@payload-auth-link/migrate 0.6.0 → 0.7.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC1F,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,WAAW,EACX,eAAe,GAGhB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,YAAY,EAA2C,MAAM,uBAAuB,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,gBAAgB,GAOjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,GAG3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,GAcjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC1F,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,WAAW,EACX,eAAe,GAIhB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,YAAY,EAA2C,MAAM,uBAAuB,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,gBAAgB,GAOjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,GAK3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,GAcjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payload-auth-link/migrate",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "payload-auth-link migration kit: read-only doctor/preflight, the payload-auth importer, and exporters.",
   "license": "MIT",
   "repository": {
@@ -40,7 +40,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@payload-auth-link/core": "0.8.0",
+    "@payload-auth-link/core": "0.9.0",
     "pg": "^8.23.1",
     "typescript": "^6.0.3"
   },
@@ -53,9 +53,9 @@
   },
   "devDependencies": {
     "@better-auth/api-key": "1.7.7",
-    "@payload-auth-link/core": "0.8.0",
-    "@payload-auth-link/plugin": "0.12.0",
-    "@payload-auth-link/provider-better-auth": "0.9.0",
+    "@payload-auth-link/core": "0.9.0",
+    "@payload-auth-link/plugin": "0.13.0",
+    "@payload-auth-link/provider-better-auth": "0.10.0",
     "@payloadcms/db-postgres": "3.91.0",
     "@types/node": "^22",
     "@types/pg": "^8.23.1",
@@ -63,7 +63,7 @@
     "payload": "3.91.0"
   },
   "peerDependencies": {
-    "@payload-auth-link/next": "^0.5.0",
+    "@payload-auth-link/next": "^0.6.0",
     "payload": "^3.83.0 || 4.0.0-beta.0"
   },
   "peerDependenciesMeta": {

package/src/cli.ts

@@ -67,17 +67,29 @@ Commands:
                     [--source-map '{"accounts":"user_accounts","sessions":"user_sessions"}']
   export            --database-url URL [--out file.jsonl]
                     [--tables users,accounts | '["users","accounts"]']
-                    (lossless JSONL of every auth table — the off-ramp, #58)
+                    [--source-map '{"accounts":"user_accounts","sessions":"user_sessions"}']
+                    (lossless JSONL of every auth table — the off-ramp, #58:
+                    each mapped model's table, their child tables such as
+                    users_role / organizations_tags, and every ba_* and
+                    oauth_* table present; a mapped table that is missing
+                    exits 1)
   codemod           --src ./src [--write]
   from-payload-auth --config ./src/payload.config.ts [--apply] [--sessions=carry|drop]
                     [--manifest ./payload-auth-link-migration.json] [--database-url URL] [--json]
                     [--source-map '{"accounts":"user_accounts","sessions":"user_sessions"}']
   verify            --config ./src/payload.config.ts [--database-url URL] [--json]
                     [--source-map '{"accounts":"user_accounts","sessions":"user_sessions"}']
-  rollback          --config ./src/payload.config.ts [--manifest ...]
-                    [--allow-unsigned-manifest]  (a pre-0.6.0 manifest; also
-                    accepted by from-payload-auth / adopt-prelink when resuming)
-  finalize          [--manifest ...]
+  rollback          --config ./src/payload.config.ts [--manifest ...] [--slugs JSON]
+                    [--allow-unsigned-manifest]  (a manifest without a full
+                    signature: pre-0.6.0, or 0.6.0's which leaves 'finalized'
+                    unsigned; also accepted by from-payload-auth /
+                    adopt-prelink / finalize when resuming)
+                    [--allow-unsigned-deletes]  (with an UNSIGNED manifest,
+                    also delete its created rows and restore plaintext
+                    values; without it an unsigned rollback deletes nothing)
+  finalize          --config ./src/payload.config.ts [--manifest ...]
+                    (records the finalize in the app's database and
+                    re-signs the manifest; rollback is refused afterwards)
   adopt-prelink     --config ./src/payload.config.ts [--apply] [--json]
                     [--manifest ./payload-auth-link-prelink.json]
                     [--users-slug users] [--verified-field emailVerified]
@@ -101,15 +113,17 @@ Commands:
   writes the payload-auth-link collections through the Payload Local
   API, records every created row and field change in the manifest,
   and never modifies the source tables. verify checks both sides;
-  rollback undoes exactly the manifest; finalize marks it read-only
-  so the legacy tables may be dropped later, in their own migration.
+  rollback undoes exactly the manifest (and only ever deletes rows in
+  the import's own target collections); finalize records the point of
+  no return so the legacy tables may be dropped later, in their own
+  migration (adopt mode: those are the live tables — never drop them).
 
   The manifest lands in the CURRENT DIRECTORY unless --manifest says
   otherwise. It holds ids and sealed values only (no emails in the
   clear; sealed with the app's PAYLOAD_SECRET, so rollback must run
   against the same app) and is written with mode 0600. It is signed
-  with the same secret: rollback and a resumed --apply refuse an
-  edited manifest. Delete it once
+  with the same secret: rollback, finalize, and a resumed --apply
+  refuse an edited manifest. Delete it once
   the migration is finalized and your soak window has passed.
 
   codemod rewrites the three named payload-auth call-site patterns
@@ -285,20 +299,40 @@ async function main(
           return 3
         }
       }
+      // --source-map: the same layout semantics as every other command
+      // (issue #110) — renamed tables are exported, null-mapped models
+      // are skipped, and a mapped table that is missing exits 1.
+      let sourceTables: import('./importer/types.js').ResolvedSourceTables | undefined
+      const sourceMapFlag = flags.get('source-map')
+      if (typeof sourceMapFlag === 'string') {
+        try {
+          const { parseSourceMapJson, resolveSourceTables } = await import('./importer/types.js')
+          sourceTables = resolveSourceTables(parseSourceMapJson(sourceMapFlag))
+        } catch (error) {
+          err.write(`${error instanceof Error ? error.message : String(error)}\n`)
+          return 3
+        }
+      }
       const { exportToJsonl } = await import('./exporters.js')
       const result = await exportToJsonl({
         connectionString: databaseUrl,
         format: 'jsonl',
         ...(tables === undefined ? {} : { tables }),
-        log: (message) => out.write(`${message}\n`),
+        ...(sourceTables === undefined ? {} : { sourceTables }),
+        // Progress goes to stderr: stdout may BE the JSONL document.
+        log: (message) => err.write(`${message}\n`),
       })
-      // A requested table that doesn't exist is an error, not a gap
-      // (issue #68): nothing is silently omitted.
-      if (tables !== undefined && result.missing.length > 0) {
+      // A required table that doesn't exist is an error, not a gap
+      // (issues #68, #110): nothing is silently omitted.
+      if (result.missing.length > 0) {
         for (const table of result.missing) {
           err.write(`export: table '${table}' does not exist on the source\n`)
         }
-        err.write('nothing silently omitted; fix --tables or drop it\n')
+        err.write(
+          tables === undefined
+            ? "nothing silently omitted; pass --source-map to name your layout's tables (null for a model that is not installed)\n"
+            : 'nothing silently omitted; fix --tables or drop it\n'
+        )
         return 1
       }
       if (typeof flags.get('out') === 'string') {
@@ -373,27 +407,39 @@ async function main(
       )
       return 0
     }
-    // finalize [--manifest ...]
-    // (no --config: manifest-only; no Payload instance is loaded)
+    // The remaining commands (from-payload-auth, verify, rollback,
+    // finalize, adopt-prelink) all load a Payload instance, so they
+    // need the config.
+    const configFlag = flags.get('config')
+    if (typeof configFlag !== 'string' || configFlag === '') {
+      err.write(`${command} requires --config <path to payload.config.ts>\n`)
+      return 3
+    }
+    // finalize --config ... [--manifest ...]: boots the target app to
+    // sign the finalized manifest and record the database marker.
     if (command === 'finalize') {
-      const finalized = await runFinalize({
-        log,
-        ...(typeof flags.get('manifest') === 'string'
-          ? { manifestPath: flags.get('manifest') as string }
-          : {}),
-      })
+      let finalized: Awaited<ReturnType<typeof runFinalize>>
+      try {
+        finalized = await runFinalize({
+          configPath: new URL(configFlag, `file://${process.cwd()}/`).pathname,
+          log,
+          ...(typeof flags.get('manifest') === 'string'
+            ? { manifestPath: flags.get('manifest') as string }
+            : {}),
+          ...(typeof flags.get('slugs') === 'string'
+            ? { slugsJson: flags.get('slugs') as string }
+            : {}),
+          allowUnsignedManifest: flags.get('allow-unsigned-manifest') === true,
+        })
+      } catch (error) {
+        err.write(`finalize failed: ${error instanceof Error ? error.message : String(error)}\n`)
+        return 1
+      }
       if (json) {
         out.write(`${JSON.stringify({ finalized: finalized.finalized })}\n`)
       }
       return 0
     }
-    // The remaining commands (from-payload-auth, verify, rollback) all
-    // load a Payload instance, so they need the config.
-    const configFlag = flags.get('config')
-    if (typeof configFlag !== 'string' || configFlag === '') {
-      err.write(`${command} requires --config <path to payload.config.ts>\n`)
-      return 3
-    }
     if (command === 'adopt-prelink') {
       const usersSlug = flags.get('users-slug')
       const verifiedField = flags.get('verified-field')
@@ -441,6 +487,7 @@ async function main(
       json,
       log,
       allowUnsignedManifest: flags.get('allow-unsigned-manifest') === true,
+      allowUnsignedDeletes: flags.get('allow-unsigned-deletes') === true,
     }
     if (command === 'from-payload-auth') {
       const outcome = await runFromPayloadAuth(importOptions)
@@ -478,7 +525,14 @@ async function main(
       return result.ok ? 0 : 1
     }
     if (command === 'rollback') {
-      const undone = await runRollback(importOptions)
+      let undone: Awaited<ReturnType<typeof runRollback>>
+      try {
+        undone = await runRollback(importOptions)
+      } catch (error) {
+        // A refused or failed rollback is an error exit, never a quiet 0.
+        err.write(`rollback failed: ${error instanceof Error ? error.message : String(error)}\n`)
+        return 1
+      }
       if (json) {
         out.write(`${JSON.stringify(undone)}\n`)
       }

package/src/doctor/plugins.ts

@@ -181,10 +181,15 @@ export function pluginsFromCollectionSlugs(slugs: readonly string[]): string[] {
   return [...ids].sort()
 }
 
-/** Plugin call names a config source can name, mapped to plugin ids. */
-/** True when a source file actually imports Better Auth. */
+/**
+ * True when a source file actually imports Better Auth — any subpath
+ * depth (`better-auth/plugins/generic-oauth`, issue #110), static or
+ * dynamic `import()`, or `require()`.
+ */
 const betterAuthImport =
-  /(?:from\s*|require\(\s*)['"](?:better-auth(?:\/[\w-]+)?|@better-auth\/[\w-]+)['"]/
+  /(?:from\s*|require\(\s*|import\(\s*)['"](?:better-auth(?:\/[\w.-]+)*|@better-auth\/[\w.-]+(?:\/[\w.-]+)*)['"]/
+
+/** Plugin call names a config source can name, mapped to plugin ids. */
 
 const callNameToPlugin: Readonly<Record<string, string>> = {
   magicLink: 'magic-link',

package/src/doctor/run-doctor.ts

@@ -124,6 +124,24 @@ export function betterAuthPluginIds(pluginOptions: Record<string, unknown>): str
   return ids
 }
 
+/**
+ * The options of the payload-auth-link plugin in a built (TARGET)
+ * config, or `null` when the plugin is not installed. Payload keeps each
+ * plugin's `slug` and `options` for cross-plugin discovery.
+ */
+function authLinkPluginOptions(config: unknown): Record<string, unknown> | null {
+  if (!isRecord(config) || !Array.isArray(config.plugins)) {
+    return null
+  }
+  for (const entry of config.plugins) {
+    if (typeof entry === 'function' && (entry as { slug?: unknown }).slug === 'payload-auth-link') {
+      const options: unknown = (entry as { options?: unknown }).options
+      return isRecord(options) ? options : {}
+    }
+  }
+  return null
+}
+
 /** The users collection slug the payload-auth app configured. */
 export function usersSlugOf(pluginOptions: Record<string, unknown>): string {
   const users: unknown = pluginOptions.users
@@ -285,16 +303,25 @@ export async function runDoctor(options: DoctorOptions): Promise<DoctorReport> {
   let users: DoctorReport['users'] = null
   if (configLoaded) {
     const usersSlug = usersSlugOf(plugin?.pluginOptions ?? {})
+    const usersCollection = findUsersCollection(config, usersSlug)
+    const authLinkOptions = authLinkPluginOptions(config)
+    // An adopt-mode TARGET (issue #110): payload-auth-link is installed
+    // on the users collection and no engine-owned ba-users collection
+    // exists, so Better Auth creates its users in the host collection.
+    const adoptTarget = authLinkOptions !== null && !collectionSlugs(config).includes('ba-users')
+    const rolesField = authLinkOptions?.['rolesField']
     const { finding, issues: userIssues } = analyzeUsersCollection(
-      findUsersCollection(config, usersSlug),
-      'roles'
+      usersCollection,
+      typeof rolesField === 'string' && rolesField !== '' ? rolesField : 'roles',
+      { adoptTarget }
     )
     users = finding
     for (const issue of userIssues) {
       if (
         issue.code === 'injected-field-collision' ||
         issue.code === 'roles-field-not-select' ||
-        issue.code === 'users-collection-missing'
+        issue.code === 'users-collection-missing' ||
+        issue.code === 'adopt-local-strategy-on'
       ) {
         blockers.push(issue)
       } else {

package/src/doctor/users.ts

@@ -70,11 +70,6 @@ export function findUsersCollection(
   return null
 }
 
-/**
- * Payload's local email+password strategy for a collection. payload-auth
- * leaves it on (its own Better Auth strategy rides alongside), which is
- * exactly the surface 0.7.0 closes for provider-linked documents.
- */
 /** Names of the custom auth strategies a collection declares. */
 function strategiesOf(collection: Record<string, unknown>): string[] {
   const auth: unknown = collection.auth
@@ -87,6 +82,11 @@ function strategiesOf(collection: Record<string, unknown>): string[] {
     .filter((name): name is string => typeof name === 'string')
 }
 
+/**
+ * Payload's local email+password strategy for a collection, as the
+ * BUILT config has it. payload-auth leaves it on unless the app set
+ * `disableDefaultPayloadAuth: true`; either way, this reads the result.
+ */
 export function localStrategyOn(collection: Record<string, unknown>): boolean {
   const auth: unknown = collection.auth
   if (auth === undefined || auth === null) {
@@ -109,7 +109,15 @@ const pluginStrategyName = 'auth-link'
 
 export function analyzeUsersCollection(
   collection: Record<string, unknown> | null,
-  rolesFieldName: string
+  rolesFieldName: string,
+  options: {
+    /**
+     * The config is an adopt-mode TARGET: payload-auth-link is installed
+     * and Better Auth serves its users from this collection (no ba-users
+     * collection). Enables the target-side adopt checks.
+     */
+    readonly adoptTarget?: boolean | undefined
+  } = {}
 ): { finding: UsersFinding | null; issues: DoctorIssue[] } {
   if (collection === null) {
     return {
@@ -193,8 +201,18 @@ export function analyzeUsersCollection(
   const local = localStrategyOn(collection)
   if (local) {
     notes.push(
-      'Payload local strategy is ON (payload-auth leaves it active): since 0.7.0, provider-linked documents refuse local sign-in and forgot/reset by default — break-glass operator accounts keep theirs; allowLocalCredentialsForLinkedDocs: true reopens it only for a migration window'
+      'Payload local strategy is ON for this collection: since 0.7.0, provider-linked documents refuse local sign-in and forgot/reset by default — break-glass operator accounts keep theirs; allowLocalCredentialsForLinkedDocs: true reopens it only for a migration window'
     )
+    if (options.adoptTarget === true) {
+      // Adopt mode (issue #110): Better Auth creates its users IN this
+      // collection, and Payload's local strategy demands a password on
+      // every create — sign-up and anonymous sign-in fail for every
+      // new user.
+      issues.push({
+        code: 'adopt-local-strategy-on',
+        detail: `adopt mode serves Better Auth's users from the collection '${typeof collection.slug === 'string' ? collection.slug : 'users'}', but Payload's local strategy is ON there: Payload requires a password on every create, so every NEW user fails (email sign-up 422, anonymous sign-in 500 "field is invalid: password"). Set auth: { disableLocalStrategy: true } on the collection (payload-auth's disableDefaultPayloadAuth: true did the same), or use the importer (ba-* collections) instead of adopt`,
+      })
+    }
   } else {
     const strategies = Array.isArray(collection.auth) ? [] : strategiesOf(collection)
     notes.push(

package/src/exporters.ts

@@ -1,4 +1,5 @@
 import { Client } from 'pg'
+import { presentTables, resolveSourceTables, type ResolvedSourceTables } from './importer/types.js'
 
 /**
  * Off-ramp exporters (issue #58): every payload-auth-link collection's
@@ -14,12 +15,42 @@ export type ExportFormat = 'jsonl'
 export type ExportOptions = {
   readonly connectionString: string
   readonly format: ExportFormat
-  /** Tables to export; defaults to the full auth-table set. */
+  /**
+   * Tables to export, exactly (`--tables`). Without it, the export
+   * covers EVERY auth table (see {@link resolveAuthTables}).
+   */
   readonly tables?: readonly string[] | undefined
+  /**
+   * The source layout (`--source-map`, issue #110): model → table, or
+   * `null` for "not installed". Defaults to payload-auth's layout. A
+   * mapped table that does not exist lands in `missing`.
+   */
+  readonly sourceTables?: ResolvedSourceTables | undefined
   readonly log?: (message: string) => void
 }
 
-/** The auth-table set, in dependency order for re-import. */
+/**
+ * Better Auth plugin tables payload-auth creates beyond the importer's
+ * models — exported whenever present (they are auth data the off-ramp
+ * must not lose).
+ */
+export const optionalAuthTables: readonly string[] = [
+  'admin_invitations',
+  'two_factors',
+  'passkeys',
+  'sso_providers',
+  'organization_roles',
+  'teams',
+  'team_members',
+  'device_code',
+  'subscriptions',
+]
+
+/**
+ * The legacy default auth-table list (payload-auth's default layout plus
+ * the plugin's users child tables). Kept for callers that name it;
+ * {@link resolveAuthTables} is what the export uses.
+ */
 export const exportTables: readonly string[] = [
   'users',
   'users_role',
@@ -40,9 +71,9 @@ export type ExportResult = {
   readonly jsonl: string
   readonly totalRows: number
   /**
-   * Requested tables that do not exist on the source (issue #68). The
-   * caller decides policy: `--tables` names must abort (exit 1),
-   * default-list gaps are reported but tolerated.
+   * Required tables that do not exist on the source (issues #68, #110):
+   * a `--tables` name, or a mapped model's table. The CLI exits 1 on
+   * any; optional tables (children, ba_*, oauth_*) never land here.
    */
   readonly missing: readonly string[]
 }
@@ -81,32 +112,102 @@ export function parseExportTables(value: string): readonly string[] {
   return names
 }
 
+/**
+ * "Every auth table" (issue #110), resolved against what the database
+ * actually holds, in dependency order:
+ *
+ * 1. each mapped model's table (`--source-map` over payload-auth's
+ *    layout; `null` = not installed) — REQUIRED: a missing one lands in
+ *    `missing`;
+ * 2. every child table of those (`<table>_*`: `users_role`,
+ *    `users_identities`, `users_sessions`, `organizations_tags`, `_rels`
+ *    tables, …) and payload-auth's other Better Auth plugin tables
+ *    ({@link optionalAuthTables}) — when present;
+ * 3. every `ba_*` (payload-auth-link engine) and `oauth_*` (OAuth
+ *    provider) table — when present.
+ */
+export function resolveAuthTables(
+  existing: ReadonlySet<string>,
+  sourceTables: ResolvedSourceTables = resolveSourceTables(undefined)
+): { readonly tables: readonly string[]; readonly missing: readonly string[] } {
+  const tables: string[] = []
+  const missing: string[] = []
+  const add = (table: string): void => {
+    if (!tables.includes(table)) {
+      tables.push(table)
+    }
+  }
+  const mapped = presentTables(sourceTables)
+  for (const table of mapped) {
+    if (existing.has(table)) {
+      add(table)
+    } else {
+      missing.push(table)
+    }
+  }
+  const sorted = [...existing].sort()
+  for (const table of [...mapped, ...optionalAuthTables]) {
+    if (!mapped.includes(table) && existing.has(table)) {
+      add(table)
+    }
+    for (const child of sorted) {
+      if (child.startsWith(`${table}_`)) {
+        add(child)
+      }
+    }
+  }
+  for (const table of sorted) {
+    if (table.startsWith('ba_') || table.startsWith('oauth_')) {
+      add(table)
+    }
+  }
+  return { tables, missing }
+}
+
 /** Export the auth tables to lossless JSONL (issue #58). */
 export async function exportToJsonl(options: ExportOptions): Promise<ExportResult> {
-  const tables = options.tables ?? exportTables
   const client = new Client({ connectionString: options.connectionString })
   await client.connect()
   try {
+    const listed = await client.query(
+      `SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'`
+    )
+    const existing = new Set(
+      listed.rows.map((row) => String((row as { table_name: unknown }).table_name))
+    )
     const lines: string[] = []
     const exported: { name: string; rows: number }[] = []
     const missing: string[] = []
+    let tables: readonly string[]
+    if (options.tables === undefined) {
+      const resolved = resolveAuthTables(existing, options.sourceTables)
+      tables = resolved.tables
+      for (const table of resolved.missing) {
+        missing.push(table)
+        options.log?.(
+          `mapped table '${table}' does not exist on the source — not exported (map its model null with --source-map if it is not installed)`
+        )
+      }
+    } else {
+      tables = options.tables
+    }
     let totalRows = 0
     for (const table of tables) {
-      const exists = await client.query(
-        `SELECT 1 FROM information_schema.tables WHERE table_schema = 'public' AND table_name = $1`,
-        [table]
-      )
-      if (exists.rows.length === 0) {
+      if (!existing.has(table)) {
         // Nothing is silently omitted (issue #68): every absent table
         // is logged and lands in `missing` for the caller's policy.
         missing.push(table)
         options.log?.(`table '${table}' does not exist on the source — not exported`)
         continue
       }
+      const columns = await client.query(
+        `SELECT 1 FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1 AND column_name = 'id'`,
+        [table]
+      )
       // Export EVERY column raw (JSON types preserved by ::jsonb cast
       // per row via row_to_json) — lossless by construction.
       const result = await client.query(
-        `SELECT row_to_json(t)::jsonb AS row FROM ${table} t ORDER BY t.id`
+        `SELECT row_to_json(t)::jsonb AS row FROM "${table}" t${columns.rows.length > 0 ? ' ORDER BY t.id' : ''}`
       )
       exported.push({ name: table, rows: result.rows.length })
       totalRows += result.rows.length