hazo_env 0.3.0 → 0.4.0

package/CHANGE_LOG.md

@@ -1,5 +1,26 @@
 # hazo_env — Change Log
 
+## 0.4.0 — 2026-06-25
+
+### Added
+- `verifyFiles()` L2–L5 — DB-backed file existence (L2), size check (L3), hash check L4 (`full|sample|none`; sample = 1% + top-10 by size + top-10 by changed_at), orphan detection L5. Previously all layers were stubs.
+- `VerifyOptions.adapter` — pass a `HazoConnectAdapter` to enable DB-backed checks; without it verify falls back to sentinel-only (disk) and sets `report.skippedReason`.
+- `VerifyReport` — new fields: `hashed?: number`, `skippedReason?: string`.
+- `runMigration` — step 7 verify now passes `tgtAdapter`; emits detailed warning on `!ok` (counts + snapshotId) but continues (G2: warns-not-aborts).
+- CLI `hazo-env verify` — new `--hash full|sample|none` flag (default `sample`); exits 1 on failure (CI-safe).
+- `doctor()` — section 7a: `_migrations` parity check across all SQLite envs (`--probe --all`); section 7b: masking ruleset column validation against live schema.
+- `DoctorOptions.probe` + `DoctorOptions.all` — enable live DB reachability probes + multi-env checks.
+- `hazo_files` added as optional peer dependency (`^3.5.0`).
+
+### Changed
+- `DoctorReport.passed` replaces `DoctorReport.ok` (previously typo in docs).
+- `DoctorCheck.status` is `'ok'|'warn'|'error'` (not `boolean`).
+
+### Test-app
+- Seed script creates 7 `hazo_files` fixture rows (3 clean, 1 size-mismatch, 1 hash-mismatch, 1 missing, 1 orphan) + physical files under `data/test/files/`.
+- `/api/verify` route + `/verify` report page added.
+- `'verify-fixtures'` autotest scenario added (5 cases).
+
 ## 0.3.0 — 2026-06-10
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ Canonical environment resolver for hazo apps. Typed env names, per-env DB/file/s
 - **Secrets** — `getSecret()` resolves from `.env.local` only; placeholders in `hazo_env_config.ini` are substituted at runtime without storing secrets.
 - **Migration engine** — `runMigration({ from, to })` copies a DB + files between envs. Validates → snapshots target → copies tables (paged, schema-checked) → copies files → verifies → writes hazo_audit entry. Prod target refused without an explicit confirm token.
 - **PII masking** — masking rules declared per table/column in `hazo_env_masking.ini` (seed) and synced to `hazo_app_config` at runtime. Built-in transforms: `mask_email`, `fake_name`, `mask_phone`, `jitter_date`, `hash`, `tokenize`, `drop`, `nullify`. Custom transforms via `registerMask()`. Applied automatically when the migration target role is `test` or `staging`.
-- **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, and schema level.
+- **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, schema level, and (with `--probe --all`) migration parity across envs + masking ruleset column validation.
 - **CLI** — `hazo-env current | doctor | snapshot | migrate | verify | restore | mask`.
 
 ## Installation
@@ -147,9 +147,11 @@ getSecret('POSTGREST_API_KEY', { required: true })
 ```ts
 import { doctor } from 'hazo_env';
 
-const report = await doctor();
-// report.ok        boolean
-// report.checks    DoctorCheck[] — { label, ok, message }
+const report = await doctor({ probe: true, all: true });
+// report.passed    boolean
+// report.checks    DoctorCheck[] — { label, status: 'ok'|'warn'|'error', detail? }
+// Migration-readiness checks (--probe --all): _migrations parity across envs,
+// masking ruleset column validation against live schema.
 ```
 
 ### Migration engine (server-only)
@@ -171,8 +173,10 @@ const result = await runMigration({
 });
 // result.ok, result.db, result.files, result.snapshotId, result.warnings, result.durationMs
 
-// Stand-alone verification
-await verifyFiles('staging', dataRoot, { hash: 'sample' });
+// Stand-alone verification (with optional hazo_connect adapter for L2–L5 checks)
+await verifyFiles('staging', dataRoot, { hash: 'sample', checkOrphans: true, adapter });
+// report.ok, report.checked, report.hashed, report.missing[], report.sizeMismatch[],
+// report.hashMismatch[], report.orphans[], report.skippedReason?
 
 // Manual snapshot / restore
 const snap = takeSnapshot(connectConfig);   // returns { snapshotId }

package/SETUP_CHECKLIST.md

@@ -94,6 +94,12 @@ All checks should be green before going to production. The doctor validates:
 - All required secrets are present in `.env.local` (values are never printed)
 - `data_root` exists and is writable
 
+Add `--probe --all` for migration-readiness checks:
+```bash
+npx hazo-env doctor --probe --all
+```
+This additionally checks: live DB reachability for all envs, `_migrations` table parity across envs, masking ruleset column validation against live schema.
+
 ## 8. (Next.js) Ensure `hazo_env` is in `transpilePackages`
 
 ```js

package/dist/cli.js

@@ -122,12 +122,22 @@ async function runMigrate() {
 }
 async function runVerify() {
     const targetEnv = args[0] ?? getEnv();
-    console.log(`\n${pc.bold('hazo-env verify')} ${pc.dim(targetEnv)}\n`);
+    // Parse --hash full|sample|none (default: sample) and --no-orphans
+    const hashIdx = args.indexOf('--hash');
+    const hashArg = hashIdx >= 0 ? args[hashIdx + 1] : 'sample';
+    const hash = (hashArg === 'full' || hashArg === 'none' || hashArg === 'sample') ? hashArg : 'sample';
+    const checkOrphans = !args.includes('--no-orphans');
+    console.log(`\n${pc.bold('hazo-env verify')} ${pc.dim(targetEnv)} ${pc.dim(`--hash ${hash}`)}\n`);
     const { verifyFiles } = await import('./migrate/verify.js');
     const { resolveFilesConfig } = await import('./resolve/files.js');
     const dataRoot = resolveFilesConfig().local.basePath;
-    const report = await verifyFiles(targetEnv, dataRoot, { hash: 'sample', checkOrphans: true });
-    console.log(`  Checked: ${report.checked} files`);
+    const report = await verifyFiles(targetEnv, dataRoot, { hash, checkOrphans });
+    if (report.skippedReason) {
+        console.log(`  ${pc.yellow('⚠')} ${report.skippedReason}`);
+    }
+    console.log(`  Checked: ${report.checked} files${report.hashed != null ? `, hashed: ${report.hashed}` : ''}`);
+    if (report.orphans.length)
+        console.log(`  ${pc.dim('ℹ')} Orphans (no DB row): ${report.orphans.join(', ')}`);
     if (report.ok) {
         console.log(`  ${pc.green('✓')} All files verified\n`);
     }
@@ -136,8 +146,10 @@ async function runVerify() {
             console.log(`  ${pc.red('✗')} Missing: ${report.missing.join(', ')}`);
         if (report.sizeMismatch.length)
             console.log(`  ${pc.yellow('⚠')} Size mismatch: ${report.sizeMismatch.join(', ')}`);
+        if (report.hashMismatch.length)
+            console.log(`  ${pc.yellow('⚠')} Hash mismatch: ${report.hashMismatch.join(', ')}`);
         console.log('');
-        process.exit(1);
+        process.exit(1); // S4: standalone verify exits 1 on failure (CI-friendly)
     }
 }
 async function runRestore() {
@@ -221,6 +233,8 @@ Usage:
     --no-db / --no-files                    Skip DB or file copy
     --allow-prod-target --confirm <token>   Override prod-target safety
   hazo-env verify <env>                     Verify files for an environment
+    --hash full|sample|none                Hash-check all / sampled / none (default: sample)
+    --no-orphans                           Skip orphan detection
   hazo-env restore <env> --snapshot <id>   Restore a snapshot
   hazo-env snapshot <env>                   Take a snapshot of an environment
   hazo-env mask sync                        Load masking ruleset from INI into DB

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2J5E"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8R5E"}

package/dist/doctor.js

@@ -166,6 +166,158 @@ export async function doctor(opts = {}) {
             });
         }
     }
+    // 7. Migration readiness checks
+    // 7a. _migrations parity (probe mode, --all): open each SQLite env and compare name-sets
+    if (opts.probe && opts.all) {
+        const migSets = new Map();
+        for (const env of envsToCheck) {
+            let cfg;
+            try {
+                cfg = resolveConnectConfig({ env, allowOtherEnv: true });
+            }
+            catch {
+                continue;
+            }
+            if (cfg.type !== 'sqlite' || !cfg.sqlite)
+                continue;
+            try {
+                const Database = require('better-sqlite3');
+                const db = Database(cfg.sqlite.database_path);
+                let names;
+                try {
+                    names = db.prepare('SELECT name FROM _migrations').all().map((r) => r.name);
+                }
+                catch {
+                    names = [];
+                }
+                db.close();
+                migSets.set(env, new Set(names));
+            }
+            catch {
+                // DB not openable — skip (probe check already reported error)
+            }
+        }
+        if (migSets.size >= 2) {
+            const envList = [...migSets.keys()];
+            const referenceSet = migSets.get(envList[0]);
+            const referenceEnv = envList[0];
+            for (const env of envList.slice(1)) {
+                const s = migSets.get(env);
+                const onlyInRef = [...referenceSet].filter((n) => !s.has(n));
+                const onlyInEnv = [...s].filter((n) => !referenceSet.has(n));
+                if (onlyInRef.length === 0 && onlyInEnv.length === 0) {
+                    checks.push({ label: `Migration parity (${referenceEnv} ↔ ${env})`, status: 'ok', detail: `${s.size} applied` });
+                }
+                else {
+                    const detail = [
+                        onlyInRef.length ? `only in ${referenceEnv}: ${onlyInRef.join(', ')}` : '',
+                        onlyInEnv.length ? `only in ${env}: ${onlyInEnv.join(', ')}` : '',
+                    ].filter(Boolean).join('; ');
+                    checks.push({ label: `Migration parity (${referenceEnv} ↔ ${env})`, status: 'warn', detail });
+                }
+            }
+        }
+    }
+    // 7b. Masking ruleset column validation: every (table, column) in the masking INI must
+    //     exist in at least one SQLite env's schema. Skip silently for PostgREST envs.
+    const maskingConfigPath = path.resolve(process.cwd(), 'config', 'hazo_env_masking.ini');
+    if (fs.existsSync(maskingConfigPath)) {
+        try {
+            // Parse the masking INI directly — HazoConfig doesn't expose section enumeration.
+            // Format: each [section] is a table name; keys are column names.
+            const iniContent = fs.readFileSync(maskingConfigPath, 'utf-8');
+            const rules = [];
+            let currentTable = '';
+            for (const rawLine of iniContent.split('\n')) {
+                const line = rawLine.trim();
+                if (!line || line.startsWith(';') || line.startsWith('#'))
+                    continue;
+                const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+                if (sectionMatch) {
+                    currentTable = sectionMatch[1].trim();
+                    continue;
+                }
+                if (!currentTable)
+                    continue;
+                const eqIdx = line.indexOf('=');
+                if (eqIdx < 0)
+                    continue;
+                const column = line.slice(0, eqIdx).trim();
+                if (column)
+                    rules.push({ table: currentTable, column });
+            }
+            if (rules.length > 0) {
+                // Collect SQLite schemas for checked envs
+                const schemas = new Map(); // "table.column" → present
+                for (const env of envsToCheck) {
+                    let cfg;
+                    try {
+                        cfg = resolveConnectConfig({ env, allowOtherEnv: true });
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (cfg.type !== 'sqlite' || !cfg.sqlite)
+                        continue;
+                    try {
+                        const Database = require('better-sqlite3');
+                        const db = Database(cfg.sqlite.database_path);
+                        try {
+                            const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((r) => r.name);
+                            for (const tbl of tables) {
+                                const cols = db.prepare(`PRAGMA table_info(${tbl})`).all();
+                                for (const col of cols) {
+                                    schemas.set(`${tbl}.${col.name}`, new Set());
+                                }
+                            }
+                        }
+                        catch { /* DB empty or unreadable */ }
+                        db.close();
+                    }
+                    catch { /* DB not openable */ }
+                }
+                if (schemas.size > 0) {
+                    const badRules = [];
+                    for (const { table, column } of rules) {
+                        if (!schemas.has(`${table}.${column}`)) {
+                            badRules.push(`${table}.${column}`);
+                        }
+                    }
+                    if (badRules.length === 0) {
+                        checks.push({ label: 'Masking ruleset columns', status: 'ok', detail: `${rules.length} rule(s) validated` });
+                    }
+                    else {
+                        checks.push({
+                            label: 'Masking ruleset columns',
+                            status: 'warn',
+                            detail: `Column(s) not found in schema: ${badRules.join(', ')} (PostgREST envs skipped)`,
+                        });
+                    }
+                }
+                else {
+                    // No SQLite envs probed — can't validate columns; skip silently
+                    const hasPostgrest = envsToCheck.some((env) => {
+                        try {
+                            return resolveConnectConfig({ env, allowOtherEnv: true }).type === 'postgrest';
+                        }
+                        catch {
+                            return false;
+                        }
+                    });
+                    if (hasPostgrest) {
+                        checks.push({
+                            label: 'Masking ruleset columns',
+                            status: 'ok',
+                            detail: 'PostgREST env — column validation skipped',
+                        });
+                    }
+                }
+            }
+        }
+        catch {
+            // Masking config parse failure — non-fatal, skip
+        }
+    }
     const passed = checks.every((c) => c.status !== 'error');
     return { env: targetEnv, checks, passed };
 }

package/dist/migrate/db.d.ts

@@ -1,6 +1,9 @@
 import type { HazoConnectAdapter } from 'hazo_connect';
 export interface DbCopyOptions {
+    type?: 'sqlite' | 'postgrest';
     tables?: '*' | string[];
+    preserve?: string[];
+    pkOverrides?: Record<string, string>;
     scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
     onProgress?: (msg: string) => void;
 }

package/dist/migrate/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/migrate/db.js

@@ -21,6 +21,11 @@ async function getMigrationNames(adapter) {
     return rows.map((r) => r.name);
 }
 export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
+    // PostgREST path: dispatch to dedicated implementation
+    if (opts.type === 'postgrest') {
+        const { copyDbPostgrest } = await import('./db.postgrest.js');
+        return copyDbPostgrest(srcAdapter, tgtAdapter, opts);
+    }
     const connect = await optional_import('hazo_connect/server');
     if (!connect) {
         throw new HazoError({
@@ -29,7 +34,7 @@ export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
             message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
         });
     }
-    // Schema parity check via _migrations
+    // Schema parity check via _migrations (SQLite only — PostgREST apps may not use _migrations)
     const srcMigrations = await getMigrationNames(srcAdapter);
     const tgtMigrations = await getMigrationNames(tgtAdapter);
     if (srcMigrations === null || tgtMigrations === null) {

package/dist/migrate/db.postgrest.d.ts

@@ -0,0 +1,4 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+import type { DbCopyOptions, DbCopyResult } from './db.js';
+export declare function copyDbPostgrest(srcAdapter: HazoConnectAdapter, tgtAdapter: HazoConnectAdapter, opts?: DbCopyOptions): Promise<DbCopyResult>;
+//# sourceMappingURL=db.postgrest.d.ts.map

package/dist/migrate/db.postgrest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA6GvB"}

package/dist/migrate/db.postgrest.js

@@ -0,0 +1,93 @@
+// hazo_env/src/migrate/db.postgrest.ts — PostgREST-based DB copy (REST-only, no raw SQL)
+import { HazoError, optional_import } from 'hazo_core';
+import { isSecretColumn } from '../lib/secret_columns.js';
+const PAGE_SIZE = 500;
+export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
+        });
+    }
+    // Table list is required for PostgREST (no auto-discovery — FK ordering unsafe without explicit list)
+    if (!opts.tables || opts.tables === '*') {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'PostgREST migration requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini or pass --tables to the CLI.',
+        });
+    }
+    const orderedTables = opts.tables;
+    const preserveSet = new Set(opts.preserve ?? []);
+    const pkOverrides = opts.pkOverrides ?? {};
+    // Tables to actually process (exclude preserve list)
+    const tablesToProcess = orderedTables.filter((t) => !preserveSet.has(t));
+    // --- Clear pass: reverse dependency order ---
+    opts.onProgress?.('Clearing target tables (reverse order for FK safety)...');
+    for (const table of [...tablesToProcess].reverse()) {
+        const pk = pkOverrides[table] ?? 'id';
+        try {
+            // PostgREST match-all DELETE: DELETE /table?pk=not.is.null
+            await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+            opts.onProgress?.(`Cleared: ${table}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            opts.onProgress?.(`Warning: could not clear ${table}: ${msg}`);
+        }
+    }
+    let totalRows = 0;
+    let totalScrubbed = 0;
+    // --- Copy pass: forward dependency order ---
+    for (const table of tablesToProcess) {
+        opts.onProgress?.(`Copying table: ${table}`);
+        const pk = pkOverrides[table] ?? 'id';
+        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
+        const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });
+        let offset = 0;
+        let pageRows = [];
+        do {
+            pageRows = await srcService.list((qb) => 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            qb.order(pk, 'asc').limit(PAGE_SIZE).offset(offset));
+            if (pageRows.length === 0)
+                break;
+            const batch = [];
+            for (let row of pageRows) {
+                const cleaned = {};
+                let didScrub = false;
+                for (const [col, val] of Object.entries(row)) {
+                    if (isSecretColumn(col)) {
+                        didScrub = true;
+                    }
+                    else {
+                        cleaned[col] = val;
+                    }
+                }
+                let processedRow = cleaned;
+                if (opts.scrubHook) {
+                    const hooked = opts.scrubHook(table, cleaned);
+                    if (hooked !== cleaned)
+                        didScrub = true;
+                    processedRow = hooked;
+                }
+                if (didScrub)
+                    totalScrubbed++;
+                batch.push(processedRow);
+            }
+            if (batch.length > 0) {
+                await tgtService.insert(batch);
+                totalRows += batch.length;
+                opts.onProgress?.(`  inserted ${batch.length} rows into ${table}`);
+            }
+            offset += PAGE_SIZE;
+        } while (pageRows.length === PAGE_SIZE);
+    }
+    // Note: PostgREST has no REST endpoint for NOTIFY. Schema reload only needed after DDL.
+    // If schema DDL changed since last reload, run: NOTIFY pgrst, 'reload schema' in Postgres.
+    opts.onProgress?.("DB copy complete. If schema DDL changed, run NOTIFY pgrst, 'reload schema' in Postgres.");
+    return { tables: tablesToProcess.length, rows: totalRows, scrubbed: totalScrubbed };
+}

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA4BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA0BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}

package/dist/migrate/files.js

@@ -6,11 +6,9 @@
 // Failures are non-fatal warnings — the file copy still completes.
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveFilesConfig } from '../resolve/files.js';
+import { resolveFilesRoot } from '../resolve/files.js';
 function resolveEnvFilesRoot(env) {
-    // resolveFilesConfig returns the data root; env-specific files are at <root>/<env>/files
-    const base = resolveFilesConfig().local.basePath;
-    return path.join(base, env, 'files');
+    return resolveFilesRoot(env);
 }
 /**
  * Attempt to scrub a PDF file in-place using hazo_pdf/mask_pdf.

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkJlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkLlF"}

package/dist/migrate/run.js

@@ -6,6 +6,7 @@
 // See: src/migrate/files.ts scrubPdfFile() and hazo_pdf/src/server/mask.ts
 import { HazoError, optional_import } from 'hazo_core';
 import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
 import { resolveFilesConfig } from '../resolve/files.js';
 import { resolveTransport } from './transport.js';
 import { takeSnapshot } from './snapshot.js';
@@ -122,20 +123,43 @@ export async function runMigration(req) {
     }
     // Create adapters
     function makeAdapter(dbConfig, readOnly = false) {
-        if (dbConfig.type !== 'sqlite' || !dbConfig.sqlite) {
-            throw new HazoError({
-                code: 'HAZO_ENV_NOT_IMPLEMENTED',
-                pkg: 'hazo_env',
-                message: `Migration is only implemented for SQLite databases. Got type "${dbConfig.type}".`,
+        if (dbConfig.type === 'sqlite') {
+            if (!dbConfig.sqlite) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'SQLite config missing database_path.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'sqlite',
+                sqlite: {
+                    database_path: dbConfig.sqlite.database_path,
+                    read_only: readOnly,
+                    driver: getSqliteDriver(),
+                },
             });
         }
-        return connect.createHazoConnect({
-            type: 'sqlite',
-            sqlite: {
-                database_path: dbConfig.sqlite.database_path,
-                read_only: readOnly,
-                driver: getSqliteDriver(),
-            },
+        if (dbConfig.type === 'postgrest') {
+            if (!dbConfig.postgrest) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'PostgREST config missing base_url/api_key.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'postgrest',
+                postgrest: {
+                    base_url: dbConfig.postgrest.base_url,
+                    api_key: dbConfig.postgrest.api_key,
+                },
+            });
+        }
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `Migration is not implemented for DB type "${dbConfig.type}".`,
         });
     }
     const srcAdapter = makeAdapter(fromDbConfig, true);
@@ -144,12 +168,16 @@ export async function runMigration(req) {
     emitProgress(req, { phase: 'schema-check', message: 'Checking schema parity', percent: 15 });
     let dbResult;
     let filesResult;
+    const migrateConfig = resolveMigrateConfig();
     // Step 5: DB copy
     if (includeDb) {
         emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
         const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
         const result = await copyDb(srcAdapter, tgtAdapter, {
-            tables: req.tables,
+            type: fromDbConfig.type,
+            tables: req.tables ?? migrateConfig.tables,
+            preserve: migrateConfig.preserve,
+            pkOverrides: migrateConfig.pkOverrides,
             scrubHook,
             onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
         });
@@ -169,9 +197,16 @@ export async function runMigration(req) {
     // Step 7: Verify
     emitProgress(req, { phase: 'verify', message: 'Running post-migration verification', percent: 80 });
     const dataRoot = resolveFilesConfig().local.basePath;
-    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true });
+    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true, adapter: tgtAdapter });
     if (!verifyReport.ok) {
-        warnings.push(`Verification found issues: missing=${verifyReport.missing.length}, sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        const parts = [];
+        if (verifyReport.missing.length)
+            parts.push(`missing=${verifyReport.missing.length}`);
+        if (verifyReport.sizeMismatch.length)
+            parts.push(`sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        if (verifyReport.hashMismatch.length)
+            parts.push(`hashMismatch=${verifyReport.hashMismatch.length}`);
+        warnings.push(`Verify found issues (${parts.join(', ')}) — migration continues; snapshotId=${snapshot.snapshotId}`);
     }
     // Step 8: Finalize — audit
     emitProgress(req, { phase: 'finalize', message: 'Recording audit event', percent: 95 });

package/dist/migrate/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAmBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAsBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}

package/dist/migrate/snapshot.js

@@ -3,6 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { HazoError } from 'hazo_core';
 export function takeSnapshot(toConfig) {
+    if (toConfig.type === 'postgrest') {
+        return { snapshotId: 'postgrest:no-snapshot', createdAt: new Date().toISOString() };
+    }
     if (toConfig.type !== 'sqlite' || !toConfig.sqlite?.database_path) {
         throw new HazoError({
             code: 'HAZO_ENV_NOT_IMPLEMENTED',

package/dist/migrate/verify.d.ts

@@ -3,6 +3,7 @@ export interface VerifyOptions {
     hash?: HashMode;
     samplePct?: number;
     checkOrphans?: boolean;
+    adapter?: import('hazo_connect').HazoConnectAdapter;
 }
 export declare function verifyFiles(env: HazoEnv, dataRoot: string, opts?: VerifyOptions): Promise<VerifyReport>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/migrate/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAMD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAgDvB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;CACrD;AAqBD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA8IvB"}

package/dist/migrate/verify.js

@@ -1,51 +1,141 @@
 // hazo_env/src/migrate/verify.ts — post-migration file verification
 import fs from 'node:fs';
 import path from 'node:path';
+import { optional_import } from 'hazo_core';
 function resolveEnvFilesRoot(env, dataRoot) {
     return path.join(dataRoot, env, 'files');
 }
+function walkDir(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const absPath = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            return walkDir(absPath);
+        // Return relative to dir's parent so caller can strip filesRoot prefix
+        return [absPath];
+    });
+}
+function walkRelative(filesRoot) {
+    const abs = walkDir(filesRoot);
+    return abs.map((p) => p.slice(filesRoot.length + 1)); // strip filesRoot + sep
+}
 export async function verifyFiles(env, dataRoot, opts = {}) {
-    const { checkOrphans = true } = opts;
+    const { hash = 'sample', checkOrphans = true, adapter } = opts;
     const filesRoot = resolveEnvFilesRoot(env, dataRoot);
     const missing = [];
     const sizeMismatch = [];
     const hashMismatch = [];
     const orphans = [];
     let checked = 0;
-    let sentinelOk = true;
-    // Layer 1: check sentinel file (data root exists and is readable)
-    if (!fs.existsSync(filesRoot)) {
-        sentinelOk = false;
+    let hashed;
+    // Layer 1: sentinel — filesRoot must exist and be readable
+    const sentinelOk = fs.existsSync(filesRoot);
+    if (!sentinelOk) {
         return { ok: false, checked: 0, missing: [], sizeMismatch: [], hashMismatch: [], orphans: [], sentinelOk: false };
     }
-    // Layer 2 & 3: walk all files
-    function walkDir(dir, relBase) {
-        if (!fs.existsSync(dir))
-            return [];
-        return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-            const relPath = path.join(relBase, entry.name);
-            const absPath = path.join(dir, entry.name);
-            if (entry.isDirectory())
-                return walkDir(absPath, relPath);
-            return [relPath];
-        });
-    }
-    const diskFiles = walkDir(filesRoot, '');
-    for (const relPath of diskFiles) {
+    // S3: Fallback detection — need both hazo_files module and an adapter
+    const hazoFiles = await optional_import('hazo_files');
+    if (!hazoFiles || !adapter) {
+        // Disk-only fallback
+        const diskFiles = walkRelative(filesRoot);
+        checked = diskFiles.length;
+        const skippedReason = 'no hazo_files tracking — size/hash/orphan skipped';
+        const ok = sentinelOk && missing.length === 0;
+        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
+    }
+    // Main path: adapter + hazo_files available
+    const connectMod = await optional_import('hazo_connect/server');
+    let rows = [];
+    let skippedReason;
+    try {
+        if (!connectMod)
+            throw new Error('hazo_connect not available');
+        const service = connectMod.createCrudService(adapter, 'hazo_files');
+        const all = await service.list();
+        rows = all.filter((r) => !r.storage_type || r.storage_type === 'local');
+    }
+    catch {
+        // Table not found or connect unavailable — disk-only fallback
+        const diskFiles = walkRelative(filesRoot);
+        checked = diskFiles.length;
+        skippedReason = 'hazo_files table not found — disk-only fallback';
+        const ok = sentinelOk && missing.length === 0;
+        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
+    }
+    // Normalize DB paths: strip leading slash if present
+    const normalizeDbPath = (p) => p.startsWith('/') ? p.slice(1) : p;
+    const dbPathSet = new Set(rows.map((r) => normalizeDbPath(r.file_path)));
+    // Track present rows for hash/size checks
+    const presentRows = [];
+    // L2 Existence
+    for (const row of rows) {
+        const relPath = normalizeDbPath(row.file_path);
         const absPath = path.join(filesRoot, relPath);
-        try {
-            fs.statSync(absPath); // existence + size (stat succeeds = file accessible)
-            checked++;
+        if (!fs.existsSync(absPath)) {
+            missing.push(row.file_path);
+        }
+        else {
+            presentRows.push({ ...row, file_path: relPath });
         }
-        catch {
-            missing.push(relPath);
+    }
+    // L3 Size
+    for (const row of presentRows) {
+        const absPath = path.join(filesRoot, row.file_path);
+        const stat = fs.statSync(absPath);
+        if (row.file_size != null && stat.size !== row.file_size) {
+            sizeMismatch.push(row.file_path);
+        }
+        checked++;
+    }
+    // L4 Hash
+    if (hash !== 'none') {
+        let toHash;
+        if (hash === 'full') {
+            toHash = presentRows;
+        }
+        else {
+            // sample: 1% random (min 1) + top 10 by file_size DESC + top 10 by file_changed_at DESC
+            const n = Math.max(1, Math.floor(presentRows.length * 0.01));
+            const shuffled = [...presentRows].sort(() => Math.random() - 0.5).slice(0, n);
+            const bySize = [...presentRows]
+                .filter((r) => r.file_size != null)
+                .sort((a, b) => (b.file_size ?? 0) - (a.file_size ?? 0))
+                .slice(0, 10);
+            const byChanged = [...presentRows]
+                .filter((r) => r.file_changed_at != null)
+                .sort((a, b) => (b.file_changed_at ?? '') < (a.file_changed_at ?? '') ? -1 : 1)
+                .slice(0, 10);
+            // Deduplicate by file_path
+            const seen = new Set();
+            toHash = [];
+            for (const r of [...shuffled, ...bySize, ...byChanged]) {
+                if (!seen.has(r.file_path)) {
+                    seen.add(r.file_path);
+                    toHash.push(r);
+                }
+            }
+        }
+        hashed = 0;
+        for (const row of toHash) {
+            const absPath = path.join(filesRoot, row.file_path);
+            const buf = fs.readFileSync(absPath);
+            const computed = hazoFiles.computeFileHashSync(buf);
+            if (row.file_hash && computed !== row.file_hash) {
+                hashMismatch.push(row.file_path);
+            }
+            hashed++;
         }
     }
-    // Layer 4: orphan check — files on disk with no corresponding DB tracking row
-    // In Phase A, hazo_files integration is not wired; just verify directory is readable
-    if (checkOrphans && !fs.existsSync(filesRoot)) {
-        orphans.push(filesRoot);
+    // L5 Orphans
+    if (checkOrphans) {
+        const diskFiles = walkRelative(filesRoot);
+        for (const diskRel of diskFiles) {
+            if (!dbPathSet.has(diskRel)) {
+                orphans.push(diskRel);
+            }
+        }
     }
-    const ok = missing.length === 0 && sizeMismatch.length === 0 && hashMismatch.length === 0;
-    return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk };
+    const ok = sentinelOk && missing.length === 0 && sizeMismatch.length === 0 && hashMismatch.length === 0;
+    return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, hashed, skippedReason };
 }

package/dist/resolve/files.d.ts

@@ -5,4 +5,10 @@ import type { FilesEnvConfig } from '../types/index.js';
  * Falls back to app_data if not configured.
  */
 export declare function resolveFilesConfig(appConfigPkg?: string): FilesEnvConfig;
+/**
+ * Resolve the file storage root path for a specific environment.
+ * Checks [files.<env>] root in hazo_env_config.ini first;
+ * falls back to <dataRoot>/<env>/files convention if absent.
+ */
+export declare function resolveFilesRoot(env: string): string;
 //# sourceMappingURL=files.d.ts.map

package/dist/resolve/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/resolve/files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAgBxD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAoCxE"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/resolve/files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAgBxD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAoCxE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAiBpD"}

package/dist/resolve/files.js

@@ -51,3 +51,26 @@ export function resolveFilesConfig(appConfigPkg) {
     }
     return { provider: 'local', local };
 }
+/**
+ * Resolve the file storage root path for a specific environment.
+ * Checks [files.<env>] root in hazo_env_config.ini first;
+ * falls back to <dataRoot>/<env>/files convention if absent.
+ */
+export function resolveFilesRoot(env) {
+    const envConfig = tryLoadConfig('hazo_env');
+    // Check explicit per-env root: [files.<env>] root = /some/path
+    const filesSection = envConfig?.getSection(`files.${env}`);
+    const explicitRoot = filesSection?.['root'];
+    if (explicitRoot) {
+        return path.isAbsolute(explicitRoot)
+            ? explicitRoot
+            : path.resolve(process.cwd(), explicitRoot);
+    }
+    // Fall back to <dataRoot>/<env>/files convention
+    const dataSection = envConfig?.getSection('data');
+    const dataRoot = dataSection?.['root'] ?? DEFAULT_DATA_ROOT;
+    const resolvedDataRoot = path.isAbsolute(dataRoot)
+        ? dataRoot
+        : path.resolve(process.cwd(), dataRoot);
+    return path.join(resolvedDataRoot, env, 'files');
+}

package/dist/resolve/migrate.d.ts

@@ -0,0 +1,3 @@
+import type { MigrateConfig } from '../types/index.js';
+export declare function resolveMigrateConfig(): MigrateConfig;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/resolve/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/resolve/migrate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,wBAAgB,oBAAoB,IAAI,aAAa,CA2BpD"}

package/dist/resolve/migrate.js

@@ -0,0 +1,29 @@
+// hazo_env/src/resolve/migrate.ts — read [migrate] section from hazo_env_config.ini
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+export function resolveMigrateConfig() {
+    try {
+        const filePath = path.resolve(process.cwd(), 'config', 'hazo_env_config.ini');
+        const config = new HazoConfig({ filePath });
+        const section = config.getSection('migrate');
+        if (!section)
+            return {};
+        const tables = section['tables']
+            ? section['tables'].split(',').map((t) => t.trim()).filter(Boolean)
+            : undefined;
+        const preserve = section['preserve']
+            ? section['preserve'].split(',').map((t) => t.trim()).filter(Boolean)
+            : undefined;
+        // Parse per-table pk overrides: keys like "pk.some_table = custom_col"
+        const pkOverrides = {};
+        for (const [k, v] of Object.entries(section)) {
+            if (k.startsWith('pk.') && typeof v === 'string') {
+                pkOverrides[k.slice(3)] = v.trim();
+            }
+        }
+        return { tables, preserve, ...(Object.keys(pkOverrides).length ? { pkOverrides } : {}) };
+    }
+    catch {
+        return {};
+    }
+}

package/dist/types/index.d.ts

@@ -93,6 +93,14 @@ export interface VerifyReport {
     hashMismatch: string[];
     orphans: string[];
     sentinelOk: boolean;
+    hashed?: number;
+    skippedReason?: string;
+}
+/** Parsed [migrate] section from hazo_env_config.ini */
+export interface MigrateConfig {
+    tables?: string[];
+    preserve?: string[];
+    pkOverrides?: Record<string, string>;
 }
 export type MaskTransform = (value: unknown, key: string, maskKey: string) => unknown;
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,10 +38,10 @@
     "picocolors": "^1.1.1"
   },
   "peerDependencies": {
-    "hazo_core": "^1.1.0",
-    "hazo_config": "^2.1.10",
-    "hazo_connect": "^3.4.1",
-    "hazo_files": "^3.0.0",
+    "hazo_core": "^1.2.0",
+    "hazo_config": "^2.4.1",
+    "hazo_connect": "^3.9.0",
+    "hazo_files": "^3.1.1",
     "hazo_secure": "^1.2.0",
     "hazo_audit": "^2.1.0",
     "hazo_pdf": "^2.0.0",
@@ -84,10 +84,10 @@
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "hazo_core": "^1.1.0",
-    "hazo_config": "^2.1.10",
-    "hazo_connect": "^3.4.1",
-    "hazo_files": "^3.0.0",
+    "hazo_core": "^1.2.1",
+    "hazo_config": "^2.4.1",
+    "hazo_connect": "^3.9.0",
+    "hazo_files": "^3.1.1",
     "next": "^16.0.10",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",