feat(wizard): port migration rewriter to the EQL v3 domain family

[tobyhede]

Part of the EQL v2 removal effort (#707). PR 6 of the linear stack — stacked on #770 (PR 5, stack-drizzle).

⚠️ Draft: stacked on #770 → #769 → #768. Review/merge PRs 3–5 first. Diff shows only wizard changes on top of PR 5.

What this does

Removes the last live EQL v2 code from @cipherstash/wizard, per the design §"PR 6".

• Ported src/lib/rewrite-migrations.ts from the eql_v2_encrypted-only rewriter to the full eql_v3_* family (mirroring the CLI's drizzle-kit v3: ALTER COLUMN to an eql_v3 domain emits invalid DDL (no v3 rewriter) #693 fix, re-converging the two long-coupled copies). Port, not delete — it's still live: post-agent.ts calls it after drizzle-kit generate, and since the wizard now scaffolds v3, the generated ALTER COLUMN … eql_v3_* statements would otherwise slip through unrepaired and fail at migrate time. Adds near-miss flagging (RewriteResult) and a stronger data-destroying warning.
• Domain checks flipped via a new isEqlEncryptedDomain helper (eql_v2_encrypted || startsWith('eql_v3_'), matching migrate's classifyEqlDomain convention) in wizard-tools.ts.
• Changeset (wizard: minor). No skill change (the wizard's internal post-agent step isn't documented in any skill).

Decision 6 (deliberate)

Detection recognizes both v2 and v3 as "already encrypted" so the agent won't clobber existing v2 ciphertext, while the wizard only emits v3. No decrypt/read path removed.

Green gate

build ✓ · tsc --noEmit clean for touched files (3 pre-existing @cipherstash/auth AutoStrategy errors in untouched files) · test 256 pass / 5 env-skipped (+108 new tests) · code:check 0 errors.

Note for reviewer

Pre-existing (not from this PR): the wizard package has 3 tsc errors about @cipherstash/auth's AutoStrategy type resolution in untouched files — would bite if a strict type gate is added here.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 8466300

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
stash	Minor
@cipherstash/wizard	Minor
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/stack	Minor
@cipherstash/stack-drizzle	Minor
@cipherstash/stack-supabase	Minor
@cipherstash/prisma-next	Minor
@cipherstash/bench	Patch
@cipherstash/test-kit	Patch
@cipherstash/prisma-next-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4570e6b3-4806-46f6-a289-b0cfe73fb05d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/remove-eql-v2-pr6-wizard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[freshtonic]

Reviewed by Claude Code on behalf of James Sadler.

Verdict: Approve

This is a clean, well-reasoned port of the wizard's migration rewriter from the single eql_v2_encrypted type to the full eql_v2/eql_v3_* domain family, re-converging it with the CLI sibling (packages/cli/src/commands/db/rewrite-migrations.ts) landed in #693. I fetched both files at the PR head and confirmed the regex machinery is now identical to the CLI reference. The change is a detection/repair transform, not a crypto change, and I found no blocking correctness, security, or data-loss defects.

What I checked carefully

• Regex family (ENCRYPTED_DOMAIN → DOMAIN_RE / MANGLED_TYPE_FORMS / ALTER_COLUMN_TO_ENCRYPTED_RE). Derived-from-one-source design (DOMAIN_RE built from ENCRYPTED_DOMAIN) is good — it structurally prevents matcher/extractor drift, and the it.each(V3_DOMAINS) "extracts the bare domain" test enforces it. Longest-first alternation ordering is correct; I traced the plain, public., "public"."...", "undefined"."...", and double-quoted forms and none premature-match a prefix and strand a fragment before \s*;. Capture-group indexing in the replace callback (first/second/column/mangledType) is right because every MANGLED_TYPE_FORMS branch uses non-capturing groups.
• The \s*; tightening. Switching the tail from [^;]*; to (...)\s*; is the load-bearing safety fix: a hand-authored SET DATA TYPE ... USING <expr>; no longer strict-matches (its USING would otherwise have been silently discarded). Correctly backstopped by NEAR_MISS_RE, which flags-but-does-not-rewrite. Verified by the 0013_using test.
• NEAR_MISS_RE ordering. Running the broad scan on the post-rewrite content is correct: genuinely-rewritten statements no longer contain SET DATA TYPE, so they can't self-flag. The "reports no skipped statements when the strict rewrite fully handled the file" test pins this, and the emitted guidance/-- UPDATE ... SET ... comment lines contain no SET DATA TYPE, so they don't trip it either. [^;] bounding keeps matches within a single statement even across newlines.
• Data-loss surface. ADD+DROP+RENAME is data-destroying — but that's unchanged from the prior v2 rewriter (deliberate, per design Decision 6). The new header comment and the post-agent.ts warning are a genuine improvement over the old "backfill ... Empty tables are safe as-is" text, which understated the footgun. The added note that constraints/defaults/indexes are not carried over is a good catch.
• Detection (isEqlEncryptedDomain). === 'eql_v2_encrypted' || startsWith('eql_v3_') errs conservative (treats-as-encrypted), so the failure mode is "won't scaffold over a column" rather than "clobbers ciphertext" — the safe direction. Trailing-underscore prefix correctly avoids a hypothetical eql_v30_*.
• post-agent.ts wiring. Destructures the new RewriteResult, surfaces skipped non-fatally, per-dir try/catch. Fine.

Non-blocking notes (no change required)

1. Hardcoded "public"."<domain>" in the emitted ADD COLUMN. The rewrite always targets the EQL domain in public, regardless of where it's actually installed. This matches both the prior v2 code and the CLI sibling, and public is the EQL install convention, so it's not a regression — just a latent assumption worth keeping in mind if EQL ever supports non-public domain installs.
2. rewriteEncryptedMigrations returns after the first existing candidate dir, even if that dir contained zero matches, so a later candidate dir with real EQL alters would be skipped. Pre-existing behavior, not introduced here — flagging only for awareness.
3. skipped[].statement can include leading content back to the previous ; (e.g. a leading comment block at file top) because NEAR_MISS_RE starts with lazy [^;]*?. Cosmetic only — the warning is still actionable.
4. PR notes 3 pre-existing @cipherstash/auth AutoStrategy tsc errors in untouched files; agreed those are out of scope here but would bite a future strict type gate.

Test coverage is strong (108 new tests, including the full generated v3 domain cross-product and every mangled drizzle-kit form). Good work.