@rehearsal-db/core 0.1.0-beta.4 → 0.1.0-beta.6

package/scripts/lib/rehearsal/plan.mjs

@@ -105,6 +105,14 @@ const resultCheck = async ({ id, label, run, remediation }) => {
 };
 
 const assertRuntimeConfigMatches = async ({ config, paths }) => {
+  if (config.runtime.target === "postgresql") {
+    if (paths.rehearsalConfig !== null || paths.supabaseWorkdir !== null) {
+      throw new Error(
+        "The PostgreSQL target unexpectedly resolved Supabase paths.",
+      );
+    }
+    return `isolated PostgreSQL image ${config.postgresql.image} and a loopback database port are configured`;
+  }
   const source = await readFile(paths.rehearsalConfig, "utf8");
   const expected = [
     ["project_id", config.runtime.projectId],
@@ -217,7 +225,8 @@ export const buildRehearsalPlan = async (options = {}) => {
       project: config.project.name,
     },
     environment: {
-      kind: "isolated_local_supabase",
+      target: config.runtime.target,
+      kind: `isolated_local_${config.runtime.target}`,
       applicationUrl: config.runtime.applicationUrl,
       projectId: config.runtime.projectId,
       ports: config.runtime.ports,
@@ -226,7 +235,7 @@ export const buildRehearsalPlan = async (options = {}) => {
       authenticationProviders: config.safety.authenticationProviders,
       barriers: [
         "versioned configuration accepts loopback hosts only",
-        "runtime uses a dedicated local Supabase workdir and project id",
+        `runtime uses a dedicated local ${config.runtime.target === "supabase" ? "Supabase workdir" : "PostgreSQL container and volume"} and project id`,
         "child processes receive an allowlisted environment",
         "application egress policy denies hosted targets and side effects",
         ...(config.safety.authenticationProviders.length
@@ -382,14 +391,37 @@ export const runRehearsalDoctor = async (options = {}) => {
       remediation: "Use npm for the initial Rehearsal contract.",
     },
     {
-      id: "supabase-cli",
-      label: "Supabase CLI",
+      id:
+        config.runtime.target === "supabase"
+          ? "supabase-cli"
+          : "postgresql-image",
+      label:
+        config.runtime.target === "supabase"
+          ? "Supabase CLI"
+          : "PostgreSQL image",
       run: async () => {
-        const result = commandAvailable("supabase");
-        if (!result.available) throw new Error("Supabase CLI is unavailable.");
-        return result.version;
+        if (config.runtime.target === "supabase") {
+          const result = commandAvailable("supabase");
+          if (!result.available)
+            throw new Error("Supabase CLI is unavailable.");
+          return result.version;
+        }
+        const result = commandAvailable("docker", [
+          "image",
+          "inspect",
+          config.postgresql.image,
+        ]);
+        if (!result.available) {
+          throw new Error(
+            `PostgreSQL image ${config.postgresql.image} is unavailable locally.`,
+          );
+        }
+        return config.postgresql.image;
       },
-      remediation: "Install the Supabase CLI in the project and retry.",
+      remediation:
+        config.runtime.target === "supabase"
+          ? "Install the Supabase CLI in the project and retry."
+          : `Pull and review ${config.postgresql.image}, then retry.`,
     },
     {
       id: "docker",
@@ -412,13 +444,17 @@ export const runRehearsalDoctor = async (options = {}) => {
       run: async () => {
         await Promise.all([
           verifyPath(paths.migrationDirectory, "directory"),
-          verifyPath(paths.rehearsalConfig, "file"),
+          ...(paths.rehearsalConfig
+            ? [verifyPath(paths.rehearsalConfig, "file")]
+            : []),
           verifyPath(paths.sanitizationPolicy, "file"),
           ...(paths.runtimeAdapter
             ? [verifyPath(paths.runtimeAdapter, "file")]
             : []),
         ]);
-        return "migrations, local runtime config, and sanitization policy exist";
+        return config.runtime.target === "supabase"
+          ? "migrations, local runtime config, and sanitization policy exist"
+          : "migrations and sanitization policy exist";
       },
       remediation:
         "Correct the missing project path in the Rehearsal configuration.",
@@ -446,6 +482,9 @@ export const runRehearsalDoctor = async (options = {}) => {
       id: "service-environment",
       label: "Local service credentials",
       run: async () => {
+        if (config.runtime.target === "postgresql") {
+          return "no local service credentials required";
+        }
         const environment = await readRehearsalServiceEnvironment({
           path: paths.serviceEnvironment,
           keys: config.supabase.serviceEnvironmentVariables,
@@ -472,6 +511,42 @@ export const runRehearsalDoctor = async (options = {}) => {
         );
         const occupied = availability.filter((entry) => !entry.available);
         if (occupied.length) {
+          if (config.runtime.target === "postgresql") {
+            const status = spawnSync(
+              "docker",
+              [
+                "ps",
+                "--filter",
+                `label=com.rehearsal-db.project=${config.runtime.projectId}`,
+                "--format",
+                "{{.Ports}}",
+              ],
+              {
+                cwd: projectRoot,
+                encoding: "utf8",
+                env: Object.fromEntries(
+                  ["HOME", "LANG", "LC_ALL", "PATH", "SHELL", "TMPDIR"].flatMap(
+                    (key) =>
+                      process.env[key] === undefined
+                        ? []
+                        : [[key, process.env[key]]],
+                  ),
+                ),
+                stdio: ["ignore", "pipe", "pipe"],
+              },
+            );
+            if (
+              status.status !== 0 ||
+              !String(status.stdout).includes(
+                `127.0.0.1:${config.runtime.ports.database}->5432/tcp`,
+              )
+            ) {
+              throw new Error(
+                `Configured database port is occupied by an unverified process: database=${config.runtime.ports.database}.`,
+              );
+            }
+            return "occupied only by the configured local Rehearsal runtime";
+          }
           const serviceEnvironment = await readRehearsalServiceEnvironment({
             path: paths.serviceEnvironment,
             keys: config.supabase.serviceEnvironmentVariables,

package/scripts/lib/rehearsal/policy_review.mjs

@@ -7,6 +7,31 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { validateRuntimeSanitizationPolicy } from "./sanitization_policy.mjs";
 
+export const SAFE_COLUMN_PRESET = Object.freeze({
+  action: "REPLACE WITH SYNTHETIC",
+  generated: "NEVER",
+  identity: "NO",
+  foreignKey: null,
+});
+
+export const createSafeTablePreset = (columns) =>
+  Object.fromEntries(
+    columns.map((column) => [
+      typeof column === "string" ? column : column.name,
+      { ...SAFE_COLUMN_PRESET },
+    ]),
+  );
+
+export const suggestPolicyExceptionColumns = (columns) =>
+  columns
+    .map((column) => (typeof column === "string" ? column : column.name))
+    .filter(
+      (column) =>
+        column === "id" ||
+        column.endsWith("_id") ||
+        ["created_at", "updated_at", "deleted_at"].includes(column),
+    );
+
 export const readReviewablePolicyDraft = async (path) => {
   const source = await readFile(path, "utf8");
   const draft = JSON.parse(source);
@@ -18,18 +43,33 @@ export const readReviewablePolicyDraft = async (path) => {
   return { source, draft };
 };
 
-export const completePolicyDraft = async ({ draft, reviewColumn }) => {
+export const completePolicyDraft = async ({
+  draft,
+  reviewColumn,
+  reviewTable,
+}) => {
   if (draft?.draft !== true || !Array.isArray(draft.tables)) {
     throw new Error("A generated REVIEW REQUIRED policy draft is required.");
   }
   const tables = [];
   for (const table of draft.tables) {
+    const columnNames = (table.columns ?? []).map((column) => column.name);
+    const tableDecisions = reviewTable
+      ? await reviewTable({ table: table.name, columns: columnNames })
+      : {};
     const columns = [];
     for (const column of table.columns ?? []) {
-      const reviewed = await reviewColumn({
-        table: table.name,
-        column: column.name,
-      });
+      const reviewed =
+        tableDecisions?.[column.name] ??
+        (await reviewColumn?.({
+          table: table.name,
+          column: column.name,
+        }));
+      if (!reviewed) {
+        throw new Error(
+          `Policy review did not classify ${table.name}.${column.name}.`,
+        );
+      }
       columns.push({ name: column.name, ...reviewed });
     }
     tables.push({ ...table, columns });

package/scripts/lib/rehearsal/runtime_restore.mjs

@@ -236,7 +236,11 @@ const buildForeignKeyChecks = (manifest) =>
     })
     .join("\n\t");
 
-export const buildRestoreSqlSuffix = ({ manifest, tableCounts }) => {
+export const buildRestoreSqlSuffix = ({
+  manifest,
+  tableCounts,
+  restoreSupabaseAuth = true,
+}) => {
   if (!Array.isArray(manifest?.tables) || !tableCounts) {
     throw new Error("A reviewed manifest and exact row counts are required.");
   }
@@ -252,7 +256,7 @@ truncate table ${manifest.tables
     .map((table) => `public.${quoteIdentifier(table.name)}`)
     .join(", ")}
 restart identity cascade;
-${buildAuthRestoreSql(manifest)}
+${restoreSupabaseAuth ? buildAuthRestoreSql(manifest) : ""}
 ${tables.map(buildTableRestoreSql).join("\n")}
 ${tables.map(buildIdentitySequenceSql).filter(Boolean).join("\n")}
 set local session_replication_role = origin;

package/scripts/lib/rehearsal/setup.mjs

@@ -9,7 +9,9 @@ import { dirname, join, relative, resolve } from "node:path";
 import {
   inspectDetectedProject,
   renderDetectedConfig,
+  renderDetectedPostgresqlConfig,
 } from "./configuration.mjs";
+import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
 
 const CONFIG_PATH = "rehearsal.config.mjs";
 const LOCAL_SUPABASE_CONFIG_PATH =
@@ -209,20 +211,26 @@ const assertCreateTargetAvailable = async (file) => {
 export const planRehearsalSetup = async ({
   projectRoot = process.cwd(),
   isPortAvailable,
+  target = "supabase",
 } = {}) => {
   const root = resolve(projectRoot);
+  const runtimeTarget = resolveRuntimeTarget(target).id;
   const detected = await inspectDetectedProject({ projectRoot: root });
   const ports = await findAvailableRehearsalPorts({
     ...(isPortAvailable ? { isAvailable: isPortAvailable } : {}),
   });
   const applicationUrl = "http://localhost:5175";
   const projectId = `${detected.projectName}-rehearsal`;
-  const sourceSupabaseConfig = await readOptionalFile(
-    join(root, "supabase/config.toml"),
-  );
+  const sourceSupabaseConfig =
+    runtimeTarget === "supabase"
+      ? await readOptionalFile(join(root, "supabase/config.toml"))
+      : null;
   const originalGitignore = await readOptionalFile(join(root, GITIGNORE_PATH));
   const nextGitignore = appendGitignoreEntries(originalGitignore);
-  for (const path of [CONFIG_PATH, LOCAL_SUPABASE_CONFIG_PATH]) {
+  for (const path of [
+    CONFIG_PATH,
+    ...(runtimeTarget === "supabase" ? [LOCAL_SUPABASE_CONFIG_PATH] : []),
+  ]) {
     if (await pathExists(join(root, path))) {
       throw new Error(
         `Rehearsal setup will not overwrite the existing file at ${path}.`,
@@ -235,23 +243,34 @@ export const planRehearsalSetup = async ({
       absolutePath: join(root, CONFIG_PATH),
       action: "create",
       mode: 0o600,
-      content: renderDetectedConfig(detected, {
-        applicationUrl,
-        ports,
-      }),
-    },
-    {
-      path: LOCAL_SUPABASE_CONFIG_PATH,
-      absolutePath: join(root, LOCAL_SUPABASE_CONFIG_PATH),
-      action: "create",
-      mode: 0o600,
-      content: renderSafeLocalSupabaseConfig({
-        projectId,
-        applicationUrl,
-        ports,
-        databaseMajorVersion: databaseMajorVersionFrom(sourceSupabaseConfig),
-      }),
+      content:
+        runtimeTarget === "supabase"
+          ? renderDetectedConfig(detected, {
+              applicationUrl,
+              ports,
+            })
+          : renderDetectedPostgresqlConfig(detected, {
+              applicationUrl,
+              databasePort: ports.database,
+            }),
     },
+    ...(runtimeTarget === "supabase"
+      ? [
+          {
+            path: LOCAL_SUPABASE_CONFIG_PATH,
+            absolutePath: join(root, LOCAL_SUPABASE_CONFIG_PATH),
+            action: "create",
+            mode: 0o600,
+            content: renderSafeLocalSupabaseConfig({
+              projectId,
+              applicationUrl,
+              ports,
+              databaseMajorVersion:
+                databaseMajorVersionFrom(sourceSupabaseConfig),
+            }),
+          },
+        ]
+      : []),
     {
       path: GITIGNORE_PATH,
       absolutePath: join(root, GITIGNORE_PATH),
@@ -270,15 +289,24 @@ export const planRehearsalSetup = async ({
     projectRoot: root,
     project: detected.projectName,
     projectId,
+    target: runtimeTarget,
     applicationUrl,
     detected,
-    ports,
+    ports: runtimeTarget === "supabase" ? ports : { database: ports.database },
     isPortAvailable: isPortAvailable ?? isRehearsalPortAvailable,
     files,
     safety: [
       "hosted access remains disabled",
-      "the Supabase runtime binds to dedicated local ports",
-      "external identity providers, realtime, edge functions, and analytics start disabled",
+      runtimeTarget === "supabase"
+        ? "the Supabase runtime binds to dedicated local ports"
+        : "PostgreSQL binds only to a dedicated loopback port",
+      ...(runtimeTarget === "supabase"
+        ? [
+            "external identity providers, realtime, edge functions, and analytics start disabled",
+          ]
+        : [
+            "the runtime uses an already-installed official PostgreSQL image and never pulls implicitly",
+          ]),
       "configuration files are never overwritten and .gitignore updates are concurrency-checked",
     ],
   };
@@ -331,13 +359,17 @@ export const summarizeRehearsalSetup = (plan, { mode }) => ({
   mode,
   project: plan.project,
   projectId: plan.projectId,
+  target: plan.target,
   applicationUrl: plan.applicationUrl,
   detected: plan.detected,
-  ports: {
-    api: plan.ports.api,
-    database: plan.ports.database,
-    studio: plan.ports.studio,
-  },
+  ports:
+    plan.target === "supabase"
+      ? {
+          api: plan.ports.api,
+          database: plan.ports.database,
+          studio: plan.ports.studio,
+        }
+      : { database: plan.ports.database },
   files: plan.files.map((file) => ({ path: file.path, action: file.action })),
   safety: plan.safety,
   nextAction:

package/scripts/lib/rehearsal/support_report.mjs

@@ -0,0 +1,102 @@
+/**
+ * Build a copy-ready, data-free support report. The report intentionally omits
+ * project names, paths, command output, environment-variable names, row data,
+ * migration contents, and baseline identifiers.
+ */
+
+import { spawnSync } from "node:child_process";
+import { arch, platform, release } from "node:os";
+import { REHEARSAL_VERSION, redactDiagnosticValue } from "./diagnostics.mjs";
+import { runRehearsalDoctor } from "./plan.mjs";
+
+export const REHEARSAL_SUPPORT_URL =
+  "https://github.com/Ddupasquier/rehearsal-db/issues/new?template=bug.yml";
+
+const safeEnvironment = () =>
+  Object.fromEntries(
+    ["HOME", "LANG", "LC_ALL", "PATH", "SHELL", "TMPDIR"].flatMap((key) =>
+      process.env[key] === undefined ? [] : [[key, process.env[key]]],
+    ),
+  );
+
+const runVersionCommand = (command, args) =>
+  spawnSync(command, args, {
+    encoding: "utf8",
+    env: safeEnvironment(),
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 5_000,
+  });
+
+const inspectTool = ({ command, args, runCommand }) => {
+  const result = runCommand(command, args);
+  if (result.error?.code === "ENOENT") return { status: "not_installed" };
+  if (result.status !== 0) return { status: "unavailable" };
+  const version = String(result.stdout || result.stderr)
+    .trim()
+    .split(/\r?\n/u)[0]
+    .slice(0, 200);
+  return {
+    status: "available",
+    version: redactDiagnosticValue(version || "version not reported"),
+  };
+};
+
+export const collectRehearsalSupportReport = async (
+  options = {},
+  {
+    runDoctor = runRehearsalDoctor,
+    runCommand = runVersionCommand,
+    system = {
+      platform: platform(),
+      release: release(),
+      architecture: arch(),
+      node: process.versions.node,
+    },
+  } = {},
+) => {
+  const doctor = await runDoctor(options);
+  return {
+    rehearsalVersion: REHEARSAL_VERSION,
+    system,
+    tools: {
+      npm: inspectTool({ command: "npm", args: ["--version"], runCommand }),
+      supabase: inspectTool({
+        command: "supabase",
+        args: ["--version"],
+        runCommand,
+      }),
+      dockerClient: inspectTool({
+        command: "docker",
+        args: ["--version"],
+        runCommand,
+      }),
+      dockerServer: inspectTool({
+        command: "docker",
+        args: ["info", "--format", "{{.ServerVersion}}"],
+        runCommand,
+      }),
+    },
+    readiness: {
+      state: doctor.state,
+      checks: doctor.checks.map(({ id, label, status, remediation }) => ({
+        id,
+        label,
+        status,
+        ...(status === "fail" && remediation ? { remediation } : {}),
+      })),
+      quarantinedHostedVariableCount:
+        doctor.ambientHostedVariables?.presentButQuarantined.length ?? 0,
+    },
+    privacy: {
+      omits: [
+        "row values",
+        "credentials",
+        "project paths",
+        "migration SQL",
+        "baseline identifiers",
+      ],
+      reviewBeforeSharing: true,
+    },
+    supportUrl: REHEARSAL_SUPPORT_URL,
+  };
+};