Rename / namespace:
- Finish github.com/pocketbase/* → github.com/hanzoai/base (+ /dbx) sweep
across all Go sources; restore the renamed root launcher (Base, base.go).
- Drop the upstream-only surfaces ours doesn't ship (admin ui/, the
password/OTP/oauth2/impersonate auth files, extensions) re-added by the
upstream merge.
- Decomplect the on-disk layout to one base_/ namespace: data/, migrations/,
hooks/, types.d.ts are siblings under base_/ (default data dir
base_/data). Drop the hz_ prefix everywhere; collapse migratecmd's
identical JS/Go branches to one path.
- Remove the accidentally-committed hz_data/ dev dir (db + iam.key) and
gitignore the runtime namespace dirs.
Deps / build:
- kmsclient now imported from the light github.com/hanzoai/kms/sdk/go module
(the root kms module zip exceeds Go's download limit); cloud/pkg/base
Mount removed (lives in the fused daemon).
- replicate v0.4.0 → v0.8.0; metric.Counter.Get() (no prometheus dto);
network/metrics.go import fix; auth gitlab/github tidy.
Tests / behavior:
- Wire registerNotifyWatcherHooks; debounce notify files past the kqueue
rescan window so cross-instance settings/collections reload fires.
- migratecmd: exclude createdAt/updatedAt (not created/updated); regenerate
Go+JS automigration goldens from canonical output.
- Convert the two stale archive red-probes to assert the landed defenses
(backlog cap bounds memory; forged-segment signature is rejected).
IAM-native (Base = pure IAM client):
- Rip the ~1k-line home-grown embedded IAM (iam_embedded*.go) and the
iam-user CLI. Base no longer reinvents identity as _iam_users/_superusers
rows. IAM_ENDPOINT (hanzo.id, or an in-process iam.Embed in the fused
daemon) is required; Base validates IAM JWTs via JWKS only — superuser is
the IAM admin claim, resolved to an ephemeral unpersisted record.
- Extract the IDV reverse-proxy (/v1/idv/*) into idv_proxy.go — it was
mis-colocated in the embedded onboarding file and is independent of IAM.
- Bind the SQL console (/v1/sql) and test it through real IAM JWTs against a
JWKS stub (no hardcoded record tokens, no persisted rows).
zeekay
90db3cd8be