hazo_env 0.6.0 → 0.8.0

package/dist/envsync/service.js

@@ -0,0 +1,406 @@
+// hazo_env/src/envsync/service.ts — HTTP front-end for envsync ("hazo-env serve")
+//
+// Plain node:http server exposing downloadDb/uploadDb/downloadFiles/uploadFiles
+// over a tiny JSON API plus a self-contained HTML control page. This package
+// only depends on dotenv + picocolors (see package.json) — no framework, so
+// http.createServer is the right level of effort here, matching the
+// "self-contained ops tool" goal from the envsync plan.
+//
+// The CLI (`hazo-env sync ...`) and this service are two independent
+// front-ends over the same envsync/engine.ts functions — neither wraps the
+// other.
+//
+// Security model:
+//  - Every route requires `Authorization: Bearer <HAZO_ENVSYNC_TOKEN>`,
+//    including GET /status and GET / — simpler and safer than deciding
+//    which routes are "safe" to leave open for a single-operator ops tool.
+//    (Caveat: this means the control page's *own* initial load also needs
+//    the header, which a plain browser navigation can't set — operators are
+//    expected to reach it via a client that can set headers, e.g. curl, an
+//    HTTP client, or a browser extension. The page's client-side JS only
+//    needs the token for the fetch() calls it makes after that.)
+//  - Binds to 127.0.0.1 by default (HAZO_ENVSYNC_BIND to override).
+//  - Every write op runs inside envsync/lock.ts's withLock — a second
+//    concurrent request gets 409, never a racing second pg_dump/tar.
+//  - Destructive ops (uploadDb, uploadFiles when confirm:true) go through
+//    the same assertConfirmed/assertNotProd guards the CLI uses — the HTTP
+//    layer adds no bypass.
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveEnvsyncConfig } from '../resolve/envsync.js';
+import { downloadDb, uploadDb, downloadFiles, uploadFiles } from './engine.js';
+import { withLock, EnvsyncLockError } from './lock.js';
+import { pruneWorkDir } from './retention.js';
+// Arbitrary high port in the range unlikely to collide with other local
+// services; no particular significance beyond "pick one and document it".
+const DEFAULT_PORT = 7845;
+const DEFAULT_BIND = '127.0.0.1';
+// Caps a JSON request body at 1MB — these bodies are a couple of string
+// fields at most, this is purely an abuse/DoS guard.
+const MAX_BODY_BYTES = 1024 * 1024;
+// ────────────────────────────────────────────────────────────────────────────
+// small HTTP helpers
+// ────────────────────────────────────────────────────────────────────────────
+function sendJson(res, status, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': Buffer.byteLength(text),
+    });
+    res.end(text);
+}
+function sendHtml(res, status, html) {
+    res.writeHead(status, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Length': Buffer.byteLength(html),
+    });
+    res.end(html);
+}
+/**
+ * Errors thrown by the guard helpers (assertConfirmed/assertNotProd) always
+ * start with "Refusing" — that's the cheapest reliable way to tell a
+ * validation-shaped guard error apart from an unexpected one without a
+ * dedicated error class, so guard errors map to 400 and everything else
+ * (including real pg_dump/tar failures) maps to 500.
+ */
+function sendEngineError(res, err) {
+    if (err instanceof EnvsyncLockError) {
+        sendJson(res, 409, { error: 'locked', message: err.message });
+        return;
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.startsWith('Refusing')) {
+        sendJson(res, 400, { error: message });
+        return;
+    }
+    sendJson(res, 500, { error: message });
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                req.destroy();
+                reject(new Error('request body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            const text = Buffer.concat(chunks).toString('utf8').trim();
+            if (!text) {
+                resolve({});
+                return;
+            }
+            try {
+                const parsed = JSON.parse(text);
+                resolve(parsed && typeof parsed === 'object' ? parsed : {});
+            }
+            catch {
+                reject(new Error('invalid JSON request body'));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function requireConfig(res) {
+    const cfg = resolveEnvsyncConfig();
+    if (!cfg) {
+        sendJson(res, 500, { error: 'envsync not configured — missing [envsync] section in hazo_env_config.ini' });
+        return null;
+    }
+    return cfg;
+}
+function progressLogger(op) {
+    return (msg) => console.log(`[envsync:${op}] ${msg}`);
+}
+// ────────────────────────────────────────────────────────────────────────────
+// routes
+// ────────────────────────────────────────────────────────────────────────────
+function handleStatus(res) {
+    const cfg = resolveEnvsyncConfig();
+    if (!cfg) {
+        sendJson(res, 200, { status: 'unconfigured' });
+        return;
+    }
+    const lockPath = path.join(cfg.work_dir, '.envsync.lock');
+    if (!fs.existsSync(lockPath)) {
+        sendJson(res, 200, { status: 'idle' });
+        return;
+    }
+    try {
+        const data = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+        sendJson(res, 200, { status: 'busy', op: data.op, since: data.timestamp });
+    }
+    catch {
+        // Missing/unreadable lockfile — treat as idle. Actual staleness
+        // enforcement (dead-PID clearing) happens inside withLock when an op is
+        // attempted; this is just a best-effort status read.
+        sendJson(res, 200, { status: 'idle' });
+    }
+}
+async function handleDbDownload(res) {
+    const cfg = requireConfig(res);
+    if (!cfg)
+        return;
+    try {
+        const result = await withLock(cfg.work_dir, 'download_db', () => downloadDb(cfg, { onProgress: progressLogger('download_db') }));
+        pruneWorkDir(cfg.work_dir, { keep: cfg.keep });
+        sendJson(res, 200, { ok: true, result });
+    }
+    catch (err) {
+        sendEngineError(res, err);
+    }
+}
+async function handleDbUpload(req, res) {
+    const cfg = requireConfig(res);
+    if (!cfg)
+        return;
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
+        return;
+    }
+    const dumpPath = body['dumpPath'];
+    if (typeof dumpPath !== 'string' || !dumpPath) {
+        sendJson(res, 400, { error: 'dumpPath is required' });
+        return;
+    }
+    try {
+        const result = await withLock(cfg.work_dir, 'upload_db', () => uploadDb(cfg, dumpPath, {
+            confirm: body['confirm'] === true,
+            allowProd: body['allowProd'] === true,
+            onProgress: progressLogger('upload_db'),
+        }));
+        sendJson(res, 200, result);
+    }
+    catch (err) {
+        sendEngineError(res, err);
+    }
+}
+async function handleFilesArchive(res) {
+    const cfg = requireConfig(res);
+    if (!cfg)
+        return;
+    try {
+        const result = await withLock(cfg.work_dir, 'download_files', () => downloadFiles(cfg, { onProgress: progressLogger('download_files') }));
+        pruneWorkDir(cfg.work_dir, { keep: cfg.keep });
+        sendJson(res, 200, { ok: true, result });
+    }
+    catch (err) {
+        sendEngineError(res, err);
+    }
+}
+async function handleFilesRestore(req, res) {
+    const cfg = requireConfig(res);
+    if (!cfg)
+        return;
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (err) {
+        sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
+        return;
+    }
+    const archivePath = body['archivePath'];
+    if (typeof archivePath !== 'string' || !archivePath) {
+        sendJson(res, 400, { error: 'archivePath is required' });
+        return;
+    }
+    try {
+        // uploadFiles itself returns { ok: false, diff } for the no-confirm
+        // dry-run preview — that's a normal 200, not an error.
+        const result = await withLock(cfg.work_dir, 'upload_files', () => uploadFiles(cfg, archivePath, {
+            confirm: body['confirm'] === true,
+            allowProd: body['allowProd'] === true,
+            onProgress: progressLogger('upload_files'),
+        }));
+        sendJson(res, 200, result);
+    }
+    catch (err) {
+        sendEngineError(res, err);
+    }
+}
+function controlPageHtml() {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>hazo_env — envsync control</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; max-width: 760px; margin: 2rem auto; padding: 0 1rem; }
+  h1 { font-size: 1.25rem; }
+  h2 { font-size: 1rem; }
+  section { margin-bottom: 1.5rem; padding: 1rem; border: 1px solid #8884; border-radius: 8px; }
+  button { padding: 0.5rem 1rem; margin-right: 0.5rem; cursor: pointer; }
+  input[type="text"], input[type="password"] { padding: 0.4rem; width: 100%; box-sizing: border-box; margin-bottom: 0.5rem; }
+  pre { background: #8881; padding: 0.75rem; border-radius: 6px; overflow-x: auto; white-space: pre-wrap; word-break: break-word; }
+  label { font-weight: 600; }
+  .row { display: flex; gap: 0.5rem; align-items: center; margin-bottom: 0.5rem; flex-wrap: wrap; }
+</style>
+</head>
+<body>
+<h1>hazo_env — envsync control</h1>
+
+<section>
+  <label for="token">Bearer token</label>
+  <div class="row">
+    <input type="password" id="token" placeholder="HAZO_ENVSYNC_TOKEN" />
+    <button id="saveToken" type="button">Save</button>
+  </div>
+  <div id="status">status: (unknown)</div>
+</section>
+
+<section>
+  <h2>Database</h2>
+  <div class="row">
+    <button id="dbDownload" type="button">Download DB</button>
+  </div>
+  <div class="row">
+    <input type="text" id="dumpPath" placeholder="/path/to/db-&lt;id&gt;.pgdump" />
+  </div>
+  <div class="row">
+    <label><input type="checkbox" id="dbConfirm" /> confirm</label>
+    <label><input type="checkbox" id="dbAllowProd" /> allow prod</label>
+    <button id="dbUpload" type="button">Upload DB</button>
+  </div>
+</section>
+
+<section>
+  <h2>Files</h2>
+  <div class="row">
+    <button id="filesArchive" type="button">Archive Files</button>
+  </div>
+  <div class="row">
+    <input type="text" id="archivePath" placeholder="/path/to/files-&lt;id&gt;.tar.gz" />
+  </div>
+  <div class="row">
+    <label><input type="checkbox" id="filesConfirm" /> confirm</label>
+    <label><input type="checkbox" id="filesAllowProd" /> allow prod</label>
+    <button id="filesRestore" type="button">Restore Files</button>
+  </div>
+</section>
+
+<pre id="output">(no output yet)</pre>
+
+<script>
+function getToken() { return sessionStorage.getItem('hazo_envsync_token') || ''; }
+document.getElementById('token').value = getToken();
+document.getElementById('saveToken').addEventListener('click', function () {
+  sessionStorage.setItem('hazo_envsync_token', document.getElementById('token').value);
+  refreshStatus();
+});
+
+function call(method, urlPath, body) {
+  var headers = { 'Content-Type': 'application/json' };
+  var token = getToken();
+  if (token) headers['Authorization'] = 'Bearer ' + token;
+  return fetch(urlPath, { method: method, headers: headers, body: body ? JSON.stringify(body) : undefined })
+    .then(function (res) { return res.json().catch(function () { return { error: 'invalid response' }; }); })
+    .then(function (json) {
+      document.getElementById('output').textContent = JSON.stringify(json, null, 2);
+      return json;
+    })
+    .catch(function (err) {
+      document.getElementById('output').textContent = 'request failed: ' + err;
+    });
+}
+
+function refreshStatus() {
+  call('GET', '/status').then(function (json) {
+    document.getElementById('status').textContent = 'status: ' + JSON.stringify(json);
+  });
+}
+
+document.getElementById('dbDownload').addEventListener('click', function () { call('POST', '/db/download'); });
+document.getElementById('dbUpload').addEventListener('click', function () {
+  call('POST', '/db/upload', {
+    dumpPath: document.getElementById('dumpPath').value,
+    confirm: document.getElementById('dbConfirm').checked,
+    allowProd: document.getElementById('dbAllowProd').checked,
+  });
+});
+document.getElementById('filesArchive').addEventListener('click', function () { call('POST', '/files/archive'); });
+document.getElementById('filesRestore').addEventListener('click', function () {
+  call('POST', '/files/restore', {
+    archivePath: document.getElementById('archivePath').value,
+    confirm: document.getElementById('filesConfirm').checked,
+    allowProd: document.getElementById('filesAllowProd').checked,
+  });
+});
+
+refreshStatus();
+</script>
+</body>
+</html>`;
+}
+// ────────────────────────────────────────────────────────────────────────────
+// server bootstrap
+// ────────────────────────────────────────────────────────────────────────────
+async function dispatch(req, res, token) {
+    const auth = req.headers['authorization'];
+    if (auth !== `Bearer ${token}`) {
+        sendJson(res, 401, { error: 'unauthorized' });
+        return;
+    }
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const method = req.method ?? 'GET';
+    if (method === 'GET' && url.pathname === '/status')
+        return handleStatus(res);
+    if (method === 'GET' && url.pathname === '/')
+        return sendHtml(res, 200, controlPageHtml());
+    if (method === 'POST' && url.pathname === '/db/download')
+        return handleDbDownload(res);
+    if (method === 'POST' && url.pathname === '/db/upload')
+        return handleDbUpload(req, res);
+    if (method === 'POST' && url.pathname === '/files/archive')
+        return handleFilesArchive(res);
+    if (method === 'POST' && url.pathname === '/files/restore')
+        return handleFilesRestore(req, res);
+    sendJson(res, 404, { error: 'not_found' });
+}
+/**
+ * Start the envsync HTTP service. Throws synchronously if no bearer token
+ * is configured (via opts.token or HAZO_ENVSYNC_TOKEN) — this service must
+ * never run unauthenticated.
+ *
+ * opts override env vars, which makes this testable without real env vars
+ * or real ports: pass { port: 0 } for an OS-assigned ephemeral port and read
+ * the actual port off `server.address()`.
+ */
+export function startEnvsyncService(opts = {}) {
+    const token = opts.token ?? process.env['HAZO_ENVSYNC_TOKEN'];
+    if (!token) {
+        throw new Error('envsync: HAZO_ENVSYNC_TOKEN is required to start the envsync service — refusing to run with no auth');
+    }
+    const envPort = process.env['HAZO_ENVSYNC_PORT'];
+    const port = opts.port ?? (envPort ? Number(envPort) : DEFAULT_PORT);
+    const bind = opts.bind ?? process.env['HAZO_ENVSYNC_BIND'] ?? DEFAULT_BIND;
+    const server = http.createServer((req, res) => {
+        dispatch(req, res, token).catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            if (!res.headersSent)
+                sendJson(res, 500, { error: message });
+            else
+                res.end();
+        });
+    });
+    server.listen(port, bind);
+    return {
+        server,
+        close() {
+            return new Promise((resolve, reject) => {
+                server.close((err) => (err ? reject(err) : resolve()));
+            });
+        },
+    };
+}

package/dist/index.d.ts

@@ -5,18 +5,6 @@ export * from './resolve/secrets.js';
 export * from './resolve/connect.js';
 export * from './resolve/files.js';
 export * from './doctor.js';
-export { runMigration } from './migrate/run.js';
-export { clearEnv } from './migrate/clear.js';
-export { verifyFiles } from './migrate/verify.js';
-export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
-export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
-export { registerMask } from './mask/registry.js';
-export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
-export type { MaskRule } from './mask/ruleset.js';
-export type { MaskTransform } from './types/index.js';
 export * from './lib/index.js';
-export { resolveBackupConfig } from './resolve/backup.js';
-export type { BackupConfig } from './resolve/backup.js';
 export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
-export { restoreDbViaDump } from './migrate/db-dump-restore.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEvG,cAAc,kBAAkB,CAAC;AAEjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,aAAa,CAAC;AAE5B,cAAc,gBAAgB,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -11,19 +11,7 @@ export * from './resolve/connect.js';
 export * from './resolve/files.js';
 // Doctor
 export * from './doctor.js';
-// Migration engine (Phase 2)
-export { runMigration } from './migrate/run.js';
-export { clearEnv } from './migrate/clear.js';
-export { verifyFiles } from './migrate/verify.js';
-export { takeSnapshot, restoreSnapshot } from './migrate/snapshot.js';
-export { writeMigrationProgress, readMigrationProgress, clearMigrationProgress } from './migrate/progress.js';
-// Masking registry
-export { registerMask } from './mask/registry.js';
-// Masking ruleset
-export { loadRuleset, syncRulesetFromIni, parseIniRules } from './mask/ruleset.js';
 // Lib
 export * from './lib/index.js';
-// dump-restore transport
-export { resolveBackupConfig } from './resolve/backup.js';
+// Generic SSH-exec utilities (retained: shared infra, not migration-specific)
 export { runSsh, assertSafeSshField } from './migrate/ssh-exec.js';
-export { restoreDbViaDump } from './migrate/db-dump-restore.js';

package/dist/migrate/run.d.ts

@@ -1,3 +1,16 @@
 import type { MigrationRequest, MigrationResult } from '../types/index.js';
+/**
+ * Resolve the effective table list handed to copyDb.
+ *
+ * `'*'` (and an unset request) both mean "all tables". The SQL path can
+ * auto-discover that set, but the PostgREST path cannot (no FK ordering without
+ * an explicit list) and rejects `'*'`. So when the request asks for "all", we
+ * fall back to the configured `[migrate] tables` list — the app's canonical
+ * FK-ordered definition of "all". Only when no config list exists do we pass
+ * `'*'` through (SQL auto-discovers; PostgREST then errors as designed).
+ *
+ * An explicit `string[]` from the request always wins.
+ */
+export declare function resolveTableList(reqTables: '*' | string[] | undefined, configTables: string[] | undefined): '*' | string[];
 export declare function runMigration(req: MigrationRequest): Promise<MigrationResult>;
 //# sourceMappingURL=run.d.ts.map

package/dist/migrate/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AA0D3G,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyMlF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AAU3G;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,GACjC,GAAG,GAAG,MAAM,EAAE,CAGhB;AAkDD,wBAAsB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyMlF"}

package/dist/migrate/run.js

@@ -22,6 +22,23 @@ function emitProgress(req, p) {
         writeMigrationProgress(req.progressDir, req.jobId, p);
     }
 }
+/**
+ * Resolve the effective table list handed to copyDb.
+ *
+ * `'*'` (and an unset request) both mean "all tables". The SQL path can
+ * auto-discover that set, but the PostgREST path cannot (no FK ordering without
+ * an explicit list) and rejects `'*'`. So when the request asks for "all", we
+ * fall back to the configured `[migrate] tables` list — the app's canonical
+ * FK-ordered definition of "all". Only when no config list exists do we pass
+ * `'*'` through (SQL auto-discovers; PostgREST then errors as designed).
+ *
+ * An explicit `string[]` from the request always wins.
+ */
+export function resolveTableList(reqTables, configTables) {
+    if (reqTables && reqTables !== '*')
+        return reqTables;
+    return configTables ?? '*';
+}
 // Resolve the SQLite driver — prefer better-sqlite3 in tests when env var is set
 function getSqliteDriver() {
     if (process.env['HAZO_ENV_TEST_SQLITE_DRIVER'] === 'better-sqlite3')
@@ -192,7 +209,7 @@ export async function runMigration(req) {
             const scrubHook = await buildScrubHook(req.to, scrubMode, tgtAdapter);
             const result = await copyDb(srcAdapter, tgtAdapter, {
                 type: fromDbConfig.type,
-                tables: req.tables ?? migrateConfig.tables,
+                tables: resolveTableList(req.tables, migrateConfig.tables),
                 preserve: migrateConfig.preserve,
                 pkOverrides: migrateConfig.pkOverrides,
                 scrubHook,

package/dist/resolve/envsync.d.ts

@@ -0,0 +1,35 @@
+export interface EnvsyncConfig {
+    /** Postgres database that downloadDb/downloadFiles pull FROM */
+    source_db: string;
+    /** Postgres database that uploadDb drops/recreates/restores INTO */
+    target_db: string;
+    /** Owner passed to createdb -O */
+    owner: string;
+    /** Local files root that downloadFiles tars and uploadFiles overwrites */
+    files_root: string;
+    /** Local scratch dir for dumps/archives + the .envsync.lock file */
+    work_dir: string;
+    /** How many of each file kind (db dump, files archive) to retain */
+    keep: number;
+    /** Shell command run before dropdb/createdb/pg_restore, if configured */
+    pre_restore_cmd?: string;
+    /** Shell command run after a successful pg_restore, if configured */
+    post_restore_cmd?: string;
+    /**
+     * Names guarded by assertNotProd. Defaults to just [source_db]: the
+     * assumption is that the environment this config downloads FROM is the
+     * one that must never be accidentally overwritten by uploadDb/uploadFiles.
+     * (No separate INI knob for this in Phase 1 — not required by spec.)
+     */
+    prodDbNames: string[];
+    /** Every KEY=value pair from [migrate.env_overrides], ${VAR}-expanded */
+    envOverrides: Record<string, string>;
+}
+/**
+ * Resolve the [envsync] section from hazo_env_config.ini.
+ * Returns null when the section is missing, the config file is missing, or
+ * any required field (source_db, target_db, owner, files_root, work_dir) is
+ * absent — mirrors resolveBackupConfig's null-on-missing behavior exactly.
+ */
+export declare function resolveEnvsyncConfig(): EnvsyncConfig | null;
+//# sourceMappingURL=envsync.d.ts.map

package/dist/resolve/envsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envsync.d.ts","sourceRoot":"","sources":["../../src/resolve/envsync.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAuD3D"}

package/dist/resolve/envsync.js

@@ -0,0 +1,77 @@
+// hazo_env/src/resolve/envsync.ts — local envsync (pg_dump/pg_restore/tar) config resolver
+//
+// Reads [envsync] and [migrate.env_overrides] from config/hazo_env_config.ini.
+// Follows the exact null-on-missing pattern of resolve/backup.ts.
+import path from 'node:path';
+import { HazoConfig } from 'hazo_config/server';
+import { resolveFilesConfig } from './files.js';
+const DEFAULT_KEEP = 3;
+function tryLoadEnvConfig() {
+    try {
+        return new HazoConfig({ filePath: path.resolve(process.cwd(), 'config', 'hazo_env_config.ini') });
+    }
+    catch {
+        return null;
+    }
+}
+function expandEnvVars(value, extraVars) {
+    return value.replace(/\$\{([^}]+)\}/g, (_, name) => extraVars[name] ?? process.env[name] ?? '');
+}
+/**
+ * Resolve the [envsync] section from hazo_env_config.ini.
+ * Returns null when the section is missing, the config file is missing, or
+ * any required field (source_db, target_db, owner, files_root, work_dir) is
+ * absent — mirrors resolveBackupConfig's null-on-missing behavior exactly.
+ */
+export function resolveEnvsyncConfig() {
+    const config = tryLoadEnvConfig();
+    if (!config)
+        return null;
+    const section = config.getSection('envsync');
+    if (!section)
+        return null;
+    const source_db_raw = section['source_db'];
+    const target_db_raw = section['target_db'];
+    const owner_raw = section['owner'];
+    const files_root_raw = section['files_root'];
+    const work_dir_raw = section['work_dir'];
+    const keep_raw = section['keep'];
+    const pre_restore_cmd_raw = section['pre_restore_cmd'];
+    const post_restore_cmd_raw = section['post_restore_cmd'];
+    if (!source_db_raw || !target_db_raw || !owner_raw || !files_root_raw || !work_dir_raw)
+        return null;
+    // Resolve DATA_ROOT for ${DATA_ROOT} substitution in files_root, the same
+    // way resolve/connect.ts does for db.<env>.sqlite.database_path.
+    let dataRoot = 'app_data';
+    try {
+        dataRoot = resolveFilesConfig().local.basePath;
+    }
+    catch {
+        // fallback: use relative default
+    }
+    const extraVars = { DATA_ROOT: dataRoot };
+    const source_db = expandEnvVars(source_db_raw, extraVars);
+    const keepParsed = keep_raw ? parseInt(keep_raw, 10) : NaN;
+    const keep = Number.isFinite(keepParsed) && keepParsed > 0 ? keepParsed : DEFAULT_KEEP;
+    const envOverrides = {};
+    const overridesSection = config.getSection('migrate.env_overrides');
+    if (overridesSection) {
+        for (const [key, value] of Object.entries(overridesSection)) {
+            if (typeof value === 'string') {
+                envOverrides[key] = expandEnvVars(value, extraVars);
+            }
+        }
+    }
+    return {
+        source_db,
+        target_db: expandEnvVars(target_db_raw, extraVars),
+        owner: expandEnvVars(owner_raw, extraVars),
+        files_root: expandEnvVars(files_root_raw, extraVars),
+        work_dir: expandEnvVars(work_dir_raw, extraVars),
+        keep,
+        pre_restore_cmd: pre_restore_cmd_raw ? expandEnvVars(pre_restore_cmd_raw, extraVars) : undefined,
+        post_restore_cmd: post_restore_cmd_raw ? expandEnvVars(post_restore_cmd_raw, extraVars) : undefined,
+        prodDbNames: [source_db],
+        envOverrides,
+    };
+}