@rehearsal-db/core 0.1.0-beta.14 → 0.1.0-beta.16

package/CHANGELOG.md

@@ -5,6 +5,53 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## Unreleased
 
+### Changed
+
+- The CLI now routes guided and scripted requests through focused typed command
+  handlers and one result/output contract. The executable retains only process
+  lifecycle, project locking, guided-loop coordination, and top-level error handling;
+  command-session caches no longer live in public parsed flags.
+- Configuration now passes through separate discovery, raw-schema validation,
+  normalization, project-root path resolution, project detection, and starter-rendering
+  modules behind the existing import path. Public declarations come from the same
+  TypeScript source, including the new `NormalizedRehearsalConfig` type.
+- Installed-consumer verification now shares one scenario catalog, artifact installer,
+  isolated workspace boundary, process boundary, and persistent application-session
+  helper. The complete release gate runs every scenario against one immutable tarball
+  and records its exact version, SHA-256, tool environment, commands, timings, and
+  results.
+- Identity policy validation, deterministic claim planning, SQL generation, local Auth
+  lookup, pure verification, and transactional execution now live in separate typed
+  stages behind the unchanged public claim API. Generated reference SQL is independently
+  testable, while only the executor can mutate the local database or Storage runtime.
+- PostgreSQL and Supabase now share one typed runtime lifecycle engine for command
+  dispatch, active-baseline loading, migration confirmation and receipts, runtime
+  markers, and rollback. Candidate receipts are bound to their exact database target,
+  while each driver retains its own ownership proof and database-specific behavior.
+- Privacy policy types, recipe normalization, dependency validation, deterministic
+  transforms, structured JSON, rule dispatch, row execution, and key handling now live
+  in focused typed stages behind the unchanged public privacy import. An explicit closed
+  registry covers every supported action and derivation without widening policy v2.
+
+## [0.1.0-beta.15] - 2026-10-08
+
+### Added
+
+- A strict, no-emit TypeScript gate now checks the first shared runtime utilities and
+  verifies that consumers can compile against Rehearsal's public configuration types.
+- The documentation site now explains the supported TypeScript surface with examples
+  that are compiled and checked against their rendered documentation source.
+- All shipped implementation and executable-helper source now uses TypeScript. Clean
+  builds emit Node-compatible ESM and declarations into the reviewed package boundary,
+  and tests exercise that compiled output rather than an alternate source path.
+- The published build omits repository-only JavaScript source maps while retaining
+  runtime JavaScript and declarations, keeping the installed package compact.
+
+### Fixed
+
+- Packed onboarding chooses an available local port block for preserved configuration
+  fixtures, so unrelated running Rehearsal projects cannot make the isolation test fail.
+
 ## [0.1.0-beta.14] - 2026-10-05
 
 ### Added
@@ -465,7 +512,10 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
   publication uses short-lived trusted OIDC, and every release tag must already exist on
   protected `main`.
 
-[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.12...HEAD
+[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.15...HEAD
+[0.1.0-beta.15]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.14...v0.1.0-beta.15
+[0.1.0-beta.14]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.13...v0.1.0-beta.14
+[0.1.0-beta.13]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.12...v0.1.0-beta.13
 [0.1.0-beta.12]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.11...v0.1.0-beta.12
 [0.1.0-beta.11]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.10...v0.1.0-beta.11
 [0.1.0-beta.10]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-beta.9...v0.1.0-beta.10

package/README.md

@@ -145,6 +145,7 @@ Reference:
 
 - [CLI commands](docs/commands.md)
 - [Configuration](docs/configuration.md)
+- [TypeScript types](docs/typescript.md)
 - [Baselines](docs/baselines.md)
 - [Sanitization](docs/sanitization.md)
 - [Security model](docs/security-model.md)

package/dist/package.json

@@ -0,0 +1,101 @@
+{
+    "name": "@rehearsal-db/core",
+    "version": "0.1.0-beta.16",
+    "private": false,
+    "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Ddupasquier/rehearsal-db.git"
+    },
+    "bugs": {
+        "url": "https://github.com/Ddupasquier/rehearsal-db/issues"
+    },
+    "homepage": "https://ddupasquier.github.io/rehearsal-db/",
+    "publishConfig": {
+        "access": "public",
+        "tag": "beta",
+        "provenance": true
+    },
+    "type": "module",
+    "engines": {
+        "node": "^22.0.0 || ^24.0.0 || ^26.0.0"
+    },
+    "bin": {
+        "rehearsal": "dist/src/cli/rehearsal.mjs"
+    },
+    "exports": {
+        ".": {
+            "types": "./types/configuration.d.mts",
+            "import": "./dist/src/index.mjs"
+        },
+        "./baseline": "./dist/src/baseline/artifact.mjs",
+        "./baseline-builder": "./dist/src/baseline/builder.mjs",
+        "./diagnostics": "./dist/src/shared/diagnostics.mjs",
+        "./migrations": "./dist/src/runtime/migration_history.mjs",
+        "./process-environment": "./dist/src/shared/process_environment.mjs",
+        "./privacy": "./dist/src/baseline/privacy_engine.mjs",
+        "./schema": "./dist/src/baseline/schema_snapshot.mjs",
+        "./service-environment": "./dist/src/runtime/service_environment.mjs",
+        "./source-access": "./dist/src/source/access.mjs"
+    },
+    "files": [
+        "dist",
+        "types",
+        "docs/*.md",
+        "README.md",
+        "BENCHMARKS.md",
+        "CHANGELOG.md",
+        "SECURITY.md",
+        "COMPATIBILITY.md",
+        "SUPPORT.md",
+        "LICENSE"
+    ],
+    "scripts": {
+        "postinstall": "node dist/scripts/install/create_root_config.mjs",
+        "prepack": "npm run build",
+        "build": "node scripts/build/clean.mjs && tsc --project tsconfig.build.json",
+        "docs:build": "node scripts/docs/build.mjs",
+        "docs:preview": "node scripts/docs/serve.mjs",
+        "test": "npm run build && vitest run",
+        "test:unit": "npm run build && vitest run tests/unit",
+        "test:integration": "npm run build && vitest run tests/integration tests/contracts",
+        "test:docs": "npm run build && vitest run tests/contracts/documentationCommands.test.mjs",
+        "test:fixture": "npm run build && node scripts/verification/run_scenario.mjs supabase",
+        "test:fixture:postgresql": "npm run build && node scripts/verification/run_scenario.mjs postgresql",
+        "test:fixture:dependent": "npm run build && node scripts/verification/run_scenario.mjs dependent-target",
+        "test:fixture:onboarding": "npm run build && node scripts/verification/run_scenario.mjs onboarding",
+        "test:fixture:typescript": "npm run build && node scripts/verification/run_scenario.mjs typescript",
+        "test:fixture:standalone": "npm run build && node scripts/verification/run_scenario.mjs standalone",
+        "test:fixture:privacy": "npm run build && node scripts/verification/run_scenario.mjs privacy",
+        "release:verify": "node scripts/verification/release_gate.mjs",
+        "check": "npm run check:syntax && npm run typecheck && npm run test && npm run docs:build && npm run format:check && npm run package:audit",
+        "check:syntax": "find scripts tests -type f -name '*.mjs' -exec node --check {} +",
+        "typecheck": "npm run build && tsc --project tsconfig.json",
+        "format": "prettier --write .",
+        "format:check": "prettier --check .",
+        "package:audit": "node scripts/verification/audit_package.mjs"
+    },
+    "keywords": [
+        "postgresql",
+        "supabase",
+        "migration",
+        "testing",
+        "database"
+    ],
+    "license": "MIT",
+    "dependencies": {
+        "@clack/prompts": "^1.8.1",
+        "pg": "^8.23.1"
+    },
+    "devDependencies": {
+        "@fontsource-variable/dm-sans": "^5.3.0",
+        "@fontsource-variable/fraunces": "^5.3.0",
+        "@lydell/node-pty": "^1.2.0-beta.15",
+        "@types/node": "22.20.5",
+        "@types/pg": "^8.23.1",
+        "marked": "^18.0.14",
+        "prettier": "^3.9.6",
+        "typescript": "7.0.2",
+        "vitest": "^5.0.2"
+    }
+}

package/dist/scripts/install/create_root_config.d.mts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+/** Create safe project-root Rehearsal scaffolding during a local install. */
+export {};

package/dist/scripts/install/create_root_config.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/** Create safe project-root Rehearsal scaffolding during a local install. */
+import { fileURLToPath } from "node:url";
+import { createInstalledRehearsalScaffold, renderInstalledRehearsalScaffold, } from "../../src/project/install_scaffold.mjs";
+const packageRoot = fileURLToPath(new URL("../../..", import.meta.url));
+try {
+    const result = await createInstalledRehearsalScaffold({ packageRoot });
+    console.log(renderInstalledRehearsalScaffold(result));
+}
+catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`Rehearsal could not safely create project files during installation: ${message}\nNext: run npx rehearsal from the application directory.`);
+}

package/dist/scripts/runtime/manage_database.d.mts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * Purpose: Select the configured database runtime and forward the requested
+ * lifecycle action to its isolated driver.
+ */
+export {};

package/{scripts → dist/scripts}/runtime/manage_database.mjs

@@ -3,16 +3,14 @@
  * Purpose: Select the configured database runtime and forward the requested
  * lifecycle action to its isolated driver.
  */
-
 import { loadRehearsalConfig } from "../../src/project/configuration.mjs";
-import {
-  parseRuntimeInvocation,
-  runRuntimeTarget,
-} from "../../src/targets/target.mjs";
-
+import { parseRuntimeInvocation } from "../../src/targets/target.mjs";
+import { runRuntimeTarget } from "../../src/targets/driver.mjs";
 const invocation = parseRuntimeInvocation();
 const { config } = await loadRehearsalConfig({
-  projectRoot: process.cwd(),
-  configPath: invocation.configPath,
+    projectRoot: process.cwd(),
+    ...(invocation.configPath === undefined
+        ? {}
+        : { configPath: invocation.configPath }),
 });
 await runRuntimeTarget(config.runtime.target);

package/dist/src/application/session.d.mts

@@ -0,0 +1,96 @@
+/** Launch ordinary application commands against verified local runtime files. */
+import { spawn } from "node:child_process";
+import type { EventEmitter } from "node:events";
+declare const SESSION_SIGNALS: string[];
+type SessionSignal = (typeof SESSION_SIGNALS)[number];
+export interface ApplicationReadiness {
+    readonly url: string;
+    readonly expectedStatus?: number;
+    readonly timeoutSeconds?: number;
+}
+export interface ApplicationSession {
+    readonly pid: number | undefined;
+    readonly ready: Readonly<{
+        url: string;
+        status: number;
+    }>;
+    readonly stop: () => Promise<void>;
+    readonly wait: () => Promise<ChildExit>;
+    readonly diagnostics: () => ApplicationDiagnostics;
+}
+export interface ApplicationDiagnostics {
+    readonly stdoutBytes: number;
+    readonly stderrBytes: number;
+}
+interface ChildExit {
+    readonly status: number | null;
+    readonly signal: NodeJS.Signals | null;
+}
+interface SessionInput {
+    readonly isTTY?: boolean;
+    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+}
+interface EnvironmentInput {
+    readonly files: Readonly<Record<string, string>> & {
+        readonly primary: string;
+    };
+    readonly mappings: Readonly<Record<string, string>>;
+}
+interface HttpJsonAssertion {
+    readonly path: readonly string[];
+    readonly equals?: unknown;
+    readonly notEquals?: unknown;
+    readonly minimumItems?: number;
+}
+export interface HttpProofCheck {
+    readonly name: string;
+    readonly kind: "positive" | "negative";
+    readonly url: string;
+    readonly method?: string;
+    readonly expectedStatus: number;
+    readonly timeoutMs?: number;
+    readonly json?: HttpJsonAssertion | null;
+}
+type SignalTarget = Pick<EventEmitter, "prependListener" | "removeListener">;
+export declare const buildApplicationEnvironment: ({ files, mappings, }: EnvironmentInput) => Promise<Record<string, string>>;
+export declare const summarizeProjectCommandFailure: ({ error, status, signal, stdout, stderr, stdoutByteCount, stderrByteCount, }: {
+    error?: NodeJS.ErrnoException;
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    stdout?: string;
+    stderr?: string;
+    stdoutByteCount?: number;
+    stderrByteCount?: number;
+}) => string;
+export declare const startApplicationSession: ({ command, cwd, files, mappings, readiness, inheritedEnvironment, spawnImplementation, fetchImplementation, signalTarget, }: EnvironmentInput & {
+    command: string;
+    cwd: string;
+    readiness: ApplicationReadiness;
+    inheritedEnvironment?: NodeJS.ProcessEnv;
+    spawnImplementation?: typeof spawn;
+    fetchImplementation?: typeof fetch;
+    signalTarget?: SignalTarget;
+}) => Promise<ApplicationSession>;
+/**
+ * Keep a ready application session attached until the user interrupts it.
+ * The child process group is always stopped before this function returns.
+ */
+export declare const holdApplicationSession: ({ session, signalTarget, input, onReady, }: {
+    session: ApplicationSession;
+    signalTarget?: SignalTarget;
+    input?: SessionInput;
+    onReady?: (ready: ApplicationSession["ready"]) => void;
+}) => Promise<Readonly<{
+    signal: SessionSignal;
+    diagnostics: ApplicationDiagnostics;
+}>>;
+export declare const runHttpProofs: ({ checks, fetchImplementation, }: {
+    checks: readonly HttpProofCheck[];
+    fetchImplementation?: typeof fetch;
+}) => Promise<readonly Readonly<{
+    name: string;
+    kind: "positive" | "negative";
+    status: number;
+}>[]>;
+export {};