@rehearsal-db/core 0.1.0-beta.4 → 0.1.0-beta.6

package/scripts/lib/rehearsal/configuration.mjs

@@ -7,6 +7,7 @@
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
 
 export {
   EXCLUDED_VALUE,
@@ -29,6 +30,11 @@ export const REHEARSAL_DEFAULTS = Object.freeze({
   safety: Object.freeze({
     allowedHosts: Object.freeze(["127.0.0.1", "::1", "localhost"]),
     blockedEnvironmentVariables: Object.freeze([
+      "DATABASE_URL",
+      "PGHOST",
+      "PGPASSWORD",
+      "PGPORT",
+      "PGUSER",
       "SUPABASE_ACCESS_TOKEN",
       "SUPABASE_DB_PASSWORD",
       "SUPABASE_PROJECT_ID",
@@ -48,6 +54,8 @@ const CONFIG_FILENAMES = Object.freeze([
 
 const LOOPBACK_HOSTS = new Set(REHEARSAL_DEFAULTS.safety.allowedHosts);
 const IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}$/u;
+const DATABASE_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]{0,62}$/u;
+const POSTGRES_IMAGE_PATTERN = /^postgres:\d+(?:\.\d+)?-alpine$/u;
 const SAFE_COMMAND_PATTERN = /^[^\n\r\0]+$/u;
 
 const isPlainObject = (value) =>
@@ -141,6 +149,7 @@ const normalizeConfig = (input) => {
       "schemaVersion",
       "project",
       "supabase",
+      "postgresql",
       "baseline",
       "application",
       "runtime",
@@ -164,19 +173,46 @@ const normalizeConfig = (input) => {
     );
   }
 
-  const supabase = assertPlainObject(root.supabase, "config.supabase");
-  assertKnownKeys(
-    supabase,
-    [
-      "workdir",
-      "migrationDirectory",
-      "rehearsalConfig",
-      "runtimeWorkdir",
-      "serviceEnvironmentFile",
-      "serviceEnvironmentVariables",
-    ],
-    "config.supabase",
-  );
+  const runtimeTarget = resolveRuntimeTarget(root.runtime?.target).id;
+  const supabase =
+    runtimeTarget === "supabase"
+      ? assertPlainObject(root.supabase, "config.supabase")
+      : null;
+  const postgresql =
+    runtimeTarget === "postgresql"
+      ? assertPlainObject(root.postgresql, "config.postgresql")
+      : null;
+  if (runtimeTarget === "supabase" && root.postgresql !== undefined) {
+    throw new Error(
+      "config.postgresql is not allowed when config.runtime.target is supabase.",
+    );
+  }
+  if (runtimeTarget === "postgresql" && root.supabase !== undefined) {
+    throw new Error(
+      "config.supabase is not allowed when config.runtime.target is postgresql.",
+    );
+  }
+  if (supabase) {
+    assertKnownKeys(
+      supabase,
+      [
+        "workdir",
+        "migrationDirectory",
+        "rehearsalConfig",
+        "runtimeWorkdir",
+        "serviceEnvironmentFile",
+        "serviceEnvironmentVariables",
+      ],
+      "config.supabase",
+    );
+  }
+  if (postgresql) {
+    assertKnownKeys(
+      postgresql,
+      ["migrationDirectory", "runtimeWorkdir", "image", "database", "user"],
+      "config.postgresql",
+    );
+  }
   const baseline = assertPlainObject(root.baseline, "config.baseline");
   assertKnownKeys(
     baseline,
@@ -192,7 +228,14 @@ const normalizeConfig = (input) => {
   const runtime = assertPlainObject(root.runtime ?? {}, "config.runtime");
   assertKnownKeys(
     runtime,
-    ["applicationUrl", "projectId", "apiPort", "databasePort", "studioPort"],
+    [
+      "target",
+      "applicationUrl",
+      "projectId",
+      "apiPort",
+      "databasePort",
+      "studioPort",
+    ],
     "config.runtime",
   );
   const safety = assertPlainObject(root.safety ?? {}, "config.safety");
@@ -234,9 +277,13 @@ const normalizeConfig = (input) => {
   }
 
   const ports = {
-    api: assertPort(runtime.apiPort, "config.runtime.apiPort"),
+    ...(runtimeTarget === "supabase"
+      ? { api: assertPort(runtime.apiPort, "config.runtime.apiPort") }
+      : {}),
     database: assertPort(runtime.databasePort, "config.runtime.databasePort"),
-    studio: assertPort(runtime.studioPort, "config.runtime.studioPort"),
+    ...(runtimeTarget === "supabase"
+      ? { studio: assertPort(runtime.studioPort, "config.runtime.studioPort") }
+      : {}),
   };
   if (new Set(Object.values(ports)).size !== Object.values(ports).length) {
     throw new Error("Rehearsal runtime ports must be unique.");
@@ -247,7 +294,7 @@ const normalizeConfig = (input) => {
     throw new Error("config.verification.commands must be an array.");
   }
   const serviceEnvironmentVariables =
-    supabase.serviceEnvironmentVariables ?? [];
+    supabase?.serviceEnvironmentVariables ?? [];
   if (!Array.isArray(serviceEnvironmentVariables)) {
     throw new Error(
       "config.supabase.serviceEnvironmentVariables must be an array.",
@@ -269,41 +316,105 @@ const normalizeConfig = (input) => {
     );
   }
   if (
-    Boolean(supabase.serviceEnvironmentFile) !==
+    Boolean(supabase?.serviceEnvironmentFile) !==
     Boolean(normalizedServiceEnvironmentVariables.length)
   ) {
     throw new Error(
       "config.supabase.serviceEnvironmentFile and serviceEnvironmentVariables must be configured together.",
     );
   }
+  const authenticationProviders = safety.authenticationProviders
+    ? assertStringArray(
+        safety.authenticationProviders,
+        "config.safety.authenticationProviders",
+      )
+    : [];
+  if (runtimeTarget === "postgresql" && authenticationProviders.length > 0) {
+    throw new Error(
+      "config.safety.authenticationProviders is available only for the Supabase target.",
+    );
+  }
 
   return Object.freeze({
     schemaVersion: REHEARSAL_CONFIG_VERSION,
     project: Object.freeze({ name: projectName }),
-    supabase: Object.freeze({
-      workdir: assertRelativePath(supabase.workdir, "config.supabase.workdir"),
-      migrationDirectory: assertRelativePath(
-        supabase.migrationDirectory,
-        "config.supabase.migrationDirectory",
-      ),
-      rehearsalConfig: assertRelativePath(
-        supabase.rehearsalConfig,
-        "config.supabase.rehearsalConfig",
-      ),
-      runtimeWorkdir: assertRelativePath(
-        supabase.runtimeWorkdir,
-        "config.supabase.runtimeWorkdir",
-      ),
-      serviceEnvironmentFile: supabase.serviceEnvironmentFile
-        ? assertRelativePath(
-            supabase.serviceEnvironmentFile,
-            "config.supabase.serviceEnvironmentFile",
-          )
-        : null,
-      serviceEnvironmentVariables: Object.freeze(
-        normalizedServiceEnvironmentVariables,
-      ),
-    }),
+    supabase: supabase
+      ? Object.freeze({
+          workdir: assertRelativePath(
+            supabase.workdir,
+            "config.supabase.workdir",
+          ),
+          migrationDirectory: assertRelativePath(
+            supabase.migrationDirectory,
+            "config.supabase.migrationDirectory",
+          ),
+          rehearsalConfig: assertRelativePath(
+            supabase.rehearsalConfig,
+            "config.supabase.rehearsalConfig",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            supabase.runtimeWorkdir,
+            "config.supabase.runtimeWorkdir",
+          ),
+          serviceEnvironmentFile: supabase.serviceEnvironmentFile
+            ? assertRelativePath(
+                supabase.serviceEnvironmentFile,
+                "config.supabase.serviceEnvironmentFile",
+              )
+            : null,
+          serviceEnvironmentVariables: Object.freeze(
+            normalizedServiceEnvironmentVariables,
+          ),
+        })
+      : null,
+    postgresql: postgresql
+      ? Object.freeze({
+          migrationDirectory: assertRelativePath(
+            postgresql.migrationDirectory,
+            "config.postgresql.migrationDirectory",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            postgresql.runtimeWorkdir ?? ".rehearsal/runtime",
+            "config.postgresql.runtimeWorkdir",
+          ),
+          image: (() => {
+            const image = assertNonEmptyString(
+              postgresql.image ?? "postgres:17-alpine",
+              "config.postgresql.image",
+            );
+            if (!POSTGRES_IMAGE_PATTERN.test(image)) {
+              throw new Error(
+                "config.postgresql.image must name an official versioned Alpine PostgreSQL image, such as postgres:17-alpine.",
+              );
+            }
+            return image;
+          })(),
+          database: (() => {
+            const database = assertNonEmptyString(
+              postgresql.database ?? "postgres",
+              "config.postgresql.database",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(database)) {
+              throw new Error(
+                "config.postgresql.database must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return database;
+          })(),
+          user: (() => {
+            const user = assertNonEmptyString(
+              postgresql.user ?? "postgres",
+              "config.postgresql.user",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(user)) {
+              throw new Error(
+                "config.postgresql.user must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return user;
+          })(),
+        })
+      : null,
     baseline: Object.freeze({
       artifactDirectory: assertRelativePath(
         baseline.artifactDirectory ??
@@ -337,6 +448,7 @@ const normalizeConfig = (input) => {
             ),
     }),
     runtime: Object.freeze({
+      target: runtimeTarget,
       applicationUrl: assertLoopbackUrl(
         runtime.applicationUrl ?? REHEARSAL_DEFAULTS.runtime.applicationUrl,
         "config.runtime.applicationUrl",
@@ -357,14 +469,7 @@ const normalizeConfig = (input) => {
           "config.safety.blockedEnvironmentVariables",
         ),
       ),
-      authenticationProviders: Object.freeze(
-        safety.authenticationProviders
-          ? assertStringArray(
-              safety.authenticationProviders,
-              "config.safety.authenticationProviders",
-            )
-          : [],
-      ),
+      authenticationProviders: Object.freeze(authenticationProviders),
       hostedAccess: "disabled",
       outboundNetwork: "deny",
     }),
@@ -428,14 +533,22 @@ export const loadRehearsalConfig = async ({
     applicationEnvironment: resolveOwnedPath(
       config.application.environmentFile,
     ),
-    migrationDirectory: resolveOwnedPath(config.supabase.migrationDirectory),
-    rehearsalConfig: resolveOwnedPath(config.supabase.rehearsalConfig),
-    runtimeWorkdir: resolveOwnedPath(config.supabase.runtimeWorkdir),
-    serviceEnvironment: config.supabase.serviceEnvironmentFile
+    migrationDirectory: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).migrationDirectory,
+    ),
+    rehearsalConfig: config.supabase
+      ? resolveOwnedPath(config.supabase.rehearsalConfig)
+      : null,
+    runtimeWorkdir: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).runtimeWorkdir,
+    ),
+    serviceEnvironment: config.supabase?.serviceEnvironmentFile
       ? resolveOwnedPath(config.supabase.serviceEnvironmentFile)
       : null,
     sanitizationPolicy: resolveOwnedPath(config.baseline.sanitizationPolicy),
-    supabaseWorkdir: resolveOwnedPath(config.supabase.workdir),
+    supabaseWorkdir: config.supabase
+      ? resolveOwnedPath(config.supabase.workdir)
+      : null,
     runtimeAdapter: config.application.runtimeAdapter
       ? resolveOwnedPath(config.application.runtimeAdapter)
       : null,
@@ -448,7 +561,7 @@ export const loadRehearsalConfig = async ({
   const requiredRuntimeWorkdir = join(paths.artifactDirectory, "runtime");
   if (paths.runtimeWorkdir !== requiredRuntimeWorkdir) {
     throw new Error(
-      "config.supabase.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.",
+      `config.${config.runtime.target}.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.`,
     );
   }
   const environmentRelativePath = relative(
@@ -496,6 +609,13 @@ export const inspectDetectedProject = async ({
       ? "yarn"
       : "npm";
   const scripts = packageJson.scripts ?? {};
+  const postgresqlMigrationDirectory = (
+    await Promise.all(
+      ["database/migrations", "db/migrations", "migrations"].map(
+        async (path) => ({ path, exists: await hasPath(path) }),
+      ),
+    )
+  ).find(({ exists }) => exists)?.path;
   const normalizedProjectName = String(packageJson.name ?? basename(root))
     .toLowerCase()
     .replace(/[^a-z0-9-]+/gu, "-")
@@ -508,6 +628,9 @@ export const inspectDetectedProject = async ({
     packageManager,
     hasSupabaseConfig: await hasPath("supabase/config.toml"),
     hasMigrations: await hasPath("supabase/migrations"),
+    hasPostgresqlMigrations: Boolean(postgresqlMigrationDirectory),
+    postgresqlMigrationDirectory:
+      postgresqlMigrationDirectory ?? "database/migrations",
     applicationCommand:
       ["dev:rehearsal", "dev", "start"]
         .find((name) => typeof scripts[name] === "string")
@@ -548,6 +671,7 @@ export default defineRehearsalConfig({
 		environmentFile: ".rehearsal/runtime.env",
 	},
 	runtime: {
+		target: "supabase",
 		applicationUrl: ${JSON.stringify(applicationUrl)},
 		projectId: "${detected.projectName}-rehearsal",
 		apiPort: ${ports.api},
@@ -567,3 +691,50 @@ export default defineRehearsalConfig({
 	verification: { commands: [${JSON.stringify(detected.verificationCommand)}] },
 });
 `;
+
+export const renderDetectedPostgresqlConfig = (
+  detected,
+  { applicationUrl = "http://localhost:5175", databasePort = 58322 } = {},
+) => `// @ts-check
+import { defineRehearsalConfig } from "@rehearsal-db/core";
+
+export default defineRehearsalConfig({
+	schemaVersion: 1,
+	project: { name: ${JSON.stringify(detected.projectName)} },
+	postgresql: {
+		migrationDirectory: ${JSON.stringify(detected.postgresqlMigrationDirectory)},
+		runtimeWorkdir: ".rehearsal/runtime",
+		image: "postgres:17-alpine",
+		database: "postgres",
+		user: "postgres",
+	},
+	baseline: {
+		artifactDirectory: ".rehearsal",
+		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
+	},
+	application: {
+		startCommand: ${JSON.stringify(detected.applicationCommand)},
+		proofCommand: ${JSON.stringify(detected.verificationCommand)},
+		environmentFile: ".rehearsal/runtime.env",
+	},
+	runtime: {
+		target: "postgresql",
+		applicationUrl: ${JSON.stringify(applicationUrl)},
+		projectId: "${detected.projectName}-rehearsal",
+		databasePort: ${databasePort},
+	},
+	safety: {
+		allowedHosts: ["127.0.0.1", "::1", "localhost"],
+		blockedEnvironmentVariables: [
+			"DATABASE_URL",
+			"PGHOST",
+			"PGPASSWORD",
+			"PGPORT",
+			"PGUSER",
+		],
+		hostedAccess: "disabled",
+		outboundNetwork: "deny",
+	},
+	verification: { commands: [${JSON.stringify(detected.verificationCommand)}] },
+});
+`;

package/scripts/lib/rehearsal/diagnostics.mjs

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 
 export const REHEARSAL_RESULT_VERSION = 1;
-export const REHEARSAL_VERSION = "0.1.0-beta.4";
+export const REHEARSAL_VERSION = "0.1.0-beta.6";
 
 export const REHEARSAL_EXIT_CODES = Object.freeze({
   success: 0,
@@ -109,7 +109,9 @@ const inferCategory = (error) => {
     return "unsafe_environment";
   }
   if (
-    /docker|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(message)
+    /docker|postgres(?:ql)?|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(
+      message,
+    )
   ) {
     return "runtime_dependency_failure";
   }

package/scripts/lib/rehearsal/input_discovery.mjs

@@ -0,0 +1,155 @@
+/**
+ * Discover likely project-owned baseline inputs without exposing their values.
+ * Discovery is bounded, ignores generated/private directories, and only sniffs
+ * small JSON or NDJSON files before returning project-relative paths.
+ */
+
+import { open, readFile, readdir, stat } from "node:fs/promises";
+import { extname, join, relative, sep } from "node:path";
+
+const ignoredDirectories = new Set([
+  ".git",
+  ".next",
+  ".rehearsal",
+  ".turbo",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+]);
+const maximumDepth = 4;
+const maximumFiles = 2_000;
+const maximumJsonBytes = 2 * 1024 * 1024;
+const maximumNdjsonProbeBytes = 64 * 1024;
+
+const projectRelativePath = (projectRoot, path) =>
+  relative(projectRoot, path).split(sep).join("/");
+
+const preference = {
+  records: [
+    "rehearsal/sanitized-data.ndjson",
+    "rehearsal/synthetic-data.ndjson",
+  ],
+  ledgers: ["rehearsal/migration-ledger.json"],
+  assetManifests: ["rehearsal/assets.json"],
+};
+
+const sortCandidates = (kind, candidates) => {
+  const preferred = new Map(
+    preference[kind].map((path, index) => [path, index]),
+  );
+  return candidates.sort((left, right) => {
+    const leftRank = preferred.get(left) ?? Number.POSITIVE_INFINITY;
+    const rightRank = preferred.get(right) ?? Number.POSITIVE_INFINITY;
+    return leftRank - rightRank || left.localeCompare(right);
+  });
+};
+
+const readFirstRecord = async (path) => {
+  const handle = await open(path, "r");
+  try {
+    const buffer = Buffer.alloc(maximumNdjsonProbeBytes);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    const probe = buffer.subarray(0, bytesRead).toString("utf8");
+    const lines = probe.split(/\r?\n/u);
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      return JSON.parse(line);
+    }
+  } finally {
+    await handle.close();
+  }
+  return undefined;
+};
+
+const isRecord = (value) =>
+  Boolean(
+    value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    typeof value.table === "string" &&
+    value.row &&
+    typeof value.row === "object" &&
+    !Array.isArray(value.row),
+  );
+
+const isMigrationLedger = (value) =>
+  Array.isArray(value) &&
+  value.length > 0 &&
+  value.every(
+    (entry) =>
+      entry &&
+      typeof entry === "object" &&
+      typeof entry.version === "string" &&
+      typeof entry.name === "string" &&
+      Array.isArray(entry.statements),
+  );
+
+const isAssetManifest = (value) =>
+  Array.isArray(value) &&
+  value.length > 0 &&
+  value.every(
+    (entry) =>
+      entry &&
+      typeof entry === "object" &&
+      typeof entry.bucket === "string" &&
+      typeof entry.objectPath === "string" &&
+      typeof entry.file === "string",
+  );
+
+const collectCandidateFiles = async (projectRoot) => {
+  const files = [];
+  const visit = async (directory, depth) => {
+    if (depth > maximumDepth || files.length >= maximumFiles) return;
+    const entries = await readdir(directory, { withFileTypes: true }).catch(
+      () => [],
+    );
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      if (files.length >= maximumFiles) return;
+      if (entry.isSymbolicLink()) continue;
+      const path = join(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories.has(entry.name)) await visit(path, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || ![".json", ".ndjson"].includes(extname(path))) {
+        continue;
+      }
+      files.push(path);
+    }
+  };
+  await visit(projectRoot, 0);
+  return files;
+};
+
+export const discoverBaselineInputFiles = async ({
+  projectRoot = process.cwd(),
+} = {}) => {
+  const result = { records: [], ledgers: [], assetManifests: [] };
+  for (const path of await collectCandidateFiles(projectRoot)) {
+    const pathStats = await stat(path).catch(() => undefined);
+    if (!pathStats?.isFile()) continue;
+    const relativePath = projectRelativePath(projectRoot, path);
+    try {
+      if (extname(path) === ".ndjson") {
+        if (isRecord(await readFirstRecord(path))) {
+          result.records.push(relativePath);
+        }
+        continue;
+      }
+      if (pathStats.size > maximumJsonBytes) continue;
+      const value = JSON.parse(await readFile(path, "utf8"));
+      if (isMigrationLedger(value)) result.ledgers.push(relativePath);
+      else if (isAssetManifest(value)) result.assetManifests.push(relativePath);
+    } catch {
+      // Invalid or unreadable files are not candidates; explicit validation will
+      // provide actionable errors if the user enters one manually.
+    }
+  }
+  return {
+    records: sortCandidates("records", result.records),
+    ledgers: sortCandidates("ledgers", result.ledgers),
+    assetManifests: sortCandidates("assetManifests", result.assetManifests),
+  };
+};