@rehearsal-db/core 0.1.0-beta.15 → 0.1.0-beta.17

package/dist/src/cli/identity_command_handlers.mjs

@@ -0,0 +1,239 @@
+/** Provider-neutral copied-account planning, application, and guided connection. */
+import { readFile } from "node:fs/promises";
+import { parseEnv } from "node:util";
+import * as prompts from "@clack/prompts";
+import { holdApplicationSession } from "../application/session.mjs";
+import { runApplicationSessionTask } from "../application/interactive_task.mjs";
+import { applyIdentityClaim } from "../identity/claim.mjs";
+import { waitForIdentityConnection } from "../identity/connect.mjs";
+import { createSupabaseStorageTransfer } from "../identity/storage.mjs";
+import { exactCommands, renderedCommand, textCommand, } from "./command_contract.mjs";
+import { renderIdentityConnection } from "./identity_renderer.mjs";
+import { renderIdentityPlan } from "./renderers.mjs";
+import { isHumanTerminal, promptForConfirmation, promptForSelection, useStyledPrompts, } from "./terminal.mjs";
+const loadIdentityRuntime = async (loaded) => {
+    const environment = parseEnv(await readFile(loaded.paths.applicationEnvironment, "utf8"));
+    if (!environment.DATABASE_URL) {
+        throw new Error("The local runtime environment has no DATABASE_URL.");
+    }
+    return environment;
+};
+const storageTransferFor = ({ plan, environment, }) => {
+    const needsStorageTransfer = plan.identity.assets.some((asset) => asset.rewritePath);
+    if (!needsStorageTransfer)
+        return undefined;
+    if (!environment.SUPABASE_URL || !environment.SUPABASE_SERVICE_ROLE_KEY) {
+        throw new Error("Identity asset transfer requires local Supabase URL and service-role credentials.");
+    }
+    return createSupabaseStorageTransfer({
+        url: environment.SUPABASE_URL,
+        serviceRoleKey: environment.SUPABASE_SERVICE_ROLE_KEY,
+    });
+};
+export const createIdentityCommandHandlers = ({ loadIdentityClaimPlan, loadIdentityPolicy, startRuntimeApplication, }) => [
+    exactCommands("identity", ["identity plan", "identity claim", "identity connect"], async ({ command, flags, planOptions, guided, state }) => {
+        if (command === "identity connect") {
+            if (!isHumanTerminal(flags)) {
+                throw new Error("identity connect requires an interactive terminal. Scripts should keep using identity plan and identity claim.");
+            }
+            if (!flags.identityName) {
+                const { policy } = await loadIdentityPolicy({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (policy.identities.length === 1) {
+                    flags.identityName = policy.identities[0].name;
+                }
+                else {
+                    const selected = await promptForSelection({
+                        message: "Which copied account would you like to connect?",
+                        flags,
+                        options: policy.identities.map((identity) => ({
+                            label: identity.name,
+                            value: identity.name,
+                        })),
+                    });
+                    if (!selected) {
+                        return textCommand("COPIED ACCOUNT CONNECTION CANCELLED\nNothing was changed.");
+                    }
+                    flags.identityName = selected;
+                }
+            }
+            const initial = await loadIdentityClaimPlan({
+                flags,
+                planOptions,
+                session: state,
+            });
+            const initialEnvironment = await loadIdentityRuntime(initial.loaded);
+            let active;
+            let reopened;
+            try {
+                active = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const observed = await runApplicationSessionTask({
+                    session: active.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            `Application: ${ready.url}`,
+                            "Sign in normally with the provider allowed by your reviewed identity policy.",
+                            "Rehearsal will continue when exactly one approved, verified local identity appears.",
+                            "It never reads your provider password, passkey, MFA secret, browser cookies, or session tokens.",
+                            "Press Ctrl+C to cancel or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "SIGN IN TO THE SANDBOX");
+                        }
+                        else {
+                            console.log(["", "SIGN IN TO THE SANDBOX", ...lines, ""].join("\n"));
+                        }
+                    },
+                    task: (signal) => waitForIdentityConnection({
+                        plan: initial.plan,
+                        connectionString: initialEnvironment.DATABASE_URL,
+                        signal,
+                    }),
+                });
+                if (!observed.completed) {
+                    if (guided && observed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return textCommand([
+                        "COPIED ACCOUNT CONNECTION CANCELLED",
+                        `Application stopped after ${observed.signal}.`,
+                        "Nothing was changed. The database runtime was preserved.",
+                    ].join("\n"));
+                }
+                const preview = observed.value;
+                if (preview.associated) {
+                    const closed = await holdApplicationSession({
+                        session: active.session,
+                        onReady: () => {
+                            const message = renderIdentityConnection({
+                                mode: "already-connected",
+                                preview,
+                            });
+                            if (useStyledPrompts(flags)) {
+                                prompts.note(message, "SANDBOX READY");
+                            }
+                            else {
+                                console.log(`\n${message}\n`);
+                            }
+                        },
+                    });
+                    if (guided && closed.signal === "SIGTSTP") {
+                        flags.exitGuidedSession = true;
+                    }
+                    return renderedCommand({
+                        data: {
+                            mode: "already-connected",
+                            preview,
+                            application: { stoppedBy: closed.signal },
+                        },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                await active.session.stop();
+                console.log(`\n${renderIdentityConnection({ mode: "preview", preview })}\n`);
+                const accepted = await promptForConfirmation("Connect my copied account using exactly this plan?", flags);
+                if (!accepted) {
+                    return renderedCommand({
+                        data: { mode: "cancelled", preview },
+                        render: ({ mode, preview: renderedPreview }) => renderIdentityConnection({ mode, preview: renderedPreview }),
+                    });
+                }
+                const refreshed = await loadIdentityClaimPlan({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                if (refreshed.plan.digest !== preview.planDigest) {
+                    throw new Error("The reviewed identity plan changed after sign-in. Nothing was changed; start the connection again.");
+                }
+                const refreshedEnvironment = await loadIdentityRuntime(refreshed.loaded);
+                const storageTransfer = storageTransferFor({
+                    plan: refreshed.plan,
+                    environment: refreshedEnvironment,
+                });
+                const result = await applyIdentityClaim({
+                    plan: refreshed.plan,
+                    confirmation: preview.planDigest,
+                    connectionString: refreshedEnvironment.DATABASE_URL,
+                    ...(storageTransfer === undefined ? {} : { storageTransfer }),
+                });
+                reopened = await startRuntimeApplication({
+                    flags,
+                    planOptions,
+                    session: state,
+                });
+                const closed = await holdApplicationSession({
+                    session: reopened.session,
+                    onReady: (ready) => {
+                        const lines = [
+                            renderIdentityConnection({
+                                mode: "connected",
+                                preview,
+                                result,
+                            }),
+                            "",
+                            `Application: ${ready.url}`,
+                            "The app is running again. Sign out and sign in once for fresh claims.",
+                            "Press Ctrl+C to close the app or Ctrl+Z to exit Rehearsal.",
+                        ];
+                        if (useStyledPrompts(flags)) {
+                            prompts.note(lines.join("\n"), "ACCOUNT CONNECTED");
+                        }
+                        else {
+                            console.log(["", ...lines, ""].join("\n"));
+                        }
+                    },
+                });
+                if (guided && closed.signal === "SIGTSTP") {
+                    flags.exitGuidedSession = true;
+                }
+                return renderedCommand({
+                    data: {
+                        mode: "connected",
+                        preview,
+                        result,
+                        application: { stoppedBy: closed.signal },
+                    },
+                    render: ({ mode, preview: renderedPreview, result: claimResult }) => renderIdentityConnection({
+                        mode,
+                        preview: renderedPreview,
+                        result: claimResult,
+                    }),
+                });
+            }
+            finally {
+                await active?.session.stop();
+                await reopened?.session.stop();
+            }
+        }
+        const { loaded, plan } = await loadIdentityClaimPlan({
+            flags,
+            planOptions,
+            session: state,
+        });
+        if (command === "identity plan" || !flags.identityConfirmation) {
+            const data = { mode: "preview", plan };
+            return renderedCommand({ data, render: renderIdentityPlan });
+        }
+        const runtimeEnvironment = await loadIdentityRuntime(loaded);
+        const storageTransfer = storageTransferFor({
+            plan,
+            environment: runtimeEnvironment,
+        });
+        const result = await applyIdentityClaim({
+            plan,
+            confirmation: flags.identityConfirmation,
+            connectionString: runtimeEnvironment.DATABASE_URL,
+            ...(storageTransfer === undefined ? {} : { storageTransfer }),
+        });
+        const data = { mode: "written", plan, result };
+        return renderedCommand({ data, render: renderIdentityPlan });
+    }),
+];

package/dist/src/cli/identity_renderer.d.mts

@@ -0,0 +1,8 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+import type { IdentityClaimResult } from "../identity/claim_contract.mjs";
+import type { IdentityConnectionPreview } from "../identity/connect.mjs";
+export declare const renderIdentityConnection: ({ mode, preview, result, }: {
+    mode: "preview" | "connected" | "already-connected" | "cancelled";
+    preview: IdentityConnectionPreview;
+    result?: IdentityClaimResult;
+}) => string;

package/dist/src/cli/identity_renderer.mjs

@@ -0,0 +1,33 @@
+/** Redacted terminal output for the interactive copied-account connection. */
+export const renderIdentityConnection = ({ mode, preview, result, }) => [
+    `COPIED ACCOUNT — ${mode.replaceAll("-", " ").toUpperCase()}`,
+    `Account label: ${preview.name}`,
+    `Verified provider: ${preview.provider}`,
+    `Data groups: ${preview.relationalGroups} relational; ${preview.nestedJsonGroups} nested JSON`,
+    `Images: ${preview.assetScopes} reviewed Storage scope${preview.assetScopes === 1 ? "" : "s"}; ${preview.storagePathGroups} path reference group${preview.storagePathGroups === 1 ? "" : "s"}`,
+    `Permissions: ${preview.claimKeys} reviewed claim${preview.claimKeys === 1 ? "" : "s"}; token hook ${preview.tokenHookConfigured ? "verified during connection" : "not configured"}`,
+    `Immutable history: ${preview.preservedAuditGroups} reference group${preview.preservedAuditGroups === 1 ? "" : "s"} stays with the copied audit identity`,
+    `Plan: ${preview.planDigest.slice(0, 12)}`,
+    "",
+    ...(mode === "preview"
+        ? [
+            "This changes only the disposable local sandbox.",
+            "Edited or independent local account data will make the connection stop safely.",
+            "Nothing has changed yet.",
+        ]
+        : mode === "cancelled"
+            ? [
+                "Nothing was changed. Your local database runtime is still available.",
+            ]
+            : mode === "already-connected"
+                ? [
+                    "This copied account is already connected in the current local runtime.",
+                    "No transfer was repeated.",
+                ]
+                : [
+                    `Transferred images: ${result?.storageObjectsTransferred ?? 0}`,
+                    `Removed untouched signup defaults: ${result?.removedSignupDefaults ?? 0}`,
+                    "The copied account is connected and verified.",
+                    "Sign out and sign in once more so the application receives fresh role claims.",
+                ]),
+].join("\n");

package/dist/src/cli/init_command.d.mts

@@ -10,7 +10,7 @@ interface InitOptions {
 export declare const runRehearsalInit: ({ projectRoot, flags }: InitOptions) => Promise<{
     mode: string;
     destination: string;
-    detected: import("../project/configuration.mjs").DetectedProject;
+    detected: import("../project/project_detection.mjs").DetectedProject;
     source: string;
     availableOptions: {
         path: string;

package/dist/src/cli/inspection_command_handlers.d.mts

@@ -0,0 +1,3 @@
+/** Read-only readiness, support, planning, and inspection command handlers. */
+import type { CommandDefinition } from "./command_contract.mjs";
+export declare const createInspectionCommandHandlers: () => readonly CommandDefinition[];

package/dist/src/cli/inspection_command_handlers.mjs

@@ -0,0 +1,79 @@
+/** Read-only readiness, support, planning, and inspection command handlers. */
+import { collectRehearsalSupportReport } from "../project/support_report.mjs";
+import { inspectRehearsalBaseline, inspectRehearsalMigrations, } from "../runtime/plan.mjs";
+import { buildRuntimeStackPlan, runRuntimeStackDoctor, topologyCandidateSummary, } from "./runtime_commands.mjs";
+import { renderBaseline, renderCandidates, renderDoctor, renderMigrations, renderPlan, renderSupportReport, } from "./renderers.mjs";
+import { exactCommands, renderedCommand } from "./command_contract.mjs";
+export const createInspectionCommandHandlers = () => [
+    exactCommands("doctor", ["doctor"], async ({ guided, flags, planOptions }) => {
+        const data = await runRuntimeStackDoctor(planOptions);
+        return renderedCommand({
+            data,
+            render: (result, verbosity) => renderDoctor(result, verbosity),
+            status: data.state === "READY" ? "success" : "not_ready",
+            ...(data.state !== "READY" && !guided ? { exitCode: 1 } : {}),
+        });
+    }),
+    exactCommands("support", ["support"], async ({ planOptions }) => {
+        const data = await collectRehearsalSupportReport(planOptions, {
+            runDoctor: async (options) => {
+                const report = await runRuntimeStackDoctor(options);
+                const targetAliases = new Map();
+                const aliasFor = (name) => {
+                    if (!targetAliases.has(name)) {
+                        targetAliases.set(name, `runtime-${targetAliases.size + 1}`);
+                    }
+                    return targetAliases.get(name);
+                };
+                return {
+                    ...report,
+                    checks: report.checks.map((check) => {
+                        const separator = check.id.indexOf(":");
+                        if (separator === -1)
+                            return check;
+                        const target = check.id.slice(0, separator);
+                        const alias = aliasFor(target);
+                        return {
+                            ...check,
+                            id: `${alias}:${check.id.slice(separator + 1)}`,
+                            label: check.label.replace(`${target}:`, `${alias}:`),
+                        };
+                    }),
+                };
+            },
+        });
+        return renderedCommand({
+            data,
+            render: (result) => renderSupportReport(result),
+        });
+    }),
+    {
+        id: "explain",
+        matches: ({ command, flags }) => command === "explain" || (command === "run" && flags.dryRun),
+        handle: async ({ planOptions }) => {
+            const data = await buildRuntimeStackPlan(planOptions);
+            return renderedCommand({
+                data,
+                render: (result, verbosity) => renderPlan(result, verbosity),
+            });
+        },
+    },
+    exactCommands("inspect-baseline", ["inspect baseline"], async ({ planOptions }) => {
+        const data = await inspectRehearsalBaseline(planOptions);
+        return renderedCommand({ data, render: renderBaseline });
+    }),
+    exactCommands("inspect-migrations", ["inspect migrations"], async ({ planOptions }) => {
+        const data = await inspectRehearsalMigrations(planOptions);
+        return renderedCommand({
+            data,
+            render: (result, verbosity) => renderMigrations(result, verbosity),
+        });
+    }),
+    exactCommands("candidates", ["candidates"], async ({ planOptions }) => {
+        const { topology: _topology, ...data } = await topologyCandidateSummary(planOptions);
+        return renderedCommand({
+            data,
+            render: (result, verbosity) => renderCandidates(result, verbosity),
+        });
+    }),
+];

package/dist/src/cli/project_command_handlers.d.mts

@@ -0,0 +1,11 @@
+/** Project setup, baseline creation, privacy-key, and cleanup command handlers. */
+import type { CommandDefinition } from "./command_contract.mjs";
+import type { createProjectCommands } from "./project_commands.mjs";
+type ProjectCommands = ReturnType<typeof createProjectCommands>;
+export declare const createProjectCommandHandlers: ({ projectRoot, runSetup, runBaselinePreparation, runCleanup, }: {
+    projectRoot: string;
+    runSetup: ProjectCommands["runSetup"];
+    runBaselinePreparation: ProjectCommands["runBaselinePreparation"];
+    runCleanup: ProjectCommands["runCleanup"];
+}) => readonly CommandDefinition[];
+export {};

package/dist/src/cli/project_command_handlers.mjs

@@ -0,0 +1,92 @@
+/** Project setup, baseline creation, privacy-key, and cleanup command handlers. */
+import { relative } from "node:path";
+import { createSyntheticBaselineFromFiles } from "../baseline/builder.mjs";
+import { inspectBaselineInputFiles } from "../baseline/preparation.mjs";
+import { createPrivacyKey } from "../baseline/privacy_engine.mjs";
+import { formatCount } from "../shared/human_output.mjs";
+import { runRehearsalInit } from "./init_command.mjs";
+import { loadPreparationContext } from "./source_commands.mjs";
+import { renderBaselinePreparation, renderCleanup, renderInit, renderSetup, } from "./renderers.mjs";
+import { exactCommands, renderedCommand } from "./command_contract.mjs";
+export const createProjectCommandHandlers = ({ projectRoot, runSetup, runBaselinePreparation, runCleanup, }) => [
+    exactCommands("setup", ["setup"], async ({ flags, planOptions, state }) => {
+        const data = await runSetup({ flags, planOptions, session: state });
+        return renderedCommand({
+            data,
+            render: () => renderSetup(data),
+        });
+    }),
+    exactCommands("init", ["init"], async ({ flags }) => {
+        const data = await runRehearsalInit({ projectRoot, flags });
+        return renderedCommand({
+            data,
+            render: (result) => renderInit(result),
+        });
+    }),
+    exactCommands("baseline-prepare", ["baseline prepare"], async ({ flags, planOptions, state }) => {
+        const data = await runBaselinePreparation({
+            flags,
+            planOptions,
+            session: state,
+        });
+        return renderedCommand({
+            data,
+            render: (result) => renderBaselinePreparation(result, flags),
+        });
+    }),
+    exactCommands("baseline-create", ["baseline create"], async ({ flags, planOptions }) => {
+        if (!flags.recordsPath || !flags.ledgerPath) {
+            throw new Error("baseline create requires --records and --ledger input paths.");
+        }
+        const baselineInput = {
+            ...planOptions,
+            recordsPath: flags.recordsPath,
+            ledgerPath: flags.ledgerPath,
+            ...(flags.assetsPath === undefined
+                ? {}
+                : { assetsPath: flags.assetsPath }),
+        };
+        await inspectBaselineInputFiles(baselineInput);
+        const data = await createSyntheticBaselineFromFiles(baselineInput);
+        return renderedCommand({
+            data,
+            render: (baseline) => [
+                `Activated synthetic baseline ${baseline.generationId}: ${formatCount(baseline.rowCount, "row")} across ${formatCount(baseline.tableCount, "table")}; ${formatCount(baseline.migrationCount, "migration")} through ${baseline.migrationCutoff}.`,
+                "",
+                flags.guided
+                    ? "Next: choose Run a rehearsal when you are ready."
+                    : "Next: run rehearsal doctor to check readiness.",
+            ].join("\n"),
+        });
+    }),
+    exactCommands("privacy-key", ["privacy key"], async ({ flags, planOptions }) => {
+        const { loaded } = await loadPreparationContext(planOptions);
+        if (!loaded.paths.privacyKey) {
+            throw new Error("No config.preparation.privacyKey is configured.");
+        }
+        const privacyKeyPath = loaded.paths.privacyKey;
+        const data = flags.write
+            ? {
+                mode: "written",
+                path: relative(loaded.projectRoot, privacyKeyPath),
+                ...(await createPrivacyKey(privacyKeyPath)),
+            }
+            : {
+                mode: "preview",
+                path: relative(loaded.projectRoot, privacyKeyPath),
+            };
+        return renderedCommand({
+            data,
+            render: (result) => result.mode === "preview"
+                ? `PRIVACY KEY — PREVIEW\n\nWould create ${result.path} with owner-only permissions.\nNothing was written. Rerun with --write after reviewing the path.`
+                : `Created owner-only privacy key at ${result.path}.\nFingerprint: ${result.fingerprint}\nThe key is excluded from source control and must not be shared.`,
+        });
+    }),
+    exactCommands("cleanup", ["cleanup"], async ({ flags, planOptions, state }) => {
+        const data = await runCleanup({ flags, planOptions, session: state });
+        return renderedCommand({
+            data,
+            render: () => renderCleanup(data),
+        });
+    }),
+];

package/dist/src/cli/project_commands.d.mts

@@ -3,6 +3,7 @@ import { summarizeBaselinePreparation } from "../baseline/preparation.mjs";
 import type { RehearsalConfigPathOptions } from "../project/configuration.mjs";
 import type { RehearsalCleanupPlan } from "../runtime/cleanup.mjs";
 import type { RehearsalCliFlags } from "./arguments.mjs";
+import type { CliSessionState } from "./command_contract.mjs";
 type CleanupStackPlan = Readonly<{
     digest: string;
     targets: readonly Readonly<{
@@ -20,12 +21,13 @@ type RunManager = (input: {
 interface ProjectCommandInput {
     readonly flags: RehearsalCliFlags;
     readonly planOptions: RehearsalConfigPathOptions;
+    readonly session?: CliSessionState;
 }
 export declare const createProjectCommands: ({ projectRoot, runManager, }: {
     projectRoot: string;
     runManager: RunManager;
 }) => Readonly<{
-    loadIdentityClaimPlan: ({ flags, planOptions, }: ProjectCommandInput) => Promise<{
+    loadIdentityClaimPlan: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<{
         loaded: Readonly<{
             config: Readonly<{
                 schemaVersion: 1;
@@ -147,11 +149,135 @@ export declare const createProjectCommands: ({ projectRoot, runManager, }: {
                 runtimeAdapter: string | null;
             }>;
         }>;
-        plan: import("../identity/claim.mjs").IdentityClaimPlan;
+        plan: import("../identity/claim_contract.mjs").IdentityClaimPlan;
+    }>;
+    loadIdentityPolicy: ({ planOptions }: ProjectCommandInput) => Promise<{
+        loaded: Readonly<{
+            config: Readonly<{
+                schemaVersion: 1;
+                project: Readonly<{
+                    name: string;
+                }>;
+                supabase: Readonly<{
+                    workdir: string;
+                    migrationDirectory: string;
+                    rehearsalConfig: string;
+                    runtimeWorkdir: string;
+                    authentication: Readonly<{
+                        enableLocalSignup: true;
+                        environmentFile: string;
+                        providers: readonly Readonly<{
+                            name: "github" | "google";
+                            clientIdEnvironmentVariable: string;
+                            clientSecretEnvironmentVariable: string;
+                            skipNonceCheck: boolean;
+                            emailOptional: boolean;
+                        }>[];
+                    }> | null;
+                    serviceEnvironmentFile: string | null;
+                    serviceEnvironmentVariables: readonly string[];
+                }> | null;
+                postgresql: Readonly<{
+                    migrationDirectory: string;
+                    runtimeWorkdir: string;
+                    image: string;
+                    database: string;
+                    user: string;
+                }> | null;
+                baseline: Readonly<{
+                    artifactDirectory: string;
+                    sanitizationPolicy: string;
+                }>;
+                containerRuntime: Readonly<{
+                    autoStartColima: boolean;
+                }>;
+                cleanup: Readonly<{
+                    retainBaselineGenerations: number;
+                }>;
+                preparation: Readonly<{
+                    sourcePolicy: string;
+                    privacyKey: string;
+                    batchRows: number;
+                    maximumRows: number;
+                    maximumBytes: number;
+                    diskHeadroomBytes: number;
+                }> | null;
+                runtimePolicy: string | null;
+                identityPolicy: string | null;
+                dependentTargets: readonly Readonly<{
+                    name: string;
+                    configPath: string;
+                    prepareCommand: string | null;
+                }>[];
+                application: Readonly<{
+                    startCommand: string;
+                    proofCommand: string;
+                    environmentFile: string;
+                    environmentVariables: Readonly<Record<string, string>>;
+                    readiness: Readonly<{
+                        url: string;
+                        expectedStatus: number;
+                        timeoutSeconds: number;
+                    }> | null;
+                    httpProofs: readonly Readonly<{
+                        name: string;
+                        kind: "positive" | "negative";
+                        url: string;
+                        method: string;
+                        expectedStatus: number;
+                        json: Readonly<{
+                            path: readonly string[];
+                            equals?: unknown;
+                            notEquals?: unknown;
+                            minimumItems?: number;
+                        }> | null;
+                    }>[];
+                    runtimeAdapter: string | null;
+                }>;
+                runtime: Readonly<{
+                    target: "postgresql" | "supabase";
+                    applicationUrl: string;
+                    projectId: string;
+                    ports: Readonly<{
+                        api?: number;
+                        database: number;
+                        studio?: number;
+                    }>;
+                }>;
+                safety: Readonly<{
+                    allowedHosts: readonly string[];
+                    blockedEnvironmentVariables: readonly string[];
+                    authenticationProviders: readonly string[];
+                    hostedAccess: "disabled";
+                    outboundNetwork: "deny";
+                }>;
+                verification: Readonly<{
+                    commands: readonly string[];
+                }>;
+            }>;
+            configPath: string;
+            projectRoot: string;
+            paths: Readonly<{
+                artifactDirectory: string;
+                applicationEnvironment: string;
+                migrationDirectory: string;
+                rehearsalConfig: string | null;
+                runtimeWorkdir: string;
+                serviceEnvironment: string | null;
+                sanitizationPolicy: string;
+                sourcePolicy: string | null;
+                privacyKey: string | null;
+                runtimePolicy: string | null;
+                identityPolicy: string | null;
+                supabaseWorkdir: string | null;
+                runtimeAdapter: string | null;
+            }>;
+        }>;
+        policy: import("../identity/claim_contract.mjs").IdentityPolicy;
     }>;
     planRuntimeStackCleanup: ({ flags, planOptions, }: ProjectCommandInput) => Promise<RehearsalCleanupPlan | CleanupStackPlan>;
-    runBaselinePreparation: ({ flags, planOptions, }: ProjectCommandInput) => Promise<ReturnType<typeof summarizeBaselinePreparation>>;
-    runCleanup: ({ flags, planOptions, }: ProjectCommandInput) => Promise<unknown>;
-    runSetup: ({ flags, planOptions, }: ProjectCommandInput) => Promise<unknown>;
+    runBaselinePreparation: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<ReturnType<typeof summarizeBaselinePreparation>>;
+    runCleanup: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<unknown>;
+    runSetup: ({ flags, planOptions, session, }: ProjectCommandInput) => Promise<unknown>;
 }>;
 export {};