@rehearsal-db/core 0.1.0-beta.7 → 0.1.0-beta.9

package/src/identity/storage.mjs

@@ -0,0 +1,165 @@
+/** Copy and verify local Supabase Storage objects during an identity claim. */
+
+import { createHash } from "node:crypto";
+import { assertLoopbackUrl } from "../shared/process_environment.mjs";
+
+const BUCKET = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
+const MAXIMUM_VERIFICATION_BYTES = 100 * 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+
+const objectPath = (value) => {
+  if (
+    typeof value !== "string" ||
+    !value ||
+    value.startsWith("/") ||
+    value.split("/").some((part) => !part || part === "." || part === "..")
+  ) {
+    throw new Error("A Storage identity-claim path is unsafe.");
+  }
+  return value.split("/").map(encodeURIComponent).join("/");
+};
+
+const readVerifiedObject = async ({
+  fetchImpl,
+  baseUrl,
+  headers,
+  bucket,
+  path,
+}) => {
+  const response = await fetchImpl(
+    `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}/${objectPath(path)}?rehearsal=${Date.now()}`,
+    {
+      headers,
+      cache: "no-store",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `Supabase Storage could not read an identity-claim object (HTTP ${response.status}).`,
+    );
+  }
+  const declaredBytes = Number(response.headers.get("content-length"));
+  if (
+    Number.isFinite(declaredBytes) &&
+    declaredBytes > MAXIMUM_VERIFICATION_BYTES
+  ) {
+    throw new Error(
+      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
+    );
+  }
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (bytes.length > MAXIMUM_VERIFICATION_BYTES) {
+    throw new Error(
+      "A Storage identity-claim object exceeds the 100 MiB verification limit.",
+    );
+  }
+  return Object.freeze({
+    bytes: bytes.length,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+  });
+};
+
+export const createSupabaseStorageTransfer = ({
+  url,
+  serviceRoleKey,
+  fetchImpl = globalThis.fetch,
+}) => {
+  assertLoopbackUrl("Rehearsal Supabase Storage", url);
+  if (typeof serviceRoleKey !== "string" || !serviceRoleKey) {
+    throw new Error(
+      "The local runtime environment has no Storage service key.",
+    );
+  }
+  if (typeof fetchImpl !== "function") {
+    throw new Error("A Fetch implementation is required for Storage transfer.");
+  }
+  const baseUrl = url.replace(/\/$/u, "");
+  const headers = Object.freeze({
+    apikey: serviceRoleKey,
+    authorization: `Bearer ${serviceRoleKey}`,
+  });
+  const removePaths = async ({ bucket, paths }) => {
+    if (!BUCKET.test(bucket ?? "") || !Array.isArray(paths) || !paths.length) {
+      throw new Error("A Storage identity-claim removal is invalid.");
+    }
+    paths.forEach(objectPath);
+    const response = await fetchImpl(
+      `${baseUrl}/storage/v1/object/${encodeURIComponent(bucket)}`,
+      {
+        method: "DELETE",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({ prefixes: paths }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      },
+    );
+    if (!response.ok) {
+      throw new Error(
+        `Supabase Storage could not remove identity-claim objects (HTTP ${response.status}).`,
+      );
+    }
+  };
+  return Object.freeze({
+    async copyAndVerify({ bucket, source, destination }) {
+      if (!BUCKET.test(bucket ?? "")) {
+        throw new Error("A Storage identity-claim bucket is invalid.");
+      }
+      objectPath(source);
+      objectPath(destination);
+      if (source === destination) {
+        throw new Error("A Storage identity-claim copy must change the path.");
+      }
+      const sourceReceipt = await readVerifiedObject({
+        fetchImpl,
+        baseUrl,
+        headers,
+        bucket,
+        path: source,
+      });
+      try {
+        const response = await fetchImpl(`${baseUrl}/storage/v1/object/copy`, {
+          method: "POST",
+          headers: { ...headers, "content-type": "application/json" },
+          body: JSON.stringify({
+            bucketId: bucket,
+            sourceKey: source,
+            destinationKey: destination,
+          }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+          throw new Error(
+            `Supabase Storage could not copy an identity-claim object (HTTP ${response.status}).`,
+          );
+        }
+        const destinationReceipt = await readVerifiedObject({
+          fetchImpl,
+          baseUrl,
+          headers,
+          bucket,
+          path: destination,
+        });
+        if (
+          sourceReceipt.bytes !== destinationReceipt.bytes ||
+          sourceReceipt.sha256 !== destinationReceipt.sha256
+        ) {
+          throw new Error(
+            "Supabase Storage copied an identity object with a different byte digest.",
+          );
+        }
+        return destinationReceipt;
+      } catch (error) {
+        try {
+          await removePaths({ bucket, paths: [destination] });
+        } catch (cleanupError) {
+          throw new AggregateError(
+            [error, cleanupError],
+            "Storage identity-copy verification failed and destination cleanup needs attention.",
+          );
+        }
+        throw error;
+      }
+    },
+    remove: removePaths,
+  });
+};

package/{scripts/lib/rehearsal → src/project}/configuration.d.mts

@@ -28,10 +28,44 @@ export interface RehearsalConfig {
   cleanup?: {
     retainBaselineGenerations?: number;
   };
+  preparation?: {
+    sourcePolicy: string;
+    privacyKey: string;
+    batchRows?: number;
+    maximumRows?: number;
+    maximumBytes?: number;
+    diskHeadroomBytes?: number;
+  };
+  runtimePolicy?: string;
+  identityPolicy?: string;
+  dependentTargets?: Array<{
+    name: string;
+    configPath: string;
+    prepareCommand?: string;
+  }>;
   application: {
     startCommand: string;
     proofCommand: string;
     environmentFile?: string;
+    environmentVariables?: Record<string, string>;
+    readiness?: {
+      url: string;
+      expectedStatus: number;
+      timeoutSeconds?: number;
+    };
+    httpProofs?: Array<{
+      name: string;
+      kind: "positive" | "negative";
+      url: string;
+      method?: string;
+      expectedStatus: number;
+      json?: {
+        path: string[];
+        equals?: unknown;
+        notEquals?: unknown;
+        minimumItems?: number;
+      };
+    }>;
     runtimeAdapter?: string;
   };
   runtime: {

package/{scripts/lib/rehearsal → src/project}/configuration.mjs

@@ -7,7 +7,7 @@
 import { access, readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
+import { resolveRuntimeTarget } from "../targets/target.mjs";
 
 export {
   EXCLUDED_VALUE,
@@ -17,7 +17,7 @@ export {
   readBoundRuntimeSanitizationPolicy,
   validateSanitizationCoverage,
   validateRuntimeSanitizationPolicy,
-} from "./sanitization_policy.mjs";
+} from "../baseline/sanitization_policy.mjs";
 
 export const REHEARSAL_CONFIG_VERSION = 1;
 
@@ -59,6 +59,8 @@ const IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}$/u;
 const DATABASE_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]{0,62}$/u;
 const POSTGRES_IMAGE_PATTERN = /^postgres:\d+(?:\.\d+)?-alpine$/u;
 const SAFE_COMMAND_PATTERN = /^[^\n\r\0]+$/u;
+const ENVIRONMENT_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+const ENVIRONMENT_REFERENCE_PATTERN = /^[a-z0-9][a-z0-9-]*:[A-Z][A-Z0-9_]*$/u;
 
 const isPlainObject = (value) =>
   value !== null &&
@@ -138,6 +140,33 @@ const assertStringArray = (value, path) => {
   return [...new Set(value.map((entry) => entry.trim()))];
 };
 
+const normalizeApplicationEnvironmentMappings = (value = {}) => {
+  const mappings = assertPlainObject(
+    value,
+    "config.application.environmentVariables",
+  );
+  return Object.freeze(
+    Object.fromEntries(
+      Object.entries(mappings).map(([key, reference]) => {
+        if (!ENVIRONMENT_KEY_PATTERN.test(key)) {
+          throw new Error(
+            `config.application.environmentVariables.${key} is not a safe environment variable name.`,
+          );
+        }
+        if (
+          typeof reference !== "string" ||
+          !ENVIRONMENT_REFERENCE_PATTERN.test(reference)
+        ) {
+          throw new Error(
+            `config.application.environmentVariables.${key} must reference target:VARIABLE, such as primary:DATABASE_URL.`,
+          );
+        }
+        return [key, reference];
+      }),
+    ),
+  );
+};
+
 const assertLoopbackUrl = (value, path, allowedHosts) => {
   let parsed;
   try {
@@ -169,6 +198,10 @@ const normalizeConfig = (input) => {
       "baseline",
       "containerRuntime",
       "cleanup",
+      "preparation",
+      "runtimePolicy",
+      "identityPolicy",
+      "dependentTargets",
       "application",
       "runtime",
       "safety",
@@ -248,12 +281,94 @@ const normalizeConfig = (input) => {
   );
   const cleanup = assertPlainObject(root.cleanup ?? {}, "config.cleanup");
   assertKnownKeys(cleanup, ["retainBaselineGenerations"], "config.cleanup");
+  const preparation =
+    root.preparation === undefined
+      ? null
+      : assertPlainObject(root.preparation, "config.preparation");
+  if (preparation) {
+    assertKnownKeys(
+      preparation,
+      [
+        "sourcePolicy",
+        "privacyKey",
+        "batchRows",
+        "maximumRows",
+        "maximumBytes",
+        "diskHeadroomBytes",
+      ],
+      "config.preparation",
+    );
+  }
+  const dependentTargets = root.dependentTargets ?? [];
+  if (!Array.isArray(dependentTargets)) {
+    throw new Error("config.dependentTargets must be an array.");
+  }
+  const normalizedDependentTargets = dependentTargets.map((entry, index) => {
+    const path = `config.dependentTargets[${index}]`;
+    const target = assertPlainObject(entry, path);
+    assertKnownKeys(target, ["name", "configPath", "prepareCommand"], path);
+    const name = assertNonEmptyString(target.name, `${path}.name`);
+    if (!IDENTIFIER_PATTERN.test(name)) {
+      throw new Error(
+        `${path}.name must contain only lowercase letters, digits, and hyphens.`,
+      );
+    }
+    return Object.freeze({
+      name,
+      configPath: assertRelativePath(target.configPath, `${path}.configPath`),
+      prepareCommand:
+        target.prepareCommand === undefined
+          ? null
+          : assertCommand(target.prepareCommand, `${path}.prepareCommand`),
+    });
+  });
+  if (
+    new Set(normalizedDependentTargets.map((target) => target.name)).size !==
+    normalizedDependentTargets.length
+  ) {
+    throw new Error("config.dependentTargets names must be unique.");
+  }
   const application = assertPlainObject(root.application, "config.application");
   assertKnownKeys(
     application,
-    ["startCommand", "proofCommand", "environmentFile", "runtimeAdapter"],
+    [
+      "startCommand",
+      "proofCommand",
+      "environmentFile",
+      "environmentVariables",
+      "readiness",
+      "httpProofs",
+      "runtimeAdapter",
+    ],
     "config.application",
   );
+  const readiness =
+    application.readiness === undefined
+      ? null
+      : assertPlainObject(
+          application.readiness,
+          "config.application.readiness",
+        );
+  if (readiness) {
+    assertKnownKeys(
+      readiness,
+      ["url", "expectedStatus", "timeoutSeconds"],
+      "config.application.readiness",
+    );
+  }
+  const httpProofs = application.httpProofs ?? [];
+  if (!Array.isArray(httpProofs)) {
+    throw new Error("config.application.httpProofs must be an array.");
+  }
+  if (
+    httpProofs.length > 0 &&
+    (!httpProofs.some((proof) => proof?.kind === "positive") ||
+      !httpProofs.some((proof) => proof?.kind === "negative"))
+  ) {
+    throw new Error(
+      "config.application.httpProofs must include at least one positive and one negative check.",
+    );
+  }
   const runtime = assertPlainObject(root.runtime ?? {}, "config.runtime");
   assertKnownKeys(
     runtime,
@@ -469,6 +584,43 @@ const normalizeConfig = (input) => {
         "config.cleanup.retainBaselineGenerations",
       ),
     }),
+    preparation: preparation
+      ? Object.freeze({
+          sourcePolicy: assertRelativePath(
+            preparation.sourcePolicy,
+            "config.preparation.sourcePolicy",
+          ),
+          privacyKey: assertRelativePath(
+            preparation.privacyKey,
+            "config.preparation.privacyKey",
+          ),
+          batchRows: assertPositiveInteger(
+            preparation.batchRows ?? 500,
+            "config.preparation.batchRows",
+          ),
+          maximumRows: assertPositiveInteger(
+            preparation.maximumRows ?? 1_000_000,
+            "config.preparation.maximumRows",
+          ),
+          maximumBytes: assertPositiveInteger(
+            preparation.maximumBytes ?? 2 * 1024 * 1024 * 1024,
+            "config.preparation.maximumBytes",
+          ),
+          diskHeadroomBytes: assertPositiveInteger(
+            preparation.diskHeadroomBytes ?? 64 * 1024 * 1024,
+            "config.preparation.diskHeadroomBytes",
+          ),
+        })
+      : null,
+    runtimePolicy:
+      root.runtimePolicy === undefined
+        ? null
+        : assertRelativePath(root.runtimePolicy, "config.runtimePolicy"),
+    identityPolicy:
+      root.identityPolicy === undefined
+        ? null
+        : assertRelativePath(root.identityPolicy, "config.identityPolicy"),
+    dependentTargets: Object.freeze(normalizedDependentTargets),
     application: Object.freeze({
       startCommand: assertCommand(
         application.startCommand,
@@ -482,6 +634,117 @@ const normalizeConfig = (input) => {
         application.environmentFile ?? ".rehearsal/runtime.env",
         "config.application.environmentFile",
       ),
+      environmentVariables: normalizeApplicationEnvironmentMappings(
+        application.environmentVariables,
+      ),
+      readiness: readiness
+        ? Object.freeze({
+            url: assertLoopbackUrl(
+              readiness.url,
+              "config.application.readiness.url",
+              allowedHosts,
+            ),
+            expectedStatus: (() => {
+              if (
+                !Number.isSafeInteger(readiness.expectedStatus) ||
+                readiness.expectedStatus < 100 ||
+                readiness.expectedStatus > 599
+              ) {
+                throw new Error(
+                  "config.application.readiness.expectedStatus must be an HTTP status.",
+                );
+              }
+              return readiness.expectedStatus;
+            })(),
+            timeoutSeconds: assertPositiveInteger(
+              readiness.timeoutSeconds ?? 30,
+              "config.application.readiness.timeoutSeconds",
+            ),
+          })
+        : null,
+      httpProofs: Object.freeze(
+        httpProofs.map((proof, index) => {
+          const path = `config.application.httpProofs[${index}]`;
+          const value = assertPlainObject(proof, path);
+          assertKnownKeys(
+            value,
+            ["name", "kind", "url", "method", "expectedStatus", "json"],
+            path,
+          );
+          if (!["positive", "negative"].includes(value.kind)) {
+            throw new Error(`${path}.kind must be positive or negative.`);
+          }
+          if (
+            !Number.isSafeInteger(value.expectedStatus) ||
+            value.expectedStatus < 100 ||
+            value.expectedStatus > 599
+          ) {
+            throw new Error(`${path}.expectedStatus must be an HTTP status.`);
+          }
+          const method = assertNonEmptyString(
+            value.method ?? "GET",
+            `${path}.method`,
+          ).toUpperCase();
+          if (!["GET", "HEAD"].includes(method)) {
+            throw new Error(`${path}.method must be GET or HEAD.`);
+          }
+          let json = null;
+          if (value.json !== undefined) {
+            const assertion = assertPlainObject(value.json, `${path}.json`);
+            assertKnownKeys(
+              assertion,
+              ["path", "equals", "notEquals", "minimumItems"],
+              `${path}.json`,
+            );
+            if (
+              !Array.isArray(assertion.path) ||
+              assertion.path.length === 0 ||
+              assertion.path.some(
+                (segment) => typeof segment !== "string" || !segment,
+              )
+            ) {
+              throw new Error(
+                `${path}.json.path must be a non-empty string array.`,
+              );
+            }
+            const assertionCount = [
+              Object.hasOwn(assertion, "equals"),
+              Object.hasOwn(assertion, "notEquals"),
+              assertion.minimumItems !== undefined,
+            ].filter(Boolean).length;
+            if (assertionCount !== 1) {
+              throw new Error(
+                `${path}.json must declare exactly one assertion.`,
+              );
+            }
+            json = Object.freeze({
+              path: Object.freeze([...assertion.path]),
+              ...(Object.hasOwn(assertion, "equals")
+                ? { equals: assertion.equals }
+                : {}),
+              ...(Object.hasOwn(assertion, "notEquals")
+                ? { notEquals: assertion.notEquals }
+                : {}),
+              ...(assertion.minimumItems !== undefined
+                ? {
+                    minimumItems: assertPositiveInteger(
+                      assertion.minimumItems,
+                      `${path}.json.minimumItems`,
+                    ),
+                  }
+                : {}),
+            });
+          }
+          return Object.freeze({
+            name: assertNonEmptyString(value.name, `${path}.name`),
+            kind: value.kind,
+            url: assertLoopbackUrl(value.url, `${path}.url`, allowedHosts),
+            method,
+            expectedStatus: value.expectedStatus,
+            json,
+          });
+        }),
+      ),
       runtimeAdapter:
         application.runtimeAdapter === undefined
           ? null
@@ -589,6 +852,18 @@ export const loadRehearsalConfig = async ({
       ? resolveOwnedPath(config.supabase.serviceEnvironmentFile)
       : null,
     sanitizationPolicy: resolveOwnedPath(config.baseline.sanitizationPolicy),
+    sourcePolicy: config.preparation
+      ? resolveOwnedPath(config.preparation.sourcePolicy)
+      : null,
+    privacyKey: config.preparation
+      ? resolveOwnedPath(config.preparation.privacyKey)
+      : null,
+    runtimePolicy: config.runtimePolicy
+      ? resolveOwnedPath(config.runtimePolicy)
+      : null,
+    identityPolicy: config.identityPolicy
+      ? resolveOwnedPath(config.identityPolicy)
+      : null,
     supabaseWorkdir: config.supabase
       ? resolveOwnedPath(config.supabase.workdir)
       : null,
@@ -620,6 +895,21 @@ export const loadRehearsalConfig = async ({
       "config.application.environmentFile must resolve to a file inside config.baseline.artifactDirectory.",
     );
   }
+  if (paths.privacyKey) {
+    const privacyKeyRelativePath = relative(
+      paths.artifactDirectory,
+      paths.privacyKey,
+    );
+    if (
+      !privacyKeyRelativePath ||
+      privacyKeyRelativePath.startsWith("..") ||
+      isAbsolute(privacyKeyRelativePath)
+    ) {
+      throw new Error(
+        "config.preparation.privacyKey must resolve to a secret file inside config.baseline.artifactDirectory.",
+      );
+    }
+  }
   if (!IDENTIFIER_PATTERN.test(config.runtime.projectId)) {
     throw new Error(
       "config.runtime.projectId must contain only lowercase letters, digits, and hyphens.",
@@ -726,6 +1016,21 @@ export default defineRehearsalConfig({
 		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
 	},
 
+	// Optional source refresh. Enable only after reviewing docs/standalone-workflow.md.
+	// Credentials are read from the environment named by source-access-policy.json.
+	// preparation: {
+	// 	sourcePolicy: "infrastructure/rehearsal/source-access-policy.json",
+	// 	privacyKey: ".rehearsal/secrets/privacy.key",
+	// 	batchRows: 500,
+	// 	maximumRows: 1000000,
+	// 	maximumBytes: 2147483648,
+	// 	diskHeadroomBytes: 67108864,
+	// },
+	// Optional reviewed schemas/extensions/triggers/local-only rows.
+	// runtimePolicy: "infrastructure/rehearsal/runtime-policy.json",
+	// Optional signup defaults, role/reference transfer, Storage paths, and token checks.
+	// identityPolicy: "infrastructure/rehearsal/identity-policy.json",
+
 	// Reuse any running Docker-compatible engine; start Colima only when needed.
 	containerRuntime: {
 		autoStartColima: true,
@@ -736,11 +1041,26 @@ export default defineRehearsalConfig({
 		retainBaselineGenerations: 2,
 	},
 
+	// Optional: manage another isolated database as part of the same rehearsal.
+	// Give that database its own complete config, ports, project ID, and .rehearsal folder.
+	// dependentTargets: [
+	// 	{
+	// 		name: "publication-api",
+	// 		configPath: "rehearsal.publication.config.mjs",
+	// 		prepareCommand: "npm run rehearsal:prepare-publication",
+	// 	},
+	// ],
+
 	application: {
 		// CHECK: commands detected from package.json. Change them if they are not correct.
 		startCommand: ${JSON.stringify(detected.applicationCommand)},
 		proofCommand: ${JSON.stringify(detected.verificationCommand)},
 		environmentFile: ".rehearsal/runtime.env",
+		// Map generated local runtime values directly into the normal app command.
+		// environmentVariables: { DATABASE_URL: "primary:DATABASE_URL" },
+		readiness: { url: ${JSON.stringify(applicationUrl)}, expectedStatus: 200, timeoutSeconds: 30 },
+		// Add at least one real positive and one negative before enabling HTTP proofs.
+		// httpProofs: [],
 		// Optional project-specific restore hook:
 		// runtimeAdapter: "infrastructure/rehearsal/runtime-adapter.mjs",
 	},
@@ -803,6 +1123,21 @@ export default defineRehearsalConfig({
 		sanitizationPolicy: "infrastructure/rehearsal/sanitization-policy.json",
 	},
 
+	// Optional source refresh. Enable only after reviewing docs/standalone-workflow.md.
+	// Credentials are read from the environment named by source-access-policy.json.
+	// preparation: {
+	// 	sourcePolicy: "infrastructure/rehearsal/source-access-policy.json",
+	// 	privacyKey: ".rehearsal/secrets/privacy.key",
+	// 	batchRows: 500,
+	// 	maximumRows: 1000000,
+	// 	maximumBytes: 2147483648,
+	// 	diskHeadroomBytes: 67108864,
+	// },
+	// Optional reviewed schemas/extensions/triggers/local-only rows.
+	// runtimePolicy: "infrastructure/rehearsal/runtime-policy.json",
+	// Optional signup defaults, role/reference transfer, Storage paths, and token checks.
+	// identityPolicy: "infrastructure/rehearsal/identity-policy.json",
+
 	// Reuse any running Docker-compatible engine; start Colima only when needed.
 	containerRuntime: {
 		autoStartColima: true,
@@ -813,11 +1148,26 @@ export default defineRehearsalConfig({
 		retainBaselineGenerations: 2,
 	},
 
+	// Optional: manage another isolated database as part of the same rehearsal.
+	// Give that database its own complete config, ports, project ID, and .rehearsal folder.
+	// dependentTargets: [
+	// 	{
+	// 		name: "publication-api",
+	// 		configPath: "rehearsal.publication.config.mjs",
+	// 		prepareCommand: "npm run rehearsal:prepare-publication",
+	// 	},
+	// ],
+
 	application: {
 		// CHECK: commands detected from package.json. Change them if they are not correct.
 		startCommand: ${JSON.stringify(detected.applicationCommand)},
 		proofCommand: ${JSON.stringify(detected.verificationCommand)},
 		environmentFile: ".rehearsal/runtime.env",
+		// Map generated local runtime values directly into the normal app command.
+		// environmentVariables: { DATABASE_URL: "primary:DATABASE_URL" },
+		readiness: { url: ${JSON.stringify(applicationUrl)}, expectedStatus: 200, timeoutSeconds: 30 },
+		// Add at least one real positive and one negative before enabling HTTP proofs.
+		// httpProofs: [],
 		// Optional project-specific restore hook:
 		// runtimeAdapter: "infrastructure/rehearsal/runtime-adapter.mjs",
 	},

package/{scripts/lib/rehearsal → src/project}/setup.mjs

@@ -11,7 +11,7 @@ import {
   renderDetectedConfig,
   renderDetectedPostgresqlConfig,
 } from "./configuration.mjs";
-import { resolveRuntimeTarget } from "../runtime/runtime_target.mjs";
+import { resolveRuntimeTarget } from "../targets/target.mjs";
 
 const CONFIG_PATH = "rehearsal.config.mjs";
 const LOCAL_SUPABASE_CONFIG_PATH =

package/{scripts/lib/rehearsal → src/project}/support_report.mjs

@@ -6,8 +6,11 @@
 
 import { spawnSync } from "node:child_process";
 import { arch, platform, release } from "node:os";
-import { REHEARSAL_VERSION, redactDiagnosticValue } from "./diagnostics.mjs";
-import { runRehearsalDoctor } from "./plan.mjs";
+import {
+  REHEARSAL_VERSION,
+  redactDiagnosticValue,
+} from "../shared/diagnostics.mjs";
+import { runRehearsalDoctor } from "../runtime/plan.mjs";
 
 export const REHEARSAL_SUPPORT_URL =
   "https://github.com/Ddupasquier/rehearsal-db/issues/new?template=bug.yml";