hazo_env 0.3.0 → 0.5.0

package/CHANGE_LOG.md

@@ -1,5 +1,41 @@
 # hazo_env — Change Log
 
+## 0.5.0 — 2026-06-25
+
+### Added
+- `clearEnv()` — delete all non-preserved tables via PostgREST (reverse FK order) + optional file-dir wipe. Exported from `src/index.ts`. CLI: `hazo-env clear <env>` (prod-target guard: `--allow-prod-target --confirm=<token>`).
+- `ClearRequest` / `ClearResult` types in `src/types/index.ts`; `'clear'` added to `MigrationProgress.phase` union.
+- rsync-over-SSH file transport — `copyFiles()` auto-dispatches to rsync when `[transport.ssh.<fromEnv>]` is configured. `copyFilesRsync()` in `src/migrate/files.ts` spawns `rsync -az --partial --info=progress2`, parses `to-chk=N/TOTAL` for live percent. `onProgress` signature extended with optional `percent` arg.
+- `resolveSshConfig(env)` in `src/resolve/ssh.ts` — reads `[transport.ssh.<env>]` section (host/user/key/path) with `${VAR}` expansion.
+- `resolveTransport()` return type widened to `'local' | 'api' | 'rsync'`; `'ssh'` input now returns `'rsync'` instead of throwing.
+- Per-table DB progress — `DbCopyOptions.onTableProgress` callback fires once per table during PostgREST copy pass; `run.ts` maps it to the 20→70% band with a `"table N/M: <name>"` message.
+- `[transport.ssh.<env>]` section added to `config/hazo_env_config.ini.sample`.
+
+### Test-app
+- `POST /api/clear` route added (mirrors `/api/migrate`).
+- `'clear-env'` autotest scenario added (dry-run guard: verifies prod-target refuses without confirm).
+
+## 0.4.0 — 2026-06-25
+
+### Added
+- `verifyFiles()` L2–L5 — DB-backed file existence (L2), size check (L3), hash check L4 (`full|sample|none`; sample = 1% + top-10 by size + top-10 by changed_at), orphan detection L5. Previously all layers were stubs.
+- `VerifyOptions.adapter` — pass a `HazoConnectAdapter` to enable DB-backed checks; without it verify falls back to sentinel-only (disk) and sets `report.skippedReason`.
+- `VerifyReport` — new fields: `hashed?: number`, `skippedReason?: string`.
+- `runMigration` — step 7 verify now passes `tgtAdapter`; emits detailed warning on `!ok` (counts + snapshotId) but continues (G2: warns-not-aborts).
+- CLI `hazo-env verify` — new `--hash full|sample|none` flag (default `sample`); exits 1 on failure (CI-safe).
+- `doctor()` — section 7a: `_migrations` parity check across all SQLite envs (`--probe --all`); section 7b: masking ruleset column validation against live schema.
+- `DoctorOptions.probe` + `DoctorOptions.all` — enable live DB reachability probes + multi-env checks.
+- `hazo_files` added as optional peer dependency (`^3.5.0`).
+
+### Changed
+- `DoctorReport.passed` replaces `DoctorReport.ok` (previously typo in docs).
+- `DoctorCheck.status` is `'ok'|'warn'|'error'` (not `boolean`).
+
+### Test-app
+- Seed script creates 7 `hazo_files` fixture rows (3 clean, 1 size-mismatch, 1 hash-mismatch, 1 missing, 1 orphan) + physical files under `data/test/files/`.
+- `/api/verify` route + `/verify` report page added.
+- `'verify-fixtures'` autotest scenario added (5 cases).
+
 ## 0.3.0 — 2026-06-10
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ Canonical environment resolver for hazo apps. Typed env names, per-env DB/file/s
 - **Secrets** — `getSecret()` resolves from `.env.local` only; placeholders in `hazo_env_config.ini` are substituted at runtime without storing secrets.
 - **Migration engine** — `runMigration({ from, to })` copies a DB + files between envs. Validates → snapshots target → copies tables (paged, schema-checked) → copies files → verifies → writes hazo_audit entry. Prod target refused without an explicit confirm token.
 - **PII masking** — masking rules declared per table/column in `hazo_env_masking.ini` (seed) and synced to `hazo_app_config` at runtime. Built-in transforms: `mask_email`, `fake_name`, `mask_phone`, `jitter_date`, `hash`, `tokenize`, `drop`, `nullify`. Custom transforms via `registerMask()`. Applied automatically when the migration target role is `test` or `staging`.
-- **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, and schema level.
+- **Doctor** — `doctor()` / `hazo-env doctor` validates pattern, DB reachability, required secrets (no values printed), data_root writability, schema level, and (with `--probe --all`) migration parity across envs + masking ruleset column validation.
 - **CLI** — `hazo-env current | doctor | snapshot | migrate | verify | restore | mask`.
 
 ## Installation
@@ -147,9 +147,11 @@ getSecret('POSTGREST_API_KEY', { required: true })
 ```ts
 import { doctor } from 'hazo_env';
 
-const report = await doctor();
-// report.ok        boolean
-// report.checks    DoctorCheck[] — { label, ok, message }
+const report = await doctor({ probe: true, all: true });
+// report.passed    boolean
+// report.checks    DoctorCheck[] — { label, status: 'ok'|'warn'|'error', detail? }
+// Migration-readiness checks (--probe --all): _migrations parity across envs,
+// masking ruleset column validation against live schema.
 ```
 
 ### Migration engine (server-only)
@@ -171,8 +173,10 @@ const result = await runMigration({
 });
 // result.ok, result.db, result.files, result.snapshotId, result.warnings, result.durationMs
 
-// Stand-alone verification
-await verifyFiles('staging', dataRoot, { hash: 'sample' });
+// Stand-alone verification (with optional hazo_connect adapter for L2–L5 checks)
+await verifyFiles('staging', dataRoot, { hash: 'sample', checkOrphans: true, adapter });
+// report.ok, report.checked, report.hashed, report.missing[], report.sizeMismatch[],
+// report.hashMismatch[], report.orphans[], report.skippedReason?
 
 // Manual snapshot / restore
 const snap = takeSnapshot(connectConfig);   // returns { snapshotId }

package/SETUP_CHECKLIST.md

@@ -94,6 +94,12 @@ All checks should be green before going to production. The doctor validates:
 - All required secrets are present in `.env.local` (values are never printed)
 - `data_root` exists and is writable
 
+Add `--probe --all` for migration-readiness checks:
+```bash
+npx hazo-env doctor --probe --all
+```
+This additionally checks: live DB reachability for all envs, `_migrations` table parity across envs, masking ruleset column validation against live schema.
+
 ## 8. (Next.js) Ensure `hazo_env` is in `transpilePackages`
 
 ```js

package/config/hazo_env_config.ini.sample

@@ -62,3 +62,21 @@ location = remote
 
 [host.prod]
 location = remote
+
+; ─── SSH transport for cross-host file rsync ─────────────────────────────────
+; When [transport.ssh.<env>] is present, copyFiles will use rsync-over-SSH
+; to pull files from that environment's file server instead of local copy.
+; This enables prod→dev migration when both envs run on separate hosts.
+
+[transport.ssh.prod]
+; SSH connection to the prod file server (used when pulling prod→dev).
+; The worker runs rsync FROM prod TO dev — prod stays read-only.
+host = ${SSH_HOST_PROD}
+user = ${SSH_USER_PROD}
+key  = ${SSH_KEY_PATH_PROD}
+path = /home/pubs/kinstripe/var/uploads
+; Optional: pin the server's host key (output of `ssh-keyscan <host>` minus the
+; leading hostname, e.g. "ssh-ed25519 AAAA..."). When set, host-key checking is
+; strict and pinned — no trust-on-first-use. When omitted, the first connection
+; is accepted (accept-new) and persisted to config/hazo_env_known_hosts.
+; host_key = ${SSH_HOST_KEY_PROD}

package/dist/cli.js

@@ -122,12 +122,22 @@ async function runMigrate() {
 }
 async function runVerify() {
     const targetEnv = args[0] ?? getEnv();
-    console.log(`\n${pc.bold('hazo-env verify')} ${pc.dim(targetEnv)}\n`);
+    // Parse --hash full|sample|none (default: sample) and --no-orphans
+    const hashIdx = args.indexOf('--hash');
+    const hashArg = hashIdx >= 0 ? args[hashIdx + 1] : 'sample';
+    const hash = (hashArg === 'full' || hashArg === 'none' || hashArg === 'sample') ? hashArg : 'sample';
+    const checkOrphans = !args.includes('--no-orphans');
+    console.log(`\n${pc.bold('hazo-env verify')} ${pc.dim(targetEnv)} ${pc.dim(`--hash ${hash}`)}\n`);
     const { verifyFiles } = await import('./migrate/verify.js');
     const { resolveFilesConfig } = await import('./resolve/files.js');
     const dataRoot = resolveFilesConfig().local.basePath;
-    const report = await verifyFiles(targetEnv, dataRoot, { hash: 'sample', checkOrphans: true });
-    console.log(`  Checked: ${report.checked} files`);
+    const report = await verifyFiles(targetEnv, dataRoot, { hash, checkOrphans });
+    if (report.skippedReason) {
+        console.log(`  ${pc.yellow('⚠')} ${report.skippedReason}`);
+    }
+    console.log(`  Checked: ${report.checked} files${report.hashed != null ? `, hashed: ${report.hashed}` : ''}`);
+    if (report.orphans.length)
+        console.log(`  ${pc.dim('ℹ')} Orphans (no DB row): ${report.orphans.join(', ')}`);
     if (report.ok) {
         console.log(`  ${pc.green('✓')} All files verified\n`);
     }
@@ -136,8 +146,10 @@ async function runVerify() {
             console.log(`  ${pc.red('✗')} Missing: ${report.missing.join(', ')}`);
         if (report.sizeMismatch.length)
             console.log(`  ${pc.yellow('⚠')} Size mismatch: ${report.sizeMismatch.join(', ')}`);
+        if (report.hashMismatch.length)
+            console.log(`  ${pc.yellow('⚠')} Hash mismatch: ${report.hashMismatch.join(', ')}`);
         console.log('');
-        process.exit(1);
+        process.exit(1); // S4: standalone verify exits 1 on failure (CI-friendly)
     }
 }
 async function runRestore() {
@@ -155,6 +167,39 @@ async function runRestore() {
     restoreSnapshot(toConfig, snapshotId);
     console.log(`  ${pc.green('✓')} Restored\n`);
 }
+async function runClear() {
+    const targetEnv = args[0] ?? getEnv();
+    const allowProd = args.includes('--allow-prod-target');
+    const confirm = args.find((a) => a.startsWith('--confirm='))?.split('=')[1];
+    console.log(`\n${pc.bold('hazo-env clear')} ${pc.dim(targetEnv)}\n`);
+    const { clearEnv } = await import('./migrate/clear.js');
+    try {
+        let lastMsg = '';
+        const result = await clearEnv({
+            env: targetEnv,
+            allowProdTarget: allowProd,
+            confirmToken: confirm,
+            onProgress: (p) => {
+                if (p.message !== lastMsg) {
+                    const pctStr = p.percent != null ? ` [${p.percent}%]` : '';
+                    console.log(`  ${pc.dim('·')} ${p.message}${pctStr}`);
+                    lastMsg = p.message;
+                }
+            },
+        });
+        if (result.ok) {
+            console.log(`  ${pc.green('✓')} Cleared ${result.tablesCleared} tables${result.filesCleared ? ' + files' : ''} in ${result.durationMs}ms\n`);
+            if (result.warnings.length)
+                result.warnings.forEach((w) => console.log(`  ${pc.yellow('⚠')} ${w}`));
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`\n  ${pc.red('✗')} ${msg}\n`);
+        process.exit(1);
+    }
+    console.log('');
+}
 async function runMask() {
     const subCmd = args[0];
     if (subCmd === 'sync') {
@@ -221,10 +266,14 @@ Usage:
     --no-db / --no-files                    Skip DB or file copy
     --allow-prod-target --confirm <token>   Override prod-target safety
   hazo-env verify <env>                     Verify files for an environment
+    --hash full|sample|none                Hash-check all / sampled / none (default: sample)
+    --no-orphans                           Skip orphan detection
   hazo-env restore <env> --snapshot <id>   Restore a snapshot
   hazo-env snapshot <env>                   Take a snapshot of an environment
   hazo-env mask sync                        Load masking ruleset from INI into DB
   hazo-env mask list                        List registered mask transforms
+  hazo-env clear <env>                      Wipe DB tables + files for an environment
+    --allow-prod-target --confirm=<token>   Override prod-target safety
 `);
 }
 (async () => {
@@ -250,6 +299,9 @@ Usage:
         else if (command === 'mask') {
             await runMask();
         }
+        else if (command === 'clear') {
+            await runClear();
+        }
         else {
             printHelp();
         }

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2J5E"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8R5E"}

package/dist/doctor.js

@@ -166,6 +166,158 @@ export async function doctor(opts = {}) {
             });
         }
     }
+    // 7. Migration readiness checks
+    // 7a. _migrations parity (probe mode, --all): open each SQLite env and compare name-sets
+    if (opts.probe && opts.all) {
+        const migSets = new Map();
+        for (const env of envsToCheck) {
+            let cfg;
+            try {
+                cfg = resolveConnectConfig({ env, allowOtherEnv: true });
+            }
+            catch {
+                continue;
+            }
+            if (cfg.type !== 'sqlite' || !cfg.sqlite)
+                continue;
+            try {
+                const Database = require('better-sqlite3');
+                const db = Database(cfg.sqlite.database_path);
+                let names;
+                try {
+                    names = db.prepare('SELECT name FROM _migrations').all().map((r) => r.name);
+                }
+                catch {
+                    names = [];
+                }
+                db.close();
+                migSets.set(env, new Set(names));
+            }
+            catch {
+                // DB not openable — skip (probe check already reported error)
+            }
+        }
+        if (migSets.size >= 2) {
+            const envList = [...migSets.keys()];
+            const referenceSet = migSets.get(envList[0]);
+            const referenceEnv = envList[0];
+            for (const env of envList.slice(1)) {
+                const s = migSets.get(env);
+                const onlyInRef = [...referenceSet].filter((n) => !s.has(n));
+                const onlyInEnv = [...s].filter((n) => !referenceSet.has(n));
+                if (onlyInRef.length === 0 && onlyInEnv.length === 0) {
+                    checks.push({ label: `Migration parity (${referenceEnv} ↔ ${env})`, status: 'ok', detail: `${s.size} applied` });
+                }
+                else {
+                    const detail = [
+                        onlyInRef.length ? `only in ${referenceEnv}: ${onlyInRef.join(', ')}` : '',
+                        onlyInEnv.length ? `only in ${env}: ${onlyInEnv.join(', ')}` : '',
+                    ].filter(Boolean).join('; ');
+                    checks.push({ label: `Migration parity (${referenceEnv} ↔ ${env})`, status: 'warn', detail });
+                }
+            }
+        }
+    }
+    // 7b. Masking ruleset column validation: every (table, column) in the masking INI must
+    //     exist in at least one SQLite env's schema. Skip silently for PostgREST envs.
+    const maskingConfigPath = path.resolve(process.cwd(), 'config', 'hazo_env_masking.ini');
+    if (fs.existsSync(maskingConfigPath)) {
+        try {
+            // Parse the masking INI directly — HazoConfig doesn't expose section enumeration.
+            // Format: each [section] is a table name; keys are column names.
+            const iniContent = fs.readFileSync(maskingConfigPath, 'utf-8');
+            const rules = [];
+            let currentTable = '';
+            for (const rawLine of iniContent.split('\n')) {
+                const line = rawLine.trim();
+                if (!line || line.startsWith(';') || line.startsWith('#'))
+                    continue;
+                const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+                if (sectionMatch) {
+                    currentTable = sectionMatch[1].trim();
+                    continue;
+                }
+                if (!currentTable)
+                    continue;
+                const eqIdx = line.indexOf('=');
+                if (eqIdx < 0)
+                    continue;
+                const column = line.slice(0, eqIdx).trim();
+                if (column)
+                    rules.push({ table: currentTable, column });
+            }
+            if (rules.length > 0) {
+                // Collect SQLite schemas for checked envs
+                const schemas = new Map(); // "table.column" → present
+                for (const env of envsToCheck) {
+                    let cfg;
+                    try {
+                        cfg = resolveConnectConfig({ env, allowOtherEnv: true });
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (cfg.type !== 'sqlite' || !cfg.sqlite)
+                        continue;
+                    try {
+                        const Database = require('better-sqlite3');
+                        const db = Database(cfg.sqlite.database_path);
+                        try {
+                            const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map((r) => r.name);
+                            for (const tbl of tables) {
+                                const cols = db.prepare(`PRAGMA table_info(${tbl})`).all();
+                                for (const col of cols) {
+                                    schemas.set(`${tbl}.${col.name}`, new Set());
+                                }
+                            }
+                        }
+                        catch { /* DB empty or unreadable */ }
+                        db.close();
+                    }
+                    catch { /* DB not openable */ }
+                }
+                if (schemas.size > 0) {
+                    const badRules = [];
+                    for (const { table, column } of rules) {
+                        if (!schemas.has(`${table}.${column}`)) {
+                            badRules.push(`${table}.${column}`);
+                        }
+                    }
+                    if (badRules.length === 0) {
+                        checks.push({ label: 'Masking ruleset columns', status: 'ok', detail: `${rules.length} rule(s) validated` });
+                    }
+                    else {
+                        checks.push({
+                            label: 'Masking ruleset columns',
+                            status: 'warn',
+                            detail: `Column(s) not found in schema: ${badRules.join(', ')} (PostgREST envs skipped)`,
+                        });
+                    }
+                }
+                else {
+                    // No SQLite envs probed — can't validate columns; skip silently
+                    const hasPostgrest = envsToCheck.some((env) => {
+                        try {
+                            return resolveConnectConfig({ env, allowOtherEnv: true }).type === 'postgrest';
+                        }
+                        catch {
+                            return false;
+                        }
+                    });
+                    if (hasPostgrest) {
+                        checks.push({
+                            label: 'Masking ruleset columns',
+                            status: 'ok',
+                            detail: 'PostgREST env — column validation skipped',
+                        });
+                    }
+                }
+            }
+        }
+        catch {
+            // Masking config parse failure — non-fatal, skip
+        }
+    }
     const passed = checks.every((c) => c.status !== 'error');
     return { env: targetEnv, checks, passed };
 }

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export * from './resolve/connect.js';
 export * from './resolve/files.js';
 export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -13,6 +13,7 @@ export * from './resolve/files.js';
 export * from './doctor.js';
 // Migration engine (Phase 2)
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';

package/dist/migrate/clear.d.ts

@@ -0,0 +1,3 @@
+import type { ClearRequest, ClearResult } from '../types/index.js';
+export declare function clearEnv(req: ClearRequest): Promise<ClearResult>;
+//# sourceMappingURL=clear.d.ts.map

package/dist/migrate/clear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear.d.ts","sourceRoot":"","sources":["../../src/migrate/clear.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAYtF,wBAAsB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoHtE"}

package/dist/migrate/clear.js

@@ -0,0 +1,117 @@
+// hazo_env/src/migrate/clear.ts — clearEnv: wipe DB tables + files for a target environment
+import { HazoError, optional_import } from 'hazo_core';
+import { getEnvRole } from '../env.server.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
+import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveFilesRoot } from '../resolve/files.js';
+import { writeMigrationProgress } from './progress.js';
+import fs from 'node:fs';
+function emitProgress(req, p) {
+    req.onProgress?.(p);
+    if (req.jobId && req.progressDir) {
+        writeMigrationProgress(req.progressDir, req.jobId, p);
+    }
+}
+export async function clearEnv(req) {
+    const startMs = Date.now();
+    const warnings = [];
+    // Guard: refuse production target unless explicitly unlocked with a confirm token
+    const role = getEnvRole(req.env);
+    if (role === 'production' && !req.allowProdTarget) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: `Refusing to clear production environment "${req.env}". Pass allowProdTarget:true and a confirmToken to override.`,
+        });
+    }
+    if (role === 'production' && req.allowProdTarget && !req.confirmToken) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: 'Production target requires a confirmToken for safety.',
+        });
+    }
+    emitProgress(req, { phase: 'validate', message: 'Validating clear request', percent: 0 });
+    const migrateConfig = resolveMigrateConfig();
+    const { tables, preserve = [], pkOverrides = {} } = migrateConfig;
+    if (!tables || tables.length === 0) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'clearEnv requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini.',
+        });
+    }
+    const tablesToClear = [...tables.filter((t) => !preserve.includes(t))].reverse();
+    const dbConfig = resolveConnectConfig({ env: req.env, allowOtherEnv: true });
+    if (dbConfig.type !== 'postgrest') {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `clearEnv only supports PostgREST connections (got "${dbConfig.type}").`,
+        });
+    }
+    if (!dbConfig.postgrest) {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: 'PostgREST config missing base_url/api_key.',
+        });
+    }
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for clearEnv. Install hazo_connect to continue.',
+        });
+    }
+    const tgtAdapter = connect.createHazoConnect({
+        type: 'postgrest',
+        postgrest: {
+            base_url: dbConfig.postgrest.base_url,
+            api_key: dbConfig.postgrest.api_key,
+        },
+    });
+    // DB clear (only if not explicitly disabled)
+    let tablesCleared = 0;
+    if (req.include?.db !== false) {
+        for (let idx = 0; idx < tablesToClear.length; idx++) {
+            const table = tablesToClear[idx];
+            const percent = Math.round(((idx + 1) / tablesToClear.length) * 90);
+            emitProgress(req, {
+                phase: 'clear',
+                message: `Clearing table ${idx + 1}/${tablesToClear.length}: ${table}`,
+                percent,
+            });
+            const pk = pkOverrides[table] ?? 'id';
+            try {
+                await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+                tablesCleared++;
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                warnings.push(`Warning: could not clear ${table}: ${msg}`);
+            }
+        }
+    }
+    // File clear
+    let filesCleared = false;
+    if (req.include?.files !== false) {
+        emitProgress(req, { phase: 'clear', message: 'Clearing files...', percent: 92 });
+        const filesRoot = resolveFilesRoot(req.env);
+        if (fs.existsSync(filesRoot)) {
+            fs.rmSync(filesRoot, { recursive: true, force: true });
+        }
+        fs.mkdirSync(filesRoot, { recursive: true });
+        filesCleared = true;
+    }
+    emitProgress(req, { phase: 'done', message: 'Clear complete', percent: 100 });
+    return {
+        ok: true,
+        tablesCleared,
+        filesCleared,
+        durationMs: Date.now() - startMs,
+        warnings,
+    };
+}

package/dist/migrate/db.d.ts

@@ -1,8 +1,12 @@
 import type { HazoConnectAdapter } from 'hazo_connect';
 export interface DbCopyOptions {
+    type?: 'sqlite' | 'postgrest';
     tables?: '*' | string[];
+    preserve?: string[];
+    pkOverrides?: Record<string, string>;
     scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
     onProgress?: (msg: string) => void;
+    onTableProgress?: (tableIdx: number, totalTables: number, tableName: string) => void;
 }
 export interface DbCopyResult {
     tables: number;

package/dist/migrate/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CACtF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/migrate/db.js

@@ -21,6 +21,11 @@ async function getMigrationNames(adapter) {
     return rows.map((r) => r.name);
 }
 export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
+    // PostgREST path: dispatch to dedicated implementation
+    if (opts.type === 'postgrest') {
+        const { copyDbPostgrest } = await import('./db.postgrest.js');
+        return copyDbPostgrest(srcAdapter, tgtAdapter, opts);
+    }
     const connect = await optional_import('hazo_connect/server');
     if (!connect) {
         throw new HazoError({
@@ -29,7 +34,7 @@ export async function copyDb(srcAdapter, tgtAdapter, opts = {}) {
             message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
         });
     }
-    // Schema parity check via _migrations
+    // Schema parity check via _migrations (SQLite only — PostgREST apps may not use _migrations)
     const srcMigrations = await getMigrationNames(srcAdapter);
     const tgtMigrations = await getMigrationNames(tgtAdapter);
     if (srcMigrations === null || tgtMigrations === null) {

package/dist/migrate/db.postgrest.d.ts

@@ -0,0 +1,4 @@
+import type { HazoConnectAdapter } from 'hazo_connect';
+import type { DbCopyOptions, DbCopyResult } from './db.js';
+export declare function copyDbPostgrest(srcAdapter: HazoConnectAdapter, tgtAdapter: HazoConnectAdapter, opts?: DbCopyOptions): Promise<DbCopyResult>;
+//# sourceMappingURL=db.postgrest.d.ts.map

package/dist/migrate/db.postgrest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}