Migrate existing old-style API keys to postguard-business PG- format

[rubenhensen]

Summary

We already have users with API keys in the old pkg-managed api_keys table. These need to be migrated into the postguard-business system so they continue to work after we switch pkg to validate against business keys (#140).

Details

• Audit the current pkg api_keys table to identify all active (non-expired) keys and their associated emails/attributes.
• Create a migration script that:
  1. Reads existing keys from the pkg database.
  2. Creates corresponding entries in the postguard-business database with proper PG- prefixed keys.
  3. Either re-keys the users (notify them of new key) or maps old keys to new format transparently.
• Coordinate with key owners if re-keying is needed.
• Ensure no downtime — both old and new keys should work during a transition period if necessary.

Related issues

• Migrate pkg API key validation to use postguard-business PG- keys #140 (switch pkg to validate against business keys)

---

/dobby please pick this up. Pull new commits and make new commits to the dobby repo often to tell other dobbies what you are up to, since several issues are interconnected. Tag @rubenhensen for anything you can't solve.

[dobby-coder]

Dobby hears the call! Dobby is most excited to help with this issue! Dobby will pull the latest from the dobby memory repo, check in often with other dobbies, and tag @rubenhensen if Dobby gets stuck. Dobby is getting to work now!

[rubenhensen]

/dobby please pick this up. First check the other related issues and their comments/PRs — another dobby may have already done some of this work. Pull new commits and make new commits to the dobby repo often to tell other dobbies what you are up to, since several issues are interconnected. Tag @rubenhensen for anything you can't solve.

[dobby-coder]

Dobby is on it, sir! Dobby sees the request and will first check his memory and related issues to see what other dobbies have been up to. Dobby will commit notes to the dobby repo often so all the little dobbies stay in sync. Dobby will tag @rubenhensen if Dobby gets stuck!

[dobby-coder]

Dobby has made a first draft! The migration half of this issue is up at encryption4all/postguard-business#11 as a draft PR — schema analysis, a pure planner + 16 unit tests, a dry-runnable CLI, and an operator runbook in docs/migrate-legacy-api-keys.md.

There are four product decisions I could not make on my own (re-key vs preserve, grouping heuristic, default status for migrated orgs, and whether to NULL created_by). They are spelled out in the PR description and the doc. The PR will stay as draft until you weigh in.

I have also left a coordination note for the sibling dobby working on postguard#140 in the dobby repo at process/issue-141-api-key-migration-2026-04-21.md — the two issues are tightly coupled and the answer to question 1 (re-key vs preserve) determines what pkg#140 has to validate. cc @rubenhensen.

[dobby-coder]

Migration script merged

PR encryption4all/postguard-business#11 (migration script for legacy api_keys → business PG- format) was approved and merged by @rubenhensen.

What shipped

• scripts/migrate-legacy-api-keys.ts with dry-run (default) and --live mode
• Pure planner in src/lib/server/migrations/legacy-api-keys.ts
• Legacy plaintext keys are SHA-256 hashed so they keep validating without re-keying
• 16 unit tests, all passing

Remaining items for this issue

• Real dry-run against a snapshot of the production pkg DB
• Live migration execution (once the four product questions from the PR are settled)
• Coordinate with feat(pg-pkg): validate API keys against postguard-business schema (#140) #142 (pkg validator switch, still draft) for the full cutover

The migration code is ready. The issue stays open until the actual migration is executed and verified in production.