@rehearsal-db/core 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/src/cli/source_commands.d.mts

@@ -0,0 +1,432 @@
+/**
+ * CLI orchestration for temporary production-source access and safe baseline
+ * replacement. Domain validation remains in src/source and src/baseline.
+ */
+import type { RehearsalConfigPathOptions } from "../project/configuration.mjs";
+import type { RehearsalCliFlags } from "./arguments.mjs";
+import { loadRuntimeTopology } from "../runtime/topology.mjs";
+import type { RuntimeTopologyTarget } from "../runtime/topology.mjs";
+type RuntimeTopology = Awaited<ReturnType<typeof loadRuntimeTopology>>;
+type RefreshPlanContext = Awaited<ReturnType<typeof buildRefreshWorkflowPlan>>;
+interface SourceCommandInput {
+    readonly flags: RehearsalCliFlags;
+    readonly planOptions: RehearsalConfigPathOptions;
+}
+export declare const loadPreparationContext: (planOptions: RehearsalConfigPathOptions) => Promise<{
+    loaded: Readonly<{
+        config: Readonly<{
+            schemaVersion: 1;
+            project: Readonly<{
+                name: string;
+            }>;
+            supabase: Readonly<{
+                workdir: string;
+                migrationDirectory: string;
+                rehearsalConfig: string;
+                runtimeWorkdir: string;
+                authentication: Readonly<{
+                    enableLocalSignup: true;
+                    environmentFile: string;
+                    providers: readonly Readonly<{
+                        name: "github" | "google";
+                        clientIdEnvironmentVariable: string;
+                        clientSecretEnvironmentVariable: string;
+                        skipNonceCheck: boolean;
+                        emailOptional: boolean;
+                    }>[];
+                }> | null;
+                serviceEnvironmentFile: string | null;
+                serviceEnvironmentVariables: readonly string[];
+            }> | null;
+            postgresql: Readonly<{
+                migrationDirectory: string;
+                runtimeWorkdir: string;
+                image: string;
+                database: string;
+                user: string;
+            }> | null;
+            baseline: Readonly<{
+                artifactDirectory: string;
+                sanitizationPolicy: string;
+            }>;
+            containerRuntime: Readonly<{
+                autoStartColima: boolean;
+            }>;
+            cleanup: Readonly<{
+                retainBaselineGenerations: number;
+            }>;
+            preparation: Readonly<{
+                sourcePolicy: string;
+                privacyKey: string;
+                batchRows: number;
+                maximumRows: number;
+                maximumBytes: number;
+                diskHeadroomBytes: number;
+            }> | null;
+            runtimePolicy: string | null;
+            identityPolicy: string | null;
+            dependentTargets: readonly Readonly<{
+                name: string;
+                configPath: string;
+                prepareCommand: string | null;
+            }>[];
+            application: Readonly<{
+                startCommand: string;
+                proofCommand: string;
+                environmentFile: string;
+                environmentVariables: Readonly<Record<string, string>>;
+                readiness: Readonly<{
+                    url: string;
+                    expectedStatus: number;
+                    timeoutSeconds: number;
+                }> | null;
+                httpProofs: readonly Readonly<{
+                    name: string;
+                    kind: "positive" | "negative";
+                    url: string;
+                    method: string;
+                    expectedStatus: number;
+                    json: Readonly<{
+                        path: readonly string[];
+                        equals?: unknown;
+                        notEquals?: unknown;
+                        minimumItems?: number;
+                    }> | null;
+                }>[];
+                runtimeAdapter: string | null;
+            }>;
+            runtime: Readonly<{
+                target: "postgresql" | "supabase";
+                applicationUrl: string;
+                projectId: string;
+                ports: Readonly<{
+                    api?: number;
+                    database: number;
+                    studio?: number;
+                }>;
+            }>;
+            safety: Readonly<{
+                allowedHosts: readonly string[];
+                blockedEnvironmentVariables: readonly string[];
+                authenticationProviders: readonly string[];
+                hostedAccess: "disabled";
+                outboundNetwork: "deny";
+            }>;
+            verification: Readonly<{
+                commands: readonly string[];
+            }>;
+        }>;
+        configPath: string;
+        projectRoot: string;
+        paths: Readonly<{
+            artifactDirectory: string;
+            applicationEnvironment: string;
+            migrationDirectory: string;
+            rehearsalConfig: string | null;
+            runtimeWorkdir: string;
+            serviceEnvironment: string | null;
+            sanitizationPolicy: string;
+            sourcePolicy: string | null;
+            privacyKey: string | null;
+            runtimePolicy: string | null;
+            identityPolicy: string | null;
+            supabaseWorkdir: string | null;
+            runtimeAdapter: string | null;
+        }>;
+    }>;
+    sourcePolicy: Readonly<import("../source/access.mjs").SourceAccessPolicy>;
+    sourcePolicyBytes: NonSharedBuffer;
+}>;
+export declare const runSourceAccess: ({ flags, planOptions, }: SourceCommandInput) => Promise<{
+    mode: "preview";
+    plan: Readonly<import("../source/access.mjs").SourceAccessPlan>;
+    receipt?: never;
+    credentialFile?: never;
+} | {
+    mode: "written";
+    plan: Readonly<import("../source/access.mjs").SourceAccessPlan>;
+    receipt: import("../source/postgresql_access.mjs").SourceAccessReceipt;
+    credentialFile: string;
+}>;
+export declare const runSourceRetirement: ({ flags, planOptions, }: SourceCommandInput) => Promise<{
+    mode: "preview";
+    plan: import("../source/postgresql_access.mjs").RetirementExecutionPlan;
+} | {
+    mode: "written";
+    plan: import("../source/postgresql_access.mjs").RetirementExecutionPlan;
+}>;
+export declare const runSourceBaselineRefresh: ({ planOptions, }: Pick<SourceCommandInput, "planOptions">) => Promise<{
+    generationId: string;
+    manifest: import("../baseline/artifact.mjs").BaselineManifest;
+    estimate: Readonly<import("../source/baseline.mjs").ExportEstimate>;
+}>;
+export declare const buildRefreshWorkflowPlan: (planOptions: RehearsalConfigPathOptions) => Promise<{
+    loaded: Readonly<{
+        config: Readonly<{
+            schemaVersion: 1;
+            project: Readonly<{
+                name: string;
+            }>;
+            supabase: Readonly<{
+                workdir: string;
+                migrationDirectory: string;
+                rehearsalConfig: string;
+                runtimeWorkdir: string;
+                authentication: Readonly<{
+                    enableLocalSignup: true;
+                    environmentFile: string;
+                    providers: readonly Readonly<{
+                        name: "github" | "google";
+                        clientIdEnvironmentVariable: string;
+                        clientSecretEnvironmentVariable: string;
+                        skipNonceCheck: boolean;
+                        emailOptional: boolean;
+                    }>[];
+                }> | null;
+                serviceEnvironmentFile: string | null;
+                serviceEnvironmentVariables: readonly string[];
+            }> | null;
+            postgresql: Readonly<{
+                migrationDirectory: string;
+                runtimeWorkdir: string;
+                image: string;
+                database: string;
+                user: string;
+            }> | null;
+            baseline: Readonly<{
+                artifactDirectory: string;
+                sanitizationPolicy: string;
+            }>;
+            containerRuntime: Readonly<{
+                autoStartColima: boolean;
+            }>;
+            cleanup: Readonly<{
+                retainBaselineGenerations: number;
+            }>;
+            preparation: Readonly<{
+                sourcePolicy: string;
+                privacyKey: string;
+                batchRows: number;
+                maximumRows: number;
+                maximumBytes: number;
+                diskHeadroomBytes: number;
+            }> | null;
+            runtimePolicy: string | null;
+            identityPolicy: string | null;
+            dependentTargets: readonly Readonly<{
+                name: string;
+                configPath: string;
+                prepareCommand: string | null;
+            }>[];
+            application: Readonly<{
+                startCommand: string;
+                proofCommand: string;
+                environmentFile: string;
+                environmentVariables: Readonly<Record<string, string>>;
+                readiness: Readonly<{
+                    url: string;
+                    expectedStatus: number;
+                    timeoutSeconds: number;
+                }> | null;
+                httpProofs: readonly Readonly<{
+                    name: string;
+                    kind: "positive" | "negative";
+                    url: string;
+                    method: string;
+                    expectedStatus: number;
+                    json: Readonly<{
+                        path: readonly string[];
+                        equals?: unknown;
+                        notEquals?: unknown;
+                        minimumItems?: number;
+                    }> | null;
+                }>[];
+                runtimeAdapter: string | null;
+            }>;
+            runtime: Readonly<{
+                target: "postgresql" | "supabase";
+                applicationUrl: string;
+                projectId: string;
+                ports: Readonly<{
+                    api?: number;
+                    database: number;
+                    studio?: number;
+                }>;
+            }>;
+            safety: Readonly<{
+                allowedHosts: readonly string[];
+                blockedEnvironmentVariables: readonly string[];
+                authenticationProviders: readonly string[];
+                hostedAccess: "disabled";
+                outboundNetwork: "deny";
+            }>;
+            verification: Readonly<{
+                commands: readonly string[];
+            }>;
+        }>;
+        configPath: string;
+        projectRoot: string;
+        paths: Readonly<{
+            artifactDirectory: string;
+            applicationEnvironment: string;
+            migrationDirectory: string;
+            rehearsalConfig: string | null;
+            runtimeWorkdir: string;
+            serviceEnvironment: string | null;
+            sanitizationPolicy: string;
+            sourcePolicy: string | null;
+            privacyKey: string | null;
+            runtimePolicy: string | null;
+            identityPolicy: string | null;
+            supabaseWorkdir: string | null;
+            runtimeAdapter: string | null;
+        }>;
+    }>;
+    topology: Readonly<{
+        projectRoot: string;
+        primary: RuntimeTopologyTarget;
+        dependents: readonly RuntimeTopologyTarget[];
+        targets: readonly RuntimeTopologyTarget[];
+    }>;
+    plan: {
+        review: {
+            planVersion: number;
+            operation: string;
+            currentBaseline: string;
+            source: {
+                targetFingerprint: string;
+                accessPlanDigest: string;
+                readerExpiresAt: string;
+                sourcePolicySha256: string;
+                privacyPolicySha256: string | null;
+            };
+            runtimeConfigurations: {
+                target: string;
+                configSha256: string | null;
+                runtimePolicySha256: string | null;
+                runtimeAdapterSha256: string | null;
+                localServiceConfigSha256: string | null;
+            }[];
+            runtimeTargets: string[];
+            dependentPreparations: {
+                target: string;
+                command: string;
+            }[];
+            retention: {
+                generations: number;
+                removeAfterReplacement: string[];
+                keepFromCurrent: string[];
+            };
+            steps: string[];
+        };
+        digest: string;
+    };
+}>;
+export declare const createRefreshWorkflow: ({ runRuntimeStack, prepareDependentTargets, topologyCommandEnvironment, buildPlan, refreshBaseline, }: {
+    runRuntimeStack: (input: {
+        command: "reset";
+        flags: RehearsalCliFlags;
+        planOptions: RehearsalConfigPathOptions;
+    }) => Promise<{
+        runtime: unknown;
+        topology: RuntimeTopology;
+    }>;
+    prepareDependentTargets: (input: {
+        topology: RuntimeTopology;
+        environment: NodeJS.ProcessEnv;
+    }) => unknown[];
+    topologyCommandEnvironment: (topology: RuntimeTopology) => NodeJS.ProcessEnv;
+    buildPlan?: (options: RehearsalConfigPathOptions) => Promise<RefreshPlanContext>;
+    refreshBaseline?: typeof runSourceBaselineRefresh;
+}) => ({ flags, planOptions }: SourceCommandInput) => Promise<{
+    mode: "preview";
+    plan: {
+        review: {
+            planVersion: number;
+            operation: string;
+            currentBaseline: string;
+            source: {
+                targetFingerprint: string;
+                accessPlanDigest: string;
+                readerExpiresAt: string;
+                sourcePolicySha256: string;
+                privacyPolicySha256: string | null;
+            };
+            runtimeConfigurations: {
+                target: string;
+                configSha256: string | null;
+                runtimePolicySha256: string | null;
+                runtimeAdapterSha256: string | null;
+                localServiceConfigSha256: string | null;
+            }[];
+            runtimeTargets: string[];
+            dependentPreparations: {
+                target: string;
+                command: string;
+            }[];
+            retention: {
+                generations: number;
+                removeAfterReplacement: string[];
+                keepFromCurrent: string[];
+            };
+            steps: string[];
+        };
+        digest: string;
+    };
+    refreshed?: never;
+    runtime?: never;
+    preparations?: never;
+    cleanup?: never;
+} | {
+    mode: "written";
+    plan: {
+        review: {
+            planVersion: number;
+            operation: string;
+            currentBaseline: string;
+            source: {
+                targetFingerprint: string;
+                accessPlanDigest: string;
+                readerExpiresAt: string;
+                sourcePolicySha256: string;
+                privacyPolicySha256: string | null;
+            };
+            runtimeConfigurations: {
+                target: string;
+                configSha256: string | null;
+                runtimePolicySha256: string | null;
+                runtimeAdapterSha256: string | null;
+                localServiceConfigSha256: string | null;
+            }[];
+            runtimeTargets: string[];
+            dependentPreparations: {
+                target: string;
+                command: string;
+            }[];
+            retention: {
+                generations: number;
+                removeAfterReplacement: string[];
+                keepFromCurrent: string[];
+            };
+            steps: string[];
+        };
+        digest: string;
+    };
+    refreshed: {
+        generationId: string;
+        manifest: import("../baseline/artifact.mjs").BaselineManifest;
+        estimate: Readonly<import("../source/baseline.mjs").ExportEstimate>;
+    };
+    runtime: unknown;
+    preparations: unknown[];
+    cleanup: {
+        state: string;
+        removed: string[];
+        remaining?: never;
+    } | {
+        removed?: never;
+        state: string;
+        remaining: number;
+    };
+}>;
+export {};