@rehearsal-db/core 1.0.2 → 1.1.0

package/CHANGELOG.md

@@ -1,10 +1,35 @@
 # Changelog
 
-All notable Rehearsal package changes will be documented here. The format follows Keep
-a Changelog, and versions will follow Semantic Versioning after the package exists.
+All notable Rehearsal package changes are documented here. The format follows Keep
+a Changelog, and published versions follow Semantic Versioning.
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-10-21
+
+### Added
+
+- Optional read-only runtime privilege expectations for reviewed schemas, tables,
+  sequences and exact function signatures. Required and forbidden effective access is
+  separate from RLS, includes inherited and column-only permissions, and never repairs
+  grants automatically. Existing policies without this field keep their behavior.
+- Document explicit least-privilege Data API grants, forward-only correction and
+  positive/negative API proofs for Supabase's October 30 opt-in table-exposure change.
+
+### Fixed
+
+- Record the Supabase provider in newly written runtime receipts, so inventory can
+  distinguish recorded format/provider compatibility from unknown legacy provenance.
+  Older receipts remain unknown rather than being silently rewritten or reverified.
+- Bound newly generated Supabase project IDs to the provider's 40-character limit
+  with a deterministic suffix. Preserve valid existing identities; reject invalid
+  configured IDs without renaming or adopting resources.
+- Align OS setup helpers with core's Node.js 22, 24 and 26 support. macOS/Linux
+  helpers accept an explicit `REHEARSAL_NODE_PATH`, and missing-Node guidance points
+  to version-manager selection or the official installer without installing an OS tool.
+- Update compatible older CLI installations to the helper's exact current target
+  instead of treating every 1.0.1-or-newer installation as already current.
+
 ## [1.0.2] - 2026-10-20
 
 ### Fixed
@@ -815,7 +840,8 @@ not unattended cleanup, and container age is not proof of user inactivity.
   publication uses short-lived trusted OIDC, and every release tag must already exist on
   protected `main`.
 
-[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.0.2...HEAD
+[Unreleased]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.0.2...v1.1.0
 [1.0.2]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/Ddupasquier/rehearsal-db/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/Ddupasquier/rehearsal-db/compare/v0.1.0-rc.10...v1.0.0

package/COMPATIBILITY.md

@@ -26,12 +26,18 @@ The first `1.0.0` release requires external beta evidence, a support policy and
 settled public API described in [the stability policy](docs/stability.md). Supporting
 additional database families, package managers or operating systems is not implied.
 
-Rehearsal supports maintained even-numbered Node.js release lines that pass its CI
-matrix. Rehearsal 1.0 supports Node.js 22, 24, and 26; Node.js 24 LTS is the recommended
-default and the release-build runtime. End-of-life and odd-numbered Node.js releases are
-not supported. A future release may remove a Node.js line after its upstream end-of-life
+Rehearsal supports the maintained Node.js release lines verified by its existing CI
+matrix: Node.js 22, 24, and 26. Node.js 24 LTS is the recommended default and the
+release-build runtime. End-of-life and unverified future release lines are not
+supported. A future release may remove a Node.js line after its upstream end-of-life
 date, with that change called out in the changelog.
 
+Core 1.1.0's OS helpers accept the same three lines. A terminal or desktop launcher
+that cannot find Node does not mean an installed version is unsupported. Select it
+through the project's existing version manager or use the helper's explicit executable
+path; see [OS setup](installers/README.md). Helpers never install Node or switch a
+project's runtime automatically.
+
 ## Operating systems and execution location
 
 Core 1.0.1's platform boundary distinguishes the computer running VS Code from the

package/README.md

@@ -47,7 +47,7 @@ it through a reviewed privacy policy, and retire the access again. It is never p
 production deployment tool.
 
 The CLI is free and MIT-licensed, with stable releases on
-[npm](https://www.npmjs.com/package/@rehearsal-db/core). This guide targets **1.0.2**;
+[npm](https://www.npmjs.com/package/@rehearsal-db/core). This guide targets **1.1.0**;
 install only a version actually published there. Prefer a visual workflow?
 [Install the free VS Code Starter preview](docs/vscode.md). Its included features are
 free indefinitely for personal or commercial development—no account, card, or trial.
@@ -71,7 +71,7 @@ your migration is intended to change.
 
 Prefer OS-specific files? Use the [Windows / WSL 2](installers/windows/README.md),
 [macOS](installers/macos/README.md) or [Linux](installers/linux/README.md) setup folder.
-These readable helpers require existing Node.js 24 or 26 and check prerequisites by
+These readable helpers accept existing Node.js 22, 24 or 26 and check prerequisites by
 default; installation is an explicit option. They do not install OS tools or start a
 database. See [their exact behavior and release availability](installers/README.md).
 

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rehearsal-db/core",
-    "version": "1.0.2",
+    "version": "1.1.0",
     "private": false,
     "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
     "repository": {

package/dist/src/project/configuration_contract.d.mts

@@ -126,6 +126,7 @@ export interface RehearsalConfig {
         protected?: boolean;
         target?: "supabase" | "postgresql";
         applicationUrl?: string;
+        /** Exact lowercase/digit/hyphen ownership ID: 2–40 Supabase, 2–63 PostgreSQL. */
         projectId?: string;
         apiPort?: number;
         databasePort: number;

package/dist/src/project/configuration_normalization.mjs

@@ -9,6 +9,7 @@ import { normalizeResourcePolicy, normalizeRequiredServices, } from "./configura
 import { normalizeConfigurationProfiles } from "./configuration_profiles.mjs";
 import { normalizeApplicationUrls } from "./configuration_application_urls.mjs";
 import { normalizeApplicationActivity } from "./configuration_activity.mjs";
+import { assertRuntimeProjectId } from "./runtime_project_identity.mjs";
 import { assertBoolean, assertCommand, assertDatabaseIdentifier, assertEnvironmentKey, assertEnvironmentReference, assertHttpStatus, assertIdentifier, assertKnownKeys, assertLoopbackUrl, assertNonEmptyString, assertPlainObject, assertPort, assertPostgresImage, assertPositiveInteger, assertRelativePath, assertStringArray, } from "./configuration_validation.mjs";
 const LOOPBACK_HOSTS = new Set(REHEARSAL_DEFAULTS.safety.allowedHosts);
 const SUPPORTED_SUPABASE_OAUTH_PROVIDERS = new Set(["github", "google"]);
@@ -351,7 +352,7 @@ export const normalizeRehearsalConfig = (input) => {
             protected: assertBoolean(runtime.protected ?? false, "config.runtime.protected"),
             target: runtimeTarget,
             applicationUrl: applicationUrls.applicationUrl,
-            projectId: assertNonEmptyString(runtime.projectId ?? REHEARSAL_DEFAULTS.runtime.projectId, "config.runtime.projectId"),
+            projectId: assertRuntimeProjectId(runtime.projectId ?? REHEARSAL_DEFAULTS.runtime.projectId, runtimeTarget),
             ports: Object.freeze(ports),
         }),
         safety: Object.freeze({

package/dist/src/project/configuration_rendering.mjs

@@ -1,4 +1,5 @@
 /** Render reviewed starter configurations without reading or writing a project. */
+import { createRuntimeProjectId } from "./runtime_project_identity.mjs";
 export const renderDetectedConfig = (detected, { applicationUrl = "http://localhost:5175", ports = { api: 58321, database: 58322, studio: 58323 }, } = {}) => `// @ts-check
 /**
  * Rehearsal configuration for ${detected.projectName}.
@@ -132,7 +133,7 @@ export default defineRehearsalConfig({
 		protected: false, // Pin data against reset, run, migrate, discard, and runtime cleanup.
 		target: "supabase",
 		applicationUrl: ${JSON.stringify(applicationUrl)},
-		projectId: "${detected.projectName}-rehearsal",
+		projectId: ${JSON.stringify(createRuntimeProjectId(detected.projectName, "supabase", detected.projectIdSeed))},
 		apiPort: ${ports.api},
 		databasePort: ${ports.database},
 		studioPort: ${ports.studio},
@@ -266,7 +267,7 @@ export default defineRehearsalConfig({
 		protected: false, // Pin data against reset, run, migrate, discard, and runtime cleanup.
 		target: "postgresql",
 		applicationUrl: ${JSON.stringify(applicationUrl)},
-		projectId: "${detected.projectName}-rehearsal",
+		projectId: ${JSON.stringify(createRuntimeProjectId(detected.projectName, "postgresql", detected.projectIdSeed))},
 		databasePort: ${databasePort},
 	},
 

package/dist/src/project/configuration_resolution.mjs

@@ -3,7 +3,6 @@ import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { findRehearsalConfigPath, } from "./configuration_discovery.mjs";
 import { normalizeRehearsalConfig } from "./configuration_normalization.mjs";
-import { assertIdentifier } from "./configuration_validation.mjs";
 export const loadRehearsalConfig = async ({ projectRoot = process.cwd(), configPath, } = {}) => {
     const root = resolve(projectRoot);
     const path = await findRehearsalConfigPath({
@@ -74,7 +73,6 @@ export const loadRehearsalConfig = async ({ projectRoot = process.cwd(), configP
             throw new Error("config.preparation.privacyKey must resolve to a secret file inside config.baseline.artifactDirectory.");
         }
     }
-    assertIdentifier(config.runtime.projectId, "config.runtime.projectId");
     return Object.freeze({
         config,
         configPath: path,

package/dist/src/project/project_detection.d.mts

@@ -1,6 +1,8 @@
 /** Inspect project-local files used to render a conservative starter config. */
 export interface DetectedProject {
     projectName: string;
+    /** Untruncated normalized name keeps shortened new runtime identities distinct. */
+    projectIdSeed?: string;
     packageManager: "npm" | "pnpm" | "yarn";
     hasSupabaseConfig: boolean;
     hasMigrations: boolean;

package/dist/src/project/project_detection.mjs

@@ -31,6 +31,7 @@ export const inspectDetectedProject = async ({ projectRoot = process.cwd(), } =
         "rehearsal-project";
     return {
         projectName,
+        projectIdSeed: normalizedProjectName || projectName,
         packageManager,
         hasSupabaseConfig: await hasPath("supabase/config.toml"),
         hasMigrations: await hasPath("supabase/migrations"),

package/dist/src/project/runtime_project_identity.d.mts

@@ -0,0 +1,5 @@
+/** Preserve exact configured runtime ownership and bound newly generated identities. */
+import type { RehearsalRuntimeTargetId } from "../targets/target.mjs";
+export declare const assertRuntimeProjectId: (value: unknown, target: RehearsalRuntimeTargetId) => string;
+/** Only new setup identities are shortened; valid existing generated IDs stay stable. */
+export declare const createRuntimeProjectId: (projectName: string, target: RehearsalRuntimeTargetId, identitySeed?: string) => string;

package/dist/src/project/runtime_project_identity.mjs

@@ -0,0 +1,41 @@
+/** Preserve exact configured runtime ownership and bound newly generated identities. */
+import { createHash } from "node:crypto";
+import { RehearsalError } from "../shared/diagnostics.mjs";
+import { assertIdentifier, assertNonEmptyString, } from "./configuration_validation.mjs";
+const maximumProjectIdLength = (target) => target === "supabase" ? 40 : 63;
+export const assertRuntimeProjectId = (value, target) => {
+    const projectId = assertNonEmptyString(value, "config.runtime.projectId");
+    const maximumLength = maximumProjectIdLength(target);
+    if (projectId.length < 2 || projectId.length > maximumLength) {
+        const provider = target === "supabase" ? "Supabase" : "PostgreSQL";
+        throw new RehearsalError({
+            category: "configuration_invalid",
+            code: "CONFIGURATION_INVALID",
+            message: `config.runtime.projectId must contain 2–${maximumLength} characters for ${provider}.`,
+            expected: `2–${maximumLength} lowercase letters, digits, or hyphens`,
+            actual: { length: projectId.length },
+            context: { field: "runtime.projectId", target, maximumLength },
+            refused: "No runtime was started or renamed. Rehearsal never truncates a configured project ID or adopts resources by prefix.",
+            suggestions: [
+                "Choose a distinct, explicitly reviewed ID for a new disposable runtime. Review existing resources before changing their configured identity.",
+            ],
+        });
+    }
+    return assertIdentifier(projectId, "config.runtime.projectId");
+};
+/** Only new setup identities are shortened; valid existing generated IDs stay stable. */
+export const createRuntimeProjectId = (projectName, target, identitySeed = projectName) => {
+    const candidate = `${projectName}-rehearsal`;
+    const maximumLength = maximumProjectIdLength(target);
+    if (candidate.length <= maximumLength)
+        return assertRuntimeProjectId(candidate, target);
+    const digest = createHash("sha256")
+        .update(`${identitySeed}-rehearsal`)
+        .digest("hex")
+        .slice(0, 12);
+    const suffix = `-${digest}-rehearsal`;
+    const prefix = projectName
+        .slice(0, maximumLength - suffix.length)
+        .replace(/-+$/u, "");
+    return assertRuntimeProjectId(`${prefix}${suffix}`, target);
+};

package/dist/src/project/setup.mjs

@@ -8,6 +8,7 @@ import { access, mkdir, open, readFile, rename, rm, writeFile, } from "node:fs/p
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { findRehearsalConfigPath, inspectDetectedProject, loadRehearsalConfig, renderDetectedConfig, renderDetectedPostgresqlConfig, } from "./configuration.mjs";
 import { resolveRuntimeTarget } from "../targets/target.mjs";
+import { createRuntimeProjectId } from "./runtime_project_identity.mjs";
 export { assertSupportedRehearsalNodeRuntime, inspectRehearsalNodeRuntime, } from "../shared/node_runtime.mjs";
 import { assertSupportedRehearsalNodeRuntime } from "../shared/node_runtime.mjs";
 const CONFIG_PATH = "rehearsal.config.mjs";
@@ -257,7 +258,8 @@ export const planRehearsalSetup = async ({ projectRoot = process.cwd(), configPa
             ...(isPortAvailable ? { isAvailable: isPortAvailable } : {}),
         });
     const applicationUrl = existing?.config.runtime.applicationUrl ?? "http://localhost:5175";
-    const projectId = existing?.config.runtime.projectId ?? `${detected.projectName}-rehearsal`;
+    const projectId = existing?.config.runtime.projectId ??
+        createRuntimeProjectId(detected.projectName, runtimeTarget, detected.projectIdSeed);
     const sourceSupabaseConfig = runtimeTarget === "supabase"
         ? await readOptionalFile(join(root, "supabase/config.toml"))
         : null;

package/dist/src/runtime/policy.d.mts

@@ -1,4 +1,5 @@
 /** Build narrowly validated local restore prerequisites and structural checks. */
+import { type RuntimePrivilege } from "./privileges.mjs";
 type PolicyObject = Record<string, unknown>;
 interface RuntimeRelation {
     readonly schema: string;
@@ -55,6 +56,7 @@ export interface RuntimePolicy {
     readonly triggers: readonly RuntimeTrigger[];
     readonly localRows: readonly RuntimeLocalRow[];
     readonly expectations: readonly RuntimeExpectation[];
+    readonly privileges?: readonly RuntimePrivilege[];
 }
 export declare const IDENTITY_CLAIM_RECEIPT_SQL = "create schema if not exists rehearsal_internal;\ncreate table if not exists rehearsal_internal.identity_claims (\n  identity_name text primary key,\n  placeholder_user_id uuid not null unique,\n  local_user_id uuid not null,\n  claimed_at timestamptz not null default now()\n);";
 export declare const validateRuntimePolicy: (input: unknown) => RuntimePolicy;

package/dist/src/runtime/policy.mjs

@@ -1,4 +1,5 @@
 /** Build narrowly validated local restore prerequisites and structural checks. */
+import { buildRuntimePrivilegeVerificationChecks, validateRuntimePrivileges, } from "./privileges.mjs";
 const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
 const IDENTITY_NAME = /^[a-z0-9][a-z0-9-]{1,62}$/u;
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
@@ -58,7 +59,14 @@ create table if not exists rehearsal_internal.identity_claims (
 );`;
 export const validateRuntimePolicy = (input) => {
     const policy = object(input, "runtimePolicy");
-    keys(policy, ["policyVersion", "prerequisites", "triggers", "localRows", "expectations"], "runtimePolicy");
+    keys(policy, [
+        "policyVersion",
+        "prerequisites",
+        "triggers",
+        "localRows",
+        "expectations",
+        "privileges",
+    ], "runtimePolicy");
     if (policy.policyVersion !== 1)
         throw new Error("Runtime policy must use policyVersion 1.");
     const prerequisites = object(policy.prerequisites ?? {}, "runtimePolicy.prerequisites");
@@ -216,6 +224,9 @@ export const validateRuntimePolicy = (input) => {
         triggers: Object.freeze(triggers),
         localRows: Object.freeze(localRows),
         expectations: Object.freeze(expectations),
+        ...(Object.hasOwn(policy, "privileges")
+            ? { privileges: validateRuntimePrivileges(policy.privileges) }
+            : {}),
     });
 };
 export const buildRuntimePrerequisiteSql = (input) => {
@@ -360,6 +371,7 @@ export const buildRuntimeVerificationSql = (input) => {
     }
     checks.push(`if exists (select 1 from pg_constraint where not convalidated) then
     raise exception 'Rehearsal found an unvalidated structural constraint'; end if;`);
+    checks.push(...buildRuntimePrivilegeVerificationChecks(policy.privileges ?? []));
     return `do $rehearsal_verify$
 begin
   ${checks.join("\n  ")}

package/dist/src/runtime/privileges.d.mts

@@ -0,0 +1,25 @@
+/** Validate opt-in effective privileges and build catalog-only verification checks. */
+export interface RuntimePrivilegeArgumentType {
+    readonly schema: "pg_catalog";
+    readonly name: string;
+}
+interface RuntimePrivilegeBase {
+    readonly schema: string;
+    readonly role: string;
+    readonly required: readonly string[];
+    readonly forbidden: readonly string[];
+}
+export type RuntimePrivilege = RuntimePrivilegeBase & ({
+    readonly kind: "schema";
+} | {
+    readonly kind: "table" | "sequence";
+    readonly name: string;
+} | {
+    readonly kind: "function";
+    readonly name: string;
+    readonly argumentTypes: readonly RuntimePrivilegeArgumentType[];
+});
+export declare const validateRuntimePrivileges: (input: unknown) => readonly RuntimePrivilege[];
+/** Blocks are embedded inside the policy verifier; no ACL or object writes are emitted. */
+export declare const buildRuntimePrivilegeVerificationChecks: (entries: readonly RuntimePrivilege[]) => readonly string[];
+export {};

package/dist/src/runtime/privileges.mjs

@@ -0,0 +1,198 @@
+/** Validate opt-in effective privileges and build catalog-only verification checks. */
+const IDENTIFIER = /^[a-z][a-z0-9_]{0,62}$/u;
+const TYPE_IDENTIFIER = /^[a-z_][a-z0-9_]{0,62}$/u;
+const PRIVILEGES = {
+    schema: ["CREATE", "USAGE"],
+    table: [
+        "SELECT",
+        "INSERT",
+        "UPDATE",
+        "DELETE",
+        "TRUNCATE",
+        "REFERENCES",
+        "TRIGGER",
+        "MAINTAIN",
+    ],
+    sequence: ["USAGE", "SELECT", "UPDATE"],
+    function: ["EXECUTE"],
+};
+const COLUMN_PRIVILEGES = new Set(["SELECT", "INSERT", "UPDATE", "REFERENCES"]);
+const object = (value, label) => {
+    if (value === null ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new Error(`${label} must be an object.`);
+    }
+    return value;
+};
+const keys = (value, allowed, label) => {
+    if (Object.keys(value).some((key) => !allowed.includes(key)))
+        throw new Error(`${label} contains unsupported fields.`);
+};
+const identifier = (value, label) => {
+    if (typeof value !== "string" || !IDENTIFIER.test(value))
+        throw new Error(`${label} is not a safe PostgreSQL identifier.`);
+    return value;
+};
+const permissions = (value, allowed, label) => {
+    if (!Array.isArray(value) ||
+        value.length > allowed.length ||
+        value.includes(undefined) ||
+        value.some((entry) => typeof entry !== "string" || !allowed.includes(entry)) ||
+        new Set(value).size !== value.length) {
+        throw new Error(`${label} must contain distinct supported privileges.`);
+    }
+    return Object.freeze([...value]);
+};
+export const validateRuntimePrivileges = (input) => {
+    if (!Array.isArray(input) ||
+        input.length > 1_024 ||
+        input.includes(undefined))
+        throw new Error("runtimePolicy.privileges must be an array of at most 1024 declarations.");
+    const observed = new Map();
+    return Object.freeze(input.map((value, index) => {
+        const label = `runtimePolicy.privileges[${index}]`;
+        const entry = object(value, label);
+        if (typeof entry.kind !== "string" ||
+            !Object.hasOwn(PRIVILEGES, entry.kind)) {
+            throw new Error(`${label}.kind is unsupported.`);
+        }
+        const kind = entry.kind;
+        keys(entry, [
+            "kind",
+            "schema",
+            "role",
+            "required",
+            "forbidden",
+            ...(kind === "schema" ? [] : ["name"]),
+            ...(kind === "function" ? ["argumentTypes"] : []),
+        ], label);
+        const schema = identifier(entry.schema, `${label}.schema`);
+        const role = identifier(entry.role, `${label}.role`);
+        const allowed = PRIVILEGES[kind];
+        const required = permissions(Object.hasOwn(entry, "required") ? entry.required : [], allowed, `${label}.required`);
+        const forbidden = permissions(Object.hasOwn(entry, "forbidden") ? entry.forbidden : [], allowed, `${label}.forbidden`);
+        if (required.length + forbidden.length === 0)
+            throw new Error(`${label} must declare a required or forbidden privilege.`);
+        const base = { schema, role, required, forbidden };
+        let normalized;
+        if (kind === "schema")
+            normalized = Object.freeze({ ...base, kind });
+        else {
+            const name = identifier(entry.name, `${label}.name`);
+            if (kind !== "function")
+                normalized = Object.freeze({ ...base, kind, name });
+            else {
+                if (!Array.isArray(entry.argumentTypes) ||
+                    entry.argumentTypes.length > 32 ||
+                    entry.argumentTypes.includes(undefined))
+                    throw new Error(`${label}.argumentTypes must be an array of at most 32 types.`);
+                const argumentTypes = entry.argumentTypes.map((value, argumentIndex) => {
+                    const typeLabel = `${label}.argumentTypes[${argumentIndex}]`;
+                    const type = object(value, typeLabel);
+                    keys(type, ["schema", "name"], typeLabel);
+                    if (type.schema !== "pg_catalog" ||
+                        typeof type.name !== "string" ||
+                        !TYPE_IDENTIFIER.test(type.name)) {
+                        throw new Error(`${typeLabel} must name a safe pg_catalog type.`);
+                    }
+                    return Object.freeze({
+                        schema: "pg_catalog",
+                        name: type.name,
+                    });
+                });
+                normalized = Object.freeze({
+                    ...base,
+                    kind,
+                    name,
+                    argumentTypes: Object.freeze(argumentTypes),
+                });
+            }
+        }
+        const identity = JSON.stringify([
+            kind,
+            schema,
+            normalized.kind === "schema" ? null : normalized.name,
+            role,
+            normalized.kind === "function" ? normalized.argumentTypes : null,
+        ]);
+        const earlier = observed.get(identity) ?? {
+            required: new Set(),
+            forbidden: new Set(),
+        };
+        if (required.some((privilege) => forbidden.includes(privilege) || earlier.forbidden.has(privilege)) ||
+            forbidden.some((privilege) => earlier.required.has(privilege))) {
+            throw new Error(`${label} has overlapping required and forbidden privileges.`);
+        }
+        required.forEach((privilege) => earlier.required.add(privilege));
+        forbidden.forEach((privilege) => earlier.forbidden.add(privilege));
+        observed.set(identity, earlier);
+        return normalized;
+    }));
+};
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+const typeLookup = (type) => `select t.oid from pg_catalog.pg_type t
+      join pg_catalog.pg_namespace n on n.oid = t.typnamespace
+      where n.nspname = 'pg_catalog' and t.typname = ${literal(type.name)}`;
+const objectLookup = (entry) => {
+    if (entry.kind === "schema")
+        return `select n.oid into rehearsal_object from pg_catalog.pg_namespace n
+    where n.nspname = ${literal(entry.schema)};`;
+    if (entry.kind === "function")
+        return `select p.oid into rehearsal_object from pg_catalog.pg_proc p
+    join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = ${literal(entry.schema)} and p.proname = ${literal(entry.name)}
+      and p.prokind = 'f' and p.pronargs = ${entry.argumentTypes.length}
+      ${entry.argumentTypes.map((type, index) => `and p.proargtypes[${index}] = (${typeLookup(type)})`).join("\n      ")};`;
+    return `select c.oid into rehearsal_object from pg_catalog.pg_class c
+    join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = ${literal(entry.schema)} and c.relname = ${literal(entry.name)}
+      and c.relkind ${entry.kind === "sequence" ? "= 'S'" : "in ('r', 'p', 'v', 'm', 'f')"};`;
+};
+const permissionCheck = (entry, privilege, forbidden) => {
+    const functionName = `pg_catalog.has_${entry.kind}_privilege`;
+    const tableCheck = `${functionName}(rehearsal_role, rehearsal_object, ${literal(privilege)})`;
+    const expression = entry.kind === "table" && forbidden && COLUMN_PRIVILEGES.has(privilege)
+        ? `(${tableCheck} or pg_catalog.has_any_column_privilege(rehearsal_role, rehearsal_object, ${literal(privilege)}))`
+        : tableCheck;
+    const evaluation = privilege === "MAINTAIN"
+        ? `if pg_catalog.current_setting('server_version_num')::integer < 170000 then
+      rehearsal_allowed := false;
+    else
+      rehearsal_allowed := ${expression};
+    end if;`
+        : `rehearsal_allowed := ${expression};`;
+    return `${evaluation}
+    if rehearsal_allowed is null then
+      raise exception 'Rehearsal privilege object is unavailable';
+    end if;
+    if rehearsal_allowed is ${forbidden ? "true" : "false"} then
+      raise exception 'Rehearsal ${forbidden ? "forbidden privilege is present" : "required privilege is missing"}';
+    end if;`;
+};
+/** Blocks are embedded inside the policy verifier; no ACL or object writes are emitted. */
+export const buildRuntimePrivilegeVerificationChecks = (entries) => entries.map((entry) => `declare
+    rehearsal_role pg_catalog.oid;
+    rehearsal_object pg_catalog.oid;
+    rehearsal_allowed boolean;
+  begin
+    select r.oid into rehearsal_role from pg_catalog.pg_roles r
+    where r.rolname = ${literal(entry.role)};
+    if rehearsal_role is null then
+      raise exception 'Rehearsal privilege role is missing';
+    end if;
+    ${entry.kind === "function"
+    ? entry.argumentTypes
+        .map((type) => `if not exists (${typeLookup(type)}) then
+      raise exception 'Rehearsal privilege argument type is missing';
+    end if;`)
+        .join("\n    ")
+    : ""}
+    ${objectLookup(entry)}
+    if rehearsal_object is null then
+      raise exception 'Rehearsal privilege object is missing';
+    end if;
+    ${entry.required.map((privilege) => permissionCheck(entry, privilege, false)).join("\n    ")}
+    ${entry.forbidden.map((privilege) => permissionCheck(entry, privilege, true)).join("\n    ")}
+  end;`);

package/dist/src/targets/supabase.mjs

@@ -426,6 +426,7 @@ const resetRuntime = async () => {
                 path: runtimeMarkerPath,
                 marker: {
                     formatVersion: active.baseline.formatVersion,
+                    target: "supabase",
                     generationId: active.baseline.generationId,
                     dataSha256: readBaselineDataSha256(active.baseline),
                     schemaSha256: active.baseline.files?.["production-schema.sql"]?.sha256 ?? null,

package/docs/README.md

@@ -41,7 +41,7 @@ accomplish and follow that path.
 ## Follow the project
 
 - [Roadmap](roadmap.md)
-- [Stability and the first stable release](stability.md)
+- [Stability and release verification](stability.md)
 - [Repository architecture](architecture.md)
 - [Release process](releasing.md)
 

package/docs/configuration.md

@@ -229,6 +229,10 @@ approval sequence.
 
 `runtimePolicy` replaces common restore adapters with reviewed schemas, allowlisted
 extensions, managed triggers, local-only singleton rows, and structural expectations.
+The [runtime policy guide](runtime-policies.md#explicit-data-api-grants) also owns the
+least-privilege Data API migration checklist and core 1.1.0's optional read-only
+required/forbidden privilege declarations. Earlier releases do not accept that new
+declaration. Rehearsal never infers or automatically grants API access.
 `identityPolicy` declares a hashed verified-email or provider-subject matcher, copied
 placeholder, safe signup defaults, required role/reference transfers, Storage path
 rewrites, and token checks. Provider credentials stay in the local Supabase runtime
@@ -300,8 +304,10 @@ Rehearsal stacks.
 `keep-until-stop` preserves today's interactive behavior, while `stop-after-run` stops
 the targets after proofs, proof failures, or interruption. `lifecycle.open` uses
 `keep-until-stop` or `stop-on-application-exit` after the app closes. Every mode stops
-only Rehearsal's configured targets, never the shared engine. Ordinary stopping keeps
-database and Storage volumes and all sandbox edits; it does not reset or discard them.
+only Rehearsal's configured targets; lifecycle selection does not enable engine shutdown.
+The separately opted-in `stopOwnedColimaWhenIdle` policy above is the only guarded Colima
+shutdown path. Ordinary stopping keeps database and Storage volumes and all sandbox
+edits; it does not reset or discard them.
 See [Container runtime lifecycle](runtime-lifecycle.md).
 
 ### Foreground application idle shutdown
@@ -637,8 +643,17 @@ The VS Code Local Resources manager reviews an exact diff before changing either
 See [Local Resources](runtime-lifecycle.md#local-resources-manager) for image and volume rules.
 
 Use unique, non-privileged ports that do not overlap. `projectId` accepts lowercase
-letters, numbers, and hyphens. It labels the local Docker resources so cleanup targets
-only this project.
+letters, numbers, and hyphens: 2–40 characters for Supabase, or 2–63 for PostgreSQL.
+It labels the local Docker resources so cleanup targets only this exact project.
+Overlong configured IDs are refused before a provider starts; Rehearsal never truncates
+them or adopts resources using a shortened prefix. Review existing resources before
+changing a configured ID, and use a distinct reviewed identity for a new disposable
+runtime rather than assuming that a renamed config owns old containers or volumes.
+
+For new setup only, the generated `<project-name>-rehearsal` ID stays unchanged when it
+fits the selected provider. Longer new IDs use a readable prefix and a deterministic
+hash suffix within that provider's limit. Setup uses the same exact ID in the generated
+Rehearsal config and Supabase TOML. Existing configuration files are never rewritten.
 
 Application and readiness URLs must use a different port from the configured database,
 API, and Studio services. Editing a URL does not rewrite your framework's development

package/docs/getting-started.md

@@ -12,17 +12,17 @@ Separate setup folders are available for
 [macOS](https://github.com/Ddupasquier/rehearsal-db/tree/main/installers/macos) and
 [Linux](https://github.com/Ddupasquier/rehearsal-db/tree/main/installers/linux).
 They are readable helpers, not native executables or bundled Node/Docker installers.
-Existing Node.js 24 or 26 is required. The default only checks an existing project;
+Existing Node.js 22, 24 or 26 is required. The default only checks an existing project;
 installation needs an explicit option and does not start a database. Review the
 [shared behavior and release availability](https://github.com/Ddupasquier/rehearsal-db/blob/main/installers/README.md)
-before choosing an install option. An exact core 1.0.2 install requires that version to
+before choosing an install option. An exact core 1.1.0 install requires that version to
 be published; a checked-in helper is not proof of publication.
 
 ### Windows: use a WSL 2 Linux workspace
 
 The Windows compatibility route is Linux execution inside **WSL 2**, not a native
-PowerShell/Command Prompt database runtime. Core 1.0.1 and extension 0.1.21 make that
-boundary explicit; native Windows version/help/discovery do not authorize runtime work.
+PowerShell/Command Prompt database runtime. Since core 1.0.1 and extension 0.1.21, that
+boundary is explicit; native Windows version/help/discovery do not authorize runtime work.
 
 1. Follow Microsoft's [WSL installation guide](https://learn.microsoft.com/en-us/windows/wsl/install)
    to prepare a WSL 2 Linux distribution, such as Ubuntu 24.04. Do not use WSL 1.

package/docs/releasing.md

@@ -138,7 +138,9 @@ release-source migration.
 4. When an unfamiliar developer is available, have them follow clean-project onboarding.
    Correct and retest the first confusing, missing, or wrong instruction. Record when
    this human observation was unavailable; automated checks must not impersonate it.
-5. Change `private` to `false` only in the reviewed release change.
+5. Confirm package metadata keeps `private: false` for this public npm package. Any
+   metadata change belongs in the reviewed release change; do not toggle visibility
+   or package privacy as an incidental publishing step.
 6. Record the exact tarball filename, SHA-1, SHA-256, allowlisted files, unpacked size,
    executable, declared runtime dependency inventory, and dependency audit result.
 7. Review the release change and its exact artifact evidence.
@@ -195,7 +197,7 @@ This is mutual exclusion, not a guaranteed ordered queue: reconcile a superseded
 pending workflow before deliberately requesting another run.
 
 The objective promotion checklist and compatibility boundary live in
-[Stability and the first stable release](stability.md).
+[Stability and release verification](stability.md).
 
 The trusted publisher allows `npm dist-tag` only so this workflow can maintain those two
 tags without a stored npm token. A manual workflow run from `main` can repair the correct

package/docs/roadmap.md

@@ -1,9 +1,16 @@
 # Next steps
 
-Rehearsal core **1.0.0 is available on
+Rehearsal core **1.1.0 is available on
 [npm](https://www.npmjs.com/package/@rehearsal-db/core)** for guided Supabase and
-ordinary PostgreSQL migration rehearsals. The [free VS Code Starter preview](vscode.md)
-adds a visual workbench. Neither requires a purchase or account.
+ordinary PostgreSQL migration rehearsals. The [free VS Code Starter 0.1.23 preview](vscode.md)
+adds a visual workbench and is distributed through Marketplace and reviewed GitHub
+VSIX releases. Neither requires a purchase or account. Core is MIT-licensed; all
+features included in Starter are free indefinitely for personal or commercial development.
+
+Stable core, the editor preview and a future paid Pro offer have separate completion
+boundaries. A downloadable preview does not imply that every native accessibility,
+provider or real-user acceptance observation has been completed. Publication does not
+authorize a new database operation or migrate a running legacy extension.
 
 The standalone workflow keeps the rehearsal engine in the package while application
 meaning and privacy decisions remain project-owned. The sequence below explains its
@@ -30,10 +37,18 @@ Track the full breakdown in
 For questions or feature requests, use
 [GitHub issues](https://github.com/Ddupasquier/rehearsal-db/issues).
 
-## Acceptance still required
+## Verification and supported-journey work
+
+The [release verification policy](stability.md) owns promotion requirements. The
+[Environment Workbench epic](https://github.com/Ddupasquier/rehearsal-db/issues/130)
+and its children track remaining editor acceptance; the issue tracker owns current
+status and pickup order, not this page. Supported-journey compatibility work,
+including the [Supabase grant-preservation review](https://github.com/Ddupasquier/rehearsal-db/issues/199),
+is distinct from adding new database families or paid features.
 
-These are verification requirements, not a live checklist of unfinished releases or
-consumer migrations. Record the observed results for each exact candidate separately.
+For each exact candidate, retain the checks already proved and complete the missing
+observations. The following describe evidence boundaries, not a claim that a shipped
+release or consumer upgrade remains unfinished:
 
 - Install the exact packed candidate in clean Supabase and PostgreSQL consumers.
 - Exercise two unrelated synthetic schemas, bounded large data, interruption, drift,
@@ -48,6 +63,12 @@ consumer migrations. Record the observed results for each exact candidate separa
 
 ## Later database targets
 
-After the PostgreSQL family is stable in real projects, evaluate individual PostgreSQL
-services. MySQL, MongoDB, and unrelated database families require different migration,
-restore, and safety behavior and remain out of scope.
+Additional database, runtime, identity-provider and migration-tool integrations require
+their own reviewed capability contracts and independent acceptance. Research or a roadmap
+ticket is not a support claim. MySQL, MongoDB, SQLite and other database families are not
+supported by this PostgreSQL/Supabase release. They remain separate future work rather
+than prerequisites for the current local workflow.
+
+The complete CLI and its database/safety capabilities stay free. Optional paid Pro
+workflows, licensing and commercial readiness remain separate owner decisions; this
+roadmap does not approve a paywall, price, billing service or new distribution operation.

package/docs/runtime-lifecycle.md

@@ -27,8 +27,8 @@ then repeat the command.
 
 Setting `autoStartColima: true` is an explicit convenience opt-in. If Docker is
 unavailable and the `colima` command exists, Rehearsal runs plain `colima start` and
-reports it. Rehearsal does not resize Colima and does not stop the shared engine
-automatically. Starting Docker can also wake unrelated containers that use Docker's
+reports it. Rehearsal does not resize Colima. Engine shutdown remains off unless the
+separate ownership-guarded policy below is explicitly enabled. Starting Docker can also wake unrelated containers that use Docker's
 `always` or `unless-stopped` restart policy. Rehearsal changes only the selected
 Supabase stack to Docker's `no` restart policy after it starts successfully.
 
@@ -84,8 +84,9 @@ lifecycle: {
 `run` accepts `keep-until-stop` or `stop-after-run`. `open` accepts
 `keep-until-stop` or `stop-on-application-exit`. The bounded choices stop every
 configured Rehearsal target in reverse dependency order after the command finishes,
-fails after startup, times out, or is interrupted. They never stop the shared Docker
-engine.
+fails after startup, times out, or is interrupted. Lifecycle choices govern targets,
+not engine ownership; they do not enable Colima shutdown. The separate
+`stopOwnedColimaWhenIdle` policy still requires its own opt-in and ownership checks.
 
 Stopping is non-destructive: database and Storage volumes, applied migrations, and
 sandbox edits remain available to `start` or `open`. Only the existing explicit `reset`

package/docs/runtime-policies.md

@@ -66,6 +66,151 @@ identity policy. Verification accepts the configured placeholder before associat
 the exact recorded local identity afterward. Rehearsal stores that mapping only in its
 local internal schema; it does not duplicate the old role or weaken the row check.
 
+### Explicit Data API grants
+
+Supabase's [official announcement](https://supabase.com/changelog/45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically)
+sets October 30, 2026 for changing existing projects to opt-in exposure of new
+`public` tables. Existing table grants remain; this is not evidence that a particular
+project's setting has already changed. Direct PostgreSQL access is a separate contract.
+
+[Grants and RLS](https://supabase.com/docs/guides/api/securing-your-api) answer different
+questions: a grant allows an API role to reach an object; an RLS policy decides which
+rows that role can use. Passing an administrator SQL query or finding an RLS policy
+does not prove that an application's Data API request will work safely.
+
+For every new or recreated API table:
+
+1. Review the exposed schemas and the exact operations needed by `anon`,
+   `authenticated`, and `service_role`. An internal table does not need API access.
+2. Put explicit, least-privilege grants and RLS in that table's new migration. Remove
+   unwanted inherited defaults for the new object; do not blindly grant anonymous CRUD.
+   Check its sequences and callable functions separately, including `PUBLIC EXECUTE`.
+3. Preserve already-applied migration files. Correct historical objects through a
+   separately reviewed forward migration, not by rewriting the baseline's prefix.
+4. Test an empty setup and the disposable restore/reset/replay path with both permissive
+   and revoked automatic defaults. A schema dump alone is not proof of effective ACLs:
+   [Supabase's dump guidance](https://supabase.com/docs/reference/cli/supabase-db-dump#supabase-db-dump)
+   warns that target default privileges can broaden restored access.
+5. Independently check SQL grants, RLS and actual allowed/denied Data API requests with
+   the application's roles. A successful `service_role` request does not prove ordinary
+   authenticated access, and an empty RLS-filtered response is not a grant refusal.
+
+For example, a **new read-only authenticated API table**, created by its migration owner,
+can deliberately declare its own boundary:
+
+```sql
+create table public.api_notes (
+  id bigint generated by default as identity primary key,
+  owner_id uuid not null,
+  body text not null
+);
+alter table public.api_notes enable row level security;
+revoke all on table public.api_notes from public, anon, authenticated, service_role;
+revoke all on sequence public.api_notes_id_seq from public, anon, authenticated, service_role;
+grant select on table public.api_notes to authenticated;
+create policy read_own_notes on public.api_notes
+  for select to authenticated using ((select auth.uid()) = owner_id);
+```
+
+This example deliberately permits no client inserts, sequence use or service-role
+access. Choose a different reviewed boundary when the application needs those operations.
+Apply such SQL only through your own authorized migration process; Rehearsal does not
+change hosted grants or RLS on your behalf.
+
+### Read-only privilege expectations (core 1.1.0 and newer)
+
+Core 1.1.0 adds the following optional declaration. Earlier releases, including
+1.0.2, do not accept `privileges`; install a published release containing this contract
+before adding it. A project-owned application proof remains necessary for API/RLS behavior.
+
+Add `privileges` to the same runtime-policy JSON to check required and forbidden
+**effective** privileges after restore and migration. These checks issue no `GRANT`,
+`REVOKE`, role switch or permission repair. They do not infer grants from RLS.
+
+```json
+{
+  "policyVersion": 1,
+  "privileges": [
+    {
+      "kind": "schema",
+      "schema": "public",
+      "role": "authenticated",
+      "required": ["USAGE"],
+      "forbidden": ["CREATE"]
+    },
+    {
+      "kind": "table",
+      "schema": "public",
+      "name": "api_notes",
+      "role": "authenticated",
+      "required": ["SELECT"],
+      "forbidden": [
+        "INSERT",
+        "UPDATE",
+        "DELETE",
+        "TRUNCATE",
+        "REFERENCES",
+        "TRIGGER",
+        "MAINTAIN"
+      ]
+    },
+    {
+      "kind": "table",
+      "schema": "public",
+      "name": "api_notes",
+      "role": "anon",
+      "forbidden": [
+        "SELECT",
+        "INSERT",
+        "UPDATE",
+        "DELETE",
+        "TRUNCATE",
+        "REFERENCES",
+        "TRIGGER",
+        "MAINTAIN"
+      ]
+    }
+  ]
+}
+```
+
+Existing policy fields and structural/RLS expectations remain independent and compatible.
+Omitting `privileges` preserves the previous behavior; an empty array adds no checks.
+Each nonempty declaration needs at least one required or forbidden privilege. Omitted
+lists mean empty, but explicit `null`, overlapping lists, unknown fields and unsupported
+identifiers or privileges are rejected. At most 1,024 declarations are accepted.
+
+| Kind       | Object fields                     | Accepted privileges                                                                     |
+| ---------- | --------------------------------- | --------------------------------------------------------------------------------------- |
+| `schema`   | `schema`; no `name`               | `USAGE`, `CREATE`                                                                       |
+| `table`    | `schema`, `name`                  | `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, `REFERENCES`, `TRIGGER`, `MAINTAIN` |
+| `sequence` | `schema`, `name`                  | `USAGE`, `SELECT`, `UPDATE`                                                             |
+| `function` | `schema`, `name`, `argumentTypes` | `EXECUTE`                                                                               |
+
+Use exact uppercase privilege names and reviewed existing role/object names. Roles must
+exist in `pg_roles`; declare an actual application role to check access inherited from
+`PUBLIC`, not a standalone `PUBLIC` pseudo-role. Function checks cover ordinary functions,
+not procedures, aggregates or window routines. A function declaration must include its
+exact input types (including `INOUT`, excluding output-only arguments) as structured
+catalog names, for example
+`"argumentTypes": [{ "schema": "pg_catalog", "name": "uuid" }]`; `[]` selects a
+zero-argument function. At most 32 arguments are supported. SQL signature strings and
+non-`pg_catalog` argument types are not accepted; use a project-owned proof for unsupported
+signatures rather than changing a function to fit the check.
+
+Effective checks include inherited role permissions and grants through `PUBLIC`.
+Required table access means a full-table privilege. Forbidden `SELECT`, `INSERT`,
+`UPDATE` and `REFERENCES` also detect a privilege granted on only one column.
+`MAINTAIN` is checked on PostgreSQL 17 and newer; below 17 it is unavailable, so a required
+check fails and a forbidden check passes. Missing roles, objects, types or exact function
+signatures fail rather than being interpreted as a successful denial.
+
+These declarations do not inventory undeclared objects, prove RLS expressions or grant
+options, change Data API exposure settings, or make a live HTTP request. Keep your
+application's positive and negative API proof alongside them, including fresh setup and
+replay coverage. A failed check needs a fresh reviewed migration; it is never an
+automatic privilege escalation or a reason to use hosted administrator credentials.
+
 ## Identity policy
 
 The identity policy links one verified local Supabase identity to a copied pseudonymous

package/docs/stability.md

@@ -1,11 +1,15 @@
-# Stability and the first stable release
+# Stability and release verification
 
-Rehearsal core **1.0.0 is published** on
+Rehearsal core **1.1.0 is published** on
 [npm](https://www.npmjs.com/package/@rehearsal-db/core). This page defines its
 compatibility promise and the verification policy for releases; it is not an
 unfinished launch checklist. Stable core does not require every planned database,
 editor interface, or paid feature.
 
+The compatibility promise began with **1.0.0**. The separate
+[VS Code Starter 0.1.23 preview](vscode.md) has its own editor acceptance and does
+not turn a core release into a completed accessibility or provider walkthrough.
+
 ## What becomes a compatibility promise
 
 Starting with `1.0.0`, Rehearsal treats these documented surfaces as public:
@@ -65,7 +69,7 @@ ready. The sequence below is policy, not a claim that its checks have passed.
    corrected candidate. Reuse sufficient unchanged evidence with its original scope;
    do not relabel old or unavailable manual checks as new results. No minimum number
    of calendar days replaces these checks.
-6. Publish `1.0.0` only when no blocking issue remains and the exact tarball has passed
+6. Publish the selected stable version only when no blocking issue remains and the exact tarball has passed
    the required release checks and consumer acceptance. The protected GitHub npm
    review is the single human authorization for its displayed exact version and
    checksum; no separate chat approval or pasted phrase is required.
@@ -94,7 +98,7 @@ baseline. Automatic compatible updates do not cross the 0.x-to-1.x version bound
 review the changelog and deliberately select the stable version:
 
 ```bash
-npm install --save-dev --save-exact @rehearsal-db/core@1.0.0
+npm install --save-dev --save-exact @rehearsal-db/core@1.1.0
 npx --no-install rehearsal --version
 npx --no-install rehearsal doctor
 ```

package/docs/vscode.md

@@ -4,9 +4,9 @@ The Rehearsal extension turns the local CLI into a project-aware database-change
 workbench. It is for developers who want the safety of exact migration plans and disposable
 local runtimes without memorizing every command.
 
-This guide targets **Free Starter 0.1.22**, named **Rehearsal DB** on
+This guide targets **Free Starter 0.1.23**, named **Rehearsal DB** on
 [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=rehearsal-db.rehearsal-db),
-with a [reviewed GitHub VSIX](https://github.com/Ddupasquier/rehearsal-vscode/releases/tag/v0.1.22)
+with a [reviewed GitHub VSIX](https://github.com/Ddupasquier/rehearsal-vscode/releases/tag/v0.1.23)
 for direct installation. The canonical extension ID is **`rehearsal-db.rehearsal-db`**,
 published by **`rehearsal-db`**. The workbench and commands retain the **Rehearsal** brand.
 All included features are free indefinitely for personal or commercial development.
@@ -44,8 +44,8 @@ boundaries, baselines, migration digests, runtime isolation, locks, rollback, an
 Use desktop VS Code 1.101 or newer on macOS or Linux and a supported Node.js release
 (22, 24, or 26). You do not need the extension source repository or Test Lab.
 For a Windows desktop, use the [WSL 2 Linux-workspace setup](getting-started.md#windows-use-a-wsl-2-linux-workspace).
-With editor 0.1.21, native Windows inspection and foreground actions refuse before launching a child
-process and directs you to Remote-WSL. Install the extension into the Linux extension
+Since editor 0.1.21, native Windows inspection and foreground actions refuse before launching a child
+process and direct you to Remote-WSL. Install the extension into the Linux extension
 host and keep the project on its Linux filesystem. WSL compatibility remains a preview;
 real WSL core fixtures do not certify a native Remote-WSL editor walkthrough.
 
@@ -66,7 +66,7 @@ real WSL core fixtures do not certify a native Remote-WSL editor walkthrough.
 4. Follow **Next best step**. Review the detected project and active configuration;
    setup, source access, migration execution and cleanup keep their own confirmations.
 
-The release pairing described here is core **1.0.2** with Starter **0.1.22**.
+The release pairing described here is core **1.0.2** with Starter **0.1.23**.
 Install it once both versions appear in their official release channels.
 The extension's minimum core is `0.1.0-rc.4`. A project that is not ready should show
 setup guidance, not require you to build the extension. Opening the dashboard does not
@@ -92,10 +92,10 @@ distinction between desktop OS, extension host, architecture and actual database
 ### Direct GitHub installation
 
 The verified GitHub VSIX is an alternative to Marketplace. Open the
-[Starter 0.1.22 release](https://github.com/Ddupasquier/rehearsal-vscode/releases/tag/v0.1.22).
-Under **Assets**, download `rehearsal-db-0.1.22.vsix` and `SHA256SUMS`. In a terminal,
-run `shasum -a 256 /path/to/rehearsal-db-0.1.22.vsix` on macOS or
-`sha256sum /path/to/rehearsal-db-0.1.22.vsix` on Linux. Compare the result with that
+[Starter 0.1.23 release](https://github.com/Ddupasquier/rehearsal-vscode/releases/tag/v0.1.23).
+Under **Assets**, download `rehearsal-db-0.1.23.vsix` and `SHA256SUMS`. In a terminal,
+run `shasum -a 256 /path/to/rehearsal-db-0.1.23.vsix` on macOS or
+`sha256sum /path/to/rehearsal-db-0.1.23.vsix` on Linux. Compare the result with that
 release's `SHA256SUMS`; stop if they differ. Do not substitute a local rebuild.
 Then open **Extensions → … → Install from VSIX…** and choose the verified file.
 Save your work and reload only if VS Code asks.
@@ -147,6 +147,11 @@ reviewed change. Wait for **Saved**, then choose **Return to project**. Concurre
 refuse safely instead of overwriting someone else's work; a saved confirmation is tied
 to the exact bytes read back from disk, not merely a completed write request.
 
+Invalid structured fields show supported values or numeric limits before review.
+For example, retained environment count must be a whole number from 1 to 1000.
+If a review becomes stale, close it, refresh Rehearsal, and review the current source;
+saved and unsaved edits are not reverted. A refusal does not retry or reset a database.
+
 Commands reuse the same Rehearsal terminal for a project only after its previous command
 has a confirmed exit and its directory still matches. A running sandbox or manually
 entered foreground command is never interrupted to make room for another action. If
@@ -222,7 +227,7 @@ route; do not delete its coordination lock while a package manager may still be
 
 Manual updating stays available: download and verify the next reviewed VSIX, then repeat
 **Install from VSIX…**. See the release's
-[installation guide](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/README.md#install-and-open-your-project).
+[installation guide](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/README.md#install-and-open-your-project).
 An ordinary core-package update is detected from its manifest, lockfile and installed
 metadata without reloading VS Code. The header shows loaded extension and core versions
 separately; installed → newest appears only after a successful release check. Unknown or
@@ -239,8 +244,8 @@ external links may use their own services.
 
 ## License, support and future Pro
 
-Starter 0.1.22 carries the same
-[free Starter license](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/LICENSE).
+Starter 0.1.23 carries the same
+[free Starter license](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/LICENSE).
 Its current review, configuration, comparison and reporting tools are included; they
 are not a timed evaluation or a paid feature gate. Free use does not mean the extension
 is MIT-licensed: its bundled terms govern copying and redistribution. Core remains MIT.
@@ -249,17 +254,17 @@ Future optional Pro editor workflows must be separately identified. They cannot
 retroactively remove Starter rights already granted for a received version. Pro pricing,
 billing and entitlements are not implemented; no payment is needed to use Starter.
 Database and safety capabilities stay in the free CLI. The
-[edition guide](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/docs/commercial-readiness.md)
+[edition guide](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/docs/commercial-readiness.md)
 owns the detailed boundary.
 
 Preview describes stability, not a trial countdown. Support is best effort, with no
 service-level agreement, database hosting, backups or production support. Before use,
-read the release's [privacy statement](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/PRIVACY.md)
-and [support policy](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/SUPPORT.md).
+read the release's [privacy statement](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/PRIVACY.md)
+and [support policy](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/SUPPORT.md).
 Report editor problems in the
 [Rehearsal issue tracker](https://github.com/Ddupasquier/rehearsal-db/issues), as
 described in the support policy.
-Use its [private security process](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.22/SECURITY.md)
+Use its [private security process](https://github.com/Ddupasquier/rehearsal-vscode/blob/v0.1.23/SECURITY.md)
 for vulnerabilities; never post credentials, private rows or baseline files publicly.
 
 Historical VSIX files retain their bundled terms. Choose a reviewed release carrying

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rehearsal-db/core",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "private": false,
   "description": "Catch PostgreSQL and Supabase migrations that pass on empty databases but fail on real data—before deploy.",
   "repository": {