@dooer/dooer-test-env 1.0.0

package/lib/shred/faker.js

@@ -0,0 +1,545 @@
+// faker.js — the JS "fake personal data" pass of the shredder, ported from cli-db-shredder's
+// lib/sql.js `fakePersonalData()`, but DEPENDENCY-FREE and DETERMINISTIC.
+//
+// The original used the npm `faker` package seeded per-row (`faker.seed(pk)`); this reimplements the
+// same idea with a small self-contained PRNG seeded from each row's primary-key hex, plus built-in
+// name/street/city pools. Same pk → identical output; a different pk → different output. No npm deps.
+//
+// Ordering: this pass runs BEFORE the SQL scripts (see index.js) — the SQL `x-`/`xxx-` scripts rebuild
+// denormalized JSON (invoice.frozenCustomerDetails) and truncate history AFTER these base rows are faked.
+//
+// Emails set here → `testcustomer+<pkhex>@dooer.com` (unique per row, matching the copy tool's
+// convention). Protection predicates from the original are preserved verbatim: the `'test-company' =
+// any(tags)` company allow-list and the `@dooer.com/@voitto.se/@steffner.nu` user-email allow-list.
+
+// ── deterministic PRNG (xmur3 seed → mulberry32 stream). Bit ops are intentional (eslint no-bitwise off).
+function xmur3(str) {
+  let h = 1779033703 ^ str.length
+  for (let i = 0; i < str.length; i++) {
+    h = Math.imul(h ^ str.charCodeAt(i), 3432918353)
+    h = (h << 13) | (h >>> 19)
+  }
+  return function next() {
+    h = Math.imul(h ^ (h >>> 16), 2246822507)
+    h = Math.imul(h ^ (h >>> 13), 3266489909)
+    h ^= h >>> 16
+    return h >>> 0
+  }
+}
+
+function mulberry32(a) {
+  return function rand() {
+    a |= 0
+    a = (a + 0x6d2b79f5) | 0
+    let t = Math.imul(a ^ (a >>> 15), 1 | a)
+    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296
+  }
+}
+
+// Seed from the row pk (hyphens stripped so a full uuid is used without float precision loss — the
+// original's parseInt(pk,16) silently lost precision; this keeps the whole key).
+function makeRng(pk) {
+  const seedStr = String(pk == null ? '' : pk)
+    .replace(/-/g, '')
+    .toLowerCase()
+  const seed = xmur3(seedStr || '0')
+  return mulberry32(seed())
+}
+
+// ── small built-in pools ───────────────────────────────────────────────────────
+const FIRST_NAMES = [
+  'Anna',
+  'Erik',
+  'Maria',
+  'Johan',
+  'Karin',
+  'Lars',
+  'Eva',
+  'Anders',
+  'Sara',
+  'Peter',
+  'Emma',
+  'Mikael',
+  'Lena',
+  'Fredrik',
+  'Ingrid',
+  'Nils',
+  'Sofia',
+  'Gustav',
+  'Linnea',
+  'Oskar',
+]
+const LAST_NAMES = [
+  'Andersson',
+  'Johansson',
+  'Karlsson',
+  'Nilsson',
+  'Eriksson',
+  'Larsson',
+  'Olsson',
+  'Persson',
+  'Svensson',
+  'Gustafsson',
+  'Pettersson',
+  'Jonsson',
+  'Jansson',
+  'Hansson',
+  'Bengtsson',
+  'Lindberg',
+]
+const STREETS = [
+  'Storgatan',
+  'Kungsgatan',
+  'Vasagatan',
+  'Drottninggatan',
+  'Nygatan',
+  'Skolgatan',
+  'Parkvägen',
+  'Björkvägen',
+  'Ringvägen',
+  'Industrigatan',
+  'Hamngatan',
+  'Järnvägsgatan',
+  'Södra vägen',
+  'Norra vägen',
+]
+const CITIES = [
+  'Stockholm',
+  'Göteborg',
+  'Malmö',
+  'Uppsala',
+  'Västerås',
+  'Örebro',
+  'Linköping',
+  'Helsingborg',
+  'Jönköping',
+  'Norrköping',
+  'Lund',
+  'Umeå',
+  'Gävle',
+  'Borås',
+  'Södertälje',
+  'Eskilstuna',
+]
+const STATES = [
+  'Stockholms län',
+  'Västra Götalands län',
+  'Skåne län',
+  'Uppsala län',
+  'Östergötlands län',
+  'Hallands län',
+]
+const COUNTRY_CODES = ['SE', 'NO', 'DK', 'FI', 'DE', 'GB', 'NL']
+const COMPANY_HEAD = [
+  'Nordic',
+  'Svea',
+  'Baltic',
+  'Aurora',
+  'Granit',
+  'Fjäll',
+  'Björk',
+  'Lykke',
+  'Vinter',
+  'Sommar',
+  'Vega',
+  'Polaris',
+  'Kompass',
+  'Delta',
+  'Orion',
+  'Tellus',
+]
+const COMPANY_TAIL = ['AB', 'HB', 'Group', 'Konsult AB', 'Handel AB', 'Teknik AB', 'Förvaltning AB']
+const WORDS = [
+  'lorem',
+  'ipsum',
+  'dolor',
+  'consulting',
+  'service',
+  'produkt',
+  'faktura',
+  'leverans',
+  'projekt',
+  'timmar',
+  'material',
+  'frakt',
+  'rådgivning',
+  'underhåll',
+  'support',
+  'licens',
+]
+const ALPHANUM = 'abcdefghijklmnopqrstuvwxyz0123456789'
+
+const randInt = (rng, n) => Math.floor(rng() * n)
+const pick = (rng, arr) => arr[randInt(rng, arr.length)]
+
+function alphaNumeric(rng, n) {
+  let out = ''
+  for (let i = 0; i < n; i++) out += ALPHANUM[randInt(rng, ALPHANUM.length)]
+  return out
+}
+const firstName = (rng) => pick(rng, FIRST_NAMES)
+const lastName = (rng) => pick(rng, LAST_NAMES)
+const companyName = (rng) => `${pick(rng, COMPANY_HEAD)} ${pick(rng, COMPANY_HEAD)} ${pick(rng, COMPANY_TAIL)}`
+const streetAddress = (rng) => `${pick(rng, STREETS)} ${1 + randInt(rng, 200)}`
+const secondaryAddress = (rng) => `Lgh ${1000 + randInt(rng, 2000)}`
+const zipCode = (rng) => String(10000 + randInt(rng, 89999))
+const city = (rng) => pick(rng, CITIES)
+const state = (rng) => pick(rng, STATES)
+const countryCode = (rng) => pick(rng, COUNTRY_CODES)
+const word = (rng) => pick(rng, WORDS)
+const words = (rng) => `${word(rng)} ${word(rng)} ${word(rng)}`
+const lines = (rng) => `${words(rng)}. ${words(rng)}.`
+const url = (rng) => `https://${word(rng)}${randInt(rng, 1000)}.example.com`
+// SE VAT: "SE" + 10 digits org number + "01" sequence suffix
+const vatNumber = (rng) => `SE${String(1000000000 + randInt(rng, 899999999))}01`
+const iban = (rng) => `SE${alphaNumeric(rng, 22).toUpperCase()}`
+const bic = (rng) => `${alphaNumeric(rng, 4).toUpperCase()}SESS`
+const digits = (rng, n) => {
+  let out = ''
+  for (let i = 0; i < n; i++) out += String(randInt(rng, 10))
+  return out
+}
+
+// Rebuild a payment-method-domestic JSON with only the keys the row already had (mirrors the original's
+// `getRandomPaymentMethodDomesticConfiguration(Object.keys(existing))`).
+function paymentMethodDomestic(rng, keys) {
+  const all = {
+    bankgiro: `${digits(rng, 3)}-${digits(rng, 4)}`,
+    plusgiro: `${digits(rng, 6)}-${digits(rng, 1)}`,
+    bankAccountNumber: digits(rng, 10),
+    bankClearingNumber: digits(rng, 4),
+    swish: `073${digits(rng, 7)}`,
+  }
+  const out = {}
+  for (const k of keys || []) if (k in all) out[k] = all[k]
+  return out
+}
+
+// The email set for any row in this pass. Unique per row via the pk hex.
+function fakeEmail(pk) {
+  const hex = String(pk == null ? '' : pk)
+    .replace(/-/g, '')
+    .toLowerCase()
+  return `testcustomer+${hex}@dooer.com`
+}
+
+// ── protection predicates (verbatim intent from the original) ────────────────────
+// Companies flagged internal (a `test-company` tag) are spared.
+const NOT_TEST_COMPANY = (col) =>
+  `${col} NOT IN (SELECT companies_pk FROM service_accounts.companies WHERE 'test-company' = any(tags))`
+// Internal user emails are spared (kept real so dev logins keep working).
+const USER_EMAIL_ALLOWLISTED = (email) =>
+  !!email && (email.endsWith('@dooer.com') || email.endsWith('@voitto.se') || email.endsWith('@steffner.nu'))
+
+// The tables/columns this pass touches — surfaced for the dry-run listing and the audit's covered-set.
+const FAKER_TABLES = [
+  'service_accounts.companies',
+  'service_accounts.users',
+  'service_salaries.salarySpecification',
+  'service_salaries_legacy.salarySpecification',
+  'service_comments.message',
+  'service_customer_questions.question',
+  'service_employees.employee',
+  'service_employees.employeeAddress',
+  'service_employees_legacy.employee',
+  'service_employees_legacy.employeeAddress',
+  'service_billing.companyInformation',
+  'service_billing.customerAddress',
+  'service_billing.customerContact',
+  'service_billing.invoice',
+  'service_billing.customer',
+  'service_billing.item',
+  'service_billing.invoiceLine',
+  'service_core_objects.payments',
+  'service_sales.invoice',
+]
+
+// Best-effort per-statement runner: some legacy schemas/columns may not exist in a given DB. We do NOT
+// want one missing table to abort the whole faker pass, so each statement is tried and failures are
+// collected (mirrors the "collect errors, report which failed" behaviour the runner uses for the SQL
+// scripts). The caller wraps this in a transaction.
+async function tryQuery(client, warnings, label, sql, params) {
+  try {
+    return await client.query(sql, params)
+  } catch (e) {
+    warnings.push(`${label}: ${e.message}`)
+    return { rows: [] }
+  }
+}
+
+// Port of fakePersonalData(): runs a series of deterministic UPDATEs on the given (connected) pg client.
+// Returns { warnings } — non-fatal per-statement failures (e.g. a legacy table absent locally).
+async function fakePersonalData(client, { verbose } = {}) {
+  const warnings = []
+  const q = (label, sql, params) => tryQuery(client, warnings, label, sql, params)
+
+  // companies (+ their salary-spec company denorm), skipping test-companies
+  const companies = await q(
+    'companies:select',
+    `SELECT companies_pk FROM service_accounts.companies WHERE ${NOT_TEST_COMPANY('companies_pk')}`
+  )
+  for (const company of companies.rows) {
+    const rng = makeRng(company.companies_pk)
+    await q(
+      'companies:update',
+      `UPDATE service_accounts.companies
+         SET company_name=$1, address=$2, address2=$3, postal_code=$4, city=$5, short_name=$6
+       WHERE companies_pk=$7`,
+      [
+        companyName(rng),
+        streetAddress(rng),
+        secondaryAddress(rng),
+        zipCode(rng),
+        city(rng),
+        alphaNumeric(rng, 6),
+        company.companies_pk,
+      ]
+    )
+    await q(
+      'salarySpecification:company',
+      `UPDATE service_salaries."salarySpecification"
+         SET "companyName"=$1, "companyStreet"=$2, "companyPostalCode"=$3, "companyCity"=$4
+       WHERE "organizationId"=$5`,
+      [companyName(rng), streetAddress(rng), zipCode(rng), city(rng), company.companies_pk]
+    )
+    await q(
+      'salarySpecification_legacy:company',
+      `UPDATE service_salaries_legacy."salarySpecification" SET "companyName"=$1 WHERE "organizationId"=$2`,
+      [companyName(rng), company.companies_pk]
+    )
+  }
+
+  // users — email/name/phone/address, skipping allow-listed internal emails
+  const users = await q(
+    'users:select',
+    `SELECT users_pk, email, cell_phone, phone, address, address2 FROM service_accounts.users`
+  )
+  for (const user of users.rows) {
+    if (USER_EMAIL_ALLOWLISTED(user.email)) continue
+    const rng = makeRng(user.users_pk)
+    await q(
+      'users:update',
+      `UPDATE service_accounts.users
+         SET email=$2, first_name=$3, last_name=$4, cell_phone=$5, phone=$6, address=$7, address2=$8, postal_code=$9, city=$10
+       WHERE users_pk=$1`,
+      [
+        user.users_pk,
+        user.email ? fakeEmail(user.users_pk) : null,
+        firstName(rng),
+        lastName(rng),
+        user.cell_phone ? '+46000000000' : null,
+        user.phone ? '+46000000000' : null,
+        user.address ? streetAddress(rng) : null,
+        user.address2 ? secondaryAddress(rng) : null,
+        user.address2 ? zipCode(rng) : null,
+        user.address2 ? city(rng) : null,
+      ]
+    )
+  }
+
+  // free-text bodies keyed to non-test companies
+  {
+    const rng = makeRng('service_comments.message')
+    await q(
+      'comments:message',
+      `UPDATE service_comments.message SET body=$1 WHERE ${NOT_TEST_COMPANY('"organizationId"')}`,
+      [lines(rng)]
+    )
+  }
+  {
+    const rng = makeRng('service_customer_questions.question')
+    await q(
+      'customer_questions:answer',
+      `UPDATE service_customer_questions.question SET answer=$1 WHERE ${NOT_TEST_COMPANY('"organizationId"')}`,
+      [lines(rng)]
+    )
+  }
+
+  // employees (current + legacy) — email/name/phone/address + salary-spec employee denorm
+  for (const schema of ['service_employees', 'service_employees_legacy']) {
+    const emps = await q(
+      `${schema}:select`,
+      `SELECT id, phone FROM ${schema}.employee WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+    )
+    for (const emp of emps.rows) {
+      const rng = makeRng(emp.id)
+      const fn = firstName(rng)
+      const ln = lastName(rng)
+      await q(
+        `${schema}:employee`,
+        `UPDATE ${schema}.employee SET email=$1, "firstName"=$2, "lastName"=$3, "phone"=$4 WHERE id=$5`,
+        [fakeEmail(emp.id), fn, ln, emp.phone ? '+46000000000' : null, emp.id]
+      )
+      await q(
+        `${schema}:employeeAddress`,
+        `UPDATE ${schema}."employeeAddress" SET "addressLines"=$1, "postalCode"=$2, "city"=$3, "region"=$4 WHERE "employeeId"=$5`,
+        [[streetAddress(rng)], zipCode(rng), city(rng), null, emp.id]
+      )
+      if (schema === 'service_employees') {
+        await q(
+          'salarySpecification:employee',
+          `UPDATE service_salaries."salarySpecification" SET "employeeName"=$1, "employeeEmail"=$2 WHERE "employeeId"=$3`,
+          [`${fn} ${ln}`, fakeEmail(emp.id), emp.id]
+        )
+      }
+    }
+  }
+
+  // billing.companyInformation — name/vat/address/website/payment configs
+  const compInfos = await q(
+    'companyInformation:select',
+    `SELECT id, "paymentMethodDomesticConfiguration", "paymentMethodInternationalConfiguration"
+       FROM service_billing."companyInformation" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const ci of compInfos.rows) {
+    const rng = makeRng(ci.id)
+    const addressJson = JSON.stringify({
+      city: city(rng),
+      street: [streetAddress(rng)],
+      country: countryCode(rng),
+      zipCode: zipCode(rng),
+    })
+    const domesticKeys = ci.paymentMethodDomesticConfiguration ? Object.keys(ci.paymentMethodDomesticConfiguration) : []
+    const domesticJson = JSON.stringify(paymentMethodDomestic(rng, domesticKeys))
+    const intlEmpty =
+      !ci.paymentMethodInternationalConfiguration ||
+      Object.keys(ci.paymentMethodInternationalConfiguration).length === 0
+    const intlJson = JSON.stringify(intlEmpty ? {} : { iban: iban(rng), bic: bic(rng) })
+    await q(
+      'companyInformation:update',
+      `UPDATE service_billing."companyInformation"
+         SET "companyName"=$1, "vatNumber"=$2, "address"=$3, "website"=$4,
+             "paymentMethodDomesticConfiguration"=$5, "paymentMethodInternationalConfiguration"=$6
+       WHERE id=$7`,
+      [companyName(rng), vatNumber(rng), addressJson, url(rng), domesticJson, intlJson, ci.id]
+    )
+  }
+
+  // billing.customerAddress
+  const custAddrs = await q(
+    'customerAddress:select',
+    `SELECT id FROM service_billing."customerAddress" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const ca of custAddrs.rows) {
+    const rng = makeRng(ca.id)
+    await q(
+      'customerAddress:update',
+      `UPDATE service_billing."customerAddress" SET street=$1, city=$2, "zipCode"=$3, state=$4, country=$5 WHERE id=$6`,
+      [[streetAddress(rng)], city(rng), zipCode(rng), state(rng), countryCode(rng), ca.id]
+    )
+  }
+
+  // billing.customerContact
+  const custContacts = await q(
+    'customerContact:select',
+    `SELECT id FROM service_billing."customerContact" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const cc of custContacts.rows) {
+    const rng = makeRng(cc.id)
+    await q(
+      'customerContact:update',
+      `UPDATE service_billing."customerContact" SET email=$1, "firstName"=$2, "surName"=$3 WHERE id=$4`,
+      [fakeEmail(cc.id), firstName(rng), lastName(rng), cc.id]
+    )
+  }
+
+  // billing.invoice message → blank
+  const billInvoices = await q(
+    'billing.invoice:select',
+    `SELECT id FROM service_billing."invoice" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const inv of billInvoices.rows) {
+    await q('billing.invoice:message', `UPDATE service_billing."invoice" SET message=$1 WHERE id=$2`, ['', inv.id])
+  }
+
+  // billing.customer name/vat
+  const customers = await q(
+    'billing.customer:select',
+    `SELECT id FROM service_billing."customer" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const cust of customers.rows) {
+    const rng = makeRng(cust.id)
+    await q('billing.customer:update', `UPDATE service_billing."customer" SET name=$1, "vatNumber"=$2 WHERE id=$3`, [
+      companyName(rng),
+      vatNumber(rng),
+      cust.id,
+    ])
+  }
+
+  // billing.item description
+  const items = await q(
+    'billing.item:select',
+    `SELECT id FROM service_billing."item" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const item of items.rows) {
+    const rng = makeRng(item.id)
+    await q('billing.item:update', `UPDATE service_billing."item" SET description=$1 WHERE id=$2`, [word(rng), item.id])
+  }
+
+  // billing.invoiceLine freetext description
+  const invLines = await q(
+    'billing.invoiceLine:select',
+    `SELECT id FROM service_billing."invoiceLine" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const line of invLines.rows) {
+    const rng = makeRng(line.id)
+    await q(
+      'billing.invoiceLine:update',
+      `UPDATE service_billing."invoiceLine" SET description=$1 WHERE id=$2 AND type = 'freetext'`,
+      [words(rng), line.id]
+    )
+  }
+
+  // core_objects.payments receiver_name (non-tax, non-test-company)
+  const payments = await q(
+    'payments:select',
+    `SELECT payments_pk, payment_type FROM service_core_objects.payments
+      WHERE payment_type <> 'tax' AND ${NOT_TEST_COMPANY('"fk_companies_pk"')}`
+  )
+  for (const p of payments.rows) {
+    const rng = makeRng(p.payments_pk)
+    const name = p.payment_type === 'vendor-payment' ? companyName(rng) : `${firstName(rng)} ${lastName(rng)}`
+    await q('payments:update', `UPDATE service_core_objects.payments SET receiver_name=$1 WHERE payments_pk=$2`, [
+      name,
+      p.payments_pk,
+    ])
+  }
+
+  // sales.invoice customerName/customerVatNumber (seeded by customerNumber, as the original did)
+  const salesInvoices = await q(
+    'sales.invoice:select',
+    `SELECT id, "customerNumber" FROM service_sales."invoice" WHERE ${NOT_TEST_COMPANY('"organizationId"')}`
+  )
+  for (const inv of salesInvoices.rows) {
+    const rng = makeRng(inv.customerNumber)
+    await q(
+      'sales.invoice:update',
+      `UPDATE service_sales."invoice" SET "customerName"=$1, "customerVatNumber"=$2 WHERE id=$3`,
+      [companyName(rng), vatNumber(rng), inv.id]
+    )
+  }
+
+  if (verbose && warnings.length) {
+    // eslint-disable-next-line no-console
+    console.log(`faker pass: ${warnings.length} non-fatal statement warning(s) (missing tables/cols)`)
+  }
+  return { warnings }
+}
+
+module.exports = {
+  fakePersonalData,
+  FAKER_TABLES,
+  fakeEmail,
+  // exported for unit tests / reuse
+  makeRng,
+  firstName,
+  lastName,
+  companyName,
+  streetAddress,
+  zipCode,
+  city,
+  paymentMethodDomestic,
+  USER_EMAIL_ALLOWLISTED,
+  NOT_TEST_COMPANY,
+}

package/lib/shred/index.js

@@ -0,0 +1,126 @@
+// index.js — the shred runner. Anonymizes PII in a Postgres via two rule layers, in this fixed order:
+//   1. the JS faker pass (faker.js `fakePersonalData`)  — names/addresses/phones/company names, emails →
+//      testcustomer+<pkhex>@dooer.com
+//   2. the vendored per-table SQL scripts (./scripts/*.sql) in FILENAME order — emails, personnummer
+//      (Luhn, dates forced 18xx), phones, passwords, truncations, denormalized-JSON rebuilds (`x-`) and
+//      history truncations (`xxx-`) LAST.
+// Plus the PII audit (audit.js) as the schema-drift backstop.
+//
+// The caller (lib/command/shred.js) owns the localhost guard + the connection; this takes an
+// already-connected `pg` Client. See ENVIRONMENT-PLAN.md §1 (shredder), §5 (base build + Safety), §9.7.
+
+const fs = require('fs')
+const path = require('path')
+const { fakePersonalData, FAKER_TABLES } = require('./faker')
+const { auditPii } = require('./audit')
+
+const SCRIPTS_DIR = path.join(__dirname, 'scripts')
+
+// SQL scripts in filename order (the `x-`/`xxx-` prefixes encode denormalized/history-last ordering).
+function listScripts() {
+  return fs
+    .readdirSync(SCRIPTS_DIR)
+    .filter((f) => /\.sql$/i.test(f))
+    .sort()
+}
+
+// Run one whole .sql file as a single simple-query batch. node-pg's simple query stops at the first
+// erroring statement (same effect as psql ON_ERROR_STOP=1) and rejects — we wrap each script in its own
+// transaction so a failing script rolls back cleanly and the NEXT script still runs (errors collected).
+async function runScript(client, name, { verbose }) {
+  const sql = fs.readFileSync(path.join(SCRIPTS_DIR, name), 'utf8')
+  try {
+    await client.query('BEGIN')
+    await client.query(sql)
+    await client.query('COMMIT')
+    if (verbose) console.log(`  ✅ ${name}`)
+    return { name, ok: true }
+  } catch (e) {
+    try {
+      await client.query('ROLLBACK')
+    } catch (_) {
+      /* ignore rollback failure */
+    }
+    if (verbose) console.log(`  🔴 ${name} — ${e.message}`)
+    return { name, ok: false, error: e.message }
+  }
+}
+
+// shred(pgClient, { execute, verbose })
+//   execute=false (default) → DRY-RUN: lists the faker tables + script order, runs the audit READ-ONLY,
+//                             writes NOTHING.
+//   execute=true            → runs the faker pass then every SQL script (each in its own transaction,
+//                             errors collected not fatal), then the audit. Returns a summary.
+async function shred(pgClient, { execute = false, verbose = false } = {}) {
+  if (!pgClient) throw new Error('shred(pgClient, opts): a connected pg Client is required')
+
+  const scripts = listScripts()
+
+  if (!execute) {
+    console.log('\n=== shred · DRY-RUN (no writes) ===')
+    console.log(`\nfaker pass would touch ${FAKER_TABLES.length} table(s):`)
+    for (const t of FAKER_TABLES) console.log(`  · ${t}`)
+    console.log(`\nSQL scripts would run in this order (${scripts.length}):`)
+    scripts.forEach((s, i) => console.log(`  ${String(i + 1).padStart(2)}. ${s}`))
+
+    const audit = await auditPii(pgClient)
+    printAudit(audit)
+    return { executed: false, faker: { tables: FAKER_TABLES }, scripts, audit }
+  }
+
+  console.log('\n=== shred · EXECUTE ===')
+
+  // 1. faker pass (its own transaction)
+  let faker
+  try {
+    await pgClient.query('BEGIN')
+    faker = await fakePersonalData(pgClient, { verbose })
+    await pgClient.query('COMMIT')
+    if (verbose) console.log('  ✅ faker pass')
+  } catch (e) {
+    try {
+      await pgClient.query('ROLLBACK')
+    } catch (_) {
+      /* ignore */
+    }
+    faker = { warnings: [], error: e.message }
+    console.log(`  🔴 faker pass — ${e.message}`)
+  }
+
+  // 2. SQL scripts, in order, errors collected
+  const results = []
+  for (const name of scripts) {
+    // eslint-disable-next-line no-await-in-loop
+    results.push(await runScript(pgClient, name, { verbose }))
+  }
+
+  const failed = results.filter((r) => !r.ok)
+  console.log(`\nscripts: ${results.length - failed.length}/${results.length} ok`)
+  if (failed.length) {
+    console.log('FAILED scripts (likely schema drift — a rule needs updating vs current schema):')
+    for (const f of failed) console.log(`  🔴 ${f.name} — ${f.error}`)
+  }
+
+  // 3. audit
+  const audit = await auditPii(pgClient)
+  printAudit(audit)
+
+  return { executed: true, faker, scripts: results, failed, audit }
+}
+
+function printAudit(audit) {
+  console.log(`\n=== PII audit ===`)
+  console.log(`covered PII-shaped columns: ${audit.covered} / ${audit.scanned} matched`)
+  if (audit.uncovered.length === 0) {
+    console.log('✅ no uncovered PII-shaped columns')
+  } else {
+    console.log(`🔴 ${audit.uncovered.length} UNCOVERED PII-shaped column(s) — db build MUST fail on these:`)
+    for (const u of audit.uncovered) console.log(`  · [${u.category}] ${u.schema}.${u.table}.${u.column}`)
+  }
+}
+
+module.exports = {
+  shred,
+  listScripts,
+  SCRIPTS_DIR,
+}

package/lib/shred/scripts/base-partner-emails.sql

@@ -0,0 +1,9 @@
+-- Base-build additions (Jimmy 2026-09-01): anonymize partner contact + invite emails that exist in the
+-- customer-free base. Unique per source value (MD5), same convention as emails.sql.
+UPDATE service_accounts.partner
+    SET "contactEmailAddress" = concat('testcustomer+', MD5("contactEmailAddress"), '@dooer.com')
+WHERE "contactEmailAddress" IS NOT NULL AND "contactEmailAddress" <> '';
+
+UPDATE service_accounts."partnerInvite"
+    SET "email" = concat('testcustomer+', MD5("email"), '@dooer.com')
+WHERE "email" IS NOT NULL AND "email" <> '';