@vxil/cli 0.35.2 → 0.36.0

package/dist/vxil-main.js

@@ -9032,8 +9032,8 @@ var init_lib = __esm({
     };
     CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
     VXIL_CONFIG_PKG_VERSION = "0.26.1";
-    VXIL_SDK_PKG_VERSION = "0.35.1";
-    VXIL_CLI_PKG_VERSION = "0.35.2";
+    VXIL_SDK_PKG_VERSION = "0.35.2";
+    VXIL_CLI_PKG_VERSION = "0.36.0";
     SCAFFOLD_NODE_TYPES_RANGE = "^24.0.0";
     SCAFFOLD_TSCONFIG = {
       compilerOptions: {
@@ -19377,6 +19377,7 @@ var EXTRA_KNOWN_FLAGS = [
   "include-empty",
   "include-password-hashes",
   "with-password-hashes",
+  "password-hash-column",
   "with-oauth-identities",
   "keep-source-id",
   "keep-timestamps",
@@ -20471,7 +20472,7 @@ function inferMapping(source, opts = {}) {
   const cmsNames = [...cmsByName.keys()];
   const loadOrder = topoOrder(cmsNames, source.foreignKeys, profile?.table, warnings);
   if (source.authUsers?.present) {
-    residuals.push(source.authUsers.hasPasswordHash ? "passwords: hashes are NOT imported by default \u2014 `vxil migrate data --with-password-hashes` carries them (bcrypt, verified and rehashed at each user's first sign-in); without it users re-auth via magic-link/OTP/social/reset on first sign-in" : "auth: credentials do not transfer \u2014 users re-auth via their existing OTP/magic-link/social flow post-cutover");
+    residuals.push(source.authUsers.hasPasswordHash ? "passwords: hashes are NOT imported by default \u2014 `vxil migrate data --with-password-hashes` carries them (bcrypt, verified and rehashed at each user's first sign-in; a generic-pg / csv-json source also names the column with `--password-hash-column <column>`); without it users re-auth via magic-link/OTP/social/reset on first sign-in" : "auth: credentials do not transfer \u2014 users re-auth via their existing OTP/magic-link/social flow post-cutover");
   }
   for (const chk of source.checks ?? []) {
     if (!cmsByName.has(lastSeg(chk.table))) continue;
@@ -21113,7 +21114,7 @@ function credentialEntry(row2, withHashes) {
 async function loadCredentials2({ deps, adapter, state, save, opts, delta = false }) {
   const result = { table: KEY, read: 0, written: 0, skipped: 0, errors: [], cursor: null };
   if (!adapter.readCredentials) {
-    result.errors.push("credentials: this source has no credential reader (supabase only today) \u2014 post the hashes yourself with the SDK `auth.users.import()`, or drop --with-password-hashes / --oidc-issuer");
+    result.errors.push("credentials: this source has no credential reader \u2014 post the hashes yourself with the SDK `auth.users.import()`, or drop --with-password-hashes / --oidc-issuer");
     return result;
   }
   const cursors = cursorsFor(state, delta);
@@ -21128,14 +21129,16 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
   const reasons = /* @__PURE__ */ new Map();
   let would = deps.dryRun ? {} : null;
   let withPassword = 0;
+  let refused = 0;
   let withLinks = 0;
   let linked = 0;
-  const readOpts = opts.withIdentities ? { identities: true } : void 0;
+  const readOpts = opts.withIdentities || opts.withHashes ? { ...opts.withIdentities ? { identities: true } : {}, ...opts.withHashes ? { hashes: true } : {} } : void 0;
   for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0, readOpts)) {
     const entries = [];
     const digests = [];
     for (const row2 of batch.rows) {
       result.read++;
+      if (opts.withHashes && row2.hash_refused) refused++;
       const entry = credentialEntry(row2, opts.withHashes);
       const h = rowHash({ ...entry, issuer: opts.oidcIssuer ?? null });
       if (sent[row2.id] === h) {
@@ -21217,6 +21220,9 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
     const list = [...reasons].map(([r, n]) => `${r}=${n}`).join(" ");
     deps.log(`credentials: ${[...reasons.values()].reduce((a, b2) => a + b2, 0)} user(s) not imported (${list}) \u2014 they sign in once another way (magic link, OTP, a reset); \`not_registered\` means the users step did not load them`);
   }
+  if (refused > 0) {
+    deps.log(`credentials: ${refused} password hash(es) are not bcrypt (cost 4\u201310), the only format the import verifies \u2014 ${deps.dryRun ? "they would NOT be sent" : "NOT sent"}; those users are imported without a password and sign in once another way (magic link, OTP, a reset)`);
+  }
   result.cursor = deps.dryRun ? cursors[KEY] ?? null : null;
   return result;
 }
@@ -22525,7 +22531,7 @@ ${notes.length ? `${notes.join("\n")}
 `;
 }
 var STANDING_CAVEATS = [
-  "Passwords: imported only with `vxil migrate data --with-password-hashes` (supabase sources: bcrypt, verified and replaced at each user's first sign-in \u2014 no forced re-sign-in); without it, or for a hash it cannot accept, users re-auth once via magic-link/OTP/social/reset.",
+  "Passwords: imported only with `vxil migrate data --with-password-hashes` (bcrypt, verified and replaced at each user's first sign-in \u2014 no forced re-sign-in; generic-pg / csv-json sources also name the hash column with `--password-hash-column <column>`); without it, or for a hash it cannot accept, users re-auth once via magic-link/OTP/social/reset.",
   "Push device tokens: vxil has no push provider \u2014 token rows migrate as ordinary owner-scoped cms app data, and sending is a function over egress (the push-notifications blueprint); or skip those tables and let clients re-enroll post-cutover.",
   "Subscriptions / entitlements / tier: NEVER seeded (provider-derived truth) \u2014 rebuild from your live provider webhooks after cutover.",
   "DB triggers / RPCs / pg_cron / row-level access rules: not auto-migrated \u2014 hand-wire as vxil functions (cms-hook/cron/http triggers; cms-hooks are async post-commit, never in-transaction) + per-collection ownerField.",
@@ -24905,6 +24911,36 @@ export default defineConfig({
 import { readFileSync as readFileSync8, readdirSync, existsSync as existsSync8, statSync } from "node:fs";
 import { basename as basename3, extname, join as join4, resolve as resolve6 } from "node:path";
 
+// src/migrate/adapters/hashImport.ts
+var BCRYPT_IMPORT_RE = /^\$2[aby]\$(\d{2})\$[./A-Za-z0-9]{53}$/;
+var BCRYPT_IMPORT_MIN_COST = 4;
+var BCRYPT_IMPORT_MAX_COST = 10;
+function importableBcrypt(v) {
+  if (typeof v !== "string") return null;
+  const h = v.trim();
+  const m = BCRYPT_IMPORT_RE.exec(h);
+  if (!m) return null;
+  const cost = Number(m[1]);
+  return cost >= BCRYPT_IMPORT_MIN_COST && cost <= BCRYPT_IMPORT_MAX_COST ? h : null;
+}
+function genericCredentialRow(id, raw) {
+  const empty = raw === null || raw === void 0 || typeof raw === "string" && raw.trim() === "";
+  const hash = empty ? null : importableBcrypt(raw);
+  return {
+    id,
+    password_hash: hash,
+    // a generic source has no confirmed-address column vxil can trust
+    email_verified: false,
+    ...!empty && hash === null ? { hash_refused: true } : {}
+  };
+}
+function missingHashColumnError(from) {
+  return new Error(`--from ${from} --with-password-hashes needs --password-hash-column <column>: the auth table column that holds each user's bcrypt hash (only bcrypt is imported; other formats are reported and not sent)`);
+}
+function noIdentitiesError(from) {
+  return new Error(`--with-oauth-identities reads Supabase auth.identities \u2014 a ${from} source has none; drop the flag`);
+}
+
 // src/migrate/adapters/identity.ts
 var IDENTITY_COLUMNS = ["id", "email", "display_name", "avatar_url", "raw_user_meta_data"];
 function splitIdentityColumns(columns) {
@@ -25026,11 +25062,13 @@ var CsvJsonAdapter = class {
   dir;
   batchSize;
   sampleSize;
+  passwordHashColumn;
   cache;
   constructor(opts) {
     this.dir = resolve6(opts.dir);
     this.batchSize = opts.batchSize ?? 500;
     this.sampleSize = opts.sampleSize ?? 200;
+    this.passwordHashColumn = opts.passwordHashColumn;
   }
   load() {
     if (this.cache) return this.cache;
@@ -25277,6 +25315,28 @@ var CsvJsonAdapter = class {
       };
     }
   }
+  /** The opt-in credentials read — the authTable's `id` plus the
+   *  ONE column the operator named (--password-hash-column), bcrypt only
+   *  (hashImport.ts); without --with-password-hashes no hash is read. */
+  async *readCredentials(cursor, opts = {}) {
+    if (opts.identities) throw noIdentitiesError("csv-json");
+    const { schema, tables } = this.load();
+    if (!schema.authUsers?.present || !schema.authUsers.table) {
+      throw new Error("csv-json: no authTable declared in _schema.json \u2014 credentials step unavailable");
+    }
+    const t = tables.get(schema.authUsers.table);
+    const hashCol = opts.hashes ? this.passwordHashColumn : void 0;
+    if (opts.hashes && hashCol === void 0) throw missingHashColumnError("csv-json");
+    if (hashCol !== void 0 && !t.columns.some((c) => c.name === hashCol)) {
+      throw new Error(`--password-hash-column '${hashCol}' is not a column of the authTable '${t.name}'`);
+    }
+    for await (const batch of this.paged(t.rows, cursor)) {
+      yield {
+        rows: batch.rows.filter((r) => r.id !== null && r.id !== void 0 && r.id !== "").map((r) => genericCredentialRow(String(r.id), hashCol !== void 0 ? r[hashCol] : null)),
+        nextCursor: batch.nextCursor
+      };
+    }
+  }
   async *paged(all, cursor) {
     let offset = 0;
     if (cursor !== void 0 && cursor !== "") {
@@ -25562,6 +25622,7 @@ var GenericPgAdapter = class {
   schemas;
   batchSize;
   authTable;
+  passwordHashColumn;
   redactedUrl;
   /** subclass override point (supabase sets 'supabase'). */
   providerName = "generic-pg";
@@ -25574,6 +25635,7 @@ var GenericPgAdapter = class {
     this.batchSize = opts.batchSize ?? 500;
     this.statementTimeoutMs = Math.trunc(opts.statementTimeoutMs ?? 12e4);
     this.authTable = opts.authTable;
+    this.passwordHashColumn = opts.passwordHashColumn;
     this.redactedUrl = redactSourceUrl(opts.url);
     this.sql = src_default(opts.url, {
       max: 1,
@@ -25871,6 +25933,33 @@ var GenericPgAdapter = class {
     const t = await this.resolveTable(source.authUsers.table);
     yield* this.pagedRead(t, this.identityColumns(t).keep, cursor);
   }
+  /** The opt-in credentials read of a generic source — the auth
+   *  table's `id` plus the ONE column the operator named
+   *  (--password-hash-column), bcrypt only (hashImport.ts). The hashes are
+   *  held in memory and sent only in the import body, never logged. Without
+   *  --with-password-hashes (an --oidc-issuer-only run) no hash is read. */
+  async *readCredentials(cursor, opts = {}) {
+    if (opts.identities) throw noIdentitiesError(this.providerName);
+    const source = await this.introspect();
+    if (!source.authUsers?.present || !source.authUsers.table) {
+      throw new Error("no auth table configured \u2014 pass --auth-table for generic-pg sources");
+    }
+    const t = await this.resolveTable(source.authUsers.table);
+    const hashCol = opts.hashes ? this.passwordHashColumn : void 0;
+    if (opts.hashes && hashCol === void 0) throw missingHashColumnError(this.providerName);
+    if (hashCol !== void 0 && !t.columns.some((c) => c.name === hashCol)) {
+      throw new Error(`--password-hash-column '${hashCol}' is not a column of the auth table '${t.name}'`);
+    }
+    if (!t.columns.some((c) => c.name === "id")) throw new Error(`the auth table '${t.name}' has no id column`);
+    const pk = t.columns.filter((c) => c.isPk).map((c) => c.name);
+    const cols = [.../* @__PURE__ */ new Set(["id", ...hashCol !== void 0 ? [hashCol] : [], ...pk.length === 1 ? pk : []])];
+    for await (const batch of this.pagedRead(t, cols, cursor)) {
+      yield {
+        rows: batch.rows.filter((r) => r.id !== null && r.id !== void 0 && r.id !== "").map((r) => genericCredentialRow(String(r.id), hashCol !== void 0 ? r[hashCol] : null)),
+        nextCursor: batch.nextCursor
+      };
+    }
+  }
   async close() {
     await this.sql.end({ timeout: 5 });
   }
@@ -26141,6 +26230,7 @@ function pgOpts(opts) {
     url: requireUrl(opts),
     ...opts.schemas !== void 0 ? { schemas: opts.schemas } : {},
     ...opts.authTable !== void 0 ? { authTable: opts.authTable } : {},
+    ...opts.passwordHashColumn !== void 0 ? { passwordHashColumn: opts.passwordHashColumn } : {},
     ...opts.batchSize !== void 0 ? { batchSize: opts.batchSize } : {},
     ...opts.statementTimeoutMs !== void 0 ? { statementTimeoutMs: opts.statementTimeoutMs } : {}
   };
@@ -26155,6 +26245,7 @@ var registry = /* @__PURE__ */ new Map([
     if (!opts.dir) throw new Error("--from csv-json needs --dir <export-directory>");
     return new CsvJsonAdapter({
       dir: opts.dir,
+      ...opts.passwordHashColumn !== void 0 ? { passwordHashColumn: opts.passwordHashColumn } : {},
       ...opts.batchSize !== void 0 ? { batchSize: opts.batchSize } : {}
     });
   }]
@@ -30270,7 +30361,8 @@ function migrateUsage() {
           step on the server: created/kept/skipped by reason, nothing written) \xB7 [--file-links shared-link] stored
           public file URLs become stable shared links instead of object ids
           \xB7 [--with-oauth-identities] carry the Google/Apple/GitHub/Facebook sign-in links (needs
-          --with-password-hashes in the same run) \xB7 [--keep-timestamps] keep each row's source
+          --with-password-hashes in the same run) \xB7 generic-pg / csv-json: --with-password-hashes
+          --password-hash-column <column> (bcrypt only; other formats are reported, not sent) \xB7 [--keep-timestamps] keep each row's source
           created_at / updated_at (cms creates; server key only)
           \xB7 [--files-owner <user id>] the owner of every migrated file (default: the path's first
           segment) \xB7 [--files-org-from-prefix] the path's first segment is the WORKSPACE (org_id):
@@ -30293,6 +30385,7 @@ ${migrateUsage()}`);
   const url = flag("url");
   const dir = flag("dir");
   const authTable = flag("auth-table");
+  const passwordHashColumn = flag("password-hash-column");
   const schemas = flag("schemas");
   const batch = flag("batch");
   const sbUrl = process.env.SUPABASE_URL;
@@ -30302,6 +30395,7 @@ ${migrateUsage()}`);
     ...url !== void 0 ? { url } : {},
     ...dir !== void 0 ? { dir } : {},
     ...authTable !== void 0 ? { authTable } : {},
+    ...passwordHashColumn !== void 0 ? { passwordHashColumn } : {},
     ...schemas !== void 0 ? { schemas: schemas.split(",").map((s) => s.trim()).filter(Boolean) } : {},
     ...batch !== void 0 ? { batchSize: Number(batch) } : {},
     ...from === "supabase" && sbUrl && sbKey ? { storage: { url: sbUrl, serviceKey: sbKey } } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.35.2",
+  "version": "0.36.0",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",