hazo_env 0.10.0 → 0.10.2

package/dist/migrate/db.js

@@ -1,127 +0,0 @@
-// hazo_env/src/migrate/db.ts — per-table DB copy with schema parity check
-import { HazoError, optional_import } from 'hazo_core';
-import { isSecretColumn } from '../lib/secret_columns.js';
-const PAGE_SIZE = 500;
-// The HazoConnectAdapter interface types rawQuery as (sql, RequestInit?) but the
-// SQLite adapter extends it with { params?: unknown[] }. Cast through unknown to
-// satisfy both the interface type and the runtime expectation.
-function rawQuery(adapter, sql, params = []) {
-    return adapter.rawQuery(sql, { params });
-}
-async function getRawTables(adapter) {
-    const result = await rawQuery(adapter, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name");
-    return result.map((r) => r.name);
-}
-async function getMigrationNames(adapter) {
-    // Check if _migrations table exists
-    const tables = await getRawTables(adapter);
-    if (!tables.includes('_migrations'))
-        return null;
-    const rows = await rawQuery(adapter, 'SELECT name FROM _migrations ORDER BY name');
-    return rows.map((r) => r.name);
-}
-export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
-    // PostgREST path: dispatch to dedicated implementation
-    if (opts.type === 'postgrest') {
-        const { copyDbPostgrest } = await import('./db.postgrest.js');
-        return copyDbPostgrest(srcAdapter, tgtAdapter, opts);
-    }
-    const connect = await optional_import('hazo_connect/server');
-    if (!connect) {
-        throw new HazoError({
-            code: 'HAZO_ENV_MISSING_DEPENDENCY',
-            pkg: 'hazo_env',
-            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
-        });
-    }
-    // Schema parity check via _migrations (SQLite only — PostgREST apps may not use _migrations)
-    const srcMigrations = await getMigrationNames(srcAdapter);
-    const tgtMigrations = await getMigrationNames(tgtAdapter);
-    if (srcMigrations === null || tgtMigrations === null) {
-        throw new HazoError({
-            code: 'HAZO_ENV_SCHEMA_MISMATCH',
-            pkg: 'hazo_env',
-            message: `Schema parity check failed: _migrations table is missing on ${srcMigrations === null ? 'source' : 'target'}. Both databases must have matching _migrations tables.`,
-        });
-    }
-    const srcSet = new Set(srcMigrations);
-    const tgtSet = new Set(tgtMigrations);
-    const missingInTgt = [...srcSet].filter((n) => !tgtSet.has(n));
-    const missingInSrc = [...tgtSet].filter((n) => !srcSet.has(n));
-    if (missingInTgt.length > 0 || missingInSrc.length > 0) {
-        throw new HazoError({
-            code: 'HAZO_ENV_SCHEMA_MISMATCH',
-            pkg: 'hazo_env',
-            message: `Schema parity check failed: migration name-sets differ.\n  Missing in target: ${missingInTgt.join(', ') || 'none'}\n  Missing in source: ${missingInSrc.join(', ') || 'none'}`,
-        });
-    }
-    // Get tables to copy
-    const allTables = await getRawTables(srcAdapter);
-    // Exclude system/internal tables
-    const SKIP = new Set(['_migrations', 'sqlite_sequence', 'hazo_audit_events', 'hazo_audit_intent']);
-    let tablesToCopy = allTables.filter((t) => !SKIP.has(t));
-    if (opts.tables && opts.tables !== '*') {
-        tablesToCopy = tablesToCopy.filter((t) => opts.tables.includes(t));
-    }
-    let totalRows = 0;
-    let totalScrubbed = 0;
-    for (const table of tablesToCopy) {
-        opts.onProgress?.(`Copying table: ${table}`);
-        // Delete all rows in target
-        await rawQuery(tgtAdapter, `DELETE FROM "${table}"`);
-        // Get schema to find PK column and all columns
-        const schema = await rawQuery(srcAdapter, `PRAGMA table_info("${table}")`);
-        const pkCol = schema.find((c) => c.pk === 1)?.name ?? 'id';
-        const allCols = schema.map((c) => c.name);
-        // Page through source
-        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
-        let offset = 0;
-        let pageRows = [];
-        do {
-            pageRows = await srcService.list((qb) => qb.order(pkCol, 'asc').limit(PAGE_SIZE).offset(offset));
-            if (pageRows.length === 0)
-                break;
-            for (let row of pageRows) {
-                // Drop secret columns
-                const cleaned = {};
-                let didScrub = false;
-                for (const col of allCols) {
-                    if (isSecretColumn(col)) {
-                        didScrub = true;
-                    }
-                    else {
-                        cleaned[col] = row[col];
-                    }
-                }
-                // Apply scrub hook if provided (masking, Phase B)
-                if (opts.scrubHook) {
-                    const hooked = opts.scrubHook(table, cleaned);
-                    if (hooked !== cleaned)
-                        didScrub = true;
-                    row = hooked;
-                }
-                else {
-                    row = cleaned;
-                }
-                if (didScrub)
-                    totalScrubbed++;
-                // Only insert columns that exist in schema
-                const insertRow = {};
-                for (const col of Object.keys(row)) {
-                    if (allCols.includes(col))
-                        insertRow[col] = row[col];
-                }
-                // Use raw INSERT to preserve PKs
-                const cols = Object.keys(insertRow);
-                if (cols.length === 0)
-                    continue;
-                const placeholders = cols.map(() => '?').join(', ');
-                const values = cols.map((c) => insertRow[c]);
-                await rawQuery(tgtAdapter, `INSERT OR REPLACE INTO "${table}" (${cols.map((c) => `"${c}"`).join(', ')}) VALUES (${placeholders})`, values);
-                totalRows++;
-            }
-            offset += PAGE_SIZE;
-        } while (pageRows.length === PAGE_SIZE);
-    }
-    return { tables: tablesToCopy.length, rows: totalRows, scrubbed: totalScrubbed };
-}

package/dist/migrate/db.postgrest.d.ts

@@ -1,4 +0,0 @@
-import type { HazoConnectAdapter } from 'hazo_connect';
-import type { DbCopyOptions, DbCopyResult } from './db.js';
-export declare function copyDbPostgrest(srcAdapter: HazoConnectAdapter, tgtAdapter: HazoConnectAdapter, opts?: DbCopyOptions): Promise<DbCopyResult>;
-//# sourceMappingURL=db.postgrest.d.ts.map

package/dist/migrate/db.postgrest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}

package/dist/migrate/db.postgrest.js

@@ -1,95 +0,0 @@
-// hazo_env/src/migrate/db.postgrest.ts — PostgREST-based DB copy (REST-only, no raw SQL)
-import { HazoError, optional_import } from 'hazo_core';
-import { isSecretColumn } from '../lib/secret_columns.js';
-const PAGE_SIZE = 500;
-export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
-    const connect = await optional_import('hazo_connect/server');
-    if (!connect) {
-        throw new HazoError({
-            code: 'HAZO_ENV_MISSING_DEPENDENCY',
-            pkg: 'hazo_env',
-            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
-        });
-    }
-    // Table list is required for PostgREST (no auto-discovery — FK ordering unsafe without explicit list)
-    if (!opts.tables || opts.tables === '*') {
-        throw new HazoError({
-            code: 'HAZO_ENV_MISSING_TABLE_LIST',
-            pkg: 'hazo_env',
-            message: 'PostgREST migration requires an explicit table list. ' +
-                'Set [migrate] tables = ... in hazo_env_config.ini or pass --tables to the CLI.',
-        });
-    }
-    const orderedTables = opts.tables;
-    const preserveSet = new Set(opts.preserve ?? []);
-    const pkOverrides = opts.pkOverrides ?? {};
-    // Tables to actually process (exclude preserve list)
-    const tablesToProcess = orderedTables.filter((t) => !preserveSet.has(t));
-    // --- Clear pass: reverse dependency order ---
-    opts.onProgress?.('Clearing target tables (reverse order for FK safety)...');
-    for (const table of [...tablesToProcess].reverse()) {
-        const pk = pkOverrides[table] ?? 'id';
-        try {
-            // PostgREST match-all DELETE: DELETE /table?pk=not.is.null
-            await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
-            opts.onProgress?.(`Cleared: ${table}`);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            opts.onProgress?.(`Warning: could not clear ${table}: ${msg}`);
-        }
-    }
-    let totalRows = 0;
-    let totalScrubbed = 0;
-    // --- Copy pass: forward dependency order ---
-    for (const table of tablesToProcess) {
-        const tableIdx = tablesToProcess.indexOf(table);
-        opts.onProgress?.(`Copying table ${tableIdx + 1}/${tablesToProcess.length}: ${table}`);
-        opts.onTableProgress?.(tableIdx + 1, tablesToProcess.length, table);
-        const pk = pkOverrides[table] ?? 'id';
-        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
-        const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });
-        let offset = 0;
-        let pageRows = [];
-        do {
-            pageRows = await srcService.list((qb) => 
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            qb.order(pk, 'asc').limit(PAGE_SIZE).offset(offset));
-            if (pageRows.length === 0)
-                break;
-            const batch = [];
-            for (let row of pageRows) {
-                const cleaned = {};
-                let didScrub = false;
-                for (const [col, val] of Object.entries(row)) {
-                    if (isSecretColumn(col)) {
-                        didScrub = true;
-                    }
-                    else {
-                        cleaned[col] = val;
-                    }
-                }
-                let processedRow = cleaned;
-                if (opts.scrubHook) {
-                    const hooked = opts.scrubHook(table, cleaned);
-                    if (hooked !== cleaned)
-                        didScrub = true;
-                    processedRow = hooked;
-                }
-                if (didScrub)
-                    totalScrubbed++;
-                batch.push(processedRow);
-            }
-            if (batch.length > 0) {
-                await tgtService.insert(batch);
-                totalRows += batch.length;
-                opts.onProgress?.(`  inserted ${batch.length} rows into ${table}`);
-            }
-            offset += PAGE_SIZE;
-        } while (pageRows.length === PAGE_SIZE);
-    }
-    // Note: PostgREST has no REST endpoint for NOTIFY. Schema reload only needed after DDL.
-    // If schema DDL changed since last reload, run: NOTIFY pgrst, 'reload schema' in Postgres.
-    opts.onProgress?.("DB copy complete. If schema DDL changed, run NOTIFY pgrst, 'reload schema' in Postgres.");
-    return { tables: tablesToProcess.length, rows: totalRows, scrubbed: totalScrubbed };
-}

package/dist/migrate/files.d.ts

@@ -1,15 +0,0 @@
-import type { HazoEnv } from '../types/index.js';
-export interface FilesCopyOptions {
-    fromEnv: HazoEnv;
-    toEnv: HazoEnv;
-    transport?: 'local' | 'rsync';
-    fileScrubHook?: (filePath: string) => Promise<void>;
-    onProgress?: (msg: string, percent?: number) => void;
-}
-export interface FilesCopyResult {
-    copied: number;
-    bytes: number;
-    placeholdered: number;
-}
-export declare function copyFiles(opts: FilesCopyOptions): Promise<FilesCopyResult>;
-//# sourceMappingURL=files.d.ts.map

package/dist/migrate/files.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAoFD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}

package/dist/migrate/files.js

@@ -1,131 +0,0 @@
-// hazo_env/src/migrate/files.ts — local file-tree copy with PDF scrubbing (Phase C)
-//
-// PDF scrubbing via hazo_pdf/server (optional peer dep). When HAZO_ENV_MASK_KEY
-// is set and a copied file has a .pdf extension, mask_pdf is called with an
-// empty targets list (structure-only scrub / reserved for future target lists).
-// Failures are non-fatal warnings — the file copy still completes.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { resolveFilesRoot } from '../resolve/files.js';
-import { resolveSshConfig } from '../resolve/ssh.js';
-import { assertSafeSshField, setupKnownHosts } from './ssh-exec.js';
-function resolveEnvFilesRoot(env) {
-    return resolveFilesRoot(env);
-}
-/**
- * Attempt to scrub a PDF file in-place using hazo_pdf/mask_pdf.
- * Non-fatal: any failure is silently swallowed — the copy always completes.
- * Called only when HAZO_ENV_MASK_KEY is set.
- */
-async function scrubPdfFile(filePath) {
-    try {
-        const pdfMod = await import('hazo_pdf/server').catch(() => null);
-        if (!pdfMod?.mask_pdf)
-            return; // hazo_pdf not installed or mask_pdf not exported
-        const { readFileSync, writeFileSync } = await import('node:fs');
-        const bytes = readFileSync(filePath);
-        const scrubbed = await pdfMod.mask_pdf(new Uint8Array(bytes), []);
-        writeFileSync(filePath, Buffer.from(scrubbed));
-    }
-    catch {
-        // Non-fatal — PDF scrubbing failure is a warning, not an abort
-    }
-}
-async function copyFilesRsync(opts, ssh) {
-    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
-    fs.mkdirSync(tgtRoot, { recursive: true });
-    assertSafeSshField('user', ssh.user);
-    assertSafeSshField('host', ssh.host);
-    assertSafeSshField('key', ssh.key);
-    assertSafeSshField('path', ssh.path);
-    const { knownHosts, strict } = setupKnownHosts(ssh);
-    const remote = `${ssh.user}@${ssh.host}:${ssh.path}/`;
-    const sshCmd = `ssh -i ${ssh.key} -o StrictHostKeyChecking=${strict} -o UserKnownHostsFile=${knownHosts}`;
-    const args = ['-az', '--partial', '--info=progress2', '-e', sshCmd, remote, tgtRoot + '/'];
-    return new Promise((resolve, reject) => {
-        const proc = spawn('rsync', args);
-        let totalFiles = 0;
-        let doneFiles = 0;
-        let totalBytes = 0;
-        proc.stdout.on('data', (chunk) => {
-            const text = chunk.toString();
-            // Parse --info=progress2: lines like "     117,504,614 100%  108.64MB/s    0:00:01 (xfr#123, to-chk=0/456)"
-            for (const line of text.split('\n')) {
-                // Extract to-chk=N/TOTAL
-                const chkMatch = line.match(/to-chk=(\d+)\/(\d+)/);
-                if (chkMatch) {
-                    const remaining = parseInt(chkMatch[1], 10);
-                    const total = parseInt(chkMatch[2], 10);
-                    if (totalFiles === 0)
-                        totalFiles = total;
-                    doneFiles = total - remaining;
-                    const pct = total > 0 ? Math.round((doneFiles / total) * 100) : 0;
-                    opts.onProgress?.(`rsync: ${doneFiles}/${total} files (${pct}%)`, pct);
-                }
-                // Extract bytes: first number on lines with a %
-                const bytesMatch = line.match(/^\s+([\d,]+)\s+\d+%/);
-                if (bytesMatch) {
-                    totalBytes = parseInt(bytesMatch[1].replace(/,/g, ''), 10);
-                }
-            }
-        });
-        proc.stderr.on('data', (chunk) => {
-            opts.onProgress?.(`rsync: ${chunk.toString().trim()}`, undefined);
-        });
-        proc.on('error', (err) => reject(err));
-        proc.on('close', (code) => {
-            if (code !== 0) {
-                reject(new Error(`rsync exited with code ${code}`));
-            }
-            else {
-                resolve({ copied: doneFiles || totalFiles, bytes: totalBytes, placeholdered: 0 });
-            }
-        });
-    });
-}
-export async function copyFiles(opts) {
-    const ssh = resolveSshConfig(opts.fromEnv);
-    if (opts.transport === 'rsync' || (opts.transport !== 'local' && ssh !== null)) {
-        if (!ssh)
-            throw new Error(`rsync requested but no [transport.ssh.${opts.fromEnv}] config found`);
-        return copyFilesRsync(opts, ssh);
-    }
-    const srcRoot = resolveEnvFilesRoot(opts.fromEnv);
-    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
-    if (!fs.existsSync(srcRoot)) {
-        opts.onProgress?.(`No files directory at ${srcRoot} — skipping file copy`);
-        return { copied: 0, bytes: 0, placeholdered: 0 };
-    }
-    fs.mkdirSync(tgtRoot, { recursive: true });
-    let copied = 0;
-    let bytes = 0;
-    async function copyDir(src, tgt) {
-        const entries = fs.readdirSync(src, { withFileTypes: true });
-        for (const entry of entries) {
-            const srcPath = path.join(src, entry.name);
-            const tgtPath = path.join(tgt, entry.name);
-            if (entry.isDirectory()) {
-                fs.mkdirSync(tgtPath, { recursive: true });
-                await copyDir(srcPath, tgtPath);
-            }
-            else {
-                fs.copyFileSync(srcPath, tgtPath);
-                const stat = fs.statSync(srcPath);
-                bytes += stat.size;
-                copied++;
-                opts.onProgress?.(`Copied: ${entry.name}`);
-                // Phase C: PDF scrubbing when HAZO_ENV_MASK_KEY is set
-                if (entry.name.toLowerCase().endsWith('.pdf') && process.env['HAZO_ENV_MASK_KEY']) {
-                    await scrubPdfFile(tgtPath);
-                }
-                // Legacy sync hook (still supported for callers that pass one)
-                if (opts.fileScrubHook) {
-                    await opts.fileScrubHook(tgtPath);
-                }
-            }
-        }
-    }
-    await copyDir(srcRoot, tgtRoot);
-    return { copied, bytes, placeholdered: 0 };
-}

package/dist/migrate/progress.d.ts

@@ -1,5 +0,0 @@
-import type { MigrationProgress } from '../types/index.js';
-export declare function writeMigrationProgress(progressDir: string, jobId: string, p: MigrationProgress): void;
-export declare function readMigrationProgress(progressDir: string, jobId: string): MigrationProgress | null;
-export declare function clearMigrationProgress(progressDir: string, jobId: string): void;
-//# sourceMappingURL=progress.d.ts.map

package/dist/migrate/progress.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/migrate/progress.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAGrG;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQlG;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG/E"}

package/dist/migrate/progress.js

@@ -1,24 +0,0 @@
-// hazo_env/src/migrate/progress.ts — Filesystem-backed migration progress store
-import fs from 'node:fs';
-import path from 'node:path';
-export function writeMigrationProgress(progressDir, jobId, p) {
-    fs.mkdirSync(progressDir, { recursive: true });
-    fs.writeFileSync(path.join(progressDir, `${jobId}.json`), JSON.stringify(p), 'utf-8');
-}
-export function readMigrationProgress(progressDir, jobId) {
-    const filePath = path.join(progressDir, `${jobId}.json`);
-    try {
-        const raw = fs.readFileSync(filePath, 'utf-8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-export function clearMigrationProgress(progressDir, jobId) {
-    const filePath = path.join(progressDir, `${jobId}.json`);
-    try {
-        fs.unlinkSync(filePath);
-    }
-    catch { /* ignore */ }
-}

package/dist/migrate/run.d.ts

@@ -1,16 +0,0 @@
-import type { MigrationRequest, MigrationResult } from '../types/index.js';
-/**
- * Resolve the effective table list handed to copyDb.
- *
- * `'*'` (and an unset request) both mean "all tables". The SQL path can
- * auto-discover that set, but the PostgREST path cannot (no FK ordering without
- * an explicit list) and rejects `'*'`. So when the request asks for "all", we
- * fall back to the configured `[migrate] tables` list — the app's canonical
- * FK-ordered definition of "all". Only when no config list exists do we pass
- * `'*'` through (SQL auto-discovers; PostgREST then errors as designed).
- *
- * An explicit `string[]` from the request always wins.
- */
-export declare function resolveTableList(reqTables: '*' | string[] | undefined, configTables: string[] | undefined): '*' | string[];
-export declare function runMigration(req: MigrationRequest): Promise<MigrationResult>;
-//# sourceMappingURL=run.d.ts.map

package/dist/migrate/run.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AAU3G;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,GACjC,GAAG,GAAG,MAAM,EAAE,CAGhB;AAkDD,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyMlF"}