hazo_env 0.2.0 → 0.3.0

package/CHANGE_LOG.md

@@ -1,5 +1,31 @@
 # hazo_env — Change Log
 
+## 0.3.0 — 2026-06-10
+
+### Added
+- `EnvRoleMap` type (`Record<string, HazoEnvRole>`) in `src/types/index.ts`
+- `roles?: EnvRoleMap` optional field on `EnvDescription` interface
+- `getRoleMap()` client + server: config-driven role map; merges `DEFAULT_ROLE_MAP` → `globalThis.__HAZO_ENV_ROLES__` (client) → `[env.roles]` INI section (server); invalid role values skipped silently
+- `[env.roles]` INI section support: arbitrary env names mapped to the four fixed roles (`development`, `test`, `staging`, `production`)
+- `describeEnv()` server version now includes `roles` field
+- Filesystem progress store: `writeMigrationProgress`, `readMigrationProgress`, `clearMigrationProgress` (`src/migrate/progress.ts`)
+- `MigrationRequest.jobId` + `MigrationRequest.progressDir` optional fields — when both present, `runMigration` writes each progress event to `<progressDir>/<jobId>.json`
+- `loadRuleset`, `syncRulesetFromIni`, `parseIniRules` masking ruleset functions now exported from package index
+- `MaskRule` type now exported from package index
+- `normalize()` utility now exported from package index (trim + lowercase env name string)
+
+### Changed
+- `getEnvRole()` rewritten to be config-driven via role map; unknown env names now default to `'development'` instead of `'production'` — this is a safe behavior fix (unknown names no longer silently get production-level protection)
+
+## 0.2.0 — 2026-06-09
+
+- feat: M2 migration engine — `runMigration`, `verifyFiles`, `takeSnapshot`, `restoreSnapshot`
+- feat: M3 PII masking — `registerMask`, built-in transforms (`mask_email`, `fake_name`, `mask_phone`, `jitter_date`, `hash`, `tokenize`, `drop`, `nullify`, `redact_pii`)
+- feat: masking ruleset management — `loadRuleset`, `syncRulesetFromIni`, `parseIniRules`, `MaskRule` (not yet exported from index — fixed in 0.3.0)
+- feat: `MaskTransform` type in `src/types/index.ts`
+- feat: CLI commands `migrate`, `verify`, `restore`, `mask sync`, `mask list`
+- chore: version bump to 0.2.0
+
 ## 0.1.1 — 2026-06-09
 
 - fix: provision `sql-wasm.wasm` into test-app `public/` via seed script (fixes Connect page error when SQLite adapter loads via sql.js WASM)

package/README.md

@@ -9,7 +9,7 @@ Canonical environment resolver for hazo apps. Typed env names, per-env DB/file/s
 - **Per-env file config** — `resolveFilesConfig()` maps the current env to a `hazo_files` config rooted at the declared `data_root`.
 - **Secrets** — `getSecret()` resolves from `.env.local` only; placeholders in `hazo_env_config.ini` are substituted at runtime without storing secrets.
 - **Migration engine** — `runMigration({ from, to })` copies a DB + files between envs. Validates → snapshots target → copies tables (paged, schema-checked) → copies files → verifies → writes hazo_audit entry. Prod target refused without an explicit confirm token.
-- **PII masking** — masking rules declared per table/column in `hazo_env_masking.ini` (seed) and synced to `hazo_app_config` at runtime. Built-in transforms: `mask_email`, `fake_name`, `mask_phone`, `jitter_date`, `hash`, `tokenize`, `drop`, `nullify`. Custom transforms via `registerMask()`. Applied automatically when the migration target role is `testing` or `staging`.
+- **PII masking** — masking rules declared per table/column in `hazo_env_masking.ini` (seed) and synced to `hazo_app_config` at runtime. Built-in transforms: `mask_email`, `fake_name`, `mask_phone`, `jitter_date`, `hash`, `tokenize`, `drop`, `nullify`. Custom transforms via `registerMask()`. Applied automatically when the migration target role is `test` or `staging`.
 - **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, and schema level.
 - **CLI** — `hazo-env current | doctor | snapshot | migrate | verify | restore | mask`.
 
@@ -64,18 +64,67 @@ const adapter = await createHazoConnect(resolveConnectConfig());
 ### Env resolution (client-safe — also in `hazo_env/client`)
 
 ```ts
-import { getEnv, getEnvRole, getPattern, listEnvs, assertEnv, describeEnv,
+import { getEnv, getEnvRole, getRoleMap, getPattern, listEnvs, assertEnv, describeEnv,
          isDev, isTest, isStaging, isProd } from 'hazo_env';
 
 getEnv()        // 'dev' | 'test' | 'staging' | 'prod'
-getEnvRole()    // 'development' | 'testing' | 'staging' | 'production'
+getEnvRole()    // 'development' | 'test' | 'staging' | 'production'
+getRoleMap()    // EnvRoleMap — full env→role mapping (config-driven; safe defaults)
 getPattern()    // e.g. 'dev_prod'
 listEnvs()      // ['dev', 'prod'] — valid envs for the declared pattern
 assertEnv()     // throws HazoError(ENV_INVALID) if HAZO_ENV is outside the pattern
-describeEnv()   // { env, role }
+describeEnv()   // { env, role, pattern, app, dataRoot, hostHint, roles? }
 isDev() / isTest() / isStaging() / isProd()
 ```
 
+`getEnvRole()` uses a config-driven role map so custom env names (e.g. `preview`, `qa`) resolve to the correct broad role. Unknown names default to `'development'` — never silently treated as production. Configure custom mappings in `[env.roles]`:
+
+```ini
+[env.roles]
+preview = staging
+qa      = test
+```
+
+### Configuring environment roles
+
+Canonical env names (`dev`, `test`, `staging`, `prod`) are pre-mapped and require no configuration. Non-canonical names (anything else) must declare their role in the `[env.roles]` INI section, or `doctor` will flag an error. Unknown names without a declaration fall back to `'development'` (safe: no masking, no prod-protection).
+
+```ini
+[env.roles]
+; Map arbitrary env names to the four fixed roles:
+;   development | test | staging | production
+qa   = test
+live = production
+rc   = staging
+```
+
+Valid role values: `development`, `test`, `staging`, `production`.
+
+#### Client-side global injection
+
+On the client (browser), the INI file is not available. Inject the resolved values at render time using `globalThis` globals — the same pattern used for the env pattern:
+
+```ts
+// In your Next.js layout server component or _app (server-side):
+// globalThis.__HAZO_ENV_PATTERN__ = 'dev,prod';                  // comma-separated pattern
+// globalThis.__HAZO_ENV_ROLES__   = { live: 'production', qa: 'test' };
+
+// Client bundle reads these automatically:
+import { getPattern, getRoleMap } from 'hazo_env/client';
+getPattern()   // reads __HAZO_ENV_PATTERN__
+getRoleMap()   // merges DEFAULT_ROLE_MAP → __HAZO_ENV_ROLES__
+```
+
+Both globals are optional; omitting them makes the client fall back to canonical defaults.
+
+### Utility
+
+```ts
+import { normalize } from 'hazo_env';
+
+normalize('  Dev ')  // → 'dev'  (trim + lowercase)
+```
+
 ### Resolvers (server-only)
 
 ```ts
@@ -106,7 +155,8 @@ const report = await doctor();
 ### Migration engine (server-only)
 
 ```ts
-import { runMigration, verifyFiles, takeSnapshot, restoreSnapshot } from 'hazo_env';
+import { runMigration, verifyFiles, takeSnapshot, restoreSnapshot,
+         writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from 'hazo_env';
 
 // Copy prod → staging (with PII masking applied automatically)
 const result = await runMigration({
@@ -116,6 +166,8 @@ const result = await runMigration({
   // allowProdTarget: true,              // required when `to` is 'prod'
   // confirmToken: '<token>',            // required together with allowProdTarget
   onProgress: (p) => console.log(p.phase, p.message),
+  // jobId: '<id>',                      // optional — persist progress to progressDir/<id>.json
+  // progressDir: '/tmp/hazo_jobs',      // required when jobId is set
 });
 // result.ok, result.db, result.files, result.snapshotId, result.warnings, result.durationMs
 
@@ -125,10 +177,26 @@ await verifyFiles('staging', dataRoot, { hash: 'sample' });
 // Manual snapshot / restore
 const snap = takeSnapshot(connectConfig);   // returns { snapshotId }
 restoreSnapshot(connectConfig, snapshotId);
+
+// Filesystem progress store (used by hazo_jobs integration)
+writeMigrationProgress(dir, jobId, progress);
+readMigrationProgress(dir, jobId);    // → MigrationProgress | null
+clearMigrationProgress(dir, jobId);
 ```
 
 **Masking** — customize per table/column in `config/hazo_env_masking.ini`. Sync to the DB with `hazo-env mask sync`. Register custom transforms with `registerMask(name, fn)`.
 
+**Masking ruleset API** — load, parse, and sync rulesets programmatically:
+
+```ts
+import { loadRuleset, syncRulesetFromIni, parseIniRules } from 'hazo_env';
+import type { MaskRule } from 'hazo_env';
+
+const rules: MaskRule[] = parseIniRules(iniText);           // parse INI text → rules array
+const loaded  = await loadRuleset(adapter);                 // read from hazo_app_config DB
+await syncRulesetFromIni(adapter, '/path/to/masking.ini'); // write parsed rules to DB
+```
+
 ## CLI
 
 ```
@@ -163,12 +231,6 @@ Key sections:
 
 Secret placeholders use `${ENV_VAR_NAME}` syntax — hazo_env substitutes them from `.env.local` at runtime.
 
-## Tailwind v4 (`@source` required if consuming UI)
-
-```css
-@source "../node_modules/hazo_env/dist";
-```
-
 ## License
 
 MIT

package/SETUP_CHECKLIST.md

@@ -33,6 +33,16 @@ api_key  = ${POSTGREST_API_KEY}
 
 **Never put secret values directly in the ini file** — use `${ENV_VAR_NAME}` placeholders.
 
+**Custom env names** — if your pattern uses names other than `dev`/`test`/`staging`/`prod` (e.g. `preview`, `qa`), add an `[env.roles]` section to map them to broad roles:
+
+```ini
+[env.roles]
+preview = staging
+qa      = testing
+```
+
+Without this, unknown env names default to `'development'` role (never silently production).
+
 ## 3. Create `.env.local` (gitignored)
 
 One file per deployment (dev machine, staging host, prod host). Contains the secrets referenced by `${…}` placeholders in the ini:
@@ -137,3 +147,19 @@ Review row counts and scrub counts before running without `--dry-run`. The migra
 ```bash
 npx hazo-env restore staging --snapshot <snapshot-id>
 ```
+
+## 10. (Required for non-canonical env names) Declare roles in `[env.roles]`
+
+If your pattern uses any env name other than `dev`, `test`, `staging`, or `prod` (e.g. `qa`, `preview`, `live`, `rc`), add an `[env.roles]` section to `config/hazo_env_config.ini` to map each name to one of the four fixed roles:
+
+```ini
+[env.roles]
+qa      = test
+preview = staging
+live    = production
+rc      = staging
+```
+
+Valid role values: `development`, `test`, `staging`, `production`.
+
+Without this declaration, undeclared non-canonical names default to `'development'` (safe — no masking, no prod-protection) **and `hazo-env doctor` will flag an error** until the mapping is added. Run `npx hazo-env doctor` to verify all env names have a declared role.

package/config/hazo_env_config.ini.sample

@@ -10,6 +10,22 @@ pattern = dev, test, staging, prod
 ; Application name (used in log output and doctor reports)
 app = myapp
 
+; ─── Environment role map ─────────────────────────────────────────────────────
+; Map each environment NAME to one of the four fixed ROLES.
+; Roles drive behavior: masking fires for test+staging roles;
+; prod-protection fires for the production role.
+; The four canonical names default automatically — list them only to be explicit.
+; Non-canonical names MUST be declared here or doctor will flag an error
+; and the role will default to 'development' (safe but unintended).
+[env.roles]
+; dev = development     (default — no declaration needed)
+; test = test           (default)
+; staging = staging     (default)
+; prod = production     (default)
+qa = test
+preview = staging
+; live = production     (example: a production env with a different name)
+
 [data]
 ; Base directory for all local file storage (relative to app root or absolute)
 ; Default: app_data

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // hazo_env/src/cli.ts — CLI entry: hazo-env current | doctor | snapshot | migrate | verify | restore
 import pc from 'picocolors';
-import { getEnv, getEnvRole } from './index.client.js';
-import { describeEnv } from './env.server.js';
+import { getEnv } from './index.client.js';
+import { describeEnv, getEnvRole, getPattern } from './env.server.js';
 import { doctor } from './doctor.js';
 const [, , command, ...args] = process.argv;
 function statusIcon(status) {
@@ -20,7 +20,7 @@ async function runCurrent() {
     catch {
         // Fallback if no config file
         const env = getEnv();
-        desc = { env, role: getEnvRole(env), pattern: ['dev', 'test', 'staging', 'prod'], app: '', dataRoot: '(config not found)', hostHint: 'unknown' };
+        desc = { env, role: getEnvRole(env), pattern: getPattern(), app: '', dataRoot: '(config not found)', hostHint: 'unknown' };
     }
     console.log(`\n${pc.bold('hazo-env current')}\n`);
     console.log(`  env:       ${pc.bold(desc.env)}`);

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA+I5E"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2J5E"}

package/dist/doctor.js

@@ -4,9 +4,11 @@ import path from 'node:path';
 import { HazoConfig } from 'hazo_config/server';
 import { optional_import } from 'hazo_core';
 import { getEnv } from './index.client.js';
-import { listEnvs } from './env.server.js';
+import { listEnvs, getEnvRole, getRoleMap } from './env.server.js';
 import { resolveConnectConfig } from './resolve/connect.js';
 import { resolveFilesConfig } from './resolve/files.js';
+// Canonical env names that have built-in role defaults — no [env.roles] entry required
+const CANONICAL_ENV_NAMES = new Set(['dev', 'test', 'staging', 'prod']);
 function findConfigFile(pkg) {
     return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
 }
@@ -110,8 +112,7 @@ export async function doctor(opts = {}) {
     if (opts.probe) {
         for (const env of envsToCheck) {
             // Get role for this env to guard against touching prod unattended
-            const role = env === 'dev' ? 'development' : env === 'test' ? 'test'
-                : env === 'staging' ? 'staging' : 'production';
+            const role = getEnvRole(env);
             if (role === 'production' && !opts.all) {
                 checks.push({
                     label: `DB probe [db.${env}]`,
@@ -153,6 +154,18 @@ export async function doctor(opts = {}) {
             }
         }
     }
+    // 6. Check that every env in the pattern has an explicit or canonical role mapping
+    const roleMap = getRoleMap();
+    const allEnvs = listEnvs();
+    for (const env of allEnvs) {
+        if (!CANONICAL_ENV_NAMES.has(env) && !(env in roleMap)) {
+            checks.push({
+                label: `Role for env '${env}'`,
+                status: 'error',
+                detail: `env '${env}' in pattern has no declared role in [env.roles]; defaulting to development`,
+            });
+        }
+    }
     const passed = checks.every((c) => c.status !== 'error');
     return { env: targetEnv, checks, passed };
 }

package/dist/env.server.d.ts

@@ -1,4 +1,10 @@
-import type { EnvPattern, EnvDescription } from './types/index.js';
+import type { EnvPattern, EnvDescription, EnvRoleMap, HazoEnv, HazoEnvRole } from './types/index.js';
+/**
+ * Get the role map, merging client defaults with any [env.roles] section from hazo_env_config.ini.
+ */
+export declare function getRoleMap(): EnvRoleMap;
+/** Get the broad role for the current environment (server-aware, reads INI) */
+export declare function getEnvRole(env?: HazoEnv): HazoEnvRole;
 /**
  * Get the declared env pattern from [env] pattern in hazo_env_config.ini.
  * Falls back to ['dev','test','staging','prod'] if the config is absent.

package/dist/env.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.server.d.ts","sourceRoot":"","sources":["../src/env.server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAY,MAAM,kBAAkB,CAAC;AAc7E;;;GAGG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAKvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,cAAc,CAW5C"}
+{"version":3,"file":"env.server.d.ts","sourceRoot":"","sources":["../src/env.server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAY,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgB/G;;GAEG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAYvC;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAGrD;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAKvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,cAAc,CAY5C"}

package/dist/env.server.js

@@ -2,7 +2,7 @@
 import path from 'node:path';
 import { HazoConfig } from 'hazo_config/server';
 import { HazoError } from 'hazo_core';
-import { getEnv, getEnvRole } from './index.client.js';
+import { getEnv, getRoleMap as clientGetRoleMap, normalize } from './index.client.js';
 function findConfigFile(pkg) {
     return path.resolve(process.cwd(), 'config', `${pkg}_config.ini`);
 }
@@ -14,6 +14,28 @@ function tryLoadConfig() {
         return null;
     }
 }
+const VALID_ROLES = new Set(['development', 'test', 'staging', 'production']);
+/**
+ * Get the role map, merging client defaults with any [env.roles] section from hazo_env_config.ini.
+ */
+export function getRoleMap() {
+    const config = tryLoadConfig();
+    const section = config?.getSection?.('env.roles') ?? {};
+    const out = { ...clientGetRoleMap() };
+    for (const [name, role] of Object.entries(section)) {
+        const r = String(role).trim();
+        if (VALID_ROLES.has(r)) {
+            out[name.trim()] = r;
+        }
+        // invalid values: skip silently (doctor will flag them)
+    }
+    return out;
+}
+/** Get the broad role for the current environment (server-aware, reads INI) */
+export function getEnvRole(env) {
+    const e = normalize(env ?? getEnv());
+    return getRoleMap()[e] ?? 'development';
+}
 /**
  * Get the declared env pattern from [env] pattern in hazo_env_config.ini.
  * Falls back to ['dev','test','staging','prod'] if the config is absent.
@@ -57,5 +79,6 @@ export function describeEnv() {
     const dataRoot = config?.getSection('data')?.['root'] ?? 'app_data';
     const locationRaw = config?.getSection(`host.${env}`)?.['location'] ?? 'unknown';
     const hostHint = locationRaw === 'local' ? 'local' : locationRaw === 'remote' ? 'remote' : 'unknown';
-    return { env, role, pattern, app, dataRoot, hostHint };
+    const roles = getRoleMap();
+    return { env, role, pattern, app, dataRoot, hostHint, roles };
 }

package/dist/index.client.d.ts

@@ -1,7 +1,11 @@
-import type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription } from './types/index.js';
-export type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription };
+import type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription, EnvRoleMap } from './types/index.js';
+export type { HazoEnv, HazoEnvRole, EnvPattern, EnvDescription, EnvRoleMap };
+/** Normalize raw env string to canonical form */
+export declare function normalize(raw: string): HazoEnv;
 /** Get the current environment name (normalized) */
 export declare function getEnv(): HazoEnv;
+/** Get the role map, merging any build-time injected overrides from __HAZO_ENV_ROLES__ */
+export declare function getRoleMap(): EnvRoleMap;
 /** Get the broad role for the current environment */
 export declare function getEnvRole(env?: HazoEnv): HazoEnvRole;
 export declare function isDev(env?: HazoEnv): boolean;

package/dist/index.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AASjE,oDAAoD;AACpD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAMrD;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA8C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAuC;AACrF,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA0C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA6C;AAE3F;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAMvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,MAAM,CAAC,CAGlE"}
+{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../src/index.client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrG,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAE7E,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAI9C;AAED,oDAAoD;AACpD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AASD,0FAA0F;AAC1F,wBAAgB,UAAU,IAAI,UAAU,CAIvC;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,CAGrD;AAED,wBAAgB,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA8C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAuC;AACrF,wBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA0C;AAC3F,wBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAA6C;AAE3F;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,UAAU,CAMvC;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,IAAI,UAAU,CAErC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,MAAM,CAAC,CAGlE"}

package/dist/index.client.js

@@ -1,7 +1,7 @@
 // hazo_env/src/index.client.ts — Client-safe entry point
 import { getCurrentEnv, HazoError } from 'hazo_core/client';
 /** Normalize raw env string to canonical form */
-function normalize(raw) {
+export function normalize(raw) {
     if (raw === 'development')
         return 'dev';
     if (raw === 'production')
@@ -12,16 +12,22 @@ function normalize(raw) {
 export function getEnv() {
     return normalize(getCurrentEnv());
 }
+const DEFAULT_ROLE_MAP = {
+    dev: 'development',
+    test: 'test',
+    staging: 'staging',
+    prod: 'production',
+};
+/** Get the role map, merging any build-time injected overrides from __HAZO_ENV_ROLES__ */
+export function getRoleMap() {
+    const g = globalThis;
+    const injected = g['__HAZO_ENV_ROLES__'];
+    return { ...DEFAULT_ROLE_MAP, ...(injected ?? {}) };
+}
 /** Get the broad role for the current environment */
 export function getEnvRole(env) {
-    const e = env ?? getEnv();
-    if (e === 'dev')
-        return 'development';
-    if (e === 'test')
-        return 'test';
-    if (e === 'staging')
-        return 'staging';
-    return 'production';
+    const e = normalize(env ?? getEnv());
+    return getRoleMap()[e] ?? 'development';
 }
 export function isDev(env) { return getEnvRole(env) === 'development'; }
 export function isTest(env) { return getEnvRole(env) === 'test'; }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 export * from './types/index.js';
 export * from './resolve/secrets.js';
 export * from './resolve/connect.js';
@@ -8,7 +8,10 @@ export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
 export { registerMask } from './mask/registry.js';
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
+export type { MaskRule } from './mask/ruleset.js';
 export type { MaskTransform } from './types/index.js';
 export * from './lib/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE/E,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,8 +1,8 @@
 // hazo_env/src/index.ts — Server entry point
 // Pure client helpers re-exported explicitly (getPattern/listEnvs/assertEnv/describeEnv are overridden below)
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
 // Server-aware overrides
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 // Types
 export * from './types/index.js';
 // Resolver + secrets
@@ -15,7 +15,10 @@ export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
 // Masking registry
 export { registerMask } from './mask/registry.js';
+// Masking ruleset
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
 // Lib
 export * from './lib/index.js';

package/dist/migrate/progress.d.ts

@@ -0,0 +1,5 @@
+import type { MigrationProgress } from '../types/index.js';
+export declare function writeMigrationProgress(progressDir: string, jobId: string, p: MigrationProgress): void;
+export declare function readMigrationProgress(progressDir: string, jobId: string): MigrationProgress | null;
+export declare function clearMigrationProgress(progressDir: string, jobId: string): void;
+//# sourceMappingURL=progress.d.ts.map

package/dist/migrate/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/migrate/progress.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAGrG;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQlG;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG/E"}

package/dist/migrate/progress.js

@@ -0,0 +1,24 @@
+// hazo_env/src/migrate/progress.ts — Filesystem-backed migration progress store
+import fs from 'node:fs';
+import path from 'node:path';
+export function writeMigrationProgress(progressDir, jobId, p) {
+    fs.mkdirSync(progressDir, { recursive: true });
+    fs.writeFileSync(path.join(progressDir, `${jobId}.json`), JSON.stringify(p), 'utf-8');
+}
+export function readMigrationProgress(progressDir, jobId) {
+    const filePath = path.join(progressDir, `${jobId}.json`);
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function clearMigrationProgress(progressDir, jobId) {
+    const filePath = path.join(progressDir, `${jobId}.json`);
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch { /* ignore */ }
+}

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AAgE3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAiJlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkJlF"}

package/dist/migrate/run.js

@@ -13,13 +13,13 @@ import { copyDb } from './db.js';
 import { copyFiles } from './files.js';
 import { verifyFiles } from './verify.js';
 import { auditMigration } from './audit.js';
-// Production roles that require explicit confirmation
-const PROD_ROLES = new Set(['prod', 'production']);
-function isProdEnv(env) {
-    return PROD_ROLES.has(env.toLowerCase());
-}
+import { writeMigrationProgress } from './progress.js';
+import { getEnvRole } from '../env.server.js';
 function emitProgress(req, p) {
     req.onProgress?.(p);
+    if (req.jobId && req.progressDir) {
+        writeMigrationProgress(req.progressDir, req.jobId, p);
+    }
 }
 // Resolve the SQLite driver — prefer better-sqlite3 in tests when env var is set
 function getSqliteDriver() {
@@ -29,9 +29,8 @@ function getSqliteDriver() {
 }
 async function buildScrubHook(toEnv, scrubMode, tgtAdapter) {
     const maskKey = process.env['HAZO_ENV_MASK_KEY'];
-    const shouldScrub = scrubMode !== 'none' &&
-        maskKey &&
-        (toEnv === 'test' || toEnv === 'staging');
+    const toRole = getEnvRole(toEnv);
+    const shouldScrub = scrubMode !== 'none' && !!maskKey && (toRole === 'test' || toRole === 'staging');
     if (!shouldScrub)
         return undefined;
     const { loadRuleset } = await import('../mask/ruleset.js');
@@ -85,14 +84,15 @@ export async function runMigration(req) {
     if (req.from === req.to) {
         throw new HazoError({ code: 'HAZO_ENV_INVALID_REQUEST', pkg: 'hazo_env', message: `Source and target environments must differ (got "${req.from}" for both).` });
     }
-    if (isProdEnv(req.to) && !req.allowProdTarget) {
+    const toRole = getEnvRole(req.to);
+    if (toRole === 'production' && !req.allowProdTarget) {
         throw new HazoError({
             code: 'HAZO_ENV_PROD_TARGET_REFUSED',
             pkg: 'hazo_env',
             message: `Refusing to migrate to production environment "${req.to}". Pass allowProdTarget:true and a confirmToken to override.`,
         });
     }
-    if (isProdEnv(req.to) && req.allowProdTarget && !req.confirmToken) {
+    if (toRole === 'production' && req.allowProdTarget && !req.confirmToken) {
         throw new HazoError({
             code: 'HAZO_ENV_PROD_TARGET_REFUSED',
             pkg: 'hazo_env',

package/dist/types/index.d.ts

@@ -4,6 +4,8 @@ export type HazoEnv = 'dev' | 'test' | 'staging' | 'prod' | string;
 export type HazoEnvRole = 'development' | 'test' | 'staging' | 'production';
 /** The set of valid environment names for this app, from [env] pattern in INI */
 export type EnvPattern = string[];
+/** Mapping of env name → broad role, for config-driven role resolution */
+export type EnvRoleMap = Record<string, HazoEnvRole>;
 /** Hint about where an environment runs */
 export type HostHint = 'local' | 'remote' | 'unknown';
 /** DB configuration for a single environment (from [db.<env>] in INI) */
@@ -34,6 +36,7 @@ export interface EnvDescription {
     app: string;
     dataRoot: string;
     hostHint: HostHint;
+    roles?: EnvRoleMap;
 }
 /** Options for resolveConnectConfig */
 export interface ResolveConnectOptions {
@@ -62,6 +65,8 @@ export interface MigrationRequest {
     allowProdTarget?: boolean;
     confirmToken?: string;
     onProgress?: (p: MigrationProgress) => void;
+    jobId?: string;
+    progressDir?: string;
 }
 export interface MigrationResult {
     ok: boolean;

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",