@rehearsal-db/core 0.1.0-beta.5 → 0.1.0-beta.6

package/docs/tutorial.md

@@ -1,96 +1,107 @@
-# Tutorial: rehearse a migration in a new project
+# Safe hands-on tutorial
 
-This walkthrough uses a fictional `widgets` application. It demonstrates the complete
-consumer workflow without importing private or hosted data.
+This tutorial runs a complete PostgreSQL rehearsal in a temporary fictional project. It
+does not use your application, production data, or a hosted database.
 
-## Create the application migration history
+Allow about five minutes. You need Node.js 24 and a running Docker-compatible engine.
 
-The project begins with one historical migration:
+## 1. Prepare Rehearsal
 
-```sql
-create table public.widgets (
-  id bigint generated always as identity primary key,
-  name text not null
-);
+If you do not already have this repository, clone it:
+
+```bash
+git clone https://github.com/Ddupasquier/rehearsal-db.git
+cd rehearsal-db
 ```
 
-Place it at `supabase/migrations/20260101000000_create_widgets.sql`. Add a second,
-candidate migration:
+Then run:
 
-```sql
-alter table public.widgets add column description text;
+```bash
+npm ci --ignore-scripts
+docker pull postgres:17-alpine
 ```
 
-Place that at `supabase/migrations/20260101000100_add_widget_description.sql`.
+If you already have this repository open, use that checkout.
 
-## Configure the isolated runtime
+## 2. Make a temporary project
 
-Run `npx rehearsal init --write`, then edit the result. Give the runtime unique local
-ports and a unique project ID. Its `rehearsalConfig` must point at a dedicated, unlinked
-Supabase config. Never reuse a hosted project reference or production environment file.
+From the Rehearsal repository root, run this block exactly:
 
-Keep the generated `.rehearsal` directory ignored. It contains local artifacts and
-runtime state, not source code.
+```bash
+rehearsal_repo=$PWD
+tutorial_dir=$(mktemp -d)
+cp -R tests/fixtures/postgresql-project "$tutorial_dir/app"
+cd "$tutorial_dir/app"
+npm install --ignore-scripts --no-save "$rehearsal_repo"
+```
 
-## Build a synthetic baseline
+The temporary project contains:
 
-The baseline contains the historical migration bundle, a one-row sanitized data stream,
-and a manifest binding their checksums. Baseline construction is deliberately separate
-from runtime execution: the application owns extraction and policy; the engine accepts
-only a completed, verified artifact.
+- one historical migration that creates a `widgets` table;
+- one candidate migration that adds a `description` column;
+- one synthetic row;
+- a reviewed sanitization policy;
+- an application proof that checks the migrated database.
 
-Write the safe rows to `rehearsal/synthetic-data.ndjson` and the exact represented
-statements to `rehearsal/migration-ledger.json`, then run:
+## 3. Create the baseline
+
+Open the guide:
 
 ```bash
-npx rehearsal baseline create \
-  --records=rehearsal/synthetic-data.ndjson \
-  --ledger=rehearsal/migration-ledger.json
+npx rehearsal
 ```
 
-For an executable sample, inspect `tests/fixtures/rehearsal-project` in the repository.
-The maintained fixture proof invokes this public command through the packed npm tarball
-and never contacts a hosted service.
+The project begins at Stage 3 of 4. Choose **Create the baseline**. Accept the detected
+record and ledger files, review the summary, then confirm creation.
 
-## Prove planning is non-mutating
+The project should advance to Stage 4 of 4 with every item checked.
 
-```bash
-npx rehearsal doctor
-npx rehearsal explain
-npx rehearsal run --dry-run
-npx rehearsal candidates --json
+## 4. Run the migration
+
+Choose **Run a rehearsal**. The guide should show exactly one candidate:
+
+```text
+20260101000100_add_widget_description.sql
 ```
 
-`explain` and `run --dry-run` return the same execution plan. At this point no local
-database has been restored.
+Confirm it. Rehearsal creates a loopback-only PostgreSQL container, restores the baseline,
+applies the candidate, and runs the fixture proof.
 
-## Run and inspect
+Success ends with an application-proof message and suggests exercising the local
+application before verification.
 
-Copy the exact digest from `candidates`:
+## 5. Try the runtime commands
+
+Exit the guide, then run:
 
 ```bash
-npx rehearsal run --confirm-candidates=<sha256>
-npx rehearsal inspect migrations
 npx rehearsal status
+npx rehearsal verify
+npx rehearsal reset
+npx rehearsal stop
+npx rehearsal discard
 ```
 
-The historical migration should be `represented_by_baseline`; the description migration
-should be `applied_to_current_runtime`. Test normal creates, updates, and deletes through
-your local application. They affect only this disposable database.
+`discard` removes only the labeled tutorial container and volume. The temporary project
+directory remains on disk and can be deleted when you no longer need it.
+
+## What you proved
 
-## Prove failure behavior
+You used the same packaged CLI a normal project installs. Rehearsal verified the baseline,
+approved an exact migration, ran it in a disposable database, tested the result, and
+cleaned up only its own runtime.
 
-Add a timestamped migration containing invalid SQL, rerun `candidates`, and use its new
-digest. The command must fail with `migration_candidate_failure`, remove the untrusted
-runtime, and never produce a successful receipt.
+Next, follow [Getting started](getting-started.md) in your own project. Start with synthetic
+rows until the workflow and application proof are reliable.
 
-Then restore the valid migration set and rerun:
+## Supabase check
+
+If Supabase CLI 2.117.0 is installed, the repository also has a fully automated Supabase
+proof:
 
 ```bash
-npx rehearsal reset
-npx rehearsal verify
-npx rehearsal stop
+cd "$rehearsal_repo"
+npm run test:fixture
 ```
 
-That cycle—plan, confirm exact bytes, run, exercise the app, reset—is the normal Rehearsal
-workflow.
+The PostgreSQL equivalent is `npm run test:fixture:postgresql`.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-beta.5",
+  "version": "0.1.0-beta.6",
   "private": false,
-  "description": "Safely rehearse Supabase migrations against sanitized, production-shaped PostgreSQL data.",
+  "description": "Safely rehearse PostgreSQL and Supabase migrations against sanitized, production-shaped data.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Ddupasquier/rehearsal-db.git"
@@ -39,6 +39,7 @@
   "files": [
     "scripts/lib/environment/local_supabase.mjs",
     "scripts/lib/rehearsal",
+    "scripts/lib/runtime",
     "scripts/operations/database/manage_rehearsal_database.mjs",
     "scripts/operations/rehearsal/rehearsal_cli.mjs",
     "docs/*.md",
@@ -55,6 +56,7 @@
     "test:unit": "vitest run tests/scripts",
     "test:docs": "vitest run tests/contracts/documentationCommands.test.mjs",
     "test:fixture": "node scripts/operations/rehearsal/prove_independent_fixture.mjs",
+    "test:fixture:postgresql": "node scripts/operations/rehearsal/prove_postgresql_fixture.mjs",
     "check": "npm run check:syntax && npm run test && npm run format:check && npm run package:audit",
     "check:syntax": "find scripts tests -type f -name '*.mjs' -exec node --check {} +",
     "format": "prettier --write .",

package/scripts/lib/rehearsal/configuration.d.mts

@@ -3,7 +3,7 @@ export type RehearsalConfigVersion = 1;
 export interface RehearsalConfig {
   schemaVersion: RehearsalConfigVersion;
   project: { name: string };
-  supabase: {
+  supabase?: {
     workdir: string;
     migrationDirectory: string;
     rehearsalConfig: string;
@@ -11,6 +11,13 @@ export interface RehearsalConfig {
     serviceEnvironmentFile?: string;
     serviceEnvironmentVariables?: string[];
   };
+  postgresql?: {
+    migrationDirectory: string;
+    runtimeWorkdir?: string;
+    image?: string;
+    database?: string;
+    user?: string;
+  };
   baseline: {
     artifactDirectory?: string;
     sanitizationPolicy: string;
@@ -22,11 +29,12 @@ export interface RehearsalConfig {
     runtimeAdapter?: string;
   };
   runtime: {
+    target?: "supabase" | "postgresql";
     applicationUrl?: string;
     projectId?: string;
-    apiPort: number;
+    apiPort?: number;
     databasePort: number;
-    studioPort: number;
+    studioPort?: number;
   };
   safety?: {
     allowedHosts?: string[];
@@ -58,6 +66,13 @@ export declare const renderDetectedConfig: (
     ports?: { api: number; database: number; studio: number };
   },
 ) => string;
+export declare const renderDetectedPostgresqlConfig: (
+  detected: unknown,
+  options?: {
+    applicationUrl?: string;
+    databasePort?: number;
+  },
+) => string;
 export declare const SANITIZATION_ACTIONS: Readonly<{
   KEEP: "KEEP";
   PSEUDONYMIZE: "PSEUDONYMIZE";

package/scripts/lib/rehearsal/configuration.mjs

@@ -7,6 +7,7 @@
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
 
 export {
   EXCLUDED_VALUE,
@@ -29,6 +30,11 @@ export const REHEARSAL_DEFAULTS = Object.freeze({
   safety: Object.freeze({
     allowedHosts: Object.freeze(["127.0.0.1", "::1", "localhost"]),
     blockedEnvironmentVariables: Object.freeze([
+      "DATABASE_URL",
+      "PGHOST",
+      "PGPASSWORD",
+      "PGPORT",
+      "PGUSER",
       "SUPABASE_ACCESS_TOKEN",
       "SUPABASE_DB_PASSWORD",
       "SUPABASE_PROJECT_ID",
@@ -48,6 +54,8 @@ const CONFIG_FILENAMES = Object.freeze([
 
 const LOOPBACK_HOSTS = new Set(REHEARSAL_DEFAULTS.safety.allowedHosts);
 const IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}$/u;
+const DATABASE_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]{0,62}$/u;
+const POSTGRES_IMAGE_PATTERN = /^postgres:\d+(?:\.\d+)?-alpine$/u;
 const SAFE_COMMAND_PATTERN = /^[^\n\r\0]+$/u;
 
 const isPlainObject = (value) =>
@@ -141,6 +149,7 @@ const normalizeConfig = (input) => {
       "schemaVersion",
       "project",
       "supabase",
+      "postgresql",
       "baseline",
       "application",
       "runtime",
@@ -164,19 +173,46 @@ const normalizeConfig = (input) => {
     );
   }
 
-  const supabase = assertPlainObject(root.supabase, "config.supabase");
-  assertKnownKeys(
-    supabase,
-    [
-      "workdir",
-      "migrationDirectory",
-      "rehearsalConfig",
-      "runtimeWorkdir",
-      "serviceEnvironmentFile",
-      "serviceEnvironmentVariables",
-    ],
-    "config.supabase",
-  );
+  const runtimeTarget = resolveRuntimeTarget(root.runtime?.target).id;
+  const supabase =
+    runtimeTarget === "supabase"
+      ? assertPlainObject(root.supabase, "config.supabase")
+      : null;
+  const postgresql =
+    runtimeTarget === "postgresql"
+      ? assertPlainObject(root.postgresql, "config.postgresql")
+      : null;
+  if (runtimeTarget === "supabase" && root.postgresql !== undefined) {
+    throw new Error(
+      "config.postgresql is not allowed when config.runtime.target is supabase.",
+    );
+  }
+  if (runtimeTarget === "postgresql" && root.supabase !== undefined) {
+    throw new Error(
+      "config.supabase is not allowed when config.runtime.target is postgresql.",
+    );
+  }
+  if (supabase) {
+    assertKnownKeys(
+      supabase,
+      [
+        "workdir",
+        "migrationDirectory",
+        "rehearsalConfig",
+        "runtimeWorkdir",
+        "serviceEnvironmentFile",
+        "serviceEnvironmentVariables",
+      ],
+      "config.supabase",
+    );
+  }
+  if (postgresql) {
+    assertKnownKeys(
+      postgresql,
+      ["migrationDirectory", "runtimeWorkdir", "image", "database", "user"],
+      "config.postgresql",
+    );
+  }
   const baseline = assertPlainObject(root.baseline, "config.baseline");
   assertKnownKeys(
     baseline,
@@ -192,7 +228,14 @@ const normalizeConfig = (input) => {
   const runtime = assertPlainObject(root.runtime ?? {}, "config.runtime");
   assertKnownKeys(
     runtime,
-    ["applicationUrl", "projectId", "apiPort", "databasePort", "studioPort"],
+    [
+      "target",
+      "applicationUrl",
+      "projectId",
+      "apiPort",
+      "databasePort",
+      "studioPort",
+    ],
     "config.runtime",
   );
   const safety = assertPlainObject(root.safety ?? {}, "config.safety");
@@ -234,9 +277,13 @@ const normalizeConfig = (input) => {
   }
 
   const ports = {
-    api: assertPort(runtime.apiPort, "config.runtime.apiPort"),
+    ...(runtimeTarget === "supabase"
+      ? { api: assertPort(runtime.apiPort, "config.runtime.apiPort") }
+      : {}),
     database: assertPort(runtime.databasePort, "config.runtime.databasePort"),
-    studio: assertPort(runtime.studioPort, "config.runtime.studioPort"),
+    ...(runtimeTarget === "supabase"
+      ? { studio: assertPort(runtime.studioPort, "config.runtime.studioPort") }
+      : {}),
   };
   if (new Set(Object.values(ports)).size !== Object.values(ports).length) {
     throw new Error("Rehearsal runtime ports must be unique.");
@@ -247,7 +294,7 @@ const normalizeConfig = (input) => {
     throw new Error("config.verification.commands must be an array.");
   }
   const serviceEnvironmentVariables =
-    supabase.serviceEnvironmentVariables ?? [];
+    supabase?.serviceEnvironmentVariables ?? [];
   if (!Array.isArray(serviceEnvironmentVariables)) {
     throw new Error(
       "config.supabase.serviceEnvironmentVariables must be an array.",
@@ -269,41 +316,105 @@ const normalizeConfig = (input) => {
     );
   }
   if (
-    Boolean(supabase.serviceEnvironmentFile) !==
+    Boolean(supabase?.serviceEnvironmentFile) !==
     Boolean(normalizedServiceEnvironmentVariables.length)
   ) {
     throw new Error(
       "config.supabase.serviceEnvironmentFile and serviceEnvironmentVariables must be configured together.",
     );
   }
+  const authenticationProviders = safety.authenticationProviders
+    ? assertStringArray(
+        safety.authenticationProviders,
+        "config.safety.authenticationProviders",
+      )
+    : [];
+  if (runtimeTarget === "postgresql" && authenticationProviders.length > 0) {
+    throw new Error(
+      "config.safety.authenticationProviders is available only for the Supabase target.",
+    );
+  }
 
   return Object.freeze({
     schemaVersion: REHEARSAL_CONFIG_VERSION,
     project: Object.freeze({ name: projectName }),
-    supabase: Object.freeze({
-      workdir: assertRelativePath(supabase.workdir, "config.supabase.workdir"),
-      migrationDirectory: assertRelativePath(
-        supabase.migrationDirectory,
-        "config.supabase.migrationDirectory",
-      ),
-      rehearsalConfig: assertRelativePath(
-        supabase.rehearsalConfig,
-        "config.supabase.rehearsalConfig",
-      ),
-      runtimeWorkdir: assertRelativePath(
-        supabase.runtimeWorkdir,
-        "config.supabase.runtimeWorkdir",
-      ),
-      serviceEnvironmentFile: supabase.serviceEnvironmentFile
-        ? assertRelativePath(
-            supabase.serviceEnvironmentFile,
-            "config.supabase.serviceEnvironmentFile",
-          )
-        : null,
-      serviceEnvironmentVariables: Object.freeze(
-        normalizedServiceEnvironmentVariables,
-      ),
-    }),
+    supabase: supabase
+      ? Object.freeze({
+          workdir: assertRelativePath(
+            supabase.workdir,
+            "config.supabase.workdir",
+          ),
+          migrationDirectory: assertRelativePath(
+            supabase.migrationDirectory,
+            "config.supabase.migrationDirectory",
+          ),
+          rehearsalConfig: assertRelativePath(
+            supabase.rehearsalConfig,
+            "config.supabase.rehearsalConfig",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            supabase.runtimeWorkdir,
+            "config.supabase.runtimeWorkdir",
+          ),
+          serviceEnvironmentFile: supabase.serviceEnvironmentFile
+            ? assertRelativePath(
+                supabase.serviceEnvironmentFile,
+                "config.supabase.serviceEnvironmentFile",
+              )
+            : null,
+          serviceEnvironmentVariables: Object.freeze(
+            normalizedServiceEnvironmentVariables,
+          ),
+        })
+      : null,
+    postgresql: postgresql
+      ? Object.freeze({
+          migrationDirectory: assertRelativePath(
+            postgresql.migrationDirectory,
+            "config.postgresql.migrationDirectory",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            postgresql.runtimeWorkdir ?? ".rehearsal/runtime",
+            "config.postgresql.runtimeWorkdir",
+          ),
+          image: (() => {
+            const image = assertNonEmptyString(
+              postgresql.image ?? "postgres:17-alpine",
+              "config.postgresql.image",
+            );
+            if (!POSTGRES_IMAGE_PATTERN.test(image)) {
+              throw new Error(
+                "config.postgresql.image must name an official versioned Alpine PostgreSQL image, such as postgres:17-alpine.",
+              );
+            }
+            return image;
+          })(),
+          database: (() => {
+            const database = assertNonEmptyString(
+              postgresql.database ?? "postgres",
+              "config.postgresql.database",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(database)) {
+              throw new Error(
+                "config.postgresql.database must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return database;
+          })(),
+          user: (() => {
+            const user = assertNonEmptyString(
+              postgresql.user ?? "postgres",
+              "config.postgresql.user",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(user)) {
+              throw new Error(
+                "config.postgresql.user must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return user;
+          })(),
+        })
+      : null,
     baseline: Object.freeze({
       artifactDirectory: assertRelativePath(
         baseline.artifactDirectory ??
@@ -337,6 +448,7 @@ const normalizeConfig = (input) => {
             ),
     }),
     runtime: Object.freeze({
+      target: runtimeTarget,
       applicationUrl: assertLoopbackUrl(
         runtime.applicationUrl ?? REHEARSAL_DEFAULTS.runtime.applicationUrl,
         "config.runtime.applicationUrl",
@@ -357,14 +469,7 @@ const normalizeConfig = (input) => {
           "config.safety.blockedEnvironmentVariables",
         ),
       ),
-      authenticationProviders: Object.freeze(
-        safety.authenticationProviders
-          ? assertStringArray(
-              safety.authenticationProviders,
-              "config.safety.authenticationProviders",
-            )
-          : [],
-      ),
+      authenticationProviders: Object.freeze(authenticationProviders),
       hostedAccess: "disabled",
       outboundNetwork: "deny",
     }),
@@ -428,14 +533,22 @@ export const loadRehearsalConfig = async ({
     applicationEnvironment: resolveOwnedPath(
       config.application.environmentFile,
     ),
-    migrationDirectory: resolveOwnedPath(config.supabase.migrationDirectory),
-    rehearsalConfig: resolveOwnedPath(config.supabase.rehearsalConfig),
-    runtimeWorkdir: resolveOwnedPath(config.supabase.runtimeWorkdir),
-    serviceEnvironment: config.supabase.serviceEnvironmentFile
+    migrationDirectory: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).migrationDirectory,
+    ),
+    rehearsalConfig: config.supabase
+      ? resolveOwnedPath(config.supabase.rehearsalConfig)
+      : null,
+    runtimeWorkdir: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).runtimeWorkdir,
+    ),
+    serviceEnvironment: config.supabase?.serviceEnvironmentFile
       ? resolveOwnedPath(config.supabase.serviceEnvironmentFile)
       : null,
     sanitizationPolicy: resolveOwnedPath(config.baseline.sanitizationPolicy),
-    supabaseWorkdir: resolveOwnedPath(config.supabase.workdir),
+    supabaseWorkdir: config.supabase
+      ? resolveOwnedPath(config.supabase.workdir)
+      : null,
     runtimeAdapter: config.application.runtimeAdapter
       ? resolveOwnedPath(config.application.runtimeAdapter)
       : null,
@@ -448,7 +561,7 @@ export const loadRehearsalConfig = async ({
   const requiredRuntimeWorkdir = join(paths.artifactDirectory, "runtime");
   if (paths.runtimeWorkdir !== requiredRuntimeWorkdir) {
     throw new Error(
-      "config.supabase.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.",
+      `config.${config.runtime.target}.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.`,
     );
   }
   const environmentRelativePath = relative(
@@ -496,6 +609,13 @@ export const inspectDetectedProject = async ({
       ? "yarn"
       : "npm";
   const scripts = packageJson.scripts ?? {};
+  const postgresqlMigrationDirectory = (
+    await Promise.all(
+      ["database/migrations", "db/migrations", "migrations"].map(
+        async (path) => ({ path, exists: await hasPath(path) }),
+      ),
+    )
+  ).find(({ exists }) => exists)?.path;
   const normalizedProjectName = String(packageJson.name ?? basename(root))
     .toLowerCase()
     .replace(/[^a-z0-9-]+/gu, "-")
@@ -508,6 +628,9 @@ export const inspectDetectedProject = async ({
     packageManager,
     hasSupabaseConfig: await hasPath("supabase/config.toml"),
     hasMigrations: await hasPath("supabase/migrations"),
+    hasPostgresqlMigrations: Boolean(postgresqlMigrationDirectory),
+    postgresqlMigrationDirectory:
+      postgresqlMigrationDirectory ?? "database/migrations",
     applicationCommand:
       ["dev:rehearsal", "dev", "start"]
         .find((name) => typeof scripts[name] === "string")
@@ -548,6 +671,7 @@ export default defineRehearsalConfig({
 		environmentFile: ".rehearsal/runtime.env",
 	},
 	runtime: {
+		target: "supabase",
 		applicationUrl: ${JSON.stringify(applicationUrl)},
 		projectId: "${detected.projectName}-rehearsal",
 		apiPort: ${ports.api},
@@ -567,3 +691,50 @@ export default defineRehearsalConfig({
 	verification: { commands: [${JSON.stringify(detected.verificationCommand)}] },
 });
 `;
+
+export const renderDetectedPostgresqlConfig = (
+  detected,
+  { applicationUrl = "http://localhost:5175", databasePort = 58322 } = {},
+) => `// @ts-check
+import { defineRehearsalConfig } from "@rehearsal-db/core";
+
+export default defineRehearsalConfig({
+	schemaVersion: 1,
+	project: { name: ${JSON.stringify(detected.projectName)} },
+	postgresql: {
+		migrationDirectory: ${JSON.stringify(detected.postgresqlMigrationDirectory)},
+		runtimeWorkdir: ".rehearsal/runtime",
+		image: "postgres:17-alpine",
+		database: "postgres",
+		user: "postgres",
+	},
+	baseline: {
+		artifactDirectory: ".rehearsal",
+		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
+	},
+	application: {
+		startCommand: ${JSON.stringify(detected.applicationCommand)},
+		proofCommand: ${JSON.stringify(detected.verificationCommand)},
+		environmentFile: ".rehearsal/runtime.env",
+	},
+	runtime: {
+		target: "postgresql",
+		applicationUrl: ${JSON.stringify(applicationUrl)},
+		projectId: "${detected.projectName}-rehearsal",
+		databasePort: ${databasePort},
+	},
+	safety: {
+		allowedHosts: ["127.0.0.1", "::1", "localhost"],
+		blockedEnvironmentVariables: [
+			"DATABASE_URL",
+			"PGHOST",
+			"PGPASSWORD",
+			"PGPORT",
+			"PGUSER",
+		],
+		hostedAccess: "disabled",
+		outboundNetwork: "deny",
+	},
+	verification: { commands: [${JSON.stringify(detected.verificationCommand)}] },
+});
+`;

package/scripts/lib/rehearsal/diagnostics.mjs

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 
 export const REHEARSAL_RESULT_VERSION = 1;
-export const REHEARSAL_VERSION = "0.1.0-beta.5";
+export const REHEARSAL_VERSION = "0.1.0-beta.6";
 
 export const REHEARSAL_EXIT_CODES = Object.freeze({
   success: 0,
@@ -109,7 +109,9 @@ const inferCategory = (error) => {
     return "unsafe_environment";
   }
   if (
-    /docker|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(message)
+    /docker|postgres(?:ql)?|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(
+      message,
+    )
   ) {
     return "runtime_dependency_failure";
   }