@dooer/dooer-test-env 1.0.0

package/lib/obc.js

@@ -0,0 +1,72 @@
+// obc.js — access the base-artifact bucket provisioned by an ObjectBucketClaim (Rook-Ceph). An OBC yields
+// a ConfigMap (BUCKET_NAME/BUCKET_HOST/BUCKET_PORT) and a Secret (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY).
+// In-cluster the Job mounts these as env; a dev `db pull` reads them via kubectl from the OBC's namespace.
+const { execFileSync } = require('child_process')
+const { S3Client, PutObjectCommand, GetObjectCommand, ListObjectsV2Command } = require('@aws-sdk/client-s3')
+
+function sh(file, args) {
+  return execFileSync(file, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).trim()
+}
+
+// resolve OBC connection: prefer env (in-cluster), else kubectl-read the OBC ConfigMap+Secret.
+function obcConfig({ obcName = 'dooer-test-env-base', namespace } = {}) {
+  let bucket = process.env.BUCKET_NAME
+  let host = process.env.BUCKET_HOST
+  let port = process.env.BUCKET_PORT
+  let ak = process.env.AWS_ACCESS_KEY_ID
+  let sk = process.env.AWS_SECRET_ACCESS_KEY
+  if (!(bucket && host && ak && sk)) {
+    if (!namespace) throw new Error('OBC not in env; pass --obc-namespace to read the OBC via kubectl')
+    const cm = JSON.parse(sh('kubectl', ['get', 'configmap', obcName, '-n', namespace, '-o', 'json']))
+    const sec = JSON.parse(sh('kubectl', ['get', 'secret', obcName, '-n', namespace, '-o', 'json']))
+    bucket = cm.data.BUCKET_NAME
+    host = cm.data.BUCKET_HOST
+    port = cm.data.BUCKET_PORT || '80'
+    ak = Buffer.from(sec.data.AWS_ACCESS_KEY_ID, 'base64').toString('utf8')
+    sk = Buffer.from(sec.data.AWS_SECRET_ACCESS_KEY, 'base64').toString('utf8')
+  }
+  // BUCKET_HOST is a k8s service name in-cluster; over VPN a dev resolves it to the rook-ceph ClusterIP
+  let endpoint = `http://${host}:${port || 80}`
+  if (namespace && !process.env.BUCKET_HOST) {
+    const svc = host.split('.')[0]
+    const ip = sh('kubectl', ['get', 'svc', svc, '-n', 'rook-ceph', '-o', 'jsonpath={.spec.clusterIP}'])
+    if (ip) endpoint = `http://${ip}:${port || 80}`
+  }
+  const client = new S3Client({
+    endpoint,
+    region: 'us-east-1',
+    forcePathStyle: true,
+    credentials: { accessKeyId: ak, secretAccessKey: sk },
+  })
+  return { client, bucket }
+}
+
+const PREFIX = 'base/'
+
+async function upload(cfg, file, key) {
+  const fs = require('fs')
+  const Body = fs.readFileSync(file)
+  const Key = key || `${PREFIX}dooer-base-db-${file.replace(/.*dooer-base-db-/, '').replace(/\.dump.*/, '')}.dump`
+  await cfg.client.send(new PutObjectCommand({ Bucket: cfg.bucket, Key, Body }))
+  return Key
+}
+
+async function newestKey(cfg) {
+  const r = await cfg.client.send(new ListObjectsV2Command({ Bucket: cfg.bucket, Prefix: PREFIX }))
+  const items = (r.Contents || [])
+    .filter((o) => o.Key.endsWith('.dump'))
+    .sort((a, b) => new Date(b.LastModified) - new Date(a.LastModified))
+  if (!items.length) throw new Error(`no base artifact under ${cfg.bucket}/${PREFIX}`)
+  return items[0].Key
+}
+
+async function download(cfg, outFile, key) {
+  const fs = require('fs')
+  const Key = key || (await newestKey(cfg))
+  const obj = await cfg.client.send(new GetObjectCommand({ Bucket: cfg.bucket, Key }))
+  const bytes = await obj.Body.transformToByteArray()
+  fs.writeFileSync(outFile, Buffer.from(bytes))
+  return { file: outFile, key: Key }
+}
+
+module.exports = { obcConfig, upload, download, newestKey, PREFIX }

package/lib/registry.js

@@ -0,0 +1,123 @@
+// registry.js — make `docker pull` work for the two private registries WITHOUT any manual steps. The
+// cluster already holds pull secrets (imagePullSecrets); we read them via kubectl, decode the
+// dockerconfigjson, and `docker login` each registry. If kubectl/the secret isn't available we fall back
+// to env vars and, on a TTY, an interactive prompt — so a dev is only ever asked when creds truly can't
+// be found. Used by `setup` and implicitly by `up`.
+const { execFileSync, spawnSync } = require('child_process')
+const readline = require('readline')
+
+// the imagePullSecrets the s-e032 manifests reference
+const PULL_SECRETS = ['aws-ecr-secret', 'push-secret-robo10']
+
+function sh(file, args, opts = {}) {
+  return execFileSync(file, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, ...opts }).trim()
+}
+
+// is the binary on PATH? "ran at all" (no ENOENT), regardless of exit code — `kubectl --version` is an
+// invalid flag but still proves kubectl is installed.
+function have(cmd) {
+  const r = spawnSync(cmd, ['--version'], { encoding: 'utf8' })
+  return !r.error
+}
+
+// { host: { username, password } } parsed from a k8s dockerconfigjson secret (or null if unreadable)
+function authsFromSecret(secretName, namespace) {
+  let b64
+  try {
+    b64 = sh('kubectl', ['get', 'secret', secretName, '-n', namespace, '-o', 'jsonpath={.data.\\.dockerconfigjson}'])
+  } catch (_) {
+    return null
+  }
+  if (!b64) return null
+  let cfg
+  try {
+    cfg = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'))
+  } catch (_) {
+    return null
+  }
+  const out = {}
+  for (const [host, entry] of Object.entries(cfg.auths || {})) {
+    let { username, password } = entry
+    if ((!username || !password) && entry.auth) {
+      const [u, ...p] = Buffer.from(entry.auth, 'base64').toString('utf8').split(':')
+      username = username || u
+      password = password || p.join(':')
+    }
+    if (username && password) out[host] = { username, password }
+  }
+  return out
+}
+
+function dockerLogin(host, username, password) {
+  const r = spawnSync('docker', ['login', host, '-u', username, '--password-stdin'], {
+    input: password,
+    encoding: 'utf8',
+  })
+  return r.status === 0
+}
+
+async function prompt(question, { silent } = {}) {
+  if (!process.stdin.isTTY) return null
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true })
+  const answer = await new Promise((resolve) => {
+    if (silent) {
+      // hide typed characters (password)
+      const onData = () => rl.output.write('\r' + question + '*'.repeat(0))
+      rl._writeToOutput = () => rl.output.write('')
+      rl.question(question, (a) => resolve(a))
+      rl.input.on('data', onData)
+    } else {
+      rl.question(question, (a) => resolve(a))
+    }
+  })
+  rl.close()
+  if (silent) process.stdout.write('\n')
+  return answer.trim()
+}
+
+// Log docker into both private registries. Returns [{host, ok, via}]. `via` = kubectl | env | prompt.
+async function loginAll({ namespace = 'dooer-staging', interactive = true } = {}) {
+  if (!have('docker')) throw new Error('docker is not installed / not on PATH')
+  const results = []
+  const merged = {}
+  for (const s of PULL_SECRETS) {
+    const a = authsFromSecret(s, namespace)
+    if (a) Object.assign(merged, a)
+  }
+  const hosts = Object.keys(merged)
+  if (hosts.length) {
+    for (const host of hosts) {
+      const ok = dockerLogin(host, merged[host].username, merged[host].password)
+      results.push({ host, ok, via: 'kubectl' })
+    }
+    return results
+  }
+  // kubectl/secret unavailable — try env, then prompt
+  const envPairs = [
+    {
+      host: process.env.DOOER_ECR_REGISTRY,
+      user: process.env.DOOER_ECR_USERNAME,
+      pass: process.env.DOOER_ECR_PASSWORD,
+    },
+  ].filter((p) => p.host && p.user && p.pass)
+  if (envPairs.length) {
+    for (const p of envPairs) results.push({ host: p.host, ok: dockerLogin(p.host, p.user, p.pass), via: 'env' })
+    return results
+  }
+  if (interactive && process.stdin.isTTY) {
+    const host = await prompt('Registry host (e.g. …dkr.ecr.eu-west-1.amazonaws.com): ')
+    const user = await prompt('Username: ')
+    const pass = await prompt('Password/token: ', { silent: true })
+    if (host && user && pass) {
+      results.push({ host, ok: dockerLogin(host, user, pass), via: 'prompt' })
+      return results
+    }
+  }
+  throw new Error(
+    'could not obtain registry credentials: kubectl could not read the cluster pull secrets ' +
+      `(${PULL_SECRETS.join(', ')}) in "${namespace}", and no DOOER_ECR_* env vars were set. ` +
+      'Check VPN + kubectl context, or set DOOER_ECR_REGISTRY/USERNAME/PASSWORD.'
+  )
+}
+
+module.exports = { loginAll, authsFromSecret, dockerLogin, have, PULL_SECRETS }

package/lib/runtime.js

@@ -0,0 +1,101 @@
+// runtime.js — shared plumbing for the env/service lifecycle: where generated files + state live, a
+// docker-compose runner, the discovery-router URL, and a tiny JSON state store (local-mode PIDs, deploy
+// overrides). Everything local; nothing here talks to k8s.
+const { spawn, spawnSync } = require('child_process')
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+const RUN_DIR = process.env.DOOER_TEST_ENV_HOME || path.join(os.homedir(), '.dooer-test-env')
+const COMPOSE_FILE = path.join(RUN_DIR, 'docker-compose.yml')
+const OVERRIDE_FILE = path.join(RUN_DIR, 'docker-compose.override.yml')
+const STATE_FILE = path.join(RUN_DIR, 'state.json')
+const REGISTRY_FILE = path.join(RUN_DIR, 'registry.json')
+const ROUTER_URL = process.env.DOOER_TEST_ENV_ROUTER || 'http://localhost:8500'
+const SERVICES_DIR =
+  process.env.DOOER_TEST_ENV_MANIFESTS ||
+  path.join(os.homedir(), 'dooer', 'new-infrastructure', 'kubernetes', 'environments', 's-e032-onprem')
+
+function ensureRunDir() {
+  fs.mkdirSync(RUN_DIR, { recursive: true })
+}
+
+function readState() {
+  try {
+    return JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'))
+  } catch (_) {
+    return { local: {}, deploy: {} }
+  }
+}
+function writeState(s) {
+  ensureRunDir()
+  fs.writeFileSync(STATE_FILE, JSON.stringify(s, null, 2))
+}
+
+// build the argv for docker compose, including the override file when it exists
+function composeArgs(rest) {
+  const files = ['-f', COMPOSE_FILE]
+  if (fs.existsSync(OVERRIDE_FILE)) files.push('-f', OVERRIDE_FILE)
+  return [...files, ...rest]
+}
+
+// run `docker compose …` inheriting stdio (interactive output). Returns exit code. `extraEnv` is merged
+// into the child env — used to feed compose ${VAR} interpolation (e.g. bankid secrets read from the
+// keychain at `up` time, so they never touch the generated yaml or disk).
+function dc(rest, { profile, env: extraEnv } = {}) {
+  const args = composeArgs(rest)
+  const env = { ...process.env, ...extraEnv }
+  if (profile) env.COMPOSE_PROFILES = profile
+  const r = spawnSync('docker', ['compose', ...args], { stdio: 'inherit', env })
+  return r.status == null ? 1 : r.status
+}
+
+// run `docker compose …` capturing stdout (for ps/parse). Returns { status, stdout }.
+function dcCapture(rest, { profile, env: extraEnv } = {}) {
+  const args = composeArgs(rest)
+  const env = { ...process.env, ...extraEnv }
+  if (profile) env.COMPOSE_PROFILES = profile
+  const r = spawnSync('docker', ['compose', ...args], { encoding: 'utf8', env })
+  return { status: r.status, stdout: r.stdout || '', stderr: r.stderr || '' }
+}
+
+// spawn a detached host process (for `service local`), return its pid. Logs to RUN_DIR/<name>.local.log.
+function spawnDetached(name, command, cmdArgs, { cwd, env }) {
+  ensureRunDir()
+  const out = fs.openSync(path.join(RUN_DIR, `${name}.local.log`), 'a')
+  const child = spawn(command, cmdArgs, {
+    cwd,
+    env: { ...process.env, ...env },
+    detached: true,
+    stdio: ['ignore', out, out],
+  })
+  child.unref()
+  return child.pid
+}
+
+function isAlive(pid) {
+  if (!pid) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (_) {
+    return false
+  }
+}
+
+module.exports = {
+  RUN_DIR,
+  COMPOSE_FILE,
+  OVERRIDE_FILE,
+  STATE_FILE,
+  REGISTRY_FILE,
+  ROUTER_URL,
+  SERVICES_DIR,
+  ensureRunDir,
+  readState,
+  writeState,
+  dc,
+  dcCapture,
+  spawnDetached,
+  isAlive,
+}

package/lib/service-token.js

@@ -0,0 +1,40 @@
+// Mint @dooer service tokens for the local env.
+//
+// A service token is an RS256 JWT that @dooer/authentication verifies with { secret: <authPublicKey>,
+// issuer, algorithms:['RS256'] } and whose payload is { type:'service', service_id:<name>, sub:null }
+// (+ iss/iat/exp). Services present it as `Authorization: Bearer <token>` on inter-service calls.
+//
+// Why mint: the `local`/`environment-local` serviceToken baked into every service's config expired in
+// 2019, so falling back to it 401s ("jwt expired"). Rather than edit 58 configs, we sign fresh tokens here
+// with the LOCAL dev private key (the same key service-accounts signs user tokens with, and that every
+// verifier now trusts via DOOER_AUTH_PUBLIC_KEY), giving them a far-future expiry.
+
+const crypto = require('crypto')
+
+const b64url = (buf) => Buffer.from(buf).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/[=]+$/, '')
+
+// Mint one service token. `nowSeconds` is injectable for deterministic tests.
+function mint({
+  serviceId,
+  privateKeyPem,
+  issuer = 'https://example.com/',
+  ttlSeconds = 3650 * 24 * 3600,
+  nowSeconds,
+} = {}) {
+  if (!serviceId) throw new Error('mint: serviceId required')
+  if (!privateKeyPem) throw new Error('mint: privateKeyPem required')
+  const iat = nowSeconds != null ? nowSeconds : Math.floor(Date.now() / 1000)
+  const header = { alg: 'RS256', typ: 'JWT' }
+  const payload = { type: 'service', service_id: serviceId, sub: null, iss: issuer, iat, exp: iat + ttlSeconds }
+  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`
+  const signature = crypto.createSign('RSA-SHA256').update(signingInput).sign(privateKeyPem)
+  return `${signingInput}.${b64url(signature)}`
+}
+
+// Decode a JWT's payload (no verification) — used to report exp in the verify command.
+function decodePayload(token) {
+  const part = token.split('.')[1]
+  return JSON.parse(Buffer.from(part.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'))
+}
+
+module.exports = { mint, decodePayload }

package/lib/shred/README.md

@@ -0,0 +1,118 @@
+# `lib/shred` — the SHRED (anonymization) engine
+
+Anonymizes PII in a **local** Postgres. Ported from the old `cli-db-shredder` (a `.dump`-era snapshot
+shredder), adapted for this CLI: no `psql` subprocess, no AWS/RDS/ZFS, deterministic where feasible,
+emails always anonymized to the repo convention, plus a **PII audit** that is the safety backstop against
+schema drift. See `ENVIRONMENT-PLAN.md` §1 (shredder), §5 (base build + Safety rails), §9.7.
+
+The dev-facing `dooer-test-env shred` command (`lib/command/shred.js`) owns the localhost guard and the
+DB connection; this module takes an already-connected `pg` Client.
+
+```js
+const { shred } = require('./lib/shred')
+await shred(pgClient, { execute: false, verbose: true }) // dry-run: lists + audits, writes nothing
+await shred(pgClient, { execute: true,  verbose: true }) // runs the rules
+```
+
+## What it does & the ordering
+
+Two rule layers run in a **fixed order** (the same order the original enforced via filename prefixes):
+
+1. **JS faker pass** — `faker.js` `fakePersonalData()`. Runs **FIRST**. Rewrites names / addresses /
+   phones / company names and sets emails, across `service_accounts`, `service_employees(_legacy)`,
+   `service_salaries(_legacy)`, `service_billing`, `service_core_objects.payments`, `service_sales`,
+   `service_comments`, `service_customer_questions`. Deterministic per row (see below).
+2. **SQL scripts** — `scripts/*.sql`, run in **filename order**. The `x-` / `xxx-` prefixes keep the
+   denormalized-JSON rebuild and the history truncations **last**:
+   - `dev-accounts.sql` — seeds known dev logins (`johan`, `osm`, … `jma`) + Luhn helper functions.
+   - `emails.sql` — hashes remaining email columns → `testcustomer+MD5(...)@dooer.com` (unique).
+   - `institution-browser.sql`, `notification-targets.sql`, `service-activity-tracker-data.sql`,
+     `service-event-stream.sql`, `service-integrations.sql` — truncate cookies / twilio / trackers /
+     events / integrations.
+   - `partners.sql` — makes `dooer-devteam` the default partner.
+   - `passwords.sql` — every user password → bcrypt of a known dev password; truncates users history.
+   - `personal-numbers.sql` — Luhn-generated personnummer with dates forced to **18xx** (can't collide
+     with a real person), fake org numbers, `users.id_number` emptied, BankID sessions truncated.
+   - `phone-numbers.sql` — `+46555…` phone numbers.
+   - `salary-spec-reports.sql`, `service-core-objects.sql` — rebuild report descriptions / redact
+     report JSON legalName.
+   - `x-service-billing.sql` — rebuilds denormalized `invoice.frozenCustomerDetails` from the
+     (already-faked) customer/contact/companyInfo rows. **Must run after the faker pass** — hence `x-`.
+   - `xxx-history-tables.sql` — truncates the `*_history` tables **last**.
+
+Then the **PII audit** runs (read-only) and its result is returned/printed.
+
+### Email formats
+
+- **Faker pass**: `testcustomer+<pkhex>@dooer.com`, where `<pkhex>` is the row's primary key with
+  hyphens stripped (unique per row).
+- **`emails.sql`**: `testcustomer+<MD5(original)>@dooer.com` (the original kept `MD5(...)` for
+  uniqueness; only the domain `@d-e023.com`→`@dooer.com` and prefix `redacted+`→`testcustomer+` changed).
+
+### Determinism
+
+The faker pass uses a **dependency-free** seeded PRNG (`xmur3` → `mulberry32`) seeded from each row's pk
+hex — same pk ⇒ identical output, different pk ⇒ different. No `faker` npm dep. (The original used
+`faker.seed(parseInt(pk,16))`, which lost precision on full uuids; this hashes the whole key.)
+The SQL scripts still use `random()` for personnummer/phones (ported verbatim, non-deterministic) — the
+ENVIRONMENT-PLAN §10 note about converting those to hash-based generation is a follow-up, not done here.
+
+### Protection predicates (preserved from the original)
+
+- Companies tagged internal are spared: `'test-company' = any(tags)`.
+- Internal user emails are spared (kept real so dev logins work): `@dooer.com` / `@voitto.se` /
+  `@steffner.nu` (and `@example.com` in the personnummer allow-list).
+
+## The PII audit (`audit.js`)
+
+`auditPii(pgClient)` scans `information_schema.columns` in the `service_*` schemas (excluding
+`*_history`) for **PII-shaped column names**:
+
+| category | matches |
+|---|---|
+| email | column name contains `email` |
+| personnummer | `personal_number`, `id_number`, or contains `personnummer` (incl. `sePersonnummer`) |
+| phone | column name contains `phone` (incl. `cell_phone`, `cellPhone`) |
+
+Each match is cross-checked against an **explicit covered-set** (`COVERED_COLUMNS` in `audit.js`) — the
+email/personnummer/phone columns the vendored rules actually touch. Anything matched but **not** in the
+covered-set is returned as `uncovered`:
+
+```
+auditPii(pgClient) → { uncovered: [{schema,table,column,category}], covered: N, scanned: M }
+```
+
+`shred` prints this. The Phase-1 **`db build` MUST fail** when `uncovered` is non-empty (ENVIRONMENT-PLAN
+§5 step 4). Dev-facing `shred` only reports it.
+
+### Covered columns (email / personnummer / phone)
+
+Emails: `service_accounts.users.email`, `.contactEmail`; `service_accounts.incoming_email_whitelists.email`;
+`service_accounts.invites.email`; `service_employees.employee.email`;
+`service_employees_legacy.employee.email`; `service_billing.customerContact.email`;
+`service_billing.companyInformation.email`; `service_outgoing_email.email.toEmail`;
+`service_invoices.invoice.companyEmail`, `.billingEmail`; `service_orders.contact.email`;
+`service_salaries.salarySpecification.employeeEmail`.
+Personnummer: `service_employees.employee.sePersonnummer`;
+`service_employees_legacy.employee.sePersonnummer`; `service_accounts.users.id_number`.
+Phone: `service_accounts.users.phone`, `.cell_phone`; `service_employees.employee.phone`;
+`service_employees_legacy.employee.phone`; `service_orders.contact.phone`;
+`service_billing.companyInformation.phone`; `service_billing.customerContact.cellPhone`.
+
+(The faker pass also rewrites many name/address columns; the audit only tracks the three PII-shaped
+name categories above — names/addresses aren't reliably detectable by column name.)
+
+## KNOWN caveat — vendored rules can be stale vs the current schema
+
+The SQL scripts and the covered-set were captured from a point-in-time schema. A **renamed/dropped
+column** makes the owning script fail; a **new service or column** is not shredded until a rule is added.
+Two things catch this:
+
+1. Each SQL script runs in its **own transaction** and errors are **collected, not fatal** — the runner
+   reports exactly which scripts failed (schema drift) and continues, rather than aborting silently.
+2. The **PII audit** flags any PII-shaped column not in the covered-set — the automated replacement for
+   the old "each team adds its own `.sql`" gap. When it flags something: add the column to the relevant
+   SQL script / faker block **and** to `COVERED_COLUMNS`.
+
+The faker pass is also best-effort per statement (a missing legacy table is a collected warning, not a
+crash), for the same drift-tolerance reason.

package/lib/shred/audit.js

@@ -0,0 +1,128 @@
+// audit.js — the PII audit that is the safety backstop against schema drift / uncovered columns.
+//
+// The old shredder's coverage was opt-in (each team added its own .sql), so a NEW service or a renamed
+// column could silently leak PII. This scans `information_schema.columns` for email / personnummer /
+// phone-shaped column names in the live `service_*` schemas (excluding `*_history`) and cross-checks them
+// against the explicit set of columns the vendored rules (SQL scripts + faker.js) actually touch. Any
+// PII-shaped column NOT in the covered set is returned as `uncovered` — `db build` FAILS the build if
+// that list is non-empty (ENVIRONMENT-PLAN.md §5 step 4 / §10).
+
+// ── PII-shaped column-name matchers ──────────────────────────────────────────────
+// email:        any column whose name contains "email"    (email, toEmail, companyEmail, contactEmail…)
+// personnummer: personal_number / id_number / anything containing "personnummer" (incl. sePersonnummer)
+// phone:        any column whose name contains "phone"     (phone, cell_phone, cellPhone…)
+// Exclude name shapes that CONTAIN email/phone but are NOT an address/number: ids/refs (…Id, …_pk,
+// …MessageID), flags (email_verified), settings (…ViaEmail/…ByEmail), and non-value text (…Name,
+// …Signature, emailService/…ServiceId). These caused false positives in the base audit.
+const NOT_A_VALUE = /(_pk|id|messageid|verified|service|serviceid|name|signature|viaemail|byemail)$/i
+const MATCHERS = [
+  { category: 'email', test: (name) => /email/i.test(name) && !NOT_A_VALUE.test(name) },
+  {
+    category: 'personnummer',
+    test: (name) => /personnummer/i.test(name) || /^(personal_number|id_number)$/i.test(name),
+  },
+  { category: 'phone', test: (name) => /phone/i.test(name) && !NOT_A_VALUE.test(name) },
+]
+
+function matchCategory(columnName) {
+  for (const m of MATCHERS) if (m.test(columnName)) return m.category
+  return null
+}
+
+// ── explicit covered-set: every email/personnummer/phone-shaped column the vendored rules touch ──────
+// Keyed "schema.table.column" (compared case-insensitively). Kept explicit (not parsed from the SQL) so
+// it is auditable and stable; the README lists these and the KNOWN caveat that they can drift vs schema.
+const COVERED_COLUMNS = [
+  // emails — faker.js pass
+  'service_accounts.users.email',
+  'service_employees.employee.email',
+  'service_employees_legacy.employee.email',
+  'service_billing.customerContact.email',
+  // emails — SQL scripts (emails.sql)
+  'service_accounts.users.contactEmail',
+  'service_accounts.incoming_email_whitelists.email',
+  'service_accounts.invites.email',
+  'service_outgoing_email.email.toEmail',
+  'service_invoices.invoice.companyEmail',
+  'service_invoices.invoice.billingEmail',
+  'service_orders.contact.email',
+  'service_billing.companyInformation.email',
+  'service_salaries.salarySpecification.employeeEmail',
+  // personnummer — personal-numbers.sql (+ users.id_number emptied there)
+  'service_employees.employee.sePersonnummer',
+  'service_employees_legacy.employee.sePersonnummer',
+  'service_accounts.users.id_number',
+  // phones — faker.js pass + phone-numbers.sql
+  'service_accounts.users.phone',
+  'service_accounts.users.cell_phone',
+  'service_employees.employee.phone',
+  'service_employees_legacy.employee.phone',
+  'service_orders.contact.phone',
+  'service_billing.companyInformation.phone',
+  'service_billing.customerContact.cellPhone',
+  // base-build additions — anonymized by base-partner-emails.sql
+  'service_accounts.partner.contactEmailAddress',
+  'service_accounts.partnerInvite.email',
+  // base-build ACCEPTED (Jimmy 2026-09-01): dooer-internal / reference, not customer PII — left as-is
+  'service_orders.consultant.email',
+  'service_orders.consultant.phone',
+  'service_suppliers.scamSupplier.phoneNumber',
+  'service_voice.redirection.phoneNumber',
+  'service_voice.switchboard.phoneNumber',
+  'service_voice.userPhoneNumber.phoneNumber',
+  'service_voice.userPhoneNumber.redirectPhoneNumber',
+  'service_voice.userPhoneNumber.voipPhoneNumber',
+].map((s) => s.toLowerCase())
+
+const COVERED_SET = new Set(COVERED_COLUMNS)
+
+const isCovered = (schema, table, column) => COVERED_SET.has(`${schema}.${table}.${column}`.toLowerCase())
+
+// Scan the live DB for PII-shaped columns not covered by a rule.
+// Returns { uncovered: [{schema,table,column,category}], covered: N, scanned: M }.
+async function auditPii(client) {
+  const res = await client.query(
+    `SELECT table_schema AS schema, table_name AS table, column_name AS column
+       FROM information_schema.columns
+      WHERE table_schema LIKE 'service\\_%'
+        AND table_schema NOT LIKE '%\\_history'
+      ORDER BY table_schema, table_name, column_name`
+  )
+
+  const q = (s) => `"${String(s).replace(/"/g, '""')}"`
+  const uncovered = []
+  let covered = 0
+  let scanned = 0
+  for (const row of res.rows) {
+    const category = matchCategory(row.column)
+    if (!category) continue
+    scanned++
+    if (isCovered(row.schema, row.table, row.column)) {
+      covered++
+      continue
+    }
+    // DATA-AWARE: only flag an uncovered column that actually HOLDS data. In the base (no organizations)
+    // most PII-shaped columns live in empty org tables (schema present, 0 rows) — those are not a leak.
+    let hasData = true
+    try {
+      const r = await client.query(
+        `SELECT 1 FROM ${q(row.schema)}.${q(row.table)} WHERE ${q(row.column)} IS NOT NULL AND ${q(
+          row.column
+        )}::text <> '' LIMIT 1`
+      )
+      hasData = r.rowCount > 0
+    } catch (_) {
+      hasData = true // if we can't check, be conservative and flag it
+    }
+    if (hasData) uncovered.push({ schema: row.schema, table: row.table, column: row.column, category })
+  }
+  return { uncovered, covered, scanned }
+}
+
+module.exports = {
+  auditPii,
+  matchCategory,
+  isCovered,
+  COVERED_COLUMNS,
+  MATCHERS,
+}