@payload-auth-link/migrate 0.0.0-stage → 0.2.0

package/dist/doctor/plugins.js

@@ -0,0 +1,202 @@
+/**
+ * Better Auth plugin classification (issue #52): for each plugin the
+ * app's `betterAuthOptions.plugins` declares, the doctor says whether
+ * payload-auth-link's engine supports it out of the box
+ * (`autoDeclare` derives its models from Better Auth's own
+ * `getAuthTables`), whether it is a probed satellite, or whether it
+ * blocks migration.
+ */
+/**
+ * Core + first-party plugins the engine derives confidently. Mirrors
+ * what the derive-schema snapshot tests pin in
+ * packages/provider-better-auth; new entries land together with a
+ * derived-schema probe.
+ */
+const autoDeclared = new Set([
+    'magic-link',
+    'email-otp',
+    'anonymous',
+    'two-factor',
+    'admin',
+    'organization',
+    'jwt',
+    'username',
+    'phone-number',
+    'generic-oauth',
+    'one-time-token',
+    'multi-session',
+    'bearer',
+    'expo',
+    'siwe',
+    'next-cookies',
+    'tanstack-start-cookies',
+    'svelte-kit-cookies',
+    'solid-start-cookies',
+]);
+/** Satellites with a committed schema probe in this repo (compat matrix). */
+const probedSatellites = new Set([
+    '@better-auth/passkey',
+    '@better-auth/api-key',
+]);
+/** Satellites explicitly unsupported until probed (see compatibility.md). */
+const unsupportedSatellites = new Map([
+    [
+        '@better-auth/sso',
+        'not probed by payload-auth-link; adding it meets UnsupportedSchemaError at wiring time',
+    ],
+]);
+/**
+ * Payload-auth's own plugin additions the engine has no equivalent
+ * for. `oidcProvider` is the headline: Better Auth 1.7 removed it, and
+ * the replacement (@better-auth/oauth-provider) uses different tables,
+ * so the data move is the app's phase-1 prerequisite.
+ */
+const removedUpstream = new Map([
+    [
+        'oidc-provider',
+        'Better Auth 1.7 removed `oidcProvider`; moving to @better-auth/oauth-provider is a schema migration (oauthApplication → oauthClient, token splits, jwks gains alg/crv) — plan it before the auth migration',
+    ],
+    [
+        'mcp',
+        'Better Auth 1.7 removed the `mcp` plugin; move its surface to @better-auth/oauth-provider',
+    ],
+]);
+/** The satellite's own id convention: package name or its short id. */
+function satelliteId(id) {
+    return id.startsWith('@better-auth/') ? id : `@better-auth/${id}`;
+}
+export function classifyPlugins(ids) {
+    const findings = [];
+    for (const raw of ids) {
+        const id = raw.trim();
+        if (id === '') {
+            continue;
+        }
+        const satellite = satelliteId(id);
+        if (removedUpstream.has(id) || removedUpstream.has(satellite)) {
+            findings.push({
+                id,
+                status: 'removed-upstream',
+                detail: removedUpstream.get(id) ?? removedUpstream.get(satellite) ?? '',
+            });
+            continue;
+        }
+        if (id === 'oidcProvider') {
+            const detail = removedUpstream.get('oidc-provider') ?? '';
+            findings.push({ id, status: 'removed-upstream', detail });
+            continue;
+        }
+        if (unsupportedSatellites.has(satellite)) {
+            findings.push({
+                id,
+                status: 'unsupported',
+                detail: unsupportedSatellites.get(satellite) ?? '',
+            });
+            continue;
+        }
+        if (probedSatellites.has(satellite)) {
+            findings.push({
+                id,
+                status: 'supported',
+                detail: 'probed satellite — schema covered by the committed probe and the compat matrix',
+            });
+            continue;
+        }
+        if (autoDeclared.has(id)) {
+            findings.push({
+                id,
+                status: 'auto-declarable',
+                detail: 'derived from Better Auth’s own getAuthTables via autoDeclare',
+            });
+            continue;
+        }
+        if (satellite !== id) {
+            findings.push({
+                id,
+                status: 'unprobed',
+                detail: 'Better Auth satellite without a committed probe; the engine will derive its models but nothing here has validated them',
+            });
+            continue;
+        }
+        findings.push({
+            id,
+            status: 'unprobed',
+            detail: 'unknown plugin id; the engine derives what Better Auth’s schema reports, but treat it as unvalidated until probed',
+        });
+    }
+    return findings;
+}
+/**
+ * payload-auth does not keep the builder's Better Auth options on the
+ * built config (the plugin closure holds them), so the doctor derives
+ * the plugin set from what IS visible: the collections payload-auth
+ * built (each plugin model gets a slug) and the config source's plugin
+ * calls (for plugins without dedicated tables — magic link, cookies).
+ * Both probes feed the same classifier.
+ */
+/** payload-auth slug (baPluginSlugs) → Better Auth plugin id. */
+const slugToPlugin = {
+    apiKeys: 'api-key',
+    jwks: 'jwt',
+    twoFactors: 'two-factor',
+    passkeys: 'passkey',
+    oauthApplications: 'oidcProvider',
+    oauthAccessTokens: 'oidcProvider',
+    oauthConsents: 'oidcProvider',
+    ssoProviders: 'sso',
+    organizations: 'organization',
+    members: 'organization',
+    invitations: 'organization',
+    organizationRoles: 'organization',
+    teams: 'organization',
+    teamMembers: 'organization',
+    deviceCode: 'device-authorization',
+    subscriptions: 'subscriptions',
+};
+/** Plugin ids proven live by the collections payload-auth built. */
+export function pluginsFromCollectionSlugs(slugs) {
+    const ids = new Set();
+    for (const slug of slugs) {
+        const id = slugToPlugin[slug];
+        if (id !== undefined) {
+            ids.add(id);
+        }
+    }
+    return [...ids].sort();
+}
+/** Plugin call names a config source can name, mapped to plugin ids. */
+const callNameToPlugin = {
+    magicLink: 'magic-link',
+    emailOTP: 'email-otp',
+    anonymous: 'anonymous',
+    twoFactor: 'two-factor',
+    admin: 'admin',
+    organization: 'organization',
+    jwt: 'jwt',
+    username: 'username',
+    phoneNumber: 'phone-number',
+    genericOAuth: 'generic-oauth',
+    nextCookies: 'next-cookies',
+    tanstackStartCookies: 'tanstack-start-cookies',
+    oidcProvider: 'oidcProvider',
+    passkey: 'passkey',
+    apiKey: 'api-key',
+    sso: 'sso',
+};
+/**
+ * Plugin ids found by scanning the config source for plugin factory
+ * calls. Regex on purpose: the loaded config cannot reveal these
+ * (closure-held options), and the doctor must not execute app code
+ * beyond loading its config module.
+ */
+export function pluginsFromConfigSource(configSource) {
+    const ids = new Set();
+    for (const [call, id] of Object.entries(callNameToPlugin)) {
+        const pattern = new RegExp(`\\b${call}\\s*\\(`);
+        if (pattern.test(configSource)) {
+            ids.add(id);
+        }
+    }
+    return [...ids].sort();
+}
+//# sourceMappingURL=plugins.js.map

package/dist/doctor/plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/doctor/plugins.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,YAAY;IACZ,WAAW;IACX,WAAW;IACX,YAAY;IACZ,OAAO;IACP,cAAc;IACd,KAAK;IACL,UAAU;IACV,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,QAAQ;IACR,MAAM;IACN,MAAM;IACN,cAAc;IACd,wBAAwB;IACxB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,sBAAsB;IACtB,sBAAsB;CACvB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,qBAAqB,GAAgC,IAAI,GAAG,CAAC;IACjE;QACE,kBAAkB;QAClB,wFAAwF;KACzF;CACF,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D;QACE,eAAe;QACf,4MAA4M;KAC7M;IACD;QACE,KAAK;QACL,2FAA2F;KAC5F;CACF,CAAC,CAAA;AAEF,uEAAuE;AACvE,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;aACxE,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;YACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAA;YACzD,SAAQ;QACV,CAAC;QACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;aACnD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,gFAAgF;aACzF,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,8DAA8D;aACvE,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,MAAM,EAAE,UAAU;gBAClB,MAAM,EACJ,wHAAwH;aAC3H,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,MAAM,EAAE,UAAU;YAClB,MAAM,EACJ,mHAAmH;SACtH,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AAEH,iEAAiE;AACjE,MAAM,YAAY,GAAqC;IACrD,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,SAAS;IACnB,iBAAiB,EAAE,cAAc;IACjC,iBAAiB,EAAE,cAAc;IACjC,aAAa,EAAE,cAAc;IAC7B,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,cAAc;IAC7B,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,cAAc;IAC3B,iBAAiB,EAAE,cAAc;IACjC,KAAK,EAAE,cAAc;IACrB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,sBAAsB;IAClC,aAAa,EAAE,eAAe;CAC/B,CAAA;AAED,oEAAoE;AACpE,MAAM,UAAU,0BAA0B,CAAC,KAAwB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAuB,YAAY,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAqC;IACzD,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;IAC5B,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;IAC3B,oBAAoB,EAAE,wBAAwB;IAC9C,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAA;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/doctor/run-doctor.d.ts

@@ -0,0 +1,48 @@
+import type { BehaviourChange, DoctorReport } from './types.js';
+/**
+ * The read-only doctor (issue #52): point it at a payload-auth app and
+ * get the exact list of what breaks before touching anything. It loads
+ * the app's config module, inspects the users collection and Better
+ * Auth plugins, scans the source tree for call sites that must
+ * migrate, and (with a database URL) reports row counts, unverified
+ * users, and orphans. It never writes.
+ */
+export type DoctorOptions = {
+    /** Absolute or cwd-relative path to the app's payload config. */
+    readonly configPath: string;
+    /** Source directory to scan. Defaults to the config's directory. */
+    readonly srcDir?: string | undefined;
+    /** Postgres connection string. Defaults to `DATABASE_URL`. */
+    readonly databaseUrl?: string | undefined;
+    /** Config loader, injectable for tests. Defaults to dynamic import. */
+    readonly loadModule?: ((path: string) => Promise<unknown>) | undefined;
+};
+/**
+ * Behaviour changes in payload-auth-link 0.7.0 that a payload-auth app
+ * feels on day one. Static by nature; kept next to the doctor so the
+ * report is one artifact.
+ */
+export declare const behaviourChanges: readonly BehaviourChange[];
+/**
+ * Detect payload-auth in the built config. The plugin stamps
+ * `config.custom.hasBetterAuthPlugin = true` when it runs; older or
+ * future builds that instead expose `pluginOptions` on the plugin
+ * function are honored too.
+ */
+export declare function findPayloadAuthPlugin(config: unknown): {
+    pluginOptions: Record<string, unknown>;
+} | null;
+/**
+ * The Better Auth plugin ids the app declared. Reads them off
+ * `betterAuthOptions.plugins` when a pluginOptions object is visible;
+ * callers otherwise derive them from the built collections and the
+ * config source (see {@link pluginsFromCollectionSlugs} and
+ * {@link pluginsFromConfigSource}).
+ */
+export declare function betterAuthPluginIds(pluginOptions: Record<string, unknown>): string[];
+/** The users collection slug the payload-auth app configured. */
+export declare function usersSlugOf(pluginOptions: Record<string, unknown>): string;
+/** Collection slugs of the built config. */
+export declare function collectionSlugs(config: unknown): string[];
+export declare function runDoctor(options: DoctorOptions): Promise<DoctorReport>;
+//# sourceMappingURL=run-doctor.d.ts.map

package/dist/doctor/run-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-doctor.d.ts","sourceRoot":"","sources":["../../src/doctor/run-doctor.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAe,YAAY,EAAE,MAAM,YAAY,CAAA;AAE5E;;;;;;;GAOG;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CACvE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAqBtD,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG;IACtD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC,GAAG,IAAI,CAmBP;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAYpF;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK1E;AAED,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAQzD;AAcD,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAyI7E"}

package/dist/doctor/run-doctor.js

@@ -0,0 +1,236 @@
+import { isRecord } from '@payload-auth-link/core';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { checkVersions } from './bands.js';
+import { introspectDatabase } from './database.js';
+import { classifyPlugins, pluginsFromCollectionSlugs, pluginsFromConfigSource } from './plugins.js';
+import { scanSource } from './source-scan.js';
+import { analyzeUsersCollection, findUsersCollection } from './users.js';
+/**
+ * Behaviour changes in payload-auth-link 0.7.0 that a payload-auth app
+ * feels on day one. Static by nature; kept next to the doctor so the
+ * report is one artifact.
+ */
+export const behaviourChanges = [
+    {
+        title: 'Provider-linked documents lose local sign-in and forgot/reset',
+        detail: '0.7.0 makes documents with linked identities provider-owned: Payload local login and the self-service forgot/reset flow are refused for them (GHSA-f4hj). Break-glass operator accounts (no linked identities) keep everything. Set allowLocalCredentialsForLinkedDocs: true only for a migration window.',
+    },
+    {
+        title: 'Suspension is enforced on every strategy',
+        detail: 'suspendedUntil now refuses provider sessions, local sign-ins, existing local JWTs and API keys on the next request — including refresh-token and GraphQL.',
+    },
+    {
+        title: 'Collection access defaults tighten',
+        detail: 'Engine collections default to deny-all API access, and the users collection ships governed defaults for update/delete/unlock. Hosts opening access do so explicitly.',
+    },
+    {
+        title: 'req.user is a projection by default',
+        detail: "req.user carries { id, collection, email, roles } plus assurance/actor fields, not the full document. Access functions reading other fields see undefined — audit them or opt into reqUser: 'document' (#57).",
+    },
+];
+/**
+ * Detect payload-auth in the built config. The plugin stamps
+ * `config.custom.hasBetterAuthPlugin = true` when it runs; older or
+ * future builds that instead expose `pluginOptions` on the plugin
+ * function are honored too.
+ */
+export function findPayloadAuthPlugin(config) {
+    if (!isRecord(config)) {
+        return null;
+    }
+    if (isRecord(config.custom) && config.custom.hasBetterAuthPlugin === true) {
+        return { pluginOptions: {} };
+    }
+    if (!Array.isArray(config.plugins)) {
+        return null;
+    }
+    for (const plugin of config.plugins) {
+        if (typeof plugin === 'function' && 'pluginOptions' in plugin) {
+            const options = plugin.pluginOptions;
+            if (isRecord(options)) {
+                return { pluginOptions: options };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * The Better Auth plugin ids the app declared. Reads them off
+ * `betterAuthOptions.plugins` when a pluginOptions object is visible;
+ * callers otherwise derive them from the built collections and the
+ * config source (see {@link pluginsFromCollectionSlugs} and
+ * {@link pluginsFromConfigSource}).
+ */
+export function betterAuthPluginIds(pluginOptions) {
+    const baOptions = pluginOptions.betterAuthOptions;
+    if (!isRecord(baOptions) || !Array.isArray(baOptions.plugins)) {
+        return [];
+    }
+    const ids = [];
+    for (const plugin of baOptions.plugins) {
+        if (isRecord(plugin) && typeof plugin.id === 'string' && plugin.id !== '') {
+            ids.push(plugin.id);
+        }
+    }
+    return ids;
+}
+/** The users collection slug the payload-auth app configured. */
+export function usersSlugOf(pluginOptions) {
+    const users = pluginOptions.users;
+    return isRecord(users) && typeof users.slug === 'string' && users.slug !== ''
+        ? users.slug
+        : 'users';
+}
+/** Collection slugs of the built config. */
+export function collectionSlugs(config) {
+    if (!isRecord(config) || !Array.isArray(config.collections)) {
+        return [];
+    }
+    return config.collections
+        .filter(isRecord)
+        .map((collection) => collection.slug)
+        .filter((slug) => typeof slug === 'string');
+}
+/** Default config loader: a dynamic import of the TS/JS config module. */
+async function defaultLoadModule(path) {
+    const mod = await import(pathToFileURL(path).href);
+    let config = isRecord(mod) && 'default' in mod ? mod.default : mod;
+    // Payload configs may be async (buildConfig returns a Promise when the
+    // config awaits) — the doctor reads the resolved object either way.
+    if (typeof config?.then === 'function') {
+        config = await config;
+    }
+    return config;
+}
+export async function runDoctor(options) {
+    const configPath = resolve(options.configPath);
+    const loadModule = options.loadModule ?? defaultLoadModule;
+    const config = await loadModule(configPath);
+    const configDir = dirname(configPath);
+    const srcDir = options.srcDir === undefined ? configDir : resolve(options.srcDir);
+    const versions = checkVersions(pathToFileURL(configPath).href);
+    const blockers = [];
+    const warnings = [];
+    for (const finding of versions) {
+        if (finding.status === 'blocker') {
+            blockers.push({
+                code: `${finding.name}-out-of-band`,
+                detail: `${finding.name}: ${finding.detail}`,
+            });
+        }
+        else if (finding.status === 'unknown') {
+            warnings.push({
+                code: `${finding.name}-version-unknown`,
+                detail: `${finding.name}: ${finding.detail}`,
+            });
+        }
+    }
+    const plugin = findPayloadAuthPlugin(config);
+    if (plugin === null) {
+        warnings.push({
+            code: 'payload-auth-not-detected',
+            detail: 'no payload-auth plugin found in the config; if this app runs payload-auth elsewhere, point --config at that config',
+        });
+    }
+    if (plugin !== null) {
+        blockers.push({
+            code: 'payload-auth-installed',
+            detail: 'payload-auth is installed and configured: migrate with adopt (#49, zero row moves) or the importer (#50, reversible copy). Its admin views, payload.betterAuth accessor, and user-table layout all change.',
+        });
+    }
+    // payload-auth keeps the builder's options in its closure, so the
+    // plugin set comes from what the built config proves: the collections
+    // payload-auth created and the plugin calls in the config source.
+    let configSource;
+    try {
+        configSource = readFileSync(configPath, 'utf8');
+    }
+    catch {
+        configSource = '';
+    }
+    const pluginIds = [
+        ...new Set([
+            ...betterAuthPluginIds(plugin?.pluginOptions ?? {}),
+            ...pluginsFromCollectionSlugs(collectionSlugs(config)),
+            ...pluginsFromConfigSource(configSource),
+        ]),
+    ];
+    const pluginFindings = classifyPlugins(pluginIds);
+    for (const finding of pluginFindings) {
+        if (finding.status === 'removed-upstream') {
+            blockers.push({
+                code: 'ba-plugin-removed-upstream',
+                detail: `${finding.id}: ${finding.detail}`,
+            });
+        }
+        else if (finding.status === 'unsupported' || finding.status === 'unprobed') {
+            warnings.push({ code: 'ba-plugin-unvalidated', detail: `${finding.id}: ${finding.detail}` });
+        }
+    }
+    const usersSlug = usersSlugOf(plugin?.pluginOptions ?? {});
+    const { finding: users, issues: userIssues } = analyzeUsersCollection(findUsersCollection(config, usersSlug), 'roles');
+    for (const issue of userIssues) {
+        if (issue.code === 'injected-field-collision' ||
+            issue.code === 'roles-field-not-select' ||
+            issue.code === 'users-collection-missing') {
+            blockers.push(issue);
+        }
+        else {
+            warnings.push(issue);
+        }
+    }
+    const source = scanSource(srcDir);
+    for (const finding of source) {
+        if (finding.kind === 'ba-internals') {
+            blockers.push({
+                code: 'ba-internals-usage',
+                detail: `${finding.files.length} file(s) use Better Auth internals (${finding.files.join(', ')}): these break across Better Auth minors and hand-roll session cookies — rewrite on the supported server API (#54) before migrating`,
+            });
+        }
+    }
+    const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
+    let database = null;
+    if (databaseUrl !== undefined && databaseUrl !== '') {
+        try {
+            const found = await introspectDatabase(databaseUrl);
+            database = found;
+            if (found.unverifiedUsers !== null && found.unverifiedUsers > 0) {
+                warnings.push({
+                    code: 'unverified-users',
+                    detail: `${found.unverifiedUsers} user(s) have emailVerified = false: they will not JIT-link on a provider sign-in; they need a verified email (or a role manager's manual link) after migration`,
+                });
+            }
+            for (const orphan of found.orphans) {
+                blockers.push({
+                    code: 'orphan-rows',
+                    detail: `${orphan.count} orphaned row(s) of kind '${orphan.kind}': the importer refuses unmappable references rather than silently skipping them`,
+                });
+            }
+        }
+        catch (error) {
+            warnings.push({
+                code: 'database-unreachable',
+                detail: `could not inspect the database: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+    }
+    else {
+        warnings.push({
+            code: 'database-not-inspected',
+            detail: 'no database URL (pass --database-url or set DATABASE_URL); row counts, unverified users, and orphans were not checked',
+        });
+    }
+    return {
+        versions,
+        plugins: pluginFindings,
+        users,
+        source,
+        database,
+        behaviourChanges,
+        blockers,
+        warnings,
+    };
+}
+//# sourceMappingURL=run-doctor.js.map

package/dist/doctor/run-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-doctor.js","sourceRoot":"","sources":["../../src/doctor/run-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAuBxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA+B;IAC1D;QACE,KAAK,EAAE,+DAA+D;QACtE,MAAM,EACJ,2SAA2S;KAC9S;IACD;QACE,KAAK,EAAE,0CAA0C;QACjD,MAAM,EACJ,2JAA2J;KAC9J;IACD;QACE,KAAK,EAAE,oCAAoC;QAC3C,MAAM,EACJ,sKAAsK;KACzK;IACD;QACE,KAAK,EAAE,qCAAqC;QAC5C,MAAM,EACJ,+MAA+M;KAClN;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IAGnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAa,MAAqC,CAAC,aAAa,CAAA;YAC7E,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAsC;IACxE,MAAM,SAAS,GAAY,aAAa,CAAC,iBAAiB,CAAA;IAC1D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,aAAsC;IAChE,MAAM,KAAK,GAAY,aAAa,CAAC,KAAK,CAAA;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAC3E,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,OAAO,CAAA;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,WAAW;SACtB,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,MAAM,GAAY,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,OAAQ,MAAgD,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,GAAG,MAAM,MAAM,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEjF,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,cAAc;gBACnC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE;aAC7C,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,kBAAkB;gBACvC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE;aAC7C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,2BAA2B;YACjC,MAAM,EACJ,oHAAoH;SACvH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EACJ,4MAA4M;SAC/M,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,YAAoB,CAAA;IACxB,IAAI,CAAC;QACH,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAA;IACnB,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,mBAAmB,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;YACnD,GAAG,0BAA0B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtD,GAAG,uBAAuB,CAAC,YAAY,CAAC;SACzC,CAAC;KACH,CAAA;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACjD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE;aAC3C,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,sBAAsB,CACnE,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,OAAO,CACR,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IACE,KAAK,CAAC,IAAI,KAAK,0BAA0B;YACzC,KAAK,CAAC,IAAI,KAAK,wBAAwB;YACvC,KAAK,CAAC,IAAI,KAAK,0BAA0B,EACzC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,uCAAuC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qIAAqI;aACpO,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACnE,IAAI,QAAQ,GAA6B,IAAI,CAAA;IAC7C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACnD,QAAQ,GAAG,KAAK,CAAA;YAChB,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,iKAAiK;iBAClM,CAAC,CAAA;YACJ,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,6BAA6B,MAAM,CAAC,IAAI,kFAAkF;iBAClJ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpG,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EACJ,uHAAuH;SAC1H,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,cAAc;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,gBAAgB;QAChB,QAAQ;QACR,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/doctor/source-scan.d.ts

@@ -0,0 +1,10 @@
+import type { SourceFinding } from './types.js';
+/**
+ * The fields the auth-link strategy projects onto `req.user` by
+ * default (`reqUser: 'projection'`). Anything else a payload-auth app
+ * reads off `req.user` is `undefined` under the projection — silent
+ * access-control drift — until `reqUser: 'document'` lands (#57).
+ */
+export declare const projectedUserFields: ReadonlySet<string>;
+export declare function scanSource(srcDir: string): SourceFinding[];
+//# sourceMappingURL=source-scan.d.ts.map

package/dist/doctor/source-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.d.ts","sourceRoot":"","sources":["../../src/doctor/source-scan.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA+B/C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAA;AA4BF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAuE1D"}

package/dist/doctor/source-scan.js

@@ -0,0 +1,142 @@
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { extname, join, relative } from 'node:path';
+/**
+ * Read-only source scan (issue #52): the call sites a payload-auth app
+ * must migrate, found by pattern over `--src`. Regex-level on
+ * purpose — the doctor must run before any code changes, on apps the
+ * compiler cannot type-check against payload-auth-link yet.
+ */
+const scanExtensions = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+const skipDirs = new Set([
+    'node_modules',
+    'dist',
+    '.next',
+    '.turbo',
+    'coverage',
+    'test-results',
+    'playwright-report',
+]);
+const payloadAuthImport = /from\s+['"]payload-auth(?:\/[A-Za-z0-9_./-]+)?['"]|import\s*\(\s*['"]payload-auth(?:\/[A-Za-z0-9_./-]+)?['"]/g;
+const betterAuthAccessor = /\bpayload\.betterAuth\b|\bbetterAuth\.api\b/g;
+const getPayloadAuth = /\bgetPayloadAuth\s*\(/g;
+// Holding the Better Auth context at all (`$context`) means reaching
+// past the supported surface — hand-hashed keys, hand-signed cookies —
+// whether or not the call sits adjacent on one line.
+const baInternals = /\$context\b|\binternalAdapter\b/g;
+// `req` and `request` are both idiomatic parameter names.
+const reqUserField = /\b(?:req|request)\.user\.([A-Za-z_$][A-Za-z0-9_$]*)/g;
+/**
+ * The fields the auth-link strategy projects onto `req.user` by
+ * default (`reqUser: 'projection'`). Anything else a payload-auth app
+ * reads off `req.user` is `undefined` under the projection — silent
+ * access-control drift — until `reqUser: 'document'` lands (#57).
+ */
+export const projectedUserFields = new Set([
+    'id',
+    'collection',
+    'email',
+    'roles',
+    'mfaRequired',
+    'assurance',
+    'actor',
+    'organizationId',
+]);
+function walk(dir, into) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (skipDirs.has(entry) || entry.startsWith('.')) {
+            continue;
+        }
+        const full = join(dir, entry);
+        let stats;
+        try {
+            stats = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (stats.isDirectory()) {
+            walk(full, into);
+        }
+        else if (scanExtensions.has(extname(entry))) {
+            into.push(full);
+        }
+    }
+}
+export function scanSource(srcDir) {
+    const files = [];
+    walk(srcDir, files);
+    const importFiles = new Set();
+    const accessorFiles = new Set();
+    const getPayloadAuthFiles = new Set();
+    const internalsFiles = new Set();
+    const reqUserFiles = new Set();
+    const reqUserFields = new Set();
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const track = (pattern, into) => {
+            pattern.lastIndex = 0;
+            if (pattern.test(content)) {
+                into.add(file);
+            }
+        };
+        track(payloadAuthImport, importFiles);
+        track(betterAuthAccessor, accessorFiles);
+        track(getPayloadAuth, getPayloadAuthFiles);
+        track(baInternals, internalsFiles);
+        for (const match of content.matchAll(reqUserField)) {
+            const field = match[1];
+            if (field !== undefined && !projectedUserFields.has(field)) {
+                reqUserFields.add(field);
+                reqUserFiles.add(file);
+            }
+        }
+    }
+    const rel = (file) => relative(srcDir, file);
+    const findings = [
+        {
+            kind: 'payload-auth-import',
+            files: [...importFiles].map(rel).sort(),
+            fields: [],
+            detail: 'imports from payload-auth; each becomes a payload-auth-link import (codemod, #53)',
+        },
+        {
+            kind: 'get-payload-auth',
+            files: [...getPayloadAuthFiles].map(rel).sort(),
+            fields: [],
+            detail: 'getPayloadAuth(config) call sites; become getPayload({ config }) (codemod, #53)',
+        },
+        {
+            kind: 'better-auth-accessor',
+            files: [...accessorFiles].map(rel).sort(),
+            fields: [],
+            detail: 'payload.betterAuth accessors; migrate to the supported session API (#54), with the opt-in shim (#53) in between',
+        },
+        {
+            kind: 'ba-internals',
+            files: [...internalsFiles].map(rel).sort(),
+            fields: [],
+            detail: 'Better Auth internals ($context.internalAdapter / $context.adapter) — unsupported; the supported server API replaces each bridge (#54)',
+        },
+        {
+            kind: 'req-user-field',
+            files: [...reqUserFiles].map(rel).sort(),
+            fields: [...reqUserFields].sort(),
+            detail: "req.user.<field> reads outside the session projection; under the default projection they read undefined — audit each or opt into reqUser: 'document' (#57)",
+        },
+    ];
+    return findings.filter((finding) => finding.files.length > 0);
+}
+//# sourceMappingURL=source-scan.js.map