@vxil/cli 0.35.2 → 0.36.1

package/dist/_vxil-feature-configs.d.ts

@@ -73,6 +73,24 @@ export declare const SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:
  * a list so a newly launched SES region needs no vxil release; a typo still
  * fails at `vxil push` (TypeBox), never as a DNS error on the first send. */
 export declare const SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
+/** (w45 W44-WEBHOOK-SECRETREF-PATTERN) the ONE pattern every webhook secret
+ *  ref shares (notifications `webhookSecretRef`, payments `stripe` / `paddle`
+ *  / `revenuecat` `webhookSecretRef`): a secret-store name, letters, digits or
+ *  '_', at most 64, with the optional `secret:` prefix both resolvers strip
+ *  (payments-v1 resolveProviderSecrets, notifications-v1
+ *  resolveTenantSecretRef). Stored secret names are lowercase-only
+ *  (control-plane SECRET_NAME_RE), so both resolvers LOWERCASE the name after
+ *  the strip: a capital ref reads its lowercase row. Upper case is accepted
+ *  (founder decision D-k2-1 option (a), parked; built per the w45 brief) so
+ *  this pattern refuses no stored config: the w45 read-only count found
+ *  stored refs with capitals on staging, which never resolved before the
+ *  lowercasing (so they were not live). A typo shape (a space, '-', '.', a
+ *  path, an empty or over-long name) is refused at push instead of failing
+ *  closed only when a webhook arrives. */
+export declare const WEBHOOK_SECRET_REF_PATTERN = "^(secret:)?[A-Za-z0-9_]{1,64}$";
+/** The validator's message for a ref that misses WEBHOOK_SECRET_REF_PATTERN
+ *  (TypeBox's own reads "Expected string to match '…'"). */
+export declare const WEBHOOK_SECRET_REF_MESSAGE = "a secret ref is the name of a stored secret: lowercase letters, numbers or '_' (capitals are read as lowercase), at most 64 characters, optionally prefixed 'secret:'";
 export declare const NotificationsConfigSchema: import("@sinclair/typebox").TObject<{
     enabled: import("@sinclair/typebox").TBoolean;
     fromEmail: import("@sinclair/typebox").TString;
@@ -834,6 +852,7 @@ export declare const PaymentsConfigSchema: import("@sinclair/typebox").TObject<{
         webhookSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         acceptSandbox: import("@sinclair/typebox").TBoolean;
         sandboxUsers: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        testStore: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"accept">, import("@sinclair/typebox").TLiteral<"reject">]>>;
     }>>;
     paypal: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         clientIdRef: import("@sinclair/typebox").TString;

package/dist/vxil-main.js

@@ -5322,7 +5322,7 @@ function isDeclaredOnOwnerErase(v) {
 function onOwnerEraseWidens(declared, remote) {
   return declared === "delete" && remote !== "delete";
 }
-var FN_RETRY_MAX_ATTEMPTS, FN_FORWARD_HEADERS_MAX, FN_SERVER_SCOPES_MAX, NOTIF_OVERRIDE_SUBJECT_MAX, NOTIF_OVERRIDE_BODY_MAX, NOTIF_OVERRIDE_MAX_BYTES, SNS_TOPIC_ARN_PATTERN, SES_REGION_PATTERN, NotificationsConfigSchema, GENERATION_DEFAULTS, GENERATION_BOUNDS, JobsConfigSchema, OAuthRefsSchema, AppleRefsSchema, OidcProviderSchema, REDIRECT_ORIGIN_PATTERN, AuthConfigSchema, RL_POLICY_NAME_PATTERN, RL_MAX_DECLARED_POLICIES, DeclaredRlPolicySchema, RateLimitsConfigSchema, FilesConfigSchema, DeclaredWebhookSubscriptionSchema, WebhooksConfigSchema, CommentsConfigSchema, CMS_MAX_COLLECTIONS_CEILING, CMS_QUERY_DEFAULTS, CmsConfigSchema, McpConfigSchema, RealtimeConfigSchema, PresenceConfigSchema, DeclaredOrgRoleSchema, OrgsConfigSchema, ActivityFeedConfigSchema, SEARCH_COLLECTION_DECLARED_CAP, SEARCH_COLLECTION_DIMS, DeclaredSearchCollectionSchema, HybridLaneWeights, VectorSearchConfigSchema, AI_TEMPLATE_NAME_PATTERN, AI_MAX_DECLARED_TEMPLATES, DeclaredAiTemplateSchema, AiConfigSchema, RagConfigSchema, PaymentsConfigSchema, FunctionsConfigSchema, CopilotConfigSchema, DENY_FUNCTION_SCOPES, FEATURE_KEYS, CMS_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_DEFAULT;
+var FN_RETRY_MAX_ATTEMPTS, FN_FORWARD_HEADERS_MAX, FN_SERVER_SCOPES_MAX, NOTIF_OVERRIDE_SUBJECT_MAX, NOTIF_OVERRIDE_BODY_MAX, NOTIF_OVERRIDE_MAX_BYTES, SNS_TOPIC_ARN_PATTERN, SES_REGION_PATTERN, WEBHOOK_SECRET_REF_PATTERN, webhookSecretRef, NotificationsConfigSchema, GENERATION_DEFAULTS, GENERATION_BOUNDS, JobsConfigSchema, OAuthRefsSchema, AppleRefsSchema, OidcProviderSchema, REDIRECT_ORIGIN_PATTERN, AuthConfigSchema, RL_POLICY_NAME_PATTERN, RL_MAX_DECLARED_POLICIES, DeclaredRlPolicySchema, RateLimitsConfigSchema, FilesConfigSchema, DeclaredWebhookSubscriptionSchema, WebhooksConfigSchema, CommentsConfigSchema, CMS_MAX_COLLECTIONS_CEILING, CMS_QUERY_DEFAULTS, CmsConfigSchema, McpConfigSchema, RealtimeConfigSchema, PresenceConfigSchema, DeclaredOrgRoleSchema, OrgsConfigSchema, ActivityFeedConfigSchema, SEARCH_COLLECTION_DECLARED_CAP, SEARCH_COLLECTION_DIMS, DeclaredSearchCollectionSchema, HybridLaneWeights, VectorSearchConfigSchema, AI_TEMPLATE_NAME_PATTERN, AI_MAX_DECLARED_TEMPLATES, DeclaredAiTemplateSchema, AiConfigSchema, RagConfigSchema, PaymentsConfigSchema, FunctionsConfigSchema, CopilotConfigSchema, DENY_FUNCTION_SCOPES, FEATURE_KEYS, CMS_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_MAX, CMS_DELETED_RETAIN_DAYS_DEFAULT;
 var init_src = __esm({
   "../feature-configs/src/index.ts"() {
     "use strict";
@@ -5354,6 +5354,8 @@ var init_src = __esm({
     NOTIF_OVERRIDE_MAX_BYTES = 64 * 1024;
     SNS_TOPIC_ARN_PATTERN = "^arn:aws(-[a-z]+)?:sns:[a-z0-9-]+:\\d{12}:[A-Za-z0-9_-]{1,256}$";
     SES_REGION_PATTERN = "^[a-z]{2}(-[a-z]+)+-\\d$";
+    WEBHOOK_SECRET_REF_PATTERN = "^(secret:)?[A-Za-z0-9_]{1,64}$";
+    webhookSecretRef = () => Type.String({ pattern: WEBHOOK_SECRET_REF_PATTERN });
     NotificationsConfigSchema = Type.Object({
       enabled: Type.Boolean({ default: true }),
       fromEmail: Type.String({ format: "email" }),
@@ -5369,7 +5371,7 @@ var init_src = __esm({
       // instead of the platform-wide PROVIDER_WEBHOOK_SECRET, binding the signature
       // to the tenant so a signed event for tenant A can never validate at tenant
       // B's webhook URL (mirrors payments revenuecat.webhookSecretRef).
-      webhookSecretRef: Type.Optional(Type.String()),
+      webhookSecretRef: Type.Optional(webhookSecretRef()),
       // 'mock' exists for staging/e2e (deterministic provider); 'resend' is MVP;
       // 'ses' (2026-09-19) is the second real provider — Amazon SES v2, BYO IAM
       // keys, same delivery/suppression/preference pipeline as resend.
@@ -6722,12 +6724,12 @@ var init_src = __esm({
       // "configure it or not", not each inner ref — guide ch. 6, auth).
       stripe: Type.Optional(Type.Object({
         secretKeyRef: Type.String(),
-        webhookSecretRef: Type.String(),
+        webhookSecretRef: webhookSecretRef(),
         taxEnabled: Type.Boolean({ default: false })
       })),
       paddle: Type.Optional(Type.Object({
         apiKeyRef: Type.String(),
-        webhookSecretRef: Type.String(),
+        webhookSecretRef: webhookSecretRef(),
         sandbox: Type.Boolean({ default: false })
       })),
       revenuecat: Type.Optional(Type.Object({
@@ -6743,7 +6745,7 @@ var init_src = __esm({
         // verification, it fails CLOSED: every delivery is 401 bad_signature with a
         // `sig_failed` row that can never be reprocessed. Mirrors stripe/paddle
         // webhookSecretRef.
-        webhookSecretRef: Type.Optional(Type.String()),
+        webhookSecretRef: Type.Optional(webhookSecretRef()),
         // Environment integrity. RevenueCat posts SANDBOX
         // and PRODUCTION events to the SAME webhook with the same auth header, so a
         // sandbox purchase would otherwise fold into production entitlements. A
@@ -6761,7 +6763,19 @@ var init_src = __esm({
         // TestFlight purchase and is refused by the CLI's production promotion
         // gate). No default on purpose (Value.Default would materialize it into
         // every RC manifest); absent = an empty list.
-        sandboxUsers: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 20 }))
+        sandboxUsers: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 256 }), { maxItems: 20 })),
+        // (2026-11-03) RevenueCat Test Store purchases.
+        // A Test Store purchase is SANDBOX data that needs no store account,
+        // invite or license tester (anyone with the app's public `test_` key can
+        // make one), so `acceptSandbox: true` on a production project would fold
+        // it. 'reject' refuses every delivery whose RAW RevenueCat event says
+        // `store: TEST_STORE` (and every sync/restore snapshot from the Test
+        // Store) BEFORE any other environment rule, `sandboxUsers` included: the
+        // delivery is kept as outcome 'rejected_test_store' (200, never folded).
+        // Absent = 'accept' (today's behaviour). No schema default on purpose
+        // (the sandboxUsers rule: Value.Default would materialize it into every RC
+        // manifest); the reader (payments-v1 environmentAccepted) owns the default.
+        testStore: Type.Optional(Type.Union([Type.Literal("accept"), Type.Literal("reject")]))
       })),
       paypal: Type.Optional(Type.Object({
         clientIdRef: Type.String(),
@@ -9031,9 +9045,9 @@ var init_lib = __esm({
       timeoutMs: { min: 1e3, max: 12e4 }
     };
     CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-    VXIL_CONFIG_PKG_VERSION = "0.26.1";
-    VXIL_SDK_PKG_VERSION = "0.35.1";
-    VXIL_CLI_PKG_VERSION = "0.35.2";
+    VXIL_CONFIG_PKG_VERSION = "0.27.0";
+    VXIL_SDK_PKG_VERSION = "0.35.3";
+    VXIL_CLI_PKG_VERSION = "0.36.1";
     SCAFFOLD_NODE_TYPES_RANGE = "^24.0.0";
     SCAFFOLD_TSCONFIG = {
       compilerOptions: {
@@ -13341,7 +13355,7 @@ function promotionRefusals(cfg, allowed) {
     out.push({
       kind: "sandbox",
       flag: PROMOTION_OVERRIDE_FLAGS.sandbox,
-      message: `sandbox provider flags [${sandboxes.join(", ")}] would ship to a live money path (a sandbox key signs with the wrong secret; revenuecat.acceptSandbox folds EVERY TestFlight / test-track purchase into live entitlements \u2014 for store review, list the reviewer app_user_ids in revenuecat.sandboxUsers instead, which a production push allows). Set them false, or override with --${PROMOTION_OVERRIDE_FLAGS.sandbox}.`
+      message: `sandbox provider flags [${sandboxes.join(", ")}] would ship to a live money path (a sandbox key signs with the wrong secret; revenuecat.acceptSandbox folds EVERY TestFlight / test-track purchase into live entitlements \u2014 for store review, list the reviewer app_user_ids in revenuecat.sandboxUsers instead, which a production push allows; if you override it for testers, also set revenuecat.testStore: 'reject', or anyone with the Test Store key folds a purchase). Set them false, or override with --${PROMOTION_OVERRIDE_FLAGS.sandbox}.`
     });
   }
   const devOrigins = devRedirectOrigins(redirectOrigins(cfg));
@@ -17505,13 +17519,13 @@ var TOOLS = [
   {
     name: "payments_list_webhook_events",
     feature: "payments",
-    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product, or a RevenueCat entitlement id that is not a ledger.tierMap key (with no ledger.priceMap hit) \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
+    description: "List provider webhook deliveries from the event log, newest-first: outcome (received|processed|error|sig_failed|parse_failed|reprocessed|ignored|unowned|rejected_environment|rejected_test_store), the provider-reported environment (production|sandbox), signature status, error, and timestamps per delivery. Use it to diagnose billing sync issues (e.g. an unmapped price or product, or a RevenueCat entitlement id that is not a ledger.tierMap key (with no ledger.priceMap hit) \u2192 outcome error, a misconfigured webhook secret producing sig_failed rows, sandbox deliveries landing as rejected_environment, RevenueCat Test Store purchases refused under revenuecat.testStore 'reject' landing as rejected_test_store). An unmapped one-off product lands `error` unless you set ledger.unmappedProduct:'ignore', which lands it `ignored` instead. Read-only \u2014 needs payments:read. Server-side key only (403 server_only on a thin-client/end-user key) \u2014 the log is tenant-wide and carries provider payloads. Payloads are detail-only (console surface).",
     inputSchema: {
       type: "object",
       properties: {
         provider: { type: "string", enum: ["mock", "stripe", "paddle", "revenuecat", "paypal"] },
         event_type: { type: "string", description: "Exact event type filter, e.g. 'subscription.updated'." },
-        outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment"] },
+        outcome: { type: "string", enum: ["received", "processed", "error", "sig_failed", "parse_failed", "reprocessed", "ignored", "unowned", "rejected_environment", "rejected_test_store"] },
         environment: { type: "string", enum: ["production", "sandbox"], description: "The provider-reported environment of the delivery (a separate axis from the API key label)." },
         provider_charge_id: { type: "string", maxLength: 200, description: "Exact match on the normalised charge id (the same provider_charge_id a payments.charge.* event carries): the delivery that recorded that charge plus any refund/dispute against it \u2014 usually one row, so ONE detail read (GET /v1/payments/webhook-events/{eventId}) fetches the verified payload. Rows received before 2026-09-19 carry no charge id." },
         provider_evt_id: { type: "string", maxLength: 200, description: "Exact match on the provider's own event id (the provider_evt_id every row shows)." },
@@ -19377,6 +19391,7 @@ var EXTRA_KNOWN_FLAGS = [
   "include-empty",
   "include-password-hashes",
   "with-password-hashes",
+  "password-hash-column",
   "with-oauth-identities",
   "keep-source-id",
   "keep-timestamps",
@@ -20471,7 +20486,7 @@ function inferMapping(source, opts = {}) {
   const cmsNames = [...cmsByName.keys()];
   const loadOrder = topoOrder(cmsNames, source.foreignKeys, profile?.table, warnings);
   if (source.authUsers?.present) {
-    residuals.push(source.authUsers.hasPasswordHash ? "passwords: hashes are NOT imported by default \u2014 `vxil migrate data --with-password-hashes` carries them (bcrypt, verified and rehashed at each user's first sign-in); without it users re-auth via magic-link/OTP/social/reset on first sign-in" : "auth: credentials do not transfer \u2014 users re-auth via their existing OTP/magic-link/social flow post-cutover");
+    residuals.push(source.authUsers.hasPasswordHash ? "passwords: hashes are NOT imported by default \u2014 `vxil migrate data --with-password-hashes` carries them (bcrypt, verified and rehashed at each user's first sign-in; a generic-pg / csv-json source also names the column with `--password-hash-column <column>`); without it users re-auth via magic-link/OTP/social/reset on first sign-in" : "auth: credentials do not transfer \u2014 users re-auth via their existing OTP/magic-link/social flow post-cutover");
   }
   for (const chk of source.checks ?? []) {
     if (!cmsByName.has(lastSeg(chk.table))) continue;
@@ -21113,7 +21128,7 @@ function credentialEntry(row2, withHashes) {
 async function loadCredentials2({ deps, adapter, state, save, opts, delta = false }) {
   const result = { table: KEY, read: 0, written: 0, skipped: 0, errors: [], cursor: null };
   if (!adapter.readCredentials) {
-    result.errors.push("credentials: this source has no credential reader (supabase only today) \u2014 post the hashes yourself with the SDK `auth.users.import()`, or drop --with-password-hashes / --oidc-issuer");
+    result.errors.push("credentials: this source has no credential reader \u2014 post the hashes yourself with the SDK `auth.users.import()`, or drop --with-password-hashes / --oidc-issuer");
     return result;
   }
   const cursors = cursorsFor(state, delta);
@@ -21128,14 +21143,16 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
   const reasons = /* @__PURE__ */ new Map();
   let would = deps.dryRun ? {} : null;
   let withPassword = 0;
+  let refused = 0;
   let withLinks = 0;
   let linked = 0;
-  const readOpts = opts.withIdentities ? { identities: true } : void 0;
+  const readOpts = opts.withIdentities || opts.withHashes ? { ...opts.withIdentities ? { identities: true } : {}, ...opts.withHashes ? { hashes: true } : {} } : void 0;
   for await (const batch of adapter.readCredentials(cursors[KEY] ?? void 0, readOpts)) {
     const entries = [];
     const digests = [];
     for (const row2 of batch.rows) {
       result.read++;
+      if (opts.withHashes && row2.hash_refused) refused++;
       const entry = credentialEntry(row2, opts.withHashes);
       const h = rowHash({ ...entry, issuer: opts.oidcIssuer ?? null });
       if (sent[row2.id] === h) {
@@ -21217,6 +21234,9 @@ async function loadCredentials2({ deps, adapter, state, save, opts, delta = fals
     const list = [...reasons].map(([r, n]) => `${r}=${n}`).join(" ");
     deps.log(`credentials: ${[...reasons.values()].reduce((a, b2) => a + b2, 0)} user(s) not imported (${list}) \u2014 they sign in once another way (magic link, OTP, a reset); \`not_registered\` means the users step did not load them`);
   }
+  if (refused > 0) {
+    deps.log(`credentials: ${refused} password hash(es) are not bcrypt (cost 4\u201310), the only format the import verifies \u2014 ${deps.dryRun ? "they would NOT be sent" : "NOT sent"}; those users are imported without a password and sign in once another way (magic link, OTP, a reset)`);
+  }
   result.cursor = deps.dryRun ? cursors[KEY] ?? null : null;
   return result;
 }
@@ -22525,7 +22545,7 @@ ${notes.length ? `${notes.join("\n")}
 `;
 }
 var STANDING_CAVEATS = [
-  "Passwords: imported only with `vxil migrate data --with-password-hashes` (supabase sources: bcrypt, verified and replaced at each user's first sign-in \u2014 no forced re-sign-in); without it, or for a hash it cannot accept, users re-auth once via magic-link/OTP/social/reset.",
+  "Passwords: imported only with `vxil migrate data --with-password-hashes` (bcrypt, verified and replaced at each user's first sign-in \u2014 no forced re-sign-in; generic-pg / csv-json sources also name the hash column with `--password-hash-column <column>`); without it, or for a hash it cannot accept, users re-auth once via magic-link/OTP/social/reset.",
   "Push device tokens: vxil has no push provider \u2014 token rows migrate as ordinary owner-scoped cms app data, and sending is a function over egress (the push-notifications blueprint); or skip those tables and let clients re-enroll post-cutover.",
   "Subscriptions / entitlements / tier: NEVER seeded (provider-derived truth) \u2014 rebuild from your live provider webhooks after cutover.",
   "DB triggers / RPCs / pg_cron / row-level access rules: not auto-migrated \u2014 hand-wire as vxil functions (cms-hook/cron/http triggers; cms-hooks are async post-commit, never in-transaction) + per-collection ownerField.",
@@ -24905,6 +24925,36 @@ export default defineConfig({
 import { readFileSync as readFileSync8, readdirSync, existsSync as existsSync8, statSync } from "node:fs";
 import { basename as basename3, extname, join as join4, resolve as resolve6 } from "node:path";
 
+// src/migrate/adapters/hashImport.ts
+var BCRYPT_IMPORT_RE = /^\$2[aby]\$(\d{2})\$[./A-Za-z0-9]{53}$/;
+var BCRYPT_IMPORT_MIN_COST = 4;
+var BCRYPT_IMPORT_MAX_COST = 10;
+function importableBcrypt(v) {
+  if (typeof v !== "string") return null;
+  const h = v.trim();
+  const m = BCRYPT_IMPORT_RE.exec(h);
+  if (!m) return null;
+  const cost = Number(m[1]);
+  return cost >= BCRYPT_IMPORT_MIN_COST && cost <= BCRYPT_IMPORT_MAX_COST ? h : null;
+}
+function genericCredentialRow(id, raw) {
+  const empty = raw === null || raw === void 0 || typeof raw === "string" && raw.trim() === "";
+  const hash = empty ? null : importableBcrypt(raw);
+  return {
+    id,
+    password_hash: hash,
+    // a generic source has no confirmed-address column vxil can trust
+    email_verified: false,
+    ...!empty && hash === null ? { hash_refused: true } : {}
+  };
+}
+function missingHashColumnError(from) {
+  return new Error(`--from ${from} --with-password-hashes needs --password-hash-column <column>: the auth table column that holds each user's bcrypt hash (only bcrypt is imported; other formats are reported and not sent)`);
+}
+function noIdentitiesError(from) {
+  return new Error(`--with-oauth-identities reads Supabase auth.identities \u2014 a ${from} source has none; drop the flag`);
+}
+
 // src/migrate/adapters/identity.ts
 var IDENTITY_COLUMNS = ["id", "email", "display_name", "avatar_url", "raw_user_meta_data"];
 function splitIdentityColumns(columns) {
@@ -25026,11 +25076,13 @@ var CsvJsonAdapter = class {
   dir;
   batchSize;
   sampleSize;
+  passwordHashColumn;
   cache;
   constructor(opts) {
     this.dir = resolve6(opts.dir);
     this.batchSize = opts.batchSize ?? 500;
     this.sampleSize = opts.sampleSize ?? 200;
+    this.passwordHashColumn = opts.passwordHashColumn;
   }
   load() {
     if (this.cache) return this.cache;
@@ -25277,6 +25329,28 @@ var CsvJsonAdapter = class {
       };
     }
   }
+  /** The opt-in credentials read — the authTable's `id` plus the
+   *  ONE column the operator named (--password-hash-column), bcrypt only
+   *  (hashImport.ts); without --with-password-hashes no hash is read. */
+  async *readCredentials(cursor, opts = {}) {
+    if (opts.identities) throw noIdentitiesError("csv-json");
+    const { schema, tables } = this.load();
+    if (!schema.authUsers?.present || !schema.authUsers.table) {
+      throw new Error("csv-json: no authTable declared in _schema.json \u2014 credentials step unavailable");
+    }
+    const t = tables.get(schema.authUsers.table);
+    const hashCol = opts.hashes ? this.passwordHashColumn : void 0;
+    if (opts.hashes && hashCol === void 0) throw missingHashColumnError("csv-json");
+    if (hashCol !== void 0 && !t.columns.some((c) => c.name === hashCol)) {
+      throw new Error(`--password-hash-column '${hashCol}' is not a column of the authTable '${t.name}'`);
+    }
+    for await (const batch of this.paged(t.rows, cursor)) {
+      yield {
+        rows: batch.rows.filter((r) => r.id !== null && r.id !== void 0 && r.id !== "").map((r) => genericCredentialRow(String(r.id), hashCol !== void 0 ? r[hashCol] : null)),
+        nextCursor: batch.nextCursor
+      };
+    }
+  }
   async *paged(all, cursor) {
     let offset = 0;
     if (cursor !== void 0 && cursor !== "") {
@@ -25562,6 +25636,7 @@ var GenericPgAdapter = class {
   schemas;
   batchSize;
   authTable;
+  passwordHashColumn;
   redactedUrl;
   /** subclass override point (supabase sets 'supabase'). */
   providerName = "generic-pg";
@@ -25574,6 +25649,7 @@ var GenericPgAdapter = class {
     this.batchSize = opts.batchSize ?? 500;
     this.statementTimeoutMs = Math.trunc(opts.statementTimeoutMs ?? 12e4);
     this.authTable = opts.authTable;
+    this.passwordHashColumn = opts.passwordHashColumn;
     this.redactedUrl = redactSourceUrl(opts.url);
     this.sql = src_default(opts.url, {
       max: 1,
@@ -25871,6 +25947,33 @@ var GenericPgAdapter = class {
     const t = await this.resolveTable(source.authUsers.table);
     yield* this.pagedRead(t, this.identityColumns(t).keep, cursor);
   }
+  /** The opt-in credentials read of a generic source — the auth
+   *  table's `id` plus the ONE column the operator named
+   *  (--password-hash-column), bcrypt only (hashImport.ts). The hashes are
+   *  held in memory and sent only in the import body, never logged. Without
+   *  --with-password-hashes (an --oidc-issuer-only run) no hash is read. */
+  async *readCredentials(cursor, opts = {}) {
+    if (opts.identities) throw noIdentitiesError(this.providerName);
+    const source = await this.introspect();
+    if (!source.authUsers?.present || !source.authUsers.table) {
+      throw new Error("no auth table configured \u2014 pass --auth-table for generic-pg sources");
+    }
+    const t = await this.resolveTable(source.authUsers.table);
+    const hashCol = opts.hashes ? this.passwordHashColumn : void 0;
+    if (opts.hashes && hashCol === void 0) throw missingHashColumnError(this.providerName);
+    if (hashCol !== void 0 && !t.columns.some((c) => c.name === hashCol)) {
+      throw new Error(`--password-hash-column '${hashCol}' is not a column of the auth table '${t.name}'`);
+    }
+    if (!t.columns.some((c) => c.name === "id")) throw new Error(`the auth table '${t.name}' has no id column`);
+    const pk = t.columns.filter((c) => c.isPk).map((c) => c.name);
+    const cols = [.../* @__PURE__ */ new Set(["id", ...hashCol !== void 0 ? [hashCol] : [], ...pk.length === 1 ? pk : []])];
+    for await (const batch of this.pagedRead(t, cols, cursor)) {
+      yield {
+        rows: batch.rows.filter((r) => r.id !== null && r.id !== void 0 && r.id !== "").map((r) => genericCredentialRow(String(r.id), hashCol !== void 0 ? r[hashCol] : null)),
+        nextCursor: batch.nextCursor
+      };
+    }
+  }
   async close() {
     await this.sql.end({ timeout: 5 });
   }
@@ -26141,6 +26244,7 @@ function pgOpts(opts) {
     url: requireUrl(opts),
     ...opts.schemas !== void 0 ? { schemas: opts.schemas } : {},
     ...opts.authTable !== void 0 ? { authTable: opts.authTable } : {},
+    ...opts.passwordHashColumn !== void 0 ? { passwordHashColumn: opts.passwordHashColumn } : {},
     ...opts.batchSize !== void 0 ? { batchSize: opts.batchSize } : {},
     ...opts.statementTimeoutMs !== void 0 ? { statementTimeoutMs: opts.statementTimeoutMs } : {}
   };
@@ -26155,6 +26259,7 @@ var registry = /* @__PURE__ */ new Map([
     if (!opts.dir) throw new Error("--from csv-json needs --dir <export-directory>");
     return new CsvJsonAdapter({
       dir: opts.dir,
+      ...opts.passwordHashColumn !== void 0 ? { passwordHashColumn: opts.passwordHashColumn } : {},
       ...opts.batchSize !== void 0 ? { batchSize: opts.batchSize } : {}
     });
   }]
@@ -30270,7 +30375,8 @@ function migrateUsage() {
           step on the server: created/kept/skipped by reason, nothing written) \xB7 [--file-links shared-link] stored
           public file URLs become stable shared links instead of object ids
           \xB7 [--with-oauth-identities] carry the Google/Apple/GitHub/Facebook sign-in links (needs
-          --with-password-hashes in the same run) \xB7 [--keep-timestamps] keep each row's source
+          --with-password-hashes in the same run) \xB7 generic-pg / csv-json: --with-password-hashes
+          --password-hash-column <column> (bcrypt only; other formats are reported, not sent) \xB7 [--keep-timestamps] keep each row's source
           created_at / updated_at (cms creates; server key only)
           \xB7 [--files-owner <user id>] the owner of every migrated file (default: the path's first
           segment) \xB7 [--files-org-from-prefix] the path's first segment is the WORKSPACE (org_id):
@@ -30293,6 +30399,7 @@ ${migrateUsage()}`);
   const url = flag("url");
   const dir = flag("dir");
   const authTable = flag("auth-table");
+  const passwordHashColumn = flag("password-hash-column");
   const schemas = flag("schemas");
   const batch = flag("batch");
   const sbUrl = process.env.SUPABASE_URL;
@@ -30302,6 +30409,7 @@ ${migrateUsage()}`);
     ...url !== void 0 ? { url } : {},
     ...dir !== void 0 ? { dir } : {},
     ...authTable !== void 0 ? { authTable } : {},
+    ...passwordHashColumn !== void 0 ? { passwordHashColumn } : {},
     ...schemas !== void 0 ? { schemas: schemas.split(",").map((s) => s.trim()).filter(Boolean) } : {},
     ...batch !== void 0 ? { batchSize: Number(batch) } : {},
     ...from === "supabase" && sbUrl && sbKey ? { storage: { url: sbUrl, serviceKey: sbKey } } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.35.2",
+  "version": "0.36.1",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -45,8 +45,8 @@
     }
   },
   "devDependencies": {
-    "@vxil/config": "0.26.1",
-    "@vxil/feature-configs": "0.23.2",
+    "@vxil/config": "0.27.0",
+    "@vxil/feature-configs": "0.24.0",
     "@vxil/runtime": "0.0.1",
     "@vxil/types": "0.0.1",
     "miniflare": "^4.20260730.0"