@rehearsal-db/core 0.1.0-beta.1 → 0.1.0-beta.10

package/{scripts/operations/database/manage_rehearsal_database.mjs → src/targets/supabase.mjs}

@@ -16,11 +16,11 @@ import { pathToFileURL } from "node:url";
 import {
   resolveActiveBaselinePaths,
   verifyActiveBaseline,
-} from "../../lib/rehearsal/baseline_artifact.mjs";
+} from "../baseline/artifact.mjs";
 import {
   createCleanProcessEnvironment,
   assertLoopbackUrl,
-} from "../../lib/rehearsal/process_environment.mjs";
+} from "../shared/process_environment.mjs";
 import {
   localCommandSucceeds,
   readLocalSupabaseEnvironment,
@@ -28,30 +28,42 @@ import {
   runLocalCommand,
   startLocalSupabase,
   stopLocalSupabase,
-} from "../../lib/environment/local_supabase.mjs";
+} from "./supabase_environment.mjs";
 import {
   buildRestoreSqlPrefix,
   buildRestoreSqlSuffix,
   createCandidateMigrationReceipt,
   encodeBaselineRecordForCopy,
   summarizeRestoreError,
-} from "../../lib/rehearsal/runtime_restore.mjs";
+} from "../runtime/restore.mjs";
 import {
   buildMigrationLedgerInventory,
   compareSourceToReplay,
   createMigrationReplayReceipt,
   readMigrationFileInventory,
-} from "../../lib/rehearsal/migration_history.mjs";
-import { loadRehearsalConfig } from "../../lib/rehearsal/configuration.mjs";
-import { readRehearsalServiceEnvironment } from "../../lib/rehearsal/service_environment.mjs";
+} from "../runtime/migration_history.mjs";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
+import { readRehearsalServiceEnvironment } from "../runtime/service_environment.mjs";
+import { readBoundRuntimeSanitizationPolicy } from "../baseline/sanitization_policy.mjs";
 import {
   captureLocalPublicSchema,
   compareProductionSchemaDumps,
-} from "../../lib/rehearsal/schema_snapshot.mjs";
+} from "../baseline/schema_snapshot.mjs";
+import { formatCount } from "../shared/human_output.mjs";
+import { parseRuntimeInvocation } from "./target.mjs";
+import {
+  buildRuntimeFinalizationSql,
+  buildRuntimePostSchemaSql,
+  buildRuntimePrerequisiteSql,
+  buildRuntimeVerificationSql,
+  validateRuntimePolicy,
+} from "../runtime/policy.mjs";
 
 const repositoryRoot = process.cwd();
+const invocation = parseRuntimeInvocation();
 const loadedConfiguration = await loadRehearsalConfig({
   projectRoot: repositoryRoot,
+  configPath: invocation.configPath,
 });
 const { config, paths: configuredPaths } = loadedConfiguration;
 const artifactRoot = configuredPaths.artifactDirectory;
@@ -73,8 +85,13 @@ const projectId = config.runtime.projectId;
 const runtimeAdapter = configuredPaths.runtimeAdapter
   ? await import(pathToFileURL(configuredPaths.runtimeAdapter).href)
   : null;
+const runtimePolicy = configuredPaths.runtimePolicy
+  ? validateRuntimePolicy(
+      JSON.parse(await readFile(configuredPaths.runtimePolicy, "utf8")),
+    )
+  : null;
 const environmentKeyPattern = /^[A-Z][A-Z0-9_]*$/u;
-const action = process.argv[2] ?? "status";
+const action = invocation.action;
 
 const readServiceEnvironment = () =>
   readRehearsalServiceEnvironment({
@@ -329,6 +346,12 @@ const writeRuntimeEnvironment = async ({
   const variables = {
     REHEARSAL_RUNTIME_ENVIRONMENT: "rehearsal",
     REHEARSAL_BASELINE_ID: baseline.generationId,
+    DATABASE_URL: environment.databaseUrl,
+    PGHOST: environment.databaseHost,
+    PGPORT: environment.databasePort,
+    PGDATABASE: environment.databaseName,
+    PGUSER: environment.databaseUser,
+    PGPASSWORD: environment.databasePassword,
     SUPABASE_URL: environment.apiUrl,
     SUPABASE_PUBLISHABLE_KEY: environment.publishableKey,
     SUPABASE_SERVICE_ROLE_KEY: environment.serviceRoleKey,
@@ -370,7 +393,13 @@ const runDatabaseSql = (sql) => {
 
 const restoreProductionSchema = async ({ baseline, paths }) => {
   const receipt = baseline.files?.["production-schema.sql"];
-  if (baseline.formatVersion === 1 && receipt === undefined) return null;
+  if (baseline.formatVersion === 1 && receipt === undefined) {
+    if (runtimePolicy) {
+      runDatabaseSql(buildRuntimePrerequisiteSql(runtimePolicy));
+      runDatabaseSql(buildRuntimePostSchemaSql(runtimePolicy));
+    }
+    return null;
+  }
   if (
     baseline.formatVersion !== 2 ||
     !/^[a-f0-9]{64}$/u.test(receipt?.sha256 ?? "") ||
@@ -381,7 +410,12 @@ const restoreProductionSchema = async ({ baseline, paths }) => {
     );
   }
   const schemaSql = await readFile(paths.schemaPath, "utf8");
-  runDatabaseSql("drop schema if exists public cascade;");
+  runDatabaseSql(`drop schema if exists public cascade;
+create schema public authorization pg_database_owner;
+grant usage on schema public to public;`);
+  if (runtimePolicy) {
+    runDatabaseSql(buildRuntimePrerequisiteSql(runtimePolicy));
+  }
   if (runtimeAdapter?.prepareSchema) {
     const preparation = runtimeAdapter.prepareSchema({
       runSql: runDatabaseSql,
@@ -393,6 +427,9 @@ const restoreProductionSchema = async ({ baseline, paths }) => {
     }
   }
   runDatabaseSql(schemaSql);
+  if (runtimePolicy) {
+    runDatabaseSql(buildRuntimePostSchemaSql(runtimePolicy));
+  }
   const restoredSchema = await captureLocalPublicSchema({
     repositoryRoot,
     artifactRoot,
@@ -443,11 +480,15 @@ const configureProjectRuntime = ({ environment, baseline }) => {
 };
 
 const readActive = async () => {
-  const [baseline, paths, manifest] = await Promise.all([
+  const [baseline, paths, policyBytes] = await Promise.all([
     verifyActiveBaseline({ artifactRoot }),
     resolveActiveBaselinePaths({ artifactRoot }),
-    readFile(manifestPath, "utf8").then(JSON.parse),
+    readFile(manifestPath),
   ]);
+  const manifest = readBoundRuntimeSanitizationPolicy({
+    bytes: policyBytes,
+    expectedSha256: baseline.sanitizationPolicySha256,
+  });
   return { baseline, paths, manifest };
 };
 
@@ -462,6 +503,7 @@ const resetRuntime = async () => {
       workdir: runtimeWorkdir,
       exclude: ["edge-runtime", "logflare", "vector", "realtime"],
       environment: serviceEnvironment,
+      autoStartColima: config.containerRuntime.autoStartColima,
     });
     const structuralSchemaSha256 = await restoreProductionSchema(active);
     await restoreBaselineRows(active);
@@ -470,6 +512,10 @@ const resetRuntime = async () => {
       paths: active.paths,
       environment,
     });
+    if (runtimePolicy && runtimePolicy.localRows.length > 0) {
+      runDatabaseSql(buildRuntimeFinalizationSql(runtimePolicy));
+      console.log("Applied reviewed local-only recipes.");
+    }
     const projectRuntime = configureProjectRuntime({
       environment,
       baseline: active.baseline,
@@ -496,7 +542,7 @@ const resetRuntime = async () => {
       { mode: 0o600 },
     );
     console.log(
-      `Restored Rehearsal baseline ${active.baseline.generationId}: ${active.baseline.rowCount} rows across ${Object.keys(active.baseline.tableCounts).length} tables.`,
+      `Restored Rehearsal baseline ${active.baseline.generationId}: ${formatCount(active.baseline.rowCount, "row")} across ${formatCount(Object.keys(active.baseline.tableCounts).length, "table")}.`,
     );
     console.log(projectRuntime.message);
     return environment;
@@ -526,6 +572,7 @@ const startRuntime = async () => {
     workdir: runtimeWorkdir,
     exclude: ["edge-runtime", "logflare", "vector", "realtime"],
     environment: serviceEnvironment,
+    autoStartColima: config.containerRuntime.autoStartColima,
   });
   const projectRuntime = configureProjectRuntime({ environment, baseline });
   await writeRuntimeEnvironment({
@@ -605,6 +652,7 @@ const verifyRuntime = async () => {
     currentFiles: candidateReceipt.currentFiles,
   });
   let projectVerification;
+  if (runtimePolicy) runDatabaseSql(buildRuntimeVerificationSql(runtimePolicy));
   if (runtimeAdapter?.verifyRuntime) {
     projectVerification = runtimeAdapter.verifyRuntime({
       baseline,
@@ -621,7 +669,7 @@ const verifyRuntime = async () => {
     }
   }
   console.log(
-    `Verified Rehearsal runtime ${baseline.generationId}: immutable baseline and migration history are valid with ${migrationComparison.candidates.length} applied candidate migrations. Runtime rows may differ from the baseline until the next reset.`,
+    `Verified Rehearsal runtime ${baseline.generationId}: immutable baseline and migration history are valid with ${formatCount(migrationComparison.candidates.length, "applied candidate migration")}. Runtime rows may differ from the baseline until the next reset.`,
   );
   if (projectVerification) console.log(projectVerification.message);
   return { baseline, candidateReceipt, migrationComparison };
@@ -652,11 +700,9 @@ const migrateRuntime = async () => {
     return receipt;
   }
   console.log(
-    `Candidate migrations (${receipt.candidateSha256}): ${receipt.candidates.map((candidate) => candidate.filename).join(", ")}`,
+    `${receipt.candidates.length === 1 ? "Candidate migration" : "Candidate migrations"} (${receipt.candidateSha256}): ${receipt.candidates.map((candidate) => candidate.filename).join(", ")}`,
   );
-  const confirmation = process.argv
-    .find((argument) => argument.startsWith("--confirm-candidates="))
-    ?.slice("--confirm-candidates=".length);
+  const confirmation = invocation.confirmation;
   if (confirmation !== receipt.candidateSha256) {
     throw new Error(
       "Candidate migration confirmation is missing or does not match the exact SHA-256.",
@@ -707,7 +753,7 @@ const migrateRuntime = async () => {
       { mode: 0o600 },
     );
     console.log(
-      `Applied ${receipt.candidates.length} confirmed candidate migrations to the disposable Rehearsal runtime.`,
+      `Applied ${formatCount(receipt.candidates.length, "confirmed candidate migration")} to the disposable Rehearsal runtime.`,
     );
     return receipt;
   } catch (error) {

package/{scripts/lib/environment/local_supabase.mjs → src/targets/supabase_environment.mjs}

@@ -4,7 +4,7 @@
  */
 
 import { spawnSync } from "node:child_process";
-import { createCleanProcessEnvironment } from "../rehearsal/process_environment.mjs";
+import { createCleanProcessEnvironment } from "../shared/process_environment.mjs";
 
 export const parseSupabaseStatusEnvironment = (output) => {
   const values = {};
@@ -18,6 +18,56 @@ export const parseSupabaseStatusEnvironment = (output) => {
   return values;
 };
 
+export const parseLocalSupabaseEnvironment = (output) => {
+  const values = parseSupabaseStatusEnvironment(output);
+  const localEnvironment = {
+    apiUrl: values.API_URL,
+    databaseUrl: values.DB_URL,
+    publishableKey: values.PUBLISHABLE_KEY ?? values.ANON_KEY,
+    serviceRoleKey: values.SERVICE_ROLE_KEY ?? values.SECRET_KEY,
+    studioUrl: values.STUDIO_URL,
+  };
+  for (const [label, value] of [
+    ["API URL", localEnvironment.apiUrl],
+    ["database URL", localEnvironment.databaseUrl],
+    ["publishable key", localEnvironment.publishableKey],
+    ["service-role key", localEnvironment.serviceRoleKey],
+  ]) {
+    if (!value) throw new Error(`Local Supabase status omitted its ${label}.`);
+  }
+  const api = new URL(localEnvironment.apiUrl);
+  const database = new URL(localEnvironment.databaseUrl);
+  const loopbackHosts = ["127.0.0.1", "::1", "localhost"];
+  if (
+    !loopbackHosts.includes(api.hostname) ||
+    !loopbackHosts.includes(database.hostname) ||
+    !["postgres:", "postgresql:"].includes(database.protocol)
+  ) {
+    throw new Error("Refusing to use a non-local Supabase status target.");
+  }
+  const databaseName = decodeURIComponent(
+    database.pathname.replace(/^\//u, ""),
+  );
+  if (
+    !database.port ||
+    !databaseName ||
+    !database.username ||
+    !database.password
+  ) {
+    throw new Error(
+      "Local Supabase status returned an incomplete database URL.",
+    );
+  }
+  return {
+    ...localEnvironment,
+    databaseHost: database.hostname,
+    databasePort: database.port,
+    databaseName,
+    databaseUser: decodeURIComponent(database.username),
+    databasePassword: decodeURIComponent(database.password),
+  };
+};
+
 export const runLocalCommand = (
   command,
   args,
@@ -62,14 +112,13 @@ export const localCommandSucceeds = (
     stdio: "ignore",
   }).status === 0;
 
-export const ensureLocalContainerRuntime = ({ cwd = process.cwd() } = {}) => {
+export const ensureLocalContainerRuntime = ({
+  cwd = process.cwd(),
+  autoStartColima = true,
+} = {}) => {
   if (localCommandSucceeds("docker", ["info"], { cwd })) return;
-  if (localCommandSucceeds("colima", ["version"], { cwd })) {
-    runLocalCommand(
-      "colima",
-      ["start", "--cpu", "4", "--memory", "4", "--disk", "40"],
-      { cwd },
-    );
+  if (autoStartColima && localCommandSucceeds("colima", ["version"], { cwd })) {
+    runLocalCommand("colima", ["start"], { cwd });
   }
   if (!localCommandSucceeds("docker", ["info"], { cwd })) {
     throw new Error(
@@ -91,25 +140,7 @@ export const readLocalSupabaseEnvironment = ({
     withWorkdir(["status", "-o", "env"], workdir),
     { capture: true, cwd, environment },
   );
-  const values = parseSupabaseStatusEnvironment(output);
-  const localEnvironment = {
-    apiUrl: values.API_URL,
-    publishableKey: values.PUBLISHABLE_KEY ?? values.ANON_KEY,
-    serviceRoleKey: values.SERVICE_ROLE_KEY ?? values.SECRET_KEY,
-    studioUrl: values.STUDIO_URL,
-  };
-  for (const [label, value] of [
-    ["API URL", localEnvironment.apiUrl],
-    ["publishable key", localEnvironment.publishableKey],
-    ["service-role key", localEnvironment.serviceRoleKey],
-  ]) {
-    if (!value) throw new Error(`Local Supabase status omitted its ${label}.`);
-  }
-  const hostname = new URL(localEnvironment.apiUrl).hostname;
-  if (!["127.0.0.1", "::1", "localhost"].includes(hostname)) {
-    throw new Error("Refusing to use a non-loopback Supabase status target.");
-  }
-  return localEnvironment;
+  return parseLocalSupabaseEnvironment(output);
 };
 
 export const startLocalSupabase = ({
@@ -118,8 +149,9 @@ export const startLocalSupabase = ({
   exclude = [],
   environment = {},
   applyMigrations = true,
+  autoStartColima = true,
 } = {}) => {
-  ensureLocalContainerRuntime({ cwd });
+  ensureLocalContainerRuntime({ cwd, autoStartColima });
   const startArguments = withWorkdir(
     ["start", ...(exclude.length ? ["--exclude", exclude.join(",")] : [])],
     workdir,

package/src/targets/target.mjs

@@ -0,0 +1,66 @@
+/**
+ * Purpose: Define the small, closed set of database runtimes Rehearsal can select.
+ * Runtime implementations stay behind this boundary so the shared CLI does not
+ * need target-specific branches.
+ */
+
+const TARGETS = Object.freeze({
+  supabase: Object.freeze({
+    id: "supabase",
+    label: "Supabase",
+  }),
+  postgresql: Object.freeze({
+    id: "postgresql",
+    label: "PostgreSQL",
+  }),
+});
+
+export const REHEARSAL_RUNTIME_TARGETS = Object.freeze(Object.keys(TARGETS));
+
+export const parseRuntimeInvocation = (arguments_ = process.argv.slice(2)) => {
+  const action = arguments_.find((argument) => !argument.startsWith("--"));
+  const valueAfter = (prefix) =>
+    arguments_
+      .find((argument) => argument.startsWith(prefix))
+      ?.slice(prefix.length);
+  return Object.freeze({
+    action: action ?? "status",
+    configPath: valueAfter("--config="),
+    confirmation: valueAfter("--confirm-candidates="),
+  });
+};
+
+export const buildRuntimeManagerArguments = ({
+  managerPath,
+  action,
+  configPath,
+  confirmation,
+}) => [
+  managerPath,
+  action,
+  ...(configPath ? [`--config=${configPath}`] : []),
+  ...(confirmation ? [`--confirm-candidates=${confirmation}`] : []),
+];
+
+export const resolveRuntimeTarget = (value = "supabase") => {
+  if (typeof value !== "string" || !Object.hasOwn(TARGETS, value)) {
+    throw new Error(
+      `Unsupported Rehearsal runtime target: ${String(value)}. Supported targets: ${REHEARSAL_RUNTIME_TARGETS.join(", ")}.`,
+    );
+  }
+  return TARGETS[value];
+};
+
+export const runRuntimeTarget = async (target) => {
+  const resolved = resolveRuntimeTarget(target);
+  switch (resolved.id) {
+    case "supabase":
+      await import("./supabase.mjs");
+      return;
+    case "postgresql":
+      await import("./postgresql.mjs");
+      return;
+    default:
+      throw new Error(`No runtime driver is installed for ${resolved.id}.`);
+  }
+};