@openinc/parse-server-opendash 4.1.1 → 4.1.2

package/dist/scripts/migration/verify.js

@@ -0,0 +1,620 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_1 = __importDefault(require("parse/node"));
+const index_js_1 = require("../../types/index.js");
+const env_js_1 = require("./lib/env.js");
+const message_js_1 = require("./lib/message.js");
+const pass_js_1 = require("./lib/pass.js");
+/** Pointer/array-of-ids fields to resolve, and the class they must resolve into. */
+const REFERENCE_FIELDS = [
+    { field: "status", className: index_js_1.Service_Status.className },
+    { field: "equipment", className: index_js_1.Service_Equipment.className },
+    { field: "project", className: index_js_1.Service_Project.className },
+    { field: "tags", className: index_js_1.Service_Tag.className, array: true },
+];
+/**
+ * How many objects the migration created for a given v1 class.
+ *
+ * Comparing raw table counts (`Maintenance_Ticket` vs `Service_Ticket`) looks
+ * equivalent but drifts: the aftercare step deliberately *adds* v2 Statuses for the
+ * `pending` / `cancelled` categories v1 never had, and any ticket created in v2
+ * before this runs inflates the other side. Both would fail a hard check for
+ * entirely correct reasons.
+ *
+ * Counting `OD3_Service_MigrationMap` rows instead asks the question that actually
+ * matters — "was every v1 record migrated?" — and is immune to anything added
+ * afterwards.
+ */
+async function migratedCount(sourceClass, batchSize) {
+    return (0, pass_js_1.countAll)(() => new node_1.default.Query("OD3_Service_MigrationMap").equalTo("sourceClass", sourceClass), batchSize);
+}
+/**
+ * Render a snapshot value for comparison.
+ *
+ * The replay check used to compare with `String(...)`, which is fine for
+ * scalars and pointers but collapses every array-of-objects column to
+ * "[object Object]" — so a `material` mismatch would have compared equal to
+ * itself and the check would have passed while proving nothing.
+ *
+ * Objects are stringified with their keys sorted, because the fold and the
+ * replay build their entries independently and key order carries no meaning.
+ */
+function comparable(value) {
+    const seen = new WeakSet();
+    const norm = (v) => {
+        if (v === null || typeof v !== "object")
+            return v;
+        if (seen.has(v))
+            return "[circular]";
+        seen.add(v);
+        if (Array.isArray(v))
+            return v.map(norm);
+        const obj = v;
+        // Parse wire types carry their identity in `__type`; compare pointers by id.
+        if (obj.__type === "Pointer")
+            return `Pointer:${String(obj.objectId)}`;
+        if (obj.__type === "Date")
+            return `Date:${String(obj.iso)}`;
+        return Object.fromEntries(Object.keys(obj)
+            .sort()
+            .filter((k) => obj[k] !== undefined)
+            .map((k) => [k, norm(obj[k])]));
+    };
+    return JSON.stringify(norm(value));
+}
+const checks = [
+    // ── Counts ───────────────────────────────────────────────────────────────
+    {
+        name: "every v1 ticket was migrated (disabled ones arrive as deleted)",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const [v1, migrated] = await Promise.all([
+                (0, pass_js_1.countAll)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Maintenance_Ticket), tenantId), batchSize),
+                migratedCount(index_js_1.Maintenance_Ticket.className, batchSize),
+            ]);
+            // Note: the map is not tenant-scoped, so this is only exact for a
+            // whole-database run. With --tenant it is a lower bound, which still catches
+            // wholesale loss (the failure mode that matters).
+            return migrated >= v1
+                ? undefined
+                : `${v1} v1 ticket(s) but only ${migrated} mapping(s) — ${v1 - migrated} not migrated`;
+        },
+    },
+    {
+        name: "every v1 kanban state was migrated",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const [v1, migrated] = await Promise.all([
+                (0, pass_js_1.countAll)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Maintenance_Kanban_State), tenantId), batchSize),
+                migratedCount(index_js_1.Maintenance_Kanban_State.className, batchSize),
+            ]);
+            return migrated >= v1
+                ? undefined
+                : `${v1} v1 kanban state(s) but only ${migrated} mapping(s)`;
+        },
+    },
+    {
+        name: "comment count matches migrated chat messages",
+        hard: false,
+        async run(tenantId, batchSize) {
+            let comments = 0;
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Maintenance_Message), tenantId), batchSize)) {
+                // Same predicates pass 10 uses, imported rather than re-inlined — a
+                // divergence here would make the check disagree with the pass it verifies.
+                for (const m of page) {
+                    if (!(0, message_js_1.isTodo)(m) && !(0, message_js_1.isSystemGenerated)(m))
+                        comments += 1;
+                }
+            }
+            const migrated = await (0, pass_js_1.countAll)(() => new node_1.default.Query(index_js_1.Chat_Message).startsWith("context", '["service","ticket"'), batchSize);
+            // Not a hard check: v1 messages can reference non-ticket objects, which are
+            // legitimately skipped.
+            return comments === migrated
+                ? undefined
+                : `${comments} human v1 comment(s) vs ${migrated} chat message(s) — the ` +
+                    `difference should equal pass 10's "not a migrated ticket" skips`;
+        },
+    },
+    // ── Required fields ──────────────────────────────────────────────────────
+    {
+        name: "every ticket has status, tenant, title and number",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const missing = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const gaps = [];
+                    if (!(0, pass_js_1.refId)(t.get("status")))
+                        gaps.push("status");
+                    if (!(0, pass_js_1.refId)(t.get("tenant")))
+                        gaps.push("tenant");
+                    if (!t.get("title"))
+                        gaps.push("title");
+                    if (typeof t.get("number") !== "number")
+                        gaps.push("number");
+                    if (gaps.length && missing.length < 10) {
+                        missing.push(`${t.id} (${gaps.join(", ")})`);
+                    }
+                }
+            }
+            return missing.length ? `e.g. ${missing.join("; ")}` : undefined;
+        },
+    },
+    {
+        name: "project ticketCounter is at least the highest number handed out",
+        hard: true,
+        async run(tenantId, batchSize) {
+            // The migration assigns `number` itself now (beforeSave is suppressed so the
+            // historical createdAt survives), so this checks the migration's own
+            // bookkeeping: a counter left behind the numbers already used would make the
+            // next run reuse them.
+            const highest = new Map();
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const number = t.get("number");
+                    const projectId = (0, pass_js_1.refId)(t.get("project"));
+                    if (typeof number !== "number" || !projectId)
+                        continue;
+                    highest.set(projectId, Math.max(highest.get(projectId) ?? 0, number));
+                }
+            }
+            const behind = [];
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Service_Project), batchSize)) {
+                for (const project of page) {
+                    if (!project.id)
+                        continue;
+                    const max = highest.get(project.id);
+                    if (max === undefined)
+                        continue;
+                    const counter = project.get("ticketCounter") ?? 0;
+                    if (counter < max && behind.length < 10) {
+                        behind.push(`${project.id}: counter ${counter} < highest number ${max}`);
+                    }
+                }
+            }
+            return behind.length ? behind.join("; ") : undefined;
+        },
+    },
+    {
+        name: "ticket numbers are unique per project",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const seen = new Map();
+            const dupes = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const number = t.get("number");
+                    if (typeof number !== "number")
+                        continue;
+                    // Keyed by tenant *and* project: tickets without a project are numbered
+                    // from the per-tenant counter, so two tenants legitimately share numbers
+                    // and a project-only key would report them as duplicates.
+                    const key = `${(0, pass_js_1.refId)(t.get("tenant")) ?? "-"}/${(0, pass_js_1.refId)(t.get("project")) ?? "(no project)"}`;
+                    const bucket = seen.get(key) ?? new Set();
+                    if (bucket.has(number) && dupes.length < 10) {
+                        dupes.push(`${key} #${number}`);
+                    }
+                    bucket.add(number);
+                    seen.set(key, bucket);
+                }
+            }
+            return dupes.length ? `duplicate number(s): ${dupes.join(", ")}` : undefined;
+        },
+    },
+    {
+        name: "every Status has a category in the v2 domain",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const bad = await (0, pass_js_1.countAll)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Status).notContainedIn("category", [
+                "inbox",
+                "active",
+                "pending",
+                "done",
+                "cancelled",
+            ]), tenantId), batchSize);
+            return bad > 0 ? `${bad} Status row(s) with an unknown category` : undefined;
+        },
+    },
+    {
+        name: "an inbox Status exists",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const n = await (0, pass_js_1.countAll)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Status).equalTo("category", "inbox"), tenantId), batchSize);
+            return n > 0 ? undefined : "no Status with category 'inbox'";
+        },
+    },
+    // ── Referential integrity ────────────────────────────────────────────────
+    {
+        name: "every ticket reference resolves to an existing object",
+        hard: true,
+        async run(tenantId, batchSize) {
+            // Load the id sets once rather than probing per ticket.
+            const known = new Map();
+            for (const { className } of REFERENCE_FIELDS) {
+                if (known.has(className))
+                    continue;
+                const ids = new Set();
+                for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(className), batchSize)) {
+                    for (const row of page)
+                        if (row.id)
+                            ids.add(row.id);
+                }
+                known.set(className, ids);
+            }
+            const broken = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    for (const { field, className, array } of REFERENCE_FIELDS) {
+                        const ids = known.get(className);
+                        const value = t.get(field);
+                        if (!value)
+                            continue;
+                        const candidates = array
+                            ? (value ?? []).map((v) => (0, pass_js_1.refId)(v))
+                            : [(0, pass_js_1.refId)(value)];
+                        for (const id of candidates) {
+                            if (id && !ids.has(id) && broken.length < 10) {
+                                broken.push(`${t.id}.${field} → ${id}`);
+                            }
+                        }
+                    }
+                }
+            }
+            return broken.length ? `e.g. ${broken.join("; ")}` : undefined;
+        },
+    },
+    {
+        name: "every ticket reference belongs to the ticket's own tenant",
+        hard: true,
+        async run(tenantId, batchSize) {
+            // Pass 08 resolved the required-status fallback once per run and only
+            // scoped it when --tenant was given, so a whole-database run put one
+            // tenant's inbox Status on every other tenant's unstatused tickets. The
+            // reference resolved fine (the row exists), so the integrity check above
+            // passed — it just belonged to a tenant that could not read it, and the
+            // column rendered empty in the UI. This is the check that catches it.
+            const tenantOf = new Map();
+            for (const { className } of REFERENCE_FIELDS) {
+                for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(className), batchSize)) {
+                    for (const row of page) {
+                        if (row.id)
+                            tenantOf.set(`${className}|${row.id}`, (0, pass_js_1.refId)(row.get("tenant")));
+                    }
+                }
+            }
+            const crossed = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const own = (0, pass_js_1.refId)(t.get("tenant"));
+                    if (!own)
+                        continue;
+                    for (const { field, className, array } of REFERENCE_FIELDS) {
+                        const value = t.get(field);
+                        if (!value)
+                            continue;
+                        const ids = array
+                            ? (value ?? []).map((v) => (0, pass_js_1.refId)(v))
+                            : [(0, pass_js_1.refId)(value)];
+                        for (const id of ids) {
+                            if (!id)
+                                continue;
+                            const other = tenantOf.get(`${className}|${id}`);
+                            // undefined = the row has no tenant at all, which is a different
+                            // (and legitimate) case — only a *mismatch* is a leak.
+                            if (other !== undefined && other !== own && crossed.length < 10) {
+                                crossed.push(`${t.id}.${field} -> ${id} (tenant ${other}, ticket is ${own})`);
+                            }
+                        }
+                    }
+                }
+            }
+            return crossed.length ? `e.g. ${crossed.join("; ")}` : undefined;
+        },
+    },
+    {
+        name: "every ticket's tags array is a complete ancestor closure",
+        hard: true,
+        async run(tenantId, batchSize) {
+            const parentOf = new Map();
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Service_Tag), batchSize)) {
+                for (const tag of page) {
+                    if (tag.id)
+                        parentOf.set(tag.id, (0, pass_js_1.refId)(tag.get("parent")));
+                }
+            }
+            const bad = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const tags = t.get("tags") ?? [];
+                    if (tags.length === 0)
+                        continue;
+                    const present = new Set(tags.map((v) => (0, pass_js_1.refId)(v)).filter(Boolean));
+                    for (const id of present) {
+                        let cursor = parentOf.get(id);
+                        const guard = new Set();
+                        while (cursor && !guard.has(cursor)) {
+                            guard.add(cursor);
+                            if (!present.has(cursor) && bad.length < 10) {
+                                bad.push(`${t.id} has ${id} but not its ancestor ${cursor}`);
+                                break;
+                            }
+                            cursor = parentOf.get(cursor);
+                        }
+                    }
+                }
+            }
+            return bad.length ? `e.g. ${bad.join("; ")}` : undefined;
+        },
+    },
+    {
+        name: "no equipment parent chain contains a cycle",
+        hard: true,
+        async run(_tenantId, batchSize) {
+            const parentOf = new Map();
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Service_Equipment), batchSize)) {
+                for (const e of page) {
+                    if (e.id)
+                        parentOf.set(e.id, (0, pass_js_1.refId)(e.get("parent")));
+                }
+            }
+            const cyclic = [];
+            for (const start of parentOf.keys()) {
+                const guard = new Set([start]);
+                let cursor = parentOf.get(start);
+                while (cursor) {
+                    if (guard.has(cursor)) {
+                        if (cyclic.length < 10)
+                            cyclic.push(start);
+                        break;
+                    }
+                    guard.add(cursor);
+                    cursor = parentOf.get(cursor);
+                }
+            }
+            return cyclic.length ? `equipment in a cycle: ${cyclic.join(", ")}` : undefined;
+        },
+    },
+    // ── Track F: the reconstructed history ───────────────────────────────────
+    {
+        name: "replaying each ticket's changelog reproduces the migrated ticket",
+        hard: true,
+        async run(tenantId, batchSize) {
+            // The strongest check in the migration: the final snapshot of the replay IS
+            // the flat ticket by construction, so any disagreement means either the fold
+            // (pass 08) or the replay (pass 12) is wrong.
+            const latestSnapshot = new Map();
+            const latestAt = new Map();
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Changelog).equalTo("nameOfClass", index_js_1.Service_Ticket.className), batchSize)) {
+                for (const row of page) {
+                    const context = row.get("context");
+                    if (!context?.migrated)
+                        continue;
+                    const ticketId = row.get("changedObject");
+                    const at = row.createdAt?.getTime() ?? 0;
+                    if (at >= (latestAt.get(ticketId) ?? -1)) {
+                        latestAt.set(ticketId, at);
+                        latestSnapshot.set(ticketId, row.get("value") ?? {});
+                    }
+                }
+            }
+            if (latestSnapshot.size === 0) {
+                return "no reconstructed history found (has pass 12 run?)";
+            }
+            // Compare only the fields the replay actually tracks; anything the fold set
+            // from a source the replay has no events for is out of scope here.
+            const tracked = [
+                "title",
+                "priority",
+                "downtime",
+                "frequency",
+                "restriction",
+                "status",
+                "equipment",
+                "project",
+                "material",
+            ];
+            const mismatches = [];
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    if (!t.id)
+                        continue;
+                    const snapshot = latestSnapshot.get(t.id);
+                    if (!snapshot) {
+                        if (mismatches.length < 10) {
+                            mismatches.push(`${t.id} has no reconstructed history`);
+                        }
+                        continue;
+                    }
+                    for (const field of tracked) {
+                        if (!(field in snapshot))
+                            continue; // never edited → nothing to compare
+                        const fromReplay = (0, pass_js_1.refId)(snapshot[field]) ?? snapshot[field];
+                        const onTicket = (0, pass_js_1.refId)(t.get(field)) ?? t.get(field);
+                        if (fromReplay !== undefined &&
+                            onTicket !== undefined &&
+                            comparable(fromReplay) !== comparable(onTicket) &&
+                            mismatches.length < 10) {
+                            mismatches.push(`${t.id}.${field}: replay ${comparable(fromReplay)} vs ` +
+                                `ticket ${comparable(onTicket)}`);
+                        }
+                    }
+                }
+            }
+            return mismatches.length ? `e.g. ${mismatches.join("; ")}` : undefined;
+        },
+    },
+    {
+        name: "reconstructed history kept its historical timestamps",
+        hard: true,
+        async run(_tenantId, batchSize) {
+            // Under the master key Parse silently stamps `createdAt = now`, which would
+            // collapse the whole trail onto the migration date. This is the check that
+            // catches a run that used the wrong key.
+            const cutoff = Date.now() - 60 * 60 * 1000;
+            let total = 0;
+            let recent = 0;
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Changelog).equalTo("nameOfClass", index_js_1.Service_Ticket.className), batchSize)) {
+                for (const row of page) {
+                    const context = row.get("context");
+                    if (!context?.migrated)
+                        continue;
+                    total += 1;
+                    if ((row.createdAt?.getTime() ?? 0) > cutoff)
+                        recent += 1;
+                }
+            }
+            if (total === 0)
+                return undefined;
+            return recent === total
+                ? `all ${total} reconstructed entries were created within the last hour — ` +
+                    `timestamps were NOT preserved (was the maintenance key actually used?)`
+                : undefined;
+        },
+    },
+    {
+        name: "no auto-generated changelog entries for migrated objects",
+        hard: true,
+        async run(_tenantId, batchSize) {
+            // Every migration write passes `context: { skipChangelog: true }`. A pass
+            // that forgets it leaves a fingerprint nothing in normal operation
+            // produces: `_ChangeLog`'s afterSave stamps `masterkey: request.master`,
+            // and a maintenance-key write is **not** master — `Auth.maintenance()`
+            // leaves `isMaster: false` — nor does it carry a user. So the tell is an
+            // entry with no acting user that is not master-key.
+            //
+            // Explicitly NOT `masterkey === true`, which is what this check looked for
+            // originally and could therefore never find: hook-written entries under the
+            // master key are legitimate v2 activity, and the migration's own writes
+            // never set that flag.
+            //
+            // Pass 12's entries match the same shape whenever the v1 row had no `user`,
+            // so they are excluded by their `context.migrated` marker rather than by
+            // their author. Both filters run in memory so an absent `actingUser` and a
+            // null one are treated alike.
+            const offenders = [];
+            let total = 0;
+            for await (const page of (0, pass_js_1.pages)(() => new node_1.default.Query(index_js_1.Changelog)
+                .containedIn("nameOfClass", [
+                index_js_1.Service_Ticket.className,
+                index_js_1.Service_Status.className,
+                index_js_1.Service_Tag.className,
+                index_js_1.Service_Equipment.className,
+                index_js_1.Service_Project.className,
+            ])
+                .notEqualTo("masterkey", true), batchSize)) {
+                for (const row of page) {
+                    const context = row.get("context");
+                    if (context?.migrated)
+                        continue; // written by pass 12, on purpose
+                    if (row.get("actingUser"))
+                        continue; // a real edit by a real user
+                    total += 1;
+                    if (offenders.length < 10) {
+                        offenders.push(`${row.get("nameOfClass")} ${row.get("changedObject")}`);
+                    }
+                }
+            }
+            return total > 0
+                ? `${total} auto-generated changelog entr(ies) — a pass is missing ` +
+                    `skipChangelog. e.g. ${offenders.join("; ")}`
+                : undefined;
+        },
+    },
+    // ── Soft: distribution sanity ────────────────────────────────────────────
+    {
+        name: "ticket status distribution looks plausible",
+        hard: false,
+        async run(tenantId, batchSize) {
+            const byCategory = new Map();
+            const categoryOf = new Map();
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Status), tenantId), batchSize)) {
+                for (const s of page) {
+                    if (s.id)
+                        categoryOf.set(s.id, s.get("category"));
+                }
+            }
+            for await (const page of (0, pass_js_1.pages)(() => (0, pass_js_1.scopeToTenant)(new node_1.default.Query(index_js_1.Service_Ticket), tenantId), batchSize)) {
+                for (const t of page) {
+                    const category = categoryOf.get((0, pass_js_1.refId)(t.get("status")) ?? "") ?? "(unknown)";
+                    byCategory.set(category, (byCategory.get(category) ?? 0) + 1);
+                }
+            }
+            const summary = [...byCategory.entries()]
+                .sort((a, b) => b[1] - a[1])
+                .map(([k, v]) => `${k}=${v}`)
+                .join(" ");
+            // Informational: always reported so the numbers land in the run log.
+            return `distribution: ${summary}`;
+        },
+    },
+];
+async function main() {
+    let config;
+    try {
+        config = (0, env_js_1.readConfig)(process.argv.slice(2));
+    }
+    catch (error) {
+        if (error instanceof env_js_1.MigrationConfigError) {
+            console.error(`\n✗ ${error.message}\n`);
+            return 2;
+        }
+        throw error;
+    }
+    (0, env_js_1.initParse)(config);
+    // Probe once before running the checks. Without this, an unreachable server or a
+    // rejected key makes every check throw, and the summary reads "N hard invariants
+    // failed — do not cut over" — which looks like N data problems rather than one
+    // connection problem.
+    try {
+        await new node_1.default.Query(index_js_1.Service_Ticket).limit(1).find(env_js_1.MK);
+    }
+    catch (error) {
+        console.error(`\n✗ Could not query ${config.parseUrl}.\n` +
+            `  ${error.message}\n` +
+            `  Check that Parse Server is reachable there, that PARSE_APP_ID matches, ` +
+            `that PARSE_MAINTENANCE_KEY is the server's maintenanceKey, and that this ` +
+            `host is allowed by maintenanceKeyIps (default: localhost only).\n` +
+            `  Nothing was verified — this is not a data problem.\n`);
+        return 2;
+    }
+    console.log(`\nverifying — tenant ${config.tenantId ?? "(all)"}\n`);
+    let hardFailures = 0;
+    let softFailures = 0;
+    for (const check of checks) {
+        let failure;
+        try {
+            failure = await check.run(config.tenantId, config.batchSize);
+        }
+        catch (error) {
+            failure = `check threw: ${error.message}`;
+        }
+        if (!failure) {
+            console.log(`  ✓ ${check.name}`);
+            continue;
+        }
+        if (check.hard) {
+            hardFailures++;
+            console.error(`  ✗ ${check.name}\n      ${failure}`);
+        }
+        else {
+            softFailures++;
+            console.warn(`  ! ${check.name}\n      ${failure}`);
+        }
+    }
+    console.log("");
+    if (hardFailures > 0) {
+        console.error(`✗ ${hardFailures} hard invariant(s) failed — do not cut over.\n`);
+        return 1;
+    }
+    console.log(softFailures > 0
+        ? `✓ hard invariants pass; ${softFailures} soft check(s) want a look.\n`
+        : `✓ all checks pass.\n`);
+    return 0;
+}
+main().then((code) => process.exit(code), (error) => {
+    console.error(error);
+    process.exit(1);
+});

package/dist/scripts/seed-v1-testdata.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Seed **v1** (`OD3_Maintenance_*`) test data, for exercising the v1 → v2 migration.
+ *
+ * DEV ONLY. Never run this against production.
+ *
+ *   OD_MIGRATION_MODE=1 PARSE_APP_ID=… PARSE_MAINTENANCE_KEY=… \
+ *     node dist/scripts/seed-v1-testdata.js [--purge]
+ *
+ * ## Why the maintenance key
+ *
+ * Realistic timestamps are the whole point. The migration's fold picks the newest
+ * side-table row and its replay builds a timeline from them — neither can be tested
+ * against data where every row was created in the same second. Historical
+ * `createdAt` / `updatedAt` require the maintenance key, so this seeder needs the
+ * same setup as the migration. That makes it a useful smoke test of the write path
+ * in its own right: if this runs, the migration's transport works.
+ *
+ * ## Why OD_MIGRATION_MODE
+ *
+ * All 29 v1 hooks call `defaultHandler`, which throws on a request with no user —
+ * and maintenance-key requests have none. The flag gates that off, so this seeder
+ * sets `tenant`, `user` and ACLs itself, exactly as the migration does.
+ *
+ * ## What it deliberately includes
+ *
+ * Every case the migration audits turned up, so a dry run has something to say:
+ *
+ *  - two tenants, each with their own kanban states and meta fields
+ *  - a ticket with no kanban state at all (inbox fallback)
+ *  - a ticket with `enabled: false`, and one with `enabled` *unset*
+ *  - side-table rows where `updatedAt` disagrees with `createdAt` ordering
+ *  - a completed todo, and a todo whose title is an i18n key
+ *  - a comment with an i18n-key title, and one with no author but an attachment
+ *  - a source with no tag, and a source tree needing ancestors
+ *  - an item with a German-decimal price and one with an unparseable price
+ *  - a two-level issue-category tree (closure expansion)
+ *  - an assignment batch (three rows, one `batchStamp`)
+ *  - a message referencing a non-ticket object (orphan skip)
+ *  - assets on a real and on a `temp-` media context
+ */
+export {};