@rehearsal-db/core 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/src/runtime/cleanup.mjs

@@ -0,0 +1,311 @@
+/**
+ * Purpose: Preview and apply narrowly scoped Rehearsal cleanup without global
+ * Docker pruning or deletion of unowned database resources.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { stat } from "node:fs/promises";
+import { planBaselineGenerationPrune, pruneBaselineGenerations, } from "../baseline/artifact.mjs";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
+import { createCleanProcessEnvironment } from "../shared/process_environment.mjs";
+const hasErrorCode = (error, code) => typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    error.code === code;
+const SUPABASE_IMAGE_PREFIX = "public.ecr.aws/supabase/";
+const commandResult = (command, args, { projectRoot }) => spawnSync(command, args, {
+    cwd: projectRoot,
+    encoding: "utf8",
+    env: createCleanProcessEnvironment(),
+    maxBuffer: 32 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"],
+});
+const runDocker = (args, { projectRoot, allowFailure = false, }) => {
+    const result = commandResult("docker", args, { projectRoot });
+    if (!allowFailure && (result.error || result.status !== 0)) {
+        const detail = [result.stdout, result.stderr]
+            .filter(Boolean)
+            .join("\n")
+            .trim();
+        throw new Error(`docker ${args.join(" ")} failed${detail ? `:\n${detail}` : "."}`);
+    }
+    return result;
+};
+const nonEmptyLines = (value) => String(value ?? "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+const dockerAvailable = (projectRoot) => runDocker(["info"], { projectRoot, allowFailure: true }).status === 0;
+export const parsePosixDiskUsage = (output) => {
+    const columns = nonEmptyLines(output).at(-1)?.split(/\s+/u) ?? [];
+    if (columns.length < 6)
+        return null;
+    const totalKiB = Number(columns[1]);
+    const usedKiB = Number(columns[2]);
+    const availableKiB = Number(columns[3]);
+    const usedPercent = Number.parseInt(columns[4], 10);
+    if (![totalKiB, usedKiB, availableKiB, usedPercent].every(Number.isFinite)) {
+        return null;
+    }
+    return {
+        totalBytes: totalKiB * 1024,
+        usedBytes: usedKiB * 1024,
+        availableBytes: availableKiB * 1024,
+        usedPercent,
+    };
+};
+const inspectContainerDisk = (projectRoot) => {
+    const context = commandResult("docker", ["context", "show"], {
+        projectRoot,
+    });
+    if (context.status !== 0 || context.stdout.trim() !== "colima")
+        return null;
+    const result = commandResult("colima", ["ssh", "--", "df", "-Pk", "/var/lib/docker"], { projectRoot });
+    const usage = result.status === 0 ? parsePosixDiskUsage(result.stdout) : null;
+    return usage ? { backend: "colima", ...usage } : null;
+};
+const inspectDockerUsage = (projectRoot) => {
+    if (!dockerAvailable(projectRoot)) {
+        return { available: false, resources: [], disk: null };
+    }
+    const result = runDocker(["system", "df", "--format", "{{json .}}"], {
+        projectRoot,
+    });
+    return {
+        available: true,
+        resources: nonEmptyLines(result.stdout).map((line) => JSON.parse(line)),
+        disk: inspectContainerDisk(projectRoot),
+    };
+};
+const inspectUsedImageIds = (projectRoot) => {
+    const containers = nonEmptyLines(runDocker(["container", "ls", "--all", "--quiet"], { projectRoot }).stdout);
+    if (containers.length === 0)
+        return new Set();
+    return new Set(nonEmptyLines(runDocker(["container", "inspect", "--format", "{{.Image}}", ...containers], { projectRoot }).stdout));
+};
+const splitImageTag = (value) => {
+    const separator = value.lastIndexOf(":");
+    if (separator <= value.lastIndexOf("/"))
+        return null;
+    return {
+        repository: value.slice(0, separator),
+        tag: value.slice(separator + 1),
+    };
+};
+export const selectOlderUnusedSupabaseImages = ({ images, usedImageIds, }) => {
+    const byRepository = new Map();
+    for (const image of images) {
+        for (const fullTag of image.RepoTags ?? []) {
+            const parsed = splitImageTag(fullTag);
+            if (!parsed?.repository.startsWith(SUPABASE_IMAGE_PREFIX))
+                continue;
+            const entries = byRepository.get(parsed.repository) ?? [];
+            entries.push({
+                id: image.Id,
+                createdAt: image.Created,
+                bytes: image.Size,
+                fullTag,
+            });
+            byRepository.set(parsed.repository, entries);
+        }
+    }
+    const candidatesById = new Map();
+    for (const entries of byRepository.values()) {
+        const newestId = [...entries].sort((left, right) => Date.parse(right.createdAt) - Date.parse(left.createdAt))[0]?.id;
+        for (const entry of entries) {
+            if (entry.id === newestId || usedImageIds.has(entry.id))
+                continue;
+            const existing = candidatesById.get(entry.id) ?? {
+                id: entry.id,
+                createdAt: entry.createdAt,
+                bytes: entry.bytes,
+                tags: [],
+            };
+            existing.tags.push(entry.fullTag);
+            candidatesById.set(entry.id, existing);
+        }
+    }
+    return [...candidatesById.values()]
+        .map((entry) => ({ ...entry, tags: [...new Set(entry.tags)].sort() }))
+        .sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+};
+const inspectUnusedImages = (projectRoot) => {
+    const imageIds = [
+        ...new Set(nonEmptyLines(runDocker(["image", "ls", "--quiet", "--no-trunc"], {
+            projectRoot,
+        }).stdout)),
+    ];
+    if (imageIds.length === 0)
+        return [];
+    const images = nonEmptyLines(runDocker(["image", "inspect", "--format", "{{json .}}", ...imageIds], {
+        projectRoot,
+    }).stdout).map((line) => JSON.parse(line));
+    return selectOlderUnusedSupabaseImages({
+        images,
+        usedImageIds: inspectUsedImageIds(projectRoot),
+    });
+};
+const runtimeDetected = async ({ config, paths, projectRoot, }) => {
+    try {
+        await stat(paths.runtimeWorkdir);
+        return true;
+    }
+    catch (error) {
+        if (!hasErrorCode(error, "ENOENT"))
+            throw error;
+    }
+    if (!dockerAvailable(projectRoot))
+        return false;
+    if (config.runtime.target === "postgresql") {
+        const containers = runDocker([
+            "container",
+            "ls",
+            "--all",
+            "--filter",
+            `label=com.rehearsal-db.project=${config.runtime.projectId}`,
+            "--quiet",
+        ], { projectRoot });
+        const volumes = runDocker([
+            "volume",
+            "ls",
+            "--filter",
+            `label=com.rehearsal-db.project=${config.runtime.projectId}`,
+            "--quiet",
+        ], { projectRoot });
+        return (nonEmptyLines(containers.stdout).length > 0 ||
+            nonEmptyLines(volumes.stdout).length > 0);
+    }
+    const containers = runDocker([
+        "container",
+        "ls",
+        "--all",
+        "--filter",
+        `label=com.supabase.cli.project=${config.runtime.projectId}`,
+        "--quiet",
+    ], { projectRoot });
+    const volumes = nonEmptyLines(runDocker(["volume", "ls", "--format", "{{.Name}}"], { projectRoot })
+        .stdout);
+    return (nonEmptyLines(containers.stdout).length > 0 ||
+        volumes.some((name) => name.endsWith(`_${config.runtime.projectId}`)));
+};
+const inspectBaselineCleanup = async ({ artifactRoot, retain, }) => {
+    try {
+        return {
+            available: true,
+            ...(await planBaselineGenerationPrune({ artifactRoot, retain })),
+        };
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT")) {
+            return { available: false, retained: [], removed: [] };
+        }
+        throw error;
+    }
+};
+const cleanupIdentity = (plan) => ({
+    projectId: plan.projectId,
+    retainBaselineGenerations: plan.retainBaselineGenerations,
+    baselineGenerations: plan.baselines.removed,
+    runtime: plan.runtime.included && plan.runtime.detected,
+    images: plan.images.candidates.map(({ id, tags }) => ({ id, tags })),
+});
+const cleanupDigest = (plan) => createHash("sha256")
+    .update(JSON.stringify(cleanupIdentity(plan)))
+    .digest("hex");
+export const planRehearsalCleanup = async ({ projectRoot = process.cwd(), configPath, includeRuntime = false, includeImages = false, inspection = { inspectDockerUsage, runtimeDetected }, } = {}) => {
+    const loaded = await loadRehearsalConfig({
+        projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+    });
+    const docker = inspection.inspectDockerUsage(loaded.projectRoot);
+    const baselines = await inspectBaselineCleanup({
+        artifactRoot: loaded.paths.artifactDirectory,
+        retain: loaded.config.cleanup.retainBaselineGenerations,
+    });
+    const images = {
+        requested: includeImages,
+        inspected: includeImages && docker.available,
+        candidates: includeImages && docker.available
+            ? inspectUnusedImages(loaded.projectRoot)
+            : [],
+    };
+    const plan = {
+        project: loaded.config.project.name,
+        projectId: loaded.config.runtime.projectId,
+        target: loaded.config.runtime.target,
+        retainBaselineGenerations: loaded.config.cleanup.retainBaselineGenerations,
+        baselines,
+        runtime: {
+            included: includeRuntime,
+            detected: await inspection.runtimeDetected({ ...loaded }),
+        },
+        images,
+        docker,
+    };
+    return Object.freeze({ ...plan, digest: cleanupDigest(plan) });
+};
+const removePlannedImages = ({ candidates, projectRoot, }) => {
+    if (candidates.length === 0)
+        return [];
+    const usedImageIds = inspectUsedImageIds(projectRoot);
+    const removed = [];
+    for (const candidate of candidates) {
+        if (usedImageIds.has(candidate.id)) {
+            throw new Error(`Cleanup stopped because a container began using ${candidate.id}. Preview the cleanup again.`);
+        }
+        for (const tag of candidate.tags) {
+            const inspection = runDocker(["image", "inspect", "--format", "{{.Id}}", tag], { projectRoot, allowFailure: true });
+            if (inspection.status !== 0)
+                continue;
+            if (inspection.stdout.trim() !== candidate.id) {
+                throw new Error(`Cleanup stopped because ${tag} changed after the preview. Preview the cleanup again.`);
+            }
+            runDocker(["image", "rm", tag], { projectRoot });
+            removed.push(tag);
+        }
+    }
+    return removed;
+};
+export const applyRehearsalCleanup = async ({ plan, confirmation, projectRoot = process.cwd(), configPath, removeRuntime = async () => undefined, inspection, } = {}) => {
+    if (!plan || confirmation !== plan.digest) {
+        throw new Error("Cleanup requires the exact --confirm-cleanup digest from a fresh preview. Nothing was removed.");
+    }
+    const refreshed = await planRehearsalCleanup({
+        projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+        includeRuntime: plan.runtime.included,
+        includeImages: plan.images.inspected,
+        ...(inspection ? { inspection } : {}),
+    });
+    if (refreshed.digest !== plan.digest) {
+        throw new Error("Cleanup targets changed after the preview. Nothing was removed; preview the cleanup again.");
+    }
+    if (plan.images.requested && !refreshed.images.inspected) {
+        throw new Error("Docker is unavailable, so Rehearsal cannot verify or remove unused images.");
+    }
+    if (refreshed.runtime.included && refreshed.runtime.detected) {
+        await removeRuntime();
+    }
+    const loaded = await loadRehearsalConfig({
+        projectRoot,
+        ...(configPath === undefined ? {} : { configPath }),
+    });
+    const baselines = refreshed.baselines.available
+        ? await pruneBaselineGenerations({
+            artifactRoot: loaded.paths.artifactDirectory,
+            retain: refreshed.retainBaselineGenerations,
+            expectedRemoved: refreshed.baselines.removed,
+        })
+        : { retained: [], removed: [] };
+    const images = removePlannedImages({
+        candidates: refreshed.images.candidates,
+        projectRoot: loaded.projectRoot,
+    });
+    return {
+        project: refreshed.project,
+        projectId: refreshed.projectId,
+        baselines,
+        runtimeRemoved: refreshed.runtime.included && refreshed.runtime.detected,
+        imagesRemoved: images,
+    };
+};

package/dist/src/runtime/migration_history.d.mts

@@ -0,0 +1,51 @@
+/**
+ * Purpose: Build and compare content-addressed application migration histories for
+ * Rehearsal without trusting timestamp-only migration alignment. Do not run directly;
+ * this module is reusable script infrastructure.
+ */
+export interface MigrationHistoryEntry {
+    version: string;
+    name: string;
+}
+export interface MigrationFileEntry extends MigrationHistoryEntry {
+    filename: string;
+    fileSha256: string;
+}
+export interface MigrationSourceEntry extends MigrationFileEntry {
+    content: string;
+}
+export interface MigrationLedgerEntry extends MigrationHistoryEntry {
+    statementCount: number;
+    statementSha256: string;
+}
+export interface MigrationReplayEntry extends MigrationFileEntry, MigrationLedgerEntry {
+}
+export interface MigrationReplayReceipt {
+    entries: MigrationReplayEntry[];
+    historySha256: string;
+}
+export declare const readMigrationFileInventory: (directory: URL) => Promise<MigrationFileEntry[]>;
+export declare const readMigrationSourceBundle: ({ directory, sourceLedger, }: {
+    directory: URL;
+    sourceLedger: readonly MigrationLedgerEntry[];
+}) => Promise<MigrationSourceEntry[]>;
+export declare const buildMigrationLedgerInventory: (rows: unknown, label?: string) => MigrationLedgerEntry[];
+export declare const createMigrationReplayReceipt: ({ files, ledger, }: {
+    files: readonly MigrationFileEntry[];
+    ledger: readonly MigrationLedgerEntry[];
+}) => MigrationReplayReceipt;
+export declare const compareSourceToReplay: ({ sourceLedger, replayReceipt, snapshotSchemaSha256, }: {
+    sourceLedger: readonly MigrationLedgerEntry[];
+    replayReceipt: MigrationReplayReceipt;
+    snapshotSchemaSha256?: string;
+}) => {
+    cutoff: string;
+    candidates: MigrationReplayEntry[];
+    candidateSha256: string;
+    historicalStatementDifferences: number;
+    snapshotSchemaSha256: string | null;
+};
+export declare const assertNoCrossDatabaseMigrationVersions: ({ applicationFiles, apiFiles, }: {
+    applicationFiles: readonly MigrationHistoryEntry[];
+    apiFiles: readonly MigrationHistoryEntry[];
+}) => void;

package/dist/src/runtime/migration_history.mjs

@@ -0,0 +1,170 @@
+/**
+ * Purpose: Build and compare content-addressed application migration histories for
+ * Rehearsal without trusting timestamp-only migration alignment. Do not run directly;
+ * this module is reusable script infrastructure.
+ */
+import { createHash } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
+const migrationNamePattern = /^(\d{14})_(.+)\.sql$/u;
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+const canonicalJson = (value) => `${JSON.stringify(value, null, "\t")}\n`;
+const normalizeStatement = (statement) => {
+    if (typeof statement !== "string") {
+        throw new Error("A Rehearsal migration ledger statement is not text.");
+    }
+    return statement.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+};
+const assertOrderedUniqueHistory = (entries, label) => {
+    const seen = new Set();
+    let previous = null;
+    for (const entry of entries) {
+        if (!/^\d{14}$/u.test(entry.version)) {
+            throw new Error(`${label} has an invalid migration version: ${entry.version}`);
+        }
+        if (seen.has(entry.version)) {
+            throw new Error(`${label} contains duplicate migration ${entry.version}.`);
+        }
+        if (previous !== null && entry.version <= previous) {
+            throw new Error(`${label} is not in strictly increasing migration order at ${entry.version}.`);
+        }
+        seen.add(entry.version);
+        previous = entry.version;
+    }
+    return entries;
+};
+export const readMigrationFileInventory = async (directory) => {
+    const names = (await readdir(directory))
+        .filter((name) => name.endsWith(".sql"))
+        .sort();
+    const entries = [];
+    for (const filename of names) {
+        const match = migrationNamePattern.exec(filename);
+        if (!match) {
+            throw new Error(`Invalid migration filename in ${directory}: ${filename}`);
+        }
+        const bytes = await readFile(new URL(filename, directory));
+        entries.push({
+            version: match[1],
+            name: match[2],
+            filename,
+            fileSha256: sha256(bytes),
+        });
+    }
+    return [...assertOrderedUniqueHistory(entries, "Migration files")];
+};
+export const readMigrationSourceBundle = async ({ directory, sourceLedger, }) => {
+    assertOrderedUniqueHistory(sourceLedger, "Source migration ledger");
+    const inventory = await readMigrationFileInventory(directory);
+    if (sourceLedger.length > inventory.length) {
+        throw new Error("The source migration history contains a version absent from local migration source.");
+    }
+    const bundle = [];
+    for (let index = 0; index < sourceLedger.length; index += 1) {
+        const source = sourceLedger[index];
+        const file = inventory[index];
+        if (source.version !== file.version || source.name !== file.name) {
+            throw new Error(`Source migration ${source.version}_${source.name} does not match local file ${file.filename}.`);
+        }
+        bundle.push({
+            ...file,
+            content: await readFile(new URL(file.filename, directory), "utf8"),
+        });
+    }
+    return bundle;
+};
+export const buildMigrationLedgerInventory = (rows, label = "Migration ledger") => {
+    if (!Array.isArray(rows) || rows.length === 0) {
+        throw new Error(`${label} is empty or unavailable.`);
+    }
+    const entries = rows.map((row) => {
+        if (!row ||
+            typeof row !== "object" ||
+            !("name" in row) ||
+            typeof row.name !== "string") {
+            throw new Error(`${label} contains an invalid row.`);
+        }
+        if (!("statements" in row) ||
+            !Array.isArray(row.statements) ||
+            row.statements.length === 0) {
+            throw new Error(`${label} migration ${"version" in row ? String(row.version) : "unknown"} has no applied statements.`);
+        }
+        const statements = row.statements.map(normalizeStatement);
+        return {
+            version: String("version" in row ? row.version : ""),
+            name: row.name,
+            statementCount: statements.length,
+            statementSha256: sha256(JSON.stringify(statements)),
+        };
+    });
+    return [...assertOrderedUniqueHistory(entries, label)];
+};
+export const createMigrationReplayReceipt = ({ files, ledger, }) => {
+    assertOrderedUniqueHistory(files, "Migration files");
+    assertOrderedUniqueHistory(ledger, "Replayed migration ledger");
+    if (files.length !== ledger.length) {
+        throw new Error(`Migration replay length mismatch: ${files.length} files but ${ledger.length} applied ledger rows.`);
+    }
+    const entries = files.map((file, index) => {
+        const applied = ledger[index];
+        if (file.version !== applied.version || file.name !== applied.name) {
+            throw new Error(`Migration replay mismatch at ${file.filename}: ledger contains ${applied.version}_${applied.name}.`);
+        }
+        return {
+            version: file.version,
+            name: file.name,
+            filename: file.filename,
+            fileSha256: file.fileSha256,
+            statementCount: applied.statementCount,
+            statementSha256: applied.statementSha256,
+        };
+    });
+    return {
+        entries,
+        historySha256: sha256(canonicalJson(entries)),
+    };
+};
+export const compareSourceToReplay = ({ sourceLedger, replayReceipt, snapshotSchemaSha256, }) => {
+    assertOrderedUniqueHistory(sourceLedger, "Source migration ledger");
+    if (!replayReceipt?.entries?.length || !replayReceipt.historySha256) {
+        throw new Error("The migration replay receipt is missing or invalid.");
+    }
+    if (sourceLedger.length > replayReceipt.entries.length) {
+        throw new Error("The source migration history contains a version absent from the reviewed replay.");
+    }
+    const snapshotBacked = snapshotSchemaSha256 !== undefined;
+    if (snapshotBacked && !/^[a-f0-9]{64}$/u.test(snapshotSchemaSha256)) {
+        throw new Error("The production schema snapshot receipt is invalid.");
+    }
+    let historicalStatementDifferences = 0;
+    for (let index = 0; index < sourceLedger.length; index += 1) {
+        const source = sourceLedger[index];
+        const replayed = replayReceipt.entries[index];
+        if (source.version !== replayed.version || source.name !== replayed.name) {
+            throw new Error(`Source migration history is not an exact replay prefix at ${source.version}_${source.name}.`);
+        }
+        if (source.statementCount !== replayed.statementCount ||
+            source.statementSha256 !== replayed.statementSha256) {
+            if (!snapshotBacked) {
+                throw new Error(`Applied statement content differs for migration ${source.version}_${source.name}.`);
+            }
+            historicalStatementDifferences += 1;
+        }
+    }
+    const candidates = replayReceipt.entries.slice(sourceLedger.length);
+    return {
+        cutoff: sourceLedger.at(-1).version,
+        candidates,
+        candidateSha256: sha256(canonicalJson(candidates)),
+        historicalStatementDifferences,
+        snapshotSchemaSha256: snapshotBacked ? snapshotSchemaSha256 : null,
+    };
+};
+export const assertNoCrossDatabaseMigrationVersions = ({ applicationFiles, apiFiles, }) => {
+    const applicationVersions = new Set(applicationFiles.map((entry) => entry.version));
+    const collisions = apiFiles
+        .map((entry) => entry.version)
+        .filter((version) => applicationVersions.has(version));
+    if (collisions.length) {
+        throw new Error(`Primary and secondary database migration versions collide: ${collisions.join(", ")}.`);
+    }
+};

package/dist/src/runtime/plan.d.mts

@@ -0,0 +1,134 @@
+/**
+ * Purpose: Build the immutable, audit-only Rehearsal execution plan and readiness
+ * report from project configuration and verified artifacts. Do not run directly;
+ * this module is reusable script infrastructure.
+ */
+import type { RehearsalConfigPathOptions } from "../project/configuration.mjs";
+export declare const buildRehearsalPlan: (options?: RehearsalConfigPathOptions) => Promise<{
+    config: {
+        schemaVersion: 1;
+        path: string;
+        project: string;
+    };
+    environment: {
+        target: "postgresql" | "supabase";
+        kind: string;
+        applicationUrl: string;
+        projectId: string;
+        ports: Readonly<{
+            api?: number;
+            database: number;
+            studio?: number;
+        }>;
+        hostedAccess: "disabled";
+        outboundNetwork: "deny";
+        authenticationProviders: readonly string[];
+        authenticationCallback: string | null;
+        barriers: string[];
+    };
+    baseline: {
+        rehearsalVersion: string;
+        formatVersion: 1 | 2;
+        generationId: string;
+        createdAt: string | null;
+        migrationCutoff: string;
+        migrationHistorySha256: string;
+        sanitizationPolicySha256: string;
+        dataSha256: string;
+        tableCount: number;
+        rowCount: number;
+        migrationCount: number;
+        verification: string;
+    };
+    migrations: {
+        representedCount: number;
+        candidateCount: number;
+        candidateSha256: string;
+        candidates: {
+            filename: string;
+            sha256: string;
+        }[];
+    };
+    execution: string[];
+    guarantee: string;
+    paths: {
+        artifactDirectory: string;
+        migrationDirectory: string;
+        sanitizationPolicy: string;
+    };
+}>;
+export declare const inspectRehearsalBaseline: (options?: RehearsalConfigPathOptions) => Promise<{
+    rehearsalVersion: string;
+    formatVersion: 1 | 2;
+    generationId: string;
+    createdAt: string | null;
+    migrationCutoff: string;
+    migrationHistorySha256: string;
+    sanitizationPolicySha256: string;
+    dataSha256: string;
+    tableCount: number;
+    rowCount: number;
+    migrationCount: number;
+    verification: string;
+    project: string;
+    provenance: {
+        configVersion: 1;
+        migrationCutoff: string;
+        sanitizationPolicySha256: string;
+    };
+    privacy: {
+        sourceRowsExposed: boolean;
+        sensitiveValuesIncludedInReport: boolean;
+    };
+}>;
+export declare const inspectRehearsalMigrations: (options?: RehearsalConfigPathOptions) => Promise<{
+    baselineGenerationId: string;
+    baselineCutoff: string;
+    candidateSha256: string;
+    migrations: {
+        version: string;
+        name: string;
+        filename: string;
+        sha256: string;
+        status: string;
+    }[];
+    definitions: {
+        represented_by_baseline: string;
+        applied_to_current_runtime: string;
+        candidate: string;
+        modified: string;
+        invalid: string;
+    };
+}>;
+export declare const runRehearsalDoctor: (options?: RehearsalConfigPathOptions) => Promise<{
+    state: string;
+    checks: {
+        id: string;
+        label: string;
+        status: string;
+        detail: string;
+        remediation: string;
+    }[];
+    ambientHostedVariables?: never;
+} | {
+    state: string;
+    checks: ({
+        id: string;
+        label: string;
+        status: string;
+        detail: unknown;
+        durationMs: number;
+        remediation?: never;
+    } | {
+        id: string;
+        label: string;
+        status: string;
+        detail: string;
+        remediation: string;
+        durationMs: number;
+    })[];
+    ambientHostedVariables: {
+        presentButQuarantined: string[];
+        note: string;
+    };
+}>;