@rehearsal-db/core 0.1.0-rc.8 → 0.1.0-rc.9

package/CHANGELOG.md

@@ -5,7 +5,15 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## [Unreleased]
 
-## [0.1.0-rc.8] - Unreleased candidate
+## [0.1.0-rc.9] - 2026-10-17
+
+### Fixed
+
+- Wrong or stale source-access approval and review-required privacy drafts report
+  actionable configuration refusals instead of internal failures. Source access,
+  privacy review and baseline-preservation requirements are unchanged.
+
+## [0.1.0-rc.8] - 2026-10-17
 
 ### Added
 

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "0.1.0-rc.8",
+    "version": "0.1.0-rc.9",
     "private": false,
     "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
     "repository": {

package/dist/src/baseline/privacy_policy.mjs

@@ -1,6 +1,7 @@
 /**
  * Validate and normalize the complete reviewed privacy policy version 2.
  */
+import { RehearsalError } from "../shared/diagnostics.mjs";
 import { validatePrivacyDependencyGraph } from "./privacy_dependency_graph.mjs";
 import { validatePrivacyRecipe } from "./privacy_recipe_validation.mjs";
 import { ACTIONS, BINDING_NAME, DEFAULT_PATH_MAXIMUM_BYTES, DEFAULT_PATH_MAXIMUM_SEGMENTS, ENVIRONMENT_KEY, HEX_64, assertKnownKeys as knownKeys, isPrivacyObject as isObject, validateIdentifier as identifier, validateNonEmpty as nonEmpty, validatePositiveInteger as positiveInteger, } from "./privacy_validation_shared.mjs";
@@ -19,7 +20,18 @@ export const validateExecutablePrivacyPolicy = (policy) => {
         throw new Error("Executable privacy policies must use policyVersion 2.");
     }
     if (policy.draft === true) {
-        throw new Error("The privacy policy is still a REVIEW REQUIRED draft.");
+        throw new RehearsalError({
+            category: "configuration_invalid",
+            code: "CONFIGURATION_INVALID",
+            message: "The privacy policy is still a REVIEW REQUIRED draft.",
+            expected: "A complete, explicitly reviewed and approved privacy policy.",
+            actual: "REVIEW REQUIRED draft.",
+            refused: "This draft policy was not accepted for source export or baseline activation.",
+            suggestions: [
+                "Review every exported table, column, recipe and source-data boundary, and obtain explicit privacy approval before completing this draft.",
+                "Do not remove the draft marker merely to bypass review. After approval, rerun rehearsal baseline refresh.",
+            ],
+        });
     }
     if (typeof policy.migrationCutoff !== "string" ||
         !/^\d{14}$/u.test(policy.migrationCutoff)) {

package/dist/src/source/access.mjs

@@ -3,6 +3,7 @@
  * Plans contain no credentials or raw owner identifiers.
  */
 import { createHash } from "node:crypto";
+import { RehearsalError } from "../shared/diagnostics.mjs";
 const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
 const ENVIRONMENT_KEY = /^[A-Z][A-Z0-9_]{1,127}$/u;
 const SHA256 = /^[a-f0-9]{64}$/u;
@@ -539,7 +540,16 @@ export const assetEndpointFingerprint = (value) => {
 };
 export const assertSourceAccessConfirmation = (plan, confirmation) => {
     if (confirmation !== plan.digest) {
-        throw new Error(`Source access confirmation does not match this exact plan. Expected ${plan.digest}.`);
+        throw new RehearsalError({
+            category: "configuration_invalid",
+            code: "CONFIGURATION_INVALID",
+            message: `Source access confirmation does not match this exact plan. Expected ${plan.digest}.`,
+            refused: "This confirmation check did not open a source connection or change source access.",
+            suggestions: [
+                "Run rehearsal source plan and review the complete current plan.",
+                "Only after explicit approval, rerun rehearsal source apply --confirm-source-access=<reviewed-full-sha256> using that plan's exact digest.",
+            ],
+        });
     }
     return plan;
 };

package/docs/commands.md

@@ -244,6 +244,12 @@ baseline-retention settings and fields that require manual review. They are not
 baseline corruption or internal failures. Review never writes configuration or
 executes proposed commands; unexpected faults retain their existing classification.
 
+A wrong or stale source-access confirmation and an executable privacy policy still
+marked as a review-required draft also return `configuration_invalid` /
+`CONFIGURATION_INVALID` (exit `2`). Review a fresh `source plan` before confirming it;
+complete the privacy review before retrying `baseline refresh`. These refusals do not
+grant source access, export rows, or replace the current baseline.
+
 Editor integrations should resolve the project's installed `@rehearsal-db/core`
 manifest and its declared `rehearsal` binary. They should not import private package
 files, search for a global installation, invoke through a shell, or parse styled output.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-rc.8",
+  "version": "0.1.0-rc.9",
   "private": false,
   "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
   "repository": {