@rehearsal-db/core 0.1.0-beta.5 → 0.1.0-beta.7

package/scripts/lib/rehearsal/configuration.d.mts

@@ -3,7 +3,7 @@ export type RehearsalConfigVersion = 1;
 export interface RehearsalConfig {
   schemaVersion: RehearsalConfigVersion;
   project: { name: string };
-  supabase: {
+  supabase?: {
     workdir: string;
     migrationDirectory: string;
     rehearsalConfig: string;
@@ -11,10 +11,23 @@ export interface RehearsalConfig {
     serviceEnvironmentFile?: string;
     serviceEnvironmentVariables?: string[];
   };
+  postgresql?: {
+    migrationDirectory: string;
+    runtimeWorkdir?: string;
+    image?: string;
+    database?: string;
+    user?: string;
+  };
   baseline: {
     artifactDirectory?: string;
     sanitizationPolicy: string;
   };
+  containerRuntime?: {
+    autoStartColima?: boolean;
+  };
+  cleanup?: {
+    retainBaselineGenerations?: number;
+  };
   application: {
     startCommand: string;
     proofCommand: string;
@@ -22,11 +35,12 @@ export interface RehearsalConfig {
     runtimeAdapter?: string;
   };
   runtime: {
+    target?: "supabase" | "postgresql";
     applicationUrl?: string;
     projectId?: string;
-    apiPort: number;
+    apiPort?: number;
     databasePort: number;
-    studioPort: number;
+    studioPort?: number;
   };
   safety?: {
     allowedHosts?: string[];
@@ -58,6 +72,13 @@ export declare const renderDetectedConfig: (
     ports?: { api: number; database: number; studio: number };
   },
 ) => string;
+export declare const renderDetectedPostgresqlConfig: (
+  detected: unknown,
+  options?: {
+    applicationUrl?: string;
+    databasePort?: number;
+  },
+) => string;
 export declare const SANITIZATION_ACTIONS: Readonly<{
   KEEP: "KEEP";
   PSEUDONYMIZE: "PSEUDONYMIZE";

package/scripts/lib/rehearsal/configuration.mjs

@@ -7,6 +7,7 @@
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
 
 export {
   EXCLUDED_VALUE,
@@ -22,6 +23,8 @@ export const REHEARSAL_CONFIG_VERSION = 1;
 
 export const REHEARSAL_DEFAULTS = Object.freeze({
   baseline: Object.freeze({ artifactDirectory: ".rehearsal" }),
+  containerRuntime: Object.freeze({ autoStartColima: true }),
+  cleanup: Object.freeze({ retainBaselineGenerations: 2 }),
   runtime: Object.freeze({
     applicationUrl: "http://localhost:5175",
     projectId: "rehearsal-local",
@@ -29,6 +32,11 @@ export const REHEARSAL_DEFAULTS = Object.freeze({
   safety: Object.freeze({
     allowedHosts: Object.freeze(["127.0.0.1", "::1", "localhost"]),
     blockedEnvironmentVariables: Object.freeze([
+      "DATABASE_URL",
+      "PGHOST",
+      "PGPASSWORD",
+      "PGPORT",
+      "PGUSER",
       "SUPABASE_ACCESS_TOKEN",
       "SUPABASE_DB_PASSWORD",
       "SUPABASE_PROJECT_ID",
@@ -48,6 +56,8 @@ const CONFIG_FILENAMES = Object.freeze([
 
 const LOOPBACK_HOSTS = new Set(REHEARSAL_DEFAULTS.safety.allowedHosts);
 const IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}$/u;
+const DATABASE_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]{0,62}$/u;
+const POSTGRES_IMAGE_PATTERN = /^postgres:\d+(?:\.\d+)?-alpine$/u;
 const SAFE_COMMAND_PATTERN = /^[^\n\r\0]+$/u;
 
 const isPlainObject = (value) =>
@@ -103,6 +113,20 @@ const assertPort = (value, path) => {
   return value;
 };
 
+const assertBoolean = (value, path) => {
+  if (typeof value !== "boolean") {
+    throw new Error(`${path} must be true or false.`);
+  }
+  return value;
+};
+
+const assertPositiveInteger = (value, path) => {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${path} must be a positive integer.`);
+  }
+  return value;
+};
+
 const assertStringArray = (value, path) => {
   if (
     !Array.isArray(value) ||
@@ -141,7 +165,10 @@ const normalizeConfig = (input) => {
       "schemaVersion",
       "project",
       "supabase",
+      "postgresql",
       "baseline",
+      "containerRuntime",
+      "cleanup",
       "application",
       "runtime",
       "safety",
@@ -164,25 +191,63 @@ const normalizeConfig = (input) => {
     );
   }
 
-  const supabase = assertPlainObject(root.supabase, "config.supabase");
-  assertKnownKeys(
-    supabase,
-    [
-      "workdir",
-      "migrationDirectory",
-      "rehearsalConfig",
-      "runtimeWorkdir",
-      "serviceEnvironmentFile",
-      "serviceEnvironmentVariables",
-    ],
-    "config.supabase",
-  );
+  const runtimeTarget = resolveRuntimeTarget(root.runtime?.target).id;
+  const supabase =
+    runtimeTarget === "supabase"
+      ? assertPlainObject(root.supabase, "config.supabase")
+      : null;
+  const postgresql =
+    runtimeTarget === "postgresql"
+      ? assertPlainObject(root.postgresql, "config.postgresql")
+      : null;
+  if (runtimeTarget === "supabase" && root.postgresql !== undefined) {
+    throw new Error(
+      "config.postgresql is not allowed when config.runtime.target is supabase.",
+    );
+  }
+  if (runtimeTarget === "postgresql" && root.supabase !== undefined) {
+    throw new Error(
+      "config.supabase is not allowed when config.runtime.target is postgresql.",
+    );
+  }
+  if (supabase) {
+    assertKnownKeys(
+      supabase,
+      [
+        "workdir",
+        "migrationDirectory",
+        "rehearsalConfig",
+        "runtimeWorkdir",
+        "serviceEnvironmentFile",
+        "serviceEnvironmentVariables",
+      ],
+      "config.supabase",
+    );
+  }
+  if (postgresql) {
+    assertKnownKeys(
+      postgresql,
+      ["migrationDirectory", "runtimeWorkdir", "image", "database", "user"],
+      "config.postgresql",
+    );
+  }
   const baseline = assertPlainObject(root.baseline, "config.baseline");
   assertKnownKeys(
     baseline,
     ["artifactDirectory", "sanitizationPolicy"],
     "config.baseline",
   );
+  const containerRuntime = assertPlainObject(
+    root.containerRuntime ?? {},
+    "config.containerRuntime",
+  );
+  assertKnownKeys(
+    containerRuntime,
+    ["autoStartColima"],
+    "config.containerRuntime",
+  );
+  const cleanup = assertPlainObject(root.cleanup ?? {}, "config.cleanup");
+  assertKnownKeys(cleanup, ["retainBaselineGenerations"], "config.cleanup");
   const application = assertPlainObject(root.application, "config.application");
   assertKnownKeys(
     application,
@@ -192,7 +257,14 @@ const normalizeConfig = (input) => {
   const runtime = assertPlainObject(root.runtime ?? {}, "config.runtime");
   assertKnownKeys(
     runtime,
-    ["applicationUrl", "projectId", "apiPort", "databasePort", "studioPort"],
+    [
+      "target",
+      "applicationUrl",
+      "projectId",
+      "apiPort",
+      "databasePort",
+      "studioPort",
+    ],
     "config.runtime",
   );
   const safety = assertPlainObject(root.safety ?? {}, "config.safety");
@@ -234,9 +306,13 @@ const normalizeConfig = (input) => {
   }
 
   const ports = {
-    api: assertPort(runtime.apiPort, "config.runtime.apiPort"),
+    ...(runtimeTarget === "supabase"
+      ? { api: assertPort(runtime.apiPort, "config.runtime.apiPort") }
+      : {}),
     database: assertPort(runtime.databasePort, "config.runtime.databasePort"),
-    studio: assertPort(runtime.studioPort, "config.runtime.studioPort"),
+    ...(runtimeTarget === "supabase"
+      ? { studio: assertPort(runtime.studioPort, "config.runtime.studioPort") }
+      : {}),
   };
   if (new Set(Object.values(ports)).size !== Object.values(ports).length) {
     throw new Error("Rehearsal runtime ports must be unique.");
@@ -247,7 +323,7 @@ const normalizeConfig = (input) => {
     throw new Error("config.verification.commands must be an array.");
   }
   const serviceEnvironmentVariables =
-    supabase.serviceEnvironmentVariables ?? [];
+    supabase?.serviceEnvironmentVariables ?? [];
   if (!Array.isArray(serviceEnvironmentVariables)) {
     throw new Error(
       "config.supabase.serviceEnvironmentVariables must be an array.",
@@ -269,41 +345,105 @@ const normalizeConfig = (input) => {
     );
   }
   if (
-    Boolean(supabase.serviceEnvironmentFile) !==
+    Boolean(supabase?.serviceEnvironmentFile) !==
     Boolean(normalizedServiceEnvironmentVariables.length)
   ) {
     throw new Error(
       "config.supabase.serviceEnvironmentFile and serviceEnvironmentVariables must be configured together.",
     );
   }
+  const authenticationProviders = safety.authenticationProviders
+    ? assertStringArray(
+        safety.authenticationProviders,
+        "config.safety.authenticationProviders",
+      )
+    : [];
+  if (runtimeTarget === "postgresql" && authenticationProviders.length > 0) {
+    throw new Error(
+      "config.safety.authenticationProviders is available only for the Supabase target.",
+    );
+  }
 
   return Object.freeze({
     schemaVersion: REHEARSAL_CONFIG_VERSION,
     project: Object.freeze({ name: projectName }),
-    supabase: Object.freeze({
-      workdir: assertRelativePath(supabase.workdir, "config.supabase.workdir"),
-      migrationDirectory: assertRelativePath(
-        supabase.migrationDirectory,
-        "config.supabase.migrationDirectory",
-      ),
-      rehearsalConfig: assertRelativePath(
-        supabase.rehearsalConfig,
-        "config.supabase.rehearsalConfig",
-      ),
-      runtimeWorkdir: assertRelativePath(
-        supabase.runtimeWorkdir,
-        "config.supabase.runtimeWorkdir",
-      ),
-      serviceEnvironmentFile: supabase.serviceEnvironmentFile
-        ? assertRelativePath(
-            supabase.serviceEnvironmentFile,
-            "config.supabase.serviceEnvironmentFile",
-          )
-        : null,
-      serviceEnvironmentVariables: Object.freeze(
-        normalizedServiceEnvironmentVariables,
-      ),
-    }),
+    supabase: supabase
+      ? Object.freeze({
+          workdir: assertRelativePath(
+            supabase.workdir,
+            "config.supabase.workdir",
+          ),
+          migrationDirectory: assertRelativePath(
+            supabase.migrationDirectory,
+            "config.supabase.migrationDirectory",
+          ),
+          rehearsalConfig: assertRelativePath(
+            supabase.rehearsalConfig,
+            "config.supabase.rehearsalConfig",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            supabase.runtimeWorkdir,
+            "config.supabase.runtimeWorkdir",
+          ),
+          serviceEnvironmentFile: supabase.serviceEnvironmentFile
+            ? assertRelativePath(
+                supabase.serviceEnvironmentFile,
+                "config.supabase.serviceEnvironmentFile",
+              )
+            : null,
+          serviceEnvironmentVariables: Object.freeze(
+            normalizedServiceEnvironmentVariables,
+          ),
+        })
+      : null,
+    postgresql: postgresql
+      ? Object.freeze({
+          migrationDirectory: assertRelativePath(
+            postgresql.migrationDirectory,
+            "config.postgresql.migrationDirectory",
+          ),
+          runtimeWorkdir: assertRelativePath(
+            postgresql.runtimeWorkdir ?? ".rehearsal/runtime",
+            "config.postgresql.runtimeWorkdir",
+          ),
+          image: (() => {
+            const image = assertNonEmptyString(
+              postgresql.image ?? "postgres:17-alpine",
+              "config.postgresql.image",
+            );
+            if (!POSTGRES_IMAGE_PATTERN.test(image)) {
+              throw new Error(
+                "config.postgresql.image must name an official versioned Alpine PostgreSQL image, such as postgres:17-alpine.",
+              );
+            }
+            return image;
+          })(),
+          database: (() => {
+            const database = assertNonEmptyString(
+              postgresql.database ?? "postgres",
+              "config.postgresql.database",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(database)) {
+              throw new Error(
+                "config.postgresql.database must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return database;
+          })(),
+          user: (() => {
+            const user = assertNonEmptyString(
+              postgresql.user ?? "postgres",
+              "config.postgresql.user",
+            );
+            if (!DATABASE_IDENTIFIER_PATTERN.test(user)) {
+              throw new Error(
+                "config.postgresql.user must be a safe lowercase PostgreSQL identifier.",
+              );
+            }
+            return user;
+          })(),
+        })
+      : null,
     baseline: Object.freeze({
       artifactDirectory: assertRelativePath(
         baseline.artifactDirectory ??
@@ -315,6 +455,20 @@ const normalizeConfig = (input) => {
         "config.baseline.sanitizationPolicy",
       ),
     }),
+    containerRuntime: Object.freeze({
+      autoStartColima: assertBoolean(
+        containerRuntime.autoStartColima ??
+          REHEARSAL_DEFAULTS.containerRuntime.autoStartColima,
+        "config.containerRuntime.autoStartColima",
+      ),
+    }),
+    cleanup: Object.freeze({
+      retainBaselineGenerations: assertPositiveInteger(
+        cleanup.retainBaselineGenerations ??
+          REHEARSAL_DEFAULTS.cleanup.retainBaselineGenerations,
+        "config.cleanup.retainBaselineGenerations",
+      ),
+    }),
     application: Object.freeze({
       startCommand: assertCommand(
         application.startCommand,
@@ -337,6 +491,7 @@ const normalizeConfig = (input) => {
             ),
     }),
     runtime: Object.freeze({
+      target: runtimeTarget,
       applicationUrl: assertLoopbackUrl(
         runtime.applicationUrl ?? REHEARSAL_DEFAULTS.runtime.applicationUrl,
         "config.runtime.applicationUrl",
@@ -357,14 +512,7 @@ const normalizeConfig = (input) => {
           "config.safety.blockedEnvironmentVariables",
         ),
       ),
-      authenticationProviders: Object.freeze(
-        safety.authenticationProviders
-          ? assertStringArray(
-              safety.authenticationProviders,
-              "config.safety.authenticationProviders",
-            )
-          : [],
-      ),
+      authenticationProviders: Object.freeze(authenticationProviders),
       hostedAccess: "disabled",
       outboundNetwork: "deny",
     }),
@@ -428,14 +576,22 @@ export const loadRehearsalConfig = async ({
     applicationEnvironment: resolveOwnedPath(
       config.application.environmentFile,
     ),
-    migrationDirectory: resolveOwnedPath(config.supabase.migrationDirectory),
-    rehearsalConfig: resolveOwnedPath(config.supabase.rehearsalConfig),
-    runtimeWorkdir: resolveOwnedPath(config.supabase.runtimeWorkdir),
-    serviceEnvironment: config.supabase.serviceEnvironmentFile
+    migrationDirectory: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).migrationDirectory,
+    ),
+    rehearsalConfig: config.supabase
+      ? resolveOwnedPath(config.supabase.rehearsalConfig)
+      : null,
+    runtimeWorkdir: resolveOwnedPath(
+      (config.supabase ?? config.postgresql).runtimeWorkdir,
+    ),
+    serviceEnvironment: config.supabase?.serviceEnvironmentFile
       ? resolveOwnedPath(config.supabase.serviceEnvironmentFile)
       : null,
     sanitizationPolicy: resolveOwnedPath(config.baseline.sanitizationPolicy),
-    supabaseWorkdir: resolveOwnedPath(config.supabase.workdir),
+    supabaseWorkdir: config.supabase
+      ? resolveOwnedPath(config.supabase.workdir)
+      : null,
     runtimeAdapter: config.application.runtimeAdapter
       ? resolveOwnedPath(config.application.runtimeAdapter)
       : null,
@@ -448,7 +604,7 @@ export const loadRehearsalConfig = async ({
   const requiredRuntimeWorkdir = join(paths.artifactDirectory, "runtime");
   if (paths.runtimeWorkdir !== requiredRuntimeWorkdir) {
     throw new Error(
-      "config.supabase.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.",
+      `config.${config.runtime.target}.runtimeWorkdir must resolve to the runtime directory inside config.baseline.artifactDirectory.`,
     );
   }
   const environmentRelativePath = relative(
@@ -496,6 +652,13 @@ export const inspectDetectedProject = async ({
       ? "yarn"
       : "npm";
   const scripts = packageJson.scripts ?? {};
+  const postgresqlMigrationDirectory = (
+    await Promise.all(
+      ["database/migrations", "db/migrations", "migrations"].map(
+        async (path) => ({ path, exists: await hasPath(path) }),
+      ),
+    )
+  ).find(({ exists }) => exists)?.path;
   const normalizedProjectName = String(packageJson.name ?? basename(root))
     .toLowerCase()
     .replace(/[^a-z0-9-]+/gu, "-")
@@ -508,6 +671,9 @@ export const inspectDetectedProject = async ({
     packageManager,
     hasSupabaseConfig: await hasPath("supabase/config.toml"),
     hasMigrations: await hasPath("supabase/migrations"),
+    hasPostgresqlMigrations: Boolean(postgresqlMigrationDirectory),
+    postgresqlMigrationDirectory:
+      postgresqlMigrationDirectory ?? "database/migrations",
     applicationCommand:
       ["dev:rehearsal", "dev", "start"]
         .find((name) => typeof scripts[name] === "string")
@@ -526,34 +692,70 @@ export const renderDetectedConfig = (
     applicationUrl = "http://localhost:5175",
     ports = { api: 58321, database: 58322, studio: 58323 },
   } = {},
-) => `// @ts-check
+) =>
+  `// @ts-check
+/**
+ * Rehearsal configuration for ${detected.projectName}.
+ * Generated from this project by \`npx rehearsal\` and safe to commit.
+ * Review the CHECK comments. Keep passwords, tokens, and production URLs out of this file.
+ * Docs: https://github.com/Ddupasquier/rehearsal-db/blob/main/docs/configuration.md
+ */
 import { defineRehearsalConfig } from "@rehearsal-db/core";
 
 export default defineRehearsalConfig({
+	// Configuration format. Rehearsal will explain if an upgrade is ever needed.
 	schemaVersion: 1,
+	// Stable local name used in Rehearsal labels and reports.
 	project: { name: ${JSON.stringify(detected.projectName)} },
+
+	// Project files Rehearsal reads. Every path stays inside this repository.
 	supabase: {
 		workdir: ".",
 		migrationDirectory: "supabase/migrations",
 		rehearsalConfig: "infrastructure/rehearsal/supabase/config.toml",
 		runtimeWorkdir: ".rehearsal/runtime",
+
+		// Optional local-only identity-provider credentials. Enable both keys together.
+		// serviceEnvironmentFile: ".env.rehearsal-service.local",
+		// serviceEnvironmentVariables: ["LOCAL_IDP_CLIENT_ID", "LOCAL_IDP_SECRET"],
 	},
+
+	// Immutable local baseline files. Rehearsal never reads production on your behalf.
 	baseline: {
 		artifactDirectory: ".rehearsal",
 		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
 	},
+
+	// Reuse any running Docker-compatible engine; start Colima only when needed.
+	containerRuntime: {
+		autoStartColima: true,
+	},
+
+	// Keep this many baseline generations, always including the active one.
+	cleanup: {
+		retainBaselineGenerations: 2,
+	},
+
 	application: {
+		// CHECK: commands detected from package.json. Change them if they are not correct.
 		startCommand: ${JSON.stringify(detected.applicationCommand)},
 		proofCommand: ${JSON.stringify(detected.verificationCommand)},
 		environmentFile: ".rehearsal/runtime.env",
+		// Optional project-specific restore hook:
+		// runtimeAdapter: "infrastructure/rehearsal/runtime-adapter.mjs",
 	},
+
+	// Disposable local runtime identity, URL, and dedicated ports.
 	runtime: {
+		target: "supabase",
 		applicationUrl: ${JSON.stringify(applicationUrl)},
 		projectId: "${detected.projectName}-rehearsal",
 		apiPort: ${ports.api},
 		databasePort: ${ports.database},
 		studioPort: ${ports.studio},
 	},
+
+	// Only local runtime URLs are accepted; common hosted credentials are quarantined.
 	safety: {
 		allowedHosts: ["127.0.0.1", "::1", "localhost"],
 		blockedEnvironmentVariables: [
@@ -564,6 +766,82 @@ export default defineRehearsalConfig({
 		hostedAccess: "disabled",
 		outboundNetwork: "deny",
 	},
-	verification: { commands: [${JSON.stringify(detected.verificationCommand)}] },
 });
-`;
+`.replaceAll("\t", "  ");
+
+export const renderDetectedPostgresqlConfig = (
+  detected,
+  { applicationUrl = "http://localhost:5175", databasePort = 58322 } = {},
+) =>
+  `// @ts-check
+/**
+ * Rehearsal configuration for ${detected.projectName}.
+ * Generated from this project by \`npx rehearsal\` and safe to commit.
+ * Review the CHECK comments. Keep passwords, tokens, and production URLs out of this file.
+ * Docs: https://github.com/Ddupasquier/rehearsal-db/blob/main/docs/configuration.md
+ */
+import { defineRehearsalConfig } from "@rehearsal-db/core";
+
+export default defineRehearsalConfig({
+	// Configuration format. Rehearsal will explain if an upgrade is ever needed.
+	schemaVersion: 1,
+	// Stable local name used in Rehearsal labels and reports.
+	project: { name: ${JSON.stringify(detected.projectName)} },
+
+	// Disposable PostgreSQL settings. The image must already exist locally.
+	postgresql: {
+		migrationDirectory: ${JSON.stringify(detected.postgresqlMigrationDirectory)},
+		runtimeWorkdir: ".rehearsal/runtime",
+		image: "postgres:17-alpine",
+		database: "postgres",
+		user: "postgres",
+	},
+
+	// Immutable local baseline files. Rehearsal never reads production on your behalf.
+	baseline: {
+		artifactDirectory: ".rehearsal",
+		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
+	},
+
+	// Reuse any running Docker-compatible engine; start Colima only when needed.
+	containerRuntime: {
+		autoStartColima: true,
+	},
+
+	// Keep this many baseline generations, always including the active one.
+	cleanup: {
+		retainBaselineGenerations: 2,
+	},
+
+	application: {
+		// CHECK: commands detected from package.json. Change them if they are not correct.
+		startCommand: ${JSON.stringify(detected.applicationCommand)},
+		proofCommand: ${JSON.stringify(detected.verificationCommand)},
+		environmentFile: ".rehearsal/runtime.env",
+		// Optional project-specific restore hook:
+		// runtimeAdapter: "infrastructure/rehearsal/runtime-adapter.mjs",
+	},
+
+	// Disposable local runtime identity, URL, and dedicated database port.
+	runtime: {
+		target: "postgresql",
+		applicationUrl: ${JSON.stringify(applicationUrl)},
+		projectId: "${detected.projectName}-rehearsal",
+		databasePort: ${databasePort},
+	},
+
+	// Only local runtime URLs are accepted; common hosted credentials are quarantined.
+	safety: {
+		allowedHosts: ["127.0.0.1", "::1", "localhost"],
+		blockedEnvironmentVariables: [
+			"DATABASE_URL",
+			"PGHOST",
+			"PGPASSWORD",
+			"PGPORT",
+			"PGUSER",
+		],
+		hostedAccess: "disabled",
+		outboundNetwork: "deny",
+	},
+});
+`.replaceAll("\t", "  ");

package/scripts/lib/rehearsal/diagnostics.mjs

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 
 export const REHEARSAL_RESULT_VERSION = 1;
-export const REHEARSAL_VERSION = "0.1.0-beta.5";
+export const REHEARSAL_VERSION = "0.1.0-beta.7";
 
 export const REHEARSAL_EXIT_CODES = Object.freeze({
   success: 0,
@@ -109,7 +109,9 @@ const inferCategory = (error) => {
     return "unsafe_environment";
   }
   if (
-    /docker|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(message)
+    /docker|postgres(?:ql)?|supabase|runtime|command|enoent|node\.js|ports?\b/iu.test(
+      message,
+    )
   ) {
     return "runtime_dependency_failure";
   }