@payload-auth-link/migrate 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,50 @@
-# Temporary Holding Version
+# @payload-auth-link/migrate
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The payload-auth → payload-auth-link migration kit
+([issues #49–#59](https://github.com/jellologic/payload-auth-link/issues/59)):
+a read-only **doctor/preflight** today, with the runnable importer and
+exporters riding the same CLI as they land (#50, #58).
+
+## Doctor (read-only preflight)
+
+```sh
+bunx @payload-auth-link/migrate doctor --config ./src/payload.config.ts --src ./src
+```
+
+Reports, without writing anything:
+
+- **Version bands** — payload, better-auth, next against the supported
+  bands (better-auth 1.6 → 1.7 removed `oidcProvider`, so apps using it
+  are flagged).
+- **Better Auth plugins** — supported, auto-declarable, unprobed, or
+  removed upstream, derived from the collections payload-auth built and
+  the plugin calls in the config source.
+- **The users collection** — field collisions with the plugin's
+  injected fields, the existing role field and its values
+  (non-canonical values such as `frontPlugin`), and whether Payload's
+  local strategy is on.
+- **0.7.0 behaviour changes that will bite** — provider-owned
+  documents, suspension on every strategy, access defaults, the
+  `req.user` projection.
+- **Source scan** — `payload-auth/*` imports, `payload.betterAuth` /
+  `getPayloadAuth` call sites, `$context` internals, and
+  `req.user.<field>` reads outside the session projection.
+- **Database** (with `--database-url` or `DATABASE_URL`) — row counts
+  per auth table, unverified users (who will not JIT-link), and
+  orphans.
+
+Output: human-readable text, or `--json` for tools. Exit codes:
+`0` clean, `1` blockers, `2` warnings only, `3` usage errors.
+
+Every finding carries a stable machine `code`, so CI (and the
+migration guide) can assert exact blocker lists. The authoritative
+exercise of the doctor lives in the repo's payload-auth fixture
+(`fixtures/payload-auth-app`), where the CI job pins the exact
+blockers it must report — and none it must not.
+
+Requires Bun (`bunx`): the doctor loads the app's config module with
+Bun's module loader, which tolerates the directory imports
+payload-auth's dist uses.
+
+Peers: `payload` ^3.83.0 || 4.0.0-beta.0 (the import commands boot the
+app's own Payload instance; the doctor itself only reads).

package/dist/cli.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env bun
+type StdSink = {
+    readonly write: (chunk: string) => void;
+};
+declare function main(argv: readonly string[], out?: StdSink, err?: StdSink): Promise<number>;
+export { main as cliMain };
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA6KA,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;CACxC,CAAA;AAED,iBAAe,IAAI,CACjB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,OAAwB,EAC7B,GAAG,GAAE,OAAwB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAwFjB;AAiBD,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,CAAA"}

package/dist/cli.js

@@ -0,0 +1,257 @@
+#!/usr/bin/env bun
+/**
+ * The `@payload-auth-link/migrate` CLI (issues #49–#59). Today: the
+ * read-only `doctor` (#52). The importer and exporters ride the same
+ * entrypoint as they land (#50, #58).
+ *
+ * Exit codes: 0 clean, 1 blockers, 2 warnings only, 3 usage errors.
+ * Never logs credential material — connection strings print only in
+ * the `--json` echo of what the caller passed, and secrets inside them
+ * are the caller's own input.
+ */
+import { runDoctor } from './doctor/run-doctor.js';
+import { runFinalize, runFromPayloadAuth, runRollback, runVerify, } from './importer/run-import.js';
+function parseArgs(argv) {
+    const positional = [];
+    const flags = new Map();
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === undefined) {
+            continue;
+        }
+        if (arg.startsWith('--')) {
+            const eq = arg.indexOf('=');
+            if (eq > 0) {
+                flags.set(arg.slice(2, eq), arg.slice(eq + 1));
+            }
+            else {
+                const name = arg.slice(2);
+                const next = argv[index + 1];
+                if (next !== undefined && !next.startsWith('--')) {
+                    flags.set(name, next);
+                    index += 1;
+                }
+                else {
+                    flags.set(name, true);
+                }
+            }
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    return { command: positional[0] ?? null, flags };
+}
+function usage() {
+    return `@payload-auth-link/migrate — the payload-auth → payload-auth-link migration kit
+
+Commands:
+  doctor --config ./src/payload.config.ts [--src ./src] [--json] [--database-url URL]
+  from-payload-auth --config ./src/payload.config.ts [--apply] [--sessions=carry|drop]
+                    [--manifest ./payload-auth-link-migration.json] [--database-url URL] [--json]
+  verify            --config ./src/payload.config.ts [--database-url URL] [--json]
+  rollback          --config ./src/payload.config.ts [--manifest ...]
+  finalize          [--manifest ...]
+
+  doctor is read-only: it loads the config, inspects the users
+  collection and Better Auth plugins, scans sources for call sites
+  that must migrate, and (with a database URL) reports row counts,
+  unverified users, and orphans.
+
+  from-payload-auth is a DRY RUN by default: it prints planned row
+  counts per model, collisions, and anything unmappable. --apply
+  writes the payload-auth-link collections through the Payload Local
+  API, records every created row and field change in the manifest,
+  and never modifies the source tables. verify checks both sides;
+  rollback undoes exactly the manifest; finalize marks it read-only
+  so the legacy tables may be dropped later, in their own migration.
+
+Exit codes: 0 clean, 1 blockers/mismatch, 2 warnings only, 3 usage errors.
+`;
+}
+function formatReport(report) {
+    const lines = [];
+    lines.push('== versions ==');
+    for (const finding of report.versions) {
+        lines.push(`${finding.status === 'ok' ? ' ok ' : finding.status === 'unknown' ? ' ?  ' : ' !! '} ${finding.name}: ${finding.installed ?? 'unresolved'} (band ${finding.band})`);
+    }
+    lines.push('');
+    lines.push('== Better Auth plugins ==');
+    if (report.plugins.length === 0) {
+        lines.push('     none declared');
+    }
+    for (const finding of report.plugins) {
+        lines.push(`  -  ${finding.id}: ${finding.status} — ${finding.detail}`);
+    }
+    lines.push('');
+    lines.push('== users collection ==');
+    if (report.users === null) {
+        lines.push('     not found');
+    }
+    else {
+        lines.push(`  slug: ${report.users.slug}`);
+        const role = report.users.roleField;
+        if (role !== null) {
+            lines.push(`  role field '${role.name}': ${role.type}${role.hasMany ? ' (hasMany)' : ''} values [${role.values.join(', ')}]${role.nonCanonical.length > 0 ? ` — NON-CANONICAL: ${role.nonCanonical.join(', ')}` : ''}`);
+        }
+        else {
+            lines.push('  role field: none found');
+        }
+        lines.push(`  local strategy: ${report.users.localStrategy ? 'ON' : 'off'}`);
+        if (report.users.collisions.length > 0) {
+            lines.push(`  collisions with injected fields: ${report.users.collisions.join(', ')}`);
+        }
+        for (const note of report.users.notes) {
+            lines.push(`  note: ${note}`);
+        }
+    }
+    lines.push('');
+    lines.push('== source scan ==');
+    if (report.source.length === 0) {
+        lines.push('     no migration call sites found');
+    }
+    for (const finding of report.source) {
+        lines.push(`  -  ${finding.kind}: ${finding.files.length} file(s)${finding.fields.length > 0 ? ` (fields: ${finding.fields.join(', ')})` : ''}`);
+        for (const file of finding.files.slice(0, 8)) {
+            lines.push(`        ${file}`);
+        }
+    }
+    lines.push('');
+    lines.push('== database ==');
+    if (report.database === null) {
+        lines.push('     not inspected');
+    }
+    else {
+        for (const table of report.database.tables) {
+            lines.push(`  ${table.name}: ${table.rows}`);
+        }
+        if (report.database.unverifiedUsers !== null) {
+            lines.push(`  unverified users: ${report.database.unverifiedUsers}`);
+        }
+        for (const orphan of report.database.orphans) {
+            lines.push(`  ORPHANS ${orphan.kind}: ${orphan.count}`);
+        }
+    }
+    lines.push('');
+    lines.push('== behaviour changes that will bite (0.7.0) ==');
+    for (const change of report.behaviourChanges) {
+        lines.push(`  * ${change.title}: ${change.detail}`);
+    }
+    lines.push('');
+    lines.push('== blockers ==');
+    if (report.blockers.length === 0) {
+        lines.push('     none');
+    }
+    for (const issue of report.blockers) {
+        lines.push(`  [${issue.code}] ${issue.detail}`);
+    }
+    lines.push('');
+    lines.push('== warnings ==');
+    if (report.warnings.length === 0) {
+        lines.push('     none');
+    }
+    for (const issue of report.warnings) {
+        lines.push(`  [${issue.code}] ${issue.detail}`);
+    }
+    return lines.join('\n');
+}
+async function main(argv, out = process.stdout, err = process.stderr) {
+    const { command, flags } = parseArgs(argv);
+    if (command === null || command === 'help' || flags.get('help') === true) {
+        out.write(usage());
+        return command === null && argv.length === 0 ? 3 : 0;
+    }
+    const importCommands = ['from-payload-auth', 'verify', 'rollback', 'finalize'];
+    if (command !== 'doctor' && !importCommands.includes(command)) {
+        err.write(`unknown command '${command}'\n\n${usage()}`);
+        return 3;
+    }
+    if (importCommands.includes(command)) {
+        const configFlag = flags.get('config');
+        if (typeof configFlag !== 'string' || configFlag === '') {
+            err.write(`${command} requires --config <path to payload.config.ts>\n`);
+            return 3;
+        }
+        const databaseUrl = typeof flags.get('database-url') === 'string'
+            ? flags.get('database-url')
+            : (process.env.DATABASE_URL ?? '');
+        if ((command === 'from-payload-auth' || command === 'verify') && databaseUrl === '') {
+            err.write(`${command} requires --database-url or DATABASE_URL\n`);
+            return 3;
+        }
+        const sessionsFlag = flags.get('sessions');
+        const sessions = sessionsFlag === 'drop' ? 'drop' : 'carry';
+        const importOptions = {
+            configPath: new URL(configFlag, `file://${process.cwd()}/`).pathname,
+            databaseUrl,
+            apply: flags.get('apply') === true,
+            sessions,
+            ...(typeof flags.get('manifest') === 'string'
+                ? { manifestPath: flags.get('manifest') }
+                : {}),
+            ...(typeof flags.get('slugs') === 'string'
+                ? { slugsJson: flags.get('slugs') }
+                : {}),
+            json: flags.get('json') === true,
+        };
+        if (command === 'from-payload-auth') {
+            const outcome = await runFromPayloadAuth(importOptions);
+            if (outcome.plan.unmappable.length > 0) {
+                err.write(`ABORT: ${outcome.plan.unmappable.length} unmappable row(s); nothing was silently skipped\n`);
+                return 1;
+            }
+            return 0;
+        }
+        if (command === 'verify') {
+            const result = await runVerify(importOptions);
+            return result.ok ? 0 : 1;
+        }
+        if (command === 'rollback') {
+            await runRollback(importOptions);
+            return 0;
+        }
+        await runFinalize(importOptions);
+        return 0;
+    }
+    const configPath = flags.get('config');
+    if (typeof configPath !== 'string' || configPath === '') {
+        err.write('doctor requires --config <path to payload.config.ts>\n');
+        return 3;
+    }
+    const resolvedConfig = new URL(configPath, `file://${process.cwd()}/`).pathname;
+    const srcFlag = flags.get('src');
+    const dbFlag = flags.get('database-url');
+    const report = await runDoctor({
+        configPath: resolvedConfig,
+        ...(typeof srcFlag === 'string'
+            ? { srcDir: new URL(srcFlag, `file://${process.cwd()}/`).pathname }
+            : {}),
+        ...(typeof dbFlag === 'string' ? { databaseUrl: dbFlag } : {}),
+    });
+    if (flags.get('json') === true) {
+        out.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else {
+        out.write(`${formatReport(report)}\n`);
+    }
+    if (report.blockers.length > 0) {
+        return 1;
+    }
+    if (report.warnings.length > 0) {
+        return 2;
+    }
+    return 0;
+}
+const invokedDirectly = process.argv[1]?.endsWith('cli.js') === true || process.argv[1]?.endsWith('cli.ts') === true;
+if (invokedDirectly) {
+    main(process.argv.slice(2))
+        .then((code) => {
+        process.exitCode = code;
+    })
+        .catch((error) => {
+        process.stderr.write(`doctor failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+export { main as cliMain };
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAElD,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,SAAS,GAEV,MAAM,0BAA0B,CAAA;AAOjC,SAAS,SAAS,CAAC,IAAuB;IACxC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAA;IACjD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAuB,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAChD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACzB,MAAM,IAAI,GAAuB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;gBAChD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;oBACrB,KAAK,IAAI,CAAC,CAAA;gBACZ,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAwBR,CAAA;AACD,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,SAAS,IAAI,YAAY,UAAU,OAAO,CAAC,IAAI,GAAG,CACpK,CAAA;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAClC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAA;QACnC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CACR,iBAAiB,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5M,CAAA;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACxC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAClD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,QAAQ,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrI,CAAA;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAClC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC5D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACzB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACzB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAMD,KAAK,UAAU,IAAI,CACjB,IAAuB,EACvB,MAAe,OAAO,CAAC,MAAM,EAC7B,MAAe,OAAO,CAAC,MAAM;IAE7B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAClB,OAAO,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;IAC9E,IAAI,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,oBAAoB,OAAO,QAAQ,KAAK,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,kDAAkD,CAAC,CAAA;YACvE,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;YAC3C,CAAC,CAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAY;YACvC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,4CAA4C,CAAC,CAAA;YACjE,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,OAAiB,CAAA;QACjF,MAAM,aAAa,GAAyB;YAC1C,UAAU,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ;YACpE,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI;YAClC,QAAQ;YACR,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;gBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAW,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAW,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;SACjC,CAAA;QACD,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAA;YACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CACP,UAAU,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,oDAAoD,CAC7F,CAAA;gBACD,OAAO,CAAC,CAAA;YACV,CAAC;YACD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAA;YAC7C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;YAChC,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;QAChC,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;QACnE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ;YAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAA;AAC9F,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC7E,CAAA;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,CAAA"}

package/dist/doctor/bands.d.ts

@@ -0,0 +1,16 @@
+import { type VersionRange } from '@payload-auth-link/core';
+import type { VersionFinding } from './types.js';
+/**
+ * The bands the doctor checks against. These mirror the authoritative
+ * constants — `supportedPayloadBand` (packages/plugin) and
+ * `supportedBetterAuthBand` (packages/provider-better-auth) — and a
+ * unit test asserts the copies never drift from them, so the doctor
+ * cannot promise a band the runtime would refuse.
+ */
+export declare const payloadBand: readonly VersionRange[];
+export declare const betterAuthBand: readonly VersionRange[];
+/** Next is a peer of the Next adapter; the doctor reports it informationally. */
+export declare const nextBand: readonly VersionRange[];
+/** Band checks for the three upstreams that gate a migration. */
+export declare function checkVersions(fromUrl: string): VersionFinding[];
+//# sourceMappingURL=bands.d.ts.map

package/dist/doctor/bands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bands.d.ts","sourceRoot":"","sources":["../../src/doctor/bands.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAG9C,CAAA;AACD,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAA8C,CAAA;AAChG,iFAAiF;AACjF,eAAO,MAAM,QAAQ,EAAE,SAAS,YAAY,EAAgD,CAAA;AAgC5F,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAW/D"}

package/dist/doctor/bands.js

@@ -0,0 +1,49 @@
+import { describeBand, isSupportedVersion, readInstalledVersion, } from '@payload-auth-link/core';
+/**
+ * The bands the doctor checks against. These mirror the authoritative
+ * constants — `supportedPayloadBand` (packages/plugin) and
+ * `supportedBetterAuthBand` (packages/provider-better-auth) — and a
+ * unit test asserts the copies never drift from them, so the doctor
+ * cannot promise a band the runtime would refuse.
+ */
+export const payloadBand = [
+    { min: '3.83.0', maxExclusive: '4.0.0' },
+    { exact: '4.0.0-beta.0' },
+];
+export const betterAuthBand = [{ min: '1.7.6', maxExclusive: '1.8.0' }];
+/** Next is a peer of the Next adapter; the doctor reports it informationally. */
+export const nextBand = [{ min: '15.0.0', maxExclusive: '17.0.0' }];
+/**
+ * Better Auth minors this doctor knows the payload-auth app must move
+ * off: 1.6 removed `oidcProvider` in 1.7 and payload-auth's peer range
+ * still admits 1.4+, so an app can sit far below the supported band
+ * without anything telling it.
+ */
+function versionFinding(name, band, fromUrl, note) {
+    const installed = readInstalledVersion(name, fromUrl);
+    const status = installed === null ? 'unknown' : isSupportedVersion(installed, band) ? 'ok' : 'blocker';
+    const base = installed === null
+        ? 'could not read the installed manifest; resolve the version manually'
+        : isSupportedVersion(installed, band)
+            ? `installed ${installed} is inside the supported band`
+            : `installed ${installed} is OUTSIDE the supported band; upgrade before migrating`;
+    return {
+        name,
+        installed,
+        band: describeBand(band),
+        status,
+        detail: [base, note?.(installed)].filter((part) => part !== undefined).join(' — '),
+    };
+}
+/** Band checks for the three upstreams that gate a migration. */
+export function checkVersions(fromUrl) {
+    return [
+        versionFinding('payload', payloadBand, fromUrl),
+        versionFinding('better-auth', betterAuthBand, fromUrl, (installed) => installed !== null &&
+            (installed.startsWith('1.4.') || installed.startsWith('1.5.') || installed.startsWith('1.6.'))
+            ? 'better-auth 1.7 removed `oidcProvider` and the `mcp` plugin; an OAuth 2.1 server moves to @better-auth/oauth-provider (a schema migration — see the journey notes in issue #60)'
+            : undefined),
+        versionFinding('next', nextBand, fromUrl),
+    ];
+}
+//# sourceMappingURL=bands.js.map

package/dist/doctor/bands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bands.js","sourceRoot":"","sources":["../../src/doctor/bands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,yBAAyB,CAAA;AAGhC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAA4B;IAClD,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE;IACxC,EAAE,KAAK,EAAE,cAAc,EAAE;CAC1B,CAAA;AACD,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;AAChG,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAA4B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;AAE5F;;;;;GAKG;AACH,SAAS,cAAc,CACrB,IAAY,EACZ,IAA6B,EAC7B,OAAe,EACf,IAAuD;IAEvD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,MAAM,MAAM,GACV,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACzF,MAAM,IAAI,GACR,SAAS,KAAK,IAAI;QAChB,CAAC,CAAC,qEAAqE;QACvE,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC;YACnC,CAAC,CAAC,aAAa,SAAS,+BAA+B;YACvD,CAAC,CAAC,aAAa,SAAS,0DAA0D,CAAA;IACxF,OAAO;QACL,IAAI;QACJ,SAAS;QACT,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;QACxB,MAAM;QACN,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;KACnF,CAAA;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO;QACL,cAAc,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC;QAC/C,cAAc,CAAC,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACnE,SAAS,KAAK,IAAI;YAClB,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC,CAAC,iLAAiL;YACnL,CAAC,CAAC,SAAS,CACd;QACD,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;KAC1C,CAAA;AACH,CAAC"}

package/dist/doctor/database.d.ts

@@ -0,0 +1,3 @@
+import type { DatabaseFinding } from './types.js';
+export declare function introspectDatabase(connectionString: string): Promise<DatabaseFinding>;
+//# sourceMappingURL=database.d.ts.map

package/dist/doctor/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/doctor/database.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA6DjD,wBAAsB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAmE3F"}

package/dist/doctor/database.js

@@ -0,0 +1,110 @@
+import { Client } from 'pg';
+/**
+ * Read-only database introspection (issue #52): row counts for the
+ * payload-auth layout's auth tables, unverified users (who will not
+ * JIT-link), and orphans. Only an honest SELECT — the doctor never
+ * writes.
+ */
+/**
+ * The payload-auth 1.9.x Postgres layout (snake_case columns; Payload's
+ * drizzle adapter stores hasMany selects as child tables like
+ * `users_role`). Tables that don't exist are simply absent from the
+ * report — apps customize slugs and drop plugins.
+ */
+const knownTables = [
+    'users',
+    'accounts',
+    'sessions',
+    'verifications',
+    'api_keys',
+    'organizations',
+    'members',
+    'invitations',
+    'jwks',
+    'admin_invitations',
+    'users_role',
+    'two_factors',
+    'passkeys',
+    'oauth_applications',
+    'oauth_access_tokens',
+    'oauth_consents',
+    'teams',
+    'team_members',
+    'subscriptions',
+    'device_code',
+    'sso_providers',
+];
+async function tableExists(client, table) {
+    const result = await client.query(`SELECT 1 FROM information_schema.tables
+     WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    return result.rows.length > 0;
+}
+/**
+ * Discover the columns a table actually has, so checks adapt to
+ * customized layouts instead of assuming.
+ */
+async function columnsOf(client, table) {
+    const result = await client.query(`SELECT column_name FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    return new Set(result.rows.map((row) => String(row.column_name)));
+}
+export async function introspectDatabase(connectionString) {
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+        const tables = [];
+        for (const table of knownTables) {
+            if (!(await tableExists(client, table))) {
+                continue;
+            }
+            const counted = await client.query(`SELECT count(*)::int AS n FROM ${table}`);
+            const first = counted.rows[0];
+            tables.push({ name: table, rows: first?.n ?? 0 });
+        }
+        let unverifiedUsers = null;
+        if (await tableExists(client, 'users')) {
+            const columns = await columnsOf(client, 'users');
+            if (columns.has('email_verified')) {
+                const counted = await client.query('SELECT count(*)::int AS n FROM users WHERE email_verified = false');
+                const first = counted.rows[0];
+                unverifiedUsers = first?.n ?? null;
+            }
+        }
+        const orphans = [];
+        const orphanChecks = [
+            { kind: 'accounts-without-user', table: 'accounts', column: 'user_id', target: 'users' },
+            {
+                kind: 'members-without-org',
+                table: 'members',
+                column: 'organization_id',
+                target: 'organizations',
+            },
+            { kind: 'members-without-user', table: 'members', column: 'user_id', target: 'users' },
+            {
+                kind: 'invitations-without-org',
+                table: 'invitations',
+                column: 'organization_id',
+                target: 'organizations',
+            },
+        ];
+        for (const check of orphanChecks) {
+            if ((await tableExists(client, check.table)) &&
+                (await tableExists(client, check.target)) &&
+                (await columnsOf(client, check.table)).has(check.column)) {
+                const counted = await client.query(`SELECT count(*)::int AS n FROM ${check.table}
+           WHERE ${check.column} IS NOT NULL
+             AND NOT EXISTS (SELECT 1 FROM ${check.target} t WHERE t.id = ${check.table}.${check.column})`);
+                const first = counted.rows[0];
+                const count = first?.n ?? 0;
+                if (count > 0) {
+                    orphans.push({ kind: check.kind, count });
+                }
+            }
+        }
+        return { tables, unverifiedUsers, orphans };
+    }
+    finally {
+        await client.end();
+    }
+}
+//# sourceMappingURL=database.js.map

package/dist/doctor/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/doctor/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAG3B;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,GAAsB;IACrC,OAAO;IACP,UAAU;IACV,UAAU;IACV,eAAe;IACf,UAAU;IACV,eAAe;IACf,SAAS;IACT,aAAa;IACb,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,oBAAoB;IACpB,qBAAqB;IACrB,gBAAgB;IAChB,OAAO;IACP,cAAc;IACd,eAAe;IACf,aAAa;IACb,eAAe;CAChB,CAAA;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;uDACmD,EACnD,CAAC,KAAK,CAAC,CACR,CAAA;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;uDACmD,EACnD,CAAC,KAAK,CAAC,CACR,CAAA;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAE,GAAgC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,gBAAwB;IAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC/C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAqC,EAAE,CAAA;QACnD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxC,SAAQ;YACV,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;YAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAA+B,CAAA;YAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,IAAI,eAAe,GAAkB,IAAI,CAAA;QACzC,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,mEAAmE,CACpE,CAAA;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAA+B,CAAA;gBAC3D,eAAe,GAAG,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;YACpC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAsC,EAAE,CAAA;QACrD,MAAM,YAAY,GAChB;YACE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;YACxF;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,eAAe;aACxB;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;YACtF;gBACE,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,eAAe;aACxB;SACF,CAAA;QACH,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,IACE,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EACxD,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,kCAAkC,KAAK,CAAC,KAAK;mBACpC,KAAK,CAAC,MAAM;6CACc,KAAK,CAAC,MAAM,mBAAmB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CACjG,CAAA;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAA+B,CAAA;gBAC3D,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC3B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAA;IAC7C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;IACpB,CAAC;AACH,CAAC"}

package/dist/doctor/plugins.d.ts

@@ -0,0 +1,12 @@
+import type { PluginFinding } from './types.js';
+export declare function classifyPlugins(ids: readonly string[]): PluginFinding[];
+/** Plugin ids proven live by the collections payload-auth built. */
+export declare function pluginsFromCollectionSlugs(slugs: readonly string[]): string[];
+/**
+ * Plugin ids found by scanning the config source for plugin factory
+ * calls. Regex on purpose: the loaded config cannot reveal these
+ * (closure-held options), and the doctor must not execute app code
+ * beyond loading its config module.
+ */
+export declare function pluginsFromConfigSource(configSource: string): string[];
+//# sourceMappingURL=plugins.d.ts.map

package/dist/doctor/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/doctor/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA2E/C,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,EAAE,CA8DvE;AA+BD,oEAAoE;AACpE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAS7E;AAsBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAStE"}