hazo_env 0.1.1

package/CHANGE_LOG.md

@@ -0,0 +1,22 @@
+# hazo_env — Change Log
+
+## 0.1.1 — 2026-06-09
+
+- fix: provision `sql-wasm.wasm` into test-app `public/` via seed script (fixes Connect page error when SQLite adapter loads via sql.js WASM)
+- fix: test-app `tsconfig.json` jsx mode corrected to `react-jsx`
+- chore: add test-app `.gitignore` for generated artifacts (`data/`, `public/sql-wasm.wasm`, `logs/`, `.next/`)
+- docs: fill in README.md and SETUP_CHECKLIST.md with M1 API, quick-start, and config reference
+
+## 0.1.0 — 2026-06-08
+
+Initial release — M1 Core.
+
+- Env resolution: `getEnv`, `getEnvRole`, `getPattern`, `listEnvs`, `assertEnv`, `describeEnv`, `isDev`/`isTest`/`isStaging`/`isProd`
+- Client-safe subset re-exported from `hazo_env/client`
+- `resolveConnectConfig()` — maps current env to hazo_connect config (SQLite / PostgREST) via `hazo_env_config.ini`
+- `resolveFilesConfig()` — maps current env to hazo_files config (data_root)
+- `getSecret()` / `substitutePlaceholders()` — resolves secrets from `.env.local` only
+- `doctor()` — validates pattern, DB reachability, secrets present, data_root writable, schema level
+- `hazo-env` CLI: `current`, `doctor`, `snapshot` (stub)
+- Test-app with sidebar, dev pages (Resolution, Connect, Files), autotest harness, seeded SQLite
+- Unit tests via `hazo_testing`

package/README.md

@@ -0,0 +1,132 @@
+# hazo_env
+
+Canonical environment resolver for hazo apps. Typed env names, per-env DB/file/secret config, a `doctor` diagnostic command, and a `hazo-env` CLI.
+
+## What it does
+
+- **Env resolution** — typed `HazoEnv` (`dev | test | staging | prod`), role mapping, pattern declaration, and `assertEnv()` to fail fast at boot if `HAZO_ENV` is invalid.
+- **Per-env DB config** — `resolveConnectConfig()` maps the current env to its `hazo_connect` config (SQLite or PostgREST) with zero hardcoded connection strings in app code.
+- **Per-env file config** — `resolveFilesConfig()` maps the current env to a `hazo_files` config rooted at the declared `data_root`.
+- **Secrets** — `getSecret()` resolves from `.env.local` only; placeholders in `hazo_env_config.ini` are substituted at runtime without storing secrets.
+- **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, and schema level.
+- **CLI** — `hazo-env current | doctor | snapshot`.
+
+## Installation
+
+```bash
+npm install hazo_env
+```
+
+Peer deps (required): `hazo_core`, `hazo_config`.
+Peer deps (optional): `hazo_connect` (for `resolveConnectConfig`), `hazo_files` (for `resolveFilesConfig`).
+
+## Quick start
+
+### 1. Create `hazo_env_config.ini` (copy from `config/hazo_env_config.ini.sample`)
+
+```ini
+[env]
+pattern = dev, prod
+app     = myapp
+
+[db.dev]
+type          = sqlite
+database_path = ${DATA_ROOT}/dev.sqlite
+
+[db.prod]
+type    = postgrest
+base_url = ${POSTGREST_PROD_URL}
+api_key  = ${POSTGREST_API_KEY}
+```
+
+### 2. Create `.env.local` (gitignored, one per deployment)
+
+```
+POSTGREST_PROD_URL=https://db.myapp.com
+POSTGREST_API_KEY=...
+```
+
+### 3. Boot
+
+```ts
+import { assertEnv } from 'hazo_env';
+import { resolveConnectConfig } from 'hazo_env';
+import { createHazoConnect } from 'hazo_connect';
+
+assertEnv();                                           // throws if HAZO_ENV not in pattern
+const adapter = await createHazoConnect(resolveConnectConfig());
+```
+
+## API
+
+### Env resolution (client-safe — also in `hazo_env/client`)
+
+```ts
+import { getEnv, getEnvRole, getPattern, listEnvs, assertEnv, describeEnv,
+         isDev, isTest, isStaging, isProd } from 'hazo_env';
+
+getEnv()        // 'dev' | 'test' | 'staging' | 'prod'
+getEnvRole()    // 'development' | 'testing' | 'staging' | 'production'
+getPattern()    // e.g. 'dev_prod'
+listEnvs()      // ['dev', 'prod'] — valid envs for the declared pattern
+assertEnv()     // throws HazoError(ENV_INVALID) if HAZO_ENV is outside the pattern
+describeEnv()   // { env, role }
+isDev() / isTest() / isStaging() / isProd()
+```
+
+### Resolvers (server-only)
+
+```ts
+import { resolveConnectConfig } from 'hazo_env';
+import { resolveFilesConfig }   from 'hazo_env';
+import { getSecret }            from 'hazo_env';
+
+// Returns the hazo_connect config for the current env
+resolveConnectConfig()
+
+// Returns the hazo_files config for the current env (base_path from data_root)
+resolveFilesConfig()
+
+// Read a value from .env.local — throws HazoError(SECRET_MISSING) when required + absent
+getSecret('POSTGREST_API_KEY', { required: true })
+```
+
+### Doctor
+
+```ts
+import { doctor } from 'hazo_env';
+
+const report = await doctor();
+// report.ok        boolean
+// report.checks    DoctorCheck[] — { label, ok, message }
+```
+
+## CLI
+
+```
+hazo-env current                       # prints env, role, pattern, app, data_root
+hazo-env doctor [--env <e>] [--all]    # red/green validation table
+hazo-env snapshot <env>                # placeholder — full impl arrives in M2
+```
+
+## Config reference (`hazo_env_config.ini`)
+
+See `config/hazo_env_config.ini.sample` for the full annotated template.
+
+Key sections:
+- `[env]` — `pattern` (comma-separated env names), `app` (app identifier)
+- `[data]` — `root` (data_root; default `app_data`)
+- `[db.<env>]` — `type` (`sqlite` | `postgrest`), `database_path` / `base_url` / `api_key`
+- `[host.<env>]` — `location` (`local` | `remote`)
+
+Secret placeholders use `${ENV_VAR_NAME}` syntax — hazo_env substitutes them from `.env.local` at runtime.
+
+## Tailwind v4 (`@source` required if consuming UI)
+
+```css
+@source "../node_modules/hazo_env/dist";
+```
+
+## License
+
+MIT

package/SETUP_CHECKLIST.md

@@ -0,0 +1,92 @@
+# hazo_env — Setup Checklist
+
+Follow these steps when adding `hazo_env` to a consuming application.
+
+## 1. Install
+
+```bash
+npm install hazo_env hazo_core hazo_config
+# optional — only if you use resolveConnectConfig / resolveFilesConfig:
+npm install hazo_connect hazo_files
+```
+
+## 2. Create `hazo_env_config.ini`
+
+Copy `node_modules/hazo_env/config/hazo_env_config.ini.sample` to your app's config directory and fill in the values for each env:
+
+```ini
+[env]
+pattern = dev, prod   ; or: dev, test, prod / dev, test, staging, prod
+app     = myapp
+
+[db.dev]
+type          = sqlite
+database_path = ${DATA_ROOT}/dev.sqlite
+
+[db.prod]
+type     = postgrest
+base_url = ${POSTGREST_PROD_URL}
+api_key  = ${POSTGREST_API_KEY}
+```
+
+**Never put secret values directly in the ini file** — use `${ENV_VAR_NAME}` placeholders.
+
+## 3. Create `.env.local` (gitignored)
+
+One file per deployment (dev machine, staging host, prod host). Contains the secrets referenced by `${…}` placeholders in the ini:
+
+```
+POSTGREST_PROD_URL=https://db.myapp.com
+POSTGREST_API_KEY=...
+```
+
+Add `.env.local` to `.gitignore`.
+
+## 4. Set `HAZO_ENV` in each deployment
+
+Each deployment must have `HAZO_ENV` set to one of the values in `[env].pattern`:
+
+- Local dev: `HAZO_ENV=dev` in `.env.local` or your shell profile
+- Staging/prod: set in the process environment or platform config
+
+## 5. Call `assertEnv()` at boot
+
+```ts
+import { assertEnv } from 'hazo_env';
+
+assertEnv();   // throws if HAZO_ENV is missing or not in the declared pattern
+```
+
+Add this as the first call in your app's startup (e.g. `instrumentation.ts` in Next.js).
+
+## 6. Replace hardcoded DB/file config with resolvers
+
+```ts
+import { resolveConnectConfig } from 'hazo_env';
+import { resolveFilesConfig }   from 'hazo_env';
+import { createHazoConnect }    from 'hazo_connect';
+
+const adapter = await createHazoConnect(resolveConnectConfig());
+// resolveFilesConfig() → pass to createInitializedTrackedFileManager()
+```
+
+## 7. Run `hazo-env doctor` to verify
+
+```bash
+npx hazo-env doctor
+```
+
+All checks should be green before going to production. The doctor validates:
+- `HAZO_ENV` is in the declared pattern
+- DB config for the current env is readable and reachable
+- All required secrets are present in `.env.local` (values are never printed)
+- `data_root` exists and is writable
+
+## 8. (Next.js) Ensure `hazo_env` is in `transpilePackages`
+
+```js
+// next.config.js
+const nextConfig = {
+  transpilePackages: ['hazo_env', 'hazo_core', /* … */],
+};
+```

package/config/hazo_env_config.ini.sample

@@ -0,0 +1,48 @@
+; hazo_env configuration sample
+; Copy to hazo_env_config.ini and fill in values.
+; Secret values should use ${ENV_VAR_NAME} placeholders, not literal values.
+
+[env]
+; Declare the valid environment names for this app (comma-separated)
+; Standard values: dev, test, staging, prod
+pattern = dev, test, staging, prod
+
+; Application name (used in log output and doctor reports)
+app = myapp
+
+[data]
+; Base directory for all local file storage (relative to app root or absolute)
+; Default: app_data
+root = app_data
+
+[db.dev]
+; SQLite database for local development
+type = sqlite
+database_path = ${DATA_ROOT}/dev.sqlite
+
+[db.test]
+; SQLite database for automated tests
+type = sqlite
+database_path = ${DATA_ROOT}/test.sqlite
+
+[db.staging]
+; PostgREST connection for staging environment
+type = postgrest
+base_url = ${POSTGREST_STAGING_URL}
+api_key = ${POSTGREST_STAGING_API_KEY}
+
+[db.prod]
+; PostgREST connection for production environment
+type = postgrest
+base_url = ${POSTGREST_PROD_URL}
+api_key = ${POSTGREST_API_KEY}
+
+[host.dev]
+; Hint about where the dev environment runs (local/remote)
+location = local
+
+[host.staging]
+location = remote
+
+[host.prod]
+location = remote

package/config/hazo_env_masking.ini.sample

@@ -0,0 +1,19 @@
+; hazo_env masking ruleset sample
+; Copy to hazo_env_masking.ini and customize.
+; This file seeds the masking engine with default rules for PII fields.
+; The runtime source of truth (once hazo_admin is available) is the DB-backed ruleset.
+
+[rule.users_email]
+table   = hazo_auth_users
+column  = email
+strategy = mask_email
+
+[rule.users_name]
+table   = hazo_auth_users
+column  = full_name
+strategy = fake_name
+
+[rule.api_keys]
+table   = hazo_api_keys
+column  = key_hash
+strategy = drop

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// hazo_env/src/cli.ts — CLI entry: hazo-env current | doctor | snapshot
+import pc from 'picocolors';
+import { getEnv, getEnvRole } from './index.client.js';
+import { describeEnv } from './env.server.js';
+import { doctor } from './doctor.js';
+const [, , command, ...args] = process.argv;
+function statusIcon(status) {
+    if (status === 'ok')
+        return pc.green('✓');
+    if (status === 'warn')
+        return pc.yellow('⚠');
+    return pc.red('✗');
+}
+async function runCurrent() {
+    let desc;
+    try {
+        desc = describeEnv();
+    }
+    catch {
+        // Fallback if no config file
+        const env = getEnv();
+        desc = { env, role: getEnvRole(env), pattern: ['dev', 'test', 'staging', 'prod'], app: '', dataRoot: '(config not found)', hostHint: 'unknown' };
+    }
+    console.log(`\n${pc.bold('hazo-env current')}\n`);
+    console.log(`  env:       ${pc.bold(desc.env)}`);
+    console.log(`  role:      ${desc.role}`);
+    console.log(`  pattern:   ${desc.pattern.join(', ')}`);
+    if (desc.app)
+        console.log(`  app:       ${desc.app}`);
+    console.log(`  data root: ${desc.dataRoot}`);
+    console.log(`  host hint: ${desc.hostHint}`);
+    console.log('');
+}
+async function runDoctor() {
+    const all = args.includes('--all');
+    const probe = args.includes('--probe');
+    // --env <e> (space-separated; also support --env=<e> for convenience)
+    const envFlagIdx = args.findIndex((a) => a === '--env');
+    const envFlag = envFlagIdx >= 0 ? args[envFlagIdx + 1]
+        : args.find((a) => a.startsWith('--env='))?.split('=')[1];
+    console.log(`\n${pc.bold('hazo-env doctor')}\n`);
+    const report = await doctor({ env: envFlag, all, probe });
+    console.log(`  Checking env: ${pc.bold(report.env)}${all ? ' (all envs)' : ''}\n`);
+    const labelWidth = Math.max(...report.checks.map((c) => c.label.length)) + 2;
+    for (const check of report.checks) {
+        const icon = statusIcon(check.status);
+        const label = check.label.padEnd(labelWidth);
+        const detail = check.detail ? `  ${check.detail}` : '';
+        console.log(`  ${icon} ${label}${detail}`);
+    }
+    console.log('');
+    if (report.passed) {
+        console.log(`  ${pc.green('All checks passed.')}\n`);
+    }
+    else {
+        console.log(`  ${pc.red('Some checks failed. Review the errors above.')}\n`);
+        process.exit(1);
+    }
+}
+async function runSnapshot() {
+    const targetEnv = args[0] ?? getEnv();
+    console.log(`\n${pc.yellow('snapshot')} — not implemented until Phase 2 (migration engine)\n`);
+    console.log(`  Requested snapshot of env: ${pc.bold(targetEnv)}`);
+    console.log(`  Run "hazo-env snapshot" again after the migration engine is built.\n`);
+    process.exit(1);
+}
+function printHelp() {
+    console.log(`
+${pc.bold('hazo-env')} — environment resolver CLI
+
+Usage:
+  hazo-env current                          Show current env, role, pattern, and data root
+  hazo-env doctor                           Run health checks for the current environment
+  hazo-env doctor --all                     Run health checks for all declared environments
+  hazo-env doctor --env <env>               Run health checks for a specific environment
+  hazo-env doctor --probe                   Also probe live DB reachability
+  hazo-env snapshot <env>                   (Phase 2 — not yet implemented)
+`);
+}
+(async () => {
+    try {
+        if (command === 'current') {
+            await runCurrent();
+        }
+        else if (command === 'doctor') {
+            await runDoctor();
+        }
+        else if (command === 'snapshot') {
+            await runSnapshot();
+        }
+        else {
+            printHelp();
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`\n${pc.red('Error:')} ${msg}\n`);
+        process.exit(1);
+    }
+})();

package/dist/doctor.d.ts

@@ -0,0 +1,23 @@
+export interface DoctorCheck {
+    label: string;
+    status: 'ok' | 'warn' | 'error';
+    detail?: string;
+}
+export interface DoctorReport {
+    env: string;
+    checks: DoctorCheck[];
+    passed: boolean;
+}
+export interface DoctorOptions {
+    env?: string;
+    /** Run checks for all envs in the pattern, not just the current one */
+    all?: boolean;
+    /** Run live reachability probes (sqlite open / postgrest ping) */
+    probe?: boolean;
+}
+/**
+ * Run environment health checks.
+ * Never prints secret values.
+ */
+export declare function doctor(opts?: DoctorOptions): Promise<DoctorReport>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA+I5E"}

package/dist/doctor.js

@@ -0,0 +1,158 @@
+// hazo_env/src/doctor.ts — Environment health checker
+import fs from 'node:fs';
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { optional_import } from 'hazo_core';
+import { getEnv } from './index.client.js';
+import { listEnvs } from './env.server.js';
+import { resolveConnectConfig } from './resolve/connect.js';
+import { resolveFilesConfig } from './resolve/files.js';
+function findConfigFile(pkg) {
+    return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
+}
+/**
+ * Run environment health checks.
+ * Never prints secret values.
+ */
+export async function doctor(opts = {}) {
+    const currentEnv = getEnv();
+    const targetEnv = opts.env ?? currentEnv;
+    const checks = [];
+    // 1. Check config file exists
+    const configPath = findConfigFile('hazo_env');
+    if (!fs.existsSync(configPath)) {
+        checks.push({
+            label: 'Config file (hazo_env_config.ini)',
+            status: 'error',
+            detail: `Not found at ${configPath}`,
+        });
+        return { env: targetEnv, checks, passed: false };
+    }
+    checks.push({ label: 'Config file (hazo_env_config.ini)', status: 'ok', detail: configPath });
+    // 2. Parse config file
+    let config;
+    try {
+        config = new HazoConfig({ filePath: configPath });
+    }
+    catch (e) {
+        checks.push({ label: 'Config file parse', status: 'error', detail: String(e) });
+        return { env: targetEnv, checks, passed: false };
+    }
+    // 3. Check env pattern declaration
+    const patternRaw = config.getSection('env')?.['"pattern"'] ??
+        config.getSection('env')?.['pattern'] ??
+        '';
+    const declaredPattern = patternRaw
+        ? patternRaw.split(',').map((s) => s.trim()).filter(Boolean)
+        : listEnvs();
+    if (patternRaw.length === 0) {
+        checks.push({
+            label: 'Env pattern ([env] pattern)',
+            status: 'warn',
+            detail: 'Not declared — using defaults',
+        });
+    }
+    else {
+        checks.push({
+            label: 'Env pattern ([env] pattern)',
+            status: 'ok',
+            detail: declaredPattern.join(', '),
+        });
+    }
+    // 4. Check DB config sections for the target env(s)
+    const envsToCheck = opts.all ? declaredPattern : [targetEnv];
+    for (const env of envsToCheck) {
+        try {
+            resolveConnectConfig({ env, allowOtherEnv: true });
+            checks.push({ label: `DB config [db.${env}]`, status: 'ok' });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            const isMissingSecret = msg.includes('SECRET_MISSING') || msg.includes('is not set') || msg.includes('Placeholder');
+            checks.push({
+                label: `DB config [db.${env}]`,
+                status: isMissingSecret ? 'warn' : 'error',
+                detail: isMissingSecret
+                    ? `Secret placeholder unresolved (set in .env.local)`
+                    : msg,
+            });
+        }
+    }
+    // 5. Check data root exists and is writable
+    try {
+        const filesConfig = resolveFilesConfig();
+        const dataRoot = filesConfig.local.basePath;
+        if (!fs.existsSync(dataRoot)) {
+            checks.push({
+                label: 'Data root',
+                status: 'warn',
+                detail: `${dataRoot} does not exist (will be created on first use)`,
+            });
+        }
+        else {
+            try {
+                fs.accessSync(dataRoot, fs.constants.W_OK);
+                checks.push({ label: 'Data root', status: 'ok', detail: dataRoot });
+            }
+            catch {
+                checks.push({ label: 'Data root', status: 'error', detail: `${dataRoot} is not writable` });
+            }
+        }
+    }
+    catch (e) {
+        checks.push({
+            label: 'Data root',
+            status: 'warn',
+            detail: `Could not resolve: ${e instanceof Error ? e.message : String(e)}`,
+        });
+    }
+    // 5b. Optional probe: actually open the DB
+    if (opts.probe) {
+        for (const env of envsToCheck) {
+            // Get role for this env to guard against touching prod unattended
+            const role = env === 'dev' ? 'development' : env === 'test' ? 'test'
+                : env === 'staging' ? 'staging' : 'production';
+            if (role === 'production' && !opts.all) {
+                checks.push({
+                    label: `DB probe [db.${env}]`,
+                    status: 'warn',
+                    detail: 'Refusing to probe a prod target without --all. Pass all:true to override.',
+                });
+                continue;
+            }
+            let cfg;
+            try {
+                cfg = resolveConnectConfig({ env, allowOtherEnv: true });
+            }
+            catch {
+                continue; // already reported as error above
+            }
+            if (cfg.type === 'sqlite' && cfg.sqlite) {
+                const hazoConnect = await optional_import('hazo_connect');
+                if (!hazoConnect) {
+                    checks.push({
+                        label: `DB probe [db.${env}]`,
+                        status: 'warn',
+                        detail: 'install hazo_connect to enable probing',
+                    });
+                }
+                else {
+                    try {
+                        const conn = hazoConnect.createHazoConnect({ type: 'sqlite', sqlite: cfg.sqlite });
+                        await conn.query('SELECT 1');
+                        checks.push({ label: `DB probe [db.${env}]`, status: 'ok', detail: cfg.sqlite.database_path });
+                    }
+                    catch (e) {
+                        checks.push({
+                            label: `DB probe [db.${env}]`,
+                            status: 'error',
+                            detail: e instanceof Error ? e.message : String(e),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    const passed = checks.every((c) => c.status !== 'error');
+    return { env: targetEnv, checks, passed };
+}

package/dist/env.server.d.ts

@@ -0,0 +1,19 @@
+import type { EnvPattern, EnvDescription } from './types/index.js';
+/**
+ * Get the declared env pattern from [env] pattern in hazo_env_config.ini.
+ * Falls back to ['dev','test','staging','prod'] if the config is absent.
+ */
+export declare function getPattern(): EnvPattern;
+/** List all valid environment names per the declared pattern */
+export declare function listEnvs(): EnvPattern;
+/**
+ * Assert that the current env is in the declared pattern.
+ * Throws HazoError(ENV_INVALID) if not.
+ */
+export declare function assertEnv(pattern?: EnvPattern): void;
+/**
+ * Describe the current environment (server-aware full version).
+ * Reads app, dataRoot, hostHint from hazo_env_config.ini.
+ */
+export declare function describeEnv(): EnvDescription;
+//# sourceMappingURL=env.server.d.ts.map

package/dist/env.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.server.d.ts","sourceRoot":"","sources":["../src/env.server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAY,MAAM,kBAAkB,CAAC;AAc7E;;;GAGG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAKvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,cAAc,CAW5C"}

package/dist/env.server.js

@@ -0,0 +1,61 @@
+// hazo_env/src/env.server.ts — Server-aware env resolution (reads hazo_env_config.ini)
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { HazoError } from 'hazo_core';
+import { getEnv, getEnvRole } from './index.client.js';
+function findConfigFile(pkg) {
+    return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
+}
+function tryLoadConfig() {
+    try {
+        return new HazoConfig({ filePath: findConfigFile('hazo_env') });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get the declared env pattern from [env] pattern in hazo_env_config.ini.
+ * Falls back to ['dev','test','staging','prod'] if the config is absent.
+ */
+export function getPattern() {
+    const config = tryLoadConfig();
+    const patternRaw = config?.getSection('env')?.['pattern'];
+    if (!patternRaw)
+        return ['dev', 'test', 'staging', 'prod'];
+    return patternRaw.split(',').map((s) => s.trim()).filter(Boolean);
+}
+/** List all valid environment names per the declared pattern */
+export function listEnvs() {
+    return getPattern();
+}
+/**
+ * Assert that the current env is in the declared pattern.
+ * Throws HazoError(ENV_INVALID) if not.
+ */
+export function assertEnv(pattern) {
+    const env = getEnv();
+    const validEnvs = pattern ?? getPattern();
+    if (!validEnvs.includes(env)) {
+        throw new HazoError({
+            code: 'ENV_INVALID',
+            pkg: 'hazo_env',
+            message: `Current env "${env}" is not in declared pattern [${validEnvs.join(', ')}]`,
+        });
+    }
+}
+/**
+ * Describe the current environment (server-aware full version).
+ * Reads app, dataRoot, hostHint from hazo_env_config.ini.
+ */
+export function describeEnv() {
+    const env = getEnv();
+    const role = getEnvRole(env);
+    const config = tryLoadConfig();
+    const pattern = getPattern();
+    const app = config?.getSection('env')?.['app'] ?? '';
+    const dataRoot = config?.getSection('data')?.['root'] ?? 'app_data';
+    const locationRaw = config?.getSection(`host.${env}`)?.['location'] ?? 'unknown';
+    const hostHint = locationRaw === 'local' ? 'local' : locationRaw === 'remote' ? 'remote' : 'unknown';
+    return { env, role, pattern, app, dataRoot, hostHint };
+}

package/dist/index.client.d.ts

@@ -0,0 +1,26 @@
+import type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription } from './types/index.js';
+export type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription };
+/** Get the current environment name (normalized) */
+export declare function getEnv(): HazoEnv;
+/** Get the broad role for the current environment */
+export declare function getEnvRole(env?: HazoEnv): HazoEnvRole;
+export declare function isDev(env?: HazoEnv): boolean;
+export declare function isTest(env?: HazoEnv): boolean;
+export declare function isStaging(env?: HazoEnv): boolean;
+export declare function isProd(env?: HazoEnv): boolean;
+/**
+ * Get the declared env pattern (list of valid env names).
+ * On the client this is read from a build-time injected global or returns a default.
+ * The server-side index.ts provides a richer version that reads the INI.
+ */
+export declare function getPattern(): EnvPattern;
+/** List all valid environment names per the declared pattern */
+export declare function listEnvs(): EnvPattern;
+/**
+ * Assert that the current env is in the declared pattern.
+ * Throws HazoError(ENV_INVALID) if not.
+ */
+export declare function assertEnv(pattern?: EnvPattern): void;
+/** Describe the current environment (client-safe subset) */
+export declare function describeEnv(): Pick<EnvDescription, 'env' | 'role'>;
+//# sourceMappingURL=index.client.d.ts.map

package/dist/index.client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AASjE,oDAAoD;AACpD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAMrD;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA8C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAuC;AACrF,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA0C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA6C;AAE3F;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAMvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,MAAM,CAAC,CAGlE"}

package/dist/index.client.js

@@ -0,0 +1,65 @@
+// hazo_env/src/index.client.ts — Client-safe entry point
+import { getCurrentEnv, HazoError } from 'hazo_core/client';
+/** Normalize raw env string to canonical form */
+function normalize(raw) {
+    if (raw === 'development')
+        return 'dev';
+    if (raw === 'production')
+        return 'prod';
+    return raw;
+}
+/** Get the current environment name (normalized) */
+export function getEnv() {
+    return normalize(getCurrentEnv());
+}
+/** Get the broad role for the current environment */
+export function getEnvRole(env) {
+    const e = env ?? getEnv();
+    if (e === 'dev')
+        return 'development';
+    if (e === 'test')
+        return 'test';
+    if (e === 'staging')
+        return 'staging';
+    return 'production';
+}
+export function isDev(env) { return getEnvRole(env) === 'development'; }
+export function isTest(env) { return getEnvRole(env) === 'test'; }
+export function isStaging(env) { return getEnvRole(env) === 'staging'; }
+export function isProd(env) { return getEnvRole(env) === 'production'; }
+/**
+ * Get the declared env pattern (list of valid env names).
+ * On the client this is read from a build-time injected global or returns a default.
+ * The server-side index.ts provides a richer version that reads the INI.
+ */
+export function getPattern() {
+    // Client-side: read from window.__HAZO_ENV_PATTERN__ if injected, else default
+    if (typeof globalThis !== 'undefined' && globalThis.__HAZO_ENV_PATTERN__) {
+        return globalThis.__HAZO_ENV_PATTERN__;
+    }
+    return ['dev', 'test', 'staging', 'prod'];
+}
+/** List all valid environment names per the declared pattern */
+export function listEnvs() {
+    return getPattern();
+}
+/**
+ * Assert that the current env is in the declared pattern.
+ * Throws HazoError(ENV_INVALID) if not.
+ */
+export function assertEnv(pattern) {
+    const env = getEnv();
+    const validEnvs = pattern ?? getPattern();
+    if (!validEnvs.includes(env)) {
+        throw new HazoError({
+            code: 'ENV_INVALID',
+            pkg: 'hazo_env',
+            message: `Current env "${env}" is not in declared pattern [${validEnvs.join(', ')}]`,
+        });
+    }
+}
+/** Describe the current environment (client-safe subset) */
+export function describeEnv() {
+    const env = getEnv();
+    return { env, role: getEnvRole(env) };
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export * from './types/index.js';
+export * from './resolve/secrets.js';
+export * from './resolve/connect.js';
+export * from './resolve/files.js';
+export * from './doctor.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE/E,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+// hazo_env/src/index.ts — Server entry point
+// Pure client helpers re-exported explicitly (getPattern/listEnvs/assertEnv/describeEnv are overridden below)
+export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
+// Server-aware overrides
+export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+// Types
+export * from './types/index.js';
+// Resolver + secrets
+export * from './resolve/secrets.js';
+export * from './resolve/connect.js';
+export * from './resolve/files.js';
+// Doctor
+export * from './doctor.js';

package/dist/lib/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC"}

package/dist/lib/index.js

@@ -0,0 +1 @@
+export {};

package/dist/resolve/connect.d.ts

@@ -0,0 +1,11 @@
+import type { DbEnvConfig, ResolveConnectOptions } from '../types/index.js';
+/**
+ * Resolve the connect configuration for the given (or current) environment.
+ * Reads the [db.<env>] section from hazo_env_config.ini and substitutes ${VAR} placeholders.
+ * ${DATA_ROOT} is automatically resolved from the [data] root value.
+ *
+ * @param opts.env - Target env (defaults to current env)
+ * @param opts.allowOtherEnv - Allow resolving a non-current env (default: false)
+ */
+export declare function resolveConnectConfig(opts?: ResolveConnectOptions): DbEnvConfig;
+//# sourceMappingURL=connect.d.ts.map

package/dist/resolve/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/resolve/connect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAmB5E;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,qBAA0B,GAAG,WAAW,CA4DlF"}

package/dist/resolve/connect.js

@@ -0,0 +1,85 @@
+// hazo_env/src/resolve/connect.ts — Server-only connect config resolver
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { HazoConfigError } from 'hazo_core';
+import { getEnv } from '../index.client.js';
+import { substitutePlaceholders } from './secrets.js';
+import { resolveFilesConfig } from './files.js';
+function findConfigFile(pkg) {
+    return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
+}
+function loadConfig() {
+    const filePath = findConfigFile('hazo_env');
+    try {
+        return new HazoConfig({ filePath });
+    }
+    catch {
+        throw new HazoConfigError({
+            code: 'HAZO_ENV_CONFIG_FILE_MISSING',
+            pkg: 'hazo_env',
+            message: `Config file not found: ${filePath}. Create config/hazo_env_config.ini.`,
+        });
+    }
+}
+/**
+ * Resolve the connect configuration for the given (or current) environment.
+ * Reads the [db.<env>] section from hazo_env_config.ini and substitutes ${VAR} placeholders.
+ * ${DATA_ROOT} is automatically resolved from the [data] root value.
+ *
+ * @param opts.env - Target env (defaults to current env)
+ * @param opts.allowOtherEnv - Allow resolving a non-current env (default: false)
+ */
+export function resolveConnectConfig(opts = {}) {
+    const currentEnv = getEnv();
+    const targetEnv = opts.env ?? currentEnv;
+    if (!opts.allowOtherEnv && targetEnv !== currentEnv) {
+        throw new HazoConfigError({
+            code: 'HAZO_ENV_CONFIG_ENV_MISMATCH',
+            pkg: 'hazo_env',
+            message: `resolveConnectConfig: refusing to resolve env "${targetEnv}" when running as "${currentEnv}". Pass allowOtherEnv:true to override.`,
+        });
+    }
+    const config = loadConfig();
+    const section = config.getSection(`db.${targetEnv}`);
+    if (!section) {
+        throw new HazoConfigError({
+            code: 'HAZO_ENV_CONFIG_MISSING_DB_SECTION',
+            pkg: 'hazo_env',
+            message: `No [db.${targetEnv}] section found in hazo_env_config.ini.`,
+        });
+    }
+    // Compute DATA_ROOT for ${DATA_ROOT} substitution in sqlite paths
+    let dataRoot = 'app_data';
+    try {
+        dataRoot = resolveFilesConfig().local.basePath;
+    }
+    catch {
+        // fallback: use relative default
+    }
+    const extraVars = { DATA_ROOT: dataRoot };
+    const type = section['type'];
+    if (type === 'sqlite') {
+        const rawPath = section['database_path'];
+        if (!rawPath) {
+            throw new HazoConfigError({
+                code: 'HAZO_ENV_CONFIG_MISSING_DB_PATH',
+                pkg: 'hazo_env',
+                message: `[db.${targetEnv}] is type=sqlite but has no database_path.`,
+            });
+        }
+        const database_path = substitutePlaceholders(rawPath, extraVars);
+        return { type: 'sqlite', sqlite: { database_path } };
+    }
+    if (type === 'postgrest') {
+        const rawUrl = section['base_url'] ?? '';
+        const rawKey = section['api_key'] ?? '';
+        const base_url = substitutePlaceholders(rawUrl, extraVars);
+        const api_key = substitutePlaceholders(rawKey, extraVars);
+        return { type: 'postgrest', postgrest: { base_url, api_key } };
+    }
+    throw new HazoConfigError({
+        code: 'HAZO_ENV_CONFIG_UNKNOWN_DB_TYPE',
+        pkg: 'hazo_env',
+        message: `[db.${targetEnv}] has unknown type "${type}". Expected "sqlite" or "postgrest".`,
+    });
+}

package/dist/resolve/files.d.ts

@@ -0,0 +1,8 @@
+import type { FilesEnvConfig } from '../types/index.js';
+/**
+ * Resolve the local file storage configuration.
+ * Reads data_root from [data] section in hazo_env_config.ini.
+ * Falls back to app_data if not configured.
+ */
+export declare function resolveFilesConfig(appConfigPkg?: string): FilesEnvConfig;
+//# sourceMappingURL=files.d.ts.map

package/dist/resolve/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/resolve/files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAgBxD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAoCxE"}

package/dist/resolve/files.js

@@ -0,0 +1,53 @@
+// hazo_env/src/resolve/files.ts — Server-only files config resolver
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+const DEFAULT_DATA_ROOT = 'app_data';
+function findConfigFile(pkg) {
+    return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
+}
+function tryLoadConfig(pkg) {
+    try {
+        return new HazoConfig({ filePath: findConfigFile(pkg) });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the local file storage configuration.
+ * Reads data_root from [data] section in hazo_env_config.ini.
+ * Falls back to app_data if not configured.
+ */
+export function resolveFilesConfig(appConfigPkg) {
+    const envConfig = tryLoadConfig('hazo_env');
+    const dataSection = envConfig?.getSection('data');
+    let dataRoot = dataSection?.['root'] ?? DEFAULT_DATA_ROOT;
+    // Also check the consuming app's config if a pkg name was provided
+    if (appConfigPkg) {
+        const appConfig = tryLoadConfig(appConfigPkg);
+        const appDataSection = appConfig?.getSection('data');
+        if (appDataSection?.['root']) {
+            dataRoot = appDataSection['root'];
+        }
+    }
+    // Resolve to absolute path if relative
+    if (!path.isAbsolute(dataRoot)) {
+        dataRoot = path.resolve(process.cwd(), dataRoot);
+    }
+    // Read optional limits from hazo_env_config.ini [data] section
+    const maxFileSizeStr = dataSection?.['max_file_size_mb'];
+    const allowedExtensionsStr = dataSection?.['allowed_extensions'];
+    const local = { basePath: dataRoot };
+    if (maxFileSizeStr) {
+        const mb = parseInt(maxFileSizeStr, 10);
+        if (!isNaN(mb))
+            local.maxFileSize = mb * 1024 * 1024;
+    }
+    if (allowedExtensionsStr) {
+        local.allowedExtensions = allowedExtensionsStr
+            .split(',')
+            .map((e) => e.trim())
+            .filter(Boolean);
+    }
+    return { provider: 'local', local };
+}

package/dist/resolve/secrets.d.ts

@@ -0,0 +1,16 @@
+export interface GetSecretOptions {
+    required?: boolean;
+}
+/**
+ * Get a secret value from environment variables.
+ * Loads .env.local on first call.
+ * Throws HazoConfigError with code HAZO_ENV_CONFIG_SECRET_MISSING if required and absent.
+ */
+export declare function getSecret(name: string, options?: GetSecretOptions): string | undefined;
+/**
+ * Replace ${VAR_NAME} placeholders in a string with values from extraVars or the environment.
+ * extraVars take precedence over process.env (used for e.g. DATA_ROOT injection).
+ * Never logs the resolved values.
+ */
+export declare function substitutePlaceholders(value: string, extraVars?: Record<string, string>): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/resolve/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/resolve/secrets.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,GAAG,SAAS,CAW1F;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAahG"}

package/dist/resolve/secrets.js

@@ -0,0 +1,48 @@
+// hazo_env/src/resolve/secrets.ts — Server-only secret layer
+import dotenv from 'dotenv';
+import path from 'node:path';
+import { registerSingleton, getSingleton, HazoConfigError } from 'hazo_core';
+const DOTENV_SINGLETON_KEY = 'hazo_env:dotenv_loaded';
+/** Load .env.local once per process (idempotent via singleton registry) */
+function ensureSecretsLoaded() {
+    if (getSingleton(DOTENV_SINGLETON_KEY))
+        return;
+    dotenv.config({ path: path.resolve(process.cwd(), '.env.local'), override: false });
+    registerSingleton(DOTENV_SINGLETON_KEY, true);
+}
+/**
+ * Get a secret value from environment variables.
+ * Loads .env.local on first call.
+ * Throws HazoConfigError with code HAZO_ENV_CONFIG_SECRET_MISSING if required and absent.
+ */
+export function getSecret(name, options = {}) {
+    ensureSecretsLoaded();
+    const value = process.env[name];
+    if ((value === undefined || value === '') && options.required) {
+        throw new HazoConfigError({
+            code: 'HAZO_ENV_CONFIG_SECRET_MISSING',
+            pkg: 'hazo_env',
+            message: `Required secret "${name}" is not set. Add it to .env.local or the environment.`,
+        });
+    }
+    return value || undefined;
+}
+/**
+ * Replace ${VAR_NAME} placeholders in a string with values from extraVars or the environment.
+ * extraVars take precedence over process.env (used for e.g. DATA_ROOT injection).
+ * Never logs the resolved values.
+ */
+export function substitutePlaceholders(value, extraVars) {
+    ensureSecretsLoaded();
+    return value.replace(/\$\{([^}]+)\}/g, (_, varName) => {
+        const resolved = extraVars?.[varName] ?? process.env[varName];
+        if (resolved === undefined) {
+            throw new HazoConfigError({
+                code: 'HAZO_ENV_CONFIG_SECRET_MISSING',
+                pkg: 'hazo_env',
+                message: `Placeholder \${${varName}} references "${varName}" which is not set in extraVars or environment.`,
+            });
+        }
+        return resolved;
+    });
+}

package/dist/types/index.d.ts

@@ -0,0 +1,78 @@
+/** Canonical environment names after normalization */
+export type HazoEnv = 'dev' | 'test' | 'staging' | 'prod' | string;
+/** Broad role of an environment */
+export type HazoEnvRole = 'development' | 'test' | 'staging' | 'production';
+/** The set of valid environment names for this app, from [env] pattern in INI */
+export type EnvPattern = string[];
+/** Hint about where an environment runs */
+export type HostHint = 'local' | 'remote' | 'unknown';
+/** DB configuration for a single environment (from [db.<env>] in INI) */
+export interface DbEnvConfig {
+    type: 'sqlite' | 'postgrest';
+    sqlite?: {
+        database_path: string;
+    };
+    postgrest?: {
+        base_url: string;
+        api_key: string;
+    };
+}
+/** Files configuration returned by resolveFilesConfig */
+export interface FilesEnvConfig {
+    provider: 'local';
+    local: {
+        basePath: string;
+        maxFileSize?: number;
+        allowedExtensions?: string[];
+    };
+}
+/** Result of describeEnv() */
+export interface EnvDescription {
+    env: HazoEnv;
+    role: HazoEnvRole;
+    pattern: EnvPattern;
+    app: string;
+    dataRoot: string;
+    hostHint: HostHint;
+}
+/** Options for resolveConnectConfig */
+export interface ResolveConnectOptions {
+    env?: HazoEnv;
+    allowOtherEnv?: boolean;
+}
+/** Describes a requested migration between two environments */
+export interface MigrationRequest {
+    fromEnv: HazoEnv;
+    toEnv: HazoEnv;
+    includeFiles?: boolean;
+    dryRun?: boolean;
+}
+/** Result of a completed migration */
+export interface MigrationResult {
+    success: boolean;
+    rowsMigrated?: number;
+    filesMigrated?: number;
+    error?: string;
+}
+/** Progress event emitted during a migration run */
+export interface MigrationProgress {
+    phase: 'db' | 'files' | 'verify' | 'done';
+    message: string;
+    percent?: number;
+}
+/** Result of a post-migration file verification */
+export interface VerifyReport {
+    passed: boolean;
+    missingFiles: string[];
+    extraFiles: string[];
+    checksumErrors: string[];
+}
+/** A transform rule for scrubbing/masking sensitive fields */
+export interface ScrubTransform {
+    table: string;
+    column: string;
+    /** Transform strategy: replace with fixed value, hash, or nullify */
+    strategy: 'replace' | 'hash' | 'nullify';
+    replacement?: string;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAID,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/types/index.js

@@ -0,0 +1,2 @@
+// hazo_env/src/types/index.ts
+export {};

package/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "hazo_env",
+  "version": "0.1.1",
+  "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/index.client.d.ts",
+      "import": "./dist/index.client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "hazo-env": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "config",
+    "README.md",
+    "SETUP_CHECKLIST.md",
+    "CHANGE_LOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "lint": "tsc --noEmit",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
+    "dev:test-app": "npm run build && cd test-app && npm run dev",
+    "build:test-app": "npm run build && cd test-app && npm run build"
+  },
+  "dependencies": {
+    "dotenv": "^16.4.5",
+    "picocolors": "^1.1.1"
+  },
+  "peerDependencies": {
+    "hazo_core": "^1.1.0",
+    "hazo_config": "^2.1.10",
+    "hazo_connect": "^3.4.0",
+    "hazo_files": "^3.0.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "next": "^14.0.0 || ^16.0.0"
+  },
+  "peerDependenciesMeta": {
+    "hazo_connect": {
+      "optional": true
+    },
+    "hazo_files": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5.7.2",
+    "jest": "^30.2.0",
+    "ts-jest": "^29.4.5",
+    "@types/jest": "^30.0.0",
+    "jest-environment-node": "^30.2.0",
+    "@types/node": "^22.10.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "hazo_core": "^1.1.0",
+    "hazo_config": "^2.1.10",
+    "hazo_connect": "^3.4.0",
+    "hazo_files": "^3.0.0",
+    "next": "^16.0.10",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "lucide-react": "^0.553.0",
+    "tailwindcss": "^4.2.4",
+    "@tailwindcss/postcss": "^4.2.4",
+    "postcss": "^8.4.49"
+  },
+  "keywords": [
+    "hazo",
+    "env",
+    "environment",
+    "config",
+    "resolver",
+    "cli"
+  ],
+  "author": "Pubs Abayasiri",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pub12/hazo_env.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pub12/hazo_env/issues"
+  },
+  "homepage": "https://github.com/pub12/hazo_env#readme"
+}