctionValidationArtifacts, buildOwnerFileByTable, buildPolicyOwnershipConflicts, buildTableNodesByName, attachInboundForeignKeys, buildFileDependencies, normalizeTriggerFunctionToken, buildFileNodes, };
+//# sourceMappingURL=schema-guardrail-graph-nodes.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph-sql-helpers.d.ts

@@ -0,0 +1,31 @@
+/**
+ * AI HINT: Schema Guardrail Graph - SQL Helpers
+ *
+ * Purpose: SQL string sanitization, pattern matching, and metadata extraction
+ * for idempotent file analysis
+ */
+import { type SqlFile } from '../utils/declarative-dependency-sql-utils.js';
+import type { IdempotentTouchMetadata } from './schema-guardrail-graph-types.js';
+declare function normalizeSqlIdentifier(value: string): string;
+declare function consumeSingleQuotedLiteral(params: {
+    content: string;
+    startIndex: number;
+    prefixLength: number;
+}): {
+    blankedText: string;
+    nextIndex: number;
+};
+declare function blankSingleQuotedStrings(content: string): string;
+declare function blankDynamicExecuteLiterals(content: string): string;
+declare function sanitizeIdempotentTouchScanContent(content: string): string;
+declare function splitFunctionTargetList(value: string): string[];
+declare function normalizeFunctionTouchTarget(value: string): string | null;
+declare function extractTouchedSchemas(content: string): string[];
+declare function extractTouchedFunctions(content: string): string[];
+declare function normalizeExtensionIdentifier(identifier: string): string;
+declare function extractTouchedExtensions(content: string): string[];
+declare function extractTouchedPolicies(content: string): string[];
+declare function extractIdempotentTouchMetadata(file: SqlFile): IdempotentTouchMetadata;
+export declare function buildIdempotentTouchMetadata(files: SqlFile[]): Map<string, IdempotentTouchMetadata>;
+export { normalizeSqlIdentifier, consumeSingleQuotedLiteral, blankSingleQuotedStrings, blankDynamicExecuteLiterals, sanitizeIdempotentTouchScanContent, splitFunctionTargetList, normalizeFunctionTouchTarget, normalizeExtensionIdentifier, extractTouchedSchemas, extractTouchedFunctions, extractTouchedExtensions, extractTouchedPolicies, extractIdempotentTouchMetadata, };
+//# sourceMappingURL=schema-guardrail-graph-sql-helpers.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph-types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * AI HINT: Schema Guardrail Graph - Types & Constants
+ *
+ * Purpose: Shared types, constants, and tiny utility functions
+ * for the schema guardrail graph builder
+ */
+import type { SqlFile } from '../utils/declarative-dependency-sql-utils.js';
+import type { SchemaGraphManifest, SchemaGraphOutboundForeignKey, SchemaGraphPolicyClaim, SchemaGraphTriggerRef } from './schema-guardrail-types.js';
+export type PolicyCommand = 'all' | 'select' | 'insert' | 'update' | 'delete';
+export type IdempotentTouchMetadata = {
+    touchedSchemas: string[];
+    touchedExtensions: string[];
+    touchedFunctions: string[];
+    touchedPolicies: string[];
+};
+export type DefinedFunctionMetadata = {
+    qualifiedName: string;
+    qualifiedSignature: string;
+    securityDefiner: boolean;
+    searchPathLocked: boolean;
+    crossSchemaRefs: string[];
+};
+export type ManagedBoundaryMetadata = {
+    schemas: string[];
+    refs: string[];
+};
+export type DeclarativeFileRecord = {
+    file: SqlFile;
+    declaredSchemas: string[];
+    createSchemaClaims: string[];
+    tables: Array<{
+        schema: string;
+        name: string;
+        qualifiedName: string;
+        lineNumber?: number;
+        columns: string[];
+        outboundForeignKeys: SchemaGraphOutboundForeignKey[];
+    }>;
+    policies: SchemaGraphPolicyClaim[];
+    triggersByTable: Map<string, SchemaGraphTriggerRef[]>;
+};
+export declare const GENERATOR_VERSION = "1.0.0";
+export declare const SQL_IDENTIFIER_PATTERN: RegExp;
+export declare const SQL_EXTENSION_IDENTIFIER_PATTERN: RegExp;
+export declare const QUALIFIED_SQL_OBJECT_RE: RegExp;
+export declare const SECURITY_DEFINER_RE: RegExp;
+export declare const SEARCH_PATH_LOCK_RE: RegExp;
+export declare const MANAGED_BOUNDARY_SCHEMAS: readonly ["auth", "storage", "extensions", "net", "supabase_functions"];
+export declare const TRIGGER_GUIDANCE_SUPPRESSED_FUNCTIONS: Set<string>;
+export declare const MAX_SCHEMA_GUIDANCE_TARGETS_PER_FILE = 3;
+export declare function makeGraphVersion(graph: Omit<SchemaGraphManifest, 'graphVersion' | 'generatedAt'>): string;
+export declare function currentIsoTimestamp(): string;
+export declare function stableSorted<T>(values: Iterable<T>, map: (value: T) => string): T[];
+export declare function normalizeFileList(files: Iterable<string>): string[];
+export declare function normalizePolicyCommand(input: string): PolicyCommand;
+//# sourceMappingURL=schema-guardrail-graph-types.d.ts.map

package/dist/commands/db/sync/schema-guardrail-graph.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AI HINT: Schema Guardrail Graph - Orchestration
+ *
+ * Purpose: Main entry points for schema guardrail graph building
+ * Exports: loadSqlSources, buildStaticGraph, StaticGraphBuildResult
+ */
+import type { LoadedSqlSources, SchemaGraphManifest, SchemaGuardrailConfig, SchemaGuardrailReport } from './schema-guardrail-types.js';
+export declare function loadSqlSources(targetDir: string, config: SchemaGuardrailConfig): LoadedSqlSources;
+export type StaticGraphBuildResult = {
+    graph: SchemaGraphManifest;
+    duplicateTableOwners: SchemaGuardrailReport['duplicateTableOwners'];
+    duplicateFunctionOwners: SchemaGuardrailReport['duplicateFunctionOwners'];
+    policyOwnershipConflicts: SchemaGuardrailReport['policyOwnershipConflicts'];
+    semanticDuplicateWarnings: SchemaGuardrailReport['semanticDuplicateWarnings'];
+    boundaryGuidanceWarnings: SchemaGuardrailReport['boundaryGuidanceWarnings'];
+    localBlindSpotBlockers: SchemaGuardrailReport['localBlindSpotBlockers'];
+    multiFileSchemas: SchemaGuardrailReport['multiFileSchemas'];
+};
+export declare function buildStaticGraph(targetDir: string, config: SchemaGuardrailConfig, sources: LoadedSqlSources): Promise<StaticGraphBuildResult>;
+//# sourceMappingURL=schema-guardrail-graph.d.ts.map

package/dist/commands/db/sync/schema-guardrail-local-blockers.d.ts

@@ -0,0 +1,7 @@
+import type { LoadedSqlSources, LocalBlindSpotBlocker, SchemaGraphManifest } from './schema-guardrail-types.js';
+export declare function buildLocalBlindSpotBlockers(params: {
+    graph: SchemaGraphManifest;
+    sources: LoadedSqlSources;
+    managedSchemas: Set<string>;
+}): LocalBlindSpotBlocker[];
+//# sourceMappingURL=schema-guardrail-local-blockers.d.ts.map

package/dist/commands/db/sync/schema-guardrail-phases.d.ts

@@ -0,0 +1,26 @@
+import type { SchemaGuardrailReport } from './schema-guardrail-types.js';
+type GuardrailPhaseResult = {
+    id: string;
+    label: string;
+    status: 'passed' | 'warning' | 'failed';
+    warningCount?: number;
+    warnings?: Array<{
+        code: string;
+        message: string;
+        phase: string;
+        details?: Record<string, unknown>;
+    }>;
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+        phase: string;
+    };
+};
+export declare function isStaleBlocking(params: {
+    targetDir: string;
+    strictOption?: boolean;
+}): boolean;
+export declare function createGuardrailOutcomePhases(report: SchemaGuardrailReport): GuardrailPhaseResult[];
+export {};
+//# sourceMappingURL=schema-guardrail-phases.d.ts.map

package/dist/commands/db/sync/schema-guardrail-production-check.d.ts

@@ -0,0 +1,23 @@
+/**
+ * AI HINT: Post-sync Production DDL Order Check
+ *
+ * Purpose: After local db sync succeeds, generate a pg-schema-diff plan
+ * against production (if credentials available) and validate DDL ordering.
+ *
+ * This catches ALTER POLICY before CREATE FUNCTION issues that only appear
+ * in incremental diffs against an existing production database, not during
+ * fresh-DB local syncs.
+ *
+ * Requires: GH_DATABASE_URL_ADMIN or DATABASE_URL_ADMIN (production)
+ * If not available: silently skipped (local-only development is fine)
+ */
+interface ProductionCheckParams {
+    targetDir: string;
+    logger: {
+        info(message: string): void;
+        warn(message: string): void;
+    };
+}
+export declare function runProductionDdlOrderCheck(params: ProductionCheckParams): Promise<void>;
+export {};
+//# sourceMappingURL=schema-guardrail-production-check.d.ts.map

package/dist/commands/db/sync/schema-guardrail-rewrite.d.ts

@@ -0,0 +1,46 @@
+import type { SchemaGraphManifest, SchemaManagedBlockKind, SchemaGuardrailConfig, SchemaGuardrailReport, SchemaGuardrailStaticResult } from './schema-guardrail-types.js';
+type RenderedManagedBlock = {
+    kind: SchemaManagedBlockKind;
+    target: string;
+    content: string;
+};
+export type HeaderRewritePlan = {
+    filePath: string;
+    originalSql: string;
+    expectedFileBlock?: RenderedManagedBlock;
+    expectedTableHeaders: RenderedManagedBlock[];
+    staleBlocks: Array<{
+        file: string;
+        kind: SchemaManagedBlockKind;
+        target: string;
+    }>;
+    existingManagedCount: number;
+};
+export declare function loadHeaderRewritePlans(params: {
+    targetDir: string;
+    graph: SchemaGraphManifest;
+    config: SchemaGuardrailConfig;
+    report: SchemaGuardrailReport;
+}): {
+    staleBlocks: SchemaGuardrailReport['staleBlocks'];
+    rewritePlans: HeaderRewritePlan[];
+    failure?: undefined;
+} | {
+    staleBlocks?: undefined;
+    rewritePlans?: undefined;
+    failure: SchemaGuardrailStaticResult;
+};
+export declare function finalizeCheckModeReport(params: {
+    report: SchemaGuardrailReport;
+    graph: SchemaGraphManifest;
+    staleBlocks: SchemaGuardrailReport['staleBlocks'];
+    targetDir: string;
+    strictOption?: boolean;
+}): SchemaGuardrailStaticResult;
+export declare function rewriteManagedHeaders(params: {
+    targetDir: string;
+    rewritePlans: HeaderRewritePlan[];
+    report: SchemaGuardrailReport;
+}): SchemaGuardrailStaticResult | null;
+export {};
+//# sourceMappingURL=schema-guardrail-rewrite.d.ts.map

package/dist/commands/db/sync/schema-guardrail-runtime.d.ts

@@ -0,0 +1,5 @@
+import type { TablesManifest } from '@runa-ai/runa/manifests';
+import type { SchemaGuardrailReport, SchemaGuardrailRuntimeInput } from './schema-guardrail-types.js';
+export declare function loadRuntimeTablesManifest(targetDir: string): TablesManifest | null;
+export declare function runSchemaGuardrailRuntime(input: SchemaGuardrailRuntimeInput): SchemaGuardrailReport;
+//# sourceMappingURL=schema-guardrail-runtime.d.ts.map

package/dist/commands/db/sync/schema-guardrail-semantic-warnings.d.ts

@@ -0,0 +1,9 @@
+import type { TablesManifest } from '@runa-ai/runa/manifests';
+import type { SchemaGraphManifest, SchemaGuardrailConfig, SemanticDuplicateWarning } from './schema-guardrail-types.js';
+export declare function createSemanticWarningDetails(warning: SemanticDuplicateWarning): Record<string, unknown>;
+export declare function buildSemanticDuplicateWarnings(params: {
+    graph: SchemaGraphManifest;
+    runtimeTables: TablesManifest | null;
+    config: SchemaGuardrailConfig;
+}): SemanticDuplicateWarning[];
+//# sourceMappingURL=schema-guardrail-semantic-warnings.d.ts.map

package/dist/commands/db/sync/schema-guardrail-types.d.ts

@@ -0,0 +1,243 @@
+import type { SqlFile } from '../utils/declarative-dependency-sql-utils.js';
+export type SchemaManagedBlockKind = 'file-header' | 'table-header';
+export type SchemaGuardrailMode = 'check' | 'sync';
+export type SchemaGraphFileLayer = 'declarative' | 'idempotent';
+export type SchemaGraphFileAuthoringRole = 'declarative-owner' | 'operational';
+export type BoundaryGuidanceWarningKind = 'schema' | 'function' | 'policy' | 'security_definer' | 'trigger_function' | 'managed_boundary';
+export type LocalBlindSpotBlockerKind = 'cross-schema-rls' | 'dynamic-sql' | 'extension-placement';
+export type SchemaGuardrailPhaseId = 'load_sources' | 'build_static_graph' | 'validate_ownership' | 'compare_generated_headers' | 'refresh_generated_headers' | 'handoff_db_sync' | 'runtime_reconcile' | 'publish_report';
+export type SchemaGuardrailFailureCode = 'source_load_failed' | 'duplicate_table_owner' | 'duplicate_function_owner' | 'policy_ownership_conflict' | 'raw_cross_schema_rls_blocked' | 'dynamic_sql_blocked' | 'extension_placement_blocked' | 'stale_generated_header' | 'generated_header_validation_failed' | 'generated_header_rewrite_failed' | 'static_graph_build_failed' | 'critical_runtime_graph_contradiction' | 'sync_apply_failed';
+export interface SchemaGraphFileNode {
+    path: string;
+    sourceLayer: SchemaGraphFileLayer;
+    authoringRole: SchemaGraphFileAuthoringRole;
+    domainName?: string;
+    declaredSchemas: string[];
+    ownedTables: string[];
+    forwardDependsOnFiles: string[];
+    definedFunctions: string[];
+    securityDefinerFunctions: string[];
+    securityDefinerContracts: string[];
+    triggerFunctions: string[];
+    functionCrossSchemaRefs: string[];
+    managedBoundarySchemas: string[];
+    managedBoundaryRefs: string[];
+    touchedSchemas: string[];
+    touchedExtensions: string[];
+    touchedFunctions: string[];
+    touchedPolicies: string[];
+    policyCrossSchemaRefs: string[];
+    preferredEditSurface?: string;
+    idempotentPurpose?: string;
+}
+export interface SchemaGraphSchemaNode {
+    name: string;
+    claimFiles: string[];
+    createSchemaFiles?: string[];
+}
+export interface SchemaGraphOutboundForeignKey {
+    column: string;
+    referencesTable: string;
+    referencesColumn: string;
+    onDelete?: 'CASCADE' | 'SET NULL' | 'SET DEFAULT' | 'RESTRICT' | 'NO ACTION';
+    onUpdate?: 'CASCADE' | 'SET NULL' | 'SET DEFAULT' | 'RESTRICT' | 'NO ACTION';
+}
+export interface SchemaGraphInboundForeignKey {
+    fromTable: string;
+    fromColumn: string;
+    toColumn: string;
+    onDelete?: 'CASCADE' | 'SET NULL' | 'SET DEFAULT' | 'RESTRICT' | 'NO ACTION';
+    onUpdate?: 'CASCADE' | 'SET NULL' | 'SET DEFAULT' | 'RESTRICT' | 'NO ACTION';
+}
+export interface SchemaGraphPolicyRef {
+    name: string;
+    command: 'all' | 'select' | 'insert' | 'update' | 'delete';
+}
+export interface SchemaGraphTriggerRef {
+    name: string;
+    timing: 'BEFORE' | 'AFTER' | 'INSTEAD OF';
+    event: string;
+    functionName?: string;
+}
+export interface SchemaGraphTableNode {
+    schema: string;
+    name: string;
+    qualifiedName: string;
+    ownerFile: string;
+    lineNumber?: number;
+    columns: string[];
+    outboundForeignKeys: SchemaGraphOutboundForeignKey[];
+    inboundForeignKeys: SchemaGraphInboundForeignKey[];
+    policies: SchemaGraphPolicyRef[];
+    triggers: SchemaGraphTriggerRef[];
+}
+export interface SchemaGraphFunctionClaim {
+    qualifiedName: string;
+    signature: string;
+    sourceLayer: 'declarative' | 'idempotent';
+    sourceFile: string;
+    lineNumber?: number;
+    bodyHash?: string;
+}
+export interface SchemaGraphPolicyClaim {
+    name: string;
+    targetTable: string;
+    command: 'all' | 'select' | 'insert' | 'update' | 'delete';
+    sourceFile: string;
+    lineNumber?: number;
+}
+export interface SchemaGraphFileDependencyEdge {
+    fromFile: string;
+    toFile: string;
+    viaTables: string[];
+}
+export interface SchemaGraphManifest {
+    version: 1;
+    source: 'declarative-sql-ast';
+    generatedAt: string;
+    generatorVersion: string;
+    graphVersion: string;
+    files: SchemaGraphFileNode[];
+    schemas: SchemaGraphSchemaNode[];
+    tables: SchemaGraphTableNode[];
+    functionClaims: SchemaGraphFunctionClaim[];
+    policyClaims: SchemaGraphPolicyClaim[];
+    fileDependencies: SchemaGraphFileDependencyEdge[];
+}
+export interface RuntimeWarningIssue {
+    code: 'RUNTIME_EXTRA_TABLE';
+    target: string;
+    details: string;
+}
+export interface RuntimeContradictionIssue {
+    code: 'RUNTIME_TABLE_MISSING' | 'RUNTIME_FK_MISMATCH' | 'RUNTIME_POLICY_MISMATCH' | 'RUNTIME_TRIGGER_MISMATCH';
+    target: string;
+    details: string;
+}
+export interface SemanticDuplicateEvidence {
+    nameSimilarity: number;
+    sharedColumns: string[];
+    sharedFkNeighborhood: string[];
+    sameSchemaAffinity: boolean;
+}
+export interface SemanticDuplicateCandidate {
+    qualifiedName: string;
+    ownerFile: string;
+    score: number;
+    evidence: SemanticDuplicateEvidence;
+}
+export interface SemanticDuplicateWarning {
+    proposedTable: string;
+    ownerFile: string;
+    candidates: SemanticDuplicateCandidate[];
+    score: number;
+    evidence: SemanticDuplicateEvidence;
+    suggestedNextFile?: string;
+    suppressionKey: string;
+}
+export interface BoundaryGuidanceWarning {
+    sourceFile: string;
+    kind: BoundaryGuidanceWarningKind;
+    target: string;
+    suggestedDeclarativeFile?: string;
+    suggestedIdempotentFile?: string;
+    suggestedHelperFunction?: string;
+    reason: string;
+}
+export interface LocalBlindSpotBlocker {
+    kind: LocalBlindSpotBlockerKind;
+    sourceFile: string;
+    line?: number;
+    target: string;
+    details: string;
+    suggestedDeclarativeFile?: string;
+    suggestedHelper?: string;
+    requiredFile?: string;
+}
+export interface SchemaGuardrailReport {
+    mode: SchemaGuardrailMode;
+    exitMode: 'success' | 'success_with_warnings' | 'failed';
+    graphVersion?: string;
+    parser: {
+        engine: 'ast';
+        available: boolean;
+    };
+    multiFileSchemas: Array<{
+        schema: string;
+        files: string[];
+    }>;
+    duplicateTableOwners: Array<{
+        qualifiedName: string;
+        files: string[];
+    }>;
+    duplicateFunctionOwners: Array<{
+        qualifiedName: string;
+        signature: string | null;
+        declarativeFiles: string[];
+        idempotentFiles: string[];
+    }>;
+    policyOwnershipConflicts: Array<{
+        policyName: string;
+        targetTable: string;
+        files: string[];
+        tableOwnerFile: string;
+    }>;
+    semanticDuplicateWarnings: SemanticDuplicateWarning[];
+    boundaryGuidanceWarnings: BoundaryGuidanceWarning[];
+    localBlindSpotBlockers: LocalBlindSpotBlocker[];
+    staleBlocks: Array<{
+        file: string;
+        kind: SchemaManagedBlockKind;
+        target: string;
+    }>;
+    headersRewritten: string[];
+    rewritesRetainedOnDisk: boolean;
+    applyCommitted: boolean;
+    runtimeWarnings: RuntimeWarningIssue[];
+    runtimeContradictions: RuntimeContradictionIssue[];
+    failure?: {
+        phase: SchemaGuardrailPhaseId;
+        code: SchemaGuardrailFailureCode;
+        message: string;
+    };
+}
+export interface SchemaGuardrailStaticInput {
+    targetDir: string;
+    mode: SchemaGuardrailMode;
+    strictOption?: boolean;
+    enableLocalBlindSpotBlockers?: boolean;
+}
+export interface SchemaGuardrailStaticResult {
+    graph: SchemaGraphManifest | null;
+    report: SchemaGuardrailReport;
+}
+export interface SchemaGuardrailRuntimeInput {
+    targetDir: string;
+    graph: SchemaGraphManifest;
+    report: SchemaGuardrailReport;
+}
+export type SchemaGuardrailConfig = {
+    declarativeSqlDir: string;
+    allowedDuplicateFunctions: Array<{
+        qualifiedName: string;
+        signature: string;
+        reason: string;
+        declarativeFile?: string;
+        idempotentFile?: string;
+        expectedBodyHash?: string;
+    }>;
+    generatedHeaderRewriteTargets: string[];
+    semanticWarnings: {
+        threshold: number;
+        maxCandidates: number;
+        ignorePairs: Set<string>;
+    };
+    tableHeaderMaxWidth: number;
+    excludeFromOrphanDetection: string[];
+    idempotentSqlDir: string;
+};
+export type LoadedSqlSources = {
+    declarativeFiles: SqlFile[];
+    idempotentFiles: SqlFile[];
+};
+//# sourceMappingURL=schema-guardrail-types.d.ts.map