@payload-auth-link/migrate 0.0.0-stage → 0.2.1

package/dist/doctor/source-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-scan.js","sourceRoot":"","sources":["../../src/doctor/source-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGnD;;;;;GAKG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,cAAc;IACd,mBAAmB;CACpB,CAAC,CAAA;AAEF,MAAM,iBAAiB,GACrB,+GAA+G,CAAA;AACjH,MAAM,kBAAkB,GAAG,8CAA8C,CAAA;AACzE,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAC/C,qEAAqE;AACrE,uEAAuE;AACvE,qDAAqD;AACrD,MAAM,WAAW,GAAG,kCAAkC,CAAA;AACtD,0DAA0D;AAC1D,MAAM,YAAY,GAAG,sDAAsD,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,OAAO;IACP,aAAa;IACb,WAAW;IACX,OAAO;IACP,gBAAgB;CACjB,CAAC,CAAA;AAEF,SAAS,IAAI,CAAC,GAAW,EAAE,IAAc;IACvC,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,KAAK,CAAA;QACT,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAQ,EAAE;YACzD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;YACrB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QACD,KAAK,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAA;QACrC,KAAK,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAA;QACxC,KAAK,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAA;QAC1C,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;QAClC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACtB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACxB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAoB;QAChC;YACE,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACvC,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,mFAAmF;SAC5F;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAC/C,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,iFAAiF;SAC1F;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACzC,MAAM,EAAE,EAAE;YACV,MAAM,EACJ,iHAAiH;SACpH;QACD;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAC1C,MAAM,EAAE,EAAE;YACV,MAAM,EACJ,wIAAwI;SAC3I;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE;YACjC,MAAM,EACJ,4JAA4J;SAC/J;KACF,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC"}

package/dist/doctor/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The doctor's report shape (issue #52): read-only findings, every
+ * one carrying a stable machine code so tests (and the guide) assert
+ * exact blocker lists instead of prose.
+ */
+/** A finding the doctor is confident about: fix it before migrating. */
+export type DoctorIssue = {
+    /** Stable machine code — e.g. `better-auth-out-of-band`. */
+    readonly code: string;
+    /** Human detail: what was found, what closes it. */
+    readonly detail: string;
+};
+/** One upstream dependency against its supported band. */
+export type VersionFinding = {
+    readonly name: string;
+    /** `null` when no manifest resolved (exotic bundling). */
+    readonly installed: string | null;
+    /** The supported band, human-readable. */
+    readonly band: string;
+    readonly status: 'ok' | 'warning' | 'blocker' | 'unknown';
+    readonly detail: string;
+};
+/** One Better Auth plugin's migration posture. */
+export type PluginFinding = {
+    /** The plugin's `id` (or the satellite package name). */
+    readonly id: string;
+    readonly status: 'supported' | 'auto-declarable' | 'unprobed' | 'unsupported' | 'removed-upstream';
+    readonly detail: string;
+};
+/** The users collection, as the migration will meet it. */
+export type UsersFinding = {
+    /** Collection slug (payload-auth's `users` by default). */
+    readonly slug: string;
+    readonly roleField: {
+        readonly name: string;
+        readonly type: string;
+        readonly hasMany: boolean;
+        /** Declared select values, when the field is a select. */
+        readonly values: readonly string[];
+        /** Values that are not canonical lowercase slugs. */
+        readonly nonCanonical: readonly string[];
+    } | null;
+    /** Payload's own email+password local strategy is active. */
+    readonly localStrategy: boolean;
+    /** Host fields colliding with the plugin's injected field names. */
+    readonly collisions: readonly string[];
+    readonly notes: readonly string[];
+};
+/** One source-scan category with the files that matched. */
+export type SourceFinding = {
+    readonly kind: 'payload-auth-import' | 'better-auth-accessor' | 'get-payload-auth' | 'ba-internals' | 'req-user-field';
+    readonly files: readonly string[];
+    /** For `req-user-field`: every field read off `req.user`. */
+    readonly fields: readonly string[];
+    readonly detail: string;
+};
+/** Database state, as far as a read-only connection can see. */
+export type DatabaseFinding = {
+    readonly tables: readonly {
+        readonly name: string;
+        readonly rows: number;
+    }[];
+    /** Users with `emailVerified = false` — they will not JIT-link. */
+    readonly unverifiedUsers: number | null;
+    readonly orphans: readonly {
+        readonly kind: string;
+        readonly count: number;
+    }[];
+};
+/** Default-behaviour changes in payload-auth-link 0.7.0 that bite. */
+export type BehaviourChange = {
+    readonly title: string;
+    readonly detail: string;
+};
+/** The full read-only doctor report (`--json` prints this object). */
+export type DoctorReport = {
+    readonly versions: readonly VersionFinding[];
+    readonly plugins: readonly PluginFinding[];
+    readonly users: UsersFinding | null;
+    readonly source: readonly SourceFinding[];
+    readonly database: DatabaseFinding | null;
+    readonly behaviourChanges: readonly BehaviourChange[];
+    readonly blockers: readonly DoctorIssue[];
+    readonly warnings: readonly DoctorIssue[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/doctor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/doctor/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,aAAa,GAAG,kBAAkB,CAAA;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,2DAA2D;AAC3D,MAAM,MAAM,YAAY,GAAG;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,0DAA0D;QAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;QAClC,qDAAqD;QACrD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KACzC,GAAG,IAAI,CAAA;IACR,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,CAAA;AAED,4DAA4D;AAC5D,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EACT,qBAAqB,GACrB,sBAAsB,GACtB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC5E,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC/E,CAAA;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAA;IACrD,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;CAC1C,CAAA"}

package/dist/doctor/types.js

@@ -0,0 +1,7 @@
+/**
+ * The doctor's report shape (issue #52): read-only findings, every
+ * one carrying a stable machine code so tests (and the guide) assert
+ * exact blocker lists instead of prose.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/doctor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/doctor/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/doctor/users.d.ts

@@ -0,0 +1,10 @@
+import type { DoctorIssue, UsersFinding } from './types.js';
+/** Find the payload-auth-shaped users collection (or the app's own users slug). */
+export declare function findUsersCollection(config: unknown, usersSlug: string): Record<string, unknown> | null;
+export declare function localStrategyOn(collection: Record<string, unknown>): boolean;
+export declare function analyzeUsersCollection(collection: Record<string, unknown> | null, rolesFieldName: string): {
+    finding: UsersFinding | null;
+    issues: DoctorIssue[];
+};
+export declare function injectedFieldNamesForDocs(): readonly string[];
+//# sourceMappingURL=users.d.ts.map

package/dist/doctor/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/doctor/users.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAuD3D,mFAAmF;AACnF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAUhC;AAmBD,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAS5E;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC1C,cAAc,EAAE,MAAM,GACrB;IAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAmGzD;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D"}

package/dist/doctor/users.js

@@ -0,0 +1,176 @@
+import { isRecord } from '@payload-auth-link/core';
+/**
+ * The users collection analysis (issue #52): collisions with the
+ * plugin's injected fields, the existing role field and its values,
+ * and whether Payload's local strategy is on — the three things that
+ * decide whether a payload-auth app's user table can be adopted as-is.
+ */
+/**
+ * The plugin's injected users-collection field names (see
+ * `packages/plugin/src/collections.ts`). The `roles` field is special:
+ * the plugin ADOPTS a compatible host select instead of throwing, so a
+ * host `roles`/`role` field is analyzed as the role field, not
+ * reported as a collision.
+ */
+const injectedFieldNames = new Set([
+    'identities',
+    'phone',
+    'suspendedUntil',
+    'suspendReason',
+    'linkable',
+    'linkableEmail',
+]);
+/** Canonical roles are lowercase slugs (`staff`, `front-plugin`). */
+const canonicalRole = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+/** Narrow a config field list; configs are untyped at this boundary. */
+function fieldList(collection) {
+    const fields = collection.fields;
+    if (!Array.isArray(fields)) {
+        return [];
+    }
+    return fields.filter(isRecord);
+}
+function fieldName(field) {
+    return typeof field.name === 'string' && field.name !== '' ? field.name : null;
+}
+function fieldType(field) {
+    return typeof field.type === 'string' ? field.type : 'unknown';
+}
+function selectValues(field) {
+    const options = field.options;
+    if (!Array.isArray(options)) {
+        return [];
+    }
+    return options
+        .map((option) => (typeof option === 'string' ? option : isRecord(option) ? option.value : null))
+        .filter((value) => typeof value === 'string');
+}
+/** Find the payload-auth-shaped users collection (or the app's own users slug). */
+export function findUsersCollection(config, usersSlug) {
+    if (!isRecord(config) || !Array.isArray(config.collections)) {
+        return null;
+    }
+    for (const collection of config.collections) {
+        if (isRecord(collection) && collection.slug === usersSlug) {
+            return collection;
+        }
+    }
+    return null;
+}
+/**
+ * Payload's local email+password strategy for a collection. payload-auth
+ * leaves it on (its own Better Auth strategy rides alongside), which is
+ * exactly the surface 0.7.0 closes for provider-linked documents.
+ */
+/** Names of the custom auth strategies a collection declares. */
+function strategiesOf(collection) {
+    const auth = collection.auth;
+    if (!isRecord(auth) || !Array.isArray(auth.strategies)) {
+        return [];
+    }
+    return auth.strategies
+        .filter(isRecord)
+        .map((strategy) => strategy.name)
+        .filter((name) => typeof name === 'string');
+}
+export function localStrategyOn(collection) {
+    const auth = collection.auth;
+    if (auth === undefined || auth === null) {
+        return false;
+    }
+    if (auth === true) {
+        return true;
+    }
+    return isRecord(auth) ? auth.disableLocalStrategy !== true : false;
+}
+export function analyzeUsersCollection(collection, rolesFieldName) {
+    if (collection === null) {
+        return {
+            finding: null,
+            issues: [
+                { code: 'users-collection-missing', detail: 'no users collection found in the config' },
+            ],
+        };
+    }
+    const fields = fieldList(collection);
+    const issues = [];
+    const notes = [];
+    const collisions = fields
+        .map(fieldName)
+        .filter((name) => name !== null)
+        .filter((name) => injectedFieldNames.has(name));
+    let roleField = null;
+    const roleCandidates = fields.filter((field) => {
+        const name = fieldName(field);
+        return name === rolesFieldName || name === 'role';
+    });
+    for (const field of roleCandidates) {
+        const name = fieldName(field) ?? 'role';
+        if (fieldType(field) === 'select') {
+            const values = selectValues(field);
+            const nonCanonical = values.filter((value) => !canonicalRole.test(value));
+            roleField = {
+                name,
+                type: fieldType(field),
+                hasMany: field.hasMany === true,
+                values,
+                nonCanonical,
+            };
+            if (nonCanonical.length > 0) {
+                issues.push({
+                    code: 'non-canonical-role-value',
+                    detail: `the '${name}' field stores non-canonical value(s) ${nonCanonical
+                        .map((value) => `'${value}'`)
+                        .join(', ')}; the role value map (#56) keeps them stored as-is while roles stay canonical inside the plugin`,
+                });
+            }
+            if (field.hasMany !== true) {
+                issues.push({
+                    code: 'roles-field-single-select',
+                    detail: `the '${name}' field is a single-select; the plugin can only adopt a multi-select (hasMany) covering every configured role`,
+                });
+            }
+        }
+        else if (name === rolesFieldName) {
+            issues.push({
+                code: 'roles-field-not-select',
+                detail: `the '${rolesFieldName}' field is a '${fieldType(field)}', not a select; rename it and let the plugin inject its governed field`,
+            });
+        }
+    }
+    if (collisions.length > 0) {
+        issues.push({
+            code: 'injected-field-collision',
+            detail: `field(s) ${collisions
+                .map((name) => `'${name}'`)
+                .join(', ')} collide with the plugin's injected fields; rename them before booting payload-auth-link (its config throws on collisions)`,
+        });
+    }
+    const local = localStrategyOn(collection);
+    if (local) {
+        notes.push('Payload local strategy is ON (payload-auth leaves it active): since 0.7.0, provider-linked documents refuse local sign-in and forgot/reset by default — break-glass operator accounts keep theirs; allowLocalCredentialsForLinkedDocs: true reopens it only for a migration window');
+    }
+    else {
+        const strategies = Array.isArray(collection.auth) ? [] : strategiesOf(collection);
+        notes.push(strategies.length > 0
+            ? `Payload local strategy is OFF; authentication rides custom strategy/ies: ${strategies.join(', ')}`
+            : 'Payload local strategy is OFF for this collection');
+    }
+    if (isRecord(collection.auth) && collection.auth.useAPIKey === true) {
+        notes.push('useAPIKey is enabled: API keys are refused for suspended users at request time since 0.7.0 and never carry MFA-gated roles');
+    }
+    return {
+        finding: {
+            slug: typeof collection.slug === 'string' ? collection.slug : 'users',
+            roleField,
+            localStrategy: local,
+            collisions,
+            notes,
+        },
+        issues,
+    };
+}
+export function injectedFieldNamesForDocs() {
+    return [...injectedFieldNames, 'roles', 'email'];
+}
+//# sourceMappingURL=users.js.map

package/dist/doctor/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/doctor/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,eAAe;CAChB,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,aAAa,GAAG,+BAA+B,CAAA;AAErD,wEAAwE;AACxE,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,MAAM,GAAY,UAAU,CAAC,MAAM,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC/F,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,iEAAiE;AACjE,SAAS,YAAY,CAAC,UAAmC;IACvD,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,UAAU;SACnB,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAmC;IACjE,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAA0C,EAC1C,cAAsB;IAEtB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,yCAAyC,EAAE;aACxF;SACF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,SAAS,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAEjD,IAAI,SAAS,GAA8B,IAAI,CAAA;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;QACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACzE,SAAS,GAAG;gBACV,IAAI;gBACJ,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;gBAC/B,MAAM;gBACN,YAAY;aACb,CAAA;YACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,QAAQ,IAAI,yCAAyC,YAAY;yBACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC;yBAC5B,IAAI,CACH,IAAI,CACL,iGAAiG;iBACrG,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,2BAA2B;oBACjC,MAAM,EAAE,QAAQ,IAAI,+GAA+G;iBACpI,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,QAAQ,cAAc,iBAAiB,SAAS,CAAC,KAAK,CAAC,yEAAyE;aACzI,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,YAAY,UAAU;iBAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;iBAC1B,IAAI,CACH,IAAI,CACL,4HAA4H;SAChI,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CACR,oRAAoR,CACrR,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACjF,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,4EAA4E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrG,CAAC,CAAC,mDAAmD,CACxD,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CACR,4HAA4H,CAC7H,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YACrE,SAAS;YACT,aAAa,EAAE,KAAK;YACpB,UAAU;YACV,KAAK;SACN;QACD,MAAM;KACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,GAAG,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC"}

package/dist/importer/apply.d.ts

@@ -0,0 +1,39 @@
+import type { Payload } from 'payload';
+import { type ImportManifest, type ImportResult, type PlanRow } from './types.js';
+/**
+ * Apply side (issue #50): copy payload-auth rows into the
+ * payload-auth-link collections through the Payload Local API.
+ *
+ * - Password hashes, OAuth tokens, API-key hashes, and jwks carry over
+ *   VERBATIM (payload-auth used Better Auth's own hashing).
+ * - `linkable` + `linkableEmail` are granted from VERIFIED emails only;
+ *   unverified users are reported by the plan, never linked.
+ * - Sessions default to `carry` so nobody is logged out: the carried
+ *   rows keep their tokens, and with the same `advanced.cookiePrefix`
+ *   the existing cookies keep working.
+ * - Idempotent and resumable: every target row carries a deterministic
+ *   `baId` derived from the source id (`acct-<source id>`), so a
+ *   re-run after a crash finds its own earlier rows and skips them.
+ * - Every created row and every field write lands in the manifest, so
+ *   `rollback` is exact and the source tables stay untouched.
+ */
+export type ApplyOptions = {
+    readonly payload: Payload;
+    readonly sourceConnectionString: string;
+    readonly apply: boolean;
+    readonly sessions: 'carry' | 'drop';
+    readonly manifest: ImportManifest | null;
+    /** Written (merged) on `apply`; required when `apply` is true. */
+    readonly manifestPath: string;
+    readonly sourceCounts: Readonly<Record<string, number>>;
+    readonly sourceDatabase: string;
+    /** Target collection slugs; defaults must match the engine wiring. */
+    readonly slugs?: Readonly<Record<string, string>> | undefined;
+    /** Injectable clock for deterministic `linkedAt` stamps. */
+    readonly now?: () => Date;
+    readonly log?: (message: string) => void;
+};
+export declare function applyImport(options: ApplyOptions): Promise<ImportResult>;
+/** Collapse per-row plan entries into one line per model (dry-run print). */
+export declare function summarizePlanRows(rows: readonly PlanRow[]): PlanRow[];
+//# sourceMappingURL=apply.d.ts.map

package/dist/importer/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/importer/apply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAKL,KAAK,cAAc,EAEnB,KAAK,YAAY,EACjB,KAAK,OAAO,EACb,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC,CAAA;AAkGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwjB9E;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,CAerE"}