@payload-auth-link/migrate 0.0.0-stage → 0.2.0

package/dist/importer/source.js

@@ -0,0 +1,147 @@
+import { Client } from 'pg';
+export async function openSource(connectionString) {
+    const client = new Client({ connectionString });
+    await client.connect();
+    return client;
+}
+/** The columns one table actually has (customized layouts drop columns). */
+async function columnsOf(client, table) {
+    const result = await client.query(`SELECT column_name FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    return new Set(result.rows.map((row) => String(row.column_name)));
+}
+async function tableExists(client, table) {
+    const result = await client.query(`SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    return result.rows.length > 0;
+}
+export async function countTables(client, tables) {
+    const counts = {};
+    for (const table of tables) {
+        if (await tableExists(client, table)) {
+            const counted = await client.query(`SELECT count(*)::int AS n FROM ${table}`);
+            counts[table] = counted.rows[0]?.n ?? 0;
+        }
+        else {
+            counts[table] = 0;
+        }
+    }
+    return counts;
+}
+function iso(value) {
+    return value instanceof Date ? value : null;
+}
+function text(value) {
+    return typeof value === 'string' && value !== '' ? value : null;
+}
+/** Every source user, with role rows and accounts attached. */
+export async function readSourceUsers(client) {
+    const hasRoleTable = await tableExists(client, 'users_role');
+    const users = await client.query(`SELECT id, email, name, email_verified, image, created_at, updated_at FROM users ORDER BY id`);
+    const roleRows = hasRoleTable
+        ? await client.query(`SELECT parent_id, value FROM users_role ORDER BY parent_id, "order"`)
+        : { rows: [] };
+    const rolesByUser = new Map();
+    for (const row of roleRows.rows) {
+        const list = rolesByUser.get(String(row.parent_id)) ?? [];
+        list.push(row.value);
+        rolesByUser.set(String(row.parent_id), list);
+    }
+    const accounts = await client.query(`SELECT id, account_id, provider_id, password, access_token, refresh_token, id_token,
+            scope, access_token_expires_at, refresh_token_expires_at, user_id
+     FROM accounts ORDER BY id`);
+    const accountsByUser = new Map();
+    for (const row of accounts.rows) {
+        const userId = String(row.user_id);
+        const account = {
+            id: String(row.id),
+            accountId: String(row.account_id),
+            providerId: String(row.provider_id),
+            password: text(row.password),
+            accessToken: text(row.access_token),
+            refreshToken: text(row.refresh_token),
+            idToken: text(row.id_token),
+            scope: text(row.scope),
+            accessTokenExpiresAt: iso(row.access_token_expires_at),
+            refreshTokenExpiresAt: iso(row.refresh_token_expires_at),
+        };
+        const list = accountsByUser.get(userId) ?? [];
+        list.push(account);
+        accountsByUser.set(userId, list);
+    }
+    const out = [];
+    for (const row of users.rows) {
+        const id = String(row.id);
+        out.push({
+            id,
+            email: String(row.email),
+            name: text(row.name),
+            emailVerified: row.email_verified === true,
+            image: text(row.image),
+            createdAt: iso(row.created_at) ?? new Date(),
+            updatedAt: iso(row.updated_at) ?? new Date(),
+            roles: rolesByUser.get(id) ?? [],
+            accounts: accountsByUser.get(id) ?? [],
+        });
+    }
+    return out;
+}
+/** Rows of one flat plugin table (sessions, verifications, apiKeys, jwks, …). */
+export async function readFlatRows(client, table, columns) {
+    if (!(await tableExists(client, table))) {
+        return [];
+    }
+    const result = await client.query(`SELECT ${columns.join(', ')} FROM ${table} ORDER BY id`);
+    return result.rows;
+}
+/**
+ * Members and invitations reference organizations and users by numeric
+ * id; the importer remaps to the target's baIds. Orphaned references
+ * are unmappable — they abort the run rather than skip silently.
+ */
+export async function findOrphans(client) {
+    const orphans = [];
+    const checks = [
+        { model: 'account', table: 'accounts', column: 'user_id', target: 'users' },
+        { model: 'session', table: 'sessions', column: 'user_id', target: 'users' },
+        { model: 'member', table: 'members', column: 'organization_id', target: 'organizations' },
+        { model: 'member', table: 'members', column: 'user_id', target: 'users' },
+        {
+            model: 'invitation',
+            table: 'invitations',
+            column: 'organization_id',
+            target: 'organizations',
+        },
+        { model: 'invitation', table: 'invitations', column: 'inviter_id', target: 'users' },
+        { model: 'apikey', table: 'api_keys', column: 'user_id', target: 'users' },
+    ];
+    for (const check of checks) {
+        const exists = await Promise.all([
+            tableExists(client, check.table),
+            tableExists(client, check.target),
+        ]);
+        if (!exists[0] || !exists[1]) {
+            continue;
+        }
+        // Customized layouts drop columns; a missing reference column is
+        // not an orphan farm.
+        if (!(await columnsOf(client, check.table)).has(check.column)) {
+            continue;
+        }
+        const result = await client.query(`SELECT t.id FROM ${check.table} t
+       WHERE t.${check.column} IS NOT NULL
+         AND NOT EXISTS (SELECT 1 FROM ${check.target} s WHERE s.id = t.${check.column})`);
+        for (const row of result.rows) {
+            orphans.push({
+                model: check.model,
+                key: String(row.id),
+                reason: `${check.table}.${check.column} references a missing ${check.target} row`,
+            });
+        }
+    }
+    return orphans;
+}
+/** Users whose email never verified — reported, never granted `linkable`. */
+export function unverifiedEmails(users) {
+    return users.filter((user) => !user.emailVerified).map((user) => user.email);
+}
+//# sourceMappingURL=source.js.map

package/dist/importer/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/importer/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAuC3B,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,gBAAwB;IACvD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC/C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IACtB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;uDACmD,EACnD,CAAC,KAAK,CAAC,CACR,CAAA;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAE,GAAgC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;AACjG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,2FAA2F,EAC3F,CAAC,KAAK,CAAC,CACR,CAAA;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,MAAyB;IAEzB,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAA;YAC7E,MAAM,CAAC,KAAK,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAgC,EAAE,CAAC,IAAI,CAAC,CAAA;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,8FAA8F,CAC/F,CAAA;IACD,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC;QAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,EAAe,EAAE,CAAA;IAC7B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC/C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAA8C,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACpB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;+BAE2B,CAC5B,CAAA;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAA;IACzD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAiC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,OAAO,GAAkB;YAC7B,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC3B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACtB,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtD,qBAAqB,EAAE,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC;SACzD,CAAA;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClB,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAiC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzB,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YACpB,aAAa,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI;YAC1C,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACtB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,EAAE;YAC5C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,EAAE;YAC5C,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;YAChC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;SACvC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAa,EACb,OAA0B;IAE1B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,cAAc,CAAC,CAAA;IAC3F,OAAO,MAAM,CAAC,IAAmB,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAiB,EAAE,CAAA;IAChC,MAAM,MAAM,GAAgF;QAC1F,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3E,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3E,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE;QACzF,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;QACzE;YACE,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,eAAe;SACxB;QACD,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;QACpF,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE;KAC3E,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/B,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;YAChC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,SAAQ;QACV,CAAC;QACD,iEAAiE;QACjE,sBAAsB;QACtB,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,oBAAoB,KAAK,CAAC,KAAK;iBACpB,KAAK,CAAC,MAAM;yCACY,KAAK,CAAC,MAAM,qBAAqB,KAAK,CAAC,MAAM,GAAG,CACpF,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAyB,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,yBAAyB,KAAK,CAAC,MAAM,MAAM;aAClF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9E,CAAC"}

package/dist/importer/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Importer manifest (issue #50): every row created and every field
+ * changed, so `rollback` is exact. The manifest is the run's contract —
+ * `verify`, `rollback`, and `finalize` all read it.
+ */
+export type CreatedRow = {
+    /** Target collection slug. */
+    readonly collection: string;
+    /** Payload document id of the created row. */
+    readonly id: string | number;
+    /** The source identity this row was created for (dedupe on resume). */
+    readonly sourceKey: string;
+};
+export type FieldWrite = {
+    readonly collection: string;
+    readonly id: string | number;
+    readonly field: string;
+    /** The prior value, JSON-serialized, restored by rollback. */
+    readonly before: string | null;
+};
+export type ImportManifest = {
+    readonly version: 1;
+    readonly createdAt: string;
+    readonly sourceDatabase: string;
+    readonly options: {
+        readonly sessions: 'carry' | 'drop';
+    };
+    readonly created: CreatedRow[];
+    readonly fieldWrites: FieldWrite[];
+    readonly finalized: boolean;
+    /** Counts per source table at plan time (the rollback baseline). */
+    readonly sourceCounts: Readonly<Record<string, number>>;
+    /** Cumulative plan totals (rows created + skipped across resumes). */
+    readonly totals: Readonly<Record<string, number>>;
+};
+/** Per-model plan row for the dry run. */
+export type PlanRow = {
+    readonly model: string;
+    readonly sourceTable: string;
+    readonly targetCollection: string;
+    readonly rows: number;
+    readonly skipped: number;
+    readonly unmappable: readonly string[];
+};
+/** Why a row cannot be imported — the run aborts rather than skips. */
+export type Unmappable = {
+    readonly model: string;
+    readonly key: string;
+    readonly reason: string;
+};
+export type ImportPlan = {
+    readonly rows: readonly PlanRow[];
+    readonly unmappable: readonly Unmappable[];
+    readonly sessions: 'carry' | 'drop';
+    readonly warnings: readonly string[];
+};
+export type ImportResult = {
+    readonly created: number;
+    readonly skipped: number;
+    readonly fieldWrites: number;
+    readonly plan: ImportPlan;
+};
+/** The models the importer copies. */
+export type TargetModel = 'user' | 'session' | 'account' | 'verification' | 'apikey' | 'jwks' | 'organization' | 'member' | 'invitation';
+/** Target slugs with the known models always present (index-safe). */
+export type TargetSlugMap = Record<TargetModel, string> & Record<string, string>;
+/** Default target slugs; must match the app's engine wiring. */
+export declare const defaultTargetSlugs: TargetSlugMap;
+//# sourceMappingURL=types.d.ts.map

package/dist/importer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/importer/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;KACpC,CAAA;IACD,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD,CAAA;AAED,0CAA0C;AAC1C,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAED,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAA;IAC1C,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAC1B,CAAA;AAED,sCAAsC;AACtC,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,SAAS,GACT,cAAc,GACd,QAAQ,GACR,MAAM,GACN,cAAc,GACd,QAAQ,GACR,YAAY,CAAA;AAEhB,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEhF,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,EAAE,aAUhC,CAAA"}

package/dist/importer/types.js

@@ -0,0 +1,13 @@
+/** Default target slugs; must match the app's engine wiring. */
+export const defaultTargetSlugs = {
+    user: 'ba-users',
+    session: 'ba-sessions',
+    account: 'ba-accounts',
+    verification: 'ba-verifications',
+    apikey: 'ba-apikey',
+    jwks: 'ba-jwks',
+    organization: 'ba-organization',
+    member: 'ba-member',
+    invitation: 'ba-invitation',
+};
+//# sourceMappingURL=types.js.map

package/dist/importer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/importer/types.ts"],"names":[],"mappings":"AAoFA,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAkB;IAC/C,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,YAAY,EAAE,kBAAkB;IAChC,MAAM,EAAE,WAAW;IACnB,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,iBAAiB;IAC/B,MAAM,EAAE,WAAW;IACnB,UAAU,EAAE,eAAe;CAC5B,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Public API of `@payload-auth-link/migrate` (issues #49–#59). The
+ * CLI is the primary surface; these exports let tools and tests run
+ * the doctor in-process and consume its typed report.
+ */
+export { runDoctor, behaviourChanges, findPayloadAuthPlugin, betterAuthPluginIds, usersSlugOf, } from './doctor/run-doctor.js';
+export type { DoctorOptions } from './doctor/run-doctor.js';
+export { checkVersions, payloadBand, betterAuthBand, nextBand } from './doctor/bands.js';
+export { classifyPlugins } from './doctor/plugins.js';
+export { scanSource, projectedUserFields } from './doctor/source-scan.js';
+export { analyzeUsersCollection, findUsersCollection, localStrategyOn } from './doctor/users.js';
+export { introspectDatabase } from './doctor/database.js';
+export { runFromPayloadAuth, runVerify, runRollback, runFinalize } from './importer/run-import.js';
+export { applyImport, summarizePlanRows } from './importer/apply.js';
+export { readManifest, writeManifest, verifyImport, rollbackImport, finalizeManifest, defaultManifestPath, type VerifyIssue, type VerifyResult, } from './importer/lifecycle.js';
+export { defaultTargetSlugs, type CreatedRow, type TargetModel, type TargetSlugMap, type FieldWrite, type ImportManifest, type ImportPlan, type ImportResult, type PlanRow, type Unmappable, } from './importer/types.js';
+export { cliMain } from './cli.js';
+export type { BehaviourChange, DatabaseFinding, DoctorIssue, DoctorReport, PluginFinding, SourceFinding, UsersFinding, VersionFinding, } from './doctor/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,YAAY,EACV,eAAe,EACf,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * Public API of `@payload-auth-link/migrate` (issues #49–#59). The
+ * CLI is the primary surface; these exports let tools and tests run
+ * the doctor in-process and consume its typed report.
+ */
+export { runDoctor, behaviourChanges, findPayloadAuthPlugin, betterAuthPluginIds, usersSlugOf, } from './doctor/run-doctor.js';
+export { checkVersions, payloadBand, betterAuthBand, nextBand } from './doctor/bands.js';
+export { classifyPlugins } from './doctor/plugins.js';
+export { scanSource, projectedUserFields } from './doctor/source-scan.js';
+export { analyzeUsersCollection, findUsersCollection, localStrategyOn } from './doctor/users.js';
+export { introspectDatabase } from './doctor/database.js';
+export { runFromPayloadAuth, runVerify, runRollback, runFinalize } from './importer/run-import.js';
+export { applyImport, summarizePlanRows } from './importer/apply.js';
+export { readManifest, writeManifest, verifyImport, rollbackImport, finalizeManifest, defaultManifestPath, } from './importer/lifecycle.js';
+export { defaultTargetSlugs, } from './importer/types.js';
+export { cliMain } from './cli.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAClG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,GAUnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA"}

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@payload-auth-link/migrate",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "payload-auth-link migration kit: read-only doctor/preflight, the payload-auth importer, and exporters.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jellologic/payload-auth-link.git",
+    "directory": "packages/migrate"
+  },
+  "homepage": "https://github.com/jellologic/payload-auth-link/tree/main/packages/migrate#readme",
+  "bugs": {
+    "url": "https://github.com/jellologic/payload-auth-link/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "bin": {
+    "payload-auth-link-migrate": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "!dist/*.tsbuildinfo",
+    "src",
+    "!src/**/__tests__",
+    "!dist/**/__tests__",
+    "!dist/**/__fixtures__",
+    "!src/**/__fixtures__"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  },
+  "dependencies": {
+    "@payload-auth-link/core": "workspace:*",
+    "pg": "^8.16.3"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=20.9.0"
+  },
+  "devDependencies": {
+    "@better-auth/api-key": "1.7.7",
+    "@payload-auth-link/core": "workspace:*",
+    "@payload-auth-link/plugin": "workspace:*",
+    "@payload-auth-link/provider-better-auth": "workspace:*",
+    "@payloadcms/db-postgres": "3.90.2",
+    "@types/node": "^22",
+    "@types/pg": "^8.15.4",
+    "better-auth": "1.7.7",
+    "payload": "3.90.2"
+  },
+  "peerDependencies": {
+    "payload": "^3.83.0 || 4.0.0-beta.0"
+  },
+  "peerDependenciesMeta": {
+    "payload": {
+      "optional": false
+    }
+  }
+}

package/src/cli.ts

@@ -0,0 +1,287 @@
+#!/usr/bin/env bun
+/**
+ * The `@payload-auth-link/migrate` CLI (issues #49–#59). Today: the
+ * read-only `doctor` (#52). The importer and exporters ride the same
+ * entrypoint as they land (#50, #58).
+ *
+ * Exit codes: 0 clean, 1 blockers, 2 warnings only, 3 usage errors.
+ * Never logs credential material — connection strings print only in
+ * the `--json` echo of what the caller passed, and secrets inside them
+ * are the caller's own input.
+ */
+import { runDoctor } from './doctor/run-doctor.js'
+import type { DoctorReport } from './doctor/types.js'
+import {
+  runFinalize,
+  runFromPayloadAuth,
+  runRollback,
+  runVerify,
+  type ImportCommandOptions,
+} from './importer/run-import.js'
+
+type ParsedArgs = {
+  readonly command: string | null
+  readonly flags: ReadonlyMap<string, string | boolean>
+}
+
+function parseArgs(argv: readonly string[]): ParsedArgs {
+  const positional: string[] = []
+  const flags = new Map<string, string | boolean>()
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg: string | undefined = argv[index]
+    if (arg === undefined) {
+      continue
+    }
+    if (arg.startsWith('--')) {
+      const eq = arg.indexOf('=')
+      if (eq > 0) {
+        flags.set(arg.slice(2, eq), arg.slice(eq + 1))
+      } else {
+        const name = arg.slice(2)
+        const next: string | undefined = argv[index + 1]
+        if (next !== undefined && !next.startsWith('--')) {
+          flags.set(name, next)
+          index += 1
+        } else {
+          flags.set(name, true)
+        }
+      }
+    } else {
+      positional.push(arg)
+    }
+  }
+  return { command: positional[0] ?? null, flags }
+}
+
+function usage(): string {
+  return `@payload-auth-link/migrate — the payload-auth → payload-auth-link migration kit
+
+Commands:
+  doctor --config ./src/payload.config.ts [--src ./src] [--json] [--database-url URL]
+  from-payload-auth --config ./src/payload.config.ts [--apply] [--sessions=carry|drop]
+                    [--manifest ./payload-auth-link-migration.json] [--database-url URL] [--json]
+  verify            --config ./src/payload.config.ts [--database-url URL] [--json]
+  rollback          --config ./src/payload.config.ts [--manifest ...]
+  finalize          [--manifest ...]
+
+  doctor is read-only: it loads the config, inspects the users
+  collection and Better Auth plugins, scans sources for call sites
+  that must migrate, and (with a database URL) reports row counts,
+  unverified users, and orphans.
+
+  from-payload-auth is a DRY RUN by default: it prints planned row
+  counts per model, collisions, and anything unmappable. --apply
+  writes the payload-auth-link collections through the Payload Local
+  API, records every created row and field change in the manifest,
+  and never modifies the source tables. verify checks both sides;
+  rollback undoes exactly the manifest; finalize marks it read-only
+  so the legacy tables may be dropped later, in their own migration.
+
+Exit codes: 0 clean, 1 blockers/mismatch, 2 warnings only, 3 usage errors.
+`
+}
+
+function formatReport(report: DoctorReport): string {
+  const lines: string[] = []
+  lines.push('== versions ==')
+  for (const finding of report.versions) {
+    lines.push(
+      `${finding.status === 'ok' ? ' ok ' : finding.status === 'unknown' ? ' ?  ' : ' !! '} ${finding.name}: ${finding.installed ?? 'unresolved'} (band ${finding.band})`
+    )
+  }
+  lines.push('')
+  lines.push('== Better Auth plugins ==')
+  if (report.plugins.length === 0) {
+    lines.push('     none declared')
+  }
+  for (const finding of report.plugins) {
+    lines.push(`  -  ${finding.id}: ${finding.status} — ${finding.detail}`)
+  }
+  lines.push('')
+  lines.push('== users collection ==')
+  if (report.users === null) {
+    lines.push('     not found')
+  } else {
+    lines.push(`  slug: ${report.users.slug}`)
+    const role = report.users.roleField
+    if (role !== null) {
+      lines.push(
+        `  role field '${role.name}': ${role.type}${role.hasMany ? ' (hasMany)' : ''} values [${role.values.join(', ')}]${role.nonCanonical.length > 0 ? ` — NON-CANONICAL: ${role.nonCanonical.join(', ')}` : ''}`
+      )
+    } else {
+      lines.push('  role field: none found')
+    }
+    lines.push(`  local strategy: ${report.users.localStrategy ? 'ON' : 'off'}`)
+    if (report.users.collisions.length > 0) {
+      lines.push(`  collisions with injected fields: ${report.users.collisions.join(', ')}`)
+    }
+    for (const note of report.users.notes) {
+      lines.push(`  note: ${note}`)
+    }
+  }
+  lines.push('')
+  lines.push('== source scan ==')
+  if (report.source.length === 0) {
+    lines.push('     no migration call sites found')
+  }
+  for (const finding of report.source) {
+    lines.push(
+      `  -  ${finding.kind}: ${finding.files.length} file(s)${finding.fields.length > 0 ? ` (fields: ${finding.fields.join(', ')})` : ''}`
+    )
+    for (const file of finding.files.slice(0, 8)) {
+      lines.push(`        ${file}`)
+    }
+  }
+  lines.push('')
+  lines.push('== database ==')
+  if (report.database === null) {
+    lines.push('     not inspected')
+  } else {
+    for (const table of report.database.tables) {
+      lines.push(`  ${table.name}: ${table.rows}`)
+    }
+    if (report.database.unverifiedUsers !== null) {
+      lines.push(`  unverified users: ${report.database.unverifiedUsers}`)
+    }
+    for (const orphan of report.database.orphans) {
+      lines.push(`  ORPHANS ${orphan.kind}: ${orphan.count}`)
+    }
+  }
+  lines.push('')
+  lines.push('== behaviour changes that will bite (0.7.0) ==')
+  for (const change of report.behaviourChanges) {
+    lines.push(`  * ${change.title}: ${change.detail}`)
+  }
+  lines.push('')
+  lines.push('== blockers ==')
+  if (report.blockers.length === 0) {
+    lines.push('     none')
+  }
+  for (const issue of report.blockers) {
+    lines.push(`  [${issue.code}] ${issue.detail}`)
+  }
+  lines.push('')
+  lines.push('== warnings ==')
+  if (report.warnings.length === 0) {
+    lines.push('     none')
+  }
+  for (const issue of report.warnings) {
+    lines.push(`  [${issue.code}] ${issue.detail}`)
+  }
+  return lines.join('\n')
+}
+
+type StdSink = {
+  readonly write: (chunk: string) => void
+}
+
+async function main(
+  argv: readonly string[],
+  out: StdSink = process.stdout,
+  err: StdSink = process.stderr
+): Promise<number> {
+  const { command, flags } = parseArgs(argv)
+  if (command === null || command === 'help' || flags.get('help') === true) {
+    out.write(usage())
+    return command === null && argv.length === 0 ? 3 : 0
+  }
+  const importCommands = ['from-payload-auth', 'verify', 'rollback', 'finalize']
+  if (command !== 'doctor' && !importCommands.includes(command)) {
+    err.write(`unknown command '${command}'\n\n${usage()}`)
+    return 3
+  }
+  if (importCommands.includes(command)) {
+    const configFlag = flags.get('config')
+    if (typeof configFlag !== 'string' || configFlag === '') {
+      err.write(`${command} requires --config <path to payload.config.ts>\n`)
+      return 3
+    }
+    const databaseUrl =
+      typeof flags.get('database-url') === 'string'
+        ? (flags.get('database-url') as string)
+        : (process.env.DATABASE_URL ?? '')
+    if ((command === 'from-payload-auth' || command === 'verify') && databaseUrl === '') {
+      err.write(`${command} requires --database-url or DATABASE_URL\n`)
+      return 3
+    }
+    const sessionsFlag = flags.get('sessions')
+    const sessions = sessionsFlag === 'drop' ? ('drop' as const) : ('carry' as const)
+    const importOptions: ImportCommandOptions = {
+      configPath: new URL(configFlag, `file://${process.cwd()}/`).pathname,
+      databaseUrl,
+      apply: flags.get('apply') === true,
+      sessions,
+      ...(typeof flags.get('manifest') === 'string'
+        ? { manifestPath: flags.get('manifest') as string }
+        : {}),
+      ...(typeof flags.get('slugs') === 'string'
+        ? { slugsJson: flags.get('slugs') as string }
+        : {}),
+      json: flags.get('json') === true,
+    }
+    if (command === 'from-payload-auth') {
+      const outcome = await runFromPayloadAuth(importOptions)
+      if (outcome.plan.unmappable.length > 0) {
+        err.write(
+          `ABORT: ${outcome.plan.unmappable.length} unmappable row(s); nothing was silently skipped\n`
+        )
+        return 1
+      }
+      return 0
+    }
+    if (command === 'verify') {
+      const result = await runVerify(importOptions)
+      return result.ok ? 0 : 1
+    }
+    if (command === 'rollback') {
+      await runRollback(importOptions)
+      return 0
+    }
+    await runFinalize(importOptions)
+    return 0
+  }
+  const configPath = flags.get('config')
+  if (typeof configPath !== 'string' || configPath === '') {
+    err.write('doctor requires --config <path to payload.config.ts>\n')
+    return 3
+  }
+  const resolvedConfig = new URL(configPath, `file://${process.cwd()}/`).pathname
+  const srcFlag = flags.get('src')
+  const dbFlag = flags.get('database-url')
+  const report = await runDoctor({
+    configPath: resolvedConfig,
+    ...(typeof srcFlag === 'string'
+      ? { srcDir: new URL(srcFlag, `file://${process.cwd()}/`).pathname }
+      : {}),
+    ...(typeof dbFlag === 'string' ? { databaseUrl: dbFlag } : {}),
+  })
+  if (flags.get('json') === true) {
+    out.write(`${JSON.stringify(report, null, 2)}\n`)
+  } else {
+    out.write(`${formatReport(report)}\n`)
+  }
+  if (report.blockers.length > 0) {
+    return 1
+  }
+  if (report.warnings.length > 0) {
+    return 2
+  }
+  return 0
+}
+
+const invokedDirectly =
+  process.argv[1]?.endsWith('cli.js') === true || process.argv[1]?.endsWith('cli.ts') === true
+if (invokedDirectly) {
+  main(process.argv.slice(2))
+    .then((code) => {
+      process.exitCode = code
+    })
+    .catch((error: unknown) => {
+      process.stderr.write(
+        `doctor failed: ${error instanceof Error ? error.message : String(error)}\n`
+      )
+      process.exitCode = 1
+    })
+}
+
+export { main as cliMain }