@rehearsal-db/core 0.1.0-rc.9 → 1.0.0

package/CHANGELOG.md

@@ -5,6 +5,38 @@ a Changelog, and versions will follow Semantic Versioning after the package exis
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-10-17
+
+### Stable compatibility
+
+- Establish the documented CLI, configuration, policy, baseline, TypeScript and
+  JSON contracts as the 1.x compatibility boundary. This preserves rc.10's database,
+  authentication and restore behavior.
+- Keep the complete MIT CLI free. The separately distributed Free Starter editor,
+  future Pro plans and additional database families do not expand the core support
+  matrix or change its safety boundaries.
+
+### Fixed
+
+- Report unknown CLI commands and options as invalid input (exit 2), rather than
+  letting words in the input or help text misclassify them as migration or baseline
+  failures. The command remains refused and supported-command help is retained.
+
+## [0.1.0-rc.10] - 2026-10-17
+
+### Fixed
+
+- Interactive Ctrl+C and Ctrl+Z retire owned work without leaving an invoking npm
+  job suspended. Terminal mode and input consumption are restored after cleanup;
+  startup and unanswered migration confirmations cancel safely, and unrelated jobs
+  are untouched.
+
+### Documentation
+
+- Stable promotion is evidence-based after owner review: complete the release and
+  consumer acceptance checks rather than waiting a fixed number of calendar days.
+  Exact-artifact, security, data-preservation and human publishing approvals remain.
+
 ## [0.1.0-rc.9] - 2026-10-17
 
 ### Fixed
@@ -740,7 +772,14 @@ not unattended cleanup, and container age is not proof of user inactivity.
   publication uses short-lived trusted OIDC, and every release tag must already exist on
   protected `main`.
 
-[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.4...HEAD
+[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.10...v1.0.0
+[0.1.0-rc.10]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.9...v0.1.0-rc.10
+[0.1.0-rc.9]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.8...v0.1.0-rc.9
+[0.1.0-rc.8]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.7...v0.1.0-rc.8
+[0.1.0-rc.7]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.6...v0.1.0-rc.7
+[0.1.0-rc.6]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.5...v0.1.0-rc.6
+[0.1.0-rc.5]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.4...v0.1.0-rc.5
 [0.1.0-rc.4]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.3...v0.1.0-rc.4
 [0.1.0-rc.3]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.2...v0.1.0-rc.3
 [0.1.0-rc.2]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.1...v0.1.0-rc.2

package/COMPATIBILITY.md

@@ -1,10 +1,15 @@
 # Rehearsal compatibility policy
 
-Rehearsal begins at `0.x`. Minor releases may contain breaking changes, but every
-intentional break must be called out in the changelog with a migration path. Patch
-releases must remain backward compatible within their minor line.
+Starting with `1.0.0`, documented public contracts are backward compatible throughout
+the `1.x` line. Minor releases may add compatible capabilities; patch releases fix
+defects. An intentional breaking change requires a new major version, a changelog
+entry and a migration path.
 
-The following are compatibility contracts for published 0.x releases:
+Historical `0.x` releases allowed intentional breaking changes in minor versions,
+with changelog and migration guidance. Their patch releases remain compatible within
+their minor line. Existing artifacts and granted license rights are unchanged.
+
+The following are compatibility contracts for published releases:
 
 - configuration property names, types, defaults, validation, and schema version;
 - baseline format and checksum meaning;
@@ -17,12 +22,12 @@ A change to any of those requires either a compatible extension or a deliberate
 transition. Rehearsal must never silently reinterpret an old config, baseline, digest,
 or successful verification receipt.
 
-The first `1.0.0` release requires external beta evidence, a support policy, and a settled
-public API. Supporting additional database families, package managers, or operating
-systems is not implied by the 0.x contract.
+The first `1.0.0` release requires external beta evidence, a support policy and the
+settled public API described in [the stability policy](docs/stability.md). Supporting
+additional database families, package managers or operating systems is not implied.
 
 Rehearsal supports maintained even-numbered Node.js release lines that pass its CI
-matrix. Beta.13 supports Node.js 22, 24, and 26; Node.js 24 LTS is the recommended
+matrix. Rehearsal 1.0 supports Node.js 22, 24, and 26; Node.js 24 LTS is the recommended
 default and the release-build runtime. End-of-life and odd-numbered Node.js releases are
 not supported. A future release may remove a Node.js line after its upstream end-of-life
 date, with that change called out in the changelog.

package/SECURITY.md

@@ -9,9 +9,11 @@ Report suspected vulnerabilities through the
 in this repository. A GitHub account is required. Do not open a
 public issue containing an exploit, secret, hosted target, or source record.
 
-Supported security updates cover the latest released 0.x minor during beta. A security
-fix may deliberately tighten configuration or refuse a workflow that an earlier beta
-accepted. During beta, reports apply to the latest published release and current `main`.
+Security updates target the latest released 1.x version. Update to the latest 1.x
+release to receive fixes; older release candidates are not a maintained security line.
+Reports concerning current `main` and prereleases are also welcome. A security fix may
+tighten validation or refuse an unsafe workflow; it must not silently reinterpret
+existing data or claim that a refused operation succeeded.
 
 The threat boundary and remaining responsibilities live in
 [docs/security-model.md](docs/security-model.md). Every

package/SUPPORT.md

@@ -3,8 +3,7 @@
 Use GitHub Issues for reproducible defects and setup problems that include a synthetic
 reproduction. Include operating system, architecture, Node version, Supabase CLI version,
 Docker engine, the failing command, safe diagnostics, and the smallest reproduction.
-The first beta does not yet maintain a separate public discussion or feature-request
-channel.
+Search existing reports before opening a new issue.
 
 Run `npx rehearsal support` or choose **Get help** in the guide to collect the environment
 and readiness portion without assembling it by hand. The report intentionally excludes
@@ -15,6 +14,8 @@ Do not include credentials, connection strings, source rows, baseline artifacts,
 URLs, or proprietary migrations. Report security problems through private vulnerability
 reporting as described in [SECURITY.md](SECURITY.md).
 
-The package is pre-release. The supported matrix is defined in
+The supported matrix and 1.x compatibility boundary are defined in
 [COMPATIBILITY.md](COMPATIBILITY.md); unsupported environments are welcome as clearly
 labelled experiments but cannot be treated as verified behavior.
+
+Support is community-based; no response-time guarantee or production SLA is offered.

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "0.1.0-rc.9",
+    "version": "1.0.0",
     "private": false,
     "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
     "repository": {
@@ -76,7 +76,7 @@
         "test:fixture:standalone": "npm run build && node scripts/verification/run_scenario.mjs standalone",
         "test:fixture:privacy": "npm run build && node scripts/verification/run_scenario.mjs privacy",
         "test:fixture:resources": "npm run build && node scripts/verification/run_scenario.mjs resources",
-        "release:verify": "node scripts/verification/release_gate.mjs",
+        "release:verify": "npm run build && node scripts/verification/release_gate.mjs",
         "check": "npm run check:syntax && npm run typecheck && npm run test && npm run docs:build && npm run format:check && npm run package:audit",
         "check:syntax": "find scripts tests -type f -name '*.mjs' -exec node --check {} +",
         "typecheck": "npm run build && tsc --project tsconfig.json",

package/dist/src/application/interactive_task.d.mts

@@ -1,12 +1,8 @@
 /** Run identity discovery while an owned local application remains available. */
 import type { EventEmitter } from "node:events";
+import { type TerminalInput } from "../shared/terminal_input.mjs";
 import { type ApplicationDiagnostics, type ApplicationSession, type ApplicationSessionSignal } from "./session.mjs";
 type SignalTarget = Pick<EventEmitter, "prependListener" | "removeListener">;
-interface SessionInput {
-    readonly isTTY?: boolean;
-    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
-    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
-}
 /**
  * A terminal interruption aborts the task and retires the owned process group.
  * A completed task leaves the session running so its caller can deliberately
@@ -16,7 +12,7 @@ export declare const runApplicationSessionTask: <Value>({ session, task, signalT
     session: ApplicationSession;
     task: (signal: AbortSignal) => Promise<Value>;
     signalTarget?: SignalTarget;
-    input?: SessionInput;
+    input?: TerminalInput | null;
     onReady?: (ready: ApplicationSession["ready"]) => void;
 }) => Promise<Readonly<{
     completed: true;

package/dist/src/application/interactive_task.mjs

@@ -1,4 +1,5 @@
 /** Run identity discovery while an owned local application remains available. */
+import { acquireTerminalInput, } from "../shared/terminal_input.mjs";
 import { summarizeProjectCommandFailure, } from "./session.mjs";
 const SESSION_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
 /**
@@ -23,19 +24,10 @@ export const runApplicationSessionTask = async ({ session, task, signalTarget =
     for (const [signal, handler] of handlers) {
         signalTarget.prependListener(signal, handler);
     }
-    const onInput = (chunk) => {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        if (bytes.includes(0x03)) {
-            finishInterruption({ kind: "interrupted", signal: "SIGINT" });
-        }
-        else if (bytes.includes(0x1a)) {
-            finishInterruption({ kind: "interrupted", signal: "SIGTSTP" });
-        }
-    };
-    if (input?.isTTY)
-        input.prependListener("data", onInput);
+    let releaseInput = () => undefined;
     const abortController = new AbortController();
     try {
+        releaseInput = acquireTerminalInput(input, (signal) => finishInterruption({ kind: "interrupted", signal }));
         onReady(session.ready);
         const outcome = await Promise.race([
             interruption,
@@ -77,7 +69,6 @@ export const runApplicationSessionTask = async ({ session, task, signalTarget =
         for (const [signal, handler] of handlers) {
             signalTarget.removeListener(signal, handler);
         }
-        if (input?.isTTY)
-            input.removeListener("data", onInput);
+        releaseInput();
     }
 };

package/dist/src/application/session.d.mts

@@ -3,7 +3,8 @@ import { spawn } from "node:child_process";
 import type { EventEmitter } from "node:events";
 import { waitForApplicationIdle } from "./activity_monitor.mjs";
 import type { ApplicationActivity } from "./activity_contract.mjs";
-declare const SESSION_SIGNALS: string[];
+import { type TerminalInput } from "../shared/terminal_input.mjs";
+declare const SESSION_SIGNALS: readonly ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
 type SessionSignal = (typeof SESSION_SIGNALS)[number];
 export type ApplicationSessionSignal = SessionSignal;
 export interface ApplicationReadiness {
@@ -29,11 +30,6 @@ interface ChildExit {
     readonly status: number | null;
     readonly signal: NodeJS.Signals | null;
 }
-interface SessionInput {
-    readonly isTTY?: boolean;
-    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
-    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
-}
 interface EnvironmentInput {
     readonly files: Readonly<Record<string, string>> & {
         readonly primary: string;
@@ -66,7 +62,7 @@ export declare const summarizeProjectCommandFailure: ({ error, status, signal, s
     stdoutByteCount?: number;
     stderrByteCount?: number;
 }) => string;
-export declare const startApplicationSession: ({ command, cwd, files, mappings, readiness, inheritedEnvironment, spawnImplementation, fetchImplementation, signalTarget, portPreflight, }: EnvironmentInput & {
+export declare const startApplicationSession: ({ command, cwd, files, mappings, readiness, inheritedEnvironment, spawnImplementation, fetchImplementation, signalTarget, input, portPreflight, }: EnvironmentInput & {
     command: string;
     cwd: string;
     readiness: ApplicationReadiness;
@@ -74,6 +70,7 @@ export declare const startApplicationSession: ({ command, cwd, files, mappings,
     spawnImplementation?: typeof spawn;
     fetchImplementation?: typeof fetch;
     signalTarget?: SignalTarget;
+    input?: TerminalInput | null;
     portPreflight?: (readiness: ApplicationReadiness) => Promise<void>;
 }) => Promise<ApplicationSession>;
 /**
@@ -83,7 +80,7 @@ export declare const startApplicationSession: ({ command, cwd, files, mappings,
 export declare const holdApplicationSession: ({ session, signalTarget, input, onReady, activity, idleTimeoutSeconds, idleMonitorImplementation, onActivityAvailability, }: {
     session: ApplicationSession;
     signalTarget?: SignalTarget;
-    input?: SessionInput;
+    input?: TerminalInput | null;
     onReady?: (ready: ApplicationSession["ready"]) => void;
     activity?: ApplicationActivity | null;
     idleTimeoutSeconds?: number | null;

package/dist/src/application/session.mjs

@@ -7,6 +7,8 @@ import { createCleanProcessEnvironment, isLoopbackUrl, } from "../shared/process
 import { assertApplicationPortAvailable } from "./port_preflight.mjs";
 import { waitForApplicationIdle } from "./activity_monitor.mjs";
 import { stopOwnedPosixProcessGroup } from "./process_group.mjs";
+import { acquireTerminalInput, } from "../shared/terminal_input.mjs";
+import { createOperationCancelledError, throwIfOperationCancelled, } from "../shared/cancellation.mjs";
 const ENV_KEY = /^[A-Z][A-Z0-9_]*$/u;
 const MAX_DIAGNOSTIC_BYTES = 64 * 1024;
 const SESSION_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
@@ -188,7 +190,7 @@ const stopOwnedChild = async (child) => {
             throw new Error("Owned application process group did not stop within its shutdown bound. No unrelated process was targeted.");
     }
 };
-export const startApplicationSession = async ({ command, cwd, files, mappings, readiness, inheritedEnvironment = process.env, spawnImplementation = spawn, fetchImplementation = fetch, signalTarget = process, portPreflight = (value) => assertApplicationPortAvailable({ url: value?.url }), }) => {
+export const startApplicationSession = async ({ command, cwd, files, mappings, readiness, inheritedEnvironment = process.env, spawnImplementation = spawn, fetchImplementation = fetch, signalTarget = process, input = process.stdin, portPreflight = (value) => assertApplicationPortAvailable({ url: value?.url }), }) => {
     const mapped = await buildApplicationEnvironment({ files, mappings });
     const [program, ...args] = parseCommand(command);
     await portPreflight(readiness);
@@ -228,13 +230,22 @@ export const startApplicationSession = async ({ command, cwd, files, mappings, r
     });
     let interruptStartup = () => undefined;
     const interruption = new Promise((_, reject) => {
-        interruptStartup = (signal) => reject(new Error(`Application startup was interrupted by ${signal}.`));
+        interruptStartup = (signal) => reject(createOperationCancelledError(signal));
     });
-    const startupHandlers = new Map(SESSION_SIGNALS.map((signal) => [signal, () => interruptStartup(signal)]));
+    let releaseInput = null;
+    const startupHandlers = new Map(SESSION_SIGNALS.map((signal) => [
+        signal,
+        () => {
+            if (!releaseInput || releaseInput.isCurrentOwner())
+                interruptStartup(signal);
+        },
+    ]));
     for (const [signal, handler] of startupHandlers) {
         signalTarget.prependListener(signal, handler);
     }
     try {
+        releaseInput = acquireTerminalInput(input, interruptStartup);
+        throwIfOperationCancelled();
         const ready = await Promise.race([
             waitForReadiness({
                 readiness,
@@ -255,13 +266,19 @@ export const startApplicationSession = async ({ command, cwd, files, mappings, r
         });
     }
     catch (error) {
-        await stopApplication();
+        try {
+            await stopApplication();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "Application startup failed and its owned process could not be stopped.");
+        }
         throw error;
     }
     finally {
         for (const [signal, handler] of startupHandlers) {
             signalTarget.removeListener(signal, handler);
         }
+        releaseInput?.();
     }
 };
 /**
@@ -278,26 +295,23 @@ export const holdApplicationSession = async ({ session, signalTarget = process,
     const interruption = new Promise((resolve) => {
         finishInterruption = resolve;
     });
+    let releaseInput = null;
     const handlers = new Map(SESSION_SIGNALS.map((signal) => [
         signal,
-        () => finishInterruption({ kind: "interrupted", signal }),
+        () => {
+            if (!releaseInput || releaseInput.isCurrentOwner())
+                finishInterruption({ kind: "interrupted", signal });
+        },
     ]));
     for (const [signal, handler] of handlers) {
         signalTarget.prependListener(signal, handler);
     }
-    const onInput = (chunk) => {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        if (bytes.includes(0x03)) {
-            finishInterruption({ kind: "interrupted", signal: "SIGINT" });
-        }
-        else if (bytes.includes(0x1a)) {
-            finishInterruption({ kind: "interrupted", signal: "SIGTSTP" });
-        }
-    };
-    if (input?.isTTY)
-        input.prependListener("data", onInput);
     const activityController = new AbortController();
+    let operationFailed = false;
+    let operationError;
     try {
+        releaseInput = acquireTerminalInput(input, (signal) => finishInterruption({ kind: "interrupted", signal }));
+        throwIfOperationCancelled();
         if (idleTimeoutSeconds !== null &&
             (!activity ||
                 !Number.isSafeInteger(idleTimeoutSeconds) ||
@@ -338,20 +352,31 @@ export const holdApplicationSession = async ({ session, signalTarget = process,
             },
         });
     }
+    catch (error) {
+        operationFailed = true;
+        operationError = error;
+        throw error;
+    }
     finally {
         activityController.abort();
         try {
             // npm can forward the terminal's SIGINT after the CLI receives it.
             // Keep our handlers installed until the owned process group is fully
             // stopped so a duplicate signal cannot terminate Rehearsal mid-cleanup.
-            await session.stop();
+            try {
+                await session.stop();
+            }
+            catch (cleanupError) {
+                if (operationFailed)
+                    throw new AggregateError([operationError, cleanupError], "Application session failed and its owned process could not be stopped.");
+                throw cleanupError;
+            }
         }
         finally {
             for (const [signal, handler] of handlers) {
                 signalTarget.removeListener(signal, handler);
             }
-            if (input?.isTTY)
-                input.removeListener("data", onInput);
+            releaseInput?.();
         }
     }
 };

package/dist/src/cli/arguments.mjs

@@ -1,4 +1,5 @@
 /** Parse and classify the stable Rehearsal command-line contract. */
+import { RehearsalError } from "../shared/diagnostics.mjs";
 export const parseArguments = (arguments_) => {
     const flags = {
         json: false,
@@ -86,7 +87,13 @@ export const parseArguments = (arguments_) => {
         else if (argument.startsWith("--image-id="))
             (flags.imageIds ??= []).push(argument.slice("--image-id=".length));
         else if (argument.startsWith("--"))
-            throw new Error(`Unknown Rehearsal option: ${argument}.`);
+            throw new RehearsalError({
+                category: "configuration_invalid",
+                code: "CONFIGURATION_INVALID",
+                message: `Unknown Rehearsal option: ${argument}.`,
+                refused: "No Rehearsal command was executed.",
+                suggestions: ["Run rehearsal --help to list supported options."],
+            });
         else
             positionals.push(argument);
     }

package/dist/src/cli/rehearsal.mjs

@@ -8,7 +8,7 @@ import { join } from "node:path";
 import { performance } from "node:perf_hooks";
 import { fileURLToPath } from "node:url";
 import * as prompts from "@clack/prompts";
-import { normalizeRehearsalError, renderHumanError, serializeRehearsalError, } from "../shared/diagnostics.mjs";
+import { RehearsalError, normalizeRehearsalError, renderHumanError, serializeRehearsalError, } from "../shared/diagnostics.mjs";
 import { acquireProjectOperation, assertInstalledPackageFingerprint, createInstalledPackageFingerprint, } from "../shared/operation_guard.mjs";
 import { commandMutatesProject, parseArguments, resetGuidedFlags, } from "./arguments.mjs";
 import { usage } from "./basic_command_handlers.mjs";
@@ -70,7 +70,13 @@ const executeCommand = async ({ command, flags, planOptions, guided, }) => {
         state,
     });
     if (!result) {
-        throw new Error(`Unknown Rehearsal command: ${command}.\n\n${usage()}`);
+        throw new RehearsalError({
+            category: "configuration_invalid",
+            code: "CONFIGURATION_INVALID",
+            message: `Unknown Rehearsal command: ${command}.\n\n${usage()}`,
+            refused: "No Rehearsal command was executed.",
+            suggestions: ["Run rehearsal --help to list supported commands."],
+        });
     }
     const exitCode = emitCommand({ command, flags, result });
     if (exitCode !== undefined)
@@ -141,12 +147,18 @@ const main = async () => {
                                 removeGuidedExitShortcut = null;
                             }
                             try {
-                                await executeCommand({
+                                const executeSelected = () => executeCommand({
                                     command: selected,
                                     flags,
                                     planOptions,
                                     guided: true,
                                 });
+                                if (opensApplication) {
+                                    await runWithOperationCancellation({ task: executeSelected });
+                                }
+                                else {
+                                    await executeSelected();
+                                }
                             }
                             finally {
                                 if (opensApplication) {

package/dist/src/cli/runtime_commands.mjs

@@ -473,6 +473,7 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
     };
     const startRuntimeApplication = async ({ flags, planOptions, session: commandSession, onRuntimeStarted = () => undefined, }) => {
         const topology = await loadRuntimeTopology(planOptions);
+        throwIfOperationCancelled();
         const application = topology.primary.config.application;
         const readiness = application.readiness;
         if (!readiness) {
@@ -516,6 +517,18 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
             mappings: application.environmentVariables,
             readiness,
         }));
+        try {
+            throwIfOperationCancelled();
+        }
+        catch (error) {
+            try {
+                await applicationSession.stop();
+            }
+            catch (cleanupError) {
+                throw new AggregateError([error, cleanupError], "Application handoff was cancelled and its owned process could not be stopped.");
+            }
+            throw error;
+        }
         return {
             started: started.runtime,
             verified: verified.runtime,
@@ -527,6 +540,7 @@ export const createRuntimeCommands = ({ packageRoot, projectRoot, managerPath, g
     };
     const openRuntimeApplication = async ({ flags, planOptions, session: commandSession, onReady = () => undefined, }) => {
         const topology = await loadRuntimeTopology(planOptions);
+        throwIfOperationCancelled();
         let runtimeStarted = false;
         const { result, lifecycle } = await applyRuntimePersistence({
             mode: topology.primary.config.lifecycle.open,

package/dist/src/cli/terminal.mjs

@@ -1,6 +1,8 @@
 /** Terminal presentation and prompt primitives shared by guided CLI workflows. */
 import { createInterface } from "node:readline/promises";
 import * as prompts from "@clack/prompts";
+import { hasTerminalInputLease, reassertTerminalInputLease, } from "../shared/terminal_input.mjs";
+import { getOperationCancellationSignal } from "../shared/cancellation.mjs";
 const useColor = (flags) => !flags.plain &&
     process.stdout.isTTY &&
     process.env.NO_COLOR === undefined &&
@@ -54,22 +56,39 @@ export const promptForChoice = async ({ message, options, flags = {}, optionsAlr
     }
 };
 export async function promptForConfirmation(message, flags = {}, { cancelValue = false } = {}) {
+    const signal = getOperationCancellationSignal();
+    if (signal?.aborted)
+        throw signal.reason;
     if (useStyledPrompts(flags)) {
-        const accepted = await prompts.confirm({ message, initialValue: false });
-        return prompts.isCancel(accepted) ? cancelValue : accepted;
+        try {
+            const accepted = await prompts.confirm({
+                message,
+                initialValue: false,
+                ...(signal ? { signal } : {}),
+            });
+            return prompts.isCancel(accepted) ? cancelValue : accepted;
+        }
+        finally {
+            reassertTerminalInputLease(process.stdin);
+        }
     }
     const prompt = createInterface({
         input: process.stdin,
         output: process.stdout,
     });
     try {
-        const answer = (await prompt.question(`${message} (y/N) `))
+        const answer = (await prompt.question(`${message} (y/N) `, { signal }))
             .trim()
             .toLowerCase();
         return answer === "y" || answer === "yes";
     }
     finally {
-        prompt.close();
+        try {
+            prompt.close();
+        }
+        finally {
+            reassertTerminalInputLease(process.stdin);
+        }
     }
 }
 export const promptForPath = async ({ message, defaultValue, optional = false, flags = {}, validate, }) => {
@@ -203,7 +222,7 @@ export const promptForMultipleChoice = async ({ message, options, initialValues
 export const installGuidedExitShortcut = (flags, { beforeExit } = {}) => {
     let exiting = false;
     const exit = () => {
-        if (exiting)
+        if (exiting || hasTerminalInputLease(process.stdin))
             return;
         exiting = true;
         if (process.stdin.isTTY && process.stdin.isRaw)

package/dist/src/runtime/persistence.mjs

@@ -1,5 +1,5 @@
 /** Explicit, non-destructive persistence policy for project-owned runtimes. */
-import { withOperationCancellationShield } from "../shared/cancellation.mjs";
+import { getOperationCancellationSignal, withOperationCancellationShield, } from "../shared/cancellation.mjs";
 export const shouldStopRuntime = (mode) => mode === "stop-after-run" || mode === "stop-on-application-exit";
 export const applyRuntimePersistence = async ({ mode, operation, stop, canStop = () => true, }) => {
     let result;
@@ -20,8 +20,11 @@ export const applyRuntimePersistence = async ({ mode, operation, stop, canStop =
             stopped = true;
         }
         catch (stopError) {
-            if (operationFailed) {
-                throw new AggregateError([operationError, stopError], "The Rehearsal operation failed and its owned runtime could not be stopped automatically.");
+            // The shield has unwound here. A later interruption must not let the
+            // outer cancellation owner replace a real cleanup fault with clean130.
+            const cancellation = getOperationCancellationSignal();
+            if (operationFailed || cancellation?.aborted) {
+                throw new AggregateError([operationFailed ? operationError : cancellation.reason, stopError], "The Rehearsal operation failed and its owned runtime could not be stopped automatically.");
             }
             throw stopError;
         }

package/dist/src/shared/cancellation.d.mts

@@ -1,6 +1,7 @@
 /** Cooperative cancellation state for one mutating CLI operation. */
 import type { EventEmitter } from "node:events";
 import { RehearsalError } from "./diagnostics.mjs";
+import { type TerminalInput } from "./terminal_input.mjs";
 export declare const OPERATION_CANCELLATION_SIGNALS: readonly ["SIGINT", "SIGTERM", "SIGHUP", "SIGTSTP"];
 export type OperationCancellationSignal = (typeof OPERATION_CANCELLATION_SIGNALS)[number];
 type SignalTarget = Pick<EventEmitter, "prependListener" | "removeListener">;
@@ -11,8 +12,9 @@ export declare const getOperationCancellationSignal: () => AbortSignal | undefin
 export declare const throwIfOperationCancelled: () => void;
 export declare const reachOperationCancellationCheckpoint: () => Promise<void>;
 export declare const withOperationCancellationShield: <Value>(task: () => Promise<Value>) => Promise<Value>;
-export declare const runWithOperationCancellation: <Value>({ task, signalTarget, }: {
+export declare const runWithOperationCancellation: <Value>({ task, signalTarget, input, }: {
     task: (signal: AbortSignal) => Promise<Value>;
     signalTarget?: SignalTarget;
+    input?: TerminalInput | null;
 }) => Promise<Value>;
 export {};

package/dist/src/shared/cancellation.mjs

@@ -1,5 +1,6 @@
 /** Cooperative cancellation state for one mutating CLI operation. */
 import { RehearsalError } from "./diagnostics.mjs";
+import { acquireTerminalInput, } from "./terminal_input.mjs";
 export const OPERATION_CANCELLATION_SIGNALS = [
     "SIGINT",
     "SIGTERM",
@@ -8,6 +9,7 @@ export const OPERATION_CANCELLATION_SIGNALS = [
 ];
 const CANCELLABLE_COMMANDS = new Set([
     "migrate",
+    "open",
     "refresh",
     "reset",
     "run",
@@ -48,24 +50,29 @@ export const withOperationCancellationShield = async (task) => {
         shieldDepth -= 1;
     }
 };
-export const runWithOperationCancellation = async ({ task, signalTarget = process, }) => {
+export const runWithOperationCancellation = async ({ task, signalTarget = process, input = process.stdin, }) => {
     if (activeSignal) {
         throw new Error("A cancellable Rehearsal operation is already active.");
     }
     const controller = new AbortController();
     activeSignal = controller.signal;
+    let releaseInput = null;
+    const interrupt = (signal) => {
+        if (!controller.signal.aborted)
+            controller.abort(createOperationCancelledError(signal));
+    };
     const handlers = new Map(OPERATION_CANCELLATION_SIGNALS.map((signal) => [
         signal,
         () => {
-            if (!controller.signal.aborted) {
-                controller.abort(createOperationCancelledError(signal));
-            }
+            if (!releaseInput || releaseInput.isCurrentOwner())
+                interrupt(signal);
         },
     ]));
     for (const [signal, handler] of handlers) {
         signalTarget.prependListener(signal, handler);
     }
     try {
+        releaseInput = acquireTerminalInput(input, interrupt);
         const result = await task(controller.signal);
         throwIfOperationCancelled();
         return result;
@@ -82,5 +89,6 @@ export const runWithOperationCancellation = async ({ task, signalTarget = proces
         }
         activeSignal = undefined;
         shieldDepth = 0;
+        releaseInput?.();
     }
 };

package/dist/src/shared/terminal_input.d.mts

@@ -0,0 +1,25 @@
+/** Own terminal control bytes without suspending the invoking shell's npm job. */
+export interface TerminalInput {
+    readonly isTTY?: boolean;
+    readonly isRaw?: boolean;
+    readonly readableFlowing?: boolean | null;
+    setRawMode?(enabled: boolean): unknown;
+    resume?(): unknown;
+    pause?(): unknown;
+    prependListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer | string) => void): unknown;
+}
+export interface TerminalInputLease {
+    (): void;
+    isCurrentOwner(): boolean;
+}
+export declare const hasTerminalInputLease: (input: TerminalInput | null | undefined) => boolean;
+/** Prompt libraries may restore cooked mode; resume only a still-owned lease. */
+export declare const reassertTerminalInputLease: (input: TerminalInput | null | undefined) => void;
+/**
+ * Raw input turns Ctrl+C/Ctrl+Z into bytes instead of kernel signals to the
+ * entire foreground npm/shell job. Signal handlers remain responsible for
+ * externally delivered signals. The final overlapping lease restores only the
+ * mode/flow state this owner acquired; a pre-existing raw terminal stays raw.
+ */
+export declare const acquireTerminalInput: (input: TerminalInput | null | undefined, onInterrupt: (signal: "SIGINT" | "SIGTSTP") => void) => TerminalInputLease;

package/dist/src/shared/terminal_input.mjs

@@ -0,0 +1,129 @@
+/** Own terminal control bytes without suspending the invoking shell's npm job. */
+const leases = new WeakMap();
+export const hasTerminalInputLease = (input) => !!input && leases.has(input);
+/** Prompt libraries may restore cooked mode; resume only a still-owned lease. */
+export const reassertTerminalInputLease = (input) => {
+    if (!input || !leases.get(input)?.interactive)
+        return;
+    if (input.isRaw !== true)
+        input.setRawMode?.(true);
+    input.resume?.();
+};
+const restoreInput = (input, lease) => {
+    if (!lease.interactive)
+        return;
+    const errors = [];
+    try {
+        if (lease.changedRaw)
+            input.setRawMode?.(lease.wasRaw);
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    try {
+        // A previously untouched (null) stream must return to non-consuming mode,
+        // just like a previously paused stream; do not leave stdin keeping Node alive.
+        if (lease.wasFlowing)
+            input.resume?.();
+        else
+            input.pause?.();
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    if (errors.length === 1)
+        throw errors[0];
+    if (errors.length > 1)
+        throw new AggregateError(errors, "Terminal input restoration failed.");
+};
+/**
+ * Raw input turns Ctrl+C/Ctrl+Z into bytes instead of kernel signals to the
+ * entire foreground npm/shell job. Signal handlers remain responsible for
+ * externally delivered signals. The final overlapping lease restores only the
+ * mode/flow state this owner acquired; a pre-existing raw terminal stays raw.
+ */
+export const acquireTerminalInput = (input, onInterrupt) => {
+    if (!input)
+        return Object.assign(() => undefined, { isCurrentOwner: () => true });
+    const owner = { interrupt: onInterrupt };
+    let lease = leases.get(input);
+    const first = !lease;
+    if (!lease) {
+        const owners = [];
+        lease = {
+            owners,
+            interactive: input.isTTY === true,
+            wasRaw: input.isRaw === true,
+            wasFlowing: input.readableFlowing === true,
+            changedRaw: input.isTTY === true &&
+                input.isRaw !== true &&
+                typeof input.setRawMode === "function",
+            dispatch: (chunk) => {
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                const signal = bytes.includes(0x03)
+                    ? "SIGINT"
+                    : bytes.includes(0x1a)
+                        ? "SIGTSTP"
+                        : null;
+                // Capture one owner before dispatch: synchronous release must not deliver
+                // the same byte again to an outer operation.
+                const current = owners.at(-1);
+                if (signal)
+                    current?.interrupt(signal);
+            },
+        };
+        leases.set(input, lease);
+    }
+    lease.owners.push(owner);
+    try {
+        if (first && lease.changedRaw)
+            input.setRawMode(true);
+        if (first && lease.interactive)
+            input.prependListener("data", lease.dispatch);
+        if (lease.interactive)
+            input.resume?.();
+    }
+    catch (error) {
+        const errors = [error];
+        lease.owners.splice(lease.owners.indexOf(owner), 1);
+        try {
+            if (first && lease.interactive)
+                input.removeListener("data", lease.dispatch);
+        }
+        catch (cleanupError) {
+            errors.push(cleanupError);
+        }
+        if (first) {
+            leases.delete(input);
+            try {
+                restoreInput(input, lease);
+            }
+            catch (cleanupError) {
+                errors.push(cleanupError);
+            }
+        }
+        if (errors.length > 1)
+            throw new AggregateError(errors, "Terminal input could not be acquired or restored.");
+        throw error;
+    }
+    let released = false;
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        lease.owners.splice(lease.owners.indexOf(owner), 1);
+        if (lease.owners.length === 0) {
+            leases.delete(input);
+            try {
+                if (lease.interactive)
+                    input.removeListener("data", lease.dispatch);
+            }
+            finally {
+                restoreInput(input, lease);
+            }
+        }
+    };
+    return Object.assign(release, {
+        isCurrentOwner: () => !released && lease.owners.at(-1) === owner,
+    });
+};

package/docs/commands.md

@@ -324,7 +324,8 @@ Clients should disable conflicting actions unless the state is `idle`.
 
 ### Cancelling a mutation
 
-`run`, `reset`, `migrate`, and confirmed `refresh` support package-owned cancellation.
+`run`, `reset`, `migrate`, confirmed `refresh`, and direct or guided `open` preparation support
+package-owned cancellation.
 Send `SIGINT`, `SIGTERM`, `SIGHUP`, or `SIGTSTP` to the Rehearsal CLI process. Rehearsal
 handles repeated delivery as one request, forwards it only to the detached process group
 it launched, waits for package rollback and child cleanup, releases the project lock, and
@@ -343,6 +344,14 @@ The CLI does not stop Docker itself, signal unrelated processes, prune shared re
 or delete unrelated volumes. `SIGTSTP` is treated as cancellation and becomes `SIGTERM`
 for the owned child group instead of suspending it mid-cleanup. Windows uses direct child
 signalling; the detached process-group guarantee is supported on macOS and Linux.
+During an interactive cancellable operation, Rehearsal temporarily owns terminal control
+input so `Ctrl+C` and `Ctrl+Z` request cleanup without suspending an invoking npm job.
+It restores the terminal's previous raw mode and consuming/non-consuming input state
+after cleanup. Piped input is not consumed by this shortcut.
+For direct or guided `open`, cancellation before the ready attached session returns this same
+exit `130` contract, including interruption during runtime preparation or application
+readiness. A cancellation during the ready application's handoff stops that owned
+application before returning; cleanup failure is not reported as clean cancellation.
 
 `SIGKILL`, host shutdown, and a force-quit cannot produce a result or run cleanup. After
 one of those events, clients must not guess: run `activity --json`. A `stale` or `invalid`
@@ -384,6 +393,13 @@ default `keep-until-stop` leaves databases running; `stop-on-application-exit` s
 with database and Storage changes preserved. Likewise, `lifecycle.run` can remain
 `keep-until-stop` or use `stop-after-run` for bounded automation. JSON results include
 the selected mode, final runtime state, and preserved-data guarantee.
+While the ready application or copied-account sign-in session is attached, terminal
+`Ctrl+C` and `Ctrl+Z` are handled as control bytes rather than suspending npm wrappers.
+Rehearsal restores the prior terminal mode after retiring its owned application; it
+never resumes or signals an invoking shell, npm ancestor, or unrelated job.
+Once the ready application is attached, its handled `Ctrl+C`, `Ctrl+Z`, `SIGINT`, or
+`SIGTSTP` closes the session with exit `0` as before; it does not also cancel an outer
+preparation owner. Nested input ownership dispatches a control byte only once.
 
 ## Clean up disk space
 

package/docs/releasing.md

@@ -154,6 +154,28 @@ The independent Rehearsal Test Lab is the primary pre-release consumer environme
 Real product integrations provide additional compatibility evidence; they do not
 replace the package-owned release gate or Test Lab.
 
+### Optional remote verification
+
+When local resource guards refuse a heavy run, the existing full release check can
+run on an isolated GitHub-hosted runner instead:
+
+```bash
+gh workflow run verify.yml --ref YOUR_REVIEWED_RELEASE_BRANCH -f exact_release=true
+```
+
+This manual-only option runs `npm run release:verify` and the production dependency
+audit. It adds no required branch check and has no publishing permission or npm
+environment. It does not bypass a local resource guard or start local services.
+The other existing verification jobs still run normally.
+
+Download the run's `exact-release-<commit>-<attempt>` artifact within seven days.
+It contains only the frozen tarball and release reports. Require a successful job
+and all nine passed stages in `acceptance.json`, match the reviewed source commit
+and tarball SHA-256, then use those exact bytes for consumer checks and publication
+authorization. Reports retained after failure are failure evidence, not approval.
+This is an execution option for the same release requirements, not a substitute for
+consumer acceptance, supported-platform observations or human publication approval.
+
 The workflow publishes beta and release-candidate versions under the `beta` dist-tag.
 While Rehearsal has no stable release, it also moves `latest` to the same reviewed
 prerelease. This keeps the npm package page and the ordinary

package/docs/stability.md

@@ -1,11 +1,11 @@
 # Stability and the first stable release
 
 Rehearsal leaves beta when the workflow it already promises is dependable. Stable
-`0.1.0` does not require every planned database, desktop interface, or paid feature.
+`1.0.0` does not require every planned database, desktop interface, or paid feature.
 
 ## What becomes a compatibility promise
 
-Starting with `0.1.0`, Rehearsal treats these documented surfaces as public:
+Starting with `1.0.0`, Rehearsal treats these documented surfaces as public:
 
 - CLI command names, flags, JSON result fields, and exit categories in
   [CLI commands](commands.md);
@@ -45,21 +45,29 @@ release.
 
 ## Promotion sequence
 
-The sequence below records the initial beta-to-stable policy, not current release
-progress. Historical version names explain that policy; they do not claim a candidate
-is ready or restart an observation window by themselves.
-
-1. Ship beta.18 with only stability, release-safety, upgrade, and documentation work.
-2. Freeze broad feature development on the release branch.
-3. Publish a release candidate from protected `main` through the reviewed npm environment.
-4. Run the complete Rehearsal Test Lab gate twice from clean isolated workspaces.
-5. Perform one final package-only upgrade in a real consumer. The consumer must use the
-   published package rather than duplicate Rehearsal machinery.
-6. Keep the current candidate available for at least seven calendar days. Restart the
-   window if a blocking package change is required. The container-lifecycle correction
-   in `0.1.0-rc.2` restarts this observation window.
-7. Publish `0.1.0` only when no blocking issue remains and the accepted registry artifact
-   matches the tested artifact exactly.
+Promotion is evidence-based, not a calendar countdown. The initial seven-day RC
+wait was replaced after owner review; passing time alone cannot make a candidate
+ready. The sequence below is policy, not a claim that its checks have passed.
+
+1. Freeze broad feature development on the release branch.
+2. Select one immutable candidate from the reviewed release branch. A release candidate
+   may be published from protected `main` through the reviewed npm environment; another
+   prerelease is not required solely to verify the final stable tarball.
+3. Run the complete Rehearsal Test Lab gate twice from clean isolated workspaces.
+4. Perform one final package-only check in a real consumer using the exact frozen
+   stable tarball, not duplicate Rehearsal machinery. Preserve its reviewed settings
+   and persistent data; a package check does not require resetting its databases.
+5. Review reports and existing scheduled Test Lab results for unresolved blockers.
+   A blocking correction needs its affected acceptance repeated against the exact
+   corrected candidate. Reuse sufficient unchanged evidence with its original scope;
+   do not relabel old or unavailable manual checks as new results. No minimum number
+   of calendar days replaces these checks.
+6. Publish `1.0.0` only when no blocking issue remains and the exact tarball has passed
+   the required release checks, consumer acceptance, exact-artifact authorization and
+   protected human publication approval.
+7. Independently verify registry bytes, provenance, signatures and channels, then
+   confirm the published package in the real consumer. Promotion is complete only
+   when the published artifact matches the tested tarball and these checks pass.
 
 Test Lab is the primary verification system. A real consumer is the final compatibility
 check, not a replacement for package-owned coverage. Real Google or GitHub consent does
@@ -69,6 +77,23 @@ not need to run on every build unless authentication behavior changes.
 
 Beta and release-candidate versions publish under the `beta` tag. Before a stable
 release exists, `latest` follows that reviewed prerelease so the ordinary install command
-remains useful. Once stable `0.1.0` exists, `latest` stays on the stable line and `beta`
+remains useful. Once stable `1.0.0` exists, `latest` stays on the stable line and `beta`
 continues to identify the newest prerelease. Stable publication never rewrites the
 `beta` tag.
+
+## Upgrading from a 0.1 release candidate
+
+The first stable release preserves rc.10's database runtime and schema formats and
+corrects invalid-command diagnostics. A package upgrade
+does not require resetting a sandbox or replacing its reviewed configuration, key or
+baseline. Automatic compatible updates do not cross the 0.x-to-1.x version boundary;
+review the changelog and deliberately select the stable version:
+
+```bash
+npm install --save-dev --save-exact @rehearsal-db/core@1.0.0
+npx --no-install rehearsal --version
+npx --no-install rehearsal doctor
+```
+
+Use the project's existing package manager and dependency location. Review its lockfile
+and readiness output before the next sandbox operation; do not reset data just to update.

package/docs/tutorial.md

@@ -117,6 +117,6 @@ npm run test:fixture
 The PostgreSQL equivalent is `npm run test:fixture:postgresql`.
 
 The release workflow also runs `npm run test:fixture:onboarding` from the packed package.
-That check creates fresh Supabase and PostgreSQL consumers, verifies beta configuration
+That check creates fresh Supabase and PostgreSQL consumers, verifies reviewed configuration
 preservation, and exercises safe refusal and recovery for partial setup, occupied ports,
 malformed configuration, and missing credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "0.1.0-rc.9",
+  "version": "1.0.0",
   "private": false,
   "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
   "repository": {
@@ -76,7 +76,7 @@
     "test:fixture:standalone": "npm run build && node scripts/verification/run_scenario.mjs standalone",
     "test:fixture:privacy": "npm run build && node scripts/verification/run_scenario.mjs privacy",
     "test:fixture:resources": "npm run build && node scripts/verification/run_scenario.mjs resources",
-    "release:verify": "node scripts/verification/release_gate.mjs",
+    "release:verify": "npm run build && node scripts/verification/release_gate.mjs",
     "check": "npm run check:syntax && npm run typecheck && npm run test && npm run docs:build && npm run format:check && npm run package:audit",
     "check:syntax": "find scripts tests -type f -name '*.mjs' -exec node --check {} +",
     "typecheck": "npm run build && tsc --project tsconfig.json",