feat: add cloud-api runtime DB image entrypoints

scripts/src/dev-runtime-migration.test.mjs

@@ -1,5 +1,8 @@
 import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import path from "node:path";
 import test from "node:test";
+import { promisify } from "node:util";
 
 import {
   buildDevRuntimeMigrationReport,
@@ -11,6 +14,9 @@ import {
   CLOUD_RUNTIME_DURABLE_TABLE_COLUMNS
 } from "../../internal/db/schema.mjs";
 
+const execFileAsync = promisify(execFile);
+const repoRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../..");
+
 test("source check is non-secret and does not attempt live DB access", async () => {
   const report = await buildDevRuntimeMigrationReport(parseArgs(["--check"]), {
     env: {
@@ -33,6 +39,48 @@ test("source check is non-secret and does not attempt live DB access", async ()
   assert.equal(JSON.stringify(report).includes("db.example.test"), false);
 });
 
+test("cloud-api image migration entrypoint exposes the same non-secret source check", async () => {
+  const { stdout } = await execFileAsync(
+    process.execPath,
+    ["cmd/hwlab-cloud-api/migrate.mjs", "--check"],
+    {
+      cwd: repoRoot,
+      env: {
+        ...process.env,
+        HWLAB_CLOUD_DB_URL: "postgresql://hwlab:secret-password@db.example.test:5432/hwlab?sslmode=require",
+        HWLAB_CLOUD_DB_SSL_MODE: "disable"
+      }
+    }
+  );
+  const report = JSON.parse(stdout);
+
+  assert.equal(report.conclusion.status, "ready");
+  assert.equal(report.actions.liveDbReadAttempted, false);
+  assert.equal(report.actions.liveDbWriteAttempted, false);
+  assert.equal(report.safety.printsSecretValues, false);
+  assert.equal(report.safety.dbUrlValueRedacted, true);
+  assert.equal(report.migration.id, CLOUD_CORE_MIGRATION_ID);
+  assert.equal(JSON.stringify(report).includes("secret-password"), false);
+  assert.equal(JSON.stringify(report).includes("db.example.test"), false);
+});
+
+test("cloud-api image migration entrypoint redacts invalid DSN-shaped argv failures", async () => {
+  const secretArg = "postgresql://hwlab:secret-password@db.example.test:5432/hwlab?sslmode=require";
+  await assert.rejects(
+    execFileAsync(process.execPath, ["cmd/hwlab-cloud-api/migrate.mjs", secretArg], { cwd: repoRoot }),
+    (error) => {
+      const report = JSON.parse(error.stdout);
+      assert.equal(report.conclusion.status, "blocked");
+      assert.equal(report.error, "unknown argument: [redacted-postgres-url]");
+      assert.match(report.traceId, /^[0-9a-f]{16}$/u);
+      assert.equal(report.safety.secretValuesPrinted, false);
+      assert.equal(JSON.stringify(report).includes("secret-password"), false);
+      assert.equal(JSON.stringify(report).includes("db.example.test"), false);
+      return true;
+    }
+  );
+});
+
 test("apply mode refuses missing DEV confirmation before touching query client", async () => {
   const queryClient = createFakeQueryClient({ migrationReady: false });
   const report = await buildDevRuntimeMigrationReport(parseArgs(["--apply"]), {