@dooer/dooer-test-env 1.0.0

package/lib/engine/gen-schema-map.js

@@ -0,0 +1,479 @@
+#!/usr/bin/env node
+/*
+ * gen-schema-map.js — build schema-map.json from the read-only measurement TSVs in _measure/.
+ *
+ * Philosophy (Jimmy, 2026-08-24): START FROM ALL 297 org-scoped tables and COPY by default; a table
+ * is only `ignore` when there is a specific, stated reason AND we know it will not affect AI-booking
+ * tests. Every table is present in the map in structured form so a decision can be flipped by editing
+ * one `action` field — nothing is silently dropped.
+ *
+ * Run:  node gen-schema-map.js   (writes ./schema-map.json)
+ * Re-measure the inputs with the queries documented in PROCESS.md.
+ */
+const fs = require('fs')
+const path = require('path')
+const M = path.join(__dirname, '..', '..', '_measure')
+
+const readTsv = (f) =>
+  fs
+    .readFileSync(path.join(M, f), 'utf8')
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+
+// ── measurement inputs ───────────────────────────────────────────────────────
+// m2: schema|table|orgColumn  (one row per org-fk column; a table may appear several times)
+const orgCols = readTsv('m2.org-fk-columns.tsv').map((l) => l.split('|'))
+// m3: schema|table|pkColumn|pkType  (PKs for every table in an org schema — over-inclusive)
+const pkRows = readTsv('m3.pk-types.tsv').map((l) => l.split('|'))
+// m5b: schema|table|emailColumn  (email columns inside the copy set)
+const emailRows = readTsv('m5b.email-in-copyset.tsv').map((l) => l.split('|'))
+// m11: schema|table|column|typname|sequenceName  (every single-column-unique column)
+const uniqueRows = readTsv('m11.unique-columns.tsv').map((l) => l.split('|'))
+// m4: child|childCol|=>|parent|parentCol  (FK graph among org schemas)
+const stripQ = (s) => s.replace(/"/g, '')
+const fkEdges = readTsv('m4.fk-graph.tsv').map((l) => {
+  const [child, childCol, , parent, parentCol] = l.split('|')
+  return { child: stripQ(child), childCol, parent: stripQ(parent), parentCol }
+})
+// m5: ALL email columns in the org schemas (broader than m5b, so orphan tables get scrubbed too)
+const emailAll = readTsv('m5.email-columns.tsv').map((l) => l.split('|'))
+// m13: the COMPLETE FK graph (child|childCol|parent|parentCol) — used to compute the orphan closure
+// TRANSITIVELY (below). Supersedes the old static m14.orphan-fk.json, which only captured ONE level and
+// so missed children-of-orphans like document_files_converted (the page images). (fix 2026-08-27)
+const allFk = readTsv('m13.all-fk.tsv').map((l) => {
+  const [child, childCol, parent, parentCol] = l.split('|')
+  return { child: stripQ(child), childCol: stripQ(childCol), parent: stripQ(parent), parentCol: stripQ(parentCol) }
+})
+// m7: schema.table present on staging but NOT production (schema drift — skip if absent either side)
+const stagingOnly = new Set(readTsv('m7.copyset-missing-in-prod.txt'))
+// m15: uuid columns that REFERENCE service_accounts.users (soft refs by name pattern + declared FKs).
+// Copied rows point at users that may not exist in the target namespace (a cross-namespace copy), which
+// breaks resolvers like `createdByUser`. We collect the ids in these columns, copy the referenced users
+// that are missing from the target, and remap the refs. (Jimmy 2026-08-27)
+const userRefRows = readTsv('m15.user-ref-columns.tsv').map((l) => l.split('|'))
+
+// ── column-role vocabulary ───────────────────────────────────────────────────
+// OWNER = holds the org's OWN id → used to FILTER rows and remapped source→target.
+const OWNER = new Set([
+  'organizationId',
+  'company_id',
+  'organization_id',
+  'companyId',
+  'fk_companies_pk',
+  'companies_pk', // the org's own PK on service_accounts.companies
+  'taskOrganizationId', // scheduledTask: the task's owning org
+  'customerOrganizationId', // voice.call: the call's owning (customer) org
+])
+// CROSS-ORG = points at ANOTHER org → left as-is (UUID-rewrite only rewrites it if it equals source).
+const CROSS_ORG = new Set([
+  'partnerOrganizationId',
+  'parent_company_id',
+  'child_company_id',
+  'organizationInstitutionId',
+])
+// NON-ORG = matched the regex but is a type/role/junction ref, not an org id → not a filter column.
+const roleOf = (c) => (OWNER.has(c) ? 'owner' : CROSS_ORG.has(c) ? 'crossOrg' : 'nonOrg')
+// owner-filter priority when a table carries several owner columns
+const OWNER_PRIORITY = [
+  'organizationId',
+  'company_id',
+  'organization_id',
+  'companyId',
+  'fk_companies_pk',
+  'companies_pk',
+  'taskOrganizationId',
+  'customerOrganizationId',
+]
+
+// ── ignore rules (each with a stated reason; everything else copies) ─────────
+const IGNORE_SCHEMA = {
+  service_institution_browser:
+    'Excluded by Dennis/Jimmy: bank-scraping/institution data, security-sensitive, irrelevant to AI booking.',
+}
+// identity / user / auth tables — target account + its owners are kept as-is (rule #4: never create or
+// copy users). The source org id is remapped onto the EXISTING target org id instead.
+const IGNORE_TABLE = {
+  'service_accounts.companies': 'Org identity row already exists in the target; keep it, remap org id.',
+  'service_accounts.companies2users': 'Owner/user links — rule #4: keep the target account owners, do not copy users.',
+  'service_accounts.user_roles_at_companies': 'User role assignments — user data, kept as-is on target.',
+  'service_accounts.user_roles_at_companies_privileges': 'User role privileges — user data, kept as-is on target.',
+  'service_accounts.user_privileges': 'Per-user privileges — user data, kept as-is on target.',
+  'service_accounts.invites': 'User invites — user/onboarding data, not part of accounting state.',
+  'service_accounts.signup': 'Signup/onboarding user data.',
+  'service_accounts.signupConnectAccount': 'Signup/onboarding user data.',
+  'service_accounts.tokenInvalidation': 'Auth token state — security, user-specific.',
+  'service_accounts.bankIdSession': 'BankID auth sessions — security, user-specific, transient.',
+  'service_outgoing_email.email':
+    'Outbound email queue — avoid any send from a test org; historical, not accounting state.',
+  'service_search.searchIndex':
+    'Derived/rebuildable full-text search index; its composite (entityType, entityId) unique would collide in a same-DB copy and it rebuilds itself from the copied source data. (Jimmy 2026-08-24)',
+  'service_documents.duplicateInfo':
+    'Derived/rebuildable duplicate-detection metadata; a CHECK constraint (documentIds_ordered: documentId1<documentId2) is broken when both uuids are remapped and their order flips. Rebuilt by the dedup pass. (2026-08-26)',
+}
+// Per-table EXTRA filter (SQL fragment ANDed onto the org filter; may use $1 = the source org id).
+// Restricts a big table to rows tied to an ACTIVE task (not fulfilled/rejected) — both these tables
+// carry a `taskId` FK to service_task_engine.task, so no join table is needed. (Jimmy 2026-08-26)
+const ACTIVE_TASK = `"taskId" IN (SELECT id FROM service_task_engine.task WHERE "organizationId"=$1 AND status NOT IN ('fulfilled','rejected'))`
+const EXTRA_FILTER = {
+  'service_accounting_checks.check': ACTIVE_TASK,
+  'service_task_engine.taskEventAction': ACTIVE_TASK,
+}
+// advisory only (still action=copy): tables you may additionally want to drop later. Flip action to
+// "ignore" to exclude — left in so the default is inclusive per the start-from-all principle.
+const IGNORE_CANDIDATES = [
+  'service_notifications.notification',
+  'service_activity_log.userActivity',
+  'service_activity_log.groupedUserActivity',
+  'service_activity_log.groupedUserActivityLogLink',
+  'service_activity_tracker_data.trackedEvent',
+  'service_activity_tracker_data.salesActivity',
+]
+
+// REVERSE-reference parents: tables with NO org column that are REFERENCED BY a copied table and must
+// themselves be copied (fresh rows) rather than shared. `fileData` is the S3-blob metadata row (S3
+// key = its id); we copy it with a new id and physically copy the S3 object to the new key, so the
+// copy owns its own files (no sharing → no cross-account delete risk). (Jimmy 2026-08-26)
+const REVERSE_REF = [
+  {
+    key: 'service_file_storage.fileData',
+    schema: 'service_file_storage',
+    table: 'fileData',
+    fkFilter: {
+      column: 'id',
+      parentSchema: 'service_file_storage',
+      parentTable: 'fileEntry',
+      parentColumn: 'fileDataId',
+      parentOrgColumn: 'organizationId',
+    },
+    s3Blob: true, // its id is an S3 object key → the S3 copy phase moves the object to the new id
+  },
+]
+
+// ── transitive orphan closure ────────────────────────────────────────────────
+// An "orphan" is a table with no owner (org) column. It is copyable iff a chain of FKs reaches an
+// org-rooted table. A ONE-level orphan (document_files → documents) terminates at `parentOrgColumn`; a
+// MULTI-level orphan (document_files_converted → document_files → documents) nests a `parentFilter` so
+// the whole chain roots at an org-scoped ancestor. We only route through parents that are themselves
+// copyable (rooted-and-not-ignored, or an already-resolved orphan) so no copied row dangles.
+const splitKey = (k) => {
+  const d = k.indexOf('.')
+  return [k.slice(0, d), k.slice(d + 1)]
+}
+const isIgnoredKey = (key) => {
+  const [schema, table] = splitKey(key)
+  return !!IGNORE_SCHEMA[schema] || !!IGNORE_TABLE[key] || /__history$/.test(table) || /_history$/.test(schema)
+}
+// owner filter column per table (same rule as the per-table build below), computed up-front
+const ownerColOf = {}
+{
+  const ownersByKey = {}
+  for (const [schema, table, column] of orgCols) {
+    if (roleOf(column) !== 'owner') continue
+    const key = `${schema}.${table}`
+    ;(ownersByKey[key] = ownersByKey[key] || []).push(column)
+  }
+  for (const key of Object.keys(ownersByKey)) {
+    ownerColOf[key] = OWNER_PRIORITY.find((p) => ownersByKey[key].includes(p)) || ownersByKey[key][0]
+  }
+}
+const copyable = new Set() // rooted (owner column) and not ignored — the closure seed
+for (const key of Object.keys(ownerColOf)) if (!isIgnoredKey(key)) copyable.add(key)
+const computedOrphanFks = {} // key → fkFilter (possibly nested via parentFilter)
+let grew = true
+while (grew) {
+  grew = false
+  for (const e of allFk) {
+    if (copyable.has(e.child) || isIgnoredKey(e.child)) continue
+    if (!copyable.has(e.parent)) continue
+    const [ps, pt] = splitKey(e.parent)
+    const base = { column: e.childCol, parentSchema: ps, parentTable: pt, parentColumn: e.parentCol }
+    if (ownerColOf[e.parent]) computedOrphanFks[e.child] = { ...base, parentOrgColumn: ownerColOf[e.parent] }
+    else if (computedOrphanFks[e.parent])
+      computedOrphanFks[e.child] = { ...base, parentFilter: computedOrphanFks[e.parent] }
+    else continue // parent copyable via a special handler but exposes no filter to nest — try another edge
+    copyable.add(e.child)
+    grew = true
+  }
+}
+
+// ── build per-table records ──────────────────────────────────────────────────
+const tables = {}
+for (const [schema, table, column] of orgCols) {
+  const key = `${schema}.${table}`
+  if (!tables[key]) tables[key] = { schema, table, orgColumns: [], emailColumns: [] }
+  tables[key].orgColumns.push({ column, role: roleOf(column) })
+}
+// orphan child tables (no org column): copied by filtering a FK chain into a copied parent (transitive
+// closure above; nested `parentFilter` for children-of-orphans)
+for (const childKey of Object.keys(computedOrphanFks)) {
+  const [schema, table] = splitKey(childKey)
+  if (!tables[childKey])
+    tables[childKey] = { schema, table, orgColumns: [], emailColumns: [], fkFilter: computedOrphanFks[childKey] }
+}
+// reverse-reference parents (fileData): copied via a FK from a copied child
+for (const r of REVERSE_REF) {
+  if (!tables[r.key])
+    tables[r.key] = {
+      schema: r.schema,
+      table: r.table,
+      orgColumns: [],
+      emailColumns: [],
+      fkFilter: r.fkFilter,
+      s3Blob: r.s3Blob,
+    }
+}
+// attach PK (single-column only; composite/none → pk:null, copied as a leaf with UUID-rewrite)
+const pkByTable = {}
+for (const [schema, table, col, type] of pkRows) {
+  const key = `${schema}.${table}`
+  if (!pkByTable[key]) pkByTable[key] = []
+  pkByTable[key].push({ column: col, type })
+}
+// only scrub columns that actually hold an email ADDRESS — never a PK or an *Id/*MessageID column
+// (scrubbing a key to a constant would collide/corrupt).
+const looksLikeAddress = (c) => /email/i.test(c) && !/(_pk$|id$|messageid$)/i.test(c)
+for (const [schema, table, col] of emailAll) {
+  const key = `${schema}.${table}`
+  if (tables[key] && looksLikeAddress(col)) tables[key].emailColumns.push(col)
+}
+
+const out = []
+for (const key of Object.keys(tables).sort()) {
+  const t = tables[key]
+  const pks = pkByTable[key] || []
+  const pk = pks.length === 1 ? pks[0] : null // composite/none → null
+  // owner filter column
+  const owners = t.orgColumns.filter((c) => c.role === 'owner').map((c) => c.column)
+  const filterColumn = OWNER_PRIORITY.find((p) => owners.includes(p)) || owners[0] || null
+  // company_relation has only parent/child cross-org cols — special (match either side)
+  const special = []
+  if (key === 'service_core_objects.transactions')
+    special.push('integerPkRemap: transactions_pk (int) needs old→new remap kept consistent with the *_uuid twin')
+  if (key === 'service_authorization.company_relation')
+    special.push(
+      'crossOrgRelation: copy rows where parent_company_id OR child_company_id = source; remap the matching side'
+    )
+
+  // decision
+  let action = 'copy'
+  let ignoreReason = null
+  if (IGNORE_SCHEMA[t.schema]) {
+    action = 'ignore'
+    ignoreReason = IGNORE_SCHEMA[t.schema]
+  } else if (IGNORE_TABLE[key]) {
+    action = 'ignore'
+    ignoreReason = IGNORE_TABLE[key]
+  } else if (/__history$/.test(t.table) || /_history$/.test(t.schema)) {
+    // audit/history mirror tables (a `_history` schema, or a `__history` table) — not source-of-truth
+    // state, rebuilt by the history triggers, and large/slow to copy. (Jimmy 2026-08-26)
+    action = 'ignore'
+    ignoreReason =
+      'Audit/history mirror — not source-of-truth state, regenerated by history triggers, large/slow to copy.'
+  } else if (!filterColumn && !t.fkFilter && special.length === 0) {
+    // safe default: no owner-filter column, no FK filter, no special handler → cannot determine which
+    // rows belong to the org, so do NOT copy. Review manually to opt in.
+    action = 'ignore'
+    ignoreReason =
+      'No owner-filter column found (only ' +
+      t.orgColumns.map((c) => `${c.column}:${c.role}`).join(', ') +
+      ') — cannot scope rows to the org. Review before enabling.'
+  }
+
+  out.push({
+    key,
+    schema: t.schema,
+    table: t.table,
+    action,
+    ...(ignoreReason ? { ignoreReason } : {}),
+    ...(IGNORE_CANDIDATES.includes(key) ? { ignoreCandidate: true } : {}),
+    ...(EXTRA_FILTER[key] ? { extraFilter: EXTRA_FILTER[key] } : {}),
+    ...(t.fkFilter ? { fkFilter: t.fkFilter } : {}),
+    ...(t.s3Blob ? { s3Blob: true } : {}),
+    presentInProdAndStaging: !stagingOnly.has(key),
+    filterColumn,
+    orgColumns: t.orgColumns,
+    pk: pk ? { column: pk.column, type: pk.type } : null,
+    emailColumns: t.emailColumns,
+    ...(special.length ? { special } : {}),
+  })
+}
+
+// ── uniqueness strategies (per-column, config-driven; the script hardcodes NOTHING) ──────────────
+// Every single-column-unique column needs a strategy so a copy never collides on it. uuids remap
+// (value carries no meaning); sequence-backed ints draw nextval; app-assigned unique ints get a fresh
+// value above the target's max; unique text keys get a suffix; edit any column's `strategy` to change it.
+const copySet = new Set(out.filter((t) => t.action === 'copy').map((t) => t.key))
+const DEFAULT_BY_TYPE = {
+  uuid: 'remap-uuid',
+  int4: 'max-offset',
+  int8: 'max-offset',
+  integer: 'max-offset',
+  bigint: 'max-offset',
+  int2: 'max-offset',
+  text: 'text-suffix',
+  varchar: 'text-suffix',
+  'character varying': 'text-suffix',
+  bpchar: 'text-suffix',
+}
+const refsFor = (schema, table, column) =>
+  fkEdges
+    .filter((e) => e.parent === `${schema}.${table}` && e.parentCol === column)
+    .map((e) => {
+      const dot = e.child.indexOf('.')
+      return { schema: e.child.slice(0, dot), table: e.child.slice(dot + 1), column: e.childCol }
+    })
+const uniqueColumns = []
+for (const [schema, table, column, typ, seq] of uniqueRows) {
+  const key = `${schema}.${table}`
+  if (!copySet.has(key)) continue
+  if (typ === 'uuid') {
+    uniqueColumns.push({ key: `${key}.${column}`, schema, table, column, type: 'uuid', strategy: 'remap-uuid' })
+    continue
+  }
+  const strategy = seq ? 'sequence' : DEFAULT_BY_TYPE[typ] || 'text-suffix'
+  const references = refsFor(schema, table, column)
+  uniqueColumns.push({
+    key: `${key}.${column}`,
+    schema,
+    table,
+    column,
+    type: typ,
+    strategy,
+    ...(seq ? { sequenceName: seq } : {}),
+    references,
+  })
+}
+// Composite-UNIQUE dedup-key members that would collide in a same-DB copy (no org column, no remapped
+// uuid in the constraint). They are dedup/idempotency keys, not FKs. Strategy depends on the column
+// TYPE (measured 2026-08-26): a uuid key must be DERIVED to a fresh uuid (a text suffix would make it
+// an invalid uuid); a text key gets a suffix. Edit `type`/`strategy` to change.
+const COMPOSITE_KEYS = [
+  {
+    schema: 'service_task_engine',
+    table: 'task',
+    column: 'uniquenessKey',
+    type: 'text',
+    note: '(type, uniquenessKey)',
+  },
+  {
+    schema: 'service_customer_questions',
+    table: 'dynamicQuestion',
+    column: 'uniquenessKey',
+    type: 'uuid',
+    note: '(typePrefix, type, uniquenessKey)',
+  },
+  {
+    schema: 'service_customer_questions',
+    table: 'scheduledDynamicQuestion',
+    column: 'uniquenessKey',
+    type: 'uuid',
+    note: '(type, uniquenessKey)',
+  },
+  {
+    schema: 'service_checks_engine',
+    table: 'checkFinding',
+    column: 'dedupeKey',
+    type: 'text',
+    note: '(checkKey, dedupeKey)',
+  },
+  {
+    schema: 'service_business_entities',
+    table: 'entity',
+    column: 'externalId',
+    type: 'text',
+    note: '(externalType, externalId)',
+  },
+]
+for (const c of COMPOSITE_KEYS) {
+  const key = `${c.schema}.${c.table}`
+  if (!copySet.has(key)) continue
+  if (c.type === 'uuid') {
+    // uuid dedup key → derive a fresh uuid via the normal uuid remap (valid + unique)
+    uniqueColumns.push({
+      key: `${key}.${c.column}`,
+      schema: c.schema,
+      table: c.table,
+      column: c.column,
+      type: 'uuid',
+      strategy: 'remap-uuid',
+      composite: c.note,
+    })
+  } else {
+    uniqueColumns.push({
+      key: `${key}.${c.column}`,
+      schema: c.schema,
+      table: c.table,
+      column: c.column,
+      type: 'text',
+      strategy: 'text-suffix',
+      references: [],
+      composite: c.note,
+    })
+  }
+}
+uniqueColumns.sort((a, b) => (a.type === b.type ? a.key.localeCompare(b.key) : a.type === 'uuid' ? 1 : -1))
+
+const copyCount = out.filter((t) => t.action === 'copy').length
+const doc = {
+  generatedAt: '2026-08-24 (measured read-only on dooer-staging)',
+  note:
+    'START FROM ALL, copy by default; `action:"ignore"` only with a stated reason that does not affect ' +
+    'AI-booking tests. Flip one `action` field to change a decision. See FINDINGS.md / PROCESS.md.',
+  orgIdentity:
+    'Org identity is ONE uuid: `organizationId` == `service_accounts.companies.companies_pk`. The copy ' +
+    'remaps the source org uuid to the target org uuid, and rewrites every other copied row PK (uuid) so ' +
+    'intra-org references rewire automatically. References to non-copied rows (users, global templates) ' +
+    'stay untouched because they are not in the remap map.',
+  emailScrub: { value: 'testcustomer@dooer.com', columnCount: emailRows.length },
+  options: {
+    // a text/varchar value equal to a copied row's uuid is a reference (e.g. a polymorphic entityId
+    // stored as text) — remap it to the copy's new uuid so references follow. Safe + improves fidelity.
+    remapTextStoredUuids: true,
+  },
+  // Tables whose PRIMARY KEY is an S3 object key (the S3-copy phase moves each object old.id → new.id).
+  s3BlobTables: REVERSE_REF.filter((r) => r.s3Blob).map((r) => r.key),
+  // Referenced-user copy: soft/`fk` uuid columns (in the COPY set) that point at service_accounts.users.
+  // The tool collects their values, copies the users missing from the target (never touching existing
+  // ones), remaps the refs, and anonymizes emails for `customer`-role users. `userTable` is the config
+  // for that copy — role lives in `fk_user_roles_at_dooer_pk` (text: admin/customer/hi/hiab); only
+  // `customer` is anonymized (Jimmy 2026-08-27), the rest are copied verbatim. Email is UNIQUE per role
+  // (`(email, fk_user_roles_at_dooer_pk)`), so anonymized addresses are made unique per user.
+  userTable: {
+    schema: 'service_accounts',
+    table: 'users',
+    pk: 'users_pk',
+    roleColumn: 'fk_user_roles_at_dooer_pk',
+    anonymizeRoles: ['customer'],
+    emailColumns: ['email', 'contactEmail', 'conversationEmailAddress'],
+    nullColumns: ['id_number', 'password_hash'], // PII / credentials — cleared for anonymized users
+    anonymizedEmailPattern: 'testcustomer+u<id>@dooer.com', // <id> = the copied user's new uuid (unique)
+  },
+  userRefColumns: userRefRows
+    .filter(([s, t]) => copySet.has(`${s}.${t}`))
+    .map(([schema, table, column]) => ({ schema, table, column })),
+  uniquenessStrategies: {
+    note:
+      'Per-column strategy for every single-column-UNIQUE column so a copy never collides. The script ' +
+      "reads this and hardcodes nothing — edit a column's `strategy` to change behaviour.",
+    strategies: {
+      'remap-uuid': 'generate a fresh uuid, applied consistently everywhere the value appears (value-based, global)',
+      sequence: 'draw nextval() from `sequenceName` on the target; also rewrite the columns in `references`',
+      'max-offset': 'assign target_max(column)+1,+2,… (app-assigned unique int); also rewrite `references`',
+      'text-suffix': 'append "-seedcopy-<rand>" to the source value; also rewrite `references`',
+      preserve: 'keep the source value unchanged (only safe when a collision is impossible)',
+    },
+    defaultByType: DEFAULT_BY_TYPE,
+    columns: uniqueColumns,
+  },
+  skipSchemas: Object.keys(IGNORE_SCHEMA),
+  counts: { total: out.length, copy: copyCount, ignore: out.length - copyCount },
+  ignoreCandidates: IGNORE_CANDIDATES,
+  fkGraph: '_measure/m4.fk-graph.tsv (420 edges among org schemas)',
+  tables: out,
+}
+fs.writeFileSync(path.join(__dirname, 'schema-map.json'), JSON.stringify(doc, null, 2) + '\n')
+console.log(
+  `schema-map.json: ${out.length} tables (${copyCount} copy, ${out.length - copyCount} ignore), ` +
+    `${emailRows.length} email columns, ${stagingOnly.size} staging-only.`
+)

package/lib/engine/purge.js

@@ -0,0 +1,137 @@
+// purge.js — delete ALL data for one organization (the inverse of copy). Removes every org-scoped row
+// across the schema-map (data + identity: companies, memberships, …), FK-safe in one transaction, and
+// deletes the org's S3 file objects. NEVER touches service_accounts.users (users are global; not in the
+// map). Dry-run by default. Writing to dooer-production requires confirmProduction.
+const path = require('path')
+const engine = require('./seed')
+
+const { connect, withRetry, filterClause, qTable, qIdent, s3Config, DeleteObjectCommand } = engine
+
+// every map table that can be scoped to an org (copy AND ignore — a purge removes identity rows too),
+// that physically exists on the target. Order doesn't matter: we disable FK/triggers for the delete.
+function purgeTables(map) {
+  return map.tables.filter((t) => {
+    if (t.key === 'service_accounts.users') return false // never delete users
+    const f = filterClause(t, '00000000-0000-0000-0000-000000000000')
+    return !!f
+  })
+}
+
+async function purge(opts) {
+  const args = {
+    org: opts.org,
+    namespace: opts.namespace || 'dooer-staging',
+    execute: !!opts.execute,
+    confirmProduction: !!opts.confirmProduction,
+    skipFiles: !!opts.skipFiles,
+    mapPath: opts.mapPath || path.join(__dirname, 'schema-map.json'),
+  }
+  if (!args.org) throw new Error('missing --org')
+  if (args.namespace === 'dooer-production' && args.execute && !args.confirmProduction) {
+    throw new Error('refusing to DELETE from dooer-production without --confirm-production')
+  }
+  const map = require(args.mapPath)
+  const tables = purgeTables(map)
+  const mode = args.execute ? 'EXECUTE' : 'DRY-RUN (dummy — no writes)'
+  console.log(`\n=== customer purge · ${mode} ===`)
+  console.log(`org: ${args.org}  @ ${args.namespace}  · candidate tables: ${tables.length}\n`)
+
+  const c = await connect(args.namespace)
+  try {
+    // count what would be deleted (also validates every filter compiles against the live schema)
+    const plan = []
+    let total = 0
+    let idx = 0
+    for (const t of tables) {
+      idx++
+      process.stderr.write(`\r[scan ${idx}/${tables.length}] ${t.key.slice(0, 52).padEnd(52)}`)
+      const exists = await c.query(
+        `SELECT 1 FROM information_schema.tables WHERE table_schema=$1 AND table_name=$2 AND table_type='BASE TABLE'`,
+        [t.schema, t.table]
+      )
+      if (!exists.rowCount) continue
+      const f = filterClause(t, args.org, { includeExtra: false })
+      const r = await withRetry(
+        () => c.query(`SELECT count(*)::int AS n FROM ${qTable(t.schema, t.table)} WHERE ${f.sql}`, f.params),
+        {
+          label: `count ${t.key}`,
+        }
+      )
+      const n = r.rows[0].n
+      if (n > 0) plan.push({ t, n })
+      total += n
+    }
+    process.stderr.write('\n')
+    for (const p of plan) console.log(`  ${String(p.n).padStart(9)}  ${p.t.key}`)
+    console.log(`\ntotal rows to delete: ${total} across ${plan.length} table(s)`)
+
+    // collect the org's S3 object keys (s3Blob tables) before we delete the rows
+    let fileKeys = []
+    if (!args.skipFiles) {
+      for (const key of map.s3BlobTables || []) {
+        const t = map.tables.find((x) => x.key === key)
+        if (!t) continue
+        const f = filterClause(t, args.org, { includeExtra: false })
+        const r = await withRetry(
+          () =>
+            c.query(`SELECT ${qIdent(t.pk.column)} AS id FROM ${qTable(t.schema, t.table)} WHERE ${f.sql}`, f.params),
+          {
+            label: `filekeys ${key}`,
+          }
+        )
+        fileKeys = fileKeys.concat(r.rows.map((x) => x.id).filter(Boolean))
+      }
+      console.log(`S3 objects to delete: ${fileKeys.length}`)
+    }
+
+    if (!args.execute) {
+      console.log('\nDRY-RUN complete — nothing was deleted. Re-run with --execute to purge.\n')
+      return { total, tables: plan.length, files: fileKeys.length }
+    }
+
+    // delete rows in ONE transaction with FK/triggers disabled (order-independent)
+    await c.client.query('BEGIN')
+    await c.client.query("SET session_replication_role = 'replica'")
+    let deleted = 0
+    for (const p of plan) {
+      const f = filterClause(p.t, args.org, { includeExtra: false })
+      const r = await c.client.query(`DELETE FROM ${qTable(p.t.schema, p.t.table)} WHERE ${f.sql}`, f.params)
+      deleted += r.rowCount
+    }
+    await c.client.query("SET session_replication_role = 'origin'")
+    await c.client.query('COMMIT')
+    console.log(`\nEXECUTE complete — ${deleted} rows deleted from ${args.org} @ ${args.namespace}.`)
+
+    // delete the S3 objects (best-effort, after the DB commit)
+    if (!args.skipFiles && fileKeys.length) {
+      const cfg = s3Config(args.namespace)
+      let ok = 0
+      let failed = 0
+      for (const key of fileKeys) {
+        try {
+          await withRetry(
+            () => cfg.primary.client.send(new DeleteObjectCommand({ Bucket: cfg.primary.bucket, Key: key })),
+            { label: 'del' }
+          )
+          if (cfg.fallback) {
+            try {
+              await cfg.fallback.client.send(new DeleteObjectCommand({ Bucket: cfg.fallback.bucket, Key: key }))
+            } catch (_) {
+              /* object may only exist in one bucket */
+            }
+          }
+          ok++
+        } catch (e) {
+          failed++
+          console.error(`  S3 delete failed for ${key}: ${e.message}`)
+        }
+      }
+      console.log(`S3: deleted ${ok}, failed ${failed}.`)
+    }
+    return { total: deleted, tables: plan.length, files: fileKeys.length }
+  } finally {
+    await c.end()
+  }
+}
+
+module.exports = { purge, purgeTables }