hatchkit 0.1.35 → 0.1.37

package/dist/assets/env.js

@@ -0,0 +1,150 @@
+/*
+ * Resolve the S3 connection a scaffolded project actually uses, in
+ * either `dev` or `prod` mode. The bucket the *runtime* talks to is
+ * the source of truth — we read the same .env files the runtime
+ * reads, not the global hatchkit config or keychain.
+ *
+ * Naming convention quirks (see provision/s3-buckets.ts):
+ *
+ *   · For S3/AWS-style projects, the assets bucket name lives in the
+ *     env (`S3_BUCKET_NAME` or `S3_BUCKET_NAME` again). The `_*_*`
+ *     credential keys are `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`
+ *     (AWS-prefixed) or `S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY`
+ *     (generic).
+ *   · For R2 the assets bucket name is NOT in env (the runtime never
+ *     calls it directly — it's URL-driven). The bucket name lives in
+ *     `.hatchkit.json` under `s3Buckets.assets.name`. R2 uses the
+ *     `R2_*` prefix for its credentials.
+ *
+ * We normalise both shapes here so callers don't have to care.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseDotenv } from "@dotenvx/dotenvx";
+import { readManifest } from "../scaffold/manifest.js";
+/** Load + decrypt the env vars that the runtime will see in `mode`. */
+export function loadProjectEnv(opts) {
+    const serverDir = opts.serverDir ?? detectServerDir(opts.projectDir);
+    const filename = opts.mode === "prod" ? ".env.production" : ".env.development";
+    const envPath = join(serverDir, filename);
+    if (!existsSync(envPath)) {
+        throw new Error(`Expected ${envPath} (mode=${opts.mode}). Is this a hatchkit project? ` +
+            `Run from the project root, or pass --dir.`);
+    }
+    const src = readFileSync(envPath, "utf-8");
+    let privateKey;
+    if (opts.mode === "prod") {
+        privateKey = process.env.DOTENV_PRIVATE_KEY_PRODUCTION ?? readPrivateKey(opts.projectDir);
+        if (!privateKey) {
+            throw new Error(`Can't decrypt ${envPath}. No DOTENV_PRIVATE_KEY_PRODUCTION in env, ` +
+                `and no .env.keys at ${join(opts.projectDir, ".env.keys")} or ${join(serverDir, ".env.keys")}. ` +
+                `Run \`hatchkit keys show <project>\` and export the value, or restore .env.keys.`);
+        }
+    }
+    const parsed = parseDotenv(src, { privateKey, processEnv: {} });
+    return parsed;
+}
+/** Resolve the unified S3 config used by mirror operations. */
+export function loadS3Config(opts) {
+    const env = loadProjectEnv(opts);
+    const serverDir = opts.serverDir ?? detectServerDir(opts.projectDir);
+    const manifest = readManifest(opts.projectDir);
+    const prefix = detectPrefix(env);
+    const accessKeyId = env[`${prefix}_ACCESS_KEY_ID`] ?? env.AWS_ACCESS_KEY_ID ?? env.S3_ACCESS_KEY_ID ?? "";
+    const secretAccessKey = env[`${prefix}_SECRET_ACCESS_KEY`] ??
+        env.AWS_SECRET_ACCESS_KEY ??
+        env.S3_SECRET_ACCESS_KEY ??
+        "";
+    const endpoint = env[`${prefix}_ENDPOINT`] ?? env.S3_ENDPOINT ?? defaultEndpointFor(prefix, env);
+    const region = env[`${prefix}_REGION`] ??
+        env.AWS_REGION ??
+        env.S3_REGION ??
+        (prefix === "R2" ? "auto" : "us-east-1");
+    const forcePathStyle = parseBool(env.S3_FORCE_PATH_STYLE) ?? prefix !== "AWS";
+    // Assets bucket — for R2, not in env, so fall back to the manifest.
+    // For S3/AWS the bucket env (`S3_BUCKET_NAME`) holds the assets name
+    // unless a state bucket was provisioned (in which case it holds the
+    // state name — see provision/s3-buckets.ts:459-465). Reconcile by
+    // preferring the manifest when it's present.
+    const assetsFromManifest = manifest?.s3Buckets?.assets;
+    const stateFromManifest = manifest?.s3Buckets?.state;
+    const bucketEnv = env[`${prefix}_BUCKET_NAME`] ?? env.S3_BUCKET_NAME ?? env.R2_STATE_BUCKET;
+    const assetsName = assetsFromManifest?.name ?? bucketEnv;
+    if (!assetsName) {
+        throw new Error(`Can't resolve the assets bucket name for mode=${opts.mode}. ` +
+            `No s3Buckets.assets in .hatchkit.json and no S3_BUCKET_NAME / R2_BUCKET_NAME in env. ` +
+            `If this is a fresh project, run \`hatchkit provision s3\` first.`);
+    }
+    const assetsPublicUrl = assetsFromManifest?.publicUrl ?? env.NEXT_PUBLIC_ASSETS_BASE_URL ?? env.S3_PUBLIC_URL ?? null;
+    const stateName = stateFromManifest?.name ?? env[`${prefix}_STATE_BUCKET`];
+    if (!accessKeyId || !secretAccessKey) {
+        throw new Error(`Missing S3 credentials in ${join(serverDir, opts.mode === "prod" ? ".env.production" : ".env.development")}. ` +
+            `Looked for ${prefix}_ACCESS_KEY_ID / AWS_ACCESS_KEY_ID and the matching secret.`);
+    }
+    return {
+        mode: opts.mode,
+        endpoint,
+        region,
+        accessKeyId,
+        secretAccessKey,
+        forcePathStyle,
+        buckets: {
+            assets: { name: assetsName, publicUrl: assetsPublicUrl },
+            ...(stateName ? { state: { name: stateName } } : {}),
+        },
+        source: opts.mode === "prod" ? `${serverDir}/.env.production` : `${serverDir}/.env.development`,
+    };
+}
+/** Detect the env-name prefix the project uses. Order matters — R2
+ *  wins over AWS wins over S3 because the more specific prefixes
+ *  signal an explicit choice while S3 is the generic fallback. */
+function detectPrefix(env) {
+    if (env.R2_ENDPOINT || env.R2_ACCESS_KEY_ID)
+        return "R2";
+    if (env.AWS_ACCESS_KEY_ID && (env.S3_BUCKET_NAME || env.S3_ENDPOINT))
+        return "AWS";
+    return "S3";
+}
+function defaultEndpointFor(prefix, env) {
+    if (prefix === "AWS") {
+        const region = env.AWS_REGION ?? "us-east-1";
+        return `https://s3.${region}.amazonaws.com`;
+    }
+    // R2 / generic S3 require an explicit endpoint — surfacing the
+    // missing var here is more useful than a misleading default.
+    throw new Error(`No ${prefix}_ENDPOINT or S3_ENDPOINT set. For R2 set R2_ENDPOINT to https://<account-id>.r2.cloudflarestorage.com.`);
+}
+function parseBool(v) {
+    if (v === undefined)
+        return undefined;
+    return v === "true" || v === "1";
+}
+function detectServerDir(projectDir) {
+    // Conventions, in order: pnpm/npm workspace at packages/server, or
+    // a flat single-package project where the env file sits at root.
+    const candidate = join(projectDir, "packages", "server");
+    if (existsSync(join(candidate, ".env.example")) ||
+        existsSync(join(candidate, ".env.development"))) {
+        return candidate;
+    }
+    return projectDir;
+}
+/** Find the dotenvx private key for `production`. Searches the
+ *  project root and packages/server for `.env.keys` (where dotenvx
+ *  writes it locally). Caller falls back to the OS keychain. */
+function readPrivateKey(projectDir) {
+    const candidates = [
+        join(projectDir, ".env.keys"),
+        join(projectDir, "packages", "server", ".env.keys"),
+    ];
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        const text = readFileSync(path, "utf-8");
+        const m = text.match(/^DOTENV_PRIVATE_KEY_PRODUCTION="?([0-9a-fA-F]+)"?/m);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+//# sourceMappingURL=env.js.map

package/dist/assets/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/assets/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAkCvD,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,UAAU,IAAI,CAAC,IAAI,iCAAiC;YACrE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3C,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iBAAiB,OAAO,6CAA6C;gBACnE,uBAAuB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI;gBAChG,kFAAkF,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,MAAgC,CAAC;AAC1C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,WAAW,GACf,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACxF,MAAM,eAAe,GACnB,GAAG,CAAC,GAAG,MAAM,oBAAoB,CAAC;QAClC,GAAG,CAAC,qBAAqB;QACzB,GAAG,CAAC,oBAAoB;QACxB,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,MAAM,GACV,GAAG,CAAC,GAAG,MAAM,SAAS,CAAC;QACvB,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,SAAS;QACb,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,KAAK,KAAK,CAAC;IAE9E,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,MAAM,kBAAkB,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;IACvD,MAAM,iBAAiB,GAAG,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,eAAe,CAAC;IAE5F,MAAM,UAAU,GAAG,kBAAkB,EAAE,IAAI,IAAI,SAAS,CAAC;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,IAAI,IAAI;YAC5D,uFAAuF;YACvF,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,kBAAkB,EAAE,SAAS,IAAI,GAAG,CAAC,2BAA2B,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;IAChG,MAAM,SAAS,GAAG,iBAAiB,EAAE,IAAI,IAAI,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC;IAE3E,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI;YAC7G,cAAc,MAAM,6DAA6D,CACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ;QACR,MAAM;QACN,WAAW;QACX,eAAe;QACf,cAAc;QACd,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE;YACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;QACD,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC,CAAC,GAAG,SAAS,mBAAmB;KAChG,CAAC;AACJ,CAAC;AAED;;kEAEkE;AAClE,SAAS,YAAY,CAAC,GAA2B;IAC/C,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,GAA2B;IACrE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;QAC7C,OAAO,cAAc,MAAM,gBAAgB,CAAC;IAC9C,CAAC;IACD,+DAA+D;IAC/D,6DAA6D;IAC7D,MAAM,IAAI,KAAK,CACb,MAAM,MAAM,wGAAwG,CACrH,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAqB;IACtC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,IACE,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,EAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;gEAEgE;AAChE,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC;KACpD,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3E,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/assets/index.d.ts

@@ -0,0 +1,2 @@
+export declare function handleAssets(args: string[]): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/assets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAsCA,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkClE"}

package/dist/assets/index.js

@@ -0,0 +1,328 @@
+/*
+ * `hatchkit assets <subcommand>` — move bytes between the local
+ * MinIO bucket and the production bucket (or any S3-compatible
+ * source, for adoption).
+ *
+ * Subcommands:
+ *   seed     ./seed/assets/  → local MinIO
+ *   push     local MinIO     → prod bucket
+ *   pull     prod bucket     → local MinIO
+ *   migrate  external bucket → prod bucket (--from-endpoint=… --from-bucket=…)
+ *   list     dev|prod          List objects in a bucket
+ *
+ * All transfer commands take `--bucket assets|state` (default assets),
+ * `--dir <path>` (default cwd), `--dry-run`, and `--json`.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { ListObjectsV2Command } from "@aws-sdk/client-s3";
+import chalk from "chalk";
+import ora from "ora";
+import { loadS3Config } from "./env.js";
+import { buildS3Client, ensureBucket, formatBytes, mirror, } from "./mirror.js";
+export async function handleAssets(args) {
+    const sub = args[0];
+    if (!sub || sub === "--help" || sub === "-h") {
+        printHelp();
+        return 0;
+    }
+    const flags = parseCommon(args.slice(1));
+    try {
+        switch (sub) {
+            case "seed":
+                return await handleSeed(args.slice(1), flags);
+            case "push":
+                return await handlePush(flags);
+            case "pull":
+                return await handlePull(flags);
+            case "migrate":
+                return await handleMigrate(args.slice(1), flags);
+            case "list":
+                return await handleList(args.slice(1), flags);
+            default:
+                console.error(chalk.red(`Unknown subcommand: assets ${sub}`));
+                printHelp();
+                return 1;
+        }
+    }
+    catch (err) {
+        const msg = err.message;
+        if (flags.json) {
+            console.log(JSON.stringify({ ok: false, error: msg }));
+        }
+        else {
+            console.error(chalk.red(`\n  ✗ ${msg}\n`));
+        }
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// seed — populate the local MinIO bucket from ./seed/assets/
+// ---------------------------------------------------------------------------
+async function handleSeed(rawArgs, flags) {
+    const fromArg = takeFlag(rawArgs, "--from");
+    const fromDir = resolve(flags.projectDir, fromArg ?? "seed/assets");
+    if (!existsSync(fromDir)) {
+        throw new Error(`Seed directory ${fromDir} doesn't exist. Create it (mkdir -p seed/assets) and drop files in, or pass --from <path>.`);
+    }
+    const dev = loadS3Config({ projectDir: flags.projectDir, mode: "dev" });
+    const target = endpoint(dev, flags.bucket, "local");
+    await ensureBucket(target);
+    return runMirror({
+        label: `seed → ${target.label} bucket "${target.bucket}"`,
+        flags,
+        run: () => mirror({
+            source: { kind: "dir", dir: fromDir, label: "seed/assets" },
+            target,
+            dryRun: flags.dryRun,
+            onObject: makeProgress(flags.json),
+        }),
+        extra: { from: fromDir },
+    });
+}
+// ---------------------------------------------------------------------------
+// push — local MinIO → prod
+// ---------------------------------------------------------------------------
+async function handlePush(flags) {
+    const dev = loadS3Config({ projectDir: flags.projectDir, mode: "dev" });
+    const prod = loadS3Config({ projectDir: flags.projectDir, mode: "prod" });
+    const source = endpoint(dev, flags.bucket, "local");
+    const target = endpoint(prod, flags.bucket, "prod");
+    if (!flags.dryRun)
+        await ensureBucket(target);
+    return runMirror({
+        label: `push local → prod bucket "${target.bucket}"`,
+        flags,
+        run: () => mirror({
+            source,
+            target,
+            dryRun: flags.dryRun,
+            onObject: makeProgress(flags.json),
+        }),
+    });
+}
+// ---------------------------------------------------------------------------
+// pull — prod → local MinIO (be careful: realistic data may include PII)
+// ---------------------------------------------------------------------------
+async function handlePull(flags) {
+    const dev = loadS3Config({ projectDir: flags.projectDir, mode: "dev" });
+    const prod = loadS3Config({ projectDir: flags.projectDir, mode: "prod" });
+    const source = endpoint(prod, flags.bucket, "prod");
+    const target = endpoint(dev, flags.bucket, "local");
+    if (!flags.dryRun)
+        await ensureBucket(target);
+    return runMirror({
+        label: `pull prod → local bucket "${target.bucket}"`,
+        flags,
+        run: () => mirror({
+            source,
+            target,
+            dryRun: flags.dryRun,
+            onObject: makeProgress(flags.json),
+        }),
+    });
+}
+// ---------------------------------------------------------------------------
+// migrate — external bucket → prod (the adoption escape hatch)
+// ---------------------------------------------------------------------------
+async function handleMigrate(rawArgs, flags) {
+    const fromEndpoint = takeFlag(rawArgs, "--from-endpoint");
+    const fromBucket = takeFlag(rawArgs, "--from-bucket");
+    const fromKey = takeFlag(rawArgs, "--from-key") ?? process.env.HATCHKIT_FROM_ACCESS_KEY_ID;
+    const fromSecret = takeFlag(rawArgs, "--from-secret") ?? process.env.HATCHKIT_FROM_SECRET_ACCESS_KEY;
+    const fromRegion = takeFlag(rawArgs, "--from-region") ?? "auto";
+    const fromPrefix = takeFlag(rawArgs, "--from-prefix");
+    const missing = [];
+    if (!fromBucket)
+        missing.push("--from-bucket");
+    if (!fromKey)
+        missing.push("--from-key (or env HATCHKIT_FROM_ACCESS_KEY_ID)");
+    if (!fromSecret)
+        missing.push("--from-secret (or env HATCHKIT_FROM_SECRET_ACCESS_KEY)");
+    if (missing.length > 0) {
+        throw new Error(`assets migrate is missing: ${missing.join(", ")}. ` +
+            `Run \`hatchkit help assets\` for the full flag list.`);
+    }
+    const sourceClient = buildS3Client({
+        mode: "prod",
+        endpoint: fromEndpoint ?? `https://s3.${fromRegion}.amazonaws.com`,
+        region: fromRegion,
+        accessKeyId: fromKey,
+        secretAccessKey: fromSecret,
+        forcePathStyle: !!fromEndpoint && !fromEndpoint.includes("amazonaws.com"),
+        buckets: { assets: { name: fromBucket, publicUrl: null } },
+        source: "migrate flags",
+    });
+    const prod = loadS3Config({ projectDir: flags.projectDir, mode: "prod" });
+    const target = endpoint(prod, flags.bucket, "prod");
+    if (!flags.dryRun)
+        await ensureBucket(target);
+    return runMirror({
+        label: `migrate ${fromBucket} → prod bucket "${target.bucket}"`,
+        flags,
+        run: () => mirror({
+            source: {
+                kind: "s3",
+                client: sourceClient,
+                bucket: fromBucket,
+                prefix: fromPrefix,
+                label: "external",
+            },
+            target,
+            dryRun: flags.dryRun,
+            onObject: makeProgress(flags.json),
+        }),
+        extra: { from: { bucket: fromBucket, endpoint: fromEndpoint, region: fromRegion } },
+    });
+}
+// ---------------------------------------------------------------------------
+// list — quick "what's in the bucket" probe
+// ---------------------------------------------------------------------------
+async function handleList(rawArgs, flags) {
+    const which = (rawArgs.find((a) => a === "dev" || a === "prod") ?? "dev");
+    const cfg = loadS3Config({ projectDir: flags.projectDir, mode: which });
+    const ep = endpoint(cfg, flags.bucket, which === "dev" ? "local" : "prod");
+    const out = await ep.client.send(new ListObjectsV2Command({ Bucket: ep.bucket, MaxKeys: 1000 }));
+    const entries = (out.Contents ?? []).map((c) => ({
+        key: c.Key ?? "",
+        size: c.Size ?? 0,
+        modified: c.LastModified?.toISOString(),
+    }));
+    if (flags.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            mode: which,
+            bucket: ep.bucket,
+            endpoint: cfg.endpoint,
+            truncated: !!out.IsTruncated,
+            entries,
+        }, null, 2));
+        return 0;
+    }
+    if (entries.length === 0) {
+        console.log(chalk.dim(`  (empty) — ${ep.bucket} on ${cfg.endpoint}`));
+        return 0;
+    }
+    for (const e of entries) {
+        console.log(`  ${chalk.cyan(e.key.padEnd(60))} ${formatBytes(e.size).padStart(10)}`);
+    }
+    console.log(chalk.dim(`\n  ${entries.length} object(s)${out.IsTruncated ? " (more — listing truncated)" : ""}`));
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// helpers
+// ---------------------------------------------------------------------------
+function endpoint(cfg, kind, label) {
+    const bucket = kind === "state" ? cfg.buckets.state?.name : cfg.buckets.assets.name;
+    if (!bucket) {
+        throw new Error(`No "${kind}" bucket configured for ${label} (${cfg.source}). ` +
+            `Either pick --bucket assets, or run \`hatchkit provision s3 --with-state-bucket\`.`);
+    }
+    return { kind: "s3", client: buildS3Client(cfg), bucket, label };
+}
+function makeProgress(json) {
+    if (json)
+        return undefined;
+    return (event) => {
+        if (event.kind === "copied") {
+            process.stdout.write(chalk.green("  ✓ ") + chalk.dim(event.key) + "\n");
+        }
+        else if (event.kind === "skipped") {
+            process.stdout.write(chalk.dim(`  · ${event.key} (${event.reason})\n`));
+        }
+        else {
+            process.stdout.write(chalk.red(`  ✗ ${event.key}: ${event.error.message}\n`));
+        }
+    };
+}
+async function runMirror(opts) {
+    if (opts.flags.dryRun && !opts.flags.json) {
+        console.log(chalk.yellow(`  (dry run — no objects will be copied)`));
+    }
+    const spinner = opts.flags.json ? null : ora(opts.label).start();
+    spinner?.stop();
+    if (!opts.flags.json)
+        console.log(chalk.bold(`  ${opts.label}`));
+    const result = await opts.run();
+    if (opts.flags.json) {
+        console.log(JSON.stringify({ ok: result.failed === 0, ...result, ...opts.extra }, null, 2));
+    }
+    else {
+        const verb = opts.flags.dryRun ? "would copy" : "copied";
+        console.log(`\n  ${chalk.bold(verb)} ${result.copied} · skipped ${result.skipped} · failed ${result.failed} · ${formatBytes(result.bytes)} · ${(result.durationMs / 1000).toFixed(1)}s`);
+    }
+    return result.failed === 0 ? 0 : 2;
+}
+function parseCommon(rest) {
+    const dirArg = takeFlag(rest, "--dir");
+    const bucketArg = takeFlag(rest, "--bucket") ?? "assets";
+    if (bucketArg !== "assets" && bucketArg !== "state") {
+        throw new Error(`--bucket must be "assets" or "state", got "${bucketArg}"`);
+    }
+    return {
+        projectDir: dirArg ? resolve(dirArg) : resolve("."),
+        bucket: bucketArg,
+        dryRun: rest.includes("--dry-run"),
+        json: rest.includes("--json"),
+    };
+}
+/** Pull `--flag value` (or `--flag=value`) out of rest, removing the
+ *  matched tokens. Mutates `rest` so subsequent calls see a smaller
+ *  argv. Mirrors the pattern used in cli/src/utils/flags.ts. */
+function takeFlag(rest, name) {
+    for (let i = 0; i < rest.length; i++) {
+        const tok = rest[i];
+        if (tok === name) {
+            const v = rest[i + 1];
+            rest.splice(i, 2);
+            return v;
+        }
+        if (tok.startsWith(`${name}=`)) {
+            const v = tok.slice(name.length + 1);
+            rest.splice(i, 1);
+            return v;
+        }
+    }
+    return undefined;
+}
+function printHelp() {
+    console.log(`
+${chalk.bold("hatchkit assets")} — move bytes between local MinIO and prod buckets.
+
+${chalk.bold("Subcommands")}
+
+  ${chalk.cyan("seed")}     [--from <dir>]                Local dir → local MinIO bucket.
+                                            Defaults to ./seed/assets.
+  ${chalk.cyan("push")}     [--bucket assets|state]       Local MinIO → prod bucket.
+  ${chalk.cyan("pull")}     [--bucket assets|state]       Prod bucket → local MinIO.
+                                            Caution: prod data may include PII.
+  ${chalk.cyan("migrate")}  --from-endpoint=URL           External S3 → prod bucket.
+           --from-bucket=NAME                The adoption escape hatch.
+           --from-key=AKIA…                  Creds can also come from
+           --from-secret=…                   HATCHKIT_FROM_ACCESS_KEY_ID +
+           [--from-region=us-east-1]         HATCHKIT_FROM_SECRET_ACCESS_KEY.
+           [--from-prefix=path/]
+  ${chalk.cyan("list")}     [dev|prod] [--bucket assets|state]
+                                            Show what's in a bucket.
+
+${chalk.bold("Common flags")}
+
+  --dir <path>     Project dir (defaults to cwd).
+  --bucket KIND    "assets" (default) or "state".
+  --dry-run        Plan only — list what would be copied.
+  --json           Machine-readable output.
+
+${chalk.bold("Notes")}
+
+  Mirror semantics: copy missing + changed objects. Never deletes from
+  the target. ETag mismatches always re-copy (false positives are
+  wasted bandwidth, not data loss). Streams Get→Put so cross-provider
+  migrations (e.g. AWS → R2) work without server-side copy.
+
+  Reads dev creds from packages/server/.env.development (plaintext) and
+  prod creds from packages/server/.env.production (decrypted via
+  dotenvx + .env.keys). Bucket names come from .hatchkit.json when
+  the env doesn't carry them (R2's URL-driven assets bucket).
+`);
+}
+//# sourceMappingURL=index.js.map

package/dist/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/assets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAA2D,YAAY,EAAE,MAAM,UAAU,CAAC;AACjG,OAAO,EAGL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,MAAM,GACP,MAAM,aAAa,CAAC;AASrB,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,KAAK,SAAS;gBACZ,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACnD,KAAK,MAAM;gBACT,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChD;gBACE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9D,SAAS,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,OAAiB,EAAE,KAAkB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,aAAa,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,4FAA4F,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,SAAS,CAAC;QACf,KAAK,EAAE,UAAU,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,GAAG;QACzD,KAAK;QACL,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE;YAC3D,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;SACnC,CAAC;QACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,SAAS,CAAC;QACf,KAAK,EAAE,6BAA6B,MAAM,CAAC,MAAM,GAAG;QACpD,KAAK;QACL,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC;YACL,MAAM;YACN,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;SACnC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,SAAS,CAAC;QACf,KAAK,EAAE,6BAA6B,MAAM,CAAC,MAAM,GAAG;QACpD,KAAK;QACL,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC;YACL,MAAM;YACN,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;SACnC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAAC,OAAiB,EAAE,KAAkB;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3F,MAAM,UAAU,GACd,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACpF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC;IAChE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAClD,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC;QACjC,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,YAAY,IAAI,cAAc,UAAU,gBAAgB;QAClE,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,OAAiB;QAC9B,eAAe,EAAE,UAAoB;QACrC,cAAc,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC;QACzE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACpE,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,SAAS,CAAC;QACf,KAAK,EAAE,WAAW,UAAU,mBAAmB,MAAM,CAAC,MAAM,GAAG;QAC/D,KAAK;QACL,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC;YACL,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,UAAoB;gBAC5B,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,UAAU;aAClB;YACD,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;SACnC,CAAC;QACJ,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;KACpF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,OAAiB,EAAE,KAAkB;IAC7D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAe,CAAC;IACxF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE;KACxC,CAAC,CAAC,CAAC;IAEJ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW;YAC5B,OAAO;SACR,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,OAAO,OAAO,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,GAAqB,EAAE,IAAgB,EAAE,KAAa;IACtE,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,2BAA2B,KAAK,KAAK,GAAG,CAAC,MAAM,KAAK;YAC7D,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,CAAC,KAAwC,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,SAAS,CAAC,IAAmB;IAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IAEhC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC5K,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC;IACzD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,SAAS,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;gEAEgE;AAChE,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;EACZ,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;;EAE7B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;;IAEvB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;;IAElB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;;IAElB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;;;;;;IAMrB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;;;EAGpB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;;;;;;;EAO1B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;;;;;;;;;;;CAWpB,CAAC,CAAC;AACH,CAAC"}

package/dist/assets/mirror.d.ts

@@ -0,0 +1,59 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import type { ResolvedS3Config } from "./env.js";
+/** Build an SDK client from our normalised config. */
+export declare function buildS3Client(cfg: ResolvedS3Config): S3Client;
+export interface MirrorEndpointS3 {
+    kind: "s3";
+    client: S3Client;
+    bucket: string;
+    /** Optional prefix to scope the source to a sub-tree. */
+    prefix?: string;
+    /** Human-readable label for log output (e.g. "prod", "local"). */
+    label: string;
+}
+export interface MirrorEndpointDir {
+    kind: "dir";
+    /** Local directory; entries are walked recursively. */
+    dir: string;
+    /** Optional prefix to prepend to all uploaded keys. */
+    prefix?: string;
+    label: string;
+}
+export type MirrorSource = MirrorEndpointS3 | MirrorEndpointDir;
+export interface MirrorOptions {
+    source: MirrorSource;
+    target: MirrorEndpointS3;
+    /** When true, list what would be copied but don't transfer. */
+    dryRun?: boolean;
+    /** Max concurrent uploads. Defaults to 8. */
+    concurrency?: number;
+    /** Optional progress callback fired per object. */
+    onObject?: (event: ObjectEvent) => void;
+}
+export type ObjectEvent = {
+    kind: "skipped";
+    key: string;
+    reason: "etag-match" | "size-match";
+} | {
+    kind: "copied";
+    key: string;
+    bytes: number;
+} | {
+    kind: "copy-failed";
+    key: string;
+    error: Error;
+};
+export interface MirrorResult {
+    scanned: number;
+    copied: number;
+    skipped: number;
+    failed: number;
+    bytes: number;
+    durationMs: number;
+}
+export declare function mirror(opts: MirrorOptions): Promise<MirrorResult>;
+/** Verify the target bucket actually exists + is reachable. Surfaces
+ *  a friendlier error than the SDK's stack-traced NoSuchBucket. */
+export declare function ensureBucket(endpoint: MirrorEndpointS3): Promise<void>;
+export declare function formatBytes(n: number): string;
+//# sourceMappingURL=mirror.d.ts.map

package/dist/assets/mirror.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mirror.d.ts","sourceRoot":"","sources":["../../src/assets/mirror.ts"],"names":[],"mappings":"AA2BA,OAAO,EAKL,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,QAAQ,CAW7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,KAAK,CAAC;IACZ,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;CACzC;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD,wBAAsB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAwDvE;AA8HD;mEACmE;AACnE,wBAAsB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa5E;AA4BD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK7C"}