hazo_env 0.2.0 → 0.4.0

package/dist/index.client.js

@@ -1,7 +1,7 @@
 // hazo_env/src/index.client.ts — Client-safe entry point
 import { getCurrentEnv, HazoError } from 'hazo_core/client';
 /** Normalize raw env string to canonical form */
-function normalize(raw) {
+export function normalize(raw) {
     if (raw === 'development')
         return 'dev';
     if (raw === 'production')
@@ -12,16 +12,22 @@ function normalize(raw) {
 export function getEnv() {
     return normalize(getCurrentEnv());
 }
+const DEFAULT_ROLE_MAP = {
+    dev: 'development',
+    test: 'test',
+    staging: 'staging',
+    prod: 'production',
+};
+/** Get the role map, merging any build-time injected overrides from __HAZO_ENV_ROLES__ */
+export function getRoleMap() {
+    const g = globalThis;
+    const injected = g['__HAZO_ENV_ROLES__'];
+    return { ...DEFAULT_ROLE_MAP, ...(injected ?? {}) };
+}
 /** Get the broad role for the current environment */
 export function getEnvRole(env) {
-    const e = env ?? getEnv();
-    if (e === 'dev')
-        return 'development';
-    if (e === 'test')
-        return 'test';
-    if (e === 'staging')
-        return 'staging';
-    return 'production';
+    const e = normalize(env ?? getEnv());
+    return getRoleMap()[e] ?? 'development';
 }
 export function isDev(env) { return getEnvRole(env) === 'development'; }
 export function isTest(env) { return getEnvRole(env) === 'test'; }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 export * from './types/index.js';
 export * from './resolve/secrets.js';
 export * from './resolve/connect.js';
@@ -8,7 +8,10 @@ export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
 export { registerMask } from './mask/registry.js';
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
+export type { MaskRule } from './mask/ruleset.js';
 export type { MaskTransform } from './types/index.js';
 export * from './lib/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE/E,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,8 +1,8 @@
 // hazo_env/src/index.ts — Server entry point
 // Pure client helpers re-exported explicitly (getPattern/listEnvs/assertEnv/describeEnv are overridden below)
-export { getEnv, getEnvRole, isDev, isTest, isStaging, isProd } from './index.client.js';
+export { getEnv, isDev, isTest, isStaging, isProd } from './index.client.js';
 // Server-aware overrides
-export { getPattern, listEnvs, assertEnv, describeEnv } from './env.server.js';
+export { getPattern, listEnvs, assertEnv, describeEnv, getEnvRole, getRoleMap } from './env.server.js';
 // Types
 export * from './types/index.js';
 // Resolver + secrets
@@ -15,7 +15,10 @@ export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
+export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
 // Masking registry
 export { registerMask } from './mask/registry.js';
+// Masking ruleset
+export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
 // Lib
 export * from './lib/index.js';

package/dist/migrate/db.d.ts

@@ -1,6 +1,9 @@
 import type { HazoConnectAdapter } from 'hazo_connect';
 export interface DbCopyOptions {
+    type?: 'sqlite' | 'postgrest';
     tables?: '*' | string[];
+    preserve?: string[];
+    pkOverrides?: Record<string, string>;
     scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
     onProgress?: (msg: string) => void;
 }

package/dist/migrate/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/migrate/db.js

@@ -21,6 +21,11 @@ async function getMigrationNames(adapter) {
     return rows.map((r) => r.name);
 }
 export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
+    // PostgREST path: dispatch to dedicated implementation
+    if (opts.type === 'postgrest') {
+        const { copyDbPostgrest } = await import('./db.postgrest.js');
+        return copyDbPostgrest(srcAdapter, tgtAdapter, opts);
+    }
     const connect = await optional_import('hazo_connect/server');
     if (!connect) {
         throw new HazoError({
@@ -29,7 +34,7 @@ export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
             message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
         });
     }
-    // Schema parity check via _migrations
+    // Schema parity check via _migrations (SQLite only — PostgREST apps may not use _migrations)
     const srcMigrations = await getMigrationNames(srcAdapter);
     const tgtMigrations = await getMigrationNames(tgtAdapter);
     if (srcMigrations === null || tgtMigrations === null) {

package/dist/migrate/db.postgrest.d.ts

@@ -0,0 +1,4 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+import type { DbCopyOptions, DbCopyResult } from './db.js';
+export declare function copyDbPostgrest(srcAdapter: HazoConnectAdapter, tgtAdapter: HazoConnectAdapter, opts?: DbCopyOptions): Promise<DbCopyResult>;
+//# sourceMappingURL=db.postgrest.d.ts.map

package/dist/migrate/db.postgrest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA6GvB"}

package/dist/migrate/db.postgrest.js

@@ -0,0 +1,93 @@
+// hazo_env/src/migrate/db.postgrest.ts — PostgREST-based DB copy (REST-only, no raw SQL)
+import { HazoError, optional_import } from 'hazo_core';
+import { isSecretColumn } from '../lib/secret_columns.js';
+const PAGE_SIZE = 500;
+export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
+        });
+    }
+    // Table list is required for PostgREST (no auto-discovery — FK ordering unsafe without explicit list)
+    if (!opts.tables || opts.tables === '*') {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'PostgREST migration requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini or pass --tables to the CLI.',
+        });
+    }
+    const orderedTables = opts.tables;
+    const preserveSet = new Set(opts.preserve ?? []);
+    const pkOverrides = opts.pkOverrides ?? {};
+    // Tables to actually process (exclude preserve list)
+    const tablesToProcess = orderedTables.filter((t) => !preserveSet.has(t));
+    // --- Clear pass: reverse dependency order ---
+    opts.onProgress?.('Clearing target tables (reverse order for FK safety)...');
+    for (const table of [...tablesToProcess].reverse()) {
+        const pk = pkOverrides[table] ?? 'id';
+        try {
+            // PostgREST match-all DELETE: DELETE /table?pk=not.is.null
+            await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+            opts.onProgress?.(`Cleared: ${table}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            opts.onProgress?.(`Warning: could not clear ${table}: ${msg}`);
+        }
+    }
+    let totalRows = 0;
+    let totalScrubbed = 0;
+    // --- Copy pass: forward dependency order ---
+    for (const table of tablesToProcess) {
+        opts.onProgress?.(`Copying table: ${table}`);
+        const pk = pkOverrides[table] ?? 'id';
+        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
+        const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });
+        let offset = 0;
+        let pageRows = [];
+        do {
+            pageRows = await srcService.list((qb) => 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            qb.order(pk, 'asc').limit(PAGE_SIZE).offset(offset));
+            if (pageRows.length === 0)
+                break;
+            const batch = [];
+            for (let row of pageRows) {
+                const cleaned = {};
+                let didScrub = false;
+                for (const [col, val] of Object.entries(row)) {
+                    if (isSecretColumn(col)) {
+                        didScrub = true;
+                    }
+                    else {
+                        cleaned[col] = val;
+                    }
+                }
+                let processedRow = cleaned;
+                if (opts.scrubHook) {
+                    const hooked = opts.scrubHook(table, cleaned);
+                    if (hooked !== cleaned)
+                        didScrub = true;
+                    processedRow = hooked;
+                }
+                if (didScrub)
+                    totalScrubbed++;
+                batch.push(processedRow);
+            }
+            if (batch.length > 0) {
+                await tgtService.insert(batch);
+                totalRows += batch.length;
+                opts.onProgress?.(`  inserted ${batch.length} rows into ${table}`);
+            }
+            offset += PAGE_SIZE;
+        } while (pageRows.length === PAGE_SIZE);
+    }
+    // Note: PostgREST has no REST endpoint for NOTIFY. Schema reload only needed after DDL.
+    // If schema DDL changed since last reload, run: NOTIFY pgrst, 'reload schema' in Postgres.
+    opts.onProgress?.("DB copy complete. If schema DDL changed, run NOTIFY pgrst, 'reload schema' in Postgres.");
+    return { tables: tablesToProcess.length, rows: totalRows, scrubbed: totalScrubbed };
+}

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA4BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA0BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}

package/dist/migrate/files.js

@@ -6,11 +6,9 @@
 // Failures are non-fatal warnings — the file copy still completes.
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveFilesConfig } from '../resolve/files.js';
+import { resolveFilesRoot } from '../resolve/files.js';
 function resolveEnvFilesRoot(env) {
-    // resolveFilesConfig returns the data root; env-specific files are at <root>/<env>/files
-    const base = resolveFilesConfig().local.basePath;
-    return path.join(base, env, 'files');
+    return resolveFilesRoot(env);
 }
 /**
  * Attempt to scrub a PDF file in-place using hazo_pdf/mask_pdf.

package/dist/migrate/progress.d.ts

@@ -0,0 +1,5 @@
+import type { MigrationProgress } from '../types/index.js';
+export declare function writeMigrationProgress(progressDir: string, jobId: string, p: MigrationProgress): void;
+export declare function readMigrationProgress(progressDir: string, jobId: string): MigrationProgress | null;
+export declare function clearMigrationProgress(progressDir: string, jobId: string): void;
+//# sourceMappingURL=progress.d.ts.map

package/dist/migrate/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/migrate/progress.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAGrG;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQlG;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG/E"}

package/dist/migrate/progress.js

@@ -0,0 +1,24 @@
+// hazo_env/src/migrate/progress.ts — Filesystem-backed migration progress store
+import fs from 'node:fs';
+import path from 'node:path';
+export function writeMigrationProgress(progressDir, jobId, p) {
+    fs.mkdirSync(progressDir, { recursive: true });
+    fs.writeFileSync(path.join(progressDir, `${jobId}.json`), JSON.stringify(p), 'utf-8');
+}
+export function readMigrationProgress(progressDir, jobId) {
+    const filePath = path.join(progressDir, `${jobId}.json`);
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function clearMigrationProgress(progressDir, jobId) {
+    const filePath = path.join(progressDir, `${jobId}.json`);
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch { /* ignore */ }
+}

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AAgE3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAiJlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkLlF"}

package/dist/migrate/run.js

@@ -6,6 +6,7 @@
 // See: src/migrate/files.ts scrubPdfFile() and hazo_pdf/src/server/mask.ts
 import { HazoError, optional_import } from 'hazo_core';
 import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
 import { resolveFilesConfig } from '../resolve/files.js';
 import { resolveTransport } from './transport.js';
 import { takeSnapshot } from './snapshot.js';
@@ -13,13 +14,13 @@ import { copyDb } from './db.js';
 import { copyFiles } from './files.js';
 import { verifyFiles } from './verify.js';
 import { auditMigration } from './audit.js';
-// Production roles that require explicit confirmation
-const PROD_ROLES = new Set(['prod', 'production']);
-function isProdEnv(env) {
-    return PROD_ROLES.has(env.toLowerCase());
-}
+import { writeMigrationProgress } from './progress.js';
+import { getEnvRole } from '../env.server.js';
 function emitProgress(req, p) {
     req.onProgress?.(p);
+    if (req.jobId && req.progressDir) {
+        writeMigrationProgress(req.progressDir, req.jobId, p);
+    }
 }
 // Resolve the SQLite driver — prefer better-sqlite3 in tests when env var is set
 function getSqliteDriver() {
@@ -29,9 +30,8 @@ function getSqliteDriver() {
 }
 async function buildScrubHook(toEnv, scrubMode, tgtAdapter) {
     const maskKey = process.env['HAZO_ENV_MASK_KEY'];
-    const shouldScrub = scrubMode !== 'none' &&
-        maskKey &&
-        (toEnv === 'test' || toEnv === 'staging');
+    const toRole = getEnvRole(toEnv);
+    const shouldScrub = scrubMode !== 'none' && !!maskKey && (toRole === 'test' || toRole === 'staging');
     if (!shouldScrub)
         return undefined;
     const { loadRuleset } = await import('../mask/ruleset.js');
@@ -85,14 +85,15 @@ export async function runMigration(req) {
     if (req.from === req.to) {
         throw new HazoError({ code: 'HAZO_ENV_INVALID_REQUEST', pkg: 'hazo_env', message: `Source and target environments must differ (got "${req.from}" for both).` });
     }
-    if (isProdEnv(req.to) && !req.allowProdTarget) {
+    const toRole = getEnvRole(req.to);
+    if (toRole === 'production' && !req.allowProdTarget) {
         throw new HazoError({
             code: 'HAZO_ENV_PROD_TARGET_REFUSED',
             pkg: 'hazo_env',
             message: `Refusing to migrate to production environment "${req.to}". Pass allowProdTarget:true and a confirmToken to override.`,
         });
     }
-    if (isProdEnv(req.to) && req.allowProdTarget && !req.confirmToken) {
+    if (toRole === 'production' && req.allowProdTarget && !req.confirmToken) {
         throw new HazoError({
             code: 'HAZO_ENV_PROD_TARGET_REFUSED',
             pkg: 'hazo_env',
@@ -122,20 +123,43 @@ export async function runMigration(req) {
     }
     // Create adapters
     function makeAdapter(dbConfig, readOnly = false) {
-        if (dbConfig.type !== 'sqlite' || !dbConfig.sqlite) {
-            throw new HazoError({
-                code: 'HAZO_ENV_NOT_IMPLEMENTED',
-                pkg: 'hazo_env',
-                message: `Migration is only implemented for SQLite databases. Got type "${dbConfig.type}".`,
+        if (dbConfig.type === 'sqlite') {
+            if (!dbConfig.sqlite) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'SQLite config missing database_path.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'sqlite',
+                sqlite: {
+                    database_path: dbConfig.sqlite.database_path,
+                    read_only: readOnly,
+                    driver: getSqliteDriver(),
+                },
+            });
+        }
+        if (dbConfig.type === 'postgrest') {
+            if (!dbConfig.postgrest) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'PostgREST config missing base_url/api_key.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'postgrest',
+                postgrest: {
+                    base_url: dbConfig.postgrest.base_url,
+                    api_key: dbConfig.postgrest.api_key,
+                },
             });
         }
-        return connect.createHazoConnect({
-            type: 'sqlite',
-            sqlite: {
-                database_path: dbConfig.sqlite.database_path,
-                read_only: readOnly,
-                driver: getSqliteDriver(),
-            },
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `Migration is not implemented for DB type "${dbConfig.type}".`,
         });
     }
     const srcAdapter = makeAdapter(fromDbConfig, true);
@@ -144,12 +168,16 @@ export async function runMigration(req) {
     emitProgress(req, { phase: 'schema-check', message: 'Checking schema parity', percent: 15 });
     let dbResult;
     let filesResult;
+    const migrateConfig = resolveMigrateConfig();
     // Step 5: DB copy
     if (includeDb) {
         emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
         const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
         const result = await copyDb(srcAdapter, tgtAdapter, {
-            tables: req.tables,
+            type: fromDbConfig.type,
+            tables: req.tables ?? migrateConfig.tables,
+            preserve: migrateConfig.preserve,
+            pkOverrides: migrateConfig.pkOverrides,
             scrubHook,
             onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
         });
@@ -169,9 +197,16 @@ export async function runMigration(req) {
     // Step 7: Verify
     emitProgress(req, { phase: 'verify', message: 'Running post-migration verification', percent: 80 });
     const dataRoot = resolveFilesConfig().local.basePath;
-    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true });
+    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true, adapter: tgtAdapter });
     if (!verifyReport.ok) {
-        warnings.push(`Verification found issues: missing=${verifyReport.missing.length}, sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        const parts = [];
+        if (verifyReport.missing.length)
+            parts.push(`missing=${verifyReport.missing.length}`);
+        if (verifyReport.sizeMismatch.length)
+            parts.push(`sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        if (verifyReport.hashMismatch.length)
+            parts.push(`hashMismatch=${verifyReport.hashMismatch.length}`);
+        warnings.push(`Verify found issues (${parts.join(', ')}) — migration continues; snapshotId=${snapshot.snapshotId}`);
     }
     // Step 8: Finalize — audit
     emitProgress(req, { phase: 'finalize', message: 'Recording audit event', percent: 95 });

package/dist/migrate/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAmBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAsBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}

package/dist/migrate/snapshot.js

@@ -3,6 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { HazoError } from 'hazo_core';
 export function takeSnapshot(toConfig) {
+    if (toConfig.type === 'postgrest') {
+        return { snapshotId: 'postgrest:no-snapshot', createdAt: new Date().toISOString() };
+    }
     if (toConfig.type !== 'sqlite' || !toConfig.sqlite?.database_path) {
         throw new HazoError({
             code: 'HAZO_ENV_NOT_IMPLEMENTED',

package/dist/migrate/verify.d.ts

@@ -3,6 +3,7 @@ export interface VerifyOptions {
     hash?: HashMode;
     samplePct?: number;
     checkOrphans?: boolean;
+    adapter?: import('hazo_connect').HazoConnectAdapter;
 }
 export declare function verifyFiles(env: HazoEnv, dataRoot: string, opts?: VerifyOptions): Promise<VerifyReport>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/migrate/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAMD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAgDvB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;CACrD;AAqBD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA8IvB"}