[ottonomy]

Stacked on #285 — review and merge that first.

Adds scripts/atlas/atlas.ts scan, a read-only report on the credentials collection in MongoDB Atlas, so the 350 KB sharing limit can be checked against real data before the move off Atlas. It is a maintainer's tool run by hand with a read-only database user; it is not part of the app, its build or CI.

scan:

• lists the collection's indexes, with any TTL (expireAfterSeconds);
• counts documents: shared, unshared, shared and unexpired (createdAt within 365 days), and those with a missing createdAt, shared or vp or an id that is not a v4 UUID;
• reports vp size (UTF-8 JSON bytes, the measure the app's limit uses): max, p50, p90, p99, and how many are over 350 KB and over 400 KB, among all documents and among the shared and unexpired;
• prints the createdAt range of the shared and unexpired.

It takes ATLAS_URI, ATLAS_DB and ATLAS_COLLECTION from the environment only, prints the host but never the user or password, and never prints ids, holder DIDs or credential content. Commands are dispatched from a table, so copy and a synthetic-data generator can be added beside scan later. tsx is added as a dev dependency to run it. See scripts/atlas/README.md.

Validation

• Against a local mongo:7 with auth on, seeded with 29 Atlas-shaped documents (id, controller, createdAt, vp, shared) covering each count, run as a user with only the built-in read role: every count, percentile and date matched the expected values; the seed's marker ids, DIDs and content and the password appeared nowhere in the output; the database profiler recorded only listIndexes and one find.
• Error paths: missing or malformed ATLAS_URI exits 2 without echoing it; wrong password and unknown collection exit 1.
• npm ci, npm test (116 passed, 26 skipped), npx tsc --noEmit.

Not yet run against Atlas itself; a maintainer runs it by hand.

🤖 Generated with Claude Code