@wpmoo/toolkit 0.9.25 → 0.9.26

package/dist/audit-log.js

@@ -0,0 +1,78 @@
+import { appendFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+const secretFlagNames = new Set([
+    'password',
+    'api-key',
+    'token',
+    'secret',
+    'api_key',
+]);
+function isSecretFlagToken(token) {
+    return token === '--password'
+        ? '--password'
+        : token === '--api-key'
+            ? '--api-key'
+            : token === '--token'
+                ? '--token'
+                : token === '--secret'
+                    ? '--secret'
+                    : undefined;
+}
+function isSecretKVToken(token) {
+    const firstEquals = token.indexOf('=');
+    if (firstEquals < 0) {
+        return undefined;
+    }
+    const [name] = [token.slice(0, firstEquals), token.slice(firstEquals + 1)];
+    return secretFlagNames.has(name.replace(/^--+/, '').toLowerCase()) ? name : undefined;
+}
+function normalizeFlag(flag) {
+    return flag.startsWith('--') ? flag : `--${flag}`;
+}
+/**
+ * Redacts values for common secret-like arguments.
+ */
+export function sanitizeCommandArgs(args) {
+    const sanitized = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        const secretKV = isSecretKVToken(arg);
+        if (secretKV) {
+            sanitized.push(`${secretKV}=***`);
+            continue;
+        }
+        const secretFlag = isSecretFlagToken(arg);
+        if (secretFlag && index + 1 < args.length && !args[index + 1].startsWith('--')) {
+            sanitized.push(arg);
+            sanitized.push('***');
+            index += 1;
+            continue;
+        }
+        sanitized.push(arg);
+    }
+    return sanitized;
+}
+export function extractApprovedFlags(args, approvedFlagNames) {
+    const present = [];
+    const argsByIndex = args.map((arg) => arg.toLowerCase());
+    approvedFlagNames.forEach((name) => {
+        const normalized = normalizeFlag(name).toLowerCase();
+        if (argsByIndex.some((arg) => arg === normalized || arg.startsWith(`${normalized}=`))) {
+            present.push(name);
+        }
+    });
+    return present;
+}
+export async function appendAuditLog(options) {
+    const logPath = join(options.environmentPath, '.wpmoo', 'audit.log');
+    const event = {
+        timestamp: (options.timestamp ?? new Date()).toISOString(),
+        command: options.command,
+        environment: options.environment,
+        dryRun: options.dryRun,
+        approvedFlags: [...(options.approvedFlags ?? extractApprovedFlags(options.args, options.approvedFlagNames))],
+        args: sanitizeCommandArgs(options.args),
+    };
+    await mkdir(dirname(logPath), { recursive: true });
+    await appendFile(logPath, `${JSON.stringify(event)}\n`, 'utf8');
+}

package/dist/daily-actions.js

@@ -1,9 +1,12 @@
 import { spawn } from 'node:child_process';
 import { access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { appendAuditLog } from './audit-log.js';
 import { readEnvFile, selectedComposeEnvironment } from './compose-layout.js';
-import { normalizeDatabaseName } from './databases.js';
+import { defaultDatabaseSnapshotMaxAgeMs, findDatabaseSnapshots, normalizeDatabaseName } from './databases.js';
+import { evaluateDailyActionPolicy, } from './environment-policy.js';
 import { markerPath } from './environment.js';
+import { scanMigrationRisks } from './migrations.js';
 export const dailyActionCommands = [
     'start',
     'stop',
@@ -185,68 +188,6 @@ function scriptArgs(command, argv) {
         return ensureNoArgs(command, argv);
     return validateDatabaseArg(positionalArgs(command, argv, 1, 3), 1);
 }
-function isDestructiveCommand(command, args) {
-    if (command === 'resetdb')
-        return true;
-    return command === 'restore-snapshot' && args[0] !== '--dry-run';
-}
-function isProductionLifecycleCommand(command) {
-    return command === 'install' || command === 'update' || command === 'test';
-}
-function isStageLifecycleCommand(command) {
-    return command === 'install' || command === 'update';
-}
-function destructiveCommandError(command, envName) {
-    return `Refusing destructive command '${command}' in WPMOO_ENV=${envName}. Set WPMOO_ALLOW_DESTRUCTIVE=1 to run it intentionally.`;
-}
-function stageLifecycleCommandError(command) {
-    return `Refusing stage lifecycle command '${command}' in WPMOO_ENV=stage. Set WPMOO_ALLOW_STAGE_LIFECYCLE=1 to run it intentionally.`;
-}
-function productionLifecycleCommandError(command) {
-    return `Refusing production lifecycle command '${command}' in WPMOO_ENV=prod. Set WPMOO_ALLOW_PROD_LIFECYCLE=1 to run it intentionally.`;
-}
-async function assertDestructiveCommandAllowed(command, args, cwd) {
-    if (!isDestructiveCommand(command, args)) {
-        return;
-    }
-    const env = await readEnvFile(cwd);
-    const envName = process.env.WPMOO_ENV?.trim() || selectedComposeEnvironment(env);
-    if (envName !== 'stage' && envName !== 'prod') {
-        return;
-    }
-    const allowDestructive = process.env.WPMOO_ALLOW_DESTRUCTIVE?.trim() || env?.get('WPMOO_ALLOW_DESTRUCTIVE')?.trim();
-    if (allowDestructive !== '1') {
-        throw new Error(destructiveCommandError(command, envName));
-    }
-}
-async function assertProductionLifecycleCommandAllowed(command, cwd) {
-    if (!isProductionLifecycleCommand(command)) {
-        return;
-    }
-    const env = await readEnvFile(cwd);
-    const envName = process.env.WPMOO_ENV?.trim() || selectedComposeEnvironment(env);
-    if (envName !== 'prod') {
-        return;
-    }
-    const allowProdLifecycle = process.env.WPMOO_ALLOW_PROD_LIFECYCLE?.trim() || env?.get('WPMOO_ALLOW_PROD_LIFECYCLE')?.trim();
-    if (allowProdLifecycle !== '1') {
-        throw new Error(productionLifecycleCommandError(command));
-    }
-}
-async function assertStageLifecycleCommandAllowed(command, cwd) {
-    if (!isStageLifecycleCommand(command)) {
-        return;
-    }
-    const env = await readEnvFile(cwd);
-    const envName = process.env.WPMOO_ENV?.trim() || selectedComposeEnvironment(env);
-    if (envName !== 'stage') {
-        return;
-    }
-    const allowStageLifecycle = process.env.WPMOO_ALLOW_STAGE_LIFECYCLE?.trim() || env?.get('WPMOO_ALLOW_STAGE_LIFECYCLE')?.trim();
-    if (allowStageLifecycle !== '1') {
-        throw new Error(stageLifecycleCommandError(command));
-    }
-}
 async function assertEnvironmentRoot(cwd) {
     try {
         await access(join(cwd, markerPath));
@@ -265,17 +206,121 @@ async function assertScriptExists(cwd, script) {
     }
     return scriptPath;
 }
-export async function dailyActionPlan(command, argv, cwd = process.cwd()) {
+function envValue(env, key) {
+    return process.env[key]?.trim() || env?.get(key)?.trim();
+}
+function flagEnabled(env, key) {
+    return envValue(env, key) === '1';
+}
+function approvedFlags(env) {
+    return [
+        'WPMOO_ALLOW_DESTRUCTIVE',
+        'WPMOO_ALLOW_STAGE_LIFECYCLE',
+        'WPMOO_ALLOW_PROD_LIFECYCLE',
+        'WPMOO_ALLOW_NO_RECENT_SNAPSHOT',
+        'WPMOO_ALLOW_MIGRATIONS',
+    ].filter((key) => flagEnabled(env, key));
+}
+function requiresMigrationApproval(command) {
+    return command === 'install' || command === 'update' || command === 'test';
+}
+function noRecentSnapshotMessage(command, environment) {
+    return `Refusing destructive command '${command}' in WPMOO_ENV=${environment} without a recent database snapshot. Create a snapshot first or set WPMOO_ALLOW_NO_RECENT_SNAPSHOT=1 to run it intentionally.`;
+}
+function migrationRiskMessage(command, environment) {
+    return `Refusing migration-risk command '${command}' in WPMOO_ENV=${environment}. Review detected migration scripts or set WPMOO_ALLOW_MIGRATIONS=1 to run it intentionally.`;
+}
+async function auditDailyActionPreview(preview) {
+    if (preview.environment !== 'prod' || !preview.auditWorthy) {
+        return;
+    }
+    await appendAuditLog({
+        environmentPath: preview.cwd,
+        command: preview.command,
+        environment: preview.environment,
+        dryRun: preview.dryRun,
+        args: preview.args,
+        approvedFlagNames: [],
+        approvedFlags: preview.approvedFlags,
+    });
+}
+export async function dailyActionSafetyPreview(command, argv, cwd = process.cwd()) {
     await assertEnvironmentRoot(cwd);
     const scriptPath = await assertScriptExists(cwd, dailyActionScripts[command]);
     const args = scriptArgs(command, argv);
-    await assertStageLifecycleCommandAllowed(command, cwd);
-    await assertProductionLifecycleCommandAllowed(command, cwd);
-    await assertDestructiveCommandAllowed(command, args, cwd);
+    const env = await readEnvFile(cwd);
+    const envName = envValue(env, 'WPMOO_ENV') || selectedComposeEnvironment(env);
+    const policy = evaluateDailyActionPolicy(command, args, {
+        envName,
+        allowDestructive: envValue(env, 'WPMOO_ALLOW_DESTRUCTIVE'),
+        allowStageLifecycle: envValue(env, 'WPMOO_ALLOW_STAGE_LIFECYCLE'),
+        allowProdLifecycle: envValue(env, 'WPMOO_ALLOW_PROD_LIFECYCLE'),
+    });
+    const warnings = [];
+    const snapshotRequired = policy.isDestructive && (policy.env === 'stage' || policy.env === 'prod');
+    const snapshot = snapshotRequired ? findDatabaseSnapshots(cwd) : undefined;
+    const noRecentSnapshot = snapshotRequired &&
+        snapshot &&
+        (snapshot.newestSnapshotAgeMs === null || snapshot.newestSnapshotAgeMs > defaultDatabaseSnapshotMaxAgeMs) &&
+        !flagEnabled(env, 'WPMOO_ALLOW_NO_RECENT_SNAPSHOT');
+    if (noRecentSnapshot) {
+        warnings.push({
+            kind: 'no-recent-snapshot',
+            requiredFlag: 'WPMOO_ALLOW_NO_RECENT_SNAPSHOT',
+            blocking: true,
+            message: noRecentSnapshotMessage(command, policy.env),
+        });
+    }
+    const migrations = requiresMigrationApproval(command) && (policy.env === 'stage' || policy.env === 'prod')
+        ? await scanMigrationRisks(cwd)
+        : undefined;
+    if (migrations?.risk && !flagEnabled(env, 'WPMOO_ALLOW_MIGRATIONS')) {
+        warnings.push({
+            kind: 'migration-risk',
+            requiredFlag: 'WPMOO_ALLOW_MIGRATIONS',
+            blocking: true,
+            message: migrationRiskMessage(command, policy.env),
+        });
+    }
     return {
         cwd,
         scriptPath,
         args,
+        command,
+        environment: policy.env,
+        dryRun: policy.isDryRunPreview,
+        destructive: policy.isDestructive,
+        auditWorthy: policy.isAuditWorthy,
+        allowed: policy.allowed,
+        deny: policy.allowed ? undefined : { ...policy.deny, message: policy.message },
+        refusalMessage: policy.allowed ? undefined : policy.message,
+        requiredFlag: policy.allowed ? undefined : policy.deny.requiredFlag,
+        warnings,
+        snapshot: snapshot
+            ? {
+                requiredRecent: true,
+                newestSnapshotAgeMs: snapshot.newestSnapshotAgeMs,
+                snapshotPaths: snapshot.snapshotPaths,
+            }
+            : undefined,
+        migrations,
+        approvedFlags: approvedFlags(env),
+    };
+}
+export async function dailyActionPlan(command, argv, cwd = process.cwd()) {
+    const preview = await dailyActionSafetyPreview(command, argv, cwd);
+    await auditDailyActionPreview(preview);
+    if (!preview.allowed) {
+        throw new Error(preview.refusalMessage);
+    }
+    const blockingWarning = preview.warnings.find((warning) => warning.blocking);
+    if (blockingWarning) {
+        throw new Error(blockingWarning.message);
+    }
+    return {
+        cwd: preview.cwd,
+        scriptPath: preview.scriptPath,
+        args: preview.args,
     };
 }
 async function spawnDailyAction(plan) {

package/dist/databases.js

@@ -1,4 +1,13 @@
+import { readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
 import { spawn } from 'node:child_process';
+export const defaultDatabaseSnapshotMaxAgeMs = 24 * 60 * 60 * 1000;
+export const databaseSnapshotDirectoryNames = ['backups', 'backup', 'snapshots'];
+export const databaseSnapshotExtensions = ['.dump', '.sql', '.sql.gz', '.zip', '.tar', '.tar.gz'];
+function isDatabaseSnapshotFile(fileName, extensions) {
+    const normalized = fileName.toLowerCase();
+    return extensions.some((extension) => normalized.endsWith(extension));
+}
 const maintenanceDatabases = new Set(['postgres']);
 const databaseNamePattern = /^[A-Za-z0-9_.-]+$/u;
 export function isValidDatabaseName(value) {
@@ -46,6 +55,54 @@ export function parseDatabaseListOutput(output, options = {}) {
     }
     return databases;
 }
+export function findDatabaseSnapshots(targetDirectory, options = {}) {
+    const { nowMs = Date.now(), snapshotDirectories = [...databaseSnapshotDirectoryNames], snapshotExtensions = [...databaseSnapshotExtensions], } = options;
+    const snapshots = [];
+    for (const directoryName of snapshotDirectories) {
+        const directory = join(targetDirectory, directoryName);
+        let entries;
+        try {
+            entries = readdirSync(directory, { withFileTypes: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                continue;
+            }
+            throw error;
+        }
+        for (const entry of entries) {
+            if (!isDatabaseSnapshotFile(entry.name, snapshotExtensions)) {
+                continue;
+            }
+            const path = join(directory, entry.name);
+            let stats;
+            try {
+                stats = statSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (!stats.isFile()) {
+                continue;
+            }
+            const mtimeMs = stats.mtimeMs;
+            const ageMs = Math.max(0, nowMs - mtimeMs);
+            snapshots.push({ path, mtimeMs, ageMs });
+        }
+    }
+    snapshots.sort((a, b) => b.mtimeMs - a.mtimeMs || a.path.localeCompare(b.path));
+    const newestSnapshot = snapshots[0] ?? null;
+    return {
+        snapshots,
+        snapshotPaths: snapshots.map((snapshot) => snapshot.path),
+        newestSnapshotAgeMs: newestSnapshot ? newestSnapshot.ageMs : null,
+    };
+}
+export function hasRecentDatabaseSnapshot(targetDirectory, options = {}) {
+    const { maxAgeMs = defaultDatabaseSnapshotMaxAgeMs, ...scanOptions } = options;
+    const result = findDatabaseSnapshots(targetDirectory, scanOptions);
+    return result.newestSnapshotAgeMs !== null && result.newestSnapshotAgeMs <= maxAgeMs;
+}
 export function normalizeDatabaseListResult(result) {
     if (Array.isArray(result)) {
         return { ok: true, databases: result };

package/dist/environment-policy.js

@@ -0,0 +1,219 @@
+export const dailyActionPolicyCommands = [
+    'start',
+    'stop',
+    'logs',
+    'restart',
+    'shell',
+    'psql',
+    'install',
+    'update',
+    'test',
+    'resetdb',
+    'snapshot',
+    'restore-snapshot',
+    'lint',
+    'pot',
+];
+function normalizeFlag(value) {
+    return value?.trim() ?? '';
+}
+function parseFlag(value) {
+    return normalizeFlag(value) === '1';
+}
+export const dailyActionPolicyTable = {
+    start: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    stop: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    logs: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    restart: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    shell: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    psql: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    install: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: true,
+        requiresProdLifecycleApproval: true,
+        isAuditWorthy: () => true,
+    },
+    update: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: true,
+        requiresProdLifecycleApproval: true,
+        isAuditWorthy: () => true,
+    },
+    test: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: true,
+        isAuditWorthy: () => true,
+    },
+    resetdb: {
+        isDestructive: () => true,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => true,
+    },
+    snapshot: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    'restore-snapshot': {
+        isDestructive: (args) => args[0] !== '--dry-run',
+        isDryRunAllowed: true,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: (args) => args[0] !== '--dry-run',
+    },
+    lint: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+    pot: {
+        isDestructive: () => false,
+        isDryRunAllowed: false,
+        requiresStageLifecycleApproval: false,
+        requiresProdLifecycleApproval: false,
+        isAuditWorthy: () => false,
+    },
+};
+export function parseEnvironmentKind(rawEnvName) {
+    const normalized = rawEnvName?.trim().toLowerCase();
+    if (normalized === 'stage' || normalized === 'prod') {
+        return normalized;
+    }
+    return 'dev';
+}
+export function isDailyActionPolicyCommand(value) {
+    return dailyActionPolicyCommands.includes(value);
+}
+export function isRestoreSnapshotDryRun(args) {
+    return args[0] === '--dry-run';
+}
+function denyMessage(kind, command, env) {
+    if (kind === 'destructive') {
+        return `Refusing destructive command '${command}' in WPMOO_ENV=${env}. Set WPMOO_ALLOW_DESTRUCTIVE=1 to run it intentionally.`;
+    }
+    if (kind === 'stage-lifecycle') {
+        return `Refusing stage lifecycle command '${command}' in WPMOO_ENV=stage. Set WPMOO_ALLOW_STAGE_LIFECYCLE=1 to run it intentionally.`;
+    }
+    return `Refusing production lifecycle command '${command}' in WPMOO_ENV=prod. Set WPMOO_ALLOW_PROD_LIFECYCLE=1 to run it intentionally.`;
+}
+export function renderPolicyDenyMessage(deny) {
+    return denyMessage(deny.kind, deny.command, deny.env);
+}
+export function evaluateDailyActionPolicy(command, args, flags) {
+    const env = parseEnvironmentKind(flags.envName);
+    const policy = dailyActionPolicyTable[command];
+    const isDestructive = policy.isDestructive(args);
+    const isDryRunPreview = command === 'restore-snapshot' && isRestoreSnapshotDryRun(args);
+    const isAuditWorthy = policy.isAuditWorthy(args);
+    if (policy.requiresStageLifecycleApproval && env === 'stage' && !parseFlag(flags.allowStageLifecycle)) {
+        const deny = {
+            kind: 'stage-lifecycle',
+            command,
+            env,
+            requiredFlag: 'WPMOO_ALLOW_STAGE_LIFECYCLE',
+            requiredValue: '1',
+        };
+        return {
+            allowed: false,
+            command,
+            env,
+            isDestructive,
+            isDryRunPreview,
+            isAuditWorthy,
+            deny,
+            message: renderPolicyDenyMessage(deny),
+        };
+    }
+    if (policy.requiresProdLifecycleApproval && env === 'prod' && !parseFlag(flags.allowProdLifecycle)) {
+        const deny = {
+            kind: 'prod-lifecycle',
+            command,
+            env,
+            requiredFlag: 'WPMOO_ALLOW_PROD_LIFECYCLE',
+            requiredValue: '1',
+        };
+        return {
+            allowed: false,
+            command,
+            env,
+            isDestructive,
+            isDryRunPreview,
+            isAuditWorthy,
+            deny,
+            message: renderPolicyDenyMessage(deny),
+        };
+    }
+    if (isDestructive && (env === 'stage' || env === 'prod') && !parseFlag(flags.allowDestructive)) {
+        const deny = {
+            kind: 'destructive',
+            command,
+            env,
+            requiredFlag: 'WPMOO_ALLOW_DESTRUCTIVE',
+            requiredValue: '1',
+        };
+        return {
+            allowed: false,
+            command,
+            env,
+            isDestructive,
+            isDryRunPreview,
+            isAuditWorthy,
+            deny,
+            message: renderPolicyDenyMessage(deny),
+        };
+    }
+    return {
+        allowed: true,
+        command,
+        env,
+        isDestructive,
+        isDryRunPreview,
+        isAuditWorthy,
+    };
+}

package/dist/migrations.js

@@ -0,0 +1,112 @@
+import { lstat, readdir } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+const sourceRepoTypes = ['private', 'oca', 'external'];
+const sourceRepoBase = ['odoo', 'custom', 'src'];
+const migrationFolders = ['migrations', 'migration'];
+const versionedMigrationFiles = ['pre-migration.py', 'post-migration.py', 'end-migration.py'];
+const scriptMigrationFiles = ['migrate.py', 'migration.py'];
+async function isDirectory(path) {
+    try {
+        const entry = await lstat(path);
+        return entry.isDirectory() && !entry.isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+            return false;
+        }
+        throw error;
+    }
+}
+async function isFile(path) {
+    try {
+        const entry = await lstat(path);
+        return entry.isFile() && !entry.isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+            return false;
+        }
+        throw error;
+    }
+}
+async function listDirectoryNames(path) {
+    try {
+        const entries = await readdir(path, { withFileTypes: true });
+        const filtered = entries.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.startsWith('.'));
+        return filtered.map((entry) => entry.name).sort();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+            return [];
+        }
+        throw error;
+    }
+}
+async function listMigrationFiles(modulePath, migrationFolder) {
+    const found = [];
+    const versionRoot = join(modulePath, migrationFolder);
+    if (!(await isDirectory(versionRoot))) {
+        return found;
+    }
+    const versions = await listDirectoryNames(versionRoot);
+    for (const version of versions) {
+        const versionPath = join(versionRoot, version);
+        if (!(await isDirectory(versionPath))) {
+            continue;
+        }
+        for (const file of versionedMigrationFiles) {
+            const path = join(versionPath, file);
+            if (await isFile(path)) {
+                found.push(path);
+            }
+        }
+    }
+    return found;
+}
+async function scanModule(modulePath) {
+    const found = [];
+    for (const folder of migrationFolders) {
+        found.push(...(await listMigrationFiles(modulePath, folder)));
+    }
+    const scriptsPath = join(modulePath, 'scripts');
+    if (!(await isDirectory(scriptsPath))) {
+        return found.sort();
+    }
+    for (const migrationScript of scriptMigrationFiles) {
+        const candidate = join(scriptsPath, migrationScript);
+        if (await isFile(candidate)) {
+            found.push(candidate);
+        }
+    }
+    return found;
+}
+export async function scanMigrationRisks(target) {
+    const root = resolve(target);
+    const foundPaths = [];
+    const srcRoot = join(root, ...sourceRepoBase);
+    for (const sourceType of sourceRepoTypes) {
+        const typeRoot = join(srcRoot, sourceType);
+        if (!(await isDirectory(typeRoot))) {
+            continue;
+        }
+        const repoNames = await listDirectoryNames(typeRoot);
+        for (const repoName of repoNames) {
+            const repoPath = join(typeRoot, repoName);
+            if (!(await isDirectory(repoPath))) {
+                continue;
+            }
+            const moduleNames = await listDirectoryNames(repoPath);
+            for (const moduleName of moduleNames) {
+                const modulePath = join(repoPath, moduleName);
+                const modulePaths = await scanModule(modulePath);
+                foundPaths.push(...modulePaths);
+            }
+        }
+    }
+    foundPaths.sort();
+    return {
+        foundPaths,
+        count: foundPaths.length,
+        risk: foundPaths.length > 0,
+    };
+}

package/dist/templates.js

@@ -601,6 +601,62 @@ allow_stage_lifecycle() {
   [[ "$value" == "1" ]]
 }
 
+allow_no_recent_snapshot() {
+  local value="\${WPMOO_ALLOW_NO_RECENT_SNAPSHOT:-$(env_file_value WPMOO_ALLOW_NO_RECENT_SNAPSHOT)}"
+  [[ "$value" == "1" ]]
+}
+
+allow_migrations() {
+  local value="\${WPMOO_ALLOW_MIGRATIONS:-$(env_file_value WPMOO_ALLOW_MIGRATIONS)}"
+  [[ "$value" == "1" ]]
+}
+
+has_recent_snapshot() {
+  local dir
+  for dir in backups backup snapshots; do
+    [[ -d "$dir" ]] || continue
+    if find "$dir" -type f \\( -name "*.dump" -o -name "*.sql" -o -name "*.sql.gz" -o -name "*.zip" -o -name "*.tar" -o -name "*.tar.gz" \\) -mtime -1 -print -quit 2>/dev/null | grep -q .; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+require_recent_snapshot_or_override() {
+  local command="$1"
+  local env_name
+  env_name="$(selected_env)"
+  if [[ "$env_name" == "stage" || "$env_name" == "prod" ]]; then
+    if ! allow_no_recent_snapshot && ! has_recent_snapshot; then
+      echo "Refusing destructive command '$command' in WPMOO_ENV=$env_name without a recent database snapshot. Create a snapshot first or set WPMOO_ALLOW_NO_RECENT_SNAPSHOT=1 to run it intentionally." >&2
+      exit 1
+    fi
+  fi
+}
+
+has_migration_risk() {
+  local base
+  for base in odoo/custom/src/private odoo/custom/src/oca odoo/custom/src/external; do
+    [[ -d "$base" ]] || continue
+    if find "$base" -type f \\( -path "*/migrations/*/pre-migration.py" -o -path "*/migrations/*/post-migration.py" -o -path "*/migrations/*/end-migration.py" -o -path "*/migration/*/pre-migration.py" -o -path "*/migration/*/post-migration.py" -o -path "*/migration/*/end-migration.py" -o -path "*/scripts/migrate.py" -o -path "*/scripts/migration.py" \\) -print -quit 2>/dev/null | grep -q .; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+require_migrations_allowed() {
+  local command="$1"
+  local env_name
+  env_name="$(selected_env)"
+  if [[ "$env_name" == "stage" || "$env_name" == "prod" ]]; then
+    if ! allow_migrations && has_migration_risk; then
+      echo "Refusing migration-risk command '$command' in WPMOO_ENV=$env_name. Review detected migration scripts or set WPMOO_ALLOW_MIGRATIONS=1 to run it intentionally." >&2
+      exit 1
+    fi
+  fi
+}
+
 require_stage_lifecycle_allowed() {
   local command="$1"
   local env_name
@@ -712,6 +768,7 @@ case "$command" in
     require_module_args "$command" "$@"
     require_stage_lifecycle_allowed "$command"
     require_prod_lifecycle_allowed "$command"
+    require_migrations_allowed "$command"
     run_script ./scripts/install.sh "$@"
     ;;
   "update")
@@ -719,18 +776,21 @@ case "$command" in
     require_module_args "$command" "$@"
     require_stage_lifecycle_allowed "$command"
     require_prod_lifecycle_allowed "$command"
+    require_migrations_allowed "$command"
     run_script ./scripts/update.sh "$@"
     ;;
   "test")
     shift
     validate_test_args "$@"
     require_prod_lifecycle_allowed "$command"
+    require_migrations_allowed "$command"
     run_script ./scripts/test.sh "$@"
     ;;
   "resetdb")
     shift
     positional_args "$command" 0 2 "$@"
     require_destructive_allowed "$command"
+    require_recent_snapshot_or_override "$command"
     run_script ./scripts/resetdb.sh "$@"
     ;;
   "snapshot")
@@ -749,6 +809,7 @@ case "$command" in
     restore_args+=("$@")
     if [[ "\${restore_args[0]:-}" != "--dry-run" ]]; then
       require_destructive_allowed "$command"
+      require_recent_snapshot_or_override "$command"
     fi
     run_script ./scripts/restore-snapshot.sh "\${restore_args[@]}"
     ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wpmoo/toolkit",
-  "version": "0.9.25",
+  "version": "0.9.26",
   "description": "WPMoo Toolkit for development, staging, and production lifecycle workflows.",
   "type": "module",
   "repository": {