deckhearth/.convoys/fix-reset-db-script.md

# fix-reset-db-script (P2 hygiene — fold of two queued follow-ups)

**Status:** in-progress
**Priority:** P2 hygiene (not a security blocker; `npm run reset-db` is dev-only
and currently broken on Node 22, so blast radius is low — but the bug
pattern is the same as the P0-grade weak-creds shape that
`drop-public-setup` already fixed once)
**Convoy owner:** parent (no architect — fold of two well-scoped
follow-ups; single-file fix following an established proven pattern)
**Opened:** 2026-05-25

## Problem (3 bugs in 1 file)

`scripts/reset-db.js` carries three known bugs surfaced by the
`pick-a-name` architect audit (2026-05-24) and ratified for fix in
this session:

1. **CJS-in-ESM environment** (lines 10, 12, 142): `require()` calls in
   an ESM file (`package.json "type": "module"` since `bump-next-js`).
   `npm run reset-db` throws `ReferenceError: require is not defined`
   on Node 22.x. **Same bug pattern that hit `setup-neon-db.js`
   pre-`drop-public-setup` Brief 2.** Fix is the same fix.
2. **Hardcoded weak admin password** (line 143: `bcrypt.hash('admin123', 12)`):
   identical anti-pattern to the one `drop-public-setup` Brief 1
   removed from `setup-neon-db.js`. Should require `ADMIN_INITIAL_PASSWORD`
   env var, fail loud if unset.
3. **Password echoed to stdout** (line 156:
   `console.log('   Admin Password: admin123')`): explicit security
   anti-pattern. `setup-neon-db.js` post-`drop-public-setup` does NOT
   echo the password — same convention applies here.

## Fix (mirror `setup-neon-db.js` exactly)

The fix shape is fully derived from the post-`drop-public-setup`
`scripts/setup-neon-db.js` file shipped at `b63b509`. Verbatim mirror:

- Replace CJS `require('dotenv').config()` with ESM
  `import dotenv from 'dotenv'; dotenv.config({ path: '.env.local' })`
- Replace CJS `const { neon } = require('@neondatabase/serverless')`
  with ESM `import { neon } from '@neondatabase/serverless'`
- Replace inline CJS `const bcrypt = require('bcryptjs')` (line 142)
  with top-level ESM `import bcrypt from 'bcryptjs'`
- Add the same fail-loud `ADMIN_INITIAL_PASSWORD` env-var check at the
  top of the `async function resetDatabase()` body, with the same
  helpful error message that points to README.md
- Replace `bcrypt.hash('admin123', 12)` with `bcrypt.hash(adminPassword, 12)`
- Update the admin email to the post-`pick-a-name` canonical
  (`admin@deckhearth.com` — already correct in the file at line 147,
  by the B2 sweep)
- Replace the `Admin Password: admin123` log line with `Admin user
  ready (email: admin@deckhearth.com)` (matching `setup-neon-db.js`
  line 157)
- Add `ON CONFLICT (email) DO NOTHING` to the INSERT (matching
  `setup-neon-db.js` line 149 — defensive against double-run)

## Scope

- **In scope:** `scripts/reset-db.js` only.
- **Out of scope:** any other `scripts/*.js` files (none have the same
  bugs — `setup-neon-db.js` already fixed, migration script already
  ESM, the rest don't ship admin creds).

## Why no architect

This is a **proven-pattern fold** — both `convert-reset-db-to-esm` and
`purge-weak-creds-from-helpers` were architect-recommended in
`pick-a-name` for "may fold if more such bugs accumulate in helper
scripts." All 3 bugs are in 1 file; the fix shape is verbatim-mirror of
the post-`drop-public-setup` `setup-neon-db.js`. No new decisions; no
new precedents; no surface for an architect to add value. Parent
applies the fix, runs the bounded checks, opens the PR. If anything
surprising surfaces (a 4th bug, a different bcrypt API, etc.), the
parent stops and dispatches an architect mid-execution.

## Acceptance criteria

- `node --check scripts/reset-db.js` exit 0
- `npm run lint` exit 1 with 128 problems (baseline preserved; no
  regression)
- `npm run test:run` 21/21 pass (no test surface touched; verification
  only)
- Grep: 0 occurrences of `require(` in `scripts/reset-db.js`
- Grep: 0 occurrences of `admin123` in `scripts/reset-db.js`
- Grep: 0 occurrences of `Admin Password` in `scripts/reset-db.js`
- Grep: `ADMIN_INITIAL_PASSWORD` referenced (1 hit)

## Operator action required pre-merge

- **None pre-merge** (no schema change, no env-var addition).
- **Optional post-merge:** if the operator wants to verify the fix
  works end-to-end, they can run `npm run reset-db` against a
  **non-prod** Neon branch (the script drops all tables — DO NOT run
  against prod). The script will refuse to run if `ADMIN_INITIAL_PASSWORD`
  is not set in `.env.local`, with the same helpful error message
  `setup-neon-db.js` already uses.

## Known constraints

- The script is **destructive** (drops all tables). We do NOT live-test
  it in this convoy. Boot-the-brief is syntax + lint + vitest only.
  Live verification is the operator's optional post-merge action.
- This convoy does NOT add ESLint `no-restricted-syntax` rule against
  CJS `require()` in `scripts/**`. That would be a separate
  `lint-against-cjs-in-esm-scripts` convoy. Surfaced here so future
  helper scripts don't re-introduce the bug.

## Out of scope (queued follow-ups)

- `lint-against-cjs-in-esm-scripts` (NEW, P3 polish): add ESLint rule
  to prevent any future `require()` in `scripts/**` once `package.json`
  has `"type": "module"`.
- `add-neon-return-shape-rule` (P3 polish, surfaced 2026-05-25 by
  PR #24): codify the `neon()` vs `@vercel/postgres` return-shape
  difference as a rule. **May fold into `single-sql-client`** which
  would eliminate the dual-client problem entirely.

## Owns

Parent (single-file proven-pattern fix; no architect or implementer
subagent required).

## As-shipped

(To be appended post-merge.)