@bolvrk/engine-surrealdb

SurrealDB migration danger rules for Bolvrk: the SR### corpus, over the official SurrealQL grammar (@surrealdb/lezer, vendored and patched, see src/grammar/NOTICE.md), never regex.

Beta. Static (tier 1) rules only, behind --engine=surrealdb in the CLI:

npx bolvrk check migrations/*.surql --engine=surrealdb

The rules cover schema changes SurrealDB accepts without checking the records already stored (a required TYPE, a new ASSERT, READONLY, a SCHEMAFULL switch, TYPE RELATION, REMOVE FIELD), OVERWRITE resetting permissions, DROP tables that discard writes, REMOVE TABLE / DATABASE / NAMESPACE, whole-table UPDATE, DELETE and FOR loops, unclosed and nested transactions, index builds and rebuilds without CONCURRENTLY, duplicate indexes, events with no WHEN, table views, syntax removed in SurrealDB 2 and 3, cascading record references, http:: calls, and credentials: plaintext DEFINE USER passwords, JWT signing keys, literal passwords hashed with crypto::*::generate, root OWNER users and PERMISSIONS FULL writes. The credential rules check runs on Postgres (BC003, BC004) run here too. Findings never quote a secret.

Every rule ships fixture migrations in both directions, and every "SurrealDB does this" claim is re-proven against a real SurrealDB 3 (the embedded @surrealdb/node engine) in the test suite, which also checks that every fixture parses on SurrealDB itself.

Same findings contract as the Postgres engine (engine: "surrealdb" on the report). Inline suppressions (-- bolvrk-ignore SR001: reason) work the same way.

Rule reference: docs/.

Licensing follows @bolvrk/engine: the rules, their metadata and the vendored grammar (src/rules/, src/metas/, src/grammar/) are Apache-2.0; the parser wrapper and check pipeline are FSL-1.1-ALv2.