@runa-ai/runa-cli 0.8.0 → 0.9.0

package/dist/commands/ci/machine/machine.d.ts

@@ -9,16 +9,16 @@
  * 2. [ci-local] setup → dbReset → pullProduction? → syncSchema → applySeeds
  *              → productionPreview → collectSchemaStats → installPgTap → runCoreTests → done
  * 3. [ci-pr] setup → initialComment → syncSchema → applySeeds → postSeedPr
- *           execution: setupRoles → staticChecks → buildAndPlaywright → appStart
- *                    → capabilities → runCoreTests → e2ePhase → finalize → done
+ *           execution: setupRoles → staticChecks → layerContent → buildAndPlaywright
+ *                    → appStart → capabilities → runCoreTests → e2ePhase → finalize → done
  *           observability: productionPreview ∥ collectSchemaStats
  *
  * State Flow (detailed):
  *   idle → setup → initialComment? → dbReset? → pullProduction? → syncSchema → applySeeds
  *     → productionPreview → collectSchemaStats → decidePath
  *     → [ci-local] → installPgTap → runCoreTests → done
- *     → [ci-pr]    → setupRoles → staticChecks → buildAndPlaywright → appStart
- *                  → capabilities → runCoreTests → coreTestsComplete
+ *     → [ci-pr]    → setupRoles → staticChecks → layerContent → buildAndPlaywright
+ *                  → appStart → capabilities → runCoreTests → coreTestsComplete
  *                  → e2ePhase (parallel: intermediateComment || e2eTests)
  *                  → finalize → done
  *
@@ -45,21 +45,31 @@
  * - failed → expect(exitCode).toBe(1)
  */
 import { type SnapshotFrom } from 'xstate';
+import { type SetupRolesOutput } from './actors/db/index.js';
+import { type CapabilitiesOutput, type LayerContentOutput, type RunLayersOutput } from './actors/test/index.js';
 import type { CiContext, CiEvent } from './types.js';
 export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent, {
-    [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").StaticChecksOutput, import("./index.js").StaticChecksInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").CapabilitiesOutput, import("./index.js").CapabilitiesInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").AppStartOutput, import("./index.js").AppStartInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").PlaywrightInstallOutput, import("./index.js").PlaywrightInstallInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").SyncSchemaOutput, import("./index.js").SyncSchemaInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ApplySeedsOutput, import("./index.js").ApplySeedsInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ProductionPreviewOutput, import("./index.js").ProductionPreviewInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup/local.js").LocalSetupOutput, import("./actors/setup/local.js").LocalSetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup/pr-local.js").PrLocalSetupOutput, import("./actors/setup/pr-local.js").PrLocalSetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ResetDbOutput, import("./index.js").ResetDbInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").PullProductionOutput, import("./index.js").PullProductionInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").CollectSchemaStatsOutput, import("./index.js").CollectSchemaStatsInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").SetupRolesOutput, import("./index.js").SetupRolesInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").InstallPgTapOutput, import("./index.js").InstallPgTapInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").AppBuildOutput, import("./index.js").AppBuildInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").BuildAndPlaywrightOutput, import("./index.js").BuildAndPlaywrightInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").RunLayersOutput, import("./index.js").RunLayersInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").UpsertCommentOutput, import("./index.js").UpsertCommentInput, import("xstate").EventObject>> | undefined;
+    [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").StaticChecksOutput, import("./index.js").StaticChecksInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<CapabilitiesOutput, import("./index.js").CapabilitiesInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").AppStartOutput, import("./index.js").AppStartInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ApplySeedsOutput, import("./index.js").ApplySeedsInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<LayerContentOutput, import("./index.js").LayerContentInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").PlaywrightInstallOutput, import("./index.js").PlaywrightInstallInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").SyncSchemaOutput, import("./index.js").SyncSchemaInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ProductionPreviewOutput, import("./index.js").ProductionPreviewInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup/local.js").LocalSetupOutput, import("./actors/setup/local.js").LocalSetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup/pr-local.js").PrLocalSetupOutput, import("./actors/setup/pr-local.js").PrLocalSetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").ResetDbOutput, import("./index.js").ResetDbInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").PullProductionOutput, import("./index.js").PullProductionInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").CollectSchemaStatsOutput, import("./index.js").CollectSchemaStatsInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<SetupRolesOutput, import("./index.js").SetupRolesInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").InstallPgTapOutput, import("./index.js").InstallPgTapInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").AppBuildOutput, import("./index.js").AppBuildInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").BuildAndPlaywrightOutput, import("./index.js").BuildAndPlaywrightInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<RunLayersOutput, import("./index.js").RunLayersInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./index.js").UpsertCommentOutput, import("./index.js").UpsertCommentInput, import("xstate").EventObject>> | undefined;
 }, {
     src: "staticChecks";
     logic: import("xstate").PromiseActorLogic<import("./index.js").StaticChecksOutput, import("./index.js").StaticChecksInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
     src: "capabilities";
-    logic: import("xstate").PromiseActorLogic<import("./index.js").CapabilitiesOutput, import("./index.js").CapabilitiesInput, import("xstate").EventObject>;
+    logic: import("xstate").PromiseActorLogic<CapabilitiesOutput, import("./index.js").CapabilitiesInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
     src: "appStart";
     logic: import("xstate").PromiseActorLogic<import("./index.js").AppStartOutput, import("./index.js").AppStartInput, import("xstate").EventObject>;
     id: string | undefined;
+} | {
+    src: "applySeeds";
+    logic: import("xstate").PromiseActorLogic<import("./index.js").ApplySeedsOutput, import("./index.js").ApplySeedsInput, import("xstate").EventObject>;
+    id: string | undefined;
+} | {
+    src: "layerContent";
+    logic: import("xstate").PromiseActorLogic<LayerContentOutput, import("./index.js").LayerContentInput, import("xstate").EventObject>;
+    id: string | undefined;
 } | {
     src: "playwrightInstall";
     logic: import("xstate").PromiseActorLogic<import("./index.js").PlaywrightInstallOutput, import("./index.js").PlaywrightInstallInput, import("xstate").EventObject>;
@@ -68,10 +78,6 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     src: "syncSchema";
     logic: import("xstate").PromiseActorLogic<import("./index.js").SyncSchemaOutput, import("./index.js").SyncSchemaInput, import("xstate").EventObject>;
     id: string | undefined;
-} | {
-    src: "applySeeds";
-    logic: import("xstate").PromiseActorLogic<import("./index.js").ApplySeedsOutput, import("./index.js").ApplySeedsInput, import("xstate").EventObject>;
-    id: string | undefined;
 } | {
     src: "productionPreview";
     logic: import("xstate").PromiseActorLogic<import("./index.js").ProductionPreviewOutput, import("./index.js").ProductionPreviewInput, import("xstate").EventObject>;
@@ -98,7 +104,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     id: string | undefined;
 } | {
     src: "setupRoles";
-    logic: import("xstate").PromiseActorLogic<import("./index.js").SetupRolesOutput, import("./index.js").SetupRolesInput, import("xstate").EventObject>;
+    logic: import("xstate").PromiseActorLogic<SetupRolesOutput, import("./index.js").SetupRolesInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
     src: "installPgTap";
@@ -114,7 +120,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     id: string | undefined;
 } | {
     src: "runLayers";
-    logic: import("xstate").PromiseActorLogic<import("./index.js").RunLayersOutput, import("./index.js").RunLayersInput, import("xstate").EventObject>;
+    logic: import("xstate").PromiseActorLogic<RunLayersOutput, import("./index.js").RunLayersInput, import("xstate").EventObject>;
     id: string | undefined;
 } | {
     src: "upsertComment";
@@ -171,14 +177,14 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
 } | {
     type: "allTestsPassed";
     params: unknown;
-}, never, "done" | "failed" | "staticChecks" | "idle" | "capabilities" | "appStart" | "syncSchema" | "applySeeds" | "productionPreview" | "pullProduction" | "collectSchemaStats" | "setupRoles" | "installPgTap" | "buildAndPlaywright" | "initialComment" | "dbReset" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | "decidePath" | {
+}, never, "done" | "failed" | "staticChecks" | "idle" | "capabilities" | "appStart" | "applySeeds" | "layerContent" | "syncSchema" | "productionPreview" | "pullProduction" | "collectSchemaStats" | "setupRoles" | "installPgTap" | "buildAndPlaywright" | "initialComment" | "dbReset" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | "decidePath" | {
     setup: "local" | "resolving" | "prLocal" | "complete";
 } | {
     finalize: "complete" | "writeSummary" | "postComment";
 } | {
     postSeedPr: {
         observability: "done" | "productionPreview" | "collectSchemaStats" | "gate";
-        execution: "done" | "failed" | "staticChecks" | "capabilities" | "appStart" | "setupRoles" | "buildAndPlaywright" | "gate" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
+        execution: "done" | "failed" | "staticChecks" | "capabilities" | "appStart" | "layerContent" | "setupRoles" | "buildAndPlaywright" | "gate" | "runCoreTests" | "coreTestsFailed" | "coreTestsComplete" | {
             e2ePhase: {
                 intermediateComment: "done" | "checking" | "posting";
                 e2eTests: "done" | "running";
@@ -231,6 +237,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     playwrightWorkers?: string | undefined;
     skipGithubComment?: boolean | undefined;
     layers?: number[] | undefined;
+    internalProfile?: "schema-only" | undefined;
 }, {
     mode: "ci-local" | "ci-pr-local";
     status: "success" | "timeout" | "failure" | "cancelled";
@@ -288,6 +295,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
                         readonly gate: {};
                         readonly setupRoles: {};
                         readonly staticChecks: {};
+                        readonly layerContent: {};
                         readonly buildAndPlaywright: {};
                         readonly appStart: {};
                         readonly capabilities: {};
@@ -331,6 +339,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
         readonly installPgTap: {};
         readonly setupRoles: {};
         readonly staticChecks: {};
+        readonly layerContent: {};
         readonly buildAndPlaywright: {};
         readonly appStart: {};
         readonly capabilities: {};
@@ -367,20 +376,5 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
 }>;
 export type CiMachine = typeof ciMachine;
 export type CiSnapshot = SnapshotFrom<typeof ciMachine>;
-/**
- * Get current state name from snapshot.
- */
-export declare function getStateName(snapshot: CiSnapshot): string;
-/**
- * Check if machine is in a final state.
- */
-export declare function isComplete(snapshot: CiSnapshot): boolean;
-/**
- * Get error message from snapshot.
- */
-export declare function getError(snapshot: CiSnapshot): string | null;
-/**
- * Get exit code from snapshot.
- */
-export declare function getExitCode(snapshot: CiSnapshot): 0 | 1 | 2;
+export { getError, getExitCode, getStateName, isComplete } from './selectors.js';
 //# sourceMappingURL=machine.d.ts.map

package/dist/commands/ci/machine/selectors.d.ts

@@ -0,0 +1,6 @@
+import type { CiSnapshot } from './machine.js';
+export declare function getStateName(snapshot: CiSnapshot): string;
+export declare function isComplete(snapshot: CiSnapshot): boolean;
+export declare function getError(snapshot: CiSnapshot): string | null;
+export declare function getExitCode(snapshot: CiSnapshot): 0 | 1 | 2;
+//# sourceMappingURL=selectors.d.ts.map

package/dist/commands/ci/machine/types.d.ts

@@ -107,13 +107,15 @@ export interface HazardDetail {
     severity: 'critical' | 'warning' | 'info';
 }
 /**
- * Production schema preview (dry-run result from `runa db apply production --check`).
+ * Production schema preview (dry-run result from `runa db preview production`).
  *
  * Used for PR comments to show what SQL will be applied to production.
  */
 export interface ProductionPreview {
     /** Whether the dry-run was executed */
     executed: boolean;
+    /** Preview profile used to generate this result */
+    profile?: 'compare-only' | 'full' | null;
     /** SQL that would be applied to production */
     planSql: string | null;
     /** Hazards detected by pg-schema-diff (simple string format) */

package/dist/commands/ci/utils/ci-logging.d.ts

@@ -1,8 +1,24 @@
 /**
  * AI HINT: CI logging helpers (human + AI readable)
  *
+ * Purpose: Structured logging for CI operations
+ * Pattern: All output goes to stderr (stdout reserved for JSON contract mode)
+ *
  * Keep sections consistent to make logs scannable.
  */
+export interface CILogger {
+    debug(message: string): void;
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+/**
+ * Create a CI-specific logger that writes to stderr.
+ * Prefixes all messages with [prefix] for easy filtering.
+ *
+ * Debug messages are only emitted when RUNA_DEBUG=true.
+ */
+export declare function createCILogger(prefix: string): CILogger;
 export declare function logSection(title: string): void;
 export declare function logKeyValueTable(params: {
     title: string;

package/dist/commands/ci/utils/rls-verification.d.ts

@@ -12,6 +12,7 @@
  * Security (Issue #458):
  * - Uses getSafeEnv() to avoid passing secrets to child processes
  */
+import { type CILogger } from './ci-logging.js';
 export interface QueryScalarParams {
     repoRoot: string;
     tmpDir: string;
@@ -41,7 +42,7 @@ export interface VerifyRlsAlignmentParams {
  *
  * @param params - Verification parameters
  */
-export declare function verifyDbRlsRoleAlignment(params: VerifyRlsAlignmentParams): Promise<void>;
+export declare function verifyDbRlsRoleAlignment(params: VerifyRlsAlignmentParams, logger?: CILogger): Promise<void>;
 export interface VerifyServiceTestParams {
     repoRoot: string;
     tmpDir: string;
@@ -59,7 +60,7 @@ export interface VerifyServiceTestParams {
  *
  * @param params - Verification parameters
  */
-export declare function verifyServiceTestPrerequisites(params: VerifyServiceTestParams): Promise<void>;
+export declare function verifyServiceTestPrerequisites(params: VerifyServiceTestParams, logger?: CILogger): Promise<void>;
 export interface VerifyPgTapAccessParams {
     repoRoot: string;
     tmpDir: string;

package/dist/commands/db/apply/actors/pg-schema-diff-actors.d.ts

@@ -15,6 +15,7 @@ export type { PgSchemaDiffResult } from '../helpers/fresh-db-handler.js';
 export declare const applyPgSchemaDiff: import("xstate").PromiseActorLogic<PgSchemaDiffResult, {
     input: DbApplyInput;
     targetDir: string;
+    preIdempotentTargetFingerprint?: string | null;
 }, import("xstate").EventObject>;
 /**
  * Validate that expected partitions (from idempotent/*.sql) exist in the database.

package/dist/commands/db/apply/contract.d.ts

@@ -10,6 +10,26 @@
  * - Same logic for all environments (local, Branch DB, production)
  */
 import { z } from 'zod';
+export declare const DbPreviewProfileSchema: z.ZodEnum<{
+    full: "full";
+    "compare-only": "compare-only";
+}>;
+export type DbPreviewProfile = z.infer<typeof DbPreviewProfileSchema>;
+export declare const DbApplyPlanSourceSchema: z.ZodEnum<{
+    inline: "inline";
+    artifact: "artifact";
+}>;
+export type DbApplyPlanSource = z.infer<typeof DbApplyPlanSourceSchema>;
+export declare const DbApplyPlannerReuseReasonSchema: z.ZodEnum<{
+    artifact_missing: "artifact_missing";
+    artifact_invalid: "artifact_invalid";
+    profile_ineligible: "profile_ineligible";
+    source_fingerprint_mismatch: "source_fingerprint_mismatch";
+    target_fingerprint_unavailable: "target_fingerprint_unavailable";
+    target_fingerprint_mismatch: "target_fingerprint_mismatch";
+    tool_version_mismatch: "tool_version_mismatch";
+}>;
+export type DbApplyPlannerReuseReason = z.infer<typeof DbApplyPlannerReuseReasonSchema>;
 export declare const DbApplyInputSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodEnum<{
         local: "local";
@@ -28,6 +48,8 @@ export declare const DbApplyInputSchema: z.ZodObject<{
     compareOnly: z.ZodDefault<z.ZodBoolean>;
     maxLockWaitMs: z.ZodDefault<z.ZodNumber>;
     freshDbCheckSql: z.ZodOptional<z.ZodString>;
+    plannerArtifactPath: z.ZodOptional<z.ZodString>;
+    plannerArtifactRequired: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
 export type DbApplyInput = z.infer<typeof DbApplyInputSchema>;
 /**
@@ -39,6 +61,7 @@ export declare const DbApplyMetricsSchema: z.ZodObject<{
     applyMs: z.ZodOptional<z.ZodNumber>;
     seedMs: z.ZodOptional<z.ZodNumber>;
     retryAttempts: z.ZodOptional<z.ZodNumber>;
+    retryWaitMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type DbApplyMetrics = z.infer<typeof DbApplyMetricsSchema>;
 export declare const DbApplyPlanSummarySchema: z.ZodObject<{
@@ -53,6 +76,29 @@ export declare const DbApplyPlanSummarySchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type DbApplyPlanSummary = z.infer<typeof DbApplyPlanSummarySchema>;
+export declare const DbApplyPlannerSchema: z.ZodObject<{
+    source: z.ZodEnum<{
+        inline: "inline";
+        artifact: "artifact";
+    }>;
+    path: z.ZodOptional<z.ZodString>;
+    reuseAttempted: z.ZodOptional<z.ZodBoolean>;
+    reuseReason: z.ZodOptional<z.ZodEnum<{
+        artifact_missing: "artifact_missing";
+        artifact_invalid: "artifact_invalid";
+        profile_ineligible: "profile_ineligible";
+        source_fingerprint_mismatch: "source_fingerprint_mismatch";
+        target_fingerprint_unavailable: "target_fingerprint_unavailable";
+        target_fingerprint_mismatch: "target_fingerprint_mismatch";
+        tool_version_mismatch: "tool_version_mismatch";
+    }>>;
+    reuseMessage: z.ZodOptional<z.ZodString>;
+    sourceFingerprint: z.ZodOptional<z.ZodString>;
+    targetFingerprint: z.ZodOptional<z.ZodString>;
+    targetFingerprintMatched: z.ZodOptional<z.ZodBoolean>;
+    hasChanges: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type DbApplyPlanner = z.infer<typeof DbApplyPlannerSchema>;
 export declare const DbApplyOutputSchema: z.ZodObject<{
     success: z.ZodBoolean;
     idempotentSchemasApplied: z.ZodNumber;
@@ -76,6 +122,10 @@ export declare const DbApplyOutputSchema: z.ZodObject<{
         }, z.core.$strict>;
     }, z.core.$strict>>;
     checkOnly: z.ZodOptional<z.ZodBoolean>;
+    previewProfile: z.ZodOptional<z.ZodEnum<{
+        full: "full";
+        "compare-only": "compare-only";
+    }>>;
     dataViolations: z.ZodOptional<z.ZodNumber>;
     ssotWarning: z.ZodOptional<z.ZodString>;
     partitionWarnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -91,7 +141,30 @@ export declare const DbApplyOutputSchema: z.ZodObject<{
         applyMs: z.ZodOptional<z.ZodNumber>;
         seedMs: z.ZodOptional<z.ZodNumber>;
         retryAttempts: z.ZodOptional<z.ZodNumber>;
+        retryWaitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    planner: z.ZodOptional<z.ZodObject<{
+        source: z.ZodEnum<{
+            inline: "inline";
+            artifact: "artifact";
+        }>;
+        path: z.ZodOptional<z.ZodString>;
+        reuseAttempted: z.ZodOptional<z.ZodBoolean>;
+        reuseReason: z.ZodOptional<z.ZodEnum<{
+            artifact_missing: "artifact_missing";
+            artifact_invalid: "artifact_invalid";
+            profile_ineligible: "profile_ineligible";
+            source_fingerprint_mismatch: "source_fingerprint_mismatch";
+            target_fingerprint_unavailable: "target_fingerprint_unavailable";
+            target_fingerprint_mismatch: "target_fingerprint_mismatch";
+            tool_version_mismatch: "tool_version_mismatch";
+        }>>;
+        reuseMessage: z.ZodOptional<z.ZodString>;
+        sourceFingerprint: z.ZodOptional<z.ZodString>;
+        targetFingerprint: z.ZodOptional<z.ZodString>;
+        targetFingerprintMatched: z.ZodOptional<z.ZodBoolean>;
+        hasChanges: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
     outcome: z.ZodObject<{
         command: z.ZodString;
         exitMode: z.ZodEnum<{
@@ -165,4 +238,140 @@ export declare const DbApplyOutputSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type DbApplyOutput = z.infer<typeof DbApplyOutputSchema>;
+export declare const DbPlanOutputSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    idempotentSchemasApplied: z.ZodNumber;
+    idempotentSchemasSkipped: z.ZodOptional<z.ZodNumber>;
+    rolePasswordsSet: z.ZodOptional<z.ZodNumber>;
+    schemaChangesApplied: z.ZodBoolean;
+    hazards: z.ZodArray<z.ZodString>;
+    seedsApplied: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    planSql: z.ZodOptional<z.ZodString>;
+    filteredPlanSql: z.ZodOptional<z.ZodString>;
+    planSummary: z.ZodOptional<z.ZodObject<{
+        rawStatements: z.ZodNumber;
+        effectiveStatements: z.ZodNumber;
+        noiseStatements: z.ZodNumber;
+        categories: z.ZodObject<{
+            idempotentDrop: z.ZodNumber;
+            idempotentAuthz: z.ZodNumber;
+            idempotentRls: z.ZodNumber;
+            suppressedFunction: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    dataViolations: z.ZodOptional<z.ZodNumber>;
+    ssotWarning: z.ZodOptional<z.ZodString>;
+    partitionWarnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    idempotentFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    idempotentRisks: z.ZodOptional<z.ZodObject<{
+        high: z.ZodNumber;
+        medium: z.ZodNumber;
+        low: z.ZodNumber;
+    }, z.core.$strip>>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        totalMs: z.ZodNumber;
+        idempotentMs: z.ZodOptional<z.ZodNumber>;
+        applyMs: z.ZodOptional<z.ZodNumber>;
+        seedMs: z.ZodOptional<z.ZodNumber>;
+        retryAttempts: z.ZodOptional<z.ZodNumber>;
+        retryWaitMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    outcome: z.ZodObject<{
+        command: z.ZodString;
+        exitMode: z.ZodEnum<{
+            success: "success";
+            success_with_warnings: "success_with_warnings";
+            failed: "failed";
+            timeout: "timeout";
+            cancelled: "cancelled";
+        }>;
+        startedAt: z.ZodString;
+        endedAt: z.ZodString;
+        durationMs: z.ZodNumber;
+        phases: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            status: z.ZodEnum<{
+                failed: "failed";
+                timeout: "timeout";
+                cancelled: "cancelled";
+                pending: "pending";
+                running: "running";
+                passed: "passed";
+                warning: "warning";
+                skipped: "skipped";
+            }>;
+            startedAt: z.ZodOptional<z.ZodString>;
+            endedAt: z.ZodOptional<z.ZodString>;
+            durationMs: z.ZodOptional<z.ZodNumber>;
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+            warningCount: z.ZodOptional<z.ZodNumber>;
+            error: z.ZodOptional<z.ZodObject<{
+                code: z.ZodString;
+                message: z.ZodString;
+                statusCode: z.ZodOptional<z.ZodNumber>;
+                retryable: z.ZodBoolean;
+                retryAfterMs: z.ZodOptional<z.ZodNumber>;
+                phase: z.ZodOptional<z.ZodString>;
+                details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>;
+            warnings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                code: z.ZodString;
+                message: z.ZodString;
+                phase: z.ZodString;
+                details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>>>;
+            metrics: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        }, z.core.$strict>>;
+        warnings: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+            phase: z.ZodString;
+            details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        errors: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+            statusCode: z.ZodOptional<z.ZodNumber>;
+            retryable: z.ZodBoolean;
+            retryAfterMs: z.ZodOptional<z.ZodNumber>;
+            phase: z.ZodOptional<z.ZodString>;
+            details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        summary: z.ZodObject<{
+            passed: z.ZodNumber;
+            warnings: z.ZodNumber;
+            failed: z.ZodNumber;
+            skipped: z.ZodNumber;
+            timedOut: z.ZodNumber;
+        }, z.core.$strict>;
+        nextActions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    checkOnly: z.ZodLiteral<true>;
+    previewProfile: z.ZodLiteral<"full">;
+    planner: z.ZodObject<{
+        source: z.ZodEnum<{
+            inline: "inline";
+            artifact: "artifact";
+        }>;
+        reuseAttempted: z.ZodOptional<z.ZodBoolean>;
+        reuseReason: z.ZodOptional<z.ZodEnum<{
+            artifact_missing: "artifact_missing";
+            artifact_invalid: "artifact_invalid";
+            profile_ineligible: "profile_ineligible";
+            source_fingerprint_mismatch: "source_fingerprint_mismatch";
+            target_fingerprint_unavailable: "target_fingerprint_unavailable";
+            target_fingerprint_mismatch: "target_fingerprint_mismatch";
+            tool_version_mismatch: "tool_version_mismatch";
+        }>>;
+        reuseMessage: z.ZodOptional<z.ZodString>;
+        targetFingerprintMatched: z.ZodOptional<z.ZodBoolean>;
+        hasChanges: z.ZodOptional<z.ZodBoolean>;
+        path: z.ZodString;
+        sourceFingerprint: z.ZodString;
+        targetFingerprint: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type DbPlanOutput = z.infer<typeof DbPlanOutputSchema>;
 //# sourceMappingURL=contract.d.ts.map

package/dist/commands/db/apply/helpers/fresh-db-handler.d.ts

@@ -10,13 +10,14 @@
  *
  * Safety: Fail-safe — if all detection fails, assumes existing DB (uses pg-schema-diff).
  */
-import type { DbApplyInput, DbApplyPlanSummary } from '../contract.js';
+import type { DbApplyInput, DbApplyPlanSummary, DbApplyPlanner } from '../contract.js';
 export interface PgSchemaDiffResult {
     sql: string;
     hazards: string[];
     applied: boolean;
     filteredPlanSql?: string;
     planSummary?: DbApplyPlanSummary;
+    planner?: DbApplyPlanner;
     retryAttempts?: number;
     retryWaitMs?: number;
     dataViolations?: number;

package/dist/commands/db/apply/helpers/index.d.ts

@@ -5,7 +5,7 @@
  */
 export { acquireAdvisoryLock, MIGRATION_LOCK_ID, releaseAdvisoryLock, } from './advisory-lock.js';
 export type { PlanHazard, PlanStatement, ValidatedPlan } from './plan-validator.js';
-export { ALLOWED_DDL_PREFIXES, BLOCKED_SQL_PATTERNS, parsePlanOutput, validatePlanForExecution, validateStatementTypes, } from './plan-validator.js';
+export { ALLOWED_DDL_PREFIXES, BLOCKED_SQL_PATTERNS, parsePlanOutput, reorderRawSqlDependencies, validateDependencyOrder, validateDependencyOrderFromRawSql, validatePlanForExecution, validateStatementTypes, } from './plan-validator.js';
 export { isNoChangePlanOutput } from './no-change-plan.js';
 export type { FilterResult } from './plan-drop-protection.js';
 export { filterIdempotentProtectedStatements, isDropStatementForProtectedObject, } from './plan-drop-protection.js';
@@ -35,5 +35,7 @@ export type { PgSchemaDiffResult } from './fresh-db-handler.js';
 export { handleFreshDbCase, hasAppTables } from './fresh-db-handler.js';
 export { checkPasswordSecurity, parseDbCredentials, setRolePasswords, } from './rbac-password-manager.js';
 export { backupIdempotentTables, getTableRowEstimates, verifyDataIntegrity, } from './data-integrity-verifier.js';
+export type { DbPlanArtifact } from './planner-artifact.js';
+export { buildTargetFingerprint, DbPlanArtifactSchema, detectPlannerSchemas, getDbPlanArtifactPath, persistDbPlanArtifact, tryReuseDbPlanArtifact, } from './planner-artifact.js';
 export { getTransactionStrategy, hasTransactionIncompatibleContent, hasTransactionIncompatibleStatements, wrapInTransaction, } from './idempotent-transaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/db/apply/helpers/plan-ast-sql-helpers.d.ts

@@ -0,0 +1,19 @@
+export declare function stripLeadingSetStatements(sql: string): string;
+export declare function extractStringValue(node: Record<string, unknown> | undefined): string | undefined;
+export declare function readIdentifierList(items: unknown[] | undefined): string[];
+export declare function qualifyName(parts: readonly string[], fallbackSchema?: string): string | null;
+export declare function rangeVarToQualifiedName(node: Record<string, unknown> | undefined): string | null;
+export declare function relationRecordToQualifiedName(record: Record<string, unknown> | undefined): string | null;
+export declare function optionDefElems(options: unknown[] | undefined): Array<Record<string, unknown>>;
+export declare function walkPgNode(node: unknown, visit: (record: Record<string, unknown>) => void): void;
+export declare function collectReferencedRelations(node: unknown, exclude: ReadonlySet<string>): string[];
+export declare function collectFunctionNames(node: unknown): string[];
+export declare function normalizeDbProconfig(entries: string[]): string;
+export declare function extractFunctionConfigFromSql(sql: string): string;
+export declare function extractFunctionOptions(createFunction: Record<string, unknown>): {
+    language: string;
+    body: string;
+    config: string;
+};
+export declare function extractFunctionIdentity(createFunction: Record<string, unknown>): string | null;
+//# sourceMappingURL=plan-ast-sql-helpers.d.ts.map

package/dist/commands/db/apply/helpers/plan-ast.d.ts

@@ -1,4 +1,5 @@
 import type { PlanStatement, ValidatedPlan } from './plan-validator.js';
+export { stripLeadingSetStatements } from './plan-ast-sql-helpers.js';
 export type PlanObjectKind = 'schema' | 'relation' | 'function' | 'function-privilege' | 'type' | 'other';
 export interface AnalyzedPlanStatement {
     statement: PlanStatement;
@@ -41,7 +42,6 @@ export interface PlanAnalysisSession {
     analyzePlpgsqlBody(body: string): Promise<CachedPlpgsqlBodyAnalysis>;
 }
 export declare function createPlanAnalysisSession(): PlanAnalysisSession;
-export declare function stripLeadingSetStatements(sql: string): string;
 export declare function analyzePlanStatement(statement: PlanStatement, session?: PlanAnalysisSession): Promise<AnalyzedPlanStatement>;
 export declare function analyzeValidatedPlan(plan: ValidatedPlan, session?: PlanAnalysisSession): Promise<AnalyzedPlan>;
 export declare function stabilizeAnalyzedPlanOrder(analyzedPlan: AnalyzedPlan): {
@@ -52,5 +52,4 @@ export declare function normalizeFunctionDefinitionAst(analyzed: Pick<AnalyzedPl
     normalizedDefinition: string;
     normalizedConfig: string;
 } | null;
-export {};
 //# sourceMappingURL=plan-ast.d.ts.map

package/dist/commands/db/apply/helpers/plan-check-filter.d.ts

@@ -7,18 +7,7 @@ export interface CheckModeFilterResult {
     removedAuthzStatements: PlanStatement[];
     removedRlsStatements: PlanStatement[];
 }
-declare function parseRolesFromAuthzStatement(sql: string): string[];
 export declare function stripLeadingSessionStatements(sql: string): string;
-type AuthzTarget = {
-    kind: 'function';
-    schema: string;
-    fullName: string;
-} | {
-    kind: 'schema' | 'sequence' | 'table';
-    schema: string;
-    fullName: string;
-} | null;
-declare function parseAuthzTarget(sql: string): AuthzTarget;
 export declare function isIdempotentManagedAuthzStatement(sql: string, schemasDir?: string): boolean;
 export declare function isIdempotentManagedRlsStatement(sql: string, schemasDir?: string): boolean;
 export declare function filterCheckModePlanStatements(plan: ValidatedPlan, protectedTables: string[], protectedObjects: IdempotentProtectedObjects, schemasDir?: string): CheckModeFilterResult;
@@ -31,7 +20,4 @@ export declare function buildCheckModePlanSummary(params: {
     suppressedFunctionStatements?: readonly PlanStatement[];
 }): DbApplyPlanSummary;
 export declare function resetManagedAuthzCache(): void;
-export declare const _parseRolesFromAuthzStatement: typeof parseRolesFromAuthzStatement;
-export declare const _parseAuthzTarget: typeof parseAuthzTarget;
-export {};
 //# sourceMappingURL=plan-check-filter.d.ts.map

package/dist/commands/db/apply/helpers/plan-validator.d.ts

@@ -90,6 +90,40 @@ export declare function validateStatementTypes(plan: ValidatedPlan): void;
  * @throws Error if unresolved hazards are found
  */
 export declare function validatePlanForExecution(plan: ValidatedPlan, allowedHazardTypes: string[]): void;
+/**
+ * Validate that plan SQL doesn't have ALTER POLICY referencing a function
+ * that is CREATE'd later in the same plan.
+ *
+ * This catches pg-schema-diff ordering bugs where ALTER POLICY (phase 50)
+ * is emitted before CREATE FUNCTION (phase 60), causing "function does not exist"
+ * errors at execution time.
+ *
+ * Called during plan generation (check mode) so issues are caught before deploy.
+ */
+/**
+ * Validate dependency order from raw SQL string.
+ * More reliable than ValidatedPlan-based check because it works regardless
+ * of how parsePlanOutput splits statements (marker-based vs SET-based).
+ */
+export declare function validateDependencyOrderFromRawSql(rawSql: string): string[];
+/**
+ * Reorder raw plan SQL to fix ALTER POLICY before CREATE FUNCTION ordering.
+ *
+ * Moves policy chunks that reference functions created later in the plan
+ * to after those function definitions. This is the actual fix that makes
+ * deploy succeed, not just detection.
+ */
+export declare function reorderRawSqlDependencies(rawSql: string): {
+    sql: string;
+    reordered: boolean;
+    movedCount: number;
+};
+export declare function validateDependencyOrder(plan: ValidatedPlan): string[];
+/**
+ * Determine whether pg-schema-diff plan output represents "no changes needed".
+ * Returns true if the output is empty, contains "No changes", or has zero statements.
+ */
+export declare function isNoChangePlanOutput(planOutput: string): boolean;
 export type { FilterResult } from './plan-drop-protection.js';
 export { filterIdempotentProtectedStatements, isDropStatementForProtectedObject, _isDropStatementForProtected, _extractProtectedSchemas, _isDropSchemaForProtected, } from './plan-drop-protection.js';
 //# sourceMappingURL=plan-validator.d.ts.map