hazo_env 0.4.0 → 0.5.0

package/CHANGE_LOG.md

@@ -1,5 +1,20 @@
 # hazo_env — Change Log
 
+## 0.5.0 — 2026-06-25
+
+### Added
+- `clearEnv()` — delete all non-preserved tables via PostgREST (reverse FK order) + optional file-dir wipe. Exported from `src/index.ts`. CLI: `hazo-env clear <env>` (prod-target guard: `--allow-prod-target --confirm=<token>`).
+- `ClearRequest` / `ClearResult` types in `src/types/index.ts`; `'clear'` added to `MigrationProgress.phase` union.
+- rsync-over-SSH file transport — `copyFiles()` auto-dispatches to rsync when `[transport.ssh.<fromEnv>]` is configured. `copyFilesRsync()` in `src/migrate/files.ts` spawns `rsync -az --partial --info=progress2`, parses `to-chk=N/TOTAL` for live percent. `onProgress` signature extended with optional `percent` arg.
+- `resolveSshConfig(env)` in `src/resolve/ssh.ts` — reads `[transport.ssh.<env>]` section (host/user/key/path) with `${VAR}` expansion.
+- `resolveTransport()` return type widened to `'local' | 'api' | 'rsync'`; `'ssh'` input now returns `'rsync'` instead of throwing.
+- Per-table DB progress — `DbCopyOptions.onTableProgress` callback fires once per table during PostgREST copy pass; `run.ts` maps it to the 20→70% band with a `"table N/M: <name>"` message.
+- `[transport.ssh.<env>]` section added to `config/hazo_env_config.ini.sample`.
+
+### Test-app
+- `POST /api/clear` route added (mirrors `/api/migrate`).
+- `'clear-env'` autotest scenario added (dry-run guard: verifies prod-target refuses without confirm).
+
 ## 0.4.0 — 2026-06-25
 
 ### Added

package/config/hazo_env_config.ini.sample

@@ -62,3 +62,21 @@ location = remote
 
 [host.prod]
 location = remote
+
+; ─── SSH transport for cross-host file rsync ─────────────────────────────────
+; When [transport.ssh.<env>] is present, copyFiles will use rsync-over-SSH
+; to pull files from that environment's file server instead of local copy.
+; This enables prod→dev migration when both envs run on separate hosts.
+
+[transport.ssh.prod]
+; SSH connection to the prod file server (used when pulling prod→dev).
+; The worker runs rsync FROM prod TO dev — prod stays read-only.
+host = ${SSH_HOST_PROD}
+user = ${SSH_USER_PROD}
+key  = ${SSH_KEY_PATH_PROD}
+path = /home/pubs/kinstripe/var/uploads
+; Optional: pin the server's host key (output of `ssh-keyscan <host>` minus the
+; leading hostname, e.g. "ssh-ed25519 AAAA..."). When set, host-key checking is
+; strict and pinned — no trust-on-first-use. When omitted, the first connection
+; is accepted (accept-new) and persisted to config/hazo_env_known_hosts.
+; host_key = ${SSH_HOST_KEY_PROD}

package/dist/cli.js

@@ -167,6 +167,39 @@ async function runRestore() {
     restoreSnapshot(toConfig, snapshotId);
     console.log(`  ${pc.green('✓')} Restored\n`);
 }
+async function runClear() {
+    const targetEnv = args[0] ?? getEnv();
+    const allowProd = args.includes('--allow-prod-target');
+    const confirm = args.find((a) => a.startsWith('--confirm='))?.split('=')[1];
+    console.log(`\n${pc.bold('hazo-env clear')} ${pc.dim(targetEnv)}\n`);
+    const { clearEnv } = await import('./migrate/clear.js');
+    try {
+        let lastMsg = '';
+        const result = await clearEnv({
+            env: targetEnv,
+            allowProdTarget: allowProd,
+            confirmToken: confirm,
+            onProgress: (p) => {
+                if (p.message !== lastMsg) {
+                    const pctStr = p.percent != null ? ` [${p.percent}%]` : '';
+                    console.log(`  ${pc.dim('·')} ${p.message}${pctStr}`);
+                    lastMsg = p.message;
+                }
+            },
+        });
+        if (result.ok) {
+            console.log(`  ${pc.green('✓')} Cleared ${result.tablesCleared} tables${result.filesCleared ? ' + files' : ''} in ${result.durationMs}ms\n`);
+            if (result.warnings.length)
+                result.warnings.forEach((w) => console.log(`  ${pc.yellow('⚠')} ${w}`));
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`\n  ${pc.red('✗')} ${msg}\n`);
+        process.exit(1);
+    }
+    console.log('');
+}
 async function runMask() {
     const subCmd = args[0];
     if (subCmd === 'sync') {
@@ -239,6 +272,8 @@ Usage:
   hazo-env snapshot <env>                   Take a snapshot of an environment
   hazo-env mask sync                        Load masking ruleset from INI into DB
   hazo-env mask list                        List registered mask transforms
+  hazo-env clear <env>                      Wipe DB tables + files for an environment
+    --allow-prod-target --confirm=<token>   Override prod-target safety
 `);
 }
 (async () => {
@@ -264,6 +299,9 @@ Usage:
         else if (command === 'mask') {
             await runMask();
         }
+        else if (command === 'clear') {
+            await runClear();
+        }
         else {
             printHelp();
         }

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export * from './resolve/connect.js';
 export * from './resolve/files.js';
 export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -13,6 +13,7 @@ export * from './resolve/files.js';
 export * from './doctor.js';
 // Migration engine (Phase 2)
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';

package/dist/migrate/clear.d.ts

@@ -0,0 +1,3 @@
+import type { ClearRequest, ClearResult } from '../types/index.js';
+export declare function clearEnv(req: ClearRequest): Promise<ClearResult>;
+//# sourceMappingURL=clear.d.ts.map

package/dist/migrate/clear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear.d.ts","sourceRoot":"","sources":["../../src/migrate/clear.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAYtF,wBAAsB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoHtE"}

package/dist/migrate/clear.js

@@ -0,0 +1,117 @@
+// hazo_env/src/migrate/clear.ts — clearEnv: wipe DB tables + files for a target environment
+import { HazoError, optional_import } from 'hazo_core';
+import { getEnvRole } from '../env.server.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
+import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveFilesRoot } from '../resolve/files.js';
+import { writeMigrationProgress } from './progress.js';
+import fs from 'node:fs';
+function emitProgress(req, p) {
+    req.onProgress?.(p);
+    if (req.jobId && req.progressDir) {
+        writeMigrationProgress(req.progressDir, req.jobId, p);
+    }
+}
+export async function clearEnv(req) {
+    const startMs = Date.now();
+    const warnings = [];
+    // Guard: refuse production target unless explicitly unlocked with a confirm token
+    const role = getEnvRole(req.env);
+    if (role === 'production' && !req.allowProdTarget) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: `Refusing to clear production environment "${req.env}". Pass allowProdTarget:true and a confirmToken to override.`,
+        });
+    }
+    if (role === 'production' && req.allowProdTarget && !req.confirmToken) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: 'Production target requires a confirmToken for safety.',
+        });
+    }
+    emitProgress(req, { phase: 'validate', message: 'Validating clear request', percent: 0 });
+    const migrateConfig = resolveMigrateConfig();
+    const { tables, preserve = [], pkOverrides = {} } = migrateConfig;
+    if (!tables || tables.length === 0) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'clearEnv requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini.',
+        });
+    }
+    const tablesToClear = [...tables.filter((t) => !preserve.includes(t))].reverse();
+    const dbConfig = resolveConnectConfig({ env: req.env, allowOtherEnv: true });
+    if (dbConfig.type !== 'postgrest') {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `clearEnv only supports PostgREST connections (got "${dbConfig.type}").`,
+        });
+    }
+    if (!dbConfig.postgrest) {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: 'PostgREST config missing base_url/api_key.',
+        });
+    }
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for clearEnv. Install hazo_connect to continue.',
+        });
+    }
+    const tgtAdapter = connect.createHazoConnect({
+        type: 'postgrest',
+        postgrest: {
+            base_url: dbConfig.postgrest.base_url,
+            api_key: dbConfig.postgrest.api_key,
+        },
+    });
+    // DB clear (only if not explicitly disabled)
+    let tablesCleared = 0;
+    if (req.include?.db !== false) {
+        for (let idx = 0; idx < tablesToClear.length; idx++) {
+            const table = tablesToClear[idx];
+            const percent = Math.round(((idx + 1) / tablesToClear.length) * 90);
+            emitProgress(req, {
+                phase: 'clear',
+                message: `Clearing table ${idx + 1}/${tablesToClear.length}: ${table}`,
+                percent,
+            });
+            const pk = pkOverrides[table] ?? 'id';
+            try {
+                await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+                tablesCleared++;
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                warnings.push(`Warning: could not clear ${table}: ${msg}`);
+            }
+        }
+    }
+    // File clear
+    let filesCleared = false;
+    if (req.include?.files !== false) {
+        emitProgress(req, { phase: 'clear', message: 'Clearing files...', percent: 92 });
+        const filesRoot = resolveFilesRoot(req.env);
+        if (fs.existsSync(filesRoot)) {
+            fs.rmSync(filesRoot, { recursive: true, force: true });
+        }
+        fs.mkdirSync(filesRoot, { recursive: true });
+        filesCleared = true;
+    }
+    emitProgress(req, { phase: 'done', message: 'Clear complete', percent: 100 });
+    return {
+        ok: true,
+        tablesCleared,
+        filesCleared,
+        durationMs: Date.now() - startMs,
+        warnings,
+    };
+}

package/dist/migrate/db.d.ts

@@ -6,6 +6,7 @@ export interface DbCopyOptions {
     pkOverrides?: Record<string, string>;
     scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
     onProgress?: (msg: string) => void;
+    onTableProgress?: (tableIdx: number, totalTables: number, tableName: string) => void;
 }
 export interface DbCopyResult {
     tables: number;

package/dist/migrate/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CACtF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/migrate/db.postgrest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA6GvB"}
+{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}

package/dist/migrate/db.postgrest.js

@@ -43,7 +43,9 @@ export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
     let totalScrubbed = 0;
     // --- Copy pass: forward dependency order ---
     for (const table of tablesToProcess) {
-        opts.onProgress?.(`Copying table: ${table}`);
+        const tableIdx = tablesToProcess.indexOf(table);
+        opts.onProgress?.(`Copying table ${tableIdx + 1}/${tablesToProcess.length}: ${table}`);
+        opts.onTableProgress?.(tableIdx + 1, tablesToProcess.length, table);
         const pk = pkOverrides[table] ?? 'id';
         const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
         const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });

package/dist/migrate/files.d.ts

@@ -2,8 +2,9 @@ import type { HazoEnv } from '../types/index.js';
 export interface FilesCopyOptions {
     fromEnv: HazoEnv;
     toEnv: HazoEnv;
+    transport?: 'local' | 'rsync';
     fileScrubHook?: (filePath: string) => Promise<void>;
-    onProgress?: (msg: string) => void;
+    onProgress?: (msg: string, percent?: number) => void;
 }
 export interface FilesCopyResult {
     copied: number;

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA0BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA6GD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}

package/dist/migrate/files.js

@@ -6,7 +6,9 @@
 // Failures are non-fatal warnings — the file copy still completes.
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawn } from 'node:child_process';
 import { resolveFilesRoot } from '../resolve/files.js';
+import { resolveSshConfig } from '../resolve/ssh.js';
 function resolveEnvFilesRoot(env) {
     return resolveFilesRoot(env);
 }
@@ -29,7 +31,88 @@ async function scrubPdfFile(filePath) {
         // Non-fatal — PDF scrubbing failure is a warning, not an abort
     }
 }
+/**
+ * Reject ssh config values that could smuggle extra ssh options through rsync's
+ * `-e` command string. rsync re-splits `-e` on whitespace, so a value starting
+ * with `-` (e.g. `-oProxyCommand=...`) or containing whitespace would be parsed
+ * as additional ssh flags rather than data. Fail loud instead of running.
+ */
+function assertSafeSshField(name, value) {
+    if (/^-/.test(value) || /\s/.test(value)) {
+        throw new Error(`Unsafe transport.ssh.${name} value: must not start with '-' or contain whitespace`);
+    }
+}
+async function copyFilesRsync(opts, ssh) {
+    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
+    fs.mkdirSync(tgtRoot, { recursive: true });
+    assertSafeSshField('user', ssh.user);
+    assertSafeSshField('host', ssh.host);
+    assertSafeSshField('key', ssh.key);
+    assertSafeSshField('path', ssh.path);
+    // Persistent known_hosts so host-key trust survives across runs (no TOFU reset).
+    const knownHosts = path.resolve(process.cwd(), 'config', 'hazo_env_known_hosts');
+    fs.mkdirSync(path.dirname(knownHosts), { recursive: true });
+    if (ssh.hostKey) {
+        // Pin the operator-provided host key; strict checking, no first-use prompt.
+        const line = `${ssh.host} ${ssh.hostKey}\n`;
+        const existing = fs.existsSync(knownHosts) ? fs.readFileSync(knownHosts, 'utf8') : '';
+        if (!existing.includes(line.trim()))
+            fs.appendFileSync(knownHosts, line);
+    }
+    // Pinned key → strict verify; otherwise accept-new (trust on first use, then
+    // persist) — never disable host-key checking outright.
+    const strict = ssh.hostKey ? 'yes' : 'accept-new';
+    const remote = `${ssh.user}@${ssh.host}:${ssh.path}/`;
+    const sshCmd = `ssh -i ${ssh.key} -o StrictHostKeyChecking=${strict} -o UserKnownHostsFile=${knownHosts}`;
+    const args = ['-az', '--partial', '--info=progress2', '-e', sshCmd, remote, tgtRoot + '/'];
+    return new Promise((resolve, reject) => {
+        const proc = spawn('rsync', args);
+        let totalFiles = 0;
+        let doneFiles = 0;
+        let totalBytes = 0;
+        proc.stdout.on('data', (chunk) => {
+            const text = chunk.toString();
+            // Parse --info=progress2: lines like "     117,504,614 100%  108.64MB/s    0:00:01 (xfr#123, to-chk=0/456)"
+            for (const line of text.split('\n')) {
+                // Extract to-chk=N/TOTAL
+                const chkMatch = line.match(/to-chk=(\d+)\/(\d+)/);
+                if (chkMatch) {
+                    const remaining = parseInt(chkMatch[1], 10);
+                    const total = parseInt(chkMatch[2], 10);
+                    if (totalFiles === 0)
+                        totalFiles = total;
+                    doneFiles = total - remaining;
+                    const pct = total > 0 ? Math.round((doneFiles / total) * 100) : 0;
+                    opts.onProgress?.(`rsync: ${doneFiles}/${total} files (${pct}%)`, pct);
+                }
+                // Extract bytes: first number on lines with a %
+                const bytesMatch = line.match(/^\s+([\d,]+)\s+\d+%/);
+                if (bytesMatch) {
+                    totalBytes = parseInt(bytesMatch[1].replace(/,/g, ''), 10);
+                }
+            }
+        });
+        proc.stderr.on('data', (chunk) => {
+            opts.onProgress?.(`rsync: ${chunk.toString().trim()}`, undefined);
+        });
+        proc.on('error', (err) => reject(err));
+        proc.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`rsync exited with code ${code}`));
+            }
+            else {
+                resolve({ copied: doneFiles || totalFiles, bytes: totalBytes, placeholdered: 0 });
+            }
+        });
+    });
+}
 export async function copyFiles(opts) {
+    const ssh = resolveSshConfig(opts.fromEnv);
+    if (opts.transport === 'rsync' || (opts.transport !== 'local' && ssh !== null)) {
+        if (!ssh)
+            throw new Error(`rsync requested but no [transport.ssh.${opts.fromEnv}] config found`);
+        return copyFilesRsync(opts, ssh);
+    }
     const srcRoot = resolveEnvFilesRoot(opts.fromEnv);
     const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
     if (!fs.existsSync(srcRoot)) {

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkLlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwLlF"}

package/dist/migrate/run.js

@@ -180,6 +180,11 @@ export async function runMigration(req) {
             pkOverrides: migrateConfig.pkOverrides,
             scrubHook,
             onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+            onTableProgress: (idx, total, name) => emitProgress(req, {
+                phase: 'db',
+                message: `table ${idx}/${total}: ${name}`,
+                percent: 20 + Math.round((idx / total) * 50),
+            }),
         });
         dbResult = result;
         emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });

package/dist/migrate/transport.d.ts

@@ -1,3 +1,3 @@
 import type { TransportMode, DbEnvConfig } from '../types/index.js';
-export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api';
+export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync';
 //# sourceMappingURL=transport.d.ts.map

package/dist/migrate/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,CAYjB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,CAM3B"}

package/dist/migrate/transport.js

@@ -1,13 +1,6 @@
-// hazo_env/src/migrate/transport.ts — resolve transport mode for a migration
-import { HazoError } from 'hazo_core';
 export function resolveTransport(fromConfig, toConfig, requested = 'auto') {
-    if (requested === 'ssh') {
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: 'SSH transport is not yet implemented. Use local or api transport.',
-        });
-    }
+    if (requested === 'ssh')
+        return 'rsync';
     if (requested === 'api')
         return 'api';
     // auto: both sqlite → local

package/dist/resolve/ssh.d.ts

@@ -0,0 +1,15 @@
+export interface SshConfig {
+    host: string;
+    user: string;
+    key: string;
+    path: string;
+    /**
+     * Optional pinned host public key (the right-hand side of a known_hosts line,
+     * e.g. "ssh-ed25519 AAAA...."). When set, host-key checking is strict and the
+     * key is pinned — no TOFU. When absent, the transport falls back to
+     * accept-new against a persistent known_hosts file.
+     */
+    hostKey?: string;
+}
+export declare function resolveSshConfig(env: string): SshConfig | null;
+//# sourceMappingURL=ssh.d.ts.map

package/dist/resolve/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../../src/resolve/ssh.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAsB9D"}

package/dist/resolve/ssh.js

@@ -0,0 +1,36 @@
+// hazo_env/src/resolve/ssh.ts — SSH transport config resolver
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+function tryLoadEnvConfig() {
+    try {
+        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
+    }
+    catch {
+        return null;
+    }
+}
+function expandEnvVars(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+export function resolveSshConfig(env) {
+    const config = tryLoadEnvConfig();
+    if (!config)
+        return null;
+    const section = config.getSection(`transport.ssh.${env}`);
+    if (!section)
+        return null;
+    const host = section['host'];
+    const user = section['user'];
+    const key = section['key'];
+    const remotePath = section['path'];
+    const hostKey = section['host_key'];
+    if (!host || !user || !key || !remotePath)
+        return null;
+    return {
+        host: expandEnvVars(host),
+        user: expandEnvVars(user),
+        key: expandEnvVars(key),
+        path: expandEnvVars(remotePath),
+        hostKey: hostKey ? expandEnvVars(hostKey) : undefined,
+    };
+}

package/dist/types/index.d.ts

@@ -47,7 +47,7 @@ export type TransportMode = 'auto' | 'local' | 'ssh' | 'api';
 export type ScrubMode = 'auto' | 'none';
 export type HashMode = 'none' | 'sample' | 'full';
 export interface MigrationProgress {
-    phase: 'validate' | 'snapshot' | 'plan' | 'schema-check' | 'db' | 'files' | 'verify' | 'finalize' | 'done';
+    phase: 'validate' | 'snapshot' | 'plan' | 'schema-check' | 'db' | 'files' | 'verify' | 'finalize' | 'done' | 'clear';
     message: string;
     percent?: number;
 }
@@ -102,5 +102,24 @@ export interface MigrateConfig {
     preserve?: string[];
     pkOverrides?: Record<string, string>;
 }
+export interface ClearRequest {
+    env: HazoEnv;
+    include?: {
+        db?: boolean;
+        files?: boolean;
+    };
+    allowProdTarget?: boolean;
+    confirmToken?: string;
+    jobId?: string;
+    progressDir?: string;
+    onProgress?: (p: MigrationProgress) => void;
+}
+export interface ClearResult {
+    ok: boolean;
+    tablesCleared: number;
+    filesCleared: boolean;
+    durationMs: number;
+    warnings: string[];
+}
 export type MaskTransform = (value: unknown, key: string, maskKey: string) => unknown;
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACrH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",