hazo_env 0.1.1 → 0.3.0

package/dist/env.server.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import { HazoConfig } from 'hazo_config/server';
 import { HazoError } from 'hazo_core';
-import { getEnv, getEnvRole } from './index.client.js';
+import { getEnv, getRoleMap as clientGetRoleMap, normalize } from './index.client.js';
 function findConfigFile(pkg) {
     return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
 }
@@ -14,6 +14,28 @@ function tryLoadConfig() {
         return null;
     }
 }
+const VALID_ROLES = new Set(['development', 'test', 'staging', 'production']);
+/**
+ * Get the role map, merging client defaults with any [env.roles] section from hazo_env_config.ini.
+ */
+export function getRoleMap() {
+    const config = tryLoadConfig();
+    const section = config?.getSection?.('env.roles') ?? {};
+    const out = { ...clientGetRoleMap() };
+    for (const [name, role] of Object.entries(section)) {
+        const r = String(role).trim();
+        if (VALID_ROLES.has(r)) {
+            out[name.trim()] = r;
+        }
+        // invalid values: skip silently (doctor will flag them)
+    }
+    return out;
+}
+/** Get the broad role for the current environment (server-aware, reads INI) */
+export function getEnvRole(env) {
+    const e = normalize(env ?? getEnv());
+    return getRoleMap()[e] ?? 'development';
+}
 /**
  * Get the declared env pattern from [env] pattern in hazo_env_config.ini.
  * Falls back to ['dev','test','staging','prod'] if the config is absent.
@@ -57,5 +79,6 @@ export function describeEnv() {
     const dataRoot = config?.getSection('data')?.['root'] ?? 'app_data';
     const locationRaw = config?.getSection(`host.${env}`)?.['location'] ?? 'unknown';
     const hostHint = locationRaw === 'local' ? 'local' : locationRaw === 'remote' ? 'remote' : 'unknown';
-    return { env, role, pattern, app, dataRoot, hostHint };
+    const roles = getRoleMap();
+    return { env, role, pattern, app, dataRoot, hostHint, roles };
 }

package/dist/index.client.d.ts

@@ -1,7 +1,11 @@
-import type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription } from './types/index.js';
-export type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription };
+import type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription, EnvRoleMap } from './types/index.js';
+export type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription, EnvRoleMap };
+/** Normalize raw env string to canonical form */
+export declare function normalize(raw: string): HazoEnv;
 /** Get the current environment name (normalized) */
 export declare function getEnv(): HazoEnv;
+/** Get the role map, merging any build-time injected overrides from __HAZO_ENV_ROLES__ */
+export declare function getRoleMap(): EnvRoleMap;
 /** Get the broad role for the current environment */
 export declare function getEnvRole(env?: HazoEnv): HazoEnvRole;
 export declare function isDev(env?: HazoEnv): boolean;

package/dist/index.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AASjE,oDAAoD;AACpD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAMrD;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA8C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAuC;AACrF,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA0C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA6C;AAE3F;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAMvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,MAAM,CAAC,CAGlE"}
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAE7E,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAI9C;AAED,oDAAoD;AACpD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AASD,0FAA0F;AAC1F,wBAAgB,UAAU,IAAI,UAAU,CAIvC;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAGrD;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA8C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAuC;AACrF,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA0C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA6C;AAE3F;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAMvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,MAAM,CAAC,CAGlE"}

package/dist/index.client.js

@@ -1,7 +1,7 @@
 // hazo_env/src/index.client.ts — Client-safe entry point
 import { getCurrentEnv, HazoError } from 'hazo_core/client';
 /** Normalize raw env string to canonical form */
-function normalize(raw) {
+export function normalize(raw) {
     if (raw === 'development')
         return 'dev';
     if (raw === 'production')
@@ -12,16 +12,22 @@ function normalize(raw) {
 export function getEnv() {
     return normalize(getCurrentEnv());
 }
+const DEFAULT_ROLE_MAP = {
+    dev: 'development',
+    test: 'test',
+    staging: 'staging',
+    prod: 'production',
+};
+/** Get the role map, merging any build-time injected overrides from __HAZO_ENV_ROLES__ */
+export function getRoleMap() {
+    const g = globalThis;
+    const injected = g['__HAZO_ENV_ROLES__'];
+    return { ...DEFAULT_ROLE_MAP, ...(injected ?? {}) };
+}
 /** Get the broad role for the current environment */
 export function getEnvRole(env) {
-    const e = env ?? getEnv();
-    if (e === 'dev')
-        return 'development';
-    if (e === 'test')
-        return 'test';
-    if (e === 'staging')
-        return 'staging';
-    return 'production';
+    const e = normalize(env ?? getEnv());
+    return getRoleMap()[e] ?? 'development';
 }
 export function isDev(env) { return getEnvRole(env) === 'development'; }
 export function isTest(env) { return getEnvRole(env) === 'test'; }

package/dist/index.d.ts

@@ -1,8 +1,17 @@
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 export * from './types/index.js';
 export * from './resolve/secrets.js';
 export * from './resolve/connect.js';
 export * from './resolve/files.js';
 export * from './doctor.js';
+export { runMigration } from './migrate/run.js';
+export { verifyFiles } from './migrate/verify.js';
+export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
+export { registerMask } from './mask/registry.js';
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
+export type { MaskRule } from './mask/ruleset.js';
+export type { MaskTransform } from './types/index.js';
+export * from './lib/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE/E,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,8 +1,8 @@
 // hazo_env/src/index.ts — Server entry point
 // Pure client helpers re-exported explicitly (getPattern/listEnvs/assertEnv/describeEnv are overridden below)
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
 // Server-aware overrides
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 // Types
 export * from './types/index.js';
 // Resolver + secrets
@@ -11,3 +11,14 @@ export * from './resolve/connect.js';
 export * from './resolve/files.js';
 // Doctor
 export * from './doctor.js';
+// Migration engine (Phase 2)
+export { runMigration } from './migrate/run.js';
+export { verifyFiles } from './migrate/verify.js';
+export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
+// Masking registry
+export { registerMask } from './mask/registry.js';
+// Masking ruleset
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
+// Lib
+export * from './lib/index.js';

package/dist/lib/index.d.ts

@@ -1,2 +1,2 @@
-export {};
+export * from './secret_columns.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AACA,cAAc,qBAAqB,CAAC"}

package/dist/lib/index.js

@@ -1 +1,2 @@
-export {};
+// hazo_env/src/lib/index.ts — Core library exports
+export * from './secret_columns.js';

package/dist/lib/secret_columns.d.ts

@@ -0,0 +1,3 @@
+export declare function isSecretColumn(columnName: string): boolean;
+export declare const SECRET_COLUMNS_LIST: string[];
+//# sourceMappingURL=secret_columns.d.ts.map

package/dist/lib/secret_columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret_columns.d.ts","sourceRoot":"","sources":["../../src/lib/secret_columns.ts"],"names":[],"mappings":"AAYA,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,eAAO,MAAM,mBAAmB,UAAsB,CAAC"}

package/dist/lib/secret_columns.js

@@ -0,0 +1,14 @@
+// hazo_env/src/lib/secret_columns.ts — columns that must never be copied as data
+const SECRET_COLUMNS = new Set([
+    'password', 'password_hash', 'hashed_password',
+    'api_key', 'api_secret', 'secret', 'secret_key',
+    'token', 'access_token', 'refresh_token', 'auth_token',
+    'private_key', 'session_token', 'session_secret',
+    'otp_secret', 'totp_secret', 'mfa_secret',
+    'client_secret', 'signing_key', 'encryption_key',
+    'webhook_secret', 'stripe_key', 'twilio_auth_token',
+]);
+export function isSecretColumn(columnName) {
+    return SECRET_COLUMNS.has(columnName.toLowerCase());
+}
+export const SECRET_COLUMNS_LIST = [...SECRET_COLUMNS];

package/dist/mask/registry.d.ts

@@ -0,0 +1,8 @@
+import type { MaskTransform } from '../types/index.js';
+/** Register a custom transform (or override a built-in). */
+export declare function registerMask(name: string, fn: MaskTransform): void;
+/** Get the transform function for a given name. Returns undefined if not registered. */
+export declare function getTransform(name: string): Promise<MaskTransform | undefined>;
+/** List all registered transform names. */
+export declare function listTransforms(): Promise<string[]>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/mask/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/mask/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAiBvD,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,GAAG,IAAI,CAElE;AAED,wFAAwF;AACxF,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAGnF;AAED,2CAA2C;AAC3C,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGxD"}

package/dist/mask/registry.js

@@ -0,0 +1,29 @@
+// hazo_env/src/mask/registry.ts — mask transform registry
+import { optional_import } from 'hazo_core';
+const _registry = new Map();
+let _seeded = false;
+async function ensureSeeded() {
+    if (_seeded)
+        return;
+    _seeded = true;
+    const maskModule = await optional_import('hazo_secure/mask');
+    if (maskModule?.BUILTIN_TRANSFORMS) {
+        for (const [name, fn] of Object.entries(maskModule.BUILTIN_TRANSFORMS)) {
+            _registry.set(name, fn);
+        }
+    }
+}
+/** Register a custom transform (or override a built-in). */
+export function registerMask(name, fn) {
+    _registry.set(name, fn);
+}
+/** Get the transform function for a given name. Returns undefined if not registered. */
+export async function getTransform(name) {
+    await ensureSeeded();
+    return _registry.get(name);
+}
+/** List all registered transform names. */
+export async function listTransforms() {
+    await ensureSeeded();
+    return [..._registry.keys()].sort();
+}

package/dist/mask/ruleset.d.ts

@@ -0,0 +1,15 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+export interface MaskRule {
+    table: string;
+    column: string;
+    transform: string;
+    params?: Record<string, unknown>;
+}
+export declare function ensureAppConfigTable(adapter: HazoConnectAdapter): Promise<void>;
+/** Load rules from hazo_env_masking.ini into hazo_app_config. */
+export declare function syncRulesetFromIni(adapter: HazoConnectAdapter, iniPath?: string): Promise<number>;
+/** Read the effective ruleset from hazo_app_config. */
+export declare function loadRuleset(adapter: HazoConnectAdapter): Promise<MaskRule[]>;
+/** Parse INI-format masking rules. Format: [table_name] / column = transform */
+export declare function parseIniRules(content: string): MaskRule[];
+//# sourceMappingURL=ruleset.d.ts.map

package/dist/mask/ruleset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleset.d.ts","sourceRoot":"","sources":["../../src/mask/ruleset.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AASD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,iEAAiE;AACjE,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,uDAAuD;AACvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAYlF;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAkBzD"}

package/dist/mask/ruleset.js

@@ -0,0 +1,77 @@
+// hazo_env/src/mask/ruleset.ts — ruleset persistence (hazo_app_config)
+import path from 'node:path';
+import fs from 'node:fs';
+const CONFIG_SECTION = 'hazo_env_masking';
+// Ensure hazo_app_config table exists in the given SQLite adapter
+function rawQuery(adapter, sql, params = []) {
+    return adapter.rawQuery(sql, { params });
+}
+export async function ensureAppConfigTable(adapter) {
+    await rawQuery(adapter, `
+    CREATE TABLE IF NOT EXISTS hazo_app_config (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+      config_section TEXT NOT NULL,
+      config_name TEXT NOT NULL,
+      config_value_json TEXT,
+      created_at TEXT DEFAULT (datetime('now')),
+      updated_at TEXT DEFAULT (datetime('now')),
+      UNIQUE(config_section, config_name)
+    )
+  `);
+}
+/** Load rules from hazo_env_masking.ini into hazo_app_config. */
+export async function syncRulesetFromIni(adapter, iniPath) {
+    const resolvedPath = iniPath ?? path.resolve(process.cwd(), 'config', 'hazo_env_masking.ini');
+    if (!fs.existsSync(resolvedPath)) {
+        throw new Error(`hazo_env_masking.ini not found at ${resolvedPath}`);
+    }
+    const content = fs.readFileSync(resolvedPath, 'utf-8');
+    const rules = parseIniRules(content);
+    await ensureAppConfigTable(adapter);
+    let count = 0;
+    for (const rule of rules) {
+        const name = `${rule.table}.${rule.column}`;
+        const valueJson = JSON.stringify({ transform: rule.transform, params: rule.params ?? {} });
+        await rawQuery(adapter, `
+      INSERT INTO hazo_app_config (config_section, config_name, config_value_json)
+      VALUES (?, ?, ?)
+      ON CONFLICT(config_section, config_name) DO UPDATE SET
+        config_value_json = excluded.config_value_json,
+        updated_at = datetime('now')
+    `, [CONFIG_SECTION, name, valueJson]);
+        count++;
+    }
+    return count;
+}
+/** Read the effective ruleset from hazo_app_config. */
+export async function loadRuleset(adapter) {
+    await ensureAppConfigTable(adapter);
+    const rows = await rawQuery(adapter, `SELECT config_name, config_value_json FROM hazo_app_config WHERE config_section = ? ORDER BY config_name`, [CONFIG_SECTION]);
+    return rows.map((row) => {
+        const [table, column] = row.config_name.split('.');
+        const parsed = JSON.parse(row.config_value_json ?? '{}');
+        return { table, column, transform: parsed.transform, params: parsed.params };
+    });
+}
+/** Parse INI-format masking rules. Format: [table_name] / column = transform */
+export function parseIniRules(content) {
+    const rules = [];
+    let currentTable = '';
+    for (const rawLine of content.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith(';') || line.startsWith('#'))
+            continue;
+        if (line.startsWith('[') && line.endsWith(']')) {
+            currentTable = line.slice(1, -1).trim();
+        }
+        else if (currentTable && line.includes('=')) {
+            const eqIdx = line.indexOf('=');
+            const column = line.slice(0, eqIdx).trim();
+            const transform = line.slice(eqIdx + 1).trim();
+            if (column && transform) {
+                rules.push({ table: currentTable, column, transform });
+            }
+        }
+    }
+    return rules;
+}

package/dist/migrate/audit.d.ts

@@ -0,0 +1,21 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+export interface AuditMigrationPayload {
+    from: string;
+    to: string;
+    scrub: string;
+    db?: {
+        tables: number;
+        rows: number;
+        scrubbed: number;
+    };
+    files?: {
+        copied: number;
+        bytes: number;
+    };
+    verify?: {
+        ok: boolean;
+        checked: number;
+    };
+}
+export declare function auditMigration(adapter: HazoConnectAdapter, payload: AuditMigrationPayload): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/migrate/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/migrate/audit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAOD,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/migrate/audit.js

@@ -0,0 +1,36 @@
+// hazo_env/src/migrate/audit.ts — emit audit intent event (wrapped, never fails migration)
+import { optional_import } from 'hazo_core';
+// Cast helper for SQLite rawQuery params extension
+function rawQuery(adapter, sql, params = []) {
+    return adapter.rawQuery(sql, { params });
+}
+export async function auditMigration(adapter, payload) {
+    try {
+        // Ensure hazo_audit_intent table exists (CREATE TABLE IF NOT EXISTS)
+        await rawQuery(adapter, `
+      CREATE TABLE IF NOT EXISTS hazo_audit_intent (
+        id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+        event_name TEXT NOT NULL,
+        payload TEXT,
+        subject_kind TEXT,
+        subject_id TEXT,
+        created_at TEXT DEFAULT (datetime('now'))
+      )
+    `).catch(() => { });
+        const auditModule = await optional_import('hazo_audit/server');
+        if (auditModule?.emitIntentEvent) {
+            await auditModule.emitIntentEvent(adapter, {
+                event_name: 'hazo_env.migration',
+                payload: payload,
+            });
+        }
+        else {
+            // Fallback: insert directly
+            await rawQuery(adapter, `INSERT INTO hazo_audit_intent (event_name, payload, subject_kind) VALUES (?, ?, ?)`, ['hazo_env.migration', JSON.stringify(payload), 'migration']);
+        }
+    }
+    catch (e) {
+        // Audit write failure never fails the migration
+        console.warn('[hazo_env] audit write failed (non-fatal):', e instanceof Error ? e.message : String(e));
+    }
+}

package/dist/migrate/db.d.ts

@@ -0,0 +1,13 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+export interface DbCopyOptions {
+    tables?: '*' | string[];
+    scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
+    onProgress?: (msg: string) => void;
+}
+export interface DbCopyResult {
+    tables: number;
+    rows: number;
+    scrubbed: number;
+}
+export declare function copyDb(srcAdapter: HazoConnectAdapter, tgtAdapter: HazoConnectAdapter, opts?: DbCopyOptions): Promise<DbCopyResult>;
+//# sourceMappingURL=db.d.ts.map

package/dist/migrate/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}

package/dist/migrate/db.js

@@ -0,0 +1,122 @@
+// hazo_env/src/migrate/db.ts — per-table DB copy with schema parity check
+import { HazoError, optional_import } from 'hazo_core';
+import { isSecretColumn } from '../lib/secret_columns.js';
+const PAGE_SIZE = 500;
+// The HazoConnectAdapter interface types rawQuery as (sql, RequestInit?) but the
+// SQLite adapter extends it with { params?: unknown[] }. Cast through unknown to
+// satisfy both the interface type and the runtime expectation.
+function rawQuery(adapter, sql, params = []) {
+    return adapter.rawQuery(sql, { params });
+}
+async function getRawTables(adapter) {
+    const result = await rawQuery(adapter, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name");
+    return result.map((r) => r.name);
+}
+async function getMigrationNames(adapter) {
+    // Check if _migrations table exists
+    const tables = await getRawTables(adapter);
+    if (!tables.includes('_migrations'))
+        return null;
+    const rows = await rawQuery(adapter, 'SELECT name FROM _migrations ORDER BY name');
+    return rows.map((r) => r.name);
+}
+export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
+        });
+    }
+    // Schema parity check via _migrations
+    const srcMigrations = await getMigrationNames(srcAdapter);
+    const tgtMigrations = await getMigrationNames(tgtAdapter);
+    if (srcMigrations === null || tgtMigrations === null) {
+        throw new HazoError({
+            code: 'HAZO_ENV_SCHEMA_MISMATCH',
+            pkg: 'hazo_env',
+            message: `Schema parity check failed: _migrations table is missing on ${srcMigrations === null ? 'source' : 'target'}. Both databases must have matching _migrations tables.`,
+        });
+    }
+    const srcSet = new Set(srcMigrations);
+    const tgtSet = new Set(tgtMigrations);
+    const missingInTgt = [...srcSet].filter((n) => !tgtSet.has(n));
+    const missingInSrc = [...tgtSet].filter((n) => !srcSet.has(n));
+    if (missingInTgt.length > 0 || missingInSrc.length > 0) {
+        throw new HazoError({
+            code: 'HAZO_ENV_SCHEMA_MISMATCH',
+            pkg: 'hazo_env',
+            message: `Schema parity check failed: migration name-sets differ.\n  Missing in target: ${missingInTgt.join(', ') || 'none'}\n  Missing in source: ${missingInSrc.join(', ') || 'none'}`,
+        });
+    }
+    // Get tables to copy
+    const allTables = await getRawTables(srcAdapter);
+    // Exclude system/internal tables
+    const SKIP = new Set(['_migrations', 'sqlite_sequence', 'hazo_audit_events', 'hazo_audit_intent']);
+    let tablesToCopy = allTables.filter((t) => !SKIP.has(t));
+    if (opts.tables && opts.tables !== '*') {
+        tablesToCopy = tablesToCopy.filter((t) => opts.tables.includes(t));
+    }
+    let totalRows = 0;
+    let totalScrubbed = 0;
+    for (const table of tablesToCopy) {
+        opts.onProgress?.(`Copying table: ${table}`);
+        // Delete all rows in target
+        await rawQuery(tgtAdapter, `DELETE FROM "${table}"`);
+        // Get schema to find PK column and all columns
+        const schema = await rawQuery(srcAdapter, `PRAGMA table_info("${table}")`);
+        const pkCol = schema.find((c) => c.pk === 1)?.name ?? 'id';
+        const allCols = schema.map((c) => c.name);
+        // Page through source
+        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
+        let offset = 0;
+        let pageRows = [];
+        do {
+            pageRows = await srcService.list((qb) => qb.order(pkCol, 'asc').limit(PAGE_SIZE).offset(offset));
+            if (pageRows.length === 0)
+                break;
+            for (let row of pageRows) {
+                // Drop secret columns
+                const cleaned = {};
+                let didScrub = false;
+                for (const col of allCols) {
+                    if (isSecretColumn(col)) {
+                        didScrub = true;
+                    }
+                    else {
+                        cleaned[col] = row[col];
+                    }
+                }
+                // Apply scrub hook if provided (masking, Phase B)
+                if (opts.scrubHook) {
+                    const hooked = opts.scrubHook(table, cleaned);
+                    if (hooked !== cleaned)
+                        didScrub = true;
+                    row = hooked;
+                }
+                else {
+                    row = cleaned;
+                }
+                if (didScrub)
+                    totalScrubbed++;
+                // Only insert columns that exist in schema
+                const insertRow = {};
+                for (const col of Object.keys(row)) {
+                    if (allCols.includes(col))
+                        insertRow[col] = row[col];
+                }
+                // Use raw INSERT to preserve PKs
+                const cols = Object.keys(insertRow);
+                if (cols.length === 0)
+                    continue;
+                const placeholders = cols.map(() => '?').join(', ');
+                const values = cols.map((c) => insertRow[c]);
+                await rawQuery(tgtAdapter, `INSERT OR REPLACE INTO "${table}" (${cols.map((c) => `"${c}"`).join(', ')}) VALUES (${placeholders})`, values);
+                totalRows++;
+            }
+            offset += PAGE_SIZE;
+        } while (pageRows.length === PAGE_SIZE);
+    }
+    return { tables: tablesToCopy.length, rows: totalRows, scrubbed: totalScrubbed };
+}

package/dist/migrate/files.d.ts

@@ -0,0 +1,14 @@
+import type { HazoEnv } from '../types/index.js';
+export interface FilesCopyOptions {
+    fromEnv: HazoEnv;
+    toEnv: HazoEnv;
+    fileScrubHook?: (filePath: string) => Promise<void>;
+    onProgress?: (msg: string) => void;
+}
+export interface FilesCopyResult {
+    copied: number;
+    bytes: number;
+    placeholdered: number;
+}
+export declare function copyFiles(opts: FilesCopyOptions): Promise<FilesCopyResult>;
+//# sourceMappingURL=files.d.ts.map

package/dist/migrate/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA4BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}

package/dist/migrate/files.js

@@ -0,0 +1,72 @@
+// hazo_env/src/migrate/files.ts — local file-tree copy with PDF scrubbing (Phase C)
+//
+// PDF scrubbing via hazo_pdf/server (optional peer dep). When HAZO_ENV_MASK_KEY
+// is set and a copied file has a .pdf extension, mask_pdf is called with an
+// empty targets list (structure-only scrub / reserved for future target lists).
+// Failures are non-fatal warnings — the file copy still completes.
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveFilesConfig } from '../resolve/files.js';
+function resolveEnvFilesRoot(env) {
+    // resolveFilesConfig returns the data root; env-specific files are at <root>/<env>/files
+    const base = resolveFilesConfig().local.basePath;
+    return path.join(base, env, 'files');
+}
+/**
+ * Attempt to scrub a PDF file in-place using hazo_pdf/mask_pdf.
+ * Non-fatal: any failure is silently swallowed — the copy always completes.
+ * Called only when HAZO_ENV_MASK_KEY is set.
+ */
+async function scrubPdfFile(filePath) {
+    try {
+        const pdfMod = await import('hazo_pdf/server').catch(() => null);
+        if (!pdfMod?.mask_pdf)
+            return; // hazo_pdf not installed or mask_pdf not exported
+        const { readFileSync, writeFileSync } = await import('node:fs');
+        const bytes = readFileSync(filePath);
+        const scrubbed = await pdfMod.mask_pdf(new Uint8Array(bytes), []);
+        writeFileSync(filePath, Buffer.from(scrubbed));
+    }
+    catch {
+        // Non-fatal — PDF scrubbing failure is a warning, not an abort
+    }
+}
+export async function copyFiles(opts) {
+    const srcRoot = resolveEnvFilesRoot(opts.fromEnv);
+    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
+    if (!fs.existsSync(srcRoot)) {
+        opts.onProgress?.(`No files directory at ${srcRoot} — skipping file copy`);
+        return { copied: 0, bytes: 0, placeholdered: 0 };
+    }
+    fs.mkdirSync(tgtRoot, { recursive: true });
+    let copied = 0;
+    let bytes = 0;
+    async function copyDir(src, tgt) {
+        const entries = fs.readdirSync(src, { withFileTypes: true });
+        for (const entry of entries) {
+            const srcPath = path.join(src, entry.name);
+            const tgtPath = path.join(tgt, entry.name);
+            if (entry.isDirectory()) {
+                fs.mkdirSync(tgtPath, { recursive: true });
+                await copyDir(srcPath, tgtPath);
+            }
+            else {
+                fs.copyFileSync(srcPath, tgtPath);
+                const stat = fs.statSync(srcPath);
+                bytes += stat.size;
+                copied++;
+                opts.onProgress?.(`Copied: ${entry.name}`);
+                // Phase C: PDF scrubbing when HAZO_ENV_MASK_KEY is set
+                if (entry.name.toLowerCase().endsWith('.pdf') && process.env['HAZO_ENV_MASK_KEY']) {
+                    await scrubPdfFile(tgtPath);
+                }
+                // Legacy sync hook (still supported for callers that pass one)
+                if (opts.fileScrubHook) {
+                    await opts.fileScrubHook(tgtPath);
+                }
+            }
+        }
+    }
+    await copyDir(srcRoot, tgtRoot);
+    return { copied, bytes, placeholdered: 0 };
+}