@rehearsal-db/core 0.1.0-beta.7 → 0.1.0-beta.9

package/src/runtime/topology.mjs

@@ -0,0 +1,177 @@
+/**
+ * Purpose: Resolve and validate a primary Rehearsal runtime plus any explicitly
+ * declared dependent runtimes. Every target remains a complete, independently
+ * safe Rehearsal configuration.
+ */
+
+import { createHash } from "node:crypto";
+import { isAbsolute, relative, resolve } from "node:path";
+import { loadRehearsalConfig } from "../project/configuration.mjs";
+import { inspectRehearsalMigrations } from "./plan.mjs";
+
+const isInside = (parent, candidate) => {
+  const path = relative(parent, candidate);
+  return !path || (!path.startsWith("..") && !isAbsolute(path));
+};
+
+const assertUnique = (entries, valueFor, label) => {
+  const seen = new Map();
+  for (const entry of entries) {
+    const value = valueFor(entry);
+    if (seen.has(value)) {
+      throw new Error(
+        `Dependent runtime ${entry.name} conflicts with ${seen.get(value)}: ${label} ${value} must be unique.`,
+      );
+    }
+    seen.set(value, entry.name);
+  }
+};
+
+const targetFrom = ({ name, declaration, loaded, primary }) =>
+  Object.freeze({
+    name,
+    primary,
+    declaration,
+    configPath: loaded.configPath,
+    config: loaded.config,
+    paths: loaded.paths,
+  });
+
+export const loadRuntimeTopology = async (options = {}) => {
+  const primaryLoaded = await loadRehearsalConfig(options);
+  const primary = targetFrom({
+    name: "primary",
+    declaration: null,
+    loaded: primaryLoaded,
+    primary: true,
+  });
+  const dependents = [];
+  for (const declaration of primary.config.dependentTargets) {
+    const loaded = await loadRehearsalConfig({
+      projectRoot: primaryLoaded.projectRoot,
+      configPath: declaration.configPath,
+    });
+    if (loaded.config.dependentTargets.length > 0) {
+      throw new Error(
+        `Dependent runtime ${declaration.name} cannot declare its own dependentTargets. Nesting is intentionally unsupported.`,
+      );
+    }
+    dependents.push(
+      targetFrom({
+        name: declaration.name,
+        declaration,
+        loaded,
+        primary: false,
+      }),
+    );
+  }
+  const targets = [primary, ...dependents];
+  assertUnique(targets, (target) => target.name, "target name");
+  assertUnique(targets, (target) => target.configPath, "config path");
+  assertUnique(
+    targets,
+    (target) => target.config.runtime.projectId,
+    "runtime project ID",
+  );
+  assertUnique(
+    targets.flatMap((target) =>
+      Object.entries(target.config.runtime.ports).map(([kind, port]) => ({
+        name: `${target.name} (${kind})`,
+        port,
+      })),
+    ),
+    (entry) => entry.port,
+    "runtime port",
+  );
+  assertUnique(
+    targets,
+    (target) => target.paths.applicationEnvironment,
+    "application environment file",
+  );
+  assertUnique(
+    targets.filter((target) => target.paths.rehearsalConfig),
+    (target) => target.paths.rehearsalConfig,
+    "Supabase runtime config",
+  );
+  for (let index = 0; index < targets.length; index += 1) {
+    for (
+      let otherIndex = index + 1;
+      otherIndex < targets.length;
+      otherIndex += 1
+    ) {
+      const left = targets[index];
+      const right = targets[otherIndex];
+      if (
+        isInside(left.paths.artifactDirectory, right.paths.artifactDirectory) ||
+        isInside(right.paths.artifactDirectory, left.paths.artifactDirectory)
+      ) {
+        throw new Error(
+          `Dependent runtimes ${left.name} and ${right.name} must use separate, non-nested .rehearsal artifact directories.`,
+        );
+      }
+    }
+  }
+  return Object.freeze({
+    projectRoot: primaryLoaded.projectRoot,
+    primary,
+    dependents: Object.freeze(dependents),
+    targets: Object.freeze(targets),
+  });
+};
+
+const candidateSummary = (inspection) => {
+  const candidates = inspection.migrations.filter(
+    (migration) => migration.status === "candidate",
+  );
+  return Object.freeze({
+    baselineGenerationId: inspection.baselineGenerationId,
+    candidateSha256: inspection.candidateSha256,
+    candidateCount: candidates.length,
+    candidates: Object.freeze(candidates),
+  });
+};
+
+export const inspectRuntimeTopologyCandidates = async (options = {}) => {
+  const topology = await loadRuntimeTopology(options);
+  const targets = [];
+  for (const target of topology.targets) {
+    targets.push(
+      Object.freeze({
+        ...target,
+        summary: candidateSummary(
+          await inspectRehearsalMigrations({
+            projectRoot: topology.projectRoot,
+            configPath: target.configPath,
+          }),
+        ),
+      }),
+    );
+  }
+  if (targets.length === 1) {
+    return Object.freeze({
+      topology,
+      targets: Object.freeze(targets),
+      candidateSha256: targets[0].summary.candidateSha256,
+      candidateCount: targets[0].summary.candidateCount,
+    });
+  }
+  const digestInput = targets.map((target) => ({
+    name: target.name,
+    candidateSha256: target.summary.candidateSha256,
+    candidates: target.summary.candidates.map((candidate) => ({
+      filename: candidate.filename,
+      sha256: candidate.sha256,
+    })),
+  }));
+  return Object.freeze({
+    topology,
+    targets: Object.freeze(targets),
+    candidateSha256: createHash("sha256")
+      .update(JSON.stringify(digestInput))
+      .digest("hex"),
+    candidateCount: targets.reduce(
+      (total, target) => total + target.summary.candidateCount,
+      0,
+    ),
+  });
+};

package/{scripts/lib/rehearsal → src/shared}/diagnostics.mjs

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 
 export const REHEARSAL_RESULT_VERSION = 1;
-export const REHEARSAL_VERSION = "0.1.0-beta.7";
+export const REHEARSAL_VERSION = "0.1.0-beta.9";
 
 export const REHEARSAL_EXIT_CODES = Object.freeze({
   success: 0,

package/src/shared/operation_guard.mjs

@@ -0,0 +1,162 @@
+/** Project-wide mutation lock and installed-package integrity guard. */
+
+import { createHash, randomBytes } from "node:crypto";
+import {
+  lstat,
+  mkdir,
+  readFile,
+  readdir,
+  realpath,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+
+const LOCK_ROOT = join(tmpdir(), "rehearsal-db-operation-locks");
+
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+
+const packageFiles = (root, directory = root) =>
+  readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) return packageFiles(root, path);
+    if (!entry.isFile()) return [];
+    return [relative(root, path)];
+  });
+
+export const createInstalledPackageFingerprint = ({ packageRoot }) => {
+  const files = [
+    "package.json",
+    ...["src", "scripts/runtime"].flatMap((directory) =>
+      packageFiles(packageRoot, join(packageRoot, directory)),
+    ),
+  ].sort();
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(file);
+    hash.update("\0");
+    hash.update(readFileSync(join(packageRoot, file)));
+    hash.update("\0");
+  }
+  return Object.freeze({ files: files.length, sha256: hash.digest("hex") });
+};
+
+export const assertInstalledPackageFingerprint = ({
+  packageRoot,
+  expected,
+}) => {
+  const actual = createInstalledPackageFingerprint({ packageRoot });
+  if (actual.files !== expected?.files || actual.sha256 !== expected?.sha256) {
+    throw new Error(
+      "The installed Rehearsal package changed during this operation. Reinstall the intended version, then start a new command.",
+    );
+  }
+  return actual;
+};
+
+const processIsAlive = (pid) => {
+  if (!Number.isSafeInteger(pid) || pid < 1) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+};
+
+const assertPrivateLockRoot = async () => {
+  await mkdir(LOCK_ROOT, { recursive: true, mode: 0o700 });
+  const details = await stat(LOCK_ROOT);
+  if (
+    !details.isDirectory() ||
+    (details.mode & 0o077) !== 0 ||
+    (typeof process.getuid === "function" && details.uid !== process.getuid())
+  ) {
+    throw new Error("The Rehearsal operation-lock directory is not private.");
+  }
+};
+
+export const acquireProjectOperation = async ({ projectRoot, command }) => {
+  await assertPrivateLockRoot();
+  const canonicalRoot = await realpath(projectRoot);
+  const projectHash = digest(canonicalRoot);
+  const lockDirectory = join(LOCK_ROOT, projectHash);
+  const ownerPath = join(lockDirectory, "owner.json");
+  const token = randomBytes(16).toString("hex");
+  const owner = {
+    formatVersion: 1,
+    pid: process.pid,
+    command,
+    projectHash,
+    token,
+    startedAt: new Date().toISOString(),
+  };
+
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      await mkdir(lockDirectory, { mode: 0o700 });
+      await writeFile(ownerPath, `${JSON.stringify(owner)}\n`, {
+        mode: 0o600,
+        flag: "wx",
+      });
+      const assertOwnership = (current) => {
+        if (current.token !== token || current.pid !== process.pid) {
+          throw new Error(
+            "The Rehearsal operation lock changed ownership unexpectedly.",
+          );
+        }
+      };
+      return Object.freeze({
+        command,
+        async release() {
+          const current = JSON.parse(await readFile(ownerPath, "utf8"));
+          assertOwnership(current);
+          await rm(lockDirectory, { recursive: true });
+        },
+        releaseSync() {
+          const current = JSON.parse(readFileSync(ownerPath, "utf8"));
+          assertOwnership(current);
+          rmSync(lockDirectory, { recursive: true });
+        },
+      });
+    } catch (error) {
+      if (error?.code !== "EEXIST" || attempt > 0) throw error;
+      const details = await lstat(lockDirectory);
+      if (!details.isDirectory() || details.isSymbolicLink()) {
+        throw new Error("The Rehearsal operation lock is unsafe.");
+      }
+      let current;
+      try {
+        current = JSON.parse(await readFile(ownerPath, "utf8"));
+      } catch {
+        throw new Error(
+          "Another Rehearsal operation owns this project, or its lock is incomplete.",
+        );
+      }
+      if (processIsAlive(current.pid)) {
+        throw new Error(
+          `Another Rehearsal operation is already running for this project (PID ${current.pid}).`,
+        );
+      }
+      const staleDirectory = `${lockDirectory}.stale-${token}`;
+      try {
+        await rename(lockDirectory, staleDirectory);
+      } catch (renameError) {
+        if (renameError?.code === "ENOENT") continue;
+        throw renameError;
+      }
+      await rm(staleDirectory, { recursive: true });
+    }
+  }
+  throw new Error("Rehearsal could not acquire its project operation lock.");
+};
+
+export const inspectProjectOperationLocks = async () =>
+  readdir(LOCK_ROOT).catch((error) => {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  });

package/{scripts/lib/rehearsal → src/shared}/process_environment.mjs

@@ -27,7 +27,11 @@ const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "::1", "localhost"]);
 
 export const isLoopbackUrl = (value) => {
   try {
-    return LOOPBACK_HOSTNAMES.has(new URL(value).hostname);
+    const parsed = new URL(value);
+    return (
+      ["http:", "https:"].includes(parsed.protocol) &&
+      LOOPBACK_HOSTNAMES.has(parsed.hostname)
+    );
   } catch {
     return false;
   }