@payload-auth-link/migrate 0.4.3 → 0.6.0

package/dist/doctor/users.js

@@ -83,6 +83,14 @@ export function localStrategyOn(collection) {
     }
     return isRecord(auth) ? auth.disableLocalStrategy !== true : false;
 }
+/**
+ * The payload-auth-link plugin's own auth strategy name
+ * (`packages/plugin/src/strategy.ts`). A users collection carrying it
+ * has ALREADY been through `authLink` — its identities/linkable/…
+ * fields are the plugin's own injections, not host collisions
+ * (issue #88: the doctor run against the TARGET config).
+ */
+const pluginStrategyName = 'auth-link';
 export function analyzeUsersCollection(collection, rolesFieldName) {
     if (collection === null) {
         return {
@@ -95,10 +103,18 @@ export function analyzeUsersCollection(collection, rolesFieldName) {
     const fields = fieldList(collection);
     const issues = [];
     const notes = [];
-    const collisions = fields
-        .map(fieldName)
-        .filter((name) => name !== null)
-        .filter((name) => injectedFieldNames.has(name));
+    // On the target config the plugin already injected these fields:
+    // they are its own, never a collision (issue #88).
+    const pluginInstalled = strategiesOf(collection).includes(pluginStrategyName);
+    const collisions = pluginInstalled
+        ? []
+        : fields
+            .map(fieldName)
+            .filter((name) => name !== null)
+            .filter((name) => injectedFieldNames.has(name));
+    if (pluginInstalled) {
+        notes.push('payload-auth-link is already installed on this collection (its auth-link strategy is present): the injected fields are the plugin’s own');
+    }
     let roleField = null;
     const roleCandidates = fields.filter((field) => {
         const name = fieldName(field);

package/dist/doctor/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/doctor/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,eAAe;CAChB,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,aAAa,GAAG,+BAA+B,CAAA;AAErD,wEAAwE;AACxE,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,MAAM,GAAY,UAAU,CAAC,MAAM,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC/F,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,iEAAiE;AACjE,SAAS,YAAY,CAAC,UAAmC;IACvD,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,UAAU;SACnB,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAmC;IACjE,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAA0C,EAC1C,cAAsB;IAEtB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,yCAAyC,EAAE;aACxF;SACF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,SAAS,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;SAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAEjD,IAAI,SAAS,GAA8B,IAAI,CAAA;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;QACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACzE,SAAS,GAAG;gBACV,IAAI;gBACJ,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;gBAC/B,MAAM;gBACN,YAAY;aACb,CAAA;YACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,QAAQ,IAAI,yCAAyC,YAAY;yBACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC;yBAC5B,IAAI,CACH,IAAI,CACL,iGAAiG;iBACrG,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,2BAA2B;oBACjC,MAAM,EAAE,QAAQ,IAAI,+GAA+G;iBACpI,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,QAAQ,cAAc,iBAAiB,SAAS,CAAC,KAAK,CAAC,yEAAyE;aACzI,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,YAAY,UAAU;iBAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;iBAC1B,IAAI,CACH,IAAI,CACL,4HAA4H;SAChI,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CACR,oRAAoR,CACrR,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACjF,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,4EAA4E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrG,CAAC,CAAC,mDAAmD,CACxD,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CACR,4HAA4H,CAC7H,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YACrE,SAAS;YACT,aAAa,EAAE,KAAK;YACpB,UAAU;YACV,KAAK;SACN;QACD,MAAM;KACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,GAAG,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/doctor/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,eAAe;CAChB,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,aAAa,GAAG,+BAA+B,CAAA;AAErD,wEAAwE;AACxE,SAAS,SAAS,CAAC,UAAmC;IACpD,MAAM,MAAM,GAAY,UAAU,CAAC,MAAM,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B;IAC/C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC/F,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,iEAAiE;AACjE,SAAS,YAAY,CAAC,UAAmC;IACvD,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,UAAU;SACnB,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAmC;IACjE,MAAM,IAAI,GAAY,UAAU,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAEtC,MAAM,UAAU,sBAAsB,CACpC,UAA0C,EAC1C,cAAsB;IAEtB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,yCAAyC,EAAE;aACxF;SACF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,iEAAiE;IACjE,mDAAmD;IACnD,MAAM,eAAe,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC7E,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM;aACH,GAAG,CAAC,SAAS,CAAC;aACd,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;aAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,yIAAyI,CAC1I,CAAA;IACH,CAAC;IAED,IAAI,SAAS,GAA8B,IAAI,CAAA;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;QACvC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACzE,SAAS,GAAG;gBACV,IAAI;gBACJ,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;gBAC/B,MAAM;gBACN,YAAY;aACb,CAAA;YACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,QAAQ,IAAI,yCAAyC,YAAY;yBACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC;yBAC5B,IAAI,CACH,IAAI,CACL,iGAAiG;iBACrG,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,2BAA2B;oBACjC,MAAM,EAAE,QAAQ,IAAI,+GAA+G;iBACpI,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,QAAQ,cAAc,iBAAiB,SAAS,CAAC,KAAK,CAAC,yEAAyE;aACzI,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,YAAY,UAAU;iBAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;iBAC1B,IAAI,CACH,IAAI,CACL,4HAA4H;SAChI,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CACR,oRAAoR,CACrR,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACjF,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,4EAA4E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACrG,CAAC,CAAC,mDAAmD,CACxD,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CACR,4HAA4H,CAC7H,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YACrE,SAAS;YACT,aAAa,EAAE,KAAK;YACpB,UAAU;YACV,KAAK;SACN;QACD,MAAM;KACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,GAAG,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClD,CAAC"}

package/dist/importer/apply.d.ts

@@ -1,21 +1,32 @@
 import type { Payload } from 'payload';
-import { type ImportManifest, type ImportResult, type PlanRow } from './types.js';
+import { type SourceUser } from './source.js';
+import { type ImportManifest, type ImportResult, type PlanRow, type Unmappable } from './types.js';
 /**
  * Apply side (issue #50): copy payload-auth rows into the
  * payload-auth-link collections through the Payload Local API.
  *
  * - Password hashes, OAuth tokens, API-key hashes, and jwks carry over
  *   VERBATIM (payload-auth used Better Auth's own hashing).
- * - `linkable` + `linkableEmail` are granted from VERIFIED emails only;
- *   unverified users are reported by the plan, never linked.
+ * - Row timestamps (`createdAt`/`updatedAt`) carry from the source rows
+ *   for every model whose source table has them (issue #88).
+ * - Better Auth plugin user state carries (issue #88): admin-plugin
+ *   `banned`/`banReason`/`banExpires`/`role` and the anonymous plugin's
+ *   `isAnonymous`, whenever the source has the column AND the target
+ *   `ba-users` collection declares the field. A banned or anonymous
+ *   source user whose state the target cannot hold is UNMAPPABLE — the
+ *   run aborts before writing; a banned user never imports unbanned.
+ * - `linkable` + `linkableEmail` are granted from VERIFIED emails only
+ *   (grant-only: an existing proof is never revoked); unverified users
+ *   are reported by the plan, never linked.
  * - Sessions default to `carry` so nobody is logged out: the carried
  *   rows keep their tokens, and with the same `advanced.cookiePrefix`
  *   the existing cookies keep working.
  * - Idempotent and resumable: every target row carries a deterministic
  *   `baId` derived from the source id (`acct-<source id>`), so a
  *   re-run after a crash finds its own earlier rows and skips them.
- * - Every created row and every field write lands in the manifest, so
- *   `rollback` is exact and the source tables stay untouched.
+ * - Every created row and every host field write lands in the
+ *   manifest — the FIRST captured prior value per field wins, sealed —
+ *   so `rollback` is exact and the source tables stay untouched.
  */
 export type ApplyOptions = {
     readonly payload: Payload;
@@ -37,7 +48,16 @@ export type ApplyOptions = {
     /** Injectable clock for deterministic `linkedAt` stamps. */
     readonly now?: () => Date;
     readonly log?: (message: string) => void;
+    /** Resume from a pre-0.6.0 manifest that has no MAC (`--allow-unsigned-manifest`). */
+    readonly allowUnsignedManifest?: boolean | undefined;
 };
+/**
+ * Plugin user state the target must be able to hold (issue #88),
+ * checked BEFORE any write: a banned user whose target has no `banned`
+ * field would import unbanned; an anonymous user without `isAnonymous`
+ * would import as a full account.
+ */
+export declare function pluginStateUnmappable(users: readonly SourceUser[], targetFields: ReadonlySet<string>, targetSlug: string): Unmappable[];
 export declare function applyImport(options: ApplyOptions): Promise<ImportResult>;
 /** Collapse per-row plan entries into one line per model (dry-run print). */
 export declare function summarizePlanRows(rows: readonly PlanRow[]): PlanRow[];

package/dist/importer/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/importer/apply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAQtC,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,YAAY,EACjB,KAAK,OAAO,EACb,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;IAC3E,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC,CAAA;AA0HD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAikB9E;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,CAerE"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/importer/apply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAGtC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IACxC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;IAC3E,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,sFAAsF;IACtF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACrD,CAAA;AAsDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,UAAU,EAAE,MAAM,GACjB,UAAU,EAAE,CAmBd;AAmGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAsgB9E;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,CAerE"}

package/dist/importer/apply.js

@@ -1,3 +1,5 @@
+import { capturedKeys, captureBefore } from './host-writes.js';
+import { authenticateManifest, signManifest } from './manifest-mac.js';
 import { readFlatRows, openSource, readSourceUsers, } from './source.js';
 import { defaultTargetSlugs, resolveSourceTables, } from './types.js';
 const slugsOf = (overrides) => ({
@@ -14,14 +16,80 @@ function numberOrNull(value) {
     const numeric = typeof value === 'number' ? value : Number(value);
     return Number.isFinite(numeric) ? numeric : undefined;
 }
+/** The source row's timestamps, when its layout has them (issue #88). */
+function stamps(row) {
+    return {
+        ...(row.created_at instanceof Date ? { createdAt: row.created_at.toISOString() } : {}),
+        ...(row.updated_at instanceof Date ? { updatedAt: row.updated_at.toISOString() } : {}),
+    };
+}
+const timestampColumns = ['created_at', 'updated_at'];
 /**
  * Rows for one mapped model. A `null` mapping records the model as
  * not installed (issue #68) — no read, no rows; anything else goes
  * through the strict `readFlatRows` (a missing mapped table throws;
- * the probe aborts the run first).
+ * the probe aborts the run first). Row timestamps are read when the
+ * layout has them.
  */
 async function readMapped(client, table, columns) {
-    return table === null ? [] : readFlatRows(client, table, columns);
+    return table === null ? [] : readFlatRows(client, table, columns, timestampColumns);
+}
+/** Field names a target collection declares (top level, flattened). */
+function targetFieldNames(payload, slug) {
+    const collection = payload.collections[slug];
+    const names = new Set();
+    for (const field of collection?.config.flattenedFields ?? []) {
+        names.add(field.name);
+    }
+    return names;
+}
+/**
+ * Plugin user state the target must be able to hold (issue #88),
+ * checked BEFORE any write: a banned user whose target has no `banned`
+ * field would import unbanned; an anonymous user without `isAnonymous`
+ * would import as a full account.
+ */
+export function pluginStateUnmappable(users, targetFields, targetSlug) {
+    const found = [];
+    for (const user of users) {
+        if (user.banned === true && !targetFields.has('banned')) {
+            found.push({
+                model: 'user',
+                key: user.id,
+                reason: `user #${user.id} is banned on the source, but '${targetSlug}' declares no 'banned' field — add Better Auth's admin() plugin to the engine (autoDeclare derives banned/banReason/banExpires) so the ban carries`,
+            });
+        }
+        if (user.isAnonymous === true && !targetFields.has('isAnonymous')) {
+            found.push({
+                model: 'user',
+                key: user.id,
+                reason: `user #${user.id} is anonymous on the source, but '${targetSlug}' declares no 'isAnonymous' field — add Better Auth's anonymous() plugin to the engine, or remove anonymous users before importing`,
+            });
+        }
+    }
+    return found;
+}
+/** Plugin user state carried onto the ba-users row (issue #88). */
+function pluginUserState(user, targetFields) {
+    const state = {};
+    if (user.banned !== null && targetFields.has('banned')) {
+        state.banned = user.banned;
+    }
+    if (user.banReason !== null && targetFields.has('banReason')) {
+        state.banReason = user.banReason;
+    }
+    if (user.banExpires !== null && targetFields.has('banExpires')) {
+        state.banExpires = user.banExpires.toISOString();
+    }
+    if (user.isAnonymous !== null && targetFields.has('isAnonymous')) {
+        state.isAnonymous = user.isAnonymous;
+    }
+    // Better Auth's admin plugin stores roles as one comma-separated
+    // string; payload-auth kept them in the users_role child table.
+    if (user.roles.length > 0 && targetFields.has('role')) {
+        state.role = user.roles.join(',');
+    }
+    return state;
 }
 /** Find an existing target row by `baId` — the resumable dedupe key. */
 async function findByBaId(payload, collection, baId) {
@@ -53,19 +121,6 @@ async function createDeduped(payload, collection, baId, data, created, sourceKey
     }
     return true;
 }
-/** Capture a host field's current value for the rollback manifest. */
-async function captureBefore(payload, hostId, field) {
-    const doc = await payload.findByID({
-        collection: 'users',
-        id: hostId,
-        depth: 0,
-        overrideAccess: true,
-    });
-    if (typeof doc !== 'object' || doc === null || !(field in doc)) {
-        return null;
-    }
-    return JSON.stringify(doc[field] ?? null);
-}
 /**
  * The identity rows pre-populated on the host user (issue #69): ONE
  * `better-auth` identity per imported user, `providerUserId` set to
@@ -98,9 +153,21 @@ export async function applyImport(options) {
     const { payload, sourceConnectionString, apply, sessions, log = () => { }, now = () => new Date(), } = options;
     const slugs = slugsOf(options.slugs);
     const sourceTables = resolveSourceTables(options.sourceTables);
+    if (options.manifest !== null) {
+        // Resuming merges the old entries and re-signs them: never launder
+        // an edited manifest into a signed one.
+        authenticateManifest(payload.secret, options.manifest, {
+            allowUnsigned: options.allowUnsignedManifest,
+        });
+    }
     const created = [...(options.manifest?.created ?? [])];
     const fieldWrites = [...(options.manifest?.fieldWrites ?? [])];
-    const totals = { ...(options.manifest?.totals ?? {}) };
+    // First capture wins (issue #88): fields captured by an earlier pass
+    // keep their pre-import value.
+    const captured = capturedKeys(fieldWrites);
+    // Per-PASS totals (issue #88): a re-apply reports what this pass
+    // planned, never the sum of every pass.
+    const totals = {};
     const planRows = [];
     const unmappable = [];
     let createdCount = 0;
@@ -112,6 +179,20 @@ export async function applyImport(options) {
     const client = await openSource(sourceConnectionString);
     try {
         const users = await readSourceUsers(client, sourceTables);
+        const baUserFields = targetFieldNames(payload, slugs.user);
+        // --- 0. target-capability gate (issue #88) ---------------------------
+        // Runs before ANY write: plugin state the target cannot hold aborts
+        // the run instead of importing a banned user unbanned.
+        const blocked = pluginStateUnmappable(users, baUserFields, slugs.user);
+        if (blocked.length > 0) {
+            log(`ABORT: ${blocked.length} user(s) carry state the target cannot hold; nothing was written`);
+            return {
+                created: 0,
+                skipped: 0,
+                fieldWrites: 0,
+                plan: { rows: [], unmappable: blocked, sessions, warnings: [] },
+            };
+        }
         const seenUsers = new Set();
         // --- 1. ba-users + host field writes ---------------------------------
         for (const user of users) {
@@ -128,6 +209,7 @@ export async function applyImport(options) {
                     name: user.name ?? '',
                     emailVerified: user.emailVerified,
                     ...(user.image === null ? {} : { image: user.image }),
+                    ...pluginUserState(user, baUserFields),
                     createdAt: user.createdAt.toISOString(),
                     updatedAt: user.updatedAt.toISOString(),
                 }, created, `user:${baId}`)
@@ -141,30 +223,32 @@ export async function applyImport(options) {
                 }
                 // Host-side writes on the EXISTING Payload user (the source
                 // layout's user id IS the host id): identities, roles, and the
-                // verified-email linking proof. Captured `before` values make
-                // rollback exact.
+                // verified-email linking proof. The prior values (and the
+                // doc's updatedAt) are captured first — once — so rollback
+                // restores the pre-import document exactly.
                 const hostId = Number(baId);
                 if (Number.isSafeInteger(hostId)) {
+                    const { present, newlyCaptured } = await captureBefore({
+                        payload,
+                        collection: 'users',
+                        id: hostId,
+                        fields: ['identities', 'roles', 'linkable', 'linkableEmail'],
+                        captured,
+                        into: fieldWrites,
+                    });
+                    fieldWriteCount += newlyCaptured;
                     const writes = {
                         identities: identityRows(user, now),
-                        linkable: user.emailVerified,
                     };
-                    const fields = ['identities', 'roles', 'linkable', 'linkableEmail'];
-                    for (const field of fields) {
-                        fieldWrites.push({
-                            collection: 'users',
-                            id: hostId,
-                            field,
-                            before: await captureBefore(payload, hostId, field),
-                        });
-                    }
-                    fieldWriteCount += fields.length;
-                    if (user.roles.length > 0) {
+                    if (user.roles.length > 0 && present.has('roles')) {
                         // Stored role values pass through unchanged (issue #56: the
                         // storage edge owns translation; the map is the app's).
                         writes.roles = user.roles;
                     }
                     if (user.emailVerified) {
+                        // Grant-only: the proof is bound to the address (both
+                        // fields), and an existing proof is never revoked here.
+                        writes.linkable = true;
                         writes.linkableEmail = user.email;
                     }
                     await payload.update({
@@ -184,6 +268,24 @@ export async function applyImport(options) {
                 unmappable: [],
             });
         }
+        const tally = (model, sourceTable, target, isNew) => {
+            if (apply) {
+                if (isNew) {
+                    createdCount += 1;
+                }
+                else {
+                    skippedCount += 1;
+                }
+            }
+            record({
+                model,
+                sourceTable,
+                targetCollection: target,
+                rows: 1,
+                skipped: isNew ? 0 : apply ? 1 : 0,
+                unmappable: [],
+            });
+        };
         // --- 2. accounts (hashes verbatim) ------------------------------------
         const accountsTable = sourceTables['accounts'];
         for (const user of users) {
@@ -206,24 +308,15 @@ export async function applyImport(options) {
                         ...(account.refreshTokenExpiresAt === null
                             ? {}
                             : { refreshTokenExpiresAt: account.refreshTokenExpiresAt.toISOString() }),
+                        ...(account.createdAt === null
+                            ? {}
+                            : { createdAt: account.createdAt.toISOString() }),
+                        ...(account.updatedAt === null
+                            ? {}
+                            : { updatedAt: account.updatedAt.toISOString() }),
                     }, created, `account:${account.id}`)
                     : false;
-                if (apply) {
-                    if (isNew) {
-                        createdCount += 1;
-                    }
-                    else {
-                        skippedCount += 1;
-                    }
-                }
-                record({
-                    model: 'account',
-                    sourceTable: accountsTable ?? 'accounts',
-                    targetCollection: slugs.account,
-                    rows: 1,
-                    skipped: isNew ? 0 : apply ? 1 : 0,
-                    unmappable: [],
-                });
+                tally('account', accountsTable ?? 'accounts', slugs.account, isNew);
             }
         }
         // --- 3. sessions (carry keeps every token) -----------------------------
@@ -236,8 +329,6 @@ export async function applyImport(options) {
                 'expires_at',
                 'ip_address',
                 'user_agent',
-                'created_at',
-                'updated_at',
             ]);
             for (const row of rows) {
                 totals.session = (totals.session ?? 0) + 1;
@@ -255,30 +346,10 @@ export async function applyImport(options) {
                         ...(textOrNull(row.user_agent) === undefined
                             ? {}
                             : { userAgent: textOrNull(row.user_agent) }),
-                        ...(row.created_at instanceof Date
-                            ? { createdAt: row.created_at.toISOString() }
-                            : {}),
-                        ...(row.updated_at instanceof Date
-                            ? { updatedAt: row.updated_at.toISOString() }
-                            : {}),
+                        ...stamps(row),
                     }, created, `session:${String(row.id)}`)
                     : false;
-                if (apply) {
-                    if (isNew) {
-                        createdCount += 1;
-                    }
-                    else {
-                        skippedCount += 1;
-                    }
-                }
-                record({
-                    model: 'session',
-                    sourceTable: sessionsTable ?? 'sessions',
-                    targetCollection: slugs.session,
-                    rows: 1,
-                    skipped: isNew ? 0 : apply ? 1 : 0,
-                    unmappable: [],
-                });
+                tally('session', sessionsTable ?? 'sessions', slugs.session, isNew);
             }
         }
         // --- 4. verifications ---------------------------------------------------
@@ -297,24 +368,10 @@ export async function applyImport(options) {
                     identifier: String(row.identifier),
                     value: String(row.value),
                     expiresAt: row.expires_at instanceof Date ? row.expires_at.toISOString() : now().toISOString(),
+                    ...stamps(row),
                 }, created, `verification:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'verification',
-                sourceTable: verificationsTable ?? 'verifications',
-                targetCollection: slugs.verification,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('verification', verificationsTable ?? 'verifications', slugs.verification, isNew);
         }
         // --- 5. api keys (hash, prefix, metadata, rate-limit state) --------------
         const apiKeysTable = sourceTables['api_keys'];
@@ -325,8 +382,8 @@ export async function applyImport(options) {
             'start',
             'prefix',
             'key',
-            // payload-auth stores the satellite's userId as referenceId
-            // (the #49 field map's source side).
+            // payload-auth stores the satellite's owner as reference_id — the
+            // same name @better-auth/api-key 1.7 uses (`referenceId`).
             'reference_id',
             'refill_interval',
             'refill_amount',
@@ -352,9 +409,9 @@ export async function applyImport(options) {
                     ...(textOrNull(row.start) === undefined ? {} : { start: textOrNull(row.start) }),
                     ...(textOrNull(row.prefix) === undefined ? {} : { prefix: textOrNull(row.prefix) }),
                     key: String(row.key),
-                    // The satellite's user reference arrives as referenceId in
-                    // payload-auth layouts; BA 1.7's own schema names it the
-                    // same, so the target field is offered both names.
+                    // @better-auth/api-key 1.7 names the owner `referenceId`;
+                    // `userId` is offered for 1.6-era target schemas (Payload
+                    // drops it where the collection has no such field).
                     userId: String(row.reference_id),
                     referenceId: String(row.reference_id),
                     ...(numberOrNull(row.refill_interval) === undefined
@@ -394,24 +451,10 @@ export async function applyImport(options) {
                     ...(textOrNull(row.metadata) === undefined
                         ? {}
                         : { metadata: textOrNull(row.metadata) }),
+                    ...stamps(row),
                 }, created, `apikey:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'apikey',
-                sourceTable: apiKeysTable ?? 'api_keys',
-                targetCollection: slugs.apikey,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('apikey', apiKeysTable ?? 'api_keys', slugs.apikey, isNew);
         }
         // --- 6. jwks --------------------------------------------------------------
         const jwksTable = sourceTables['jwks'];
@@ -423,24 +466,10 @@ export async function applyImport(options) {
                 ? await createDeduped(payload, slugs.jwks, baId, {
                     publicKey: String(row.public_key),
                     privateKey: String(row.private_key),
+                    ...stamps(row),
                 }, created, `jwks:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'jwks',
-                sourceTable: jwksTable ?? 'jwks',
-                targetCollection: slugs.jwks,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('jwks', jwksTable ?? 'jwks', slugs.jwks, isNew);
         }
         // --- 7. organization plugin rows ---------------------------------------
         const organizationsTable = sourceTables['organizations'];
@@ -462,24 +491,10 @@ export async function applyImport(options) {
                     ...(textOrNull(row.metadata) === undefined
                         ? {}
                         : { metadata: textOrNull(row.metadata) }),
+                    ...stamps(row),
                 }, created, `organization:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'organization',
-                sourceTable: organizationsTable ?? 'organizations',
-                targetCollection: slugs.organization,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('organization', organizationsTable ?? 'organizations', slugs.organization, isNew);
         }
         const membersTable = sourceTables['members'];
         const members = await readMapped(client, membersTable, [
@@ -496,24 +511,10 @@ export async function applyImport(options) {
                     organizationId: `org-${String(row.organization_id)}`,
                     userId: String(row.user_id),
                     ...(textOrNull(row.role) === undefined ? {} : { role: textOrNull(row.role) }),
+                    ...stamps(row),
                 }, created, `member:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'member',
-                sourceTable: membersTable ?? 'members',
-                targetCollection: slugs.member,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('member', membersTable ?? 'members', slugs.member, isNew);
         }
         const invitationsTable = sourceTables['invitations'];
         const invitations = await readMapped(client, invitationsTable, [
@@ -538,31 +539,18 @@ export async function applyImport(options) {
                         ? { expiresAt: row.expires_at.toISOString() }
                         : {}),
                     ...(typeof row.inviter_id === 'number' ? { inviterId: String(row.inviter_id) } : {}),
+                    ...stamps(row),
                 }, created, `invitation:${String(row.id)}`)
                 : false;
-            if (apply) {
-                if (isNew) {
-                    createdCount += 1;
-                }
-                else {
-                    skippedCount += 1;
-                }
-            }
-            record({
-                model: 'invitation',
-                sourceTable: invitationsTable ?? 'invitations',
-                targetCollection: slugs.invitation,
-                rows: 1,
-                skipped: isNew ? 0 : apply ? 1 : 0,
-                unmappable: [],
-            });
+            tally('invitation', invitationsTable ?? 'invitations', slugs.invitation, isNew);
         }
-        log(`plan: ${planRows.length} row group(s), ${createdCount} created, ${skippedCount} skipped, ${fieldWriteCount} field writes`);
+        log(`plan: ${planRows.length} row group(s), ${createdCount} created, ${skippedCount} skipped, ${fieldWriteCount} field value(s) captured`);
         if (apply) {
             // The manifest is the run's contract: merge this pass onto any
             // resumed run's rows and write it back (issue #50).
-            const manifest = {
-                version: 1,
+            const manifest = signManifest(payload.secret, {
+                version: 3,
+                kind: 'import',
                 createdAt: options.manifest?.createdAt ?? now().toISOString(),
                 sourceDatabase: options.sourceDatabase,
                 options: { sessions },
@@ -570,12 +558,8 @@ export async function applyImport(options) {
                 fieldWrites,
                 finalized: options.manifest?.finalized ?? false,
                 sourceCounts: options.sourceCounts,
-                totals: {
-                    ...options.sourceCounts,
-                    ...(options.manifest?.totals ?? {}),
-                    ...totals,
-                },
-            };
+                totals,
+            });
             const { writeManifest } = await import('./lifecycle.js');
             writeManifest(manifest, options.manifestPath);
         }