@payload-auth-link/migrate 0.3.0 → 0.4.0

package/src/importer/run-import.ts

@@ -9,12 +9,24 @@ import {
   verifyImport,
   type VerifyResult,
 } from './lifecycle.js'
-import { countTables, findOrphans, openSource, unverifiedEmails } from './source.js'
+import {
+  countTables,
+  findOrphans,
+  openSource,
+  probeSourceLayout,
+  readSourceUsers,
+  unverifiedEmails,
+  type SourceLayoutIssue,
+} from './source.js'
 import {
   defaultTargetSlugs,
+  parseSourceMapJson,
+  presentTables,
+  resolveSourceTables,
   type ImportManifest,
   type ImportPlan,
   type ImportResult,
+  type ResolvedSourceTables,
   type TargetSlugMap,
 } from './types.js'
 
@@ -36,12 +48,18 @@ export type ImportCommandOptions = {
   readonly sessions: 'carry' | 'drop'
   readonly manifestPath?: string | undefined
   readonly slugsJson?: string | undefined
+  /**
+   * The `--source-map` JSON (issue #68): model → source table name, or
+   * `null` for "model not installed". Missing mapped tables abort the
+   * run before anything is written without it.
+   */
+  readonly sourceMapJson?: string | undefined
   readonly json?: boolean
   readonly log?: (message: string) => void
   readonly loadPayload?: (configPath: string) => Promise<import('payload').Payload>
 }
 
-const log_ = (options: ImportCommandOptions): ((message: string) => void) =>
+const log_ = (options: Pick<ImportCommandOptions, 'log'>): ((message: string) => void) =>
   options.log ?? (() => {})
 
 async function loadPayloadInstance(configPath: string): Promise<import('payload').Payload> {
@@ -67,33 +85,53 @@ function slugsOf(options: ImportCommandOptions): TargetSlugMap {
   return { ...defaultTargetSlugs, ...(parsed as Record<string, string>) }
 }
 
+/** The resolved source layout (`--source-map` over the default layout). */
+function sourceTablesOf(options: ImportCommandOptions): ResolvedSourceTables {
+  return resolveSourceTables(
+    options.sourceMapJson === undefined ? undefined : parseSourceMapJson(options.sourceMapJson)
+  )
+}
+
+/**
+ * Fail-closed probe (issue #68): runs FIRST, before any plan, read, or
+ * Payload boot. Findings come back as unmappable rows — the caller's
+ * exit-1 path — so nothing is silently read as empty.
+ */
+async function probeOrFail(
+  options: ImportCommandOptions,
+  log: (message: string) => void
+): Promise<readonly SourceLayoutIssue[]> {
+  const client = await openSource(options.databaseUrl)
+  try {
+    const issues = await probeSourceLayout(client, sourceTablesOf(options))
+    for (const issue of issues) {
+      log(`  X ${issue.model}: ${issue.reason}`)
+    }
+    return issues
+  } finally {
+    await client.end()
+  }
+}
+
 /** Plan-only pass: counts, orphans, unverified users, warnings. */
-async function buildPlan(options: ImportCommandOptions): Promise<{
+async function buildPlan(
+  options: ImportCommandOptions,
+  sourceTables: ResolvedSourceTables
+): Promise<{
   plan: ImportPlan
   sourceCounts: Record<string, number>
 }> {
   const client = await openSource(options.databaseUrl)
   try {
-    const sourceCounts = await countTables(client, [
-      'users',
-      'accounts',
-      'sessions',
-      'verifications',
-      'api_keys',
-      'jwks',
-      'organizations',
-      'members',
-      'invitations',
-      'users_role',
-    ])
-    const orphans = await findOrphans(client)
+    const sourceCounts = await countTables(client, presentTables(sourceTables))
+    const { orphans, skipped } = await findOrphans(client, sourceTables)
     return {
       sourceCounts,
       plan: {
         rows: [],
         unmappable: orphans,
         sessions: options.sessions,
-        warnings: [],
+        warnings: skipped.map((reason) => `orphan check ${reason}`),
       },
     }
   } finally {
@@ -110,13 +148,34 @@ export async function runFromPayloadAuth(options: ImportCommandOptions): Promise
 }> {
   const log = log_(options)
   const slugs = slugsOf(options)
-  const { plan: basePlan, sourceCounts } = await buildPlan(options)
+  const sourceTables = sourceTablesOf(options)
+
+  // The probe runs before anything else (issue #68): a missing mapped
+  // table or column aborts here — exit 1, nothing planned or written.
+  const probeIssues = await probeOrFail(options, log)
+  if (probeIssues.length > 0) {
+    return {
+      exitCode: 1,
+      plan: {
+        rows: [],
+        unmappable: probeIssues.map((issue) => ({
+          model: issue.model,
+          key: issue.key,
+          reason: issue.reason,
+        })),
+        sessions: options.sessions,
+        warnings: [],
+      },
+      unverified: [],
+    }
+  }
+
+  const { plan: basePlan, sourceCounts } = await buildPlan(options, sourceTables)
 
   const unverified = await (async () => {
     const client = await openSource(options.databaseUrl)
     try {
-      const { readSourceUsers } = await import('./source.js')
-      return unverifiedEmails(await readSourceUsers(client))
+      return unverifiedEmails(await readSourceUsers(client, sourceTables))
     } finally {
       await client.end()
     }
@@ -152,6 +211,7 @@ export async function runFromPayloadAuth(options: ImportCommandOptions): Promise
     sourceCounts,
     sourceDatabase: options.databaseUrl.replace(/\/\/[^@]*@/, '//***@'),
     slugs,
+    sourceTables,
     log,
   })
   const plan: ImportPlan = {
@@ -186,11 +246,34 @@ export async function runFromPayloadAuth(options: ImportCommandOptions): Promise
 /** The `verify` command. */
 export async function runVerify(options: ImportCommandOptions): Promise<VerifyResult> {
   const log = log_(options)
+
+  // The probe runs first (issue #68): a missing mapped table fails the
+  // check with a blocker — before any Payload boot or read.
+  const probeIssues = await probeOrFail(options, log)
+  if (probeIssues.length > 0) {
+    const result: VerifyResult = {
+      ok: false,
+      issues: probeIssues.map((issue) => ({
+        code: 'source-table-missing',
+        detail: issue.reason,
+      })),
+      checks: [],
+    }
+    if (!options.json) {
+      for (const issue of result.issues) {
+        log(`  [${issue.code}] ${issue.detail}`)
+      }
+    }
+    return result
+  }
+
   const payload = await (options.loadPayload ?? loadPayloadInstance)(options.configPath)
   const result = await verifyImport({
     payload,
     sourceConnectionString: options.databaseUrl,
     slugs: slugsOf(options),
+    sourceTables: sourceTablesOf(options),
+    sessions: options.sessions,
   })
   if (!options.json) {
     for (const check of result.checks) {
@@ -221,8 +304,10 @@ export async function runRollback(
   return result
 }
 
-/** The `finalize` command. */
-export function runFinalize(options: ImportCommandOptions): Promise<ImportManifest> {
+/** The `finalize` command — manifest-only; no Payload instance is loaded. */
+export function runFinalize(
+  options: Pick<ImportCommandOptions, 'manifestPath' | 'log'>
+): Promise<ImportManifest> {
   const log = log_(options)
   const manifestPath = options.manifestPath ?? defaultManifestPath
   const manifest = readManifest(manifestPath)

package/src/importer/source.ts

@@ -1,11 +1,22 @@
 import { Client } from 'pg'
-import type { Unmappable } from './types.js'
+import {
+  defaultSourceTables,
+  type ResolvedSourceTables,
+  type SourceModel,
+  type Unmappable,
+} from './types.js'
 
 /**
  * Read side (issue #50): the payload-auth layout, straight from
  * Postgres. Rows are read with plain SELECTs — the source tables are
  * never modified until `finalize` (which only marks the manifest; the
  * drop itself stays the operator's step).
+ *
+ * Fail closed (issue #68): nothing here tolerates a missing table.
+ * `probeSourceLayout` is the gate — the run commands call it first and
+ * abort on any finding — so every read below assumes the mapped tables
+ * exist and throws if they don't. A customized layout renames tables
+ * with `--source-map`, never with silent skips.
  */
 
 /** One payload-auth source user with its role rows and accounts. */
@@ -37,6 +48,34 @@ export type SourceAccount = {
 
 export type SourceRow = Record<string, unknown>
 
+/** One fail-closed finding: a mapped model's table or column is absent. */
+export type SourceLayoutIssue = {
+  readonly model: SourceModel
+  /** The table (or `table.column`) the probe looked for. */
+  readonly key: string
+  /** Human reason, naming the table and the `--source-map` escape hatch. */
+  readonly reason: string
+}
+
+/**
+ * The columns each model's reads dereference (issue #68). A layout
+ * missing any of these cannot be imported faithfully — the probe
+ * blocks on it instead of letting the SELECT fail mid-run (or worse,
+ * silently store `undefined`-derived values).
+ */
+const requiredColumns: Readonly<Record<SourceModel, readonly string[]>> = {
+  users: ['id', 'email', 'email_verified'],
+  accounts: ['id', 'account_id', 'provider_id', 'user_id'],
+  sessions: ['id', 'user_id', 'token', 'expires_at'],
+  verifications: ['id', 'identifier', 'value', 'expires_at'],
+  api_keys: ['id', 'key', 'reference_id'],
+  jwks: ['id', 'public_key', 'private_key'],
+  organizations: ['id', 'name', 'slug'],
+  members: ['id', 'organization_id', 'user_id'],
+  invitations: ['id', 'organization_id', 'email'],
+  users_role: ['parent_id', 'value'],
+}
+
 export async function openSource(connectionString: string): Promise<Client> {
   const client = new Client({ connectionString })
   await client.connect()
@@ -61,18 +100,62 @@ async function tableExists(client: Client, table: string): Promise<boolean> {
   return result.rows.length > 0
 }
 
+/**
+ * Fail-closed probe (issue #68): every mapped model's table must
+ * exist (a `null` mapping records "not installed" and is skipped),
+ * and every column the reads dereference must be present. The run
+ * commands call this FIRST and abort on any finding — nothing is
+ * read, planned, or written past a failed probe.
+ */
+export async function probeSourceLayout(
+  client: Client,
+  tables: ResolvedSourceTables
+): Promise<readonly SourceLayoutIssue[]> {
+  const issues: SourceLayoutIssue[] = []
+  for (const model of Object.keys(defaultSourceTables) as SourceModel[]) {
+    const table = tables[model]
+    if (table === null) {
+      // Explicitly not installed: skipped by config, never an error.
+      continue
+    }
+    if (!(await tableExists(client, table))) {
+      issues.push({
+        model,
+        key: table,
+        reason: `model '${model}' expects source table '${table}', which does not exist — if your layout renamed it, pass --source-map '{"${model}":"<table>"}', or map it null to record it as not installed`,
+      })
+      continue
+    }
+    const columns = await columnsOf(client, table)
+    for (const column of requiredColumns[model]) {
+      if (!columns.has(column)) {
+        issues.push({
+          model,
+          key: `${table}.${column}`,
+          reason: `model '${model}' needs column '${column}' on source table '${table}', which does not exist — --source-map maps tables, not columns, so this layout needs a manual review`,
+        })
+      }
+    }
+  }
+  return issues
+}
+
+/**
+ * Row counts for the given (mapped, existing) tables. A missing table
+ * throws — the probe owns the structured "missing table" report, so a
+ * throw here means the probe was skipped.
+ */
 export async function countTables(
   client: Client,
   tables: readonly string[]
 ): Promise<Record<string, number>> {
   const counts: Record<string, number> = {}
   for (const table of tables) {
-    if (await tableExists(client, table)) {
-      const counted = await client.query(`SELECT count(*)::int AS n FROM ${table}`)
-      counts[table] = (counted.rows[0] as { n?: number } | undefined)?.n ?? 0
-    } else {
-      counts[table] = 0
+    if (!(await tableExists(client, table))) {
+      throw new Error(`source table '${table}' is missing — run probeSourceLayout first`)
     }
+    const counted = await client.query(`SELECT count(*)::int AS n FROM ${table}`)
+    counts[table] = (counted.rows[0] as { n?: number } | undefined)?.n ?? 0
   }
   return counts
 }
@@ -86,25 +169,38 @@ function text(value: unknown): string | null {
 }
 
 /** Every source user, with role rows and accounts attached. */
-export async function readSourceUsers(client: Client): Promise<SourceUser[]> {
-  const hasRoleTable = await tableExists(client, 'users_role')
+export async function readSourceUsers(
+  client: Client,
+  tables: ResolvedSourceTables = defaultSourceTables
+): Promise<SourceUser[]> {
+  const usersTable = tables['users']
+  const accountsTable = tables['accounts']
+  // A null-mapped model is "not installed" by config: no rows, no read.
+  if (usersTable === null) {
+    return []
+  }
   const users = await client.query(
-    `SELECT id, email, name, email_verified, image, created_at, updated_at FROM users ORDER BY id`
+    `SELECT id, email, name, email_verified, image, created_at, updated_at FROM ${usersTable} ORDER BY id`
   )
-  const roleRows = hasRoleTable
-    ? await client.query(`SELECT parent_id, value FROM users_role ORDER BY parent_id, "order"`)
-    : { rows: [] as unknown[] }
+  const rolesTable = tables['users_role']
+  const roleRows =
+    rolesTable === null
+      ? { rows: [] as unknown[] }
+      : await client.query(`SELECT parent_id, value FROM ${rolesTable} ORDER BY parent_id, "order"`)
   const rolesByUser = new Map<string, string[]>()
   for (const row of roleRows.rows as { parent_id: number; value: string }[]) {
     const list = rolesByUser.get(String(row.parent_id)) ?? []
     list.push(row.value)
     rolesByUser.set(String(row.parent_id), list)
   }
-  const accounts = await client.query(
-    `SELECT id, account_id, provider_id, password, access_token, refresh_token, id_token,
+  const accounts =
+    accountsTable === null
+      ? { rows: [] as unknown[] }
+      : await client.query(
+          `SELECT id, account_id, provider_id, password, access_token, refresh_token, id_token,
             scope, access_token_expires_at, refresh_token_expires_at, user_id
-     FROM accounts ORDER BY id`
-  )
+     FROM ${accountsTable} ORDER BY id`
+        )
   const accountsByUser = new Map<string, SourceAccount[]>()
   for (const row of accounts.rows as Record<string, unknown>[]) {
     const userId = String(row.user_id)
@@ -142,51 +238,100 @@ export async function readSourceUsers(client: Client): Promise<SourceUser[]> {
   return out
 }
 
-/** Rows of one flat plugin table (sessions, verifications, apiKeys, jwks, …). */
+/**
+ * Rows of one flat plugin table (sessions, verifications, apiKeys, jwks, …).
+ * A missing table throws — a `null` mapping keeps the caller from ever
+ * asking for it, and an unmapped missing table aborts at the probe.
+ */
 export async function readFlatRows(
   client: Client,
   table: string,
   columns: readonly string[]
 ): Promise<SourceRow[]> {
   if (!(await tableExists(client, table))) {
-    return []
+    throw new Error(`source table '${table}' is missing — run probeSourceLayout first`)
   }
   const result = await client.query(`SELECT ${columns.join(', ')} FROM ${table} ORDER BY id`)
   return result.rows as SourceRow[]
 }
 
+/** What the orphan sweep found, and which checks could not run (and why). */
+export type OrphanScan = {
+  readonly orphans: readonly Unmappable[]
+  /** Checks skipped with a reason — reported, never silent (issue #68). */
+  readonly skipped: readonly string[]
+}
+
 /**
  * Members and invitations reference organizations and users by numeric
  * id; the importer remaps to the target's baIds. Orphaned references
  * are unmappable — they abort the run rather than skip silently.
+ *
+ * Every check is table-mapped (issue #68). The api-key check probes
+ * its columns: better-auth names the owner reference `reference_id`
+ * (1.7 / payload-auth layouts) or `user_id` (1.6-era layouts); when
+ * neither exists the check is reported as skipped-with-reason instead
+ * of passing silently.
  */
-export async function findOrphans(client: Client): Promise<readonly Unmappable[]> {
+export async function findOrphans(
+  client: Client,
+  tables: ResolvedSourceTables = defaultSourceTables
+): Promise<OrphanScan> {
   const orphans: Unmappable[] = []
-  const checks: readonly { model: string; table: string; column: string; target: string }[] = [
-    { model: 'account', table: 'accounts', column: 'user_id', target: 'users' },
-    { model: 'session', table: 'sessions', column: 'user_id', target: 'users' },
-    { model: 'member', table: 'members', column: 'organization_id', target: 'organizations' },
-    { model: 'member', table: 'members', column: 'user_id', target: 'users' },
+  const skipped: string[] = []
+  const checks: readonly {
+    model: string
+    table: string | null
+    column: string
+    target: string | null
+  }[] = [
+    { model: 'account', table: tables['accounts'], column: 'user_id', target: tables['users'] },
+    { model: 'session', table: tables['sessions'], column: 'user_id', target: tables['users'] },
+    {
+      model: 'member',
+      table: tables['members'],
+      column: 'organization_id',
+      target: tables['organizations'],
+    },
+    { model: 'member', table: tables['members'], column: 'user_id', target: tables['users'] },
     {
       model: 'invitation',
-      table: 'invitations',
+      table: tables['invitations'],
       column: 'organization_id',
-      target: 'organizations',
+      target: tables['organizations'],
+    },
+    {
+      model: 'invitation',
+      table: tables['invitations'],
+      column: 'inviter_id',
+      target: tables['users'],
     },
-    { model: 'invitation', table: 'invitations', column: 'inviter_id', target: 'users' },
-    { model: 'apikey', table: 'api_keys', column: 'user_id', target: 'users' },
   ]
   for (const check of checks) {
+    if (check.table === null || check.target === null) {
+      // Null-mapped model: not installed by config — an expected skip,
+      // recorded so the report says why nothing was checked.
+      skipped.push(
+        `${check.model}: skipped — ${check.table === null ? 'the model is null-mapped (not installed)' : `its target '${String(check.target)}' is null-mapped (not installed)`}`
+      )
+      continue
+    }
     const exists = await Promise.all([
       tableExists(client, check.table),
       tableExists(client, check.target),
     ])
     if (!exists[0] || !exists[1]) {
+      skipped.push(
+        `${check.model}: skipped — table '${!exists[0] ? check.table : String(check.target)}' is absent`
+      )
       continue
     }
     // Customized layouts drop columns; a missing reference column is
-    // not an orphan farm.
+    // reported, not treated as an all-clear.
     if (!(await columnsOf(client, check.table)).has(check.column)) {
+      skipped.push(
+        `${check.model}: skipped — column '${check.column}' is absent on '${check.table}'`
+      )
       continue
     }
     const result = await client.query(
@@ -202,7 +347,46 @@ export async function findOrphans(client: Client): Promise<readonly Unmappable[]
       })
     }
   }
-  return orphans
+
+  // api_keys: the owner column is named per layout — probe it.
+  const apiKeysTable = tables['api_keys']
+  if (apiKeysTable === null) {
+    skipped.push('apikey: skipped — the model is null-mapped (not installed)')
+  } else if (!(await tableExists(client, apiKeysTable))) {
+    skipped.push(`apikey: skipped — table '${apiKeysTable}' is absent`)
+  } else {
+    const columns = await columnsOf(client, apiKeysTable)
+    const column = columns.has('reference_id')
+      ? 'reference_id'
+      : columns.has('user_id')
+        ? 'user_id'
+        : null
+    const usersTable = tables['users']
+    if (column === null) {
+      skipped.push(
+        `apikey: skipped — neither 'reference_id' nor 'user_id' exists on '${apiKeysTable}'; the owner check cannot run`
+      )
+    } else if (usersTable === null) {
+      skipped.push('apikey: skipped — its target is null-mapped (not installed)')
+    } else {
+      // The owner column can be varchar (reference_id) or integer
+      // (1.6-era user_id): compare through text on both sides so the
+      // check runs on either layout.
+      const result = await client.query(
+        `SELECT t.id FROM ${apiKeysTable} t
+         WHERE t.${column} IS NOT NULL
+           AND NOT EXISTS (SELECT 1 FROM ${usersTable} s WHERE s.id::text = t.${column}::text)`
+      )
+      for (const row of result.rows as { id: unknown }[]) {
+        orphans.push({
+          model: 'apikey',
+          key: String(row.id),
+          reason: `${apiKeysTable}.${column} references a missing ${usersTable} row`,
+        })
+      }
+    }
+  }
+  return { orphans, skipped }
 }
 
 /** Users whose email never verified — reported, never granted `linkable`. */

package/src/importer/types.ts

@@ -67,6 +67,92 @@ export type ImportResult = {
   readonly plan: ImportPlan
 }
 
+/**
+ * The models the source side names (issue #68). One entry per
+ * payload-auth table the importer/doctor reads — the keys are stable
+ * model names; the values are whatever the source database actually
+ * called the table.
+ */
+export type SourceModel =
+  | 'users'
+  | 'accounts'
+  | 'sessions'
+  | 'verifications'
+  | 'api_keys'
+  | 'jwks'
+  | 'organizations'
+  | 'members'
+  | 'invitations'
+  | 'users_role'
+
+/**
+ * A model → source-table override for custom layouts (`--source-map`):
+ * `{"accounts":"user_accounts","sessions":"user_sessions"}`. A `null`
+ * value means the model is explicitly NOT installed on the source
+ * (recorded as skipped-by-config, never probed as an error).
+ */
+export type SourceTableMap = { readonly [M in SourceModel]?: string | null }
+
+/** Every model resolved to its source table (`null` = not installed). */
+export type ResolvedSourceTables = Readonly<Record<SourceModel, string | null>>
+
+/** payload-auth's default Postgres layout. */
+export const defaultSourceTables: Readonly<Record<SourceModel, string>> = {
+  users: 'users',
+  accounts: 'accounts',
+  sessions: 'sessions',
+  verifications: 'verifications',
+  api_keys: 'api_keys',
+  jwks: 'jwks',
+  organizations: 'organizations',
+  members: 'members',
+  invitations: 'invitations',
+  users_role: 'users_role',
+}
+
+/** All known source models — the error message names them. */
+export const sourceModelNames: readonly SourceModel[] = Object.keys(
+  defaultSourceTables
+) as SourceModel[]
+
+/**
+ * Parse the `--source-map` JSON (same boundary style as `--slugs`):
+ * keys must be known source models, values a table name or `null`
+ * ("model not installed"). Unknown keys throw — a typo would
+ * otherwise silently skip the model it meant to map.
+ */
+export function parseSourceMapJson(json: string): SourceTableMap {
+  const parsed: unknown = JSON.parse(json)
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error('--source-map must be a JSON object of model -> table name (or null)')
+  }
+  const map: Record<string, string | null> = {}
+  for (const [key, value] of Object.entries(parsed as Record<string, unknown>)) {
+    if (!sourceModelNames.includes(key as SourceModel)) {
+      throw new Error(
+        `--source-map has an unknown model '${key}'; the known models are: ${sourceModelNames.join(', ')}`
+      )
+    }
+    if (value !== null && (typeof value !== 'string' || value.trim() === '')) {
+      throw new Error(`--source-map['${key}'] must be a table name or null`)
+    }
+    map[key] = value === null ? null : value.trim()
+  }
+  return map
+}
+
+/** Merge `--source-map` overrides onto the default layout. */
+export function resolveSourceTables(map: SourceTableMap | undefined): ResolvedSourceTables {
+  return { ...defaultSourceTables, ...(map ?? {}) }
+}
+
+/** The tables to read (the mapped ones — `null` entries are skipped). */
+export function presentTables(tables: ResolvedSourceTables): readonly string[] {
+  return sourceModelNames
+    .map((model) => tables[model])
+    .filter((table): table is string => table !== null)
+}
+
 /** The models the importer copies. */
 export type TargetModel =
   | 'user'

package/src/index.ts

@@ -12,12 +12,26 @@ export {
 } from './doctor/run-doctor.js'
 export type { DoctorOptions } from './doctor/run-doctor.js'
 export { checkVersions, payloadBand, betterAuthBand, nextBand } from './doctor/bands.js'
-export { classifyPlugins } from './doctor/plugins.js'
-export { scanSource, projectedUserFields } from './doctor/source-scan.js'
+export { classifyPlugins, pluginsFromSourceTree } from './doctor/plugins.js'
+export { scanSource, projectedUserFields, listSourceFiles } from './doctor/source-scan.js'
 export { analyzeUsersCollection, findUsersCollection, localStrategyOn } from './doctor/users.js'
 export { introspectDatabase } from './doctor/database.js'
 export { runFromPayloadAuth, runVerify, runRollback, runFinalize } from './importer/run-import.js'
 export { applyImport, summarizePlanRows } from './importer/apply.js'
+export {
+  countTables,
+  findOrphans,
+  openSource,
+  probeSourceLayout,
+  readFlatRows,
+  readSourceUsers,
+  unverifiedEmails,
+  type OrphanScan,
+  type SourceLayoutIssue,
+  type SourceAccount,
+  type SourceRow,
+  type SourceUser,
+} from './importer/source.js'
 export {
   readManifest,
   writeManifest,
@@ -29,8 +43,16 @@ export {
   type VerifyResult,
 } from './importer/lifecycle.js'
 export {
+  defaultSourceTables,
   defaultTargetSlugs,
+  parseSourceMapJson,
+  presentTables,
+  resolveSourceTables,
+  sourceModelNames,
   type CreatedRow,
+  type ResolvedSourceTables,
+  type SourceModel,
+  type SourceTableMap,
   type TargetModel,
   type TargetSlugMap,
   type FieldWrite,
@@ -40,6 +62,7 @@ export {
   type PlanRow,
   type Unmappable,
 } from './importer/types.js'
+export { exportToJsonl, parseExportTables, exportTables } from './exporters.js'
 export { cliMain } from './cli.js'
 export type {
   BehaviourChange,