@rehearsal-db/core 0.1.0-beta.5 → 0.1.0-beta.7

package/scripts/lib/rehearsal/plan.mjs

@@ -105,6 +105,14 @@ const resultCheck = async ({ id, label, run, remediation }) => {
 };
 
 const assertRuntimeConfigMatches = async ({ config, paths }) => {
+  if (config.runtime.target === "postgresql") {
+    if (paths.rehearsalConfig !== null || paths.supabaseWorkdir !== null) {
+      throw new Error(
+        "The PostgreSQL target unexpectedly resolved Supabase paths.",
+      );
+    }
+    return `isolated PostgreSQL image ${config.postgresql.image} and a loopback database port are configured`;
+  }
   const source = await readFile(paths.rehearsalConfig, "utf8");
   const expected = [
     ["project_id", config.runtime.projectId],
@@ -217,7 +225,8 @@ export const buildRehearsalPlan = async (options = {}) => {
       project: config.project.name,
     },
     environment: {
-      kind: "isolated_local_supabase",
+      target: config.runtime.target,
+      kind: `isolated_local_${config.runtime.target}`,
       applicationUrl: config.runtime.applicationUrl,
       projectId: config.runtime.projectId,
       ports: config.runtime.ports,
@@ -226,9 +235,9 @@ export const buildRehearsalPlan = async (options = {}) => {
       authenticationProviders: config.safety.authenticationProviders,
       barriers: [
         "versioned configuration accepts loopback hosts only",
-        "runtime uses a dedicated local Supabase workdir and project id",
+        `runtime uses a dedicated local ${config.runtime.target === "supabase" ? "Supabase workdir" : "PostgreSQL container and volume"} and project id`,
         "child processes receive an allowlisted environment",
-        "application egress policy denies hosted targets and side effects",
+        "configuration accepts only loopback runtime URLs and quarantines common hosted credentials",
         ...(config.safety.authenticationProviders.length
           ? [
               `external identity is limited to: ${config.safety.authenticationProviders.join(", ")}`,
@@ -382,14 +391,37 @@ export const runRehearsalDoctor = async (options = {}) => {
       remediation: "Use npm for the initial Rehearsal contract.",
     },
     {
-      id: "supabase-cli",
-      label: "Supabase CLI",
+      id:
+        config.runtime.target === "supabase"
+          ? "supabase-cli"
+          : "postgresql-image",
+      label:
+        config.runtime.target === "supabase"
+          ? "Supabase CLI"
+          : "PostgreSQL image",
       run: async () => {
-        const result = commandAvailable("supabase");
-        if (!result.available) throw new Error("Supabase CLI is unavailable.");
-        return result.version;
+        if (config.runtime.target === "supabase") {
+          const result = commandAvailable("supabase");
+          if (!result.available)
+            throw new Error("Supabase CLI is unavailable.");
+          return result.version;
+        }
+        const result = commandAvailable("docker", [
+          "image",
+          "inspect",
+          config.postgresql.image,
+        ]);
+        if (!result.available) {
+          throw new Error(
+            `PostgreSQL image ${config.postgresql.image} is unavailable locally.`,
+          );
+        }
+        return config.postgresql.image;
       },
-      remediation: "Install the Supabase CLI in the project and retry.",
+      remediation:
+        config.runtime.target === "supabase"
+          ? "Install the Supabase CLI in the project and retry."
+          : `Pull and review ${config.postgresql.image}, then retry.`,
     },
     {
       id: "docker",
@@ -412,13 +444,17 @@ export const runRehearsalDoctor = async (options = {}) => {
       run: async () => {
         await Promise.all([
           verifyPath(paths.migrationDirectory, "directory"),
-          verifyPath(paths.rehearsalConfig, "file"),
+          ...(paths.rehearsalConfig
+            ? [verifyPath(paths.rehearsalConfig, "file")]
+            : []),
           verifyPath(paths.sanitizationPolicy, "file"),
           ...(paths.runtimeAdapter
             ? [verifyPath(paths.runtimeAdapter, "file")]
             : []),
         ]);
-        return "migrations, local runtime config, and sanitization policy exist";
+        return config.runtime.target === "supabase"
+          ? "migrations, local runtime config, and sanitization policy exist"
+          : "migrations and sanitization policy exist";
       },
       remediation:
         "Correct the missing project path in the Rehearsal configuration.",
@@ -446,6 +482,9 @@ export const runRehearsalDoctor = async (options = {}) => {
       id: "service-environment",
       label: "Local service credentials",
       run: async () => {
+        if (config.runtime.target === "postgresql") {
+          return "no local service credentials required";
+        }
         const environment = await readRehearsalServiceEnvironment({
           path: paths.serviceEnvironment,
           keys: config.supabase.serviceEnvironmentVariables,
@@ -472,6 +511,42 @@ export const runRehearsalDoctor = async (options = {}) => {
         );
         const occupied = availability.filter((entry) => !entry.available);
         if (occupied.length) {
+          if (config.runtime.target === "postgresql") {
+            const status = spawnSync(
+              "docker",
+              [
+                "ps",
+                "--filter",
+                `label=com.rehearsal-db.project=${config.runtime.projectId}`,
+                "--format",
+                "{{.Ports}}",
+              ],
+              {
+                cwd: projectRoot,
+                encoding: "utf8",
+                env: Object.fromEntries(
+                  ["HOME", "LANG", "LC_ALL", "PATH", "SHELL", "TMPDIR"].flatMap(
+                    (key) =>
+                      process.env[key] === undefined
+                        ? []
+                        : [[key, process.env[key]]],
+                  ),
+                ),
+                stdio: ["ignore", "pipe", "pipe"],
+              },
+            );
+            if (
+              status.status !== 0 ||
+              !String(status.stdout).includes(
+                `127.0.0.1:${config.runtime.ports.database}->5432/tcp`,
+              )
+            ) {
+              throw new Error(
+                `Configured database port is occupied by an unverified process: database=${config.runtime.ports.database}.`,
+              );
+            }
+            return "occupied only by the configured local Rehearsal runtime";
+          }
           const serviceEnvironment = await readRehearsalServiceEnvironment({
             path: paths.serviceEnvironment,
             keys: config.supabase.serviceEnvironmentVariables,
@@ -576,7 +651,7 @@ export const runRehearsalDoctor = async (options = {}) => {
     },
     {
       id: "safety-policy",
-      label: "Hosted access and side effects",
+      label: "Hosted target configuration",
       run: async () => {
         if (
           config.safety.hostedAccess !== "disabled" ||
@@ -585,8 +660,8 @@ export const runRehearsalDoctor = async (options = {}) => {
           throw new Error("The safety policy is not fail closed.");
         }
         return config.safety.authenticationProviders.length
-          ? `hosted access disabled; application egress denied; identity providers: ${config.safety.authenticationProviders.join(", ")}`
-          : "hosted access disabled; outbound network denied";
+          ? `hosted database targets disabled; hosted credentials quarantined; local identity providers: ${config.safety.authenticationProviders.join(", ")}`
+          : "hosted database targets disabled; common hosted credentials quarantined";
       },
       remediation: "Restore the version-1 fail-closed safety policy.",
     },

package/scripts/lib/rehearsal/runtime_restore.mjs

@@ -236,7 +236,11 @@ const buildForeignKeyChecks = (manifest) =>
     })
     .join("\n\t");
 
-export const buildRestoreSqlSuffix = ({ manifest, tableCounts }) => {
+export const buildRestoreSqlSuffix = ({
+  manifest,
+  tableCounts,
+  restoreSupabaseAuth = true,
+}) => {
   if (!Array.isArray(manifest?.tables) || !tableCounts) {
     throw new Error("A reviewed manifest and exact row counts are required.");
   }
@@ -252,7 +256,7 @@ truncate table ${manifest.tables
     .map((table) => `public.${quoteIdentifier(table.name)}`)
     .join(", ")}
 restart identity cascade;
-${buildAuthRestoreSql(manifest)}
+${restoreSupabaseAuth ? buildAuthRestoreSql(manifest) : ""}
 ${tables.map(buildTableRestoreSql).join("\n")}
 ${tables.map(buildIdentitySequenceSql).filter(Boolean).join("\n")}
 set local session_replication_role = origin;

package/scripts/lib/rehearsal/setup.mjs

@@ -9,7 +9,9 @@ import { dirname, join, relative, resolve } from "node:path";
 import {
   inspectDetectedProject,
   renderDetectedConfig,
+  renderDetectedPostgresqlConfig,
 } from "./configuration.mjs";
+import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
 
 const CONFIG_PATH = "rehearsal.config.mjs";
 const LOCAL_SUPABASE_CONFIG_PATH =
@@ -209,20 +211,26 @@ const assertCreateTargetAvailable = async (file) => {
 export const planRehearsalSetup = async ({
   projectRoot = process.cwd(),
   isPortAvailable,
+  target = "supabase",
 } = {}) => {
   const root = resolve(projectRoot);
+  const runtimeTarget = resolveRuntimeTarget(target).id;
   const detected = await inspectDetectedProject({ projectRoot: root });
   const ports = await findAvailableRehearsalPorts({
     ...(isPortAvailable ? { isAvailable: isPortAvailable } : {}),
   });
   const applicationUrl = "http://localhost:5175";
   const projectId = `${detected.projectName}-rehearsal`;
-  const sourceSupabaseConfig = await readOptionalFile(
-    join(root, "supabase/config.toml"),
-  );
+  const sourceSupabaseConfig =
+    runtimeTarget === "supabase"
+      ? await readOptionalFile(join(root, "supabase/config.toml"))
+      : null;
   const originalGitignore = await readOptionalFile(join(root, GITIGNORE_PATH));
   const nextGitignore = appendGitignoreEntries(originalGitignore);
-  for (const path of [CONFIG_PATH, LOCAL_SUPABASE_CONFIG_PATH]) {
+  for (const path of [
+    CONFIG_PATH,
+    ...(runtimeTarget === "supabase" ? [LOCAL_SUPABASE_CONFIG_PATH] : []),
+  ]) {
     if (await pathExists(join(root, path))) {
       throw new Error(
         `Rehearsal setup will not overwrite the existing file at ${path}.`,
@@ -235,23 +243,34 @@ export const planRehearsalSetup = async ({
       absolutePath: join(root, CONFIG_PATH),
       action: "create",
       mode: 0o600,
-      content: renderDetectedConfig(detected, {
-        applicationUrl,
-        ports,
-      }),
-    },
-    {
-      path: LOCAL_SUPABASE_CONFIG_PATH,
-      absolutePath: join(root, LOCAL_SUPABASE_CONFIG_PATH),
-      action: "create",
-      mode: 0o600,
-      content: renderSafeLocalSupabaseConfig({
-        projectId,
-        applicationUrl,
-        ports,
-        databaseMajorVersion: databaseMajorVersionFrom(sourceSupabaseConfig),
-      }),
+      content:
+        runtimeTarget === "supabase"
+          ? renderDetectedConfig(detected, {
+              applicationUrl,
+              ports,
+            })
+          : renderDetectedPostgresqlConfig(detected, {
+              applicationUrl,
+              databasePort: ports.database,
+            }),
     },
+    ...(runtimeTarget === "supabase"
+      ? [
+          {
+            path: LOCAL_SUPABASE_CONFIG_PATH,
+            absolutePath: join(root, LOCAL_SUPABASE_CONFIG_PATH),
+            action: "create",
+            mode: 0o600,
+            content: renderSafeLocalSupabaseConfig({
+              projectId,
+              applicationUrl,
+              ports,
+              databaseMajorVersion:
+                databaseMajorVersionFrom(sourceSupabaseConfig),
+            }),
+          },
+        ]
+      : []),
     {
       path: GITIGNORE_PATH,
       absolutePath: join(root, GITIGNORE_PATH),
@@ -270,15 +289,24 @@ export const planRehearsalSetup = async ({
     projectRoot: root,
     project: detected.projectName,
     projectId,
+    target: runtimeTarget,
     applicationUrl,
     detected,
-    ports,
+    ports: runtimeTarget === "supabase" ? ports : { database: ports.database },
     isPortAvailable: isPortAvailable ?? isRehearsalPortAvailable,
     files,
     safety: [
       "hosted access remains disabled",
-      "the Supabase runtime binds to dedicated local ports",
-      "external identity providers, realtime, edge functions, and analytics start disabled",
+      runtimeTarget === "supabase"
+        ? "the Supabase runtime binds to dedicated local ports"
+        : "PostgreSQL binds only to a dedicated loopback port",
+      ...(runtimeTarget === "supabase"
+        ? [
+            "external identity providers, realtime, edge functions, and analytics start disabled",
+          ]
+        : [
+            "the runtime uses an already-installed official PostgreSQL image and never pulls implicitly",
+          ]),
       "configuration files are never overwritten and .gitignore updates are concurrency-checked",
     ],
   };
@@ -331,13 +359,17 @@ export const summarizeRehearsalSetup = (plan, { mode }) => ({
   mode,
   project: plan.project,
   projectId: plan.projectId,
+  target: plan.target,
   applicationUrl: plan.applicationUrl,
   detected: plan.detected,
-  ports: {
-    api: plan.ports.api,
-    database: plan.ports.database,
-    studio: plan.ports.studio,
-  },
+  ports:
+    plan.target === "supabase"
+      ? {
+          api: plan.ports.api,
+          database: plan.ports.database,
+          studio: plan.ports.studio,
+        }
+      : { database: plan.ports.database },
   files: plan.files.map((file) => ({ path: file.path, action: file.action })),
   safety: plan.safety,
   nextAction: