hazo_env 0.4.0 → 0.6.0

package/CHANGE_LOG.md

@@ -1,5 +1,20 @@
 # hazo_env — Change Log
 
+## 0.5.0 — 2026-06-25
+
+### Added
+- `clearEnv()` — delete all non-preserved tables via PostgREST (reverse FK order) + optional file-dir wipe. Exported from `src/index.ts`. CLI: `hazo-env clear <env>` (prod-target guard: `--allow-prod-target --confirm=<token>`).
+- `ClearRequest` / `ClearResult` types in `src/types/index.ts`; `'clear'` added to `MigrationProgress.phase` union.
+- rsync-over-SSH file transport — `copyFiles()` auto-dispatches to rsync when `[transport.ssh.<fromEnv>]` is configured. `copyFilesRsync()` in `src/migrate/files.ts` spawns `rsync -az --partial --info=progress2`, parses `to-chk=N/TOTAL` for live percent. `onProgress` signature extended with optional `percent` arg.
+- `resolveSshConfig(env)` in `src/resolve/ssh.ts` — reads `[transport.ssh.<env>]` section (host/user/key/path) with `${VAR}` expansion.
+- `resolveTransport()` return type widened to `'local' | 'api' | 'rsync'`; `'ssh'` input now returns `'rsync'` instead of throwing.
+- Per-table DB progress — `DbCopyOptions.onTableProgress` callback fires once per table during PostgREST copy pass; `run.ts` maps it to the 20→70% band with a `"table N/M: <name>"` message.
+- `[transport.ssh.<env>]` section added to `config/hazo_env_config.ini.sample`.
+
+### Test-app
+- `POST /api/clear` route added (mirrors `/api/migrate`).
+- `'clear-env'` autotest scenario added (dry-run guard: verifies prod-target refuses without confirm).
+
 ## 0.4.0 — 2026-06-25
 
 ### Added

package/README.md

@@ -235,6 +235,47 @@ Key sections:
 
 Secret placeholders use `${ENV_VAR_NAME}` syntax — hazo_env substitutes them from `.env.local` at runtime.
 
+## dump-restore transport
+
+The `dump-restore` transport copies a database via SSH `pg_dump`/`pg_restore` (binary format). Use it when the source and target share the same Postgres server (e.g. prod→dev on the same VPS) and you want a fast binary copy without going through the PostgREST row-copy loop.
+
+### Config: `[backup.<env>]`
+
+Add a section to `config/hazo_env_config.ini`:
+
+```ini
+[backup.dev]
+ssh_env         = prod         ; reuse [transport.ssh.prod] SSH connection
+target_db       = myapp_dev    ; DB to drop/recreate
+owner           = adminuser    ; createdb -O <owner>
+dump_source     = /var/backups/myapp-*.pgdump  ; glob (newest used) or "fresh"
+fresh_dump_db   = myapp        ; source DB for pg_dump when dump_source=fresh
+pre_restore_cmd = sudo systemctl stop myapp-postgrest-dev
+post_restore_cmd= sudo systemctl start myapp-postgrest-dev
+```
+
+> **No PII scrubbing on this path.** The binary `pg_restore` copies raw rows; hazo_env's `scrubHook` only runs inside the PostgREST row-copy loop. If you need scrubbed data in dev, use the default `api` transport instead.
+
+### CLI
+
+```bash
+npx hazo-env migrate --from prod --to dev --transport dump-restore
+```
+
+### Programmatic API
+
+```ts
+import { resolveBackupConfig, restoreDbViaDump } from 'hazo_env';
+
+const backup = resolveBackupConfig('dev'); // reads [backup.dev] from INI
+if (backup) {
+  const result = await restoreDbViaDump(backup, {
+    onProgress: (msg) => console.log(msg),
+  });
+  // result.mode === 'dump-restore'
+}
+```
+
 ## License
 
 MIT

package/config/hazo_env_config.ini.sample

@@ -62,3 +62,21 @@ location = remote
 
 [host.prod]
 location = remote
+
+; ─── SSH transport for cross-host file rsync ─────────────────────────────────
+; When [transport.ssh.<env>] is present, copyFiles will use rsync-over-SSH
+; to pull files from that environment's file server instead of local copy.
+; This enables prod→dev migration when both envs run on separate hosts.
+
+[transport.ssh.prod]
+; SSH connection to the prod file server (used when pulling prod→dev).
+; The worker runs rsync FROM prod TO dev — prod stays read-only.
+host = ${SSH_HOST_PROD}
+user = ${SSH_USER_PROD}
+key  = ${SSH_KEY_PATH_PROD}
+path = /home/pubs/kinstripe/var/uploads
+; Optional: pin the server's host key (output of `ssh-keyscan <host>` minus the
+; leading hostname, e.g. "ssh-ed25519 AAAA..."). When set, host-key checking is
+; strict and pinned — no trust-on-first-use. When omitted, the first connection
+; is accepted (accept-new) and persisted to config/hazo_env_known_hosts.
+; host_key = ${SSH_HOST_KEY_PROD}

package/dist/cli.js

@@ -81,6 +81,8 @@ async function runMigrate() {
     const tablesIdx = args.findIndex((a) => a === '--tables');
     const tablesArg = tablesIdx >= 0 ? args[tablesIdx + 1] : undefined;
     const tables = tablesArg ? tablesArg.split(',').map((t) => t.trim()) : undefined;
+    const transportIdx = args.findIndex((a) => a === '--transport');
+    const transport = transportIdx >= 0 ? args[transportIdx + 1] : undefined;
     if (!from || !to) {
         console.error(pc.red('Error: migrate requires --from <env> and --to <env>'));
         process.exit(1);
@@ -96,6 +98,7 @@ async function runMigrate() {
             dryRun,
             allowProdTarget,
             confirmToken,
+            transport: transport,
             onProgress: (p) => {
                 const pct = p.percent != null ? `${p.percent}%`.padStart(4) + ' ' : '     ';
                 console.log(`  ${pct}${pc.dim(p.phase.padEnd(12))} ${p.message}`);
@@ -167,6 +170,39 @@ async function runRestore() {
     restoreSnapshot(toConfig, snapshotId);
     console.log(`  ${pc.green('✓')} Restored\n`);
 }
+async function runClear() {
+    const targetEnv = args[0] ?? getEnv();
+    const allowProd = args.includes('--allow-prod-target');
+    const confirm = args.find((a) => a.startsWith('--confirm='))?.split('=')[1];
+    console.log(`\n${pc.bold('hazo-env clear')} ${pc.dim(targetEnv)}\n`);
+    const { clearEnv } = await import('./migrate/clear.js');
+    try {
+        let lastMsg = '';
+        const result = await clearEnv({
+            env: targetEnv,
+            allowProdTarget: allowProd,
+            confirmToken: confirm,
+            onProgress: (p) => {
+                if (p.message !== lastMsg) {
+                    const pctStr = p.percent != null ? ` [${p.percent}%]` : '';
+                    console.log(`  ${pc.dim('·')} ${p.message}${pctStr}`);
+                    lastMsg = p.message;
+                }
+            },
+        });
+        if (result.ok) {
+            console.log(`  ${pc.green('✓')} Cleared ${result.tablesCleared} tables${result.filesCleared ? ' + files' : ''} in ${result.durationMs}ms\n`);
+            if (result.warnings.length)
+                result.warnings.forEach((w) => console.log(`  ${pc.yellow('⚠')} ${w}`));
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`\n  ${pc.red('✗')} ${msg}\n`);
+        process.exit(1);
+    }
+    console.log('');
+}
 async function runMask() {
     const subCmd = args[0];
     if (subCmd === 'sync') {
@@ -239,6 +275,8 @@ Usage:
   hazo-env snapshot <env>                   Take a snapshot of an environment
   hazo-env mask sync                        Load masking ruleset from INI into DB
   hazo-env mask list                        List registered mask transforms
+  hazo-env clear <env>                      Wipe DB tables + files for an environment
+    --allow-prod-target --confirm=<token>   Override prod-target safety
 `);
 }
 (async () => {
@@ -264,6 +302,9 @@ Usage:
         else if (command === 'mask') {
             await runMask();
         }
+        else if (command === 'clear') {
+            await runClear();
+        }
         else {
             printHelp();
         }

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export * from './resolve/connect.js';
 export * from './resolve/files.js';
 export * from './doctor.js';
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
@@ -14,4 +15,8 @@ export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.j
 export type { MaskRule } from './mask/ruleset.js';
 export type { MaskTransform } from './types/index.js';
 export * from './lib/index.js';
+export { resolveBackupConfig } from './resolve/backup.js';
+export type { BackupConfig } from './resolve/backup.js';
+export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
+export { restoreDbViaDump } from './migrate/db-dump-restore.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -13,6 +13,7 @@ export * from './resolve/files.js';
 export * from './doctor.js';
 // Migration engine (Phase 2)
 export { runMigration } from './migrate/run.js';
+export { clearEnv } from './migrate/clear.js';
 export { verifyFiles } from './migrate/verify.js';
 export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
 export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
@@ -22,3 +23,7 @@ export { registerMask } from './mask/registry.js';
 export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
 // Lib
 export * from './lib/index.js';
+// dump-restore transport
+export { resolveBackupConfig } from './resolve/backup.js';
+export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
+export { restoreDbViaDump } from './migrate/db-dump-restore.js';

package/dist/migrate/clear.d.ts

@@ -0,0 +1,3 @@
+import type { ClearRequest, ClearResult } from '../types/index.js';
+export declare function clearEnv(req: ClearRequest): Promise<ClearResult>;
+//# sourceMappingURL=clear.d.ts.map

package/dist/migrate/clear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear.d.ts","sourceRoot":"","sources":["../../src/migrate/clear.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAYtF,wBAAsB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoHtE"}

package/dist/migrate/clear.js

@@ -0,0 +1,117 @@
+// hazo_env/src/migrate/clear.ts — clearEnv: wipe DB tables + files for a target environment
+import { HazoError, optional_import } from 'hazo_core';
+import { getEnvRole } from '../env.server.js';
+import { resolveMigrateConfig } from '../resolve/migrate.js';
+import { resolveConnectConfig } from '../resolve/connect.js';
+import { resolveFilesRoot } from '../resolve/files.js';
+import { writeMigrationProgress } from './progress.js';
+import fs from 'node:fs';
+function emitProgress(req, p) {
+    req.onProgress?.(p);
+    if (req.jobId && req.progressDir) {
+        writeMigrationProgress(req.progressDir, req.jobId, p);
+    }
+}
+export async function clearEnv(req) {
+    const startMs = Date.now();
+    const warnings = [];
+    // Guard: refuse production target unless explicitly unlocked with a confirm token
+    const role = getEnvRole(req.env);
+    if (role === 'production' && !req.allowProdTarget) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: `Refusing to clear production environment "${req.env}". Pass allowProdTarget:true and a confirmToken to override.`,
+        });
+    }
+    if (role === 'production' && req.allowProdTarget && !req.confirmToken) {
+        throw new HazoError({
+            code: 'HAZO_ENV_PROD_TARGET_REFUSED',
+            pkg: 'hazo_env',
+            message: 'Production target requires a confirmToken for safety.',
+        });
+    }
+    emitProgress(req, { phase: 'validate', message: 'Validating clear request', percent: 0 });
+    const migrateConfig = resolveMigrateConfig();
+    const { tables, preserve = [], pkOverrides = {} } = migrateConfig;
+    if (!tables || tables.length === 0) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_TABLE_LIST',
+            pkg: 'hazo_env',
+            message: 'clearEnv requires an explicit table list. ' +
+                'Set [migrate] tables = ... in hazo_env_config.ini.',
+        });
+    }
+    const tablesToClear = [...tables.filter((t) => !preserve.includes(t))].reverse();
+    const dbConfig = resolveConnectConfig({ env: req.env, allowOtherEnv: true });
+    if (dbConfig.type !== 'postgrest') {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: `clearEnv only supports PostgREST connections (got "${dbConfig.type}").`,
+        });
+    }
+    if (!dbConfig.postgrest) {
+        throw new HazoError({
+            code: 'HAZO_ENV_NOT_IMPLEMENTED',
+            pkg: 'hazo_env',
+            message: 'PostgREST config missing base_url/api_key.',
+        });
+    }
+    const connect = await optional_import('hazo_connect/server');
+    if (!connect) {
+        throw new HazoError({
+            code: 'HAZO_ENV_MISSING_DEPENDENCY',
+            pkg: 'hazo_env',
+            message: 'hazo_connect is required for clearEnv. Install hazo_connect to continue.',
+        });
+    }
+    const tgtAdapter = connect.createHazoConnect({
+        type: 'postgrest',
+        postgrest: {
+            base_url: dbConfig.postgrest.base_url,
+            api_key: dbConfig.postgrest.api_key,
+        },
+    });
+    // DB clear (only if not explicitly disabled)
+    let tablesCleared = 0;
+    if (req.include?.db !== false) {
+        for (let idx = 0; idx < tablesToClear.length; idx++) {
+            const table = tablesToClear[idx];
+            const percent = Math.round(((idx + 1) / tablesToClear.length) * 90);
+            emitProgress(req, {
+                phase: 'clear',
+                message: `Clearing table ${idx + 1}/${tablesToClear.length}: ${table}`,
+                percent,
+            });
+            const pk = pkOverrides[table] ?? 'id';
+            try {
+                await tgtAdapter.rawQuery(`/${table}?${pk}=not.is.null`, { method: 'DELETE' });
+                tablesCleared++;
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                warnings.push(`Warning: could not clear ${table}: ${msg}`);
+            }
+        }
+    }
+    // File clear
+    let filesCleared = false;
+    if (req.include?.files !== false) {
+        emitProgress(req, { phase: 'clear', message: 'Clearing files...', percent: 92 });
+        const filesRoot = resolveFilesRoot(req.env);
+        if (fs.existsSync(filesRoot)) {
+            fs.rmSync(filesRoot, { recursive: true, force: true });
+        }
+        fs.mkdirSync(filesRoot, { recursive: true });
+        filesCleared = true;
+    }
+    emitProgress(req, { phase: 'done', message: 'Clear complete', percent: 100 });
+    return {
+        ok: true,
+        tablesCleared,
+        filesCleared,
+        durationMs: Date.now() - startMs,
+        warnings,
+    };
+}

package/dist/migrate/db-dump-restore.d.ts

@@ -0,0 +1,24 @@
+import type { BackupConfig } from '../resolve/backup.js';
+export interface DbDumpRestoreResult {
+    tables: number;
+    rows: number;
+    scrubbed: number;
+    mode: string;
+}
+/**
+ * Restore a Postgres database on a remote server via SSH pg_dump/pg_restore.
+ *
+ * Steps executed remotely:
+ *  1. Obtain a dump file (fresh pg_dump or locate an existing .pgdump)
+ *  2. Run pre_restore_cmd (if configured)
+ *  3. dropdb --if-exists + createdb -O <owner>
+ *  4. pg_restore -d <target_db>
+ *  5. Run post_restore_cmd (if configured)
+ *
+ * Returns a DbDumpRestoreResult with mode: 'dump-restore' and zero
+ * row/table counts (binary restore does not report these).
+ */
+export declare function restoreDbViaDump(backup: BackupConfig, opts?: {
+    onProgress?: (msg: string) => void;
+}): Promise<DbDumpRestoreResult>;
+//# sourceMappingURL=db-dump-restore.d.ts.map

package/dist/migrate/db-dump-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-dump-restore.d.ts","sourceRoot":"","sources":["../../src/migrate/db-dump-restore.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CA6D9B"}

package/dist/migrate/db-dump-restore.js

@@ -0,0 +1,72 @@
+// hazo_env/src/migrate/db-dump-restore.ts — DB copy via SSH pg_dump/pg_restore
+//
+// Builds a single remote bash script and runs it via runSsh.
+// ⚠️  No PII scrubbing on this path — pg_restore copies raw binary rows.
+//     Use the default api transport when scrubbed data is required in dev.
+import { resolveSshConfig } from '../resolve/ssh.js';
+import { runSsh } from './ssh-exec.js';
+/**
+ * Restore a Postgres database on a remote server via SSH pg_dump/pg_restore.
+ *
+ * Steps executed remotely:
+ *  1. Obtain a dump file (fresh pg_dump or locate an existing .pgdump)
+ *  2. Run pre_restore_cmd (if configured)
+ *  3. dropdb --if-exists + createdb -O <owner>
+ *  4. pg_restore -d <target_db>
+ *  5. Run post_restore_cmd (if configured)
+ *
+ * Returns a DbDumpRestoreResult with mode: 'dump-restore' and zero
+ * row/table counts (binary restore does not report these).
+ */
+export async function restoreDbViaDump(backup, opts) {
+    const ssh = resolveSshConfig(backup.ssh_env);
+    if (!ssh) {
+        throw new Error(`dump-restore: no [transport.ssh.${backup.ssh_env}] config found — ` +
+            `set ssh_env to a configured SSH transport in [backup.*]`);
+    }
+    // Build remote bash script lines
+    const lines = ['set -euo pipefail', ''];
+    // Step 1: Get or create dump
+    lines.push('# Step 1: Get or create dump');
+    if (backup.dump_source === 'fresh') {
+        lines.push('DUMP_FILE="/tmp/he-$(date +%s).pgdump"');
+        lines.push(`echo "Creating fresh dump of ${backup.fresh_dump_db}..."`);
+        lines.push(`pg_dump -Fc ${backup.fresh_dump_db} > "$DUMP_FILE"`);
+    }
+    else {
+        lines.push(`echo "Locating dump file matching ${backup.dump_source}..."`);
+        lines.push(`DUMP_FILE=$(ls -t ${backup.dump_source} 2>/dev/null | head -1)`);
+        lines.push(`if [ -z "$DUMP_FILE" ]; then echo "No dump file found matching ${backup.dump_source}"; exit 1; fi`);
+        lines.push('echo "Using dump: $DUMP_FILE"');
+    }
+    lines.push('');
+    // Step 2: Pre-restore command (optional)
+    if (backup.pre_restore_cmd) {
+        lines.push('# Step 2: Pre-restore command');
+        lines.push('echo "Running pre-restore..."');
+        lines.push(backup.pre_restore_cmd);
+        lines.push('');
+    }
+    // Step 3: Drop and recreate target DB
+    lines.push('# Step 3: Drop and recreate target DB');
+    lines.push(`echo "Dropping ${backup.target_db}..."`);
+    lines.push(`dropdb --if-exists ${backup.target_db}`);
+    lines.push(`echo "Creating ${backup.target_db}..."`);
+    lines.push(`createdb -O ${backup.owner} ${backup.target_db}`);
+    lines.push('');
+    // Step 4: Restore
+    lines.push('# Step 4: Restore');
+    lines.push(`echo "Restoring to ${backup.target_db}..."`);
+    lines.push(`pg_restore -d ${backup.target_db} "$DUMP_FILE"`);
+    lines.push('echo "Restore complete."');
+    // Step 5: Post-restore command (optional)
+    if (backup.post_restore_cmd) {
+        lines.push('');
+        lines.push('# Step 5: Post-restore command');
+        lines.push('echo "Running post-restore..."');
+        lines.push(backup.post_restore_cmd);
+    }
+    const script = lines.join('\n');
+    await runSsh(ssh, script, { onProgress: opts?.onProgress });
+    return { tables: 0, rows: 0, scrubbed: 0, mode: 'dump-restore' };
+}

package/dist/migrate/db.d.ts

@@ -6,6 +6,7 @@ export interface DbCopyOptions {
     pkOverrides?: Record<string, string>;
     scrubHook?: (tableName: string, row: Record<string, unknown>) => Record<string, unknown>;
     onProgress?: (msg: string) => void;
+    onTableProgress?: (tableIdx: number, totalTables: number, tableName: string) => void;
 }
 export interface DbCopyResult {
     tables: number;

package/dist/migrate/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/migrate/db.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CACtF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAsB,MAAM,CAC1B,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/migrate/db.postgrest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA6GvB"}
+{"version":3,"file":"db.postgrest.d.ts","sourceRoot":"","sources":["../../src/migrate/db.postgrest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM3D,wBAAsB,eAAe,CACnC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CA+GvB"}

package/dist/migrate/db.postgrest.js

@@ -43,7 +43,9 @@ export async function copyDbPostgrest(srcAdapter, tgtAdapter, opts = {}) {
     let totalScrubbed = 0;
     // --- Copy pass: forward dependency order ---
     for (const table of tablesToProcess) {
-        opts.onProgress?.(`Copying table: ${table}`);
+        const tableIdx = tablesToProcess.indexOf(table);
+        opts.onProgress?.(`Copying table ${tableIdx + 1}/${tablesToProcess.length}: ${table}`);
+        opts.onTableProgress?.(tableIdx + 1, tablesToProcess.length, table);
         const pk = pkOverrides[table] ?? 'id';
         const srcService = connect.createCrudService(srcAdapter, table, { autoId: false });
         const tgtService = connect.createCrudService(tgtAdapter, table, { autoId: false });

package/dist/migrate/files.d.ts

@@ -2,8 +2,9 @@ import type { HazoEnv } from '../types/index.js';
 export interface FilesCopyOptions {
     fromEnv: HazoEnv;
     toEnv: HazoEnv;
+    transport?: 'local' | 'rsync';
     fileScrubHook?: (filePath: string) => Promise<void>;
-    onProgress?: (msg: string) => void;
+    onProgress?: (msg: string, percent?: number) => void;
 }
 export interface FilesCopyResult {
     copied: number;

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA0BD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4ChF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAoFD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}

package/dist/migrate/files.js

@@ -6,7 +6,10 @@
 // Failures are non-fatal warnings — the file copy still completes.
 import fs from 'node:fs';
 import path from 'node:path';
+import { spawn } from 'node:child_process';
 import { resolveFilesRoot } from '../resolve/files.js';
+import { resolveSshConfig } from '../resolve/ssh.js';
+import { assertSafeSshField, setupKnownHosts } from './ssh-exec.js';
 function resolveEnvFilesRoot(env) {
     return resolveFilesRoot(env);
 }
@@ -29,7 +32,65 @@ async function scrubPdfFile(filePath) {
         // Non-fatal — PDF scrubbing failure is a warning, not an abort
     }
 }
+async function copyFilesRsync(opts, ssh) {
+    const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
+    fs.mkdirSync(tgtRoot, { recursive: true });
+    assertSafeSshField('user', ssh.user);
+    assertSafeSshField('host', ssh.host);
+    assertSafeSshField('key', ssh.key);
+    assertSafeSshField('path', ssh.path);
+    const { knownHosts, strict } = setupKnownHosts(ssh);
+    const remote = `${ssh.user}@${ssh.host}:${ssh.path}/`;
+    const sshCmd = `ssh -i ${ssh.key} -o StrictHostKeyChecking=${strict} -o UserKnownHostsFile=${knownHosts}`;
+    const args = ['-az', '--partial', '--info=progress2', '-e', sshCmd, remote, tgtRoot + '/'];
+    return new Promise((resolve, reject) => {
+        const proc = spawn('rsync', args);
+        let totalFiles = 0;
+        let doneFiles = 0;
+        let totalBytes = 0;
+        proc.stdout.on('data', (chunk) => {
+            const text = chunk.toString();
+            // Parse --info=progress2: lines like "     117,504,614 100%  108.64MB/s    0:00:01 (xfr#123, to-chk=0/456)"
+            for (const line of text.split('\n')) {
+                // Extract to-chk=N/TOTAL
+                const chkMatch = line.match(/to-chk=(\d+)\/(\d+)/);
+                if (chkMatch) {
+                    const remaining = parseInt(chkMatch[1], 10);
+                    const total = parseInt(chkMatch[2], 10);
+                    if (totalFiles === 0)
+                        totalFiles = total;
+                    doneFiles = total - remaining;
+                    const pct = total > 0 ? Math.round((doneFiles / total) * 100) : 0;
+                    opts.onProgress?.(`rsync: ${doneFiles}/${total} files (${pct}%)`, pct);
+                }
+                // Extract bytes: first number on lines with a %
+                const bytesMatch = line.match(/^\s+([\d,]+)\s+\d+%/);
+                if (bytesMatch) {
+                    totalBytes = parseInt(bytesMatch[1].replace(/,/g, ''), 10);
+                }
+            }
+        });
+        proc.stderr.on('data', (chunk) => {
+            opts.onProgress?.(`rsync: ${chunk.toString().trim()}`, undefined);
+        });
+        proc.on('error', (err) => reject(err));
+        proc.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`rsync exited with code ${code}`));
+            }
+            else {
+                resolve({ copied: doneFiles || totalFiles, bytes: totalBytes, placeholdered: 0 });
+            }
+        });
+    });
+}
 export async function copyFiles(opts) {
+    const ssh = resolveSshConfig(opts.fromEnv);
+    if (opts.transport === 'rsync' || (opts.transport !== 'local' && ssh !== null)) {
+        if (!ssh)
+            throw new Error(`rsync requested but no [transport.ssh.${opts.fromEnv}] config found`);
+        return copyFilesRsync(opts, ssh);
+    }
     const srcRoot = resolveEnvFilesRoot(opts.fromEnv);
     const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
     if (!fs.existsSync(srcRoot)) {

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkLlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyMlF"}

package/dist/migrate/run.js

@@ -172,17 +172,40 @@ export async function runMigration(req) {
     // Step 5: DB copy
     if (includeDb) {
         emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
-        const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
-        const result = await copyDb(srcAdapter, tgtAdapter, {
-            type: fromDbConfig.type,
-            tables: req.tables ?? migrateConfig.tables,
-            preserve: migrateConfig.preserve,
-            pkOverrides: migrateConfig.pkOverrides,
-            scrubHook,
-            onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
-        });
-        dbResult = result;
-        emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
+        if (req.transport === 'dump-restore') {
+            const { resolveBackupConfig } = await import('../resolve/backup.js');
+            const { restoreDbViaDump } = await import('./db-dump-restore.js');
+            const backup = resolveBackupConfig(req.to);
+            if (!backup) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_INVALID_REQUEST',
+                    pkg: 'hazo_env',
+                    message: `[backup.${req.to}] config section is required for dump-restore transport`,
+                });
+            }
+            dbResult = await restoreDbViaDump(backup, {
+                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+            });
+            emitProgress(req, { phase: 'db', message: 'DB restore via dump complete', percent: 70 });
+        }
+        else {
+            const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
+            const result = await copyDb(srcAdapter, tgtAdapter, {
+                type: fromDbConfig.type,
+                tables: req.tables ?? migrateConfig.tables,
+                preserve: migrateConfig.preserve,
+                pkOverrides: migrateConfig.pkOverrides,
+                scrubHook,
+                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+                onTableProgress: (idx, total, name) => emitProgress(req, {
+                    phase: 'db',
+                    message: `table ${idx}/${total}: ${name}`,
+                    percent: 20 + Math.round((idx / total) * 50),
+                }),
+            });
+            dbResult = result;
+            emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
+        }
     }
     // Step 6: File copy
     if (includeFiles) {

package/dist/migrate/ssh-exec.d.ts

@@ -0,0 +1,30 @@
+import type { SshConfig } from '../resolve/ssh.js';
+/**
+ * Reject SSH config values that could smuggle extra SSH options through
+ * shell argument expansion. Values starting with '-' (e.g. -oProxyCommand=...)
+ * or containing whitespace would be re-split by SSH and treated as flags.
+ */
+export declare function assertSafeSshField(name: string, value: string): void;
+/**
+ * Set up a persistent known_hosts file for SSH host-key pinning.
+ * When ssh.hostKey is set, the key is pinned and strict checking is enabled
+ * (no TOFU). Otherwise, accept-new is used — trust on first use, then persist.
+ *
+ * Returns { knownHosts: absolute path, strict: 'yes' | 'accept-new' }.
+ */
+export declare function setupKnownHosts(ssh: SshConfig): {
+    knownHosts: string;
+    strict: string;
+};
+/**
+ * Run a bash script on a remote host via SSH, piping remoteScript to stdin.
+ *
+ * Spawns: ssh -i <key> -o StrictHostKeyChecking=<strict>
+ *             -o UserKnownHostsFile=<knownHosts> <user>@<host> bash -s
+ *
+ * Streams stdout/stderr lines to opts.onProgress. Rejects on non-zero exit.
+ */
+export declare function runSsh(ssh: SshConfig, remoteScript: string, opts?: {
+    onProgress?: (msg: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=ssh-exec.d.ts.map

package/dist/migrate/ssh-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-exec.d.ts","sourceRoot":"","sources":["../../src/migrate/ssh-exec.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYtF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/migrate/ssh-exec.js

@@ -0,0 +1,82 @@
+// hazo_env/src/migrate/ssh-exec.ts — Shared SSH execution helpers
+//
+// Extracted from files.ts so that db-dump-restore.ts can reuse the same
+// known_hosts pinning and safe-field validation without duplication.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+/**
+ * Reject SSH config values that could smuggle extra SSH options through
+ * shell argument expansion. Values starting with '-' (e.g. -oProxyCommand=...)
+ * or containing whitespace would be re-split by SSH and treated as flags.
+ */
+export function assertSafeSshField(name, value) {
+    if (/^-/.test(value) || /\s/.test(value)) {
+        throw new Error(`Unsafe transport.ssh.${name} value: must not start with '-' or contain whitespace`);
+    }
+}
+/**
+ * Set up a persistent known_hosts file for SSH host-key pinning.
+ * When ssh.hostKey is set, the key is pinned and strict checking is enabled
+ * (no TOFU). Otherwise, accept-new is used — trust on first use, then persist.
+ *
+ * Returns { knownHosts: absolute path, strict: 'yes' | 'accept-new' }.
+ */
+export function setupKnownHosts(ssh) {
+    const knownHosts = path.resolve(process.cwd(), 'config', 'hazo_env_known_hosts');
+    fs.mkdirSync(path.dirname(knownHosts), { recursive: true });
+    if (ssh.hostKey) {
+        // Pin the operator-provided host key; strict checking, no first-use prompt.
+        const line = `${ssh.host} ${ssh.hostKey}\n`;
+        const existing = fs.existsSync(knownHosts) ? fs.readFileSync(knownHosts, 'utf8') : '';
+        if (!existing.includes(line.trim()))
+            fs.appendFileSync(knownHosts, line);
+    }
+    // Pinned key → strict verify; otherwise accept-new — never disable host-key checking.
+    const strict = ssh.hostKey ? 'yes' : 'accept-new';
+    return { knownHosts, strict };
+}
+/**
+ * Run a bash script on a remote host via SSH, piping remoteScript to stdin.
+ *
+ * Spawns: ssh -i <key> -o StrictHostKeyChecking=<strict>
+ *             -o UserKnownHostsFile=<knownHosts> <user>@<host> bash -s
+ *
+ * Streams stdout/stderr lines to opts.onProgress. Rejects on non-zero exit.
+ */
+export async function runSsh(ssh, remoteScript, opts) {
+    const { knownHosts, strict } = setupKnownHosts(ssh);
+    const sshArgs = [
+        '-i', ssh.key,
+        '-o', `StrictHostKeyChecking=${strict}`,
+        '-o', `UserKnownHostsFile=${knownHosts}`,
+        `${ssh.user}@${ssh.host}`,
+        'bash', '-s',
+    ];
+    return new Promise((resolve, reject) => {
+        const proc = spawn('ssh', sshArgs);
+        proc.stdin.write(remoteScript);
+        proc.stdin.end();
+        proc.stdout.on('data', (chunk) => {
+            for (const line of chunk.toString().split('\n')) {
+                if (line.trim())
+                    opts?.onProgress?.(line);
+            }
+        });
+        proc.stderr.on('data', (chunk) => {
+            for (const line of chunk.toString().split('\n')) {
+                if (line.trim())
+                    opts?.onProgress?.(line);
+            }
+        });
+        proc.on('error', (err) => reject(err));
+        proc.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`ssh exited with code ${code}`));
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}

package/dist/migrate/transport.d.ts

@@ -1,3 +1,3 @@
 import type { TransportMode, DbEnvConfig } from '../types/index.js';
-export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api';
+export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync' | 'dump-restore';
 //# sourceMappingURL=transport.d.ts.map

package/dist/migrate/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,CAYjB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAO5C"}

package/dist/migrate/transport.js

@@ -1,13 +1,8 @@
-// hazo_env/src/migrate/transport.ts — resolve transport mode for a migration
-import { HazoError } from 'hazo_core';
 export function resolveTransport(fromConfig, toConfig, requested = 'auto') {
-    if (requested === 'ssh') {
-        throw new HazoError({
-            code: 'HAZO_ENV_NOT_IMPLEMENTED',
-            pkg: 'hazo_env',
-            message: 'SSH transport is not yet implemented. Use local or api transport.',
-        });
-    }
+    if (requested === 'dump-restore')
+        return 'dump-restore';
+    if (requested === 'ssh')
+        return 'rsync';
     if (requested === 'api')
         return 'api';
     // auto: both sqlite → local

package/dist/resolve/backup.d.ts

@@ -0,0 +1,23 @@
+export interface BackupConfig {
+    /** Which [transport.ssh.*] connection to reuse for the SSH session */
+    ssh_env: string;
+    /** The Postgres database to drop/recreate on the remote */
+    target_db: string;
+    /** Owner passed to createdb -O */
+    owner: string;
+    /** Glob matching an existing dump file, or the literal string "fresh" */
+    dump_source: string;
+    /** Source DB for pg_dump — required when dump_source === 'fresh' */
+    fresh_dump_db?: string;
+    /** Shell command to run on the remote before dropping/restoring the DB */
+    pre_restore_cmd?: string;
+    /** Shell command to run on the remote after a successful restore */
+    post_restore_cmd?: string;
+}
+/**
+ * Resolve the [backup.<env>] section from hazo_env_config.ini.
+ * Returns null when the section is missing (transport not configured).
+ * Throws when required fields are absent or ssh_env is unsafe.
+ */
+export declare function resolveBackupConfig(env: string): BackupConfig | null;
+//# sourceMappingURL=backup.d.ts.map

package/dist/resolve/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/resolve/backup.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAcD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA8BpE"}

package/dist/resolve/backup.js

@@ -0,0 +1,52 @@
+// hazo_env/src/resolve/backup.ts — dump-restore backup transport config resolver
+//
+// Reads [backup.<env>] from config/hazo_env_config.ini and returns a BackupConfig,
+// or null when the section is absent (transport not configured for that env).
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { assertSafeSshField } from '../migrate/ssh-exec.js';
+function tryLoadEnvConfig() {
+    try {
+        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
+    }
+    catch {
+        return null;
+    }
+}
+function expandEnvVars(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+/**
+ * Resolve the [backup.<env>] section from hazo_env_config.ini.
+ * Returns null when the section is missing (transport not configured).
+ * Throws when required fields are absent or ssh_env is unsafe.
+ */
+export function resolveBackupConfig(env) {
+    const config = tryLoadEnvConfig();
+    if (!config)
+        return null;
+    const section = config.getSection(`backup.${env}`);
+    if (!section)
+        return null;
+    const ssh_env_raw = section['ssh_env'];
+    const target_db_raw = section['target_db'];
+    const owner_raw = section['owner'];
+    const dump_source_raw = section['dump_source'];
+    const fresh_dump_db_raw = section['fresh_dump_db'];
+    const pre_restore_cmd_raw = section['pre_restore_cmd'];
+    const post_restore_cmd_raw = section['post_restore_cmd'];
+    if (!ssh_env_raw || !target_db_raw || !owner_raw || !dump_source_raw)
+        return null;
+    const ssh_env = expandEnvVars(ssh_env_raw);
+    // ssh_env is used as an SSH argument — must not contain shell-hostile chars
+    assertSafeSshField('ssh_env', ssh_env);
+    return {
+        ssh_env,
+        target_db: expandEnvVars(target_db_raw),
+        owner: expandEnvVars(owner_raw),
+        dump_source: expandEnvVars(dump_source_raw),
+        fresh_dump_db: fresh_dump_db_raw ? expandEnvVars(fresh_dump_db_raw) : undefined,
+        pre_restore_cmd: pre_restore_cmd_raw ? expandEnvVars(pre_restore_cmd_raw) : undefined,
+        post_restore_cmd: post_restore_cmd_raw ? expandEnvVars(post_restore_cmd_raw) : undefined,
+    };
+}

package/dist/resolve/ssh.d.ts

@@ -0,0 +1,15 @@
+export interface SshConfig {
+    host: string;
+    user: string;
+    key: string;
+    path: string;
+    /**
+     * Optional pinned host public key (the right-hand side of a known_hosts line,
+     * e.g. "ssh-ed25519 AAAA...."). When set, host-key checking is strict and the
+     * key is pinned — no TOFU. When absent, the transport falls back to
+     * accept-new against a persistent known_hosts file.
+     */
+    hostKey?: string;
+}
+export declare function resolveSshConfig(env: string): SshConfig | null;
+//# sourceMappingURL=ssh.d.ts.map

package/dist/resolve/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../../src/resolve/ssh.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAsB9D"}

package/dist/resolve/ssh.js

@@ -0,0 +1,36 @@
+// hazo_env/src/resolve/ssh.ts — SSH transport config resolver
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+function tryLoadEnvConfig() {
+    try {
+        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
+    }
+    catch {
+        return null;
+    }
+}
+function expandEnvVars(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+export function resolveSshConfig(env) {
+    const config = tryLoadEnvConfig();
+    if (!config)
+        return null;
+    const section = config.getSection(`transport.ssh.${env}`);
+    if (!section)
+        return null;
+    const host = section['host'];
+    const user = section['user'];
+    const key = section['key'];
+    const remotePath = section['path'];
+    const hostKey = section['host_key'];
+    if (!host || !user || !key || !remotePath)
+        return null;
+    return {
+        host: expandEnvVars(host),
+        user: expandEnvVars(user),
+        key: expandEnvVars(key),
+        path: expandEnvVars(remotePath),
+        hostKey: hostKey ? expandEnvVars(hostKey) : undefined,
+    };
+}

package/dist/types/index.d.ts

@@ -43,11 +43,11 @@ export interface ResolveConnectOptions {
     env?: HazoEnv;
     allowOtherEnv?: boolean;
 }
-export type TransportMode = 'auto' | 'local' | 'ssh' | 'api';
+export type TransportMode = 'auto' | 'local' | 'ssh' | 'api' | 'dump-restore';
 export type ScrubMode = 'auto' | 'none';
 export type HashMode = 'none' | 'sample' | 'full';
 export interface MigrationProgress {
-    phase: 'validate' | 'snapshot' | 'plan' | 'schema-check' | 'db' | 'files' | 'verify' | 'finalize' | 'done';
+    phase: 'validate' | 'snapshot' | 'plan' | 'schema-check' | 'db' | 'files' | 'verify' | 'finalize' | 'done' | 'clear';
     message: string;
     percent?: number;
 }
@@ -75,6 +75,7 @@ export interface MigrationResult {
         tables: number;
         rows: number;
         scrubbed: number;
+        mode?: string;
     };
     files?: {
         copied: number;
@@ -102,5 +103,24 @@ export interface MigrateConfig {
     preserve?: string[];
     pkOverrides?: Record<string, string>;
 }
+export interface ClearRequest {
+    env: HazoEnv;
+    include?: {
+        db?: boolean;
+        files?: boolean;
+    };
+    allowProdTarget?: boolean;
+    confirmToken?: string;
+    jobId?: string;
+    progressDir?: string;
+    onProgress?: (p: MigrationProgress) => void;
+}
+export interface ClearResult {
+    ok: boolean;
+    tablesCleared: number;
+    filesCleared: boolean;
+    durationMs: number;
+    warnings: string[];
+}
 export type MaskTransform = (value: unknown, key: string, maskKey: string) => unknown;
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3G,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,cAAc,CAAC;AAC9E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACrH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",