feat(wizard): port migration rewriter to the EQL v3 domain family

[tobyhede]

Part of the EQL v2 removal effort (#707). PR 6 of the linear stack — stacked on #770 (PR 5, stack-drizzle).

⚠️ Draft: stacked on #770 → #769 → #768. Review/merge PRs 3–5 first. Diff shows only wizard changes on top of PR 5.

What this does

Removes the last live EQL v2 code from @cipherstash/wizard, per the design §"PR 6".

• Ported src/lib/rewrite-migrations.ts from the eql_v2_encrypted-only rewriter to the full eql_v3_* family (mirroring the CLI's drizzle-kit v3: ALTER COLUMN to an eql_v3 domain emits invalid DDL (no v3 rewriter) #693 fix, re-converging the two long-coupled copies). Port, not delete — it's still live: post-agent.ts calls it after drizzle-kit generate, and since the wizard now scaffolds v3, the generated ALTER COLUMN … eql_v3_* statements would otherwise slip through unrepaired and fail at migrate time. Adds near-miss flagging (RewriteResult) and a stronger data-destroying warning.
• Domain checks flipped via a new isEqlEncryptedDomain helper (eql_v2_encrypted || startsWith('eql_v3_'), matching migrate's classifyEqlDomain convention) in wizard-tools.ts.
• Changeset (wizard: minor). No skill change (the wizard's internal post-agent step isn't documented in any skill).

Decision 6 (deliberate)

Detection recognizes both v2 and v3 as "already encrypted" so the agent won't clobber existing v2 ciphertext, while the wizard only emits v3. No decrypt/read path removed.

Review follow-ups (all four notes addressed)

All four non-blocking notes from the approving review are now closed, in 8466300f and 9ba737ea.

1. Hardcoded "public"."<domain>" — behaviour unchanged (it is not a regression), but the assumption is now documented at the emit site: the qualifier is asserted, not read back from the matched SQL — the schema capture is the TABLE's schema and says nothing about where the domain lives. The comment names the CLI sibling as the second place to thread an install schema through if EQL ever supports non-public domain installs. Already pinned by the existing pgSchema() test.

2. rewriteEncryptedMigrations stopped at the first existing candidate dir — fixed, and it was a live defect, not just a latent one: an empty or already-rewritten drizzle/ sitting beside a project's real migrations/ left those migrations unrepaired, so they failed at migrate time with the very cannot cast type … error the rewriter exists to prevent. The comment justifying the early return ("running again on a different candidate would double-transform already-rewritten SQL") was wrong on both counts — distinct directories hold distinct files, and the rewrite is idempotent anyway (a rewritten statement no longer contains SET DATA TYPE, so neither matcher can fire twice). Extracted as an exported, log-free sweepMigrationDirs(cwd, dirs) so it is directly testable without mocking @clack/prompts; a directory that throws is reported via error rather than stranding the ones after it. Does not apply to the CLI sibling — it takes a single explicit outDir.

3. skipped[].statement preamble — fixed in both copies. NEAR_MISS_RE's lazy [^;]*? has no left boundary but the previous ;, or start-of-file, so a near-miss in a file opening with a comment block was quoted back with that whole block glued to its front. Leading blank/comment lines (incl. --> statement-breakpoint) are stripped. Detection is unchanged; only the reported text differs.

4. The 3 @cipherstash/auth AutoStrategy tsc errors — root-caused and fixed rather than deferred. @cipherstash/auth uses conditional exports (node → index.d.ts, which has AutoStrategy; default → wasm-types.d.ts, which doesn't). The wizard's tsconfig sets moduleResolution: "bundler", which does not include the node condition, so tsc resolved against the wrong entry. Nothing was broken at runtime — the wizard is a Node CLI and always loads the node branch. Added "customConditions": ["node"], matching what packages/stack, packages/prisma-next, packages/test-kit, packages/stack-drizzle and packages/stack-supabase already carry for the identical protect-ffi problem.

   The reviewer's framing — "would bite a future strict type gate" — is why this also ships the gate. The wizard is built by tsup with dts: false, so the build transpiles without ever typechecking; that is exactly how these three errors sat in main unnoticed. Added a typecheck script and wired it into tests.yml beside the prisma-next gate (prisma-next: typecheck is red and not gated in CI — the type-level operator-capability tests aren't enforced #684). Verified it fires: with customConditions removed the step exits 2 on all three errors; restored, it exits 0.

Notes 2 and 3 landed with 9 regression tests, each watched failing against the pre-fix source first. Note 4 needs no changeset — dts: false means the published tarball is byte-identical.

Green gate

build ✓ · pnpm --filter @cipherstash/wizard run typecheck 0 errors (was 3) · wizard 265 pass / 5 env-skipped · stash 770 pass / 53 files · code:check 0 errors.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: d7a6123

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
stash	Minor
@cipherstash/wizard	Minor
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/stack	Minor
@cipherstash/stack-drizzle	Minor
@cipherstash/stack-supabase	Minor
@cipherstash/prisma-next	Minor
@cipherstash/bench	Patch
@cipherstash/test-kit	Patch
@cipherstash/prisma-next-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fab616d5-f355-4e69-9118-48cba120ab22

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/remove-eql-v2-pr6-wizard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[freshtonic]

Reviewed by Claude Code on behalf of James Sadler.

Verdict: Approve

This is a clean, well-reasoned port of the wizard's migration rewriter from the single eql_v2_encrypted type to the full eql_v2/eql_v3_* domain family, re-converging it with the CLI sibling (packages/cli/src/commands/db/rewrite-migrations.ts) landed in #693. I fetched both files at the PR head and confirmed the regex machinery is now identical to the CLI reference. The change is a detection/repair transform, not a crypto change, and I found no blocking correctness, security, or data-loss defects.

What I checked carefully

• Regex family (ENCRYPTED_DOMAIN → DOMAIN_RE / MANGLED_TYPE_FORMS / ALTER_COLUMN_TO_ENCRYPTED_RE). Derived-from-one-source design (DOMAIN_RE built from ENCRYPTED_DOMAIN) is good — it structurally prevents matcher/extractor drift, and the it.each(V3_DOMAINS) "extracts the bare domain" test enforces it. Longest-first alternation ordering is correct; I traced the plain, public., "public"."...", "undefined"."...", and double-quoted forms and none premature-match a prefix and strand a fragment before \s*;. Capture-group indexing in the replace callback (first/second/column/mangledType) is right because every MANGLED_TYPE_FORMS branch uses non-capturing groups.
• The \s*; tightening. Switching the tail from [^;]*; to (...)\s*; is the load-bearing safety fix: a hand-authored SET DATA TYPE ... USING <expr>; no longer strict-matches (its USING would otherwise have been silently discarded). Correctly backstopped by NEAR_MISS_RE, which flags-but-does-not-rewrite. Verified by the 0013_using test.
• NEAR_MISS_RE ordering. Running the broad scan on the post-rewrite content is correct: genuinely-rewritten statements no longer contain SET DATA TYPE, so they can't self-flag. The "reports no skipped statements when the strict rewrite fully handled the file" test pins this, and the emitted guidance/-- UPDATE ... SET ... comment lines contain no SET DATA TYPE, so they don't trip it either. [^;] bounding keeps matches within a single statement even across newlines.
• Data-loss surface. ADD+DROP+RENAME is data-destroying — but that's unchanged from the prior v2 rewriter (deliberate, per design Decision 6). The new header comment and the post-agent.ts warning are a genuine improvement over the old "backfill ... Empty tables are safe as-is" text, which understated the footgun. The added note that constraints/defaults/indexes are not carried over is a good catch.
• Detection (isEqlEncryptedDomain). === 'eql_v2_encrypted' || startsWith('eql_v3_') errs conservative (treats-as-encrypted), so the failure mode is "won't scaffold over a column" rather than "clobbers ciphertext" — the safe direction. Trailing-underscore prefix correctly avoids a hypothetical eql_v30_*.
• post-agent.ts wiring. Destructures the new RewriteResult, surfaces skipped non-fatally, per-dir try/catch. Fine.

Non-blocking notes (no change required)

1. Hardcoded "public"."<domain>" in the emitted ADD COLUMN. The rewrite always targets the EQL domain in public, regardless of where it's actually installed. This matches both the prior v2 code and the CLI sibling, and public is the EQL install convention, so it's not a regression — just a latent assumption worth keeping in mind if EQL ever supports non-public domain installs.
2. rewriteEncryptedMigrations returns after the first existing candidate dir, even if that dir contained zero matches, so a later candidate dir with real EQL alters would be skipped. Pre-existing behavior, not introduced here — flagging only for awareness.
3. skipped[].statement can include leading content back to the previous ; (e.g. a leading comment block at file top) because NEAR_MISS_RE starts with lazy [^;]*?. Cosmetic only — the warning is still actionable.
4. PR notes 3 pre-existing @cipherstash/auth AutoStrategy tsc errors in untouched files; agreed those are out of scope here but would bite a future strict type gate.

Test coverage is strong (108 new tests, including the full generated v3 domain cross-product and every mangled drizzle-kit form). Good work.

[tobyhede]

All four non-blocking notes are addressed — 8466300f (notes 1–3) and 9ba737ea (note 4).

1 — hardcoded "public"."<domain>". Left as-is, documented at the emit site. Worth stating explicitly: the qualifier is asserted, not read back from the matched SQL — the schema capture is the TABLE's schema (from a pgSchema() table) and says nothing about where the domain lives. The comment names the CLI sibling as the second place to thread an install schema through if that ever changes.

2 — sweep stopping at the first existing candidate dir. Fixed. This turned out to be live rather than latent: an empty or already-rewritten drizzle/ beside a project's real migrations/ left those migrations unrepaired, so they failed at migrate time with the exact cannot cast type … error the rewriter exists to prevent. The comment justifying the early return ("running again on a different candidate would double-transform already-rewritten SQL") was wrong twice over — distinct directories hold distinct files, and the rewrite is idempotent regardless, since a rewritten statement no longer contains SET DATA TYPE. Extracted as an exported, log-free sweepMigrationDirs(cwd, dirs) so it is testable without mocking @clack/prompts; a directory that throws is reported via error instead of stranding the ones after it. Not applicable to the CLI sibling — it takes a single explicit outDir.

3 — skipped[].statement preamble. Fixed in both copies. Leading blank/comment lines (incl. --> statement-breakpoint) are stripped. Detection unchanged; only the reported text differs.

4 — the 3 AutoStrategy tsc errors. Root-caused and fixed rather than deferred. @cipherstash/auth uses conditional exports — node → index.d.ts (has AutoStrategy), default → wasm-types.d.ts (doesn't). The wizard's tsconfig sets moduleResolution: "bundler", which does not include the node condition, so tsc resolved against the wrong entry. Nothing was broken at runtime; the wizard is a Node CLI and always loads the node branch. Added "customConditions": ["node"], matching what stack, prisma-next, test-kit, stack-drizzle and stack-supabase already carry for the identical protect-ffi problem.

Your "would bite a future strict type gate" framing is why this also ships the gate. The wizard is built by tsup with dts: false, so the build transpiles without ever typechecking — which is precisely how these three sat in main unnoticed. Added a typecheck script wired into tests.yml beside the prisma-next gate (#684), and verified it fires: with customConditions removed the step exits 2 on all three errors; restored, exits 0.

Notes 2 and 3 landed with 9 regression tests, each watched failing against the pre-fix source before the fix went in. Note 4 needs no changeset — dts: false means the published tarball is byte-identical.

Green: typecheck 0 errors (was 3) · wizard 265 pass / 5 env-skipped · stash 770 pass / 53 files · code:check 0 errors.