hazo_env 0.10.0 → 0.10.2

package/dist/migrate/run.js

@@ -1,270 +0,0 @@
-// hazo_env/src/migrate/run.ts — runMigration pipeline
-//
-// PDF scrubbing (Phase C): after each file copy, files.ts invokes hazo_pdf/server mask_pdf
-// for any .pdf file when HAZO_ENV_MASK_KEY is set. hazo_pdf is an optional peer dep of
-// hazo_env — if not installed the copy still completes (scrub silently skipped).
-// See: src/migrate/files.ts scrubPdfFile() and hazo_pdf/src/server/mask.ts
-import { HazoError, optional_import } from 'hazo_core';
-import { resolveConnectConfig } from '../resolve/connect.js';
-import { resolveMigrateConfig } from '../resolve/migrate.js';
-import { resolveFilesConfig } from '../resolve/files.js';
-import { resolveTransport } from './transport.js';
-import { takeSnapshot } from './snapshot.js';
-import { copyDb } from './db.js';
-import { copyFiles } from './files.js';
-import { verifyFiles } from './verify.js';
-import { auditMigration } from './audit.js';
-import { writeMigrationProgress } from './progress.js';
-import { getEnvRole } from '../env.server.js';
-function emitProgress(req, p) {
-    req.onProgress?.(p);
-    if (req.jobId && req.progressDir) {
-        writeMigrationProgress(req.progressDir, req.jobId, p);
-    }
-}
-/**
- * Resolve the effective table list handed to copyDb.
- *
- * `'*'` (and an unset request) both mean "all tables". The SQL path can
- * auto-discover that set, but the PostgREST path cannot (no FK ordering without
- * an explicit list) and rejects `'*'`. So when the request asks for "all", we
- * fall back to the configured `[migrate] tables` list — the app's canonical
- * FK-ordered definition of "all". Only when no config list exists do we pass
- * `'*'` through (SQL auto-discovers; PostgREST then errors as designed).
- *
- * An explicit `string[]` from the request always wins.
- */
-export function resolveTableList(reqTables, configTables) {
-    if (reqTables && reqTables !== '*')
-        return reqTables;
-    return configTables ?? '*';
-}
-// Resolve the SQLite driver — prefer better-sqlite3 in tests when env var is set
-function getSqliteDriver() {
-    if (process.env['HAZO_ENV_TEST_SQLITE_DRIVER'] === 'better-sqlite3')
-        return 'better-sqlite3';
-    return 'sql.js';
-}
-async function buildScrubHook(toEnv, scrubMode, tgtAdapter) {
-    const maskKey = process.env['HAZO_ENV_MASK_KEY'];
-    const toRole = getEnvRole(toEnv);
-    const shouldScrub = scrubMode !== 'none' && !!maskKey && (toRole === 'test' || toRole === 'staging');
-    if (!shouldScrub)
-        return undefined;
-    const { loadRuleset } = await import('../mask/ruleset.js');
-    const { getTransform } = await import('../mask/registry.js');
-    let ruleset;
-    try {
-        ruleset = await loadRuleset(tgtAdapter);
-    }
-    catch {
-        return undefined;
-    }
-    if (ruleset.length === 0)
-        return undefined;
-    const transformMap = new Map();
-    for (const rule of ruleset) {
-        const fn = await getTransform(rule.transform);
-        if (!fn)
-            continue;
-        if (!transformMap.has(rule.table))
-            transformMap.set(rule.table, new Map());
-        transformMap.get(rule.table).set(rule.column, fn);
-    }
-    return (table, row) => {
-        const colTransforms = transformMap.get(table);
-        if (!colTransforms || colTransforms.size === 0)
-            return row;
-        const result = { ...row };
-        for (const [col, fn] of colTransforms) {
-            if (col in result)
-                result[col] = fn(result[col], col, maskKey);
-        }
-        return result;
-    };
-}
-export async function runMigration(req) {
-    const startMs = Date.now();
-    const warnings = [];
-    const connect = await optional_import('hazo_connect/server');
-    if (!connect) {
-        throw new HazoError({
-            code: 'HAZO_ENV_MISSING_DEPENDENCY',
-            pkg: 'hazo_env',
-            message: 'hazo_connect is required for migration. Install it as a peer dependency.',
-        });
-    }
-    // Step 1: Validate
-    emitProgress(req, { phase: 'validate', message: 'Validating migration request', percent: 0 });
-    if (!req.from || !req.to) {
-        throw new HazoError({ code: 'HAZO_ENV_INVALID_REQUEST', pkg: 'hazo_env', message: 'Migration requires both from and to environments.' });
-    }
-    if (req.from === req.to) {
-        throw new HazoError({ code: 'HAZO_ENV_INVALID_REQUEST', pkg: 'hazo_env', message: `Source and target environments must differ (got "${req.from}" for both).` });
-    }
-    const toRole = getEnvRole(req.to);
-    if (toRole === 'production' && !req.allowProdTarget) {
-        throw new HazoError({
-            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
-            pkg: 'hazo_env',
-            message: `Refusing to migrate to production environment "${req.to}". Pass allowProdTarget:true and a confirmToken to override.`,
-        });
-    }
-    if (toRole === 'production' && req.allowProdTarget && !req.confirmToken) {
-        throw new HazoError({
-            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
-            pkg: 'hazo_env',
-            message: 'Production target requires a confirmToken for safety.',
-        });
-    }
-    const fromDbConfig = resolveConnectConfig({ env: req.from, allowOtherEnv: true });
-    const toDbConfig = resolveConnectConfig({ env: req.to, allowOtherEnv: true });
-    resolveTransport(fromDbConfig, toDbConfig, req.transport);
-    const includeDb = req.include?.db ?? true;
-    const includeFiles = req.include?.files ?? true;
-    const scrubMode = req.scrub ?? 'auto';
-    // Step 2: Snapshot target
-    emitProgress(req, { phase: 'snapshot', message: 'Taking snapshot of target', percent: 5 });
-    const snapshot = takeSnapshot(toDbConfig);
-    // Step 3: Plan (dry-run stops here)
-    emitProgress(req, { phase: 'plan', message: 'Building migration plan', percent: 10 });
-    if (req.dryRun) {
-        return {
-            ok: true,
-            snapshotId: snapshot.snapshotId,
-            db: includeDb ? { tables: 0, rows: 0, scrubbed: 0 } : undefined,
-            files: includeFiles ? { copied: 0, bytes: 0, placeholdered: 0 } : undefined,
-            warnings: ['dry-run: no changes made'],
-            durationMs: Date.now() - startMs,
-        };
-    }
-    // Create adapters
-    function makeAdapter(dbConfig, readOnly = false) {
-        if (dbConfig.type === 'sqlite') {
-            if (!dbConfig.sqlite) {
-                throw new HazoError({
-                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
-                    pkg: 'hazo_env',
-                    message: 'SQLite config missing database_path.',
-                });
-            }
-            return connect.createHazoConnect({
-                type: 'sqlite',
-                sqlite: {
-                    database_path: dbConfig.sqlite.database_path,
-                    read_only: readOnly,
-                    driver: getSqliteDriver(),
-                },
-            });
-        }
-        if (dbConfig.type === 'postgrest') {
-            if (!dbConfig.postgrest) {
-                throw new HazoError({
-                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
-                    pkg: 'hazo_env',
-                    message: 'PostgREST config missing base_url/api_key.',
-                });
-            }
-            return connect.createHazoConnect({
-                type: 'postgrest',
-                postgrest: {
-                    base_url: dbConfig.postgrest.base_url,
-                    api_key: dbConfig.postgrest.api_key,
-                },
-            });
-        }
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: `Migration is not implemented for DB type "${dbConfig.type}".`,
-        });
-    }
-    const srcAdapter = makeAdapter(fromDbConfig, true);
-    const tgtAdapter = makeAdapter(toDbConfig, false);
-    // Step 4: Schema parity (checked inside copyDb)
-    emitProgress(req, { phase: 'schema-check', message: 'Checking schema parity', percent: 15 });
-    let dbResult;
-    let filesResult;
-    const migrateConfig = resolveMigrateConfig();
-    // Step 5: DB copy
-    if (includeDb) {
-        emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
-        if (req.transport === 'dump-restore') {
-            const { resolveBackupConfig } = await import('../resolve/backup.js');
-            const { restoreDbViaDump } = await import('./db-dump-restore.js');
-            const backup = resolveBackupConfig(req.to);
-            if (!backup) {
-                throw new HazoError({
-                    code: 'HAZO_ENV_INVALID_REQUEST',
-                    pkg: 'hazo_env',
-                    message: `[backup.${req.to}] config section is required for dump-restore transport`,
-                });
-            }
-            dbResult = await restoreDbViaDump(backup, {
-                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
-            });
-            emitProgress(req, { phase: 'db', message: 'DB restore via dump complete', percent: 70 });
-        }
-        else {
-            const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
-            const result = await copyDb(srcAdapter, tgtAdapter, {
-                type: fromDbConfig.type,
-                tables: resolveTableList(req.tables, migrateConfig.tables),
-                preserve: migrateConfig.preserve,
-                pkOverrides: migrateConfig.pkOverrides,
-                scrubHook,
-                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
-                onTableProgress: (idx, total, name) => emitProgress(req, {
-                    phase: 'db',
-                    message: `table ${idx}/${total}: ${name}`,
-                    percent: 20 + Math.round((idx / total) * 50),
-                }),
-            });
-            dbResult = result;
-            emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
-        }
-    }
-    // Step 6: File copy
-    if (includeFiles) {
-        emitProgress(req, { phase: 'files', message: 'Copying files', percent: 72 });
-        const result = await copyFiles({
-            fromEnv: req.from,
-            toEnv: req.to,
-            onProgress: (msg) => emitProgress(req, { phase: 'files', message: msg }),
-        });
-        filesResult = result;
-    }
-    // Step 7: Verify
-    emitProgress(req, { phase: 'verify', message: 'Running post-migration verification', percent: 80 });
-    const dataRoot = resolveFilesConfig().local.basePath;
-    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true, adapter: tgtAdapter });
-    if (!verifyReport.ok) {
-        const parts = [];
-        if (verifyReport.missing.length)
-            parts.push(`missing=${verifyReport.missing.length}`);
-        if (verifyReport.sizeMismatch.length)
-            parts.push(`sizeMismatch=${verifyReport.sizeMismatch.length}`);
-        if (verifyReport.hashMismatch.length)
-            parts.push(`hashMismatch=${verifyReport.hashMismatch.length}`);
-        warnings.push(`Verify found issues (${parts.join(', ')}) — migration continues; snapshotId=${snapshot.snapshotId}`);
-    }
-    // Step 8: Finalize — audit
-    emitProgress(req, { phase: 'finalize', message: 'Recording audit event', percent: 95 });
-    await auditMigration(tgtAdapter, {
-        from: req.from,
-        to: req.to,
-        scrub: scrubMode,
-        db: dbResult,
-        files: filesResult ? { copied: filesResult.copied, bytes: filesResult.bytes } : undefined,
-        verify: { ok: verifyReport.ok, checked: verifyReport.checked },
-    });
-    emitProgress(req, { phase: 'done', message: 'Migration complete', percent: 100 });
-    return {
-        ok: true,
-        snapshotId: snapshot.snapshotId,
-        db: dbResult,
-        files: filesResult,
-        warnings,
-        durationMs: Date.now() - startMs,
-    };
-}

package/dist/migrate/snapshot.d.ts

@@ -1,8 +0,0 @@
-import type { DbEnvConfig } from '../types/index.js';
-export interface SnapshotResult {
-    snapshotId: string;
-    createdAt: string;
-}
-export declare function takeSnapshot(toConfig: DbEnvConfig): SnapshotResult;
-export declare function restoreSnapshot(toConfig: DbEnvConfig, snapshotId: string): void;
-//# sourceMappingURL=snapshot.d.ts.map

package/dist/migrate/snapshot.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAsBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}

package/dist/migrate/snapshot.js

@@ -1,51 +0,0 @@
-// hazo_env/src/migrate/snapshot.ts — SQLite file-copy snapshot
-import fs from 'node:fs';
-import path from 'node:path';
-import { HazoError } from 'hazo_core';
-export function takeSnapshot(toConfig) {
-    if (toConfig.type === 'postgrest') {
-        return { snapshotId: 'postgrest:no-snapshot', createdAt: new Date().toISOString() };
-    }
-    if (toConfig.type !== 'sqlite' || !toConfig.sqlite?.database_path) {
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: 'Snapshot is only supported for SQLite databases.',
-        });
-    }
-    const srcPath = toConfig.sqlite.database_path;
-    if (!fs.existsSync(srcPath)) {
-        // No DB yet — snapshot is a no-op, return a virtual ID
-        return { snapshotId: `no-db:${srcPath}`, createdAt: new Date().toISOString() };
-    }
-    const snapshotDir = path.join(path.dirname(srcPath), 'snapshots');
-    fs.mkdirSync(snapshotDir, { recursive: true });
-    const ts = new Date().toISOString().replace(/[:.]/g, '-');
-    const snapshotPath = path.join(snapshotDir, `pre-migrate-${ts}.sqlite`);
-    fs.copyFileSync(srcPath, snapshotPath);
-    return { snapshotId: snapshotPath, createdAt: new Date().toISOString() };
-}
-export function restoreSnapshot(toConfig, snapshotId) {
-    if (toConfig.type !== 'sqlite' || !toConfig.sqlite?.database_path) {
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: 'Restore is only supported for SQLite databases.',
-        });
-    }
-    if (snapshotId.startsWith('no-db:')) {
-        throw new HazoError({
-            code: 'HAZO_ENV_SNAPSHOT_NOT_FOUND',
-            pkg: 'hazo_env',
-            message: 'Cannot restore: snapshot was taken when no database existed.',
-        });
-    }
-    if (!fs.existsSync(snapshotId)) {
-        throw new HazoError({
-            code: 'HAZO_ENV_SNAPSHOT_NOT_FOUND',
-            pkg: 'hazo_env',
-            message: `Snapshot file not found: ${snapshotId}`,
-        });
-    }
-    fs.copyFileSync(snapshotId, toConfig.sqlite.database_path);
-}

package/dist/migrate/transport.d.ts

@@ -1,3 +0,0 @@
-import type { TransportMode, DbEnvConfig } from '../types/index.js';
-export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync' | 'dump-restore';
-//# sourceMappingURL=transport.d.ts.map

package/dist/migrate/transport.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAO5C"}

package/dist/migrate/transport.js

@@ -1,12 +0,0 @@
-export function resolveTransport(fromConfig, toConfig, requested = 'auto') {
-    if (requested === 'dump-restore')
-        return 'dump-restore';
-    if (requested === 'ssh')
-        return 'rsync';
-    if (requested === 'api')
-        return 'api';
-    // auto: both sqlite → local
-    if (fromConfig.type === 'sqlite' && toConfig.type === 'sqlite')
-        return 'local';
-    return 'api';
-}

package/dist/migrate/verify.d.ts

@@ -1,9 +0,0 @@
-import type { HazoEnv, VerifyReport, HashMode } from '../types/index.js';
-export interface VerifyOptions {
-    hash?: HashMode;
-    samplePct?: number;
-    checkOrphans?: boolean;
-    adapter?: import('hazo_connect').HazoConnectAdapter;
-}
-export declare function verifyFiles(env: HazoEnv, dataRoot: string, opts?: VerifyOptions): Promise<VerifyReport>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/migrate/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;CACrD;AAqBD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA8IvB"}

package/dist/migrate/verify.js

@@ -1,141 +0,0 @@
-// hazo_env/src/migrate/verify.ts — post-migration file verification
-import fs from 'node:fs';
-import path from 'node:path';
-import { optional_import } from 'hazo_core';
-function resolveEnvFilesRoot(env, dataRoot) {
-    return path.join(dataRoot, env, 'files');
-}
-function walkDir(dir) {
-    if (!fs.existsSync(dir))
-        return [];
-    return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-        const absPath = path.join(dir, entry.name);
-        if (entry.isDirectory())
-            return walkDir(absPath);
-        // Return relative to dir's parent so caller can strip filesRoot prefix
-        return [absPath];
-    });
-}
-function walkRelative(filesRoot) {
-    const abs = walkDir(filesRoot);
-    return abs.map((p) => p.slice(filesRoot.length + 1)); // strip filesRoot + sep
-}
-export async function verifyFiles(env, dataRoot, opts = {}) {
-    const { hash = 'sample', checkOrphans = true, adapter } = opts;
-    const filesRoot = resolveEnvFilesRoot(env, dataRoot);
-    const missing = [];
-    const sizeMismatch = [];
-    const hashMismatch = [];
-    const orphans = [];
-    let checked = 0;
-    let hashed;
-    // Layer 1: sentinel — filesRoot must exist and be readable
-    const sentinelOk = fs.existsSync(filesRoot);
-    if (!sentinelOk) {
-        return { ok: false, checked: 0, missing: [], sizeMismatch: [], hashMismatch: [], orphans: [], sentinelOk: false };
-    }
-    // S3: Fallback detection — need both hazo_files module and an adapter
-    const hazoFiles = await optional_import('hazo_files');
-    if (!hazoFiles || !adapter) {
-        // Disk-only fallback
-        const diskFiles = walkRelative(filesRoot);
-        checked = diskFiles.length;
-        const skippedReason = 'no hazo_files tracking — size/hash/orphan skipped';
-        const ok = sentinelOk && missing.length === 0;
-        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
-    }
-    // Main path: adapter + hazo_files available
-    const connectMod = await optional_import('hazo_connect/server');
-    let rows = [];
-    let skippedReason;
-    try {
-        if (!connectMod)
-            throw new Error('hazo_connect not available');
-        const service = connectMod.createCrudService(adapter, 'hazo_files');
-        const all = await service.list();
-        rows = all.filter((r) => !r.storage_type || r.storage_type === 'local');
-    }
-    catch {
-        // Table not found or connect unavailable — disk-only fallback
-        const diskFiles = walkRelative(filesRoot);
-        checked = diskFiles.length;
-        skippedReason = 'hazo_files table not found — disk-only fallback';
-        const ok = sentinelOk && missing.length === 0;
-        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
-    }
-    // Normalize DB paths: strip leading slash if present
-    const normalizeDbPath = (p) => p.startsWith('/') ? p.slice(1) : p;
-    const dbPathSet = new Set(rows.map((r) => normalizeDbPath(r.file_path)));
-    // Track present rows for hash/size checks
-    const presentRows = [];
-    // L2 Existence
-    for (const row of rows) {
-        const relPath = normalizeDbPath(row.file_path);
-        const absPath = path.join(filesRoot, relPath);
-        if (!fs.existsSync(absPath)) {
-            missing.push(row.file_path);
-        }
-        else {
-            presentRows.push({ ...row, file_path: relPath });
-        }
-    }
-    // L3 Size
-    for (const row of presentRows) {
-        const absPath = path.join(filesRoot, row.file_path);
-        const stat = fs.statSync(absPath);
-        if (row.file_size != null && stat.size !== row.file_size) {
-            sizeMismatch.push(row.file_path);
-        }
-        checked++;
-    }
-    // L4 Hash
-    if (hash !== 'none') {
-        let toHash;
-        if (hash === 'full') {
-            toHash = presentRows;
-        }
-        else {
-            // sample: 1% random (min 1) + top 10 by file_size DESC + top 10 by file_changed_at DESC
-            const n = Math.max(1, Math.floor(presentRows.length * 0.01));
-            const shuffled = [...presentRows].sort(() => Math.random() - 0.5).slice(0, n);
-            const bySize = [...presentRows]
-                .filter((r) => r.file_size != null)
-                .sort((a, b) => (b.file_size ?? 0) - (a.file_size ?? 0))
-                .slice(0, 10);
-            const byChanged = [...presentRows]
-                .filter((r) => r.file_changed_at != null)
-                .sort((a, b) => (b.file_changed_at ?? '') < (a.file_changed_at ?? '') ? -1 : 1)
-                .slice(0, 10);
-            // Deduplicate by file_path
-            const seen = new Set();
-            toHash = [];
-            for (const r of [...shuffled, ...bySize, ...byChanged]) {
-                if (!seen.has(r.file_path)) {
-                    seen.add(r.file_path);
-                    toHash.push(r);
-                }
-            }
-        }
-        hashed = 0;
-        for (const row of toHash) {
-            const absPath = path.join(filesRoot, row.file_path);
-            const buf = fs.readFileSync(absPath);
-            const computed = hazoFiles.computeFileHashSync(buf);
-            if (row.file_hash && computed !== row.file_hash) {
-                hashMismatch.push(row.file_path);
-            }
-            hashed++;
-        }
-    }
-    // L5 Orphans
-    if (checkOrphans) {
-        const diskFiles = walkRelative(filesRoot);
-        for (const diskRel of diskFiles) {
-            if (!dbPathSet.has(diskRel)) {
-                orphans.push(diskRel);
-            }
-        }
-    }
-    const ok = sentinelOk && missing.length === 0 && sizeMismatch.length === 0 && hashMismatch.length === 0;
-    return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, hashed, skippedReason };
-}

package/dist/resolve/backup.d.ts

@@ -1,23 +0,0 @@
-export interface BackupConfig {
-    /** Which [transport.ssh.*] connection to reuse for the SSH session */
-    ssh_env: string;
-    /** The Postgres database to drop/recreate on the remote */
-    target_db: string;
-    /** Owner passed to createdb -O */
-    owner: string;
-    /** Glob matching an existing dump file, or the literal string "fresh" */
-    dump_source: string;
-    /** Source DB for pg_dump — required when dump_source === 'fresh' */
-    fresh_dump_db?: string;
-    /** Shell command to run on the remote before dropping/restoring the DB */
-    pre_restore_cmd?: string;
-    /** Shell command to run on the remote after a successful restore */
-    post_restore_cmd?: string;
-}
-/**
- * Resolve the [backup.<env>] section from hazo_env_config.ini.
- * Returns null when the section is missing (transport not configured).
- * Throws when required fields are absent or ssh_env is unsafe.
- */
-export declare function resolveBackupConfig(env: string): BackupConfig | null;
-//# sourceMappingURL=backup.d.ts.map

package/dist/resolve/backup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/resolve/backup.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAcD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA8BpE"}

package/dist/resolve/backup.js

@@ -1,52 +0,0 @@
-// hazo_env/src/resolve/backup.ts — dump-restore backup transport config resolver
-//
-// Reads [backup.<env>] from config/hazo_env_config.ini and returns a BackupConfig,
-// or null when the section is absent (transport not configured for that env).
-import path from 'node:path';
-import { HazoConfig } from 'hazo_config/server';
-import { assertSafeSshField } from '../migrate/ssh-exec.js';
-function tryLoadEnvConfig() {
-    try {
-        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
-    }
-    catch {
-        return null;
-    }
-}
-function expandEnvVars(value) {
-    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
-}
-/**
- * Resolve the [backup.<env>] section from hazo_env_config.ini.
- * Returns null when the section is missing (transport not configured).
- * Throws when required fields are absent or ssh_env is unsafe.
- */
-export function resolveBackupConfig(env) {
-    const config = tryLoadEnvConfig();
-    if (!config)
-        return null;
-    const section = config.getSection(`backup.${env}`);
-    if (!section)
-        return null;
-    const ssh_env_raw = section['ssh_env'];
-    const target_db_raw = section['target_db'];
-    const owner_raw = section['owner'];
-    const dump_source_raw = section['dump_source'];
-    const fresh_dump_db_raw = section['fresh_dump_db'];
-    const pre_restore_cmd_raw = section['pre_restore_cmd'];
-    const post_restore_cmd_raw = section['post_restore_cmd'];
-    if (!ssh_env_raw || !target_db_raw || !owner_raw || !dump_source_raw)
-        return null;
-    const ssh_env = expandEnvVars(ssh_env_raw);
-    // ssh_env is used as an SSH argument — must not contain shell-hostile chars
-    assertSafeSshField('ssh_env', ssh_env);
-    return {
-        ssh_env,
-        target_db: expandEnvVars(target_db_raw),
-        owner: expandEnvVars(owner_raw),
-        dump_source: expandEnvVars(dump_source_raw),
-        fresh_dump_db: fresh_dump_db_raw ? expandEnvVars(fresh_dump_db_raw) : undefined,
-        pre_restore_cmd: pre_restore_cmd_raw ? expandEnvVars(pre_restore_cmd_raw) : undefined,
-        post_restore_cmd: post_restore_cmd_raw ? expandEnvVars(post_restore_cmd_raw) : undefined,
-    };
-}

package/dist/resolve/migrate.d.ts

@@ -1,3 +0,0 @@
-import type { MigrateConfig } from '../types/index.js';
-export declare function resolveMigrateConfig(): MigrateConfig;
-//# sourceMappingURL=migrate.d.ts.map

package/dist/resolve/migrate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/resolve/migrate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,wBAAgB,oBAAoB,IAAI,aAAa,CA2BpD"}

package/dist/resolve/migrate.js

@@ -1,29 +0,0 @@
-// hazo_env/src/resolve/migrate.ts — read [migrate] section from hazo_env_config.ini
-import path from 'node:path';
-import { HazoConfig } from 'hazo_config/server';
-export function resolveMigrateConfig() {
-    try {
-        const filePath = path.resolve(process.cwd(), 'config', 'hazo_env_config.ini');
-        const config = new HazoConfig({ filePath });
-        const section = config.getSection('migrate');
-        if (!section)
-            return {};
-        const tables = section['tables']
-            ? section['tables'].split(',').map((t) => t.trim()).filter(Boolean)
-            : undefined;
-        const preserve = section['preserve']
-            ? section['preserve'].split(',').map((t) => t.trim()).filter(Boolean)
-            : undefined;
-        // Parse per-table pk overrides: keys like "pk.some_table = custom_col"
-        const pkOverrides = {};
-        for (const [k, v] of Object.entries(section)) {
-            if (k.startsWith('pk.') && typeof v === 'string') {
-                pkOverrides[k.slice(3)] = v.trim();
-            }
-        }
-        return { tables, preserve, ...(Object.keys(pkOverrides).length ? { pkOverrides } : {}) };
-    }
-    catch {
-        return {};
-    }
-}