@rehearsal-db/core 0.1.0-beta.1 → 0.1.0-beta.2

package/CHANGELOG.md

@@ -5,6 +5,24 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## Unreleased
 
+## [0.1.0-beta.2] - 2026-09-15
+
+### Fixed
+
+- Generate `rehearsal.config.mjs` so first-time initialization works in both CommonJS
+  and ESM projects instead of failing when a fresh npm project declares CommonJS.
+- Report the exact table and represented-migration counts after creating a synthetic
+  baseline instead of rendering missing result fields as `undefined`.
+- Keep the copyable getting-started migration bytes identical to its migration-ledger
+  example so the documented runtime replay passes exact-history verification.
+- Install the current prerelease through npm's `beta` tag so new projects do not resolve
+  the superseded bootstrap release from npm's historical `latest` tag.
+
+### Security
+
+- Removed the completed first-package bootstrap credential path. All future publication
+  uses the package's trusted GitHub Actions OIDC publisher and cannot read an npm token.
+
 ## [0.1.0-beta.1] - 2026-09-14
 
 ### Changed
@@ -54,6 +72,7 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
   publication uses short-lived trusted OIDC, and every release tag must already exist on
   protected `main`.
 
-[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.1...HEAD
+[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.2...HEAD
+[0.1.0-beta.2]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.1...v0.1.0-beta.2
 [0.1.0-beta.1]: https://github.com/Ddupasquier/rehearsal-db/releases/tag/v0.1.0-beta.1
 [0.1.0-beta.0]: https://github.com/Ddupasquier/rehearsal-db/releases/tag/v0.1.0-beta.0

package/README.md

@@ -77,7 +77,7 @@ invariants. Reset restores and reproves the exact starting data.
 Install the current beta from npm:
 
 ```bash
-npm install --save-dev @rehearsal-db/core
+npm install --save-dev @rehearsal-db/core@beta
 ```
 
 Contributors testing an unreleased change can use `npm link` or install the tarball
@@ -102,9 +102,10 @@ npx rehearsal stop
 npx rehearsal discard
 ```
 
-`init` previews a typed `rehearsal.config.ts`; it writes only with `--write` and never
-overwrites an existing file. Review all detected values. Rehearsal intentionally does
-not detect, copy, or enable a hosted project.
+`init` previews a type-aware ESM `rehearsal.config.mjs`; it writes only with `--write`
+and never overwrites an existing file. The explicit `.mjs` extension makes the generated
+configuration executable in both CommonJS and ESM projects. Review all detected values.
+Rehearsal intentionally does not detect, copy, or enable a hosted project.
 
 `doctor` must end with `READY` before execution. `explain` and `run --dry-run` use the
 same immutable planner and perform no state-changing operations. If migrations are

package/docs/configuration.md

@@ -1,6 +1,8 @@
 # Configuration reference
 
-`rehearsal.config.ts` is executable configuration with a strict versioned schema.
+`rehearsal.config.mjs` is executable configuration with a strict versioned schema. The
+initializer uses an explicit ESM extension so the same generated file works in CommonJS
+and ESM projects.
 Unknown fields and unknown schema versions are errors, not warnings.
 
 ```ts

package/docs/getting-started.md

@@ -35,7 +35,7 @@ its labeled local runtime. It does not need a hosted Supabase project or credent
 ## 1. Install and initialize
 
 ```bash
-npm install --save-dev @rehearsal-db/core
+npm install --save-dev @rehearsal-db/core@beta
 npx rehearsal init
 ```
 
@@ -53,7 +53,7 @@ until the next section's files exist.
 
 ## 2. Add the project-owned inputs
 
-Create the paths named by `rehearsal.config.ts`:
+Create the paths named by `rehearsal.config.mjs`:
 
 - a dedicated local Supabase `config.toml`;
 - a sanitization policy describing every exported field;
@@ -68,7 +68,7 @@ cp supabase/config.toml infrastructure/rehearsal/supabase/config.toml
 ```
 
 Edit the copied Supabase config. Give it the same unique `project_id`, API port, database
-port, and Studio port used by `rehearsal.config.ts`. Disable services your proof does
+port, and Studio port used by `rehearsal.config.mjs`. Disable services your proof does
 not need. This must remain an unlinked local config; never run `supabase link` from it.
 
 Also replace the generated `application.startCommand`, `application.proofCommand`, and
@@ -83,9 +83,9 @@ Historical migration `supabase/migrations/20260101000000_create_widgets.sql`:
 
 ```sql
 create table public.widgets (
-  id bigint generated by default as identity primary key,
-  name text not null,
-  created_at timestamptz not null default now()
+	id bigint generated by default as identity primary key,
+	name text not null,
+	created_at timestamptz not null default now()
 );
 
 insert into storage.buckets (id, name, public)
@@ -238,7 +238,8 @@ stops only this project's runtime.
 
 ## Generated files
 
-- `rehearsal.config.ts` is written only by `init --write`.
+- `rehearsal.config.mjs` is written only by `init --write`. Its explicit ESM extension
+  works whether the consuming project's `package.json` uses CommonJS or ESM.
 - `.rehearsal/generations/<id>/` contains one immutable baseline generation.
 - `.rehearsal/current` selects the active generation atomically.
 - `.rehearsal/runtime/` contains the disposable local Supabase project and receipts.

package/docs/production-source.md

@@ -22,7 +22,7 @@ never row bodies.
 
 ## What not to do
 
-- Do not point `rehearsal.config.ts` at a hosted URL.
+- Do not point `rehearsal.config.mjs` at a hosted URL.
 - Do not put a production connection string in `.rehearsal/runtime.env`.
 - Do not grant table-wide access merely because a view is inconvenient.
 - Do not commit sanitized baselines; sanitized data is still data.

package/docs/releasing.md

@@ -5,48 +5,27 @@ environment. The workflow builds and hashes the candidate before the environment
 approval gate, then publishes those exact bytes with npm provenance. A local working
 tree is never the release source.
 
-The initial publishable `0.1.0-beta.1` release branch is the first change allowed to set
-`"private": false`. Publication still requires the exact protected-main tag, prerelease
-flag, artifact checks, and protected `npm` environment gate described below.
-
 `0.1.0-beta.0` was prepared under the unavailable `@rehearsal` npm scope and was never
 published. `0.1.0-beta.1` supersedes that candidate under `@rehearsal-db/core` without
 rewriting the earlier Git tag or GitHub prerelease.
 
-## One-time first-package bootstrap
+## Trusted publication boundary
 
-npm trusted publishing and staged publishing are package-level settings, so they cannot
-be configured until `@rehearsal-db/core` exists in the registry. The first public version has
-a deliberately narrower bootstrap path:
+`@rehearsal-db/core` trusts only the GitHub Actions publisher for repository
+`Ddupasquier/rehearsal-db`, workflow `publish.yml`, and environment `npm`. The publish job
+requests a short-lived GitHub OIDC identity after the protected environment approval;
+it does not read an npm token or retain a registry credential. Package publishing access
+requires 2FA and disallows bypass tokens.
 
-1. The npm owner enables 2FA and creates or confirms the public `@rehearsal-db` organization
-   scope. Do not send a password, OTP, recovery code, or access token to another person.
-2. After the reviewed release change reaches protected `main`, the owner creates the
-   exact `v0.1.0-beta.1` GitHub release and marks it as a prerelease. The prepare job runs without npm credentials,
-   packs the tag, and uploads its versioned tarball plus SHA-1 and SHA-256 metadata. The
-   publish job waits at the protected environment and cannot run yet.
-3. The owner downloads or inspects that prepared artifact, confirms its version and
-   checksum, and explicitly authorizes those exact bytes.
-4. Only then, the owner creates a short-lived granular npm token with read/write access
-   limited to the `@rehearsal-db` scope and **Bypass 2FA** enabled. npm requires that bypass
-   for a non-interactive first publish; the environment approval remains the human
-   release gate. Store the token only as the `NPM_TOKEN` secret in the protected GitHub
-   `npm` environment.
-5. The owner approves the waiting `npm` deployment. GitHub Actions publishes the exact
-   uploaded tarball with provenance. The workflow
-   refuses to use the bootstrap secret for any version other than `0.1.0-beta.1`.
-6. Immediately after the registry verification passes, the owner deletes the GitHub
-   environment secret and revokes the temporary npm token.
-7. From the new package's npm settings, configure the trusted GitHub Actions publisher
-   for repository `Ddupasquier/rehearsal-db`, workflow `publish.yml`, and environment
-   `npm`. Allow direct `npm publish` for this workflow because the protected GitHub
-   environment supplies the human gate. A later switch to npm staged publication must
-   change and prove the workflow before narrowing the trusted publisher permission.
-8. Set package publishing access to require 2FA and disallow traditional tokens.
+The initial `0.1.0-beta.1` package creation required a one-time bootstrap credential
+because npm cannot configure a trusted publisher before a package exists. That
+credential is not part of the maintained release architecture: it was deleted from the
+GitHub environment after publication, must remain revoked at npm, and cannot be consumed
+by this workflow.
 
-This bootstrap token is a one-release compromise imposed by npm's package-creation
-boundary. It is never committed, printed, copied into a ticket, or retained for later
-versions.
+Direct `npm publish` is allowed only for this trusted publisher because the protected
+GitHub `npm` environment supplies the human gate. A later switch to npm staged
+publication must change and prove the workflow before narrowing that permission.
 
 ## Every release candidate
 
@@ -66,7 +45,9 @@ versions.
    the approved version and checksum.
 10. Verify public visibility, ownership, provenance, registry SHA-1, README rendering,
     exact-version clean installation, CLI execution, signatures, and the unrelated
-    installed Docker fixture.
+    installed Docker fixture. Allow up to six minutes for a first package to propagate
+    through the public registry before classifying a missing packument as a release
+    failure.
 11. Replace consuming projects' temporary Git/archive references only on their own
     protected integration branches and rerun their complete verification.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-beta.1",
+  "version": "0.1.0-beta.2",
   "private": false,
   "description": "Safely rehearse Supabase migrations against sanitized, production-shaped PostgreSQL data.",
   "repository": {

package/scripts/lib/rehearsal/baseline_builder.mjs

@@ -148,8 +148,8 @@ export const createSyntheticBaselineFromFiles = async ({
   return {
     generationId,
     migrationCutoff: baseline.migrationCutoff,
-    migrationCount: baseline.migrationCount,
+    migrationCount: Object.keys(baseline.migrations).length,
     rowCount: baseline.rowCount,
-    tableCount: baseline.tableCount,
+    tableCount: Object.keys(baseline.tableCounts).length,
   };
 };

package/scripts/lib/rehearsal/configuration.mjs

@@ -515,9 +515,8 @@ export const inspectDetectedProject = async ({
   };
 };
 
-export const renderDetectedConfig = (
-  detected,
-) => `import { defineRehearsalConfig } from "@rehearsal-db/core";
+export const renderDetectedConfig = (detected) => `// @ts-check
+import { defineRehearsalConfig } from "@rehearsal-db/core";
 
 export default defineRehearsalConfig({
 	schemaVersion: 1,

package/scripts/lib/rehearsal/diagnostics.mjs

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 
 export const REHEARSAL_RESULT_VERSION = 1;
-export const REHEARSAL_VERSION = "0.1.0-beta.1";
+export const REHEARSAL_VERSION = "0.1.0-beta.2";
 
 export const REHEARSAL_EXIT_CODES = Object.freeze({
   success: 0,

package/scripts/operations/rehearsal/rehearsal_cli.mjs

@@ -362,7 +362,7 @@ const runApplicationProof = async (planOptions) => {
 const runInit = async ({ flags }) => {
   const detected = await inspectDetectedProject({ projectRoot });
   const source = renderDetectedConfig(detected);
-  const destination = join(projectRoot, "rehearsal.config.ts");
+  const destination = join(projectRoot, "rehearsal.config.mjs");
   let existingPath = null;
   try {
     existingPath = await findRehearsalConfigPath({ projectRoot });