@payload-auth-link/migrate 0.0.0-stage → 0.2.1

package/dist/importer/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/importer/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;GAKG;AAEH,eAAO,MAAM,mBAAmB,qCAAqC,CAAA;AAErE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAahE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAChF,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;CAC9D,GAAG,OAAO,CAAC,YAAY,CAAC,CA0NxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCjD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAOvF"}

package/dist/importer/lifecycle.js

@@ -0,0 +1,265 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+/**
+ * Manifest lifecycle (issue #50): `verify` checks both sides, `rollback`
+ * undoes exactly what the manifest records, and `finalize` marks the
+ * manifest so the source tables may be dropped — by the operator, as a
+ * separate later step.
+ */
+export const defaultManifestPath = 'payload-auth-link-migration.json';
+export function readManifest(path) {
+    if (!existsSync(path)) {
+        return null;
+    }
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        parsed.version !== 1) {
+        throw new Error(`manifest at ${path} is not a version-1 import manifest`);
+    }
+    return parsed;
+}
+export function writeManifest(manifest, path) {
+    writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+/**
+ * Verify (issue #50): per-model counts match, every source user has
+ * exactly one target row, every credential account resolves to its
+ * user, every API key carries its hash with a resolvable owner, and
+ * every member/invitation references an existing org and user. Exits
+ * non-zero on any mismatch (the caller maps `ok` to the exit code).
+ */
+export async function verifyImport(options) {
+    const { payload, sourceConnectionString } = options;
+    const slugs = {
+        ...{
+            user: 'ba-users',
+            account: 'ba-accounts',
+            session: 'ba-sessions',
+            apikey: 'ba-apikey',
+            organization: 'ba-organization',
+            member: 'ba-member',
+            invitation: 'ba-invitation',
+        },
+        ...(options.slugs ?? {}),
+    };
+    const issues = [];
+    const checks = [];
+    const check = (name, passed, detail) => {
+        checks.push({ name, passed });
+        if (!passed && detail !== undefined) {
+            issues.push({ code: 'verify-mismatch', detail });
+        }
+    };
+    const targetCounts = async (collection) => {
+        const counted = await payload.count({ collection, overrideAccess: true });
+        return counted.totalDocs;
+    };
+    // Source side, read directly.
+    const { openSource, readSourceUsers, countTables } = await import('./source.js');
+    const client = await openSource(sourceConnectionString);
+    try {
+        const sourceCounts = await countTables(client, [
+            'users',
+            'accounts',
+            'sessions',
+            'verifications',
+            'api_keys',
+            'jwks',
+            'organizations',
+            'members',
+            'invitations',
+        ]);
+        const users = await readSourceUsers(client);
+        // 1. per-model counts match (sessions only when carried).
+        const countPairs = [
+            ['users', String(slugs['user']), sourceCounts['users'] ?? 0],
+            ['accounts', String(slugs['account']), sourceCounts['accounts'] ?? 0],
+            ['api keys', String(slugs['apikey']), sourceCounts['api_keys'] ?? 0],
+            ['organizations', String(slugs['organization']), sourceCounts['organizations'] ?? 0],
+            ['members', String(slugs['member']), sourceCounts['members'] ?? 0],
+            ['invitations', String(slugs['invitation']), sourceCounts['invitations'] ?? 0],
+        ];
+        for (const [label, collection, expected] of countPairs) {
+            if (expected === 0) {
+                continue;
+            }
+            const actual = await targetCounts(collection);
+            check(`count ${label}`, actual >= expected, `expected >= ${expected} ${label} in ${collection}, found ${actual}`);
+        }
+        // 2. every source user has exactly one target row and its host doc.
+        let userMatches = 0;
+        let userIssues = 0;
+        for (const user of users) {
+            const found = await payload.find({
+                collection: String(slugs['user']),
+                where: { baId: { equals: user.id } },
+                limit: 2,
+                depth: 0,
+                pagination: false,
+                overrideAccess: true,
+            });
+            if (found.totalDocs !== 1) {
+                userIssues += 1;
+                continue;
+            }
+            userMatches += 1;
+        }
+        check('each source user has exactly one target row', userIssues === 0, `${userIssues} user(s) without exactly one ${String(slugs['user'])} row`);
+        void userMatches;
+        // 3. every credential account resolves to its user.
+        const accounts = await payload.find({
+            collection: String(slugs['account']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        const baUserIds = new Set();
+        const baUsers = await payload.find({
+            collection: String(slugs['user']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        for (const doc of baUsers.docs) {
+            baUserIds.add(String(doc.baId));
+        }
+        let orphanAccounts = 0;
+        let credentialAccounts = 0;
+        for (const doc of accounts.docs) {
+            const record = doc;
+            if (!baUserIds.has(String(record.userId))) {
+                orphanAccounts += 1;
+            }
+            if (record.providerId === 'credential') {
+                credentialAccounts += 1;
+                if (typeof record.password !== 'string' || record.password === '') {
+                    orphanAccounts += 1;
+                }
+            }
+        }
+        check('every account resolves to its user (credential hashes intact)', orphanAccounts === 0, `${orphanAccounts} account(s) with a missing user or empty credential hash`);
+        check('credential accounts carry hashes', sourceCounts.accounts === 0 || credentialAccounts > 0, 'no credential account carries a password hash');
+        // 4. API keys: hash present, owner resolves, rate-limit state kept.
+        const keys = await payload.find({
+            collection: String(slugs['apikey']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        let brokenKeys = 0;
+        for (const doc of keys.docs) {
+            const record = doc;
+            if (typeof record.key !== 'string' || record.key === '') {
+                brokenKeys += 1;
+                continue;
+            }
+            // The satellite's user reference is `referenceId` on BA 1.7's own
+            // schema and `userId` in 1.6-era layouts.
+            const owner = record.referenceId ?? record.userId;
+            if (!baUserIds.has(String(owner))) {
+                brokenKeys += 1;
+            }
+        }
+        check('every API key carries its hash and resolves to a user', brokenKeys === 0, `${brokenKeys} API key(s) without a hash or user`);
+        // 5. members/invitations reference existing orgs and users.
+        const orgIds = new Set();
+        const orgs = await payload.find({
+            collection: String(slugs['organization']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        for (const doc of orgs.docs) {
+            orgIds.add(String(doc.baId));
+        }
+        const members = await payload.find({
+            collection: String(slugs['member']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        let brokenMembers = 0;
+        for (const doc of members.docs) {
+            const record = doc;
+            if (!orgIds.has(String(record.organizationId)) || !baUserIds.has(String(record.userId))) {
+                brokenMembers += 1;
+            }
+        }
+        check('every member references an existing org and user', brokenMembers === 0, `${brokenMembers} member(s) with dangling references`);
+        const invitations = await payload.find({
+            collection: String(slugs['invitation']),
+            limit: 1000,
+            depth: 0,
+            pagination: false,
+            overrideAccess: true,
+        });
+        let brokenInvitations = 0;
+        for (const doc of invitations.docs) {
+            const record = doc;
+            if (!orgIds.has(String(record.organizationId))) {
+                brokenInvitations += 1;
+            }
+        }
+        check('every invitation references an existing org', brokenInvitations === 0, `${brokenInvitations} invitation(s) with dangling references`);
+    }
+    finally {
+        await client.end();
+    }
+    return { ok: issues.length === 0, issues, checks };
+}
+/**
+ * Rollback (issue #50): delete the created rows in reverse order and
+ * restore every captured field value. The manifest records exactly
+ * what to undo — nothing else is touched, and the source tables were
+ * never modified.
+ */
+export async function rollbackImport(options) {
+    const { payload, manifest, log = () => { } } = options;
+    if (manifest.finalized) {
+        // The point of no return: after `finalize`, the manifest's rows are
+        // the migration's history, not a TODO to undo.
+        throw new Error('the migration is finalized; rollback is no longer possible');
+    }
+    let deleted = 0;
+    for (const row of [...manifest.created].reverse()) {
+        try {
+            await payload.delete({ collection: row.collection, id: row.id, overrideAccess: true });
+            deleted += 1;
+        }
+        catch {
+            // Already gone (a crash after delete, a manual cleanup) — the
+            // goal state is "row absent", so absence is success.
+            log(`rollback: ${row.collection}#${row.id} already absent`);
+        }
+    }
+    let restored = 0;
+    for (const write of manifest.fieldWrites) {
+        const data = {
+            [write.field]: write.before === null ? null : JSON.parse(write.before),
+        };
+        await payload.update({
+            collection: write.collection,
+            id: write.id,
+            data,
+            overrideAccess: true,
+        });
+        restored += 1;
+    }
+    log(`rollback: ${deleted} row(s) deleted, ${restored} field value(s) restored`);
+    return { deleted, restored };
+}
+/** Finalize (issue #50): the point of no return — mark the manifest. */
+export function finalizeManifest(manifest, path) {
+    if (manifest.finalized) {
+        return manifest;
+    }
+    const finalized = { ...manifest, finalized: true };
+    writeManifest(finalized, path);
+    return finalized;
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/importer/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/importer/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAIjE;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,kCAAkC,CAAA;AAErE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAAgC,CAAC,OAAO,KAAK,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,qCAAqC,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,MAAwB,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAwB,EAAE,IAAY;IAClE,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAIlC;IACC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAA;IACnD,MAAM,KAAK,GAA2B;QACpC,GAAG;YACD,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,iBAAiB;YAC/B,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,eAAe;SAC5B;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;KACzB,CAAA;IACD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,MAAM,GAAwC,EAAE,CAAA;IACtD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAe,EAAE,MAAe,EAAQ,EAAE;QACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,UAAkB,EAAmB,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;QACzE,OAAO,OAAO,CAAC,SAAS,CAAA;IAC1B,CAAC,CAAA;IAED,8BAA8B;IAC9B,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,sBAAsB,CAAC,CAAA;IACvD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;YAC7C,OAAO;YACP,UAAU;YACV,UAAU;YACV,eAAe;YACf,UAAU;YACV,MAAM;YACN,eAAe;YACf,SAAS;YACT,aAAa;SACd,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;QAE3C,0DAA0D;QAC1D,MAAM,UAAU,GAAwC;YACtD,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;SAC/E,CAAA;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC;YACvD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAC7C,KAAK,CACH,SAAS,KAAK,EAAE,EAChB,MAAM,IAAI,QAAQ,EAClB,eAAe,QAAQ,IAAI,KAAK,OAAO,UAAU,WAAW,MAAM,EAAE,CACrE,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAC/B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;gBACpC,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC;gBACR,UAAU,EAAE,KAAK;gBACjB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAA;YACF,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;gBAC1B,UAAU,IAAI,CAAC,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,WAAW,IAAI,CAAC,CAAA;QAClB,CAAC;QACD,KAAK,CACH,6CAA6C,EAC7C,UAAU,KAAK,CAAC,EAChB,GAAG,UAAU,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CACzE,CAAA;QACD,KAAK,WAAW,CAAA;QAEhB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,MAAM,CAAE,GAA+B,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1C,cAAc,IAAI,CAAC,CAAA;YACrB,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;gBACvC,kBAAkB,IAAI,CAAC,CAAA;gBACvB,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;oBAClE,cAAc,IAAI,CAAC,CAAA;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CACH,+DAA+D,EAC/D,cAAc,KAAK,CAAC,EACpB,GAAG,cAAc,0DAA0D,CAC5E,CAAA;QACD,KAAK,CACH,kCAAkC,EAClC,YAAY,CAAC,QAAQ,KAAK,CAAC,IAAI,kBAAkB,GAAG,CAAC,EACrD,+CAA+C,CAChD,CAAA;QAED,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxD,UAAU,IAAI,CAAC,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAA;YACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClC,UAAU,IAAI,CAAC,CAAA;YACjB,CAAC;QACH,CAAC;QACD,KAAK,CACH,uDAAuD,EACvD,UAAU,KAAK,CAAC,EAChB,GAAG,UAAU,oCAAoC,CAClD,CAAA;QAED,4DAA4D;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACzC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAE,GAA+B,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,IAAI,aAAa,GAAG,CAAC,CAAA;QACrB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACxF,aAAa,IAAI,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QACD,KAAK,CACH,kDAAkD,EAClD,aAAa,KAAK,CAAC,EACnB,GAAG,aAAa,qCAAqC,CACtD,CAAA;QACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvC,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,CAAC;YACR,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,IAAI,iBAAiB,GAAG,CAAC,CAAA;QACzB,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC/C,iBAAiB,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QACD,KAAK,CACH,6CAA6C,EAC7C,iBAAiB,KAAK,CAAC,EACvB,GAAG,iBAAiB,yCAAyC,CAC9D,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;IACpB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAIpC;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,qDAAqD;YACrD,GAAG,CAAC,aAAa,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,GAA4B;YACpC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAa;SACpF,CAAA;QACD,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI;YACJ,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACF,QAAQ,IAAI,CAAC,CAAA;IACf,CAAC;IACD,GAAG,CAAC,aAAa,OAAO,oBAAoB,QAAQ,0BAA0B,CAAC,CAAA;IAC/E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,QAAwB,EAAE,IAAY;IACrE,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,SAAS,GAAmB,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAClE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC9B,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/importer/run-import.d.ts

@@ -0,0 +1,40 @@
+import { type VerifyResult } from './lifecycle.js';
+import { type ImportManifest, type ImportPlan, type ImportResult } from './types.js';
+/**
+ * The import commands (issue #50): `from-payload-auth` (dry-run by
+ * default, `--apply` writes), `verify`, `rollback`, `finalize`.
+ *
+ * Dry run prints planned row counts per model, collisions, and
+ * anything unmappable; unmappable data aborts `--apply` before any
+ * write. The manifest records every created row and field change;
+ * source tables are never modified — `finalize` only marks the
+ * manifest, and dropping them stays the operator's later step.
+ */
+export type ImportCommandOptions = {
+    readonly configPath: string;
+    readonly databaseUrl: string;
+    readonly apply: boolean;
+    readonly sessions: 'carry' | 'drop';
+    readonly manifestPath?: string | undefined;
+    readonly slugsJson?: string | undefined;
+    readonly json?: boolean;
+    readonly log?: (message: string) => void;
+    readonly loadPayload?: (configPath: string) => Promise<import('payload').Payload>;
+};
+/** The `from-payload-auth` command: dry-run plan, or `--apply` + manifest. */
+export declare function runFromPayloadAuth(options: ImportCommandOptions): Promise<{
+    exitCode: number;
+    result?: ImportResult;
+    plan: ImportPlan;
+    unverified: readonly string[];
+}>;
+/** The `verify` command. */
+export declare function runVerify(options: ImportCommandOptions): Promise<VerifyResult>;
+/** The `rollback` command. */
+export declare function runRollback(options: ImportCommandOptions): Promise<{
+    deleted: number;
+    restored: number;
+}>;
+/** The `finalize` command. */
+export declare function runFinalize(options: ImportCommandOptions): Promise<ImportManifest>;
+//# sourceMappingURL=run-import.d.ts.map

package/dist/importer/run-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-import.d.ts","sourceRoot":"","sources":["../../src/importer/run-import.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EAElB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;GASG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,SAAS,EAAE,OAAO,CAAC,CAAA;CAClF,CAAA;AA8DD,8EAA8E;AAC9E,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B,CAAC,CA0ED;AAED,4BAA4B;AAC5B,wBAAsB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBpF;AAED,8BAA8B;AAC9B,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAahD;AAED,8BAA8B;AAC9B,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAYlF"}

package/dist/importer/run-import.js

@@ -0,0 +1,176 @@
+import { isRecord } from '@payload-auth-link/core';
+import { pathToFileURL } from 'node:url';
+import { applyImport, summarizePlanRows } from './apply.js';
+import { defaultManifestPath, finalizeManifest, readManifest, rollbackImport, verifyImport, } from './lifecycle.js';
+import { countTables, findOrphans, openSource, unverifiedEmails } from './source.js';
+import { defaultTargetSlugs, } from './types.js';
+const log_ = (options) => options.log ?? (() => { });
+async function loadPayloadInstance(configPath) {
+    // Lazy: `doctor` never needs Payload, and a cold CLI should not pay
+    // for the module graph the import commands use.
+    const { getPayload } = await import('payload');
+    const mod = (await import(pathToFileURL(configPath).href));
+    let config = isRecord(mod) && 'default' in mod ? mod.default : mod;
+    if (typeof config?.then === 'function') {
+        config = await config;
+    }
+    return getPayload({ config: config });
+}
+function slugsOf(options) {
+    if (options.slugsJson === undefined) {
+        return { ...defaultTargetSlugs };
+    }
+    const parsed = JSON.parse(options.slugsJson);
+    if (!isRecord(parsed)) {
+        throw new Error('--slugs must be a JSON object of model -> collection slug');
+    }
+    return { ...defaultTargetSlugs, ...parsed };
+}
+/** Plan-only pass: counts, orphans, unverified users, warnings. */
+async function buildPlan(options) {
+    const client = await openSource(options.databaseUrl);
+    try {
+        const sourceCounts = await countTables(client, [
+            'users',
+            'accounts',
+            'sessions',
+            'verifications',
+            'api_keys',
+            'jwks',
+            'organizations',
+            'members',
+            'invitations',
+            'users_role',
+        ]);
+        const orphans = await findOrphans(client);
+        return {
+            sourceCounts,
+            plan: {
+                rows: [],
+                unmappable: orphans,
+                sessions: options.sessions,
+                warnings: [],
+            },
+        };
+    }
+    finally {
+        await client.end();
+    }
+}
+/** The `from-payload-auth` command: dry-run plan, or `--apply` + manifest. */
+export async function runFromPayloadAuth(options) {
+    const log = log_(options);
+    const slugs = slugsOf(options);
+    const { plan: basePlan, sourceCounts } = await buildPlan(options);
+    const unverified = await (async () => {
+        const client = await openSource(options.databaseUrl);
+        try {
+            const { readSourceUsers } = await import('./source.js');
+            return unverifiedEmails(await readSourceUsers(client));
+        }
+        finally {
+            await client.end();
+        }
+    })();
+    if (basePlan.unmappable.length > 0) {
+        // Unmappable data aborts the run — nothing is silently skipped.
+        const plan = {
+            ...basePlan,
+            warnings: [
+                ...basePlan.warnings,
+                `${unverified.length} unverified user(s) will NOT be granted the linkable proof`,
+            ],
+        };
+        if (options.apply) {
+            log('ABORT: unmappable rows present; nothing was written');
+            return { exitCode: 1, plan, unverified };
+        }
+        return { exitCode: 1, plan, unverified };
+    }
+    const manifestPath = options.manifestPath ?? defaultManifestPath;
+    const existingManifest = readManifest(manifestPath);
+    const payload = await (options.loadPayload ?? loadPayloadInstance)(options.configPath);
+    const result = await applyImport({
+        payload,
+        sourceConnectionString: options.databaseUrl,
+        apply: options.apply,
+        sessions: options.sessions,
+        manifest: existingManifest,
+        manifestPath,
+        sourceCounts,
+        sourceDatabase: options.databaseUrl.replace(/\/\/[^@]*@/, '//***@'),
+        slugs,
+        log,
+    });
+    const plan = {
+        ...result.plan,
+        warnings: [
+            ...result.plan.warnings,
+            `${unverified.length} unverified user(s) will NOT be granted the linkable proof`,
+        ],
+    };
+    if (!options.json) {
+        for (const row of summarizePlanRows(result.plan.rows)) {
+            log(`  ${row.model.padEnd(14)} ${String(row.rows).padStart(5)} row(s) -> ${row.targetCollection}${row.skipped > 0 ? ` (${row.skipped} already present)` : ''}`);
+        }
+        for (const warning of plan.warnings) {
+            log(`  ! ${warning}`);
+        }
+        for (const row of plan.unmappable) {
+            log(`  X ${row.model} #${row.key}: ${row.reason}`);
+        }
+    }
+    return {
+        exitCode: result.plan.unmappable.length > 0 ? 1 : 0,
+        result,
+        plan,
+        unverified,
+    };
+}
+/** The `verify` command. */
+export async function runVerify(options) {
+    const log = log_(options);
+    const payload = await (options.loadPayload ?? loadPayloadInstance)(options.configPath);
+    const result = await verifyImport({
+        payload,
+        sourceConnectionString: options.databaseUrl,
+        slugs: slugsOf(options),
+    });
+    if (!options.json) {
+        for (const check of result.checks) {
+            log(`  ${check.passed ? 'ok ' : 'FAIL'} ${check.name}`);
+        }
+        for (const issue of result.issues) {
+            log(`  [${issue.code}] ${issue.detail}`);
+        }
+    }
+    return result;
+}
+/** The `rollback` command. */
+export async function runRollback(options) {
+    const log = log_(options);
+    const manifestPath = options.manifestPath ?? defaultManifestPath;
+    const manifest = readManifest(manifestPath);
+    if (manifest === null) {
+        throw new Error(`no manifest at ${manifestPath}; nothing to roll back`);
+    }
+    if (manifest.finalized) {
+        throw new Error('the migration is finalized; rollback is no longer possible');
+    }
+    const payload = await (options.loadPayload ?? loadPayloadInstance)(options.configPath);
+    const result = await rollbackImport({ payload, manifest, log });
+    return result;
+}
+/** The `finalize` command. */
+export function runFinalize(options) {
+    const log = log_(options);
+    const manifestPath = options.manifestPath ?? defaultManifestPath;
+    const manifest = readManifest(manifestPath);
+    if (manifest === null) {
+        return Promise.reject(new Error(`no manifest at ${manifestPath}; run --apply first`));
+    }
+    const finalized = finalizeManifest(manifest, manifestPath);
+    log(`finalized: the manifest at ${manifestPath} is now read-only. Legacy tables may be dropped in a separate, later migration — nothing is dropped for you.`);
+    return Promise.resolve(finalized);
+}
+//# sourceMappingURL=run-import.js.map

package/dist/importer/run-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-import.js","sourceRoot":"","sources":["../../src/importer/run-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC3D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,YAAY,GAEb,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACpF,OAAO,EACL,kBAAkB,GAKnB,MAAM,YAAY,CAAA;AAyBnB,MAAM,IAAI,GAAG,CAAC,OAA6B,EAA+B,EAAE,CAC1E,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AAE3B,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAyB,CAAA;IAClF,IAAI,MAAM,GAAY,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3E,IAAI,OAAQ,MAAgD,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,GAAG,MAAM,MAAM,CAAA;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,MAAoD,EAAE,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,OAAO,CAAC,OAA6B;IAC5C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,kBAAkB,EAAE,GAAI,MAAiC,EAAE,CAAA;AACzE,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,SAAS,CAAC,OAA6B;IAIpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;YAC7C,OAAO;YACP,UAAU;YACV,UAAU;YACV,eAAe;YACf,UAAU;YACV,MAAM;YACN,eAAe;YACf,SAAS;YACT,aAAa;YACb,YAAY;SACb,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO;YACL,YAAY;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE;gBACR,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,EAAE;aACb;SACF,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;IACpB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA6B;IAMpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;IAEjE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YACvD,OAAO,gBAAgB,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,gEAAgE;QAChE,MAAM,IAAI,GAAe;YACvB,GAAG,QAAQ;YACX,QAAQ,EAAE;gBACR,GAAG,QAAQ,CAAC,QAAQ;gBACpB,GAAG,UAAU,CAAC,MAAM,4DAA4D;aACjF;SACF,CAAA;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,GAAG,CAAC,qDAAqD,CAAC,CAAA;YAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;QAC1C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,OAAO;QACP,sBAAsB,EAAE,OAAO,CAAC,WAAW;QAC3C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,YAAY;QACZ,YAAY;QACZ,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC;QACnE,KAAK;QACL,GAAG;KACJ,CAAC,CAAA;IACF,MAAM,IAAI,GAAe;QACvB,GAAG,MAAM,CAAC,IAAI;QACd,QAAQ,EAAE;YACR,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ;YACvB,GAAG,UAAU,CAAC,MAAM,4DAA4D;SACjF;KACF,CAAA;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,GAAG,CACD,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3J,CAAA;QACH,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAA;QACvB,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM;QACN,IAAI;QACJ,UAAU;KACX,CAAA;AACH,CAAC;AAED,4BAA4B;AAC5B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA6B;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,OAAO;QACP,sBAAsB,EAAE,OAAO,CAAC,WAAW;QAC3C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACzB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,wBAAwB,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,WAAW,CAAC,OAA6B;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IACzB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,YAAY,qBAAqB,CAAC,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC1D,GAAG,CACD,8BAA8B,YAAY,8GAA8G,CACzJ,CAAA;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACnC,CAAC"}

package/dist/importer/source.d.ts

@@ -0,0 +1,49 @@
+import { Client } from 'pg';
+import type { Unmappable } from './types.js';
+/**
+ * Read side (issue #50): the payload-auth layout, straight from
+ * Postgres. Rows are read with plain SELECTs — the source tables are
+ * never modified until `finalize` (which only marks the manifest; the
+ * drop itself stays the operator's step).
+ */
+/** One payload-auth source user with its role rows and accounts. */
+export type SourceUser = {
+    readonly id: string;
+    readonly email: string;
+    readonly name: string | null;
+    readonly emailVerified: boolean;
+    readonly image: string | null;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+    /** Stored role values from the `users_role` child table. */
+    readonly roles: readonly string[];
+    readonly accounts: readonly SourceAccount[];
+};
+export type SourceAccount = {
+    readonly id: string;
+    readonly accountId: string;
+    readonly providerId: string;
+    readonly password: string | null;
+    readonly accessToken: string | null;
+    readonly refreshToken: string | null;
+    readonly idToken: string | null;
+    readonly scope: string | null;
+    readonly accessTokenExpiresAt: Date | null;
+    readonly refreshTokenExpiresAt: Date | null;
+};
+export type SourceRow = Record<string, unknown>;
+export declare function openSource(connectionString: string): Promise<Client>;
+export declare function countTables(client: Client, tables: readonly string[]): Promise<Record<string, number>>;
+/** Every source user, with role rows and accounts attached. */
+export declare function readSourceUsers(client: Client): Promise<SourceUser[]>;
+/** Rows of one flat plugin table (sessions, verifications, apiKeys, jwks, …). */
+export declare function readFlatRows(client: Client, table: string, columns: readonly string[]): Promise<SourceRow[]>;
+/**
+ * Members and invitations reference organizations and users by numeric
+ * id; the importer remaps to the target's baIds. Orphaned references
+ * are unmappable — they abort the run rather than skip silently.
+ */
+export declare function findOrphans(client: Client): Promise<readonly Unmappable[]>;
+/** Users whose email never verified — reported, never granted `linkable`. */
+export declare function unverifiedEmails(users: readonly SourceUser[]): readonly string[];
+//# sourceMappingURL=source.d.ts.map

package/dist/importer/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/importer/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;GAKG;AAEH,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,IAAI,GAAG,IAAI,CAAA;CAC5C,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,wBAAsB,UAAU,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAoBD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWjC;AAUD,+DAA+D;AAC/D,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsD3E;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC,CAMtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CA2ChF;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,MAAM,EAAE,CAEhF"}