@vxil/cli 0.27.0 → 0.28.0

package/dist/vxil-main.js

@@ -5586,7 +5586,7 @@ function lowerAllTriggerBindings(def, name) {
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
 var VXIL_CONFIG_PKG_VERSION = "0.20.0";
 var VXIL_SDK_PKG_VERSION = "0.27.0";
-var VXIL_CLI_PKG_VERSION = "0.27.0";
+var VXIL_CLI_PKG_VERSION = "0.28.0";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -16805,6 +16805,8 @@ var EXTRA_KNOWN_FLAGS = [
   "dir",
   "file-links",
   "from-provider",
+  "include",
+  "owner",
   "include-empty",
   "include-password-hashes",
   "with-password-hashes",
@@ -17077,6 +17079,15 @@ import { dirname as dirname4, resolve as resolve5 } from "node:path";
 import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename2, resolve as resolve4 } from "node:path";
 
+// src/migrate/types.ts
+var OWNER_NONE = "none";
+function hasOwnerField(m) {
+  return m.ownerField !== void 0 && m.ownerField !== OWNER_NONE;
+}
+function newMigrateState() {
+  return { version: 1, schemaPushed: false, cursors: {}, idMap: {} };
+}
+
 // src/migrate/inference.ts
 var VECTOR_DIMS = [256, 384, 512, 768, 1024, 1536, 3072];
 var SOURCE_ID_FIELD = "source_id";
@@ -17160,7 +17171,92 @@ function parseNumeric(pgType) {
   const m = /^numeric\s*\(\s*(\d+)\s*,\s*(\d+)\s*\)$/i.exec(pgType.trim());
   return m ? { precision: Number(m[1]), scale: Number(m[2]) } : void 0;
 }
-var PAYMENTS_TABLE_RE = /(purchase|payment|invoice|credit)/i;
+var PAYMENTS_TABLE_WORDS = [
+  "purchase",
+  "payment",
+  "invoice",
+  "credit",
+  // en (the original pattern)
+  "pago",
+  "compra",
+  "factura",
+  "suscripci",
+  // es
+  "pagamento",
+  "fatura",
+  "assinatura",
+  // pt
+  "paiement",
+  "achat",
+  "facture",
+  "abonnement",
+  "cr\xE9dit",
+  // fr (abonnement: de too)
+  "zahlung",
+  "kauf",
+  "rechnung",
+  "guthaben",
+  // de
+  "odeme",
+  "\xF6deme",
+  "abonelik",
+  "kredi",
+  // tr
+  "pembayaran",
+  "pembelian",
+  "tagihan",
+  "langganan",
+  // id
+  "oplat",
+  "platezh",
+  "\u043F\u043B\u0430\u0442\u0435\u0436",
+  "\u043F\u043B\u0430\u0442\u0451\u0436",
+  "\u043E\u043F\u043B\u0430\u0442",
+  "\u043F\u043E\u043A\u0443\u043F\u043A",
+  "\u0441\u0447\u0435\u0442",
+  "\u0441\u0447\u0451\u0442",
+  "\u043F\u043E\u0434\u043F\u0438\u0441\u043A",
+  "\u043A\u0440\u0435\u0434\u0438\u0442",
+  // ru
+  "\u062F\u0641\u0639",
+  "\u0645\u062F\u0641\u0648\u0639",
+  "\u0641\u0627\u062A\u0648\u0631",
+  "\u0627\u0634\u062A\u0631\u0627\u0643",
+  "\u0634\u0631\u0627\u0621",
+  "\u0631\u0635\u064A\u062F",
+  // ar
+  "\u0627\u062F\u0627\u0626\u06CC\u06AF\u06CC",
+  "\u062E\u0631\u06CC\u062F\u0627\u0631\u06CC",
+  "\u0627\u0646\u0648\u0627\u0626\u0633",
+  "\u0631\u06A9\u0646\u06CC\u062A",
+  // ur
+  "\u092D\u0941\u0917\u0924\u093E\u0928",
+  "\u0916\u0930\u0940\u0926",
+  "\u091A\u093E\u0932\u093E\u0928",
+  "\u0938\u0926\u0938\u094D\u092F\u0924\u093E",
+  // hi
+  "\u09AA\u09C7\u09AE\u09C7\u09A8\u09CD\u099F",
+  "\u0985\u09B0\u09CD\u09A5\u09AA\u09CD\u09B0\u09A6\u09BE\u09A8",
+  "\u0995\u09CD\u09B0\u09AF\u09BC",
+  "\u099A\u09BE\u09B2\u09BE\u09A8",
+  // bn
+  "\u652F\u4ED8",
+  "\u4ED8\u6B3E",
+  "\u8D2D\u4E70",
+  "\u8CFC\u8CB7",
+  "\u53D1\u7968",
+  "\u767C\u7968",
+  "\u8BA2\u9605",
+  "\u8A02\u95B1",
+  "\u5145\u503C",
+  // zh
+  "\uACB0\uC81C",
+  "\uAD6C\uB9E4",
+  "\uCCAD\uAD6C",
+  "\uAD6C\uB3C5"
+  // ko
+];
+var PAYMENTS_TABLE_RE = new RegExp(PAYMENTS_TABLE_WORDS.join("|"), "iu");
 var WEBHOOK_LOG_RE = /webhook/i;
 var SUBSCRIPTION_TABLE_RE = /(subscription|entitlement)/i;
 var PUSH_TOKEN_RE = /(push_token|device_token|fcm_token|apns|expo_token)/i;
@@ -17173,6 +17269,17 @@ function isAuthParent(parentTable, authTable) {
   return !parentTable.includes(".") || !authTable.includes(".");
 }
 var OWNER_NAMES = ["user_id", "owner_id", "author_id"];
+var OWNER_LIKE_RE = new RegExp(
+  "^(?:uid|(?:owner|author|creator|createdby|postedby|uploader|user|member|usuario|propietario|dueno|due\xF1o|autor|auteur|utilisateur|proprietaire|propri\xE9taire|benutzer|nutzer|besitzer|kullanici|kullan\u0131c\u0131|sahip|pengguna|pemilik|polzovatel|vladelets|usu\xE1rio|dono)(?:id|uuid|ref)?)$",
+  "iu"
+);
+function isOwnerLikeName(column) {
+  return OWNER_LIKE_RE.test(column.replace(/[_-]/g, ""));
+}
+function ownerLikeType(c) {
+  if (c.pgType) return !["boolean", "bool", "json", "jsonb"].includes(pgBase(c.pgType)) && !/^(?:timestamp|date|time)/.test(pgBase(c.pgType));
+  return c.inferredType === void 0 || c.inferredType === "string" || c.inferredType === "number";
+}
 function ruleOwnerColumn(definition) {
   const m = /auth\.uid\(\)(?:\s+AS\s+\w+\s*\))?\s*=\s*(?:[\w"]+\.)?"?([A-Za-z_]\w*)"?/i.exec(definition) ?? /(?:[\w"]+\.)?"?([A-Za-z_]\w*)"?\s*=\s*(?:\(\s*SELECT\s+)?auth\.uid\(\)/i.exec(definition);
   return m?.[1];
@@ -17188,21 +17295,32 @@ function pickOwner(candidates) {
   for (const name of OWNER_NAMES) if (candidates.includes(name)) return { column: name, ambiguous: false };
   return { column: candidates[0], ambiguous: candidates.length > 1 };
 }
-function detectOwner(table, source, authTable, opts) {
+function detectOwner(table, source, authTable, opts, userKeyed = /* @__PURE__ */ new Set()) {
   const cols = new Set(table.columns.map((c) => c.name));
   const override = opts.owners?.[table.name];
-  if (override && cols.has(override)) return { column: override, via: "override" };
+  if (override === OWNER_NONE) return void 0;
+  if (override && cols.has(override)) return { column: override, via: "--owner" };
   for (const p of source.rlsPolicies ?? []) {
     if (lastSeg(p.table) !== table.name) continue;
     const col = ruleOwnerColumn(p.definition);
     if (col && cols.has(col)) return { column: col, via: `row-level access rule${p.name ? ` '${p.name}'` : ""}` };
   }
-  const fkCols = table.columns.map((c) => c.name).filter((name) => source.foreignKeys.some((fk) => fk.childTable === table.name && fk.childColumns.length === 1 && fk.childColumns[0] === name && isAuthParent(fk.parentTable, authTable)));
+  const userFkParent = (name) => {
+    for (const fk of source.foreignKeys) {
+      if (fk.childTable !== table.name || fk.childColumns.length !== 1 || fk.childColumns[0] !== name) continue;
+      if (isAuthParent(fk.parentTable, authTable)) return authTable;
+      const parent = lastSeg(fk.parentTable);
+      if (parent !== table.name && userKeyed.has(parent)) return parent;
+    }
+    return void 0;
+  };
+  const fkCols = table.columns.map((c) => c.name).filter((name) => userFkParent(name) !== void 0);
   if (fkCols.length > 0) {
     const pick = pickOwner(fkCols);
+    const parent = userFkParent(pick.column);
     return {
       column: pick.column,
-      via: `FK \u2192 ${authTable}`,
+      via: parent === authTable ? `FK \u2192 ${authTable}` : `FK \u2192 ${parent} (its id is the user id)`,
       ...pick.ambiguous || fkCols.length > 1 ? { ambiguousAmong: fkCols } : {}
     };
   }
@@ -17359,9 +17477,24 @@ function inferMapping(source, opts = {}) {
   const vectorTargets = [];
   const skipSet = new Set(opts.skipTables ?? []);
   const paymentsSet = new Set(opts.paymentsTables ?? []);
-  for (const name of [...skipSet, ...paymentsSet]) {
-    if (!source.tables.some((t) => t.name === name || `${t.schema ?? "public"}.${t.name}` === name)) {
-      warnings.push(`'${name}' (${skipSet.has(name) ? "--skip" : "migrate/payments.json"}) names no source table \u2014 it selects nothing`);
+  const includeSet = new Set(opts.includeTables ?? []);
+  const ownerOverrides = Object.keys(opts.owners ?? {});
+  const findTable = (name) => source.tables.find((t) => t.name === name || `${t.schema ?? "public"}.${t.name}` === name);
+  for (const [name, via] of [
+    ...[...skipSet].map((n) => [n, "--skip"]),
+    ...[...paymentsSet].map((n) => [n, "migrate/payments.json"]),
+    ...[...includeSet].map((n) => [n, "--include"]),
+    ...ownerOverrides.map((n) => [n, "--owner"])
+  ]) {
+    if (!findTable(name)) warnings.push(`'${name}' (${via}) names no source table \u2014 it selects nothing`);
+  }
+  for (const name of includeSet) {
+    if (skipSet.has(name)) warnings.push(`'${name}' is named by both --skip and --include \u2014 --skip wins`);
+  }
+  for (const [name, col] of Object.entries(opts.owners ?? {})) {
+    const t = findTable(name);
+    if (t && col !== OWNER_NONE && !t.columns.some((c) => c.name === col)) {
+      warnings.push(`--owner ${name}=${col}: ${name} has no column '${col}' \u2014 ignored (columns: ${t.columns.map((c) => c.name).join(", ")})`);
     }
   }
   const fksByChild = /* @__PURE__ */ new Map();
@@ -17388,10 +17521,17 @@ function inferMapping(source, opts = {}) {
   for (const t of source.tables) {
     const reasons = [];
     let target;
+    let confirm;
     const qualified = `${t.schema ?? "public"}.${t.name}`;
+    const included = includeSet.has(t.name) || includeSet.has(qualified);
+    const nameSkip = SUBSCRIPTION_TABLE_RE.test(t.name) ? `its name matches the subscription/entitlement pattern (provider-derived state is never seeded)` : WEBHOOK_LOG_RE.test(t.name) ? `its name matches the webhook pattern (a provider webhook/event log \u2014 vxil keeps its own delivery log)` : void 0;
     if (skipSet.has(t.name) || skipSet.has(qualified)) {
       target = "skip";
       reasons.push("skipped by option (--skip)");
+    } else if (included && (t.extensionOwned || t.schema === "auth" || t.schema === "storage" || qualified === authTable || t.name === authTable)) {
+      target = "skip";
+      reasons.push(`--include ignored: ${qualified} is an auth, storage or extension table, never a cms collection`);
+      warnings.push(`--include ${t.name}: an auth, storage or extension table is never loaded as a cms collection \u2014 ignored`);
     } else if (t.extensionOwned) {
       target = "skip";
       reasons.push(`T8: ${qualified} belongs to an installed extension \u2014 the extension recreates it; not app data`);
@@ -17404,22 +17544,26 @@ function inferMapping(source, opts = {}) {
     } else if (paymentsSet.has(t.name) || paymentsSet.has(qualified)) {
       target = "payments-credits";
       reasons.push(`T8: ${t.name} is listed in migrate/payments.json \u2192 payments credits via grantOnce (idempotent grant_key); never cms`);
-    } else if (SUBSCRIPTION_TABLE_RE.test(t.name)) {
-      target = "skip";
-      reasons.push(`subscription/entitlement table ${t.name}: provider-derived \u2014 never seeded`);
-      residuals.push(`subscription/entitlement state (${t.name}): NOT seeded \u2014 rebuild from live provider webhooks after cutover`);
-    } else if (WEBHOOK_LOG_RE.test(t.name)) {
+    } else if (nameSkip !== void 0 && !included) {
       target = "skip";
-      reasons.push(`T8: ${t.name} looks like a provider webhook/event log \u2014 vxil keeps its own delivery log; not loaded (to seed credits from it, list it in migrate/payments.json and re-run plan)`);
-    } else if (t.rowCountEstimate === 0 && !opts.includeEmpty && policiesOn(t) + fkEdgesOn(t) === 0) {
+      confirm = `${t.name}: ${nameSkip} \u2014 not loaded. If it is app data, re-run plan with \`--include ${t.name}\`; \`--skip ${t.name}\` confirms the skip`;
+      warnings.push(`SKIP (confirm): ${confirm}`);
+      if (SUBSCRIPTION_TABLE_RE.test(t.name)) {
+        reasons.push(`R1: skip (confirm): ${confirm}`);
+        residuals.push(`subscription/entitlement state (${t.name}): NOT seeded \u2014 rebuild from live provider webhooks after cutover`);
+      } else {
+        reasons.push(`T8: skip (confirm): ${confirm} (to seed credits from it instead, list it in migrate/payments.json and re-run plan)`);
+      }
+    } else if (t.rowCountEstimate === 0 && !opts.includeEmpty && !included && policiesOn(t) + fkEdgesOn(t) === 0) {
       target = "skip";
       reasons.push("R1: 0 rows \u2014 likely dropped/legacy; skipped (confirm; --include-empty keeps it)");
     } else {
       target = "cms";
       reasons.push(`R1: ${qualified} \u2192 cms collection '${toCollectionName(t.name)}'`);
+      if (included && nameSkip !== void 0) reasons.push(`kept by --include (${nameSkip})`);
       if (t.rowCountEstimate === 0) {
-        if (opts.includeEmpty) {
-          reasons.push("R1: 0 rows by the catalog estimate \u2014 kept (--include-empty)");
+        if (opts.includeEmpty || included) {
+          reasons.push(`R1: 0 rows by the catalog estimate \u2014 kept (${included ? "--include" : "--include-empty"})`);
         } else {
           reasons.push("T1: 0 rows by the catalog estimate, but it carries row-level rules/FKs \u2014 kept");
           warnings.push(
@@ -17433,20 +17577,32 @@ function inferMapping(source, opts = {}) {
         );
       }
     }
-    classified.push({ table: t, target, reasons });
+    classified.push({ table: t, target, reasons, ...confirm !== void 0 ? { confirm } : {} });
   }
   const cmsByName = /* @__PURE__ */ new Map();
   for (const c of classified) {
     if (c.target === "cms") cmsByName.set(c.table.name, { table: c.table, collection: toCollectionName(c.table.name) });
   }
   const owners = /* @__PURE__ */ new Map();
-  const profileCandidates = [];
+  let profileCandidates = [];
+  for (let pass = 0; pass <= cmsByName.size; pass++) {
+    const userKeyed = new Set(profileCandidates);
+    owners.clear();
+    const next = [];
+    for (const { table } of cmsByName.values()) {
+      const o = detectOwner(table, source, authTable, opts, userKeyed);
+      if (!o) continue;
+      owners.set(table.name, o);
+      const pkCols = table.columns.filter((c) => c.isPk);
+      if (pkCols.length === 1 && pkCols[0].name === o.column) next.push(table.name);
+    }
+    const stable = next.length === profileCandidates.length && next.every((n) => userKeyed.has(n));
+    profileCandidates = next;
+    if (stable) break;
+  }
   for (const { table } of cmsByName.values()) {
-    const o = detectOwner(table, source, authTable, opts);
+    const o = owners.get(table.name);
     if (!o) continue;
-    owners.set(table.name, o);
-    const pkCols = table.columns.filter((c) => c.isPk);
-    if (pkCols.length === 1 && pkCols[0].name === o.column) profileCandidates.push(table.name);
     if (o.ambiguousAmong) {
       const preferred = OWNER_NAMES.includes(o.column);
       const line = `T6: ${table.name} has ${o.ambiguousAmong.length} user-ref columns (${o.ambiguousAmong.join(", ")}) \u2014 owner '${o.column}'${preferred ? " (the preferred owner name)" : " is a GUESS"}; confirm ownerField in plan.json`;
@@ -17475,9 +17631,9 @@ function inferMapping(source, opts = {}) {
       }
     }
   }
-  for (const { table: t, target, reasons } of classified) {
+  for (const { table: t, target, reasons, confirm } of classified) {
     if (target !== "cms") {
-      const owner2 = target === "payments-credits" ? detectOwner(t, source, authTable, opts) : void 0;
+      const owner2 = target === "payments-credits" ? detectOwner(t, source, authTable, opts, new Set(profileCandidates)) : void 0;
       const m = {
         table: t.name,
         target,
@@ -17485,7 +17641,8 @@ function inferMapping(source, opts = {}) {
         // end_user_id / the grantOnce grant_key) — no id capture needed.
         idRemap: "value-keyed",
         fields: target === "users" ? authUserFields(t.columns.map((c) => c.name)) : [],
-        reasons
+        reasons,
+        ...confirm !== void 0 ? { confirm } : {}
       };
       const ref = target === "users" ? "id" : owner2?.column;
       if (ref !== void 0) m.userRefColumn = ref;
@@ -17639,11 +17796,27 @@ function inferMapping(source, opts = {}) {
       }
       fields.push(field);
     }
+    if (!owner) {
+      const candidates = t.columns.filter((c) => ownerLikeType(c) && (c.matchesUserIds === true || !fks.has(c.name) && isOwnerLikeName(c.name)));
+      if (candidates.length > 0) {
+        mapping.ownerCandidates = candidates.map((c) => c.name);
+        const why = candidates.map((c) => `${c.name} (${isOwnerLikeName(c.name) ? "its name" : "its values are user ids"})`).join(", ");
+        if (opts.owners?.[t.name] !== OWNER_NONE) {
+          warnings.push(
+            `OWNER (decide): ${t.name} has no owner rule or FK to the users, but ${why} may hold the row owner's user id \u2014 without an owner every end user can read every row. Re-run plan with \`--owner ${t.name}=${candidates[0].name}\` to scope each row to that user, or \`--owner ${t.name}=none\` to import it unscoped on purpose; \`schema --apply\` and \`data --execute\` refuse until then`
+          );
+        }
+      }
+      if (opts.owners?.[t.name] === OWNER_NONE) {
+        mapping.ownerField = OWNER_NONE;
+        mapping.reasons.push(`R6: no owner scoping \u2014 --owner ${t.name}=none (any caller holding cms scopes reads every row)`);
+      }
+    }
     const tokenCols = t.columns.map((c) => c.name).filter((c) => PUSH_TOKEN_RE.test(c));
     if (PUSH_TOKEN_RE.test(t.name) || tokenCols.length > 0) {
       mapping.reasons.push(`T4: push device tokens${tokenCols.length ? ` (${tokenCols.join(", ")})` : ""} \u2014 copied as app data`);
       residuals.push(
-        `push device tokens (${t.name}${tokenCols.length ? `: ${tokenCols.join(", ")}` : ""}): copied as app data into cms '${collection}'${mapping.ownerField ? ` (owner-scoped on ${mapping.ownerField})` : ""} \u2014 vxil has no push provider; send through a function over egress (the push-notifications blueprint), or \`--skip ${t.name}\` and let clients re-enroll after cutover`
+        `push device tokens (${t.name}${tokenCols.length ? `: ${tokenCols.join(", ")}` : ""}): copied as app data into cms '${collection}'${hasOwnerField(mapping) ? ` (owner-scoped on ${mapping.ownerField})` : ""} \u2014 vxil has no push provider; send through a function over egress (the push-notifications blueprint), or \`--skip ${t.name}\` and let clients re-enroll after cutover`
       );
     }
     const change = detectChangeColumn(t, source);
@@ -17718,9 +17891,9 @@ function inferMapping(source, opts = {}) {
         carried = `table not loaded as cms (${m?.target ?? "not in the plan"}) \u2014 nothing to carry`;
       } else if (isOpenRule(p.definition)) {
         carried = `open rule \u2014 nothing to carry (any caller holding cms scopes reads '${m.collection}')`;
-      } else if (m.ownerField && m.userRefColumn !== void 0 && ruleOwnerColumn(p.definition) === m.userRefColumn) {
+      } else if (hasOwnerField(m) && m.userRefColumn !== void 0 && ruleOwnerColumn(p.definition) === m.userRefColumn) {
         carried = isSoleOwnerRule(p.definition, m.userRefColumn) ? `carried by ownerField '${m.ownerField}' of '${m.collection}'` : `partly carried by ownerField '${m.ownerField}' of '${m.collection}': the rest of the rule (an OR / AND / EXISTS branch or another column) is dropped \u2014 re-express it (a public read model, a gateway function on a server key, or a validate hook)`;
-      } else if (m.ownerField) {
+      } else if (hasOwnerField(m)) {
         carried = `NOT expressed by ownerField '${m.ownerField}' of '${m.collection}' \u2014 re-express it (a gateway function on a server key, a validate hook, or a public read model)`;
       } else {
         carried = `'${m.collection}' has no ownerField \u2014 re-express it (a gateway function on a server key; strictEndUserScope makes an unowned collection server-only)`;
@@ -17792,11 +17965,6 @@ function topoOrder(cmsNames, fks, profileTable, warnings) {
 import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
 
-// src/migrate/types.ts
-function newMigrateState() {
-  return { version: 1, schemaPushed: false, cursors: {}, idMap: {} };
-}
-
 // src/migrate/loaders/delta.ts
 import { createHash as createHash2 } from "node:crypto";
 function canonical(v) {
@@ -18462,7 +18630,7 @@ function mappingToCollection(m) {
   }
   return {
     fields,
-    ...m.ownerField !== void 0 ? { ownerField: m.ownerField } : {}
+    ...hasOwnerField(m) ? { ownerField: m.ownerField } : {}
   };
 }
 function planToCollections(plan) {
@@ -19772,12 +19940,21 @@ function emitResidualsMd(plan, sourceLabel) {
   }
   return lines.join("\n") + "\n";
 }
+function undecidedOwners(plan, only) {
+  const steps = only?.length ? new Set(only) : null;
+  return plan.tables.filter((t) => t.target === "cms" && (t.ownerCandidates?.length ?? 0) > 0 && t.ownerField === void 0 && (!steps || steps.has("cms") || steps.has("vectors") || steps.has(t.table)));
+}
+function undecidedOwnersText(tables) {
+  const list = tables.map((t) => `${t.table} (${t.ownerCandidates.join(", ")})`).join(", ");
+  const first = tables[0];
+  return `${tables.length} table(s) have an id-like column that may hold the row owner, and no owner decision: ${list}. Re-run \`vxil migrate plan \u2026 --owner ${first.table}=${first.ownerCandidates[0]}\` to scope each row to that user, or \`--owner ${first.table}=none\` to import it unscoped on purpose (or set "ownerField" in ${MIGRATE_DIR}/plan.json)`;
+}
 function formatPlanSummary(plan) {
   const rows = plan.tables.map((t) => [
     t.table,
-    t.target,
+    t.confirm !== void 0 ? "skip (confirm)" : t.target,
     t.target === "cms" ? t.collection ?? "" : "\u2014",
-    t.ownerField ?? t.userRefColumn ?? "\u2014",
+    t.ownerField ?? t.userRefColumn ?? (t.ownerCandidates?.length ? `? ${t.ownerCandidates.join("|")} (decide)` : "\u2014"),
     t.target === "cms" || t.target === "users" ? String(t.fields.length) : "\u2014"
   ]);
   const head = ["TABLE", "TARGET", "COLLECTION", "OWNER/USER-REF", "FIELDS"];
@@ -19870,6 +20047,9 @@ function loaderDeps({ api, cwd, log }, dryRun) {
 async function runMigrateSchema(io, opts = {}) {
   const plan = readPlanFile(io.cwd);
   const apply = opts.apply === true;
+  const undecided = undecidedOwners(plan);
+  if (undecided.length && apply) throw new Error(`migrate schema --apply refused: ${undecidedOwnersText(undecided)} (nothing was written)`);
+  if (undecided.length) io.log(`  \u26A0 ${undecidedOwnersText(undecided)} \u2014 \`--apply\` refuses until then`);
   const missing = apply ? await missingPlanFeatures(io.api, planFeatureNeeds(plan, { step: "schema" })) : [];
   if (missing.length) throw new Error(`migrate schema --apply refused: ${missingFeaturesText(missing)} (nothing was written)`);
   if (apply) ensureStateIgnored(io.cwd, io.log);
@@ -19913,6 +20093,9 @@ async function runMigrateData(io, opts = {}) {
       io.log(`  \u26A0 migrate/payments.json names '${table}' but plan.json maps it to ${m.target} \u2014 re-run \`vxil migrate plan\` to plan it as payments credits`);
     }
   }
+  const undecided = undecidedOwners(plan, opts.only);
+  if (undecided.length && execute) throw new Error(`migrate data --execute refused: ${undecidedOwnersText(undecided)} (nothing was written)`);
+  if (undecided.length) io.log(`  \u26A0 ${undecidedOwnersText(undecided)} \u2014 \`--execute\` refuses until then`);
   const missing = execute ? await missingPlanFeatures(io.api, planFeatureNeeds(plan, {
     step: "data",
     ...opts.only ? { only: opts.only } : {},
@@ -21575,6 +21758,19 @@ export default defineConfig({
 // src/migrate/adapters/csv-json.ts
 import { readFileSync as readFileSync7, readdirSync, existsSync as existsSync7, statSync } from "node:fs";
 import { basename as basename3, extname, join as join3, resolve as resolve6 } from "node:path";
+
+// src/migrate/adapters/identity.ts
+var IDENTITY_COLUMNS = ["id", "email", "display_name", "avatar_url", "raw_user_meta_data"];
+function splitIdentityColumns(columns) {
+  const keep = columns.filter((c) => IDENTITY_COLUMNS.includes(c));
+  return { keep, dropped: columns.filter((c) => !keep.includes(c)) };
+}
+function identityDroppedWarning(adapter, table, dropped) {
+  if (dropped.length === 0) return void 0;
+  return `${adapter}: the identity read of '${table}' carries only ${IDENTITY_COLUMNS.join(", ")} \u2014 not read (not on the identity allowlist): ${dropped.join(", ")}`;
+}
+
+// src/migrate/adapters/csv-json.ts
 function parseCsv(text) {
   const src = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
   const rows = [];
@@ -21764,6 +21960,9 @@ var CsvJsonAdapter = class {
           columns: cols,
           hasPasswordHash: cols.some((c) => PASSWORDISH_RE.test(c))
         };
+        const dropped = identityDroppedWarning("csv-json", at.name, splitIdentityColumns(cols).dropped);
+        if (dropped) warnings.push(dropped);
+        this.markUserIdColumns(at, tables);
       } else {
         warnings.push(`csv-json: _schema.json authTable '${overrides.authTable}' has no matching file`);
       }
@@ -21871,22 +22070,39 @@ var CsvJsonAdapter = class {
     }) : t.rows;
     yield* this.paged(rows, cursor);
   }
-  /** identity rows from the _schema.json authTable, password-ish columns
-   *  STRIPPED (hash values never leave the export dir — the PII rule). */
+  /** identity rows from the _schema.json authTable — ONLY the identity
+   *  allowlist (IDENTITY_COLUMNS): every other column, a hash in any
+   *  language included, never leaves the export dir (the PII rule). */
   async *readAuthUsers(cursor) {
     const { schema, tables } = this.load();
     if (!schema.authUsers?.present || !schema.authUsers.table) {
       throw new Error("csv-json: no authTable declared in _schema.json \u2014 identity step unavailable");
     }
     const t = tables.get(schema.authUsers.table);
-    const strip = t.columns.map((c) => c.name).filter((c) => PASSWORDISH_RE.test(c));
-    const rows = strip.length === 0 ? t.rows : t.rows.map((r) => {
-      const out = { ...r };
-      for (const c of strip) delete out[c];
+    const { keep } = splitIdentityColumns(t.columns.map((c) => c.name));
+    const rows = t.rows.map((r) => {
+      const out = {};
+      for (const c of keep) if (c in r) out[c] = r[c];
       return out;
     });
     yield* this.paged(rows, cursor);
   }
+  /** R6 owner candidates: a string column of another table whose sampled
+   *  non-null values are ALL ids of the auth table (strings only — small
+   *  integer ids would match any counter column). */
+  markUserIdColumns(auth, tables) {
+    if (!auth.columns.some((c) => c.name === "id")) return;
+    const ids = new Set(auth.rows.map((r) => r.id).filter((v) => typeof v === "string" && v !== ""));
+    if (ids.size === 0) return;
+    for (const t of tables.values()) {
+      if (t === auth) continue;
+      for (const col of t.columns) {
+        if (col.inferredType !== "string") continue;
+        const sample = t.rows.slice(0, this.sampleSize).map((r) => r[col.name]).filter((v) => v !== null && v !== void 0 && v !== "");
+        if (sample.length > 0 && sample.every((v) => typeof v === "string" && ids.has(v))) col.matchesUserIds = true;
+      }
+    }
+  }
   /** storage objects from the `_objects/<bucket>/**` manifest (R14). Bytes are
    *  read LAZILY per object via stream() — a dry-run never opens them. */
   async *readObjects(bucket) {
@@ -22389,14 +22605,25 @@ var GenericPgAdapter = class {
       return;
     }
     const columns = t.columns.map((c) => c.name);
+    const table = this.displayName(t.schema ?? this.schemas[0], t.name);
     const auth = {
       present: true,
-      table: this.displayName(t.schema ?? this.schemas[0], t.name),
+      table,
       columns,
       hasPasswordHash: columns.some((c) => PASSWORDISH_RE2.test(c))
     };
     if (t.rowCountEstimate !== void 0) auth.count = t.rowCountEstimate;
     schema.authUsers = auth;
+    const dropped = identityDroppedWarning(this.providerName, table, this.identityColumns(t).dropped);
+    if (dropped) schema.warnings.push(dropped);
+  }
+  /** the identity allowlist (identity.ts) plus the single pk the keyset
+   *  page needs — never a pattern-filtered "everything else". */
+  identityColumns(t) {
+    const pk = t.columns.filter((c) => c.isPk).map((c) => c.name);
+    const split = splitIdentityColumns(t.columns.map((c) => c.name));
+    const keep = [...split.keep, ...pk.length === 1 && !split.keep.includes(pk[0]) ? pk : []];
+    return { keep, dropped: split.dropped.filter((c) => !keep.includes(c)) };
   }
   findTableIn(schema, table) {
     return schema.tables.find((t) => t.name === table || `${t.schema ?? ""}.${t.name}` === table);
@@ -22450,17 +22677,17 @@ var GenericPgAdapter = class {
       else offset += rows.length;
     }
   }
-  /** generic identity read: the `--auth-table` rows MINUS password/secret-ish
-   *  columns (hash values are never read out — the PII rule; the
-   *  supabase subclass overrides with the auth.users allowlist). */
+  /** generic identity read: the `--auth-table` rows, identity ALLOWLIST
+   *  columns only (identity.ts — a hash column in any language is never read
+   *  out, the PII rule; the supabase subclass overrides with the GoTrue
+   *  auth.users allowlist). */
   async *readAuthUsers(cursor) {
     const source = await this.introspect();
     if (!source.authUsers?.present || !source.authUsers.table) {
       throw new Error("no auth table configured \u2014 pass authTable (--auth-table) for generic-pg sources");
     }
     const t = await this.resolveTable(source.authUsers.table);
-    const safe = t.columns.map((c) => c.name).filter((c) => !PASSWORDISH_RE2.test(c));
-    yield* this.pagedRead(t, safe, cursor);
+    yield* this.pagedRead(t, this.identityColumns(t).keep, cursor);
   }
   async close() {
     await this.sql.end({ timeout: 5 });
@@ -26771,10 +26998,13 @@ vxil functions dev '${name}' stopped.`);
 function migrateUsage() {
   return `usage: vxil migrate <plan|schema|data|verify> [--dev]
   plan    --from supabase|generic-pg|csv-json (--url <pg-url> | --dir <folder>)
-          [--skip a,b] [--include-empty] [--profile-table <table>|none] [--keep-source-id]
+          [--skip a,b] [--include a,b] [--include-empty] [--owner <table>=<column>|none,\u2026]
+          [--profile-table <table>|none] [--keep-source-id]
           introspect the source (read-only; no API key needed) \u2192 migrate/plan.json
           + migrate/vxil.config.suggested.ts + migrate/RESIDUALS.md
-          (credit seeding is opt-in: tables named in migrate/payments.json)
+          (credit seeding is opt-in: tables named in migrate/payments.json; a table skipped only
+          for its NAME prints "skip (confirm)" \u2014 --include loads it; a table with an id-like
+          column but no detected owner must be decided with --owner before schema --apply)
   schema  [--apply]           create the plan's cms + vector-search collections (default: dry-run diff; additive only)
   data    [--execute] [--only users,credentials,cms,vectors,files,payments|<table>,\u2026] [--resume]
           the ordered backfill users \u2192 cms (FK order) \u2192 vectors \u2192 files \u2192 payments-credits
@@ -26868,7 +27098,14 @@ ${migrateUsage()}`);
   try {
     if (sub === "plan") {
       const skip = flag("skip")?.split(",").map((s) => s.trim()).filter(Boolean);
+      const include = flag("include")?.split(",").map((s) => s.trim()).filter(Boolean);
       const profileTable = flag("profile-table");
+      const owners = {};
+      for (const pair of flag("owner")?.split(",").map((s) => s.trim()).filter(Boolean) ?? []) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0 || eq === pair.length - 1) fail(`--owner '${pair}' must be <table>=<column> or <table>=none`);
+        owners[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+      }
       await runMigratePlan({
         adapter,
         cwd,
@@ -26876,6 +27113,8 @@ ${migrateUsage()}`);
         sourceLabel: label,
         infer: {
           ...skip?.length ? { skipTables: skip } : {},
+          ...include?.length ? { includeTables: include } : {},
+          ...Object.keys(owners).length ? { owners } : {},
           ...hasFlag("include-empty") ? { includeEmpty: true } : {},
           ...profileTable !== void 0 ? { profileTable } : {},
           ...hasFlag("keep-source-id") ? { keepSourceId: true } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",