hazo_env 0.3.0 → 0.5.0

package/dist/migrate/db.postgrest.js

@@ -0,0 +1,95 @@
+// hazo_env/src/migrate/db.postgrest.ts — PostgREST-based DB copy (REST-only, no raw SQL)
+import { HazoError, optional_import } from 'hazo_core';
+import { isSecretColumn } from '../lib/secret_columns.js';
+const PAGE_SIZE = 500;
+export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for DB migration. Install hazo_connect to continue.',
+        });
+    }
+    // Table list is required for PostgREST (no auto-discovery — FK ordering unsafe without explicit list)
+    if (!opts.tables || opts.tables === '*') {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'PostgREST migration requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini or pass --tables to the CLI.',
+        });
+    }
+    const orderedTables = opts.tables;
+    const preserveSet = new Set(opts.preserve ?? []);
+    const pkOverrides = opts.pkOverrides ?? {};
+    // Tables to actually process (exclude preserve list)
+    const tablesToProcess = orderedTables.filter((t) => !preserveSet.has(t));
+    // --- Clear pass: reverse dependency order ---
+    opts.onProgress?.('Clearing target tables (reverse order for FK safety)...');
+    for (const table of [...tablesToProcess].reverse()) {
+        const pk = pkOverrides[table] ?? 'id';
+        try {
+            // PostgREST match-all DELETE: DELETE /table?pk=not.is.null
+            await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+            opts.onProgress?.(`Cleared: ${table}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            opts.onProgress?.(`Warning: could not clear ${table}: ${msg}`);
+        }
+    }
+    let totalRows = 0;
+    let totalScrubbed = 0;
+    // --- Copy pass: forward dependency order ---
+    for (const table of tablesToProcess) {
+        const tableIdx = tablesToProcess.indexOf(table);
+        opts.onProgress?.(`Copying table ${tableIdx + 1}/${tablesToProcess.length}: ${table}`);
+        opts.onTableProgress?.(tableIdx + 1, tablesToProcess.length, table);
+        const pk = pkOverrides[table] ?? 'id';
+        const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
+        const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });
+        let offset = 0;
+        let pageRows = [];
+        do {
+            pageRows = await srcService.list((qb) => 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            qb.order(pk, 'asc').limit(PAGE_SIZE).offset(offset));
+            if (pageRows.length === 0)
+                break;
+            const batch = [];
+            for (let row of pageRows) {
+                const cleaned = {};
+                let didScrub = false;
+                for (const [col, val] of Object.entries(row)) {
+                    if (isSecretColumn(col)) {
+                        didScrub = true;
+                    }
+                    else {
+                        cleaned[col] = val;
+                    }
+                }
+                let processedRow = cleaned;
+                if (opts.scrubHook) {
+                    const hooked = opts.scrubHook(table, cleaned);
+                    if (hooked !== cleaned)
+                        didScrub = true;
+                    processedRow = hooked;
+                }
+                if (didScrub)
+                    totalScrubbed++;
+                batch.push(processedRow);
+            }
+            if (batch.length > 0) {
+                await tgtService.insert(batch);
+                totalRows += batch.length;
+                opts.onProgress?.(`  inserted ${batch.length} rows into ${table}`);
+            }
+            offset += PAGE_SIZE;
+        } while (pageRows.length === PAGE_SIZE);
+    }
+    // Note: PostgREST has no REST endpoint for NOTIFY. Schema reload only needed after DDL.
+    // If schema DDL changed since last reload, run: NOTIFY pgrst, 'reload schema' in Postgres.
+    opts.onProgress?.("DB copy complete. If schema DDL changed, run NOTIFY pgrst, 'reload schema' in Postgres.");
+    return { tables: tablesToProcess.length, rows: totalRows, scrubbed: totalScrubbed };
+}

package/dist/migrate/files.d.ts

@@ -2,8 +2,9 @@ import type { HazoEnv } from '../types/index.js';
 export interface FilesCopyOptions {
     fromEnv: HazoEnv;
     toEnv: HazoEnv;
+    transport?: 'local' | 'rsync';
     fileScrubHook?: (filePath: string) => Promise<void>;
-    onProgress?: (msg: string) => void;
+    onProgress?: (msg: string, percent?: number) => void;
 }
 export interface FilesCopyResult {
     copied: number;

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA4BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA6GD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}

package/dist/migrate/files.js

@@ -6,11 +6,11 @@
 // Failures are non-fatal warnings — the file copy still completes.
 import fs from 'node:fs';
 import path from 'node:path';
-import { resolveFilesConfig } from '../resolve/files.js';
+import { spawn } from 'node:child_process';
+import { resolveFilesRoot } from '../resolve/files.js';
+import { resolveSshConfig } from '../resolve/ssh.js';
 function resolveEnvFilesRoot(env) {
-    // resolveFilesConfig returns the data root; env-specific files are at <root>/<env>/files
-    const base = resolveFilesConfig().local.basePath;
-    return path.join(base, env, 'files');
+    return resolveFilesRoot(env);
 }
 /**
  * Attempt to scrub a PDF file in-place using hazo_pdf/mask_pdf.
@@ -31,7 +31,88 @@ async function scrubPdfFile(filePath) {
         // Non-fatal — PDF scrubbing failure is a warning, not an abort
     }
 }
+/**
+ * Reject ssh config values that could smuggle extra ssh options through rsync's
+ * `-e` command string. rsync re-splits `-e` on whitespace, so a value starting
+ * with `-` (e.g. `-oProxyCommand=...`) or containing whitespace would be parsed
+ * as additional ssh flags rather than data. Fail loud instead of running.
+ */
+function assertSafeSshField(name, value) {
+    if (/^-/.test(value) || /\s/.test(value)) {
+        throw new Error(`Unsafe transport.ssh.${name} value: must not start with '-' or contain whitespace`);
+    }
+}
+async function copyFilesRsync(opts, ssh) {
+    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
+    fs.mkdirSync(tgtRoot, { recursive: true });
+    assertSafeSshField('user', ssh.user);
+    assertSafeSshField('host', ssh.host);
+    assertSafeSshField('key', ssh.key);
+    assertSafeSshField('path', ssh.path);
+    // Persistent known_hosts so host-key trust survives across runs (no TOFU reset).
+    const knownHosts = path.resolve(process.cwd(), 'config', 'hazo_env_known_hosts');
+    fs.mkdirSync(path.dirname(knownHosts), { recursive: true });
+    if (ssh.hostKey) {
+        // Pin the operator-provided host key; strict checking, no first-use prompt.
+        const line = `${ssh.host} ${ssh.hostKey}\n`;
+        const existing = fs.existsSync(knownHosts) ? fs.readFileSync(knownHosts, 'utf8') : '';
+        if (!existing.includes(line.trim()))
+            fs.appendFileSync(knownHosts, line);
+    }
+    // Pinned key → strict verify; otherwise accept-new (trust on first use, then
+    // persist) — never disable host-key checking outright.
+    const strict = ssh.hostKey ? 'yes' : 'accept-new';
+    const remote = `${ssh.user}@${ssh.host}:${ssh.path}/`;
+    const sshCmd = `ssh -i ${ssh.key} -o StrictHostKeyChecking=${strict} -o UserKnownHostsFile=${knownHosts}`;
+    const args = ['-az', '--partial', '--info=progress2', '-e', sshCmd, remote, tgtRoot + '/'];
+    return new Promise((resolve, reject) => {
+        const proc = spawn('rsync', args);
+        let totalFiles = 0;
+        let doneFiles = 0;
+        let totalBytes = 0;
+        proc.stdout.on('data', (chunk) => {
+            const text = chunk.toString();
+            // Parse --info=progress2: lines like "     117,504,614 100%  108.64MB/s    0:00:01 (xfr#123, to-chk=0/456)"
+            for (const line of text.split('\n')) {
+                // Extract to-chk=N/TOTAL
+                const chkMatch = line.match(/to-chk=(\d+)\/(\d+)/);
+                if (chkMatch) {
+                    const remaining = parseInt(chkMatch[1], 10);
+                    const total = parseInt(chkMatch[2], 10);
+                    if (totalFiles === 0)
+                        totalFiles = total;
+                    doneFiles = total - remaining;
+                    const pct = total > 0 ? Math.round((doneFiles / total) * 100) : 0;
+                    opts.onProgress?.(`rsync: ${doneFiles}/${total} files (${pct}%)`, pct);
+                }
+                // Extract bytes: first number on lines with a %
+                const bytesMatch = line.match(/^\s+([\d,]+)\s+\d+%/);
+                if (bytesMatch) {
+                    totalBytes = parseInt(bytesMatch[1].replace(/,/g, ''), 10);
+                }
+            }
+        });
+        proc.stderr.on('data', (chunk) => {
+            opts.onProgress?.(`rsync: ${chunk.toString().trim()}`, undefined);
+        });
+        proc.on('error', (err) => reject(err));
+        proc.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`rsync exited with code ${code}`));
+            }
+            else {
+                resolve({ copied: doneFiles || totalFiles, bytes: totalBytes, placeholdered: 0 });
+            }
+        });
+    });
+}
 export async function copyFiles(opts) {
+    const ssh = resolveSshConfig(opts.fromEnv);
+    if (opts.transport === 'rsync' || (opts.transport !== 'local' && ssh !== null)) {
+        if (!ssh)
+            throw new Error(`rsync requested but no [transport.ssh.${opts.fromEnv}] config found`);
+        return copyFilesRsync(opts, ssh);
+    }
     const srcRoot = resolveEnvFilesRoot(opts.fromEnv);
     const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
     if (!fs.existsSync(srcRoot)) {

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkJlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwLlF"}

package/dist/migrate/run.js

@@ -6,6 +6,7 @@
 // See: src/migrate/files.ts scrubPdfFile() and hazo_pdf/src/server/mask.ts
 import { HazoError, optional_import } from 'hazo_core';
 import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
 import { resolveFilesConfig } from '../resolve/files.js';
 import { resolveTransport } from './transport.js';
 import { takeSnapshot } from './snapshot.js';
@@ -122,20 +123,43 @@ export async function runMigration(req) {
     }
     // Create adapters
     function makeAdapter(dbConfig, readOnly = false) {
-        if (dbConfig.type !== 'sqlite' || !dbConfig.sqlite) {
-            throw new HazoError({
-                code: 'HAZO_ENV_NOT_IMPLEMENTED',
-                pkg: 'hazo_env',
-                message: `Migration is only implemented for SQLite databases. Got type "${dbConfig.type}".`,
+        if (dbConfig.type === 'sqlite') {
+            if (!dbConfig.sqlite) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'SQLite config missing database_path.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'sqlite',
+                sqlite: {
+                    database_path: dbConfig.sqlite.database_path,
+                    read_only: readOnly,
+                    driver: getSqliteDriver(),
+                },
             });
         }
-        return connect.createHazoConnect({
-            type: 'sqlite',
-            sqlite: {
-                database_path: dbConfig.sqlite.database_path,
-                read_only: readOnly,
-                driver: getSqliteDriver(),
-            },
+        if (dbConfig.type === 'postgrest') {
+            if (!dbConfig.postgrest) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_NOT_IMPLEMENTED',
+                    pkg: 'hazo_env',
+                    message: 'PostgREST config missing base_url/api_key.',
+                });
+            }
+            return connect.createHazoConnect({
+                type: 'postgrest',
+                postgrest: {
+                    base_url: dbConfig.postgrest.base_url,
+                    api_key: dbConfig.postgrest.api_key,
+                },
+            });
+        }
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `Migration is not implemented for DB type "${dbConfig.type}".`,
         });
     }
     const srcAdapter = makeAdapter(fromDbConfig, true);
@@ -144,14 +168,23 @@ export async function runMigration(req) {
     emitProgress(req, { phase: 'schema-check', message: 'Checking schema parity', percent: 15 });
     let dbResult;
     let filesResult;
+    const migrateConfig = resolveMigrateConfig();
     // Step 5: DB copy
     if (includeDb) {
         emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
         const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
         const result = await copyDb(srcAdapter, tgtAdapter, {
-            tables: req.tables,
+            type: fromDbConfig.type,
+            tables: req.tables ?? migrateConfig.tables,
+            preserve: migrateConfig.preserve,
+            pkOverrides: migrateConfig.pkOverrides,
             scrubHook,
             onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+            onTableProgress: (idx, total, name) => emitProgress(req, {
+                phase: 'db',
+                message: `table ${idx}/${total}: ${name}`,
+                percent: 20 + Math.round((idx / total) * 50),
+            }),
         });
         dbResult = result;
         emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
@@ -169,9 +202,16 @@ export async function runMigration(req) {
     // Step 7: Verify
     emitProgress(req, { phase: 'verify', message: 'Running post-migration verification', percent: 80 });
     const dataRoot = resolveFilesConfig().local.basePath;
-    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true });
+    const verifyReport = await verifyFiles(req.to, dataRoot, { hash: 'sample', checkOrphans: true, adapter: tgtAdapter });
     if (!verifyReport.ok) {
-        warnings.push(`Verification found issues: missing=${verifyReport.missing.length}, sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        const parts = [];
+        if (verifyReport.missing.length)
+            parts.push(`missing=${verifyReport.missing.length}`);
+        if (verifyReport.sizeMismatch.length)
+            parts.push(`sizeMismatch=${verifyReport.sizeMismatch.length}`);
+        if (verifyReport.hashMismatch.length)
+            parts.push(`hashMismatch=${verifyReport.hashMismatch.length}`);
+        warnings.push(`Verify found issues (${parts.join(', ')}) — migration continues; snapshotId=${snapshot.snapshotId}`);
     }
     // Step 8: Finalize — audit
     emitProgress(req, { phase: 'finalize', message: 'Recording audit event', percent: 95 });

package/dist/migrate/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAmBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../src/migrate/snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,cAAc,CAsBlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB/E"}

package/dist/migrate/snapshot.js

@@ -3,6 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { HazoError } from 'hazo_core';
 export function takeSnapshot(toConfig) {
+    if (toConfig.type === 'postgrest') {
+        return { snapshotId: 'postgrest:no-snapshot', createdAt: new Date().toISOString() };
+    }
     if (toConfig.type !== 'sqlite' || !toConfig.sqlite?.database_path) {
         throw new HazoError({
             code: 'HAZO_ENV_NOT_IMPLEMENTED',

package/dist/migrate/transport.d.ts

@@ -1,3 +1,3 @@
 import type { TransportMode, DbEnvConfig } from '../types/index.js';
-export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api';
+export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync';
 //# sourceMappingURL=transport.d.ts.map

package/dist/migrate/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,CAYjB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,CAM3B"}

package/dist/migrate/transport.js

@@ -1,13 +1,6 @@
-// hazo_env/src/migrate/transport.ts — resolve transport mode for a migration
-import { HazoError } from 'hazo_core';
 export function resolveTransport(fromConfig, toConfig, requested = 'auto') {
-    if (requested === 'ssh') {
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: 'SSH transport is not yet implemented. Use local or api transport.',
-        });
-    }
+    if (requested === 'ssh')
+        return 'rsync';
     if (requested === 'api')
         return 'api';
     // auto: both sqlite → local

package/dist/migrate/verify.d.ts

@@ -3,6 +3,7 @@ export interface VerifyOptions {
     hash?: HashMode;
     samplePct?: number;
     checkOrphans?: boolean;
+    adapter?: import('hazo_connect').HazoConnectAdapter;
 }
 export declare function verifyFiles(env: HazoEnv, dataRoot: string, opts?: VerifyOptions): Promise<VerifyReport>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/migrate/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAMD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAgDvB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/migrate/verify.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,cAAc,EAAE,kBAAkB,CAAC;CACrD;AAqBD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA8IvB"}

package/dist/migrate/verify.js

@@ -1,51 +1,141 @@
 // hazo_env/src/migrate/verify.ts — post-migration file verification
 import fs from 'node:fs';
 import path from 'node:path';
+import { optional_import } from 'hazo_core';
 function resolveEnvFilesRoot(env, dataRoot) {
     return path.join(dataRoot, env, 'files');
 }
+function walkDir(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+        const absPath = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            return walkDir(absPath);
+        // Return relative to dir's parent so caller can strip filesRoot prefix
+        return [absPath];
+    });
+}
+function walkRelative(filesRoot) {
+    const abs = walkDir(filesRoot);
+    return abs.map((p) => p.slice(filesRoot.length + 1)); // strip filesRoot + sep
+}
 export async function verifyFiles(env, dataRoot, opts = {}) {
-    const { checkOrphans = true } = opts;
+    const { hash = 'sample', checkOrphans = true, adapter } = opts;
     const filesRoot = resolveEnvFilesRoot(env, dataRoot);
     const missing = [];
     const sizeMismatch = [];
     const hashMismatch = [];
     const orphans = [];
     let checked = 0;
-    let sentinelOk = true;
-    // Layer 1: check sentinel file (data root exists and is readable)
-    if (!fs.existsSync(filesRoot)) {
-        sentinelOk = false;
+    let hashed;
+    // Layer 1: sentinel — filesRoot must exist and be readable
+    const sentinelOk = fs.existsSync(filesRoot);
+    if (!sentinelOk) {
         return { ok: false, checked: 0, missing: [], sizeMismatch: [], hashMismatch: [], orphans: [], sentinelOk: false };
     }
-    // Layer 2 & 3: walk all files
-    function walkDir(dir, relBase) {
-        if (!fs.existsSync(dir))
-            return [];
-        return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-            const relPath = path.join(relBase, entry.name);
-            const absPath = path.join(dir, entry.name);
-            if (entry.isDirectory())
-                return walkDir(absPath, relPath);
-            return [relPath];
-        });
-    }
-    const diskFiles = walkDir(filesRoot, '');
-    for (const relPath of diskFiles) {
+    // S3: Fallback detection — need both hazo_files module and an adapter
+    const hazoFiles = await optional_import('hazo_files');
+    if (!hazoFiles || !adapter) {
+        // Disk-only fallback
+        const diskFiles = walkRelative(filesRoot);
+        checked = diskFiles.length;
+        const skippedReason = 'no hazo_files tracking — size/hash/orphan skipped';
+        const ok = sentinelOk && missing.length === 0;
+        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
+    }
+    // Main path: adapter + hazo_files available
+    const connectMod = await optional_import('hazo_connect/server');
+    let rows = [];
+    let skippedReason;
+    try {
+        if (!connectMod)
+            throw new Error('hazo_connect not available');
+        const service = connectMod.createCrudService(adapter, 'hazo_files');
+        const all = await service.list();
+        rows = all.filter((r) => !r.storage_type || r.storage_type === 'local');
+    }
+    catch {
+        // Table not found or connect unavailable — disk-only fallback
+        const diskFiles = walkRelative(filesRoot);
+        checked = diskFiles.length;
+        skippedReason = 'hazo_files table not found — disk-only fallback';
+        const ok = sentinelOk && missing.length === 0;
+        return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, skippedReason };
+    }
+    // Normalize DB paths: strip leading slash if present
+    const normalizeDbPath = (p) => p.startsWith('/') ? p.slice(1) : p;
+    const dbPathSet = new Set(rows.map((r) => normalizeDbPath(r.file_path)));
+    // Track present rows for hash/size checks
+    const presentRows = [];
+    // L2 Existence
+    for (const row of rows) {
+        const relPath = normalizeDbPath(row.file_path);
         const absPath = path.join(filesRoot, relPath);
-        try {
-            fs.statSync(absPath); // existence + size (stat succeeds = file accessible)
-            checked++;
+        if (!fs.existsSync(absPath)) {
+            missing.push(row.file_path);
+        }
+        else {
+            presentRows.push({ ...row, file_path: relPath });
         }
-        catch {
-            missing.push(relPath);
+    }
+    // L3 Size
+    for (const row of presentRows) {
+        const absPath = path.join(filesRoot, row.file_path);
+        const stat = fs.statSync(absPath);
+        if (row.file_size != null && stat.size !== row.file_size) {
+            sizeMismatch.push(row.file_path);
+        }
+        checked++;
+    }
+    // L4 Hash
+    if (hash !== 'none') {
+        let toHash;
+        if (hash === 'full') {
+            toHash = presentRows;
+        }
+        else {
+            // sample: 1% random (min 1) + top 10 by file_size DESC + top 10 by file_changed_at DESC
+            const n = Math.max(1, Math.floor(presentRows.length * 0.01));
+            const shuffled = [...presentRows].sort(() => Math.random() - 0.5).slice(0, n);
+            const bySize = [...presentRows]
+                .filter((r) => r.file_size != null)
+                .sort((a, b) => (b.file_size ?? 0) - (a.file_size ?? 0))
+                .slice(0, 10);
+            const byChanged = [...presentRows]
+                .filter((r) => r.file_changed_at != null)
+                .sort((a, b) => (b.file_changed_at ?? '') < (a.file_changed_at ?? '') ? -1 : 1)
+                .slice(0, 10);
+            // Deduplicate by file_path
+            const seen = new Set();
+            toHash = [];
+            for (const r of [...shuffled, ...bySize, ...byChanged]) {
+                if (!seen.has(r.file_path)) {
+                    seen.add(r.file_path);
+                    toHash.push(r);
+                }
+            }
+        }
+        hashed = 0;
+        for (const row of toHash) {
+            const absPath = path.join(filesRoot, row.file_path);
+            const buf = fs.readFileSync(absPath);
+            const computed = hazoFiles.computeFileHashSync(buf);
+            if (row.file_hash && computed !== row.file_hash) {
+                hashMismatch.push(row.file_path);
+            }
+            hashed++;
         }
     }
-    // Layer 4: orphan check — files on disk with no corresponding DB tracking row
-    // In Phase A, hazo_files integration is not wired; just verify directory is readable
-    if (checkOrphans && !fs.existsSync(filesRoot)) {
-        orphans.push(filesRoot);
+    // L5 Orphans
+    if (checkOrphans) {
+        const diskFiles = walkRelative(filesRoot);
+        for (const diskRel of diskFiles) {
+            if (!dbPathSet.has(diskRel)) {
+                orphans.push(diskRel);
+            }
+        }
     }
-    const ok = missing.length === 0 && sizeMismatch.length === 0 && hashMismatch.length === 0;
-    return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk };
+    const ok = sentinelOk && missing.length === 0 && sizeMismatch.length === 0 && hashMismatch.length === 0;
+    return { ok, checked, missing, sizeMismatch, hashMismatch, orphans, sentinelOk, hashed, skippedReason };
 }

package/dist/resolve/files.d.ts

@@ -5,4 +5,10 @@ import type { FilesEnvConfig } from '../types/index.js';
  * Falls back to app_data if not configured.
  */
 export declare function resolveFilesConfig(appConfigPkg?: string): FilesEnvConfig;
+/**
+ * Resolve the file storage root path for a specific environment.
+ * Checks [files.<env>] root in hazo_env_config.ini first;
+ * falls back to <dataRoot>/<env>/files convention if absent.
+ */
+export declare function resolveFilesRoot(env: string): string;
 //# sourceMappingURL=files.d.ts.map

package/dist/resolve/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/resolve/files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAgBxD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAoCxE"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/resolve/files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAgBxD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAoCxE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAiBpD"}

package/dist/resolve/files.js

@@ -51,3 +51,26 @@ export function resolveFilesConfig(appConfigPkg) {
     }
     return { provider: 'local', local };
 }
+/**
+ * Resolve the file storage root path for a specific environment.
+ * Checks [files.<env>] root in hazo_env_config.ini first;
+ * falls back to <dataRoot>/<env>/files convention if absent.
+ */
+export function resolveFilesRoot(env) {
+    const envConfig = tryLoadConfig('hazo_env');
+    // Check explicit per-env root: [files.<env>] root = /some/path
+    const filesSection = envConfig?.getSection(`files.${env}`);
+    const explicitRoot = filesSection?.['root'];
+    if (explicitRoot) {
+        return path.isAbsolute(explicitRoot)
+            ? explicitRoot
+            : path.resolve(process.cwd(), explicitRoot);
+    }
+    // Fall back to <dataRoot>/<env>/files convention
+    const dataSection = envConfig?.getSection('data');
+    const dataRoot = dataSection?.['root'] ?? DEFAULT_DATA_ROOT;
+    const resolvedDataRoot = path.isAbsolute(dataRoot)
+        ? dataRoot
+        : path.resolve(process.cwd(), dataRoot);
+    return path.join(resolvedDataRoot, env, 'files');
+}

package/dist/resolve/migrate.d.ts

@@ -0,0 +1,3 @@
+import type { MigrateConfig } from '../types/index.js';
+export declare function resolveMigrateConfig(): MigrateConfig;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/resolve/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/resolve/migrate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,wBAAgB,oBAAoB,IAAI,aAAa,CA2BpD"}

package/dist/resolve/migrate.js

@@ -0,0 +1,29 @@
+// hazo_env/src/resolve/migrate.ts — read [migrate] section from hazo_env_config.ini
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+export function resolveMigrateConfig() {
+    try {
+        const filePath = path.resolve(process.cwd(), 'config', 'hazo_env_config.ini');
+        const config = new HazoConfig({ filePath });
+        const section = config.getSection('migrate');
+        if (!section)
+            return {};
+        const tables = section['tables']
+            ? section['tables'].split(',').map((t) => t.trim()).filter(Boolean)
+            : undefined;
+        const preserve = section['preserve']
+            ? section['preserve'].split(',').map((t) => t.trim()).filter(Boolean)
+            : undefined;
+        // Parse per-table pk overrides: keys like "pk.some_table = custom_col"
+        const pkOverrides = {};
+        for (const [k, v] of Object.entries(section)) {
+            if (k.startsWith('pk.') && typeof v === 'string') {
+                pkOverrides[k.slice(3)] = v.trim();
+            }
+        }
+        return { tables, preserve, ...(Object.keys(pkOverrides).length ? { pkOverrides } : {}) };
+    }
+    catch {
+        return {};
+    }
+}