hazo_env 0.5.0 → 0.6.0

package/README.md

@@ -235,6 +235,47 @@ Key sections:
 
 Secret placeholders use `${ENV_VAR_NAME}` syntax — hazo_env substitutes them from `.env.local` at runtime.
 
+## dump-restore transport
+
+The `dump-restore` transport copies a database via SSH `pg_dump`/`pg_restore` (binary format). Use it when the source and target share the same Postgres server (e.g. prod→dev on the same VPS) and you want a fast binary copy without going through the PostgREST row-copy loop.
+
+### Config: `[backup.<env>]`
+
+Add a section to `config/hazo_env_config.ini`:
+
+```ini
+[backup.dev]
+ssh_env         = prod         ; reuse [transport.ssh.prod] SSH connection
+target_db       = myapp_dev    ; DB to drop/recreate
+owner           = adminuser    ; createdb -O <owner>
+dump_source     = /var/backups/myapp-*.pgdump  ; glob (newest used) or "fresh"
+fresh_dump_db   = myapp        ; source DB for pg_dump when dump_source=fresh
+pre_restore_cmd = sudo systemctl stop myapp-postgrest-dev
+post_restore_cmd= sudo systemctl start myapp-postgrest-dev
+```
+
+> **No PII scrubbing on this path.** The binary `pg_restore` copies raw rows; hazo_env's `scrubHook` only runs inside the PostgREST row-copy loop. If you need scrubbed data in dev, use the default `api` transport instead.
+
+### CLI
+
+```bash
+npx hazo-env migrate --from prod --to dev --transport dump-restore
+```
+
+### Programmatic API
+
+```ts
+import { resolveBackupConfig, restoreDbViaDump } from 'hazo_env';
+
+const backup = resolveBackupConfig('dev'); // reads [backup.dev] from INI
+if (backup) {
+  const result = await restoreDbViaDump(backup, {
+    onProgress: (msg) => console.log(msg),
+  });
+  // result.mode === 'dump-restore'
+}
+```
+
 ## License
 
 MIT

package/dist/cli.js

@@ -81,6 +81,8 @@ async function runMigrate() {
     const tablesIdx = args.findIndex((a) => a === '--tables');
     const tablesArg = tablesIdx >= 0 ? args[tablesIdx + 1] : undefined;
     const tables = tablesArg ? tablesArg.split(',').map((t) => t.trim()) : undefined;
+    const transportIdx = args.findIndex((a) => a === '--transport');
+    const transport = transportIdx >= 0 ? args[transportIdx + 1] : undefined;
     if (!from || !to) {
         console.error(pc.red('Error: migrate requires --from <env> and --to <env>'));
         process.exit(1);
@@ -96,6 +98,7 @@ async function runMigrate() {
             dryRun,
             allowProdTarget,
             confirmToken,
+            transport: transport,
             onProgress: (p) => {
                 const pct = p.percent != null ? `${p.percent}%`.padStart(4) + ' ' : '     ';
                 console.log(`  ${pct}${pc.dim(p.phase.padEnd(12))} ${p.message}`);

package/dist/index.d.ts

@@ -15,4 +15,8 @@ export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.j
 export type { MaskRule } from './mask/ruleset.js';
 export type { MaskTransform } from './types/index.js';
 export * from './lib/index.js';
+export { resolveBackupConfig } from './resolve/backup.js';
+export type { BackupConfig } from './resolve/backup.js';
+export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
+export { restoreDbViaDump } from './migrate/db-dump-restore.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -23,3 +23,7 @@ export { registerMask } from './mask/registry.js';
 export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
 // Lib
 export * from './lib/index.js';
+// dump-restore transport
+export { resolveBackupConfig } from './resolve/backup.js';
+export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
+export { restoreDbViaDump } from './migrate/db-dump-restore.js';

package/dist/migrate/db-dump-restore.d.ts

@@ -0,0 +1,24 @@
+import type { BackupConfig } from '../resolve/backup.js';
+export interface DbDumpRestoreResult {
+    tables: number;
+    rows: number;
+    scrubbed: number;
+    mode: string;
+}
+/**
+ * Restore a Postgres database on a remote server via SSH pg_dump/pg_restore.
+ *
+ * Steps executed remotely:
+ *  1. Obtain a dump file (fresh pg_dump or locate an existing .pgdump)
+ *  2. Run pre_restore_cmd (if configured)
+ *  3. dropdb --if-exists + createdb -O <owner>
+ *  4. pg_restore -d <target_db>
+ *  5. Run post_restore_cmd (if configured)
+ *
+ * Returns a DbDumpRestoreResult with mode: 'dump-restore' and zero
+ * row/table counts (binary restore does not report these).
+ */
+export declare function restoreDbViaDump(backup: BackupConfig, opts?: {
+    onProgress?: (msg: string) => void;
+}): Promise<DbDumpRestoreResult>;
+//# sourceMappingURL=db-dump-restore.d.ts.map

package/dist/migrate/db-dump-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-dump-restore.d.ts","sourceRoot":"","sources":["../../src/migrate/db-dump-restore.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CA6D9B"}

package/dist/migrate/db-dump-restore.js

@@ -0,0 +1,72 @@
+// hazo_env/src/migrate/db-dump-restore.ts — DB copy via SSH pg_dump/pg_restore
+//
+// Builds a single remote bash script and runs it via runSsh.
+// ⚠️  No PII scrubbing on this path — pg_restore copies raw binary rows.
+//     Use the default api transport when scrubbed data is required in dev.
+import { resolveSshConfig } from '../resolve/ssh.js';
+import { runSsh } from './ssh-exec.js';
+/**
+ * Restore a Postgres database on a remote server via SSH pg_dump/pg_restore.
+ *
+ * Steps executed remotely:
+ *  1. Obtain a dump file (fresh pg_dump or locate an existing .pgdump)
+ *  2. Run pre_restore_cmd (if configured)
+ *  3. dropdb --if-exists + createdb -O <owner>
+ *  4. pg_restore -d <target_db>
+ *  5. Run post_restore_cmd (if configured)
+ *
+ * Returns a DbDumpRestoreResult with mode: 'dump-restore' and zero
+ * row/table counts (binary restore does not report these).
+ */
+export async function restoreDbViaDump(backup, opts) {
+    const ssh = resolveSshConfig(backup.ssh_env);
+    if (!ssh) {
+        throw new Error(`dump-restore: no [transport.ssh.${backup.ssh_env}] config found — ` +
+            `set ssh_env to a configured SSH transport in [backup.*]`);
+    }
+    // Build remote bash script lines
+    const lines = ['set -euo pipefail', ''];
+    // Step 1: Get or create dump
+    lines.push('# Step 1: Get or create dump');
+    if (backup.dump_source === 'fresh') {
+        lines.push('DUMP_FILE="/tmp/he-$(date +%s).pgdump"');
+        lines.push(`echo "Creating fresh dump of ${backup.fresh_dump_db}..."`);
+        lines.push(`pg_dump -Fc ${backup.fresh_dump_db} > "$DUMP_FILE"`);
+    }
+    else {
+        lines.push(`echo "Locating dump file matching ${backup.dump_source}..."`);
+        lines.push(`DUMP_FILE=$(ls -t ${backup.dump_source} 2>/dev/null | head -1)`);
+        lines.push(`if [ -z "$DUMP_FILE" ]; then echo "No dump file found matching ${backup.dump_source}"; exit 1; fi`);
+        lines.push('echo "Using dump: $DUMP_FILE"');
+    }
+    lines.push('');
+    // Step 2: Pre-restore command (optional)
+    if (backup.pre_restore_cmd) {
+        lines.push('# Step 2: Pre-restore command');
+        lines.push('echo "Running pre-restore..."');
+        lines.push(backup.pre_restore_cmd);
+        lines.push('');
+    }
+    // Step 3: Drop and recreate target DB
+    lines.push('# Step 3: Drop and recreate target DB');
+    lines.push(`echo "Dropping ${backup.target_db}..."`);
+    lines.push(`dropdb --if-exists ${backup.target_db}`);
+    lines.push(`echo "Creating ${backup.target_db}..."`);
+    lines.push(`createdb -O ${backup.owner} ${backup.target_db}`);
+    lines.push('');
+    // Step 4: Restore
+    lines.push('# Step 4: Restore');
+    lines.push(`echo "Restoring to ${backup.target_db}..."`);
+    lines.push(`pg_restore -d ${backup.target_db} "$DUMP_FILE"`);
+    lines.push('echo "Restore complete."');
+    // Step 5: Post-restore command (optional)
+    if (backup.post_restore_cmd) {
+        lines.push('');
+        lines.push('# Step 5: Post-restore command');
+        lines.push('echo "Running post-restore..."');
+        lines.push(backup.post_restore_cmd);
+    }
+    const script = lines.join('\n');
+    await runSsh(ssh, script, { onProgress: opts?.onProgress });
+    return { tables: 0, rows: 0, scrubbed: 0, mode: 'dump-restore' };
+}

package/dist/migrate/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AA6GD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/migrate/files.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;CACvB;AAoFD,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkDhF"}

package/dist/migrate/files.js

@@ -9,6 +9,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { resolveFilesRoot } from '../resolve/files.js';
 import { resolveSshConfig } from '../resolve/ssh.js';
+import { assertSafeSshField, setupKnownHosts } from './ssh-exec.js';
 function resolveEnvFilesRoot(env) {
     return resolveFilesRoot(env);
 }
@@ -31,17 +32,6 @@ async function scrubPdfFile(filePath) {
         // Non-fatal — PDF scrubbing failure is a warning, not an abort
     }
 }
-/**
- * Reject ssh config values that could smuggle extra ssh options through rsync's
- * `-e` command string. rsync re-splits `-e` on whitespace, so a value starting
- * with `-` (e.g. `-oProxyCommand=...`) or containing whitespace would be parsed
- * as additional ssh flags rather than data. Fail loud instead of running.
- */
-function assertSafeSshField(name, value) {
-    if (/^-/.test(value) || /\s/.test(value)) {
-        throw new Error(`Unsafe transport.ssh.${name} value: must not start with '-' or contain whitespace`);
-    }
-}
 async function copyFilesRsync(opts, ssh) {
     const tgtRoot = resolveEnvFilesRoot(opts.toEnv);
     fs.mkdirSync(tgtRoot, { recursive: true });
@@ -49,19 +39,7 @@ async function copyFilesRsync(opts, ssh) {
     assertSafeSshField('host', ssh.host);
     assertSafeSshField('key', ssh.key);
     assertSafeSshField('path', ssh.path);
-    // Persistent known_hosts so host-key trust survives across runs (no TOFU reset).
-    const knownHosts = path.resolve(process.cwd(), 'config', 'hazo_env_known_hosts');
-    fs.mkdirSync(path.dirname(knownHosts), { recursive: true });
-    if (ssh.hostKey) {
-        // Pin the operator-provided host key; strict checking, no first-use prompt.
-        const line = `${ssh.host} ${ssh.hostKey}\n`;
-        const existing = fs.existsSync(knownHosts) ? fs.readFileSync(knownHosts, 'utf8') : '';
-        if (!existing.includes(line.trim()))
-            fs.appendFileSync(knownHosts, line);
-    }
-    // Pinned key → strict verify; otherwise accept-new (trust on first use, then
-    // persist) — never disable host-key checking outright.
-    const strict = ssh.hostKey ? 'yes' : 'accept-new';
+    const { knownHosts, strict } = setupKnownHosts(ssh);
     const remote = `${ssh.user}@${ssh.host}:${ssh.path}/`;
     const sshCmd = `ssh -i ${ssh.key} -o StrictHostKeyChecking=${strict} -o UserKnownHostsFile=${knownHosts}`;
     const args = ['-az', '--partial', '--info=progress2', '-e', sshCmd, remote, tgtRoot + '/'];

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwLlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyMlF"}

package/dist/migrate/run.js

@@ -172,22 +172,40 @@ export async function runMigration(req) {
     // Step 5: DB copy
     if (includeDb) {
         emitProgress(req, { phase: 'db', message: 'Copying database tables', percent: 20 });
-        const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
-        const result = await copyDb(srcAdapter, tgtAdapter, {
-            type: fromDbConfig.type,
-            tables: req.tables ?? migrateConfig.tables,
-            preserve: migrateConfig.preserve,
-            pkOverrides: migrateConfig.pkOverrides,
-            scrubHook,
-            onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
-            onTableProgress: (idx, total, name) => emitProgress(req, {
-                phase: 'db',
-                message: `table ${idx}/${total}: ${name}`,
-                percent: 20 + Math.round((idx / total) * 50),
-            }),
-        });
-        dbResult = result;
-        emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
+        if (req.transport === 'dump-restore') {
+            const { resolveBackupConfig } = await import('../resolve/backup.js');
+            const { restoreDbViaDump } = await import('./db-dump-restore.js');
+            const backup = resolveBackupConfig(req.to);
+            if (!backup) {
+                throw new HazoError({
+                    code: 'HAZO_ENV_INVALID_REQUEST',
+                    pkg: 'hazo_env',
+                    message: `[backup.${req.to}] config section is required for dump-restore transport`,
+                });
+            }
+            dbResult = await restoreDbViaDump(backup, {
+                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+            });
+            emitProgress(req, { phase: 'db', message: 'DB restore via dump complete', percent: 70 });
+        }
+        else {
+            const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
+            const result = await copyDb(srcAdapter, tgtAdapter, {
+                type: fromDbConfig.type,
+                tables: req.tables ?? migrateConfig.tables,
+                preserve: migrateConfig.preserve,
+                pkOverrides: migrateConfig.pkOverrides,
+                scrubHook,
+                onProgress: (msg) => emitProgress(req, { phase: 'db', message: msg }),
+                onTableProgress: (idx, total, name) => emitProgress(req, {
+                    phase: 'db',
+                    message: `table ${idx}/${total}: ${name}`,
+                    percent: 20 + Math.round((idx / total) * 50),
+                }),
+            });
+            dbResult = result;
+            emitProgress(req, { phase: 'db', message: `DB copy complete: ${result.tables} tables, ${result.rows} rows`, percent: 70 });
+        }
     }
     // Step 6: File copy
     if (includeFiles) {

package/dist/migrate/ssh-exec.d.ts

@@ -0,0 +1,30 @@
+import type { SshConfig } from '../resolve/ssh.js';
+/**
+ * Reject SSH config values that could smuggle extra SSH options through
+ * shell argument expansion. Values starting with '-' (e.g. -oProxyCommand=...)
+ * or containing whitespace would be re-split by SSH and treated as flags.
+ */
+export declare function assertSafeSshField(name: string, value: string): void;
+/**
+ * Set up a persistent known_hosts file for SSH host-key pinning.
+ * When ssh.hostKey is set, the key is pinned and strict checking is enabled
+ * (no TOFU). Otherwise, accept-new is used — trust on first use, then persist.
+ *
+ * Returns { knownHosts: absolute path, strict: 'yes' | 'accept-new' }.
+ */
+export declare function setupKnownHosts(ssh: SshConfig): {
+    knownHosts: string;
+    strict: string;
+};
+/**
+ * Run a bash script on a remote host via SSH, piping remoteScript to stdin.
+ *
+ * Spawns: ssh -i <key> -o StrictHostKeyChecking=<strict>
+ *             -o UserKnownHostsFile=<knownHosts> <user>@<host> bash -s
+ *
+ * Streams stdout/stderr lines to opts.onProgress. Rejects on non-zero exit.
+ */
+export declare function runSsh(ssh: SshConfig, remoteScript: string, opts?: {
+    onProgress?: (msg: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=ssh-exec.d.ts.map

package/dist/migrate/ssh-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-exec.d.ts","sourceRoot":"","sources":["../../src/migrate/ssh-exec.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYtF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,GAAG,EAAE,SAAS,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/migrate/ssh-exec.js

@@ -0,0 +1,82 @@
+// hazo_env/src/migrate/ssh-exec.ts — Shared SSH execution helpers
+//
+// Extracted from files.ts so that db-dump-restore.ts can reuse the same
+// known_hosts pinning and safe-field validation without duplication.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+/**
+ * Reject SSH config values that could smuggle extra SSH options through
+ * shell argument expansion. Values starting with '-' (e.g. -oProxyCommand=...)
+ * or containing whitespace would be re-split by SSH and treated as flags.
+ */
+export function assertSafeSshField(name, value) {
+    if (/^-/.test(value) || /\s/.test(value)) {
+        throw new Error(`Unsafe transport.ssh.${name} value: must not start with '-' or contain whitespace`);
+    }
+}
+/**
+ * Set up a persistent known_hosts file for SSH host-key pinning.
+ * When ssh.hostKey is set, the key is pinned and strict checking is enabled
+ * (no TOFU). Otherwise, accept-new is used — trust on first use, then persist.
+ *
+ * Returns { knownHosts: absolute path, strict: 'yes' | 'accept-new' }.
+ */
+export function setupKnownHosts(ssh) {
+    const knownHosts = path.resolve(process.cwd(), 'config', 'hazo_env_known_hosts');
+    fs.mkdirSync(path.dirname(knownHosts), { recursive: true });
+    if (ssh.hostKey) {
+        // Pin the operator-provided host key; strict checking, no first-use prompt.
+        const line = `${ssh.host} ${ssh.hostKey}\n`;
+        const existing = fs.existsSync(knownHosts) ? fs.readFileSync(knownHosts, 'utf8') : '';
+        if (!existing.includes(line.trim()))
+            fs.appendFileSync(knownHosts, line);
+    }
+    // Pinned key → strict verify; otherwise accept-new — never disable host-key checking.
+    const strict = ssh.hostKey ? 'yes' : 'accept-new';
+    return { knownHosts, strict };
+}
+/**
+ * Run a bash script on a remote host via SSH, piping remoteScript to stdin.
+ *
+ * Spawns: ssh -i <key> -o StrictHostKeyChecking=<strict>
+ *             -o UserKnownHostsFile=<knownHosts> <user>@<host> bash -s
+ *
+ * Streams stdout/stderr lines to opts.onProgress. Rejects on non-zero exit.
+ */
+export async function runSsh(ssh, remoteScript, opts) {
+    const { knownHosts, strict } = setupKnownHosts(ssh);
+    const sshArgs = [
+        '-i', ssh.key,
+        '-o', `StrictHostKeyChecking=${strict}`,
+        '-o', `UserKnownHostsFile=${knownHosts}`,
+        `${ssh.user}@${ssh.host}`,
+        'bash', '-s',
+    ];
+    return new Promise((resolve, reject) => {
+        const proc = spawn('ssh', sshArgs);
+        proc.stdin.write(remoteScript);
+        proc.stdin.end();
+        proc.stdout.on('data', (chunk) => {
+            for (const line of chunk.toString().split('\n')) {
+                if (line.trim())
+                    opts?.onProgress?.(line);
+            }
+        });
+        proc.stderr.on('data', (chunk) => {
+            for (const line of chunk.toString().split('\n')) {
+                if (line.trim())
+                    opts?.onProgress?.(line);
+            }
+        });
+        proc.on('error', (err) => reject(err));
+        proc.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`ssh exited with code ${code}`));
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}

package/dist/migrate/transport.d.ts

@@ -1,3 +1,3 @@
 import type { TransportMode, DbEnvConfig } from '../types/index.js';
-export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync';
+export declare function resolveTransport(fromConfig: DbEnvConfig, toConfig: DbEnvConfig, requested?: TransportMode): 'local' | 'api' | 'rsync' | 'dump-restore';
 //# sourceMappingURL=transport.d.ts.map

package/dist/migrate/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,CAM3B"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/migrate/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,WAAW,EACvB,QAAQ,EAAE,WAAW,EACrB,SAAS,GAAE,aAAsB,GAChC,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAO5C"}

package/dist/migrate/transport.js

@@ -1,4 +1,6 @@
 export function resolveTransport(fromConfig, toConfig, requested = 'auto') {
+    if (requested === 'dump-restore')
+        return 'dump-restore';
     if (requested === 'ssh')
         return 'rsync';
     if (requested === 'api')

package/dist/resolve/backup.d.ts

@@ -0,0 +1,23 @@
+export interface BackupConfig {
+    /** Which [transport.ssh.*] connection to reuse for the SSH session */
+    ssh_env: string;
+    /** The Postgres database to drop/recreate on the remote */
+    target_db: string;
+    /** Owner passed to createdb -O */
+    owner: string;
+    /** Glob matching an existing dump file, or the literal string "fresh" */
+    dump_source: string;
+    /** Source DB for pg_dump — required when dump_source === 'fresh' */
+    fresh_dump_db?: string;
+    /** Shell command to run on the remote before dropping/restoring the DB */
+    pre_restore_cmd?: string;
+    /** Shell command to run on the remote after a successful restore */
+    post_restore_cmd?: string;
+}
+/**
+ * Resolve the [backup.<env>] section from hazo_env_config.ini.
+ * Returns null when the section is missing (transport not configured).
+ * Throws when required fields are absent or ssh_env is unsafe.
+ */
+export declare function resolveBackupConfig(env: string): BackupConfig | null;
+//# sourceMappingURL=backup.d.ts.map

package/dist/resolve/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/resolve/backup.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAcD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA8BpE"}

package/dist/resolve/backup.js

@@ -0,0 +1,52 @@
+// hazo_env/src/resolve/backup.ts — dump-restore backup transport config resolver
+//
+// Reads [backup.<env>] from config/hazo_env_config.ini and returns a BackupConfig,
+// or null when the section is absent (transport not configured for that env).
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { assertSafeSshField } from '../migrate/ssh-exec.js';
+function tryLoadEnvConfig() {
+    try {
+        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
+    }
+    catch {
+        return null;
+    }
+}
+function expandEnvVars(value) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? '');
+}
+/**
+ * Resolve the [backup.<env>] section from hazo_env_config.ini.
+ * Returns null when the section is missing (transport not configured).
+ * Throws when required fields are absent or ssh_env is unsafe.
+ */
+export function resolveBackupConfig(env) {
+    const config = tryLoadEnvConfig();
+    if (!config)
+        return null;
+    const section = config.getSection(`backup.${env}`);
+    if (!section)
+        return null;
+    const ssh_env_raw = section['ssh_env'];
+    const target_db_raw = section['target_db'];
+    const owner_raw = section['owner'];
+    const dump_source_raw = section['dump_source'];
+    const fresh_dump_db_raw = section['fresh_dump_db'];
+    const pre_restore_cmd_raw = section['pre_restore_cmd'];
+    const post_restore_cmd_raw = section['post_restore_cmd'];
+    if (!ssh_env_raw || !target_db_raw || !owner_raw || !dump_source_raw)
+        return null;
+    const ssh_env = expandEnvVars(ssh_env_raw);
+    // ssh_env is used as an SSH argument — must not contain shell-hostile chars
+    assertSafeSshField('ssh_env', ssh_env);
+    return {
+        ssh_env,
+        target_db: expandEnvVars(target_db_raw),
+        owner: expandEnvVars(owner_raw),
+        dump_source: expandEnvVars(dump_source_raw),
+        fresh_dump_db: fresh_dump_db_raw ? expandEnvVars(fresh_dump_db_raw) : undefined,
+        pre_restore_cmd: pre_restore_cmd_raw ? expandEnvVars(pre_restore_cmd_raw) : undefined,
+        post_restore_cmd: post_restore_cmd_raw ? expandEnvVars(post_restore_cmd_raw) : undefined,
+    };
+}

package/dist/types/index.d.ts

@@ -43,7 +43,7 @@ export interface ResolveConnectOptions {
     env?: HazoEnv;
     allowOtherEnv?: boolean;
 }
-export type TransportMode = 'auto' | 'local' | 'ssh' | 'api';
+export type TransportMode = 'auto' | 'local' | 'ssh' | 'api' | 'dump-restore';
 export type ScrubMode = 'auto' | 'none';
 export type HashMode = 'none' | 'sample' | 'full';
 export interface MigrationProgress {
@@ -75,6 +75,7 @@ export interface MigrationResult {
         tables: number;
         rows: number;
         scrubbed: number;
+        mode?: string;
     };
     files?: {
         copied: number;

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACrH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnE,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAElC,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9B,CAAC;CACH;AAED,8BAA8B;AAC9B,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,cAAc,CAAC;AAC9E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,cAAc,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACrH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAGD,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",