Crate fraisier_adapter_confiture 

fraisier-adapter-confiture

The in-process ConfitureMigration adapter: a MigrationAdapter that wraps the Confiture migration CLI (confiture migrate <subcommand>). It is the native, intimate-integration migration adapter of fraisier (PRD §6.3) — not an IPC subprocess adapter, but still implementing the same frozen trait.

DSN handoff — secrets via environment, never argv

The adapter resolves the database DSN through AdapterCtx::secret (logical name "DATABASE_URL") and hands it to Confiture by setting CONFITURE_DATABASE_URL on the child process and passing --no-config. Confiture 0.20.0’s --no-config makes the environment the sole DSN source, so a stray db/environments/*.yaml in the deploy workdir can never shadow the operator’s DSN (the #152 precedence contract). The DSN never appears in argv — honouring PRD review Decision 5 and the convergence rule that the in-process and IPC paths handle secrets identically.

Version requirements

Confiture ≥ 0.20.0 is the floor for current / up / down-to / verify: it provides migrate current, migrate down-to, and the --no-config env-only DSN mode this adapter depends on. The preflight capability additionally requires Confiture ≥ 0.22.0 — earlier versions reject the --output flag this adapter passes to every subcommand, so migrate preflight could not emit its JSON report. Since preflight is an advertised capability and the deploy layer enables the forward-compat lint by default, ≥ 0.22.0 is the effective minimum for a default deploy. Confiture 0.22 also froze its exit-code / JSON shapes as a stability contract aligned to this adapter (docs/reference/fraisier-adapter-contract.md in the Confiture repo, mirrored by its tests/contract/test_fraisier_adapter_surface.py).

The window_safe capability (the first-class blue-green forward-compat verdict, parsed from the preflight report’s top-level window_safe boolean) requires Confiture ≥ 0.23.0 (fraiseql/confiture#154). The verdict is purely forward-compatibility for a two-version window — false for any replica-unsafe op or any migration the classifier cannot read (.py), true for online-safe ops including CREATE INDEX CONCURRENTLY. An older confiture omits the field; fraisier’s blue-green gate then refuses (fail-safe).

Double locking (intentional)

Confiture takes its own DB-level migration lock; the saga takes a deploy-level lock via the StateStore. Both layers stay (PRD review §3): the StateStore lock serialises the deploy, Confiture’s lock serialises the database migration against any other source. The adapter never passes --no-lock or --force.

Structs

ConfitureMigration

The in-process Confiture migration adapter.