@payload-auth-link/migrate 0.5.0 → 0.7.0

package/dist/importer/guards.js

@@ -0,0 +1,175 @@
+import { isRecord } from '@payload-auth-link/core';
+import { defaultTargetSlugs, } from './types.js';
+/**
+ * The guards every destructive manifest operation runs, independent of
+ * the manifest's signature:
+ *
+ * - created-row scoping: a rollback only ever deletes rows the importer
+ *   itself creates — rows in the import's own target collections whose
+ *   deterministic `baId` matches the source key the manifest names;
+ * - the finalize marker: `finalize` records the point of no return in
+ *   the target DATABASE (Payload's key-value store), so a manifest file
+ *   alone can never reopen a finalized migration;
+ * - the host roles field the app configured on `authLink`.
+ */
+/** The `baId` prefix the importer stamps per model (see apply.ts). */
+const baIdPrefix = {
+    user: '',
+    account: 'acct-',
+    session: 'sess-',
+    verification: 'ver-',
+    apikey: 'key-',
+    jwks: 'jwks-',
+    organization: 'org-',
+    member: 'member-',
+    invitation: 'inv-',
+};
+const isTargetModel = (value) => value in baIdPrefix;
+/**
+ * The model and deterministic `baId` a created row's `sourceKey`
+ * (`<model>:<source id>`) names, or `null` when it names none.
+ */
+export function expectedBaId(sourceKey) {
+    const colon = sourceKey.indexOf(':');
+    if (colon <= 0) {
+        return null;
+    }
+    const model = sourceKey.slice(0, colon);
+    const sourceId = sourceKey.slice(colon + 1);
+    if (!isTargetModel(model) || sourceId === '') {
+        return null;
+    }
+    return { model, baId: `${baIdPrefix[model]}${sourceId}` };
+}
+/** The target slugs with the defaults filled in. */
+export function targetSlugsOf(overrides) {
+    return { ...defaultTargetSlugs, ...(overrides ?? {}) };
+}
+/**
+ * Refuse a manifest whose created rows reach outside what the importer
+ * creates, BEFORE anything is deleted (or re-signed): an `adopt-prelink`
+ * manifest creates no rows at all, and an import's rows must sit in the
+ * import's own target collections, under the model their source key
+ * names. Signed or not — the signature proves who wrote the file, this
+ * proves the file only names the kit's own rows.
+ */
+export function assertCreatedRowsScoped(manifest, slugs) {
+    if (manifest.kind === 'adopt-prelink') {
+        if (manifest.created.length > 0) {
+            throw new Error(`the adopt-prelink manifest lists ${manifest.created.length} created row(s), which adopt-prelink never creates (edited manifest?); refusing to use it — nothing was deleted`);
+        }
+        return;
+    }
+    const bySlug = new Map();
+    for (const model of Object.keys(baIdPrefix)) {
+        bySlug.set(slugs[model], model);
+    }
+    const outside = [];
+    for (const row of manifest.created) {
+        const expected = expectedBaId(row.sourceKey);
+        const model = bySlug.get(row.collection);
+        if (model === undefined || expected === null || expected.model !== model) {
+            outside.push(`${row.collection}#${String(row.id)} (${row.sourceKey})`);
+        }
+    }
+    if (outside.length > 0) {
+        throw new Error(`the manifest lists ${outside.length} created row(s) outside the import's target collections (${[...bySlug.keys()].join(', ')}): ${outside.slice(0, 10).join(', ')}${outside.length > 10 ? ', …' : ''}. The importer only creates rows there; refusing to use the manifest — nothing was deleted. If your engine wiring renames the targets, pass the same --slugs the import ran with`);
+    }
+}
+/** A created row whose `baId` no longer matches its source key. */
+export function baIdMismatch(row, doc) {
+    const expected = expectedBaId(row.sourceKey);
+    if (expected === null) {
+        return true;
+    }
+    return !isRecord(doc) || String(doc['baId']) !== expected.baId;
+}
+function keyValueStore(payload) {
+    const kv = payload.kv;
+    if (isRecord(kv) &&
+        typeof kv['get'] === 'function' &&
+        typeof kv['set'] === 'function' &&
+        typeof kv['keys'] === 'function') {
+        return kv;
+    }
+    return null;
+}
+const markerPrefix = 'payload-auth-link/migrate/finalized/';
+/** The finalize marker key of one manifest (its kind + first-apply stamp). */
+export function finalizeMarkerKey(manifest) {
+    return `${markerPrefix}${manifest.kind ?? 'import'}/${manifest.createdAt}`;
+}
+/**
+ * Record the point of no return in the target database. One-way: the
+ * kit never deletes the marker. Throws when the store is unavailable —
+ * `finalize` must not report success it cannot back.
+ */
+export async function recordFinalizeMarker(payload, manifest, finalizedAt) {
+    const kv = keyValueStore(payload);
+    if (kv === null) {
+        throw new Error("this Payload version exposes no key-value store (payload.kv); finalize records its marker there — upgrade Payload to a release in the kit's supported band");
+    }
+    try {
+        await kv.set(finalizeMarkerKey(manifest), {
+            kind: manifest.kind ?? 'import',
+            createdAt: manifest.createdAt,
+            finalizedAt,
+        });
+    }
+    catch (error) {
+        throw new Error(`could not record the finalize marker in Payload's key-value store (the payload-kv collection): ${error instanceof Error ? error.message : String(error)} — create its table (run your Payload migrations) and re-run finalize; the manifest was not changed`, { cause: error });
+    }
+}
+/**
+ * Whether the database says this migration was finalized. `anyOfKind`
+ * widens the check to every finalized manifest of the same kind — used
+ * when the manifest's own `createdAt` is not covered by a signature.
+ * Returns `'unavailable'` when the store cannot be read; the caller
+ * decides (and logs) what that means.
+ */
+export async function finalizeMarkerState(payload, manifest, options) {
+    const kv = keyValueStore(payload);
+    if (kv === null) {
+        return 'unavailable';
+    }
+    try {
+        if ((await kv.get(finalizeMarkerKey(manifest))) !== null) {
+            return 'finalized';
+        }
+        if (options.anyOfKind) {
+            const kindPrefix = `${markerPrefix}${manifest.kind ?? 'import'}/`;
+            const keys = await kv.keys();
+            if (keys.some((key) => key.startsWith(kindPrefix))) {
+                return 'finalized';
+            }
+        }
+        return 'open';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
+/**
+ * The host roles field the app configured (`authLink({ rolesField })`),
+ * read off the plugin entry in the booted config (Payload keeps each
+ * plugin's `slug` and `options` for cross-plugin discovery). Defaults to
+ * the plugin's own default, `roles`.
+ */
+export function hostRolesField(payload) {
+    const plugins = payload.config.plugins;
+    if (Array.isArray(plugins)) {
+        for (const plugin of plugins) {
+            if (typeof plugin !== 'function') {
+                continue;
+            }
+            const entry = plugin;
+            if (entry.slug !== 'payload-auth-link') {
+                continue;
+            }
+            const rolesField = isRecord(entry.options) ? entry.options['rolesField'] : undefined;
+            return typeof rolesField === 'string' && rolesField !== '' ? rolesField : 'roles';
+        }
+    }
+    return 'roles';
+}
+//# sourceMappingURL=guards.js.map

package/dist/importer/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/importer/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAElD,OAAO,EACL,kBAAkB,GAKnB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;GAWG;AAEH,sEAAsE;AACtE,MAAM,UAAU,GAA0C;IACxD,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,MAAM;IACpB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,MAAM;IACpB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,MAAM;CACnB,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAa,EAAwB,EAAE,CAAC,KAAK,IAAI,UAAU,CAAA;AAElF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB;IAEjB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,QAAQ,EAAE,EAAE,CAAA;AAC3D,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,SAA4C;IACxE,OAAO,EAAE,GAAG,kBAAkB,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkD,EAClD,KAAoB;IAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,OAAO,CAAC,MAAM,iHAAiH,CAC7K,CAAA;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAkB,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,SAAS,GAAG,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sBAAsB,OAAO,CAAC,MAAM,4DAA4D,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,kLAAkL,CACxX,CAAA;IACH,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,GAAY;IACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAA;AAChE,CAAC;AASD,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,EAAE,GAAa,OAA4B,CAAC,EAAE,CAAA;IACpD,IACE,QAAQ,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,UAAU;QAC/B,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,UAAU;QAC/B,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,UAAU,EAChC,CAAC;QACD,OAAO,EAA8B,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,YAAY,GAAG,sCAAsC,CAAA;AAE3D,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,QAAoD;IACpF,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAA;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,QAAoD,EACpD,WAAmB;IAEnB,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,4JAA4J,CAC7J,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;YACxC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ;YAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW;SACZ,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kGAAkG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qGAAqG,EAC7P,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,QAAoD,EACpD,OAAwC;IAExC,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,GAAG,YAAY,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAA;YACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;YAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,WAAW,CAAA;YACpB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,OAAO,GAAa,OAAO,CAAC,MAAgC,CAAC,OAAO,CAAA;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,OAAoB,EAAE,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,SAAQ;YACV,CAAC;YACD,MAAM,KAAK,GAAG,MAA+C,CAAA;YAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACvC,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACpF,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAA;QACnF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/importer/host-writes.d.ts

@@ -17,8 +17,10 @@ export declare function unsealValue(secret: string, sealed: string, entry: strin
  * restored only because the importer writes them).
  */
 export declare const restorableFields: ReadonlySet<string>;
+/** {@link restorableFields} plus the app's configured roles field. */
+export declare function restorableFieldsFor(rolesField: string): ReadonlySet<string>;
 /** The captured prior value of one manifest entry, JSON-parsed. */
-export declare function priorValue(secret: string, write: FieldWrite): unknown;
+export declare function priorValue(secret: string, write: FieldWrite, restorable?: ReadonlySet<string>): unknown;
 /** Keys of the field writes a manifest already holds (first capture wins). */
 export declare function capturedKeys(writes: readonly FieldWrite[]): Set<string>;
 /**
@@ -43,5 +45,7 @@ export declare function captureBefore(options: {
  * `updatedAt` lands exactly as captured. Returns the number of field
  * values restored.
  */
-export declare function restoreCaptured(payload: Payload, manifest: Pick<ImportManifest, 'fieldWrites'>): Promise<number>;
+export declare function restoreCaptured(payload: Payload, manifest: Pick<ImportManifest, 'fieldWrites'>, options?: {
+    readonly rolesField?: string | undefined;
+}): Promise<number>;
 //# sourceMappingURL=host-writes.d.ts.map

package/dist/importer/host-writes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-writes.d.ts","sourceRoot":"","sources":["../../src/importer/host-writes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAyC5D;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlF;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBjF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAM/C,CAAA;AAEF,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAerE;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAA;CAC5B,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCrF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAyDjB"}
+{"version":3,"file":"host-writes.d.ts","sourceRoot":"","sources":["../../src/importer/host-writes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAyC5D;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlF;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBjF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAM/C,CAAA;AAEF,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAE3E;AAED,mEAAmE;AACnE,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,GAAE,WAAW,CAAC,MAAM,CAAoB,GACjD,OAAO,CAeT;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAA;CAC5B,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCrF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAC7C,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GACzD,OAAO,CAAC,MAAM,CAAC,CA0DjB"}

package/dist/importer/host-writes.js

@@ -80,9 +80,13 @@ export const restorableFields = new Set([
     'linkableEmail',
     'updatedAt',
 ]);
+/** {@link restorableFields} plus the app's configured roles field. */
+export function restorableFieldsFor(rolesField) {
+    return new Set([...restorableFields, rolesField]);
+}
 /** The captured prior value of one manifest entry, JSON-parsed. */
-export function priorValue(secret, write) {
-    if (!restorableFields.has(write.field)) {
+export function priorValue(secret, write, restorable = restorableFields) {
+    if (!restorable.has(write.field)) {
         throw new Error(`manifest entry for '${write.collection}.${write.field}' is not a field this kit writes; refusing to restore it (edited manifest?)`);
     }
     if (write.sealedBefore !== undefined) {
@@ -141,12 +145,13 @@ export async function captureBefore(options) {
  * `updatedAt` lands exactly as captured. Returns the number of field
  * values restored.
  */
-export async function restoreCaptured(payload, manifest) {
+export async function restoreCaptured(payload, manifest, options = {}) {
+    const restorable = restorableFieldsFor(options.rolesField ?? 'roles');
     const byDoc = new Map();
     for (const write of manifest.fieldWrites) {
         const key = `${write.collection}\u0000${String(write.id)}`;
         const entry = byDoc.get(key) ?? { collection: write.collection, id: write.id, data: {} };
-        entry.data[write.field] = priorValue(payload.secret, write);
+        entry.data[write.field] = priorValue(payload.secret, write, restorable);
         byDoc.set(key, entry);
     }
     let restored = 0;

package/dist/importer/host-writes.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-writes.js","sourceRoot":"","sources":["../../src/importer/host-writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAIvF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,UAAU,GAAG,KAAK,CAAA;AAExB,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAmB,EAAE,KAAa,EAAU,EAAE,CAClF,GAAG,UAAU,SAAS,MAAM,CAAC,EAAE,CAAC,SAAS,KAAK,EAAE,CAAA;AAElD,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,kDAAkD,CAAC;SAC1D,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAa;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;IACvE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAA;IACrE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2NAA2N,CAC5N,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,YAAY;IACZ,OAAO;IACP,UAAU;IACV,eAAe;IACf,WAAW;CACZ,CAAC,CAAA;AAEF,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAiB;IAC1D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,6EAA6E,CACpI,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CACf,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAChF,CAAA;IACd,CAAC;IACD,qDAAqD;IACrD,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAa,CAAA;AAC3C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAOnC;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACnE,MAAM,GAAG,GAAY,MAAM,OAAO,CAAC,QAAQ,CAAC;QAC1C,UAAU;QACV,EAAE;QACF,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,MAAM,MAAM,GACV,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,gEAAgE;YAChE,0DAA0D;YAC1D,SAAQ;QACV,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC;YACR,UAAU;YACV,EAAE;YACF,KAAK;YACL,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC;SACpF,CAAC,CAAA;QACF,aAAa,IAAI,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,QAA6C;IAE7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAGlB,CAAA;IACH,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,SAAS,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QACxF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC3D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACvB,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAA;QAClF,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACjE,OAAO,CACL,KAAK,KAAK,SAAS;gBACnB,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;oBACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACvB,CAAC,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAClD,CAAA;QACH,CAAC,CAAA;QACD,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;YACxB,CAAC;QACH,CAAC;QACD,mEAAmE;QACnE,iEAAiE;QACjE,wCAAwC;QACxC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,SAAS;gBACf,cAAc,EAAE,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,kEAAkE;QAClE,gEAAgE;QAChE,yCAAyC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,KAAK;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"host-writes.js","sourceRoot":"","sources":["../../src/importer/host-writes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAIvF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,UAAU,GAAG,KAAK,CAAA;AAExB,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAmB,EAAE,KAAa,EAAU,EAAE,CAClF,GAAG,UAAU,SAAS,MAAM,CAAC,EAAE,CAAC,SAAS,KAAK,EAAE,CAAA;AAElD,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,kDAAkD,CAAC;SAC1D,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,KAAa;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IAChE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC/B,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,KAAa;IACvE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAA;IACrE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2NAA2N,CAC5N,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,YAAY;IACZ,OAAO;IACP,UAAU;IACV,eAAe;IACf,WAAW;CACZ,CAAC,CAAA;AAEF,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,KAAiB,EACjB,aAAkC,gBAAgB;IAElD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,6EAA6E,CACpI,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CACf,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAChF,CAAA;IACd,CAAC;IACD,qDAAqD;IACrD,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAa,CAAA;AAC3C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAA6B;IACxD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAOnC;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACnE,MAAM,GAAG,GAAY,MAAM,OAAO,CAAC,QAAQ,CAAC;QAC1C,UAAU;QACV,EAAE;QACF,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,MAAM,MAAM,GACV,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,gEAAgE;YAChE,0DAA0D;YAC1D,SAAQ;QACV,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC;YACR,UAAU;YACV,EAAE;YACF,KAAK;YACL,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC;SACpF,CAAC,CAAA;QACF,aAAa,IAAI,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,QAA6C,EAC7C,UAAwD,EAAE;IAE1D,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAGlB,CAAA;IACH,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,SAAS,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QACxF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACvE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACvB,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE,CAAA;QAClF,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YACjE,OAAO,CACL,KAAK,KAAK,SAAS;gBACnB,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;oBACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACvB,CAAC,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAClD,CAAA;QACH,CAAC,CAAA;QACD,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;YACxB,CAAC;QACH,CAAC;QACD,mEAAmE;QACnE,iEAAiE;QACjE,wCAAwC;QACxC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,SAAS;gBACf,cAAc,EAAE,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,kEAAkE;QAClE,gEAAgE;QAChE,yCAAyC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,KAAK;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/importer/lifecycle.d.ts

@@ -2,9 +2,10 @@ import type { Payload } from 'payload';
 import { type ImportManifest } from './types.js';
 /**
  * Manifest lifecycle (issue #50): `verify` checks both sides, `rollback`
- * undoes exactly what the manifest records, and `finalize` marks the
- * manifest so the source tables may be dropped — by the operator, as a
- * separate later step.
+ * undoes exactly what the manifest records, and `finalize` records the
+ * point of no return (a database marker plus the re-signed manifest) so
+ * the source tables may be dropped — by the operator, as a separate
+ * later step.
  */
 /**
  * The importer's default manifest location: the CURRENT WORKING
@@ -58,13 +59,8 @@ export declare function verifyImport(options: {
     /** Injectable clock: what counts as an expired source session. */
     readonly now?: (() => Date) | undefined;
 }): Promise<VerifyResult>;
-/**
- * Rollback (issue #50): delete the created rows in reverse order and
- * restore every captured field value. The manifest records exactly
- * what to undo — nothing else is touched, and the source tables were
- * never modified.
- */
-export declare function rollbackImport(options: {
+/** Options of {@link rollbackImport}. */
+export type RollbackOptions = {
     readonly payload: Payload;
     readonly manifest: ImportManifest;
     readonly log?: (message: string) => void;
@@ -76,10 +72,61 @@ export declare function rollbackImport(options: {
      */
     readonly manifestPath?: string | undefined;
     readonly now?: (() => Date) | undefined;
-}): Promise<{
+    /** Target slugs the import ran with (`--slugs`); defaults to the ba-* set. */
+    readonly slugs?: Readonly<Record<string, string>> | undefined;
+    /**
+     * Accept a manifest without a full signature (`--allow-unsigned-manifest`):
+     * a pre-0.6.0 manifest without a MAC, or a 0.6.0 manifest whose MAC
+     * does not cover `finalized`.
+     */
+    readonly allowUnsignedManifest?: boolean | undefined;
+    /**
+     * Let a rollback driven by an UNSIGNED (pre-0.6.0) manifest delete the
+     * rows it lists and restore plaintext (version-1) values
+     * (`--allow-unsigned-deletes`). Without it, an unsigned manifest may
+     * only restore sealed field values.
+     */
+    readonly allowUnsignedDeletes?: boolean | undefined;
+};
+/**
+ * Rollback (issue #50): delete the created rows in reverse order and
+ * restore every captured field value. The manifest records exactly
+ * what to undo — nothing else is touched, and the source tables were
+ * never modified.
+ *
+ * Before anything is written, rollback refuses: a finalized manifest,
+ * or a migration the DATABASE records as finalized (the marker
+ * `finalize` writes — a manifest file alone cannot reopen it); a
+ * manifest that fails its signature; created rows outside the import's
+ * own target collections (signed or not), or whose row no longer
+ * carries the importer's deterministic `baId`; and any delete or
+ * plaintext restore driven by an unsigned manifest without
+ * `allowUnsignedDeletes`. A row already absent is fine (the goal is
+ * "absent"); a delete that FAILS (a foreign key, a hook, a permission)
+ * aborts the rollback with the rows named, before any field is
+ * restored or the manifest reset — so it can be re-run once fixed.
+ */
+export declare function rollbackImport(options: RollbackOptions): Promise<{
     deleted: number;
     restored: number;
 }>;
-/** Finalize (issue #50): the point of no return — mark the manifest. */
-export declare function finalizeManifest(manifest: ImportManifest, path: string): ImportManifest;
+/** Options of {@link finalizeManifest}. */
+export type FinalizeOptions = {
+    readonly payload: Payload;
+    readonly manifest: ImportManifest;
+    /** Where the finalized, re-signed manifest is written. */
+    readonly path: string;
+    readonly now?: (() => Date) | undefined;
+    /** Accept a manifest without a full signature (`--allow-unsigned-manifest`). */
+    readonly allowUnsignedManifest?: boolean | undefined;
+};
+/**
+ * Finalize (issue #50): the point of no return. Records a one-way
+ * marker in the target database (Payload's key-value store) that every
+ * later rollback checks independently of the file, then marks the
+ * manifest `finalized` and re-signs it — the signature covers the flag.
+ * Idempotent: finalizing a finalized manifest re-records the marker and
+ * upgrades its signature.
+ */
+export declare function finalizeManifest(options: FinalizeOptions): Promise<ImportManifest>;
 //# sourceMappingURL=lifecycle.d.ts.map

package/dist/importer/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/importer/lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,YAAY,CAAA;AAEnB;;;;;GAKG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qCAAqC,CAAA;AAErE,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,mCAAmC,CAAA;AAE1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAahE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAChF,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;IAC3E,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;IAChD,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CACxC,GAAG,OAAO,CAAC,YAAY,CAAC,CA6YxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CACxC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCjD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAOvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/importer/lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAWtC,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,YAAY,CAAA;AAEnB;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qCAAqC,CAAA;AAErE,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,mCAAmC,CAAA;AAE1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAahE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAChF,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;IAC3E,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;IAChD,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;CACxC,GAAG,OAAO,CAAC,YAAY,CAAC,CAgZxB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACpD,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA4GhD;AAkBD,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAA;IACvC,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACrD,CAAA;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAcxF"}

package/dist/importer/lifecycle.js

@@ -1,12 +1,15 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { writePrivateFile } from '../private-file.js';
+import { assertCreatedRowsScoped, baIdMismatch, finalizeMarkerState, hostRolesField, recordFinalizeMarker, targetSlugsOf, } from './guards.js';
 import { restoreCaptured } from './host-writes.js';
+import { authenticateManifest, signManifest } from './manifest-mac.js';
 import { defaultTargetSlugs, resolveSourceTables, sourceModelNames, } from './types.js';
 /**
  * Manifest lifecycle (issue #50): `verify` checks both sides, `rollback`
- * undoes exactly what the manifest records, and `finalize` marks the
- * manifest so the source tables may be dropped — by the operator, as a
- * separate later step.
+ * undoes exactly what the manifest records, and `finalize` records the
+ * point of no return (a database marker plus the re-signed manifest) so
+ * the source tables may be dropped — by the operator, as a separate
+ * later step.
  */
 /**
  * The importer's default manifest location: the CURRENT WORKING
@@ -26,8 +29,8 @@ export function readManifest(path) {
     const version = typeof parsed === 'object' && parsed !== null
         ? parsed.version
         : undefined;
-    if (version !== 1 && version !== 2) {
-        throw new Error(`manifest at ${path} is not a version-1/2 import manifest`);
+    if (version !== 1 && version !== 2 && version !== 3) {
+        throw new Error(`manifest at ${path} is not a version-1/2/3 import manifest`);
     }
     return parsed;
 }
@@ -200,6 +203,9 @@ export async function verifyImport(options) {
         // lookup findByProviderIdentity issues on the next provider
         // sign-in. The host docs also carry the stored roles (issue #68's
         // users_role accounting) whenever the host declares the field.
+        // The roles field the app configured on authLink (issue #110: a
+        // hard-coded `roles` silently skipped the check on `role` layouts).
+        const rolesField = hostRolesField(payload);
         let identityIssues = 0;
         let roleMismatchDocs = 0;
         let hostDocsWithRoles = 0;
@@ -237,7 +243,7 @@ export async function verifyImport(options) {
             if (identities.length !== 1 || resolving.length !== 1) {
                 identityIssues += 1;
             }
-            const roles = record['roles'];
+            const roles = record[rolesField];
             if (Array.isArray(roles)) {
                 hostDocsWithRoles += 1;
                 const stored = new Set(roles.map((role) => String(role)));
@@ -248,11 +254,11 @@ export async function verifyImport(options) {
         }
         check('every imported user resolves through one better-auth identity', identityIssues === 0, `${identityIssues} user(s) without exactly one better-auth identity resolving to their ba-users id`);
         if (hostDocsWithRoles > 0) {
-            check('source roles carried onto the host docs', roleMismatchDocs === 0, `${roleMismatchDocs} host doc(s) missing stored role values`);
+            check('source roles carried onto the host docs', roleMismatchDocs === 0, `${roleMismatchDocs} host doc(s) missing stored role values in '${rolesField}'`);
         }
         else if (sourceTables['users_role'] !== null && users.some((user) => user.roles.length > 0)) {
             checks.push({
-                name: 'source roles carried onto the host docs (skipped: the host users carry no roles field)',
+                name: `source roles carried onto the host docs (skipped: the host users carry no '${rolesField}' field)`,
                 passed: true,
             });
         }
@@ -390,6 +396,18 @@ export async function verifyImport(options) {
  * restore every captured field value. The manifest records exactly
  * what to undo — nothing else is touched, and the source tables were
  * never modified.
+ *
+ * Before anything is written, rollback refuses: a finalized manifest,
+ * or a migration the DATABASE records as finalized (the marker
+ * `finalize` writes — a manifest file alone cannot reopen it); a
+ * manifest that fails its signature; created rows outside the import's
+ * own target collections (signed or not), or whose row no longer
+ * carries the importer's deterministic `baId`; and any delete or
+ * plaintext restore driven by an unsigned manifest without
+ * `allowUnsignedDeletes`. A row already absent is fine (the goal is
+ * "absent"); a delete that FAILS (a foreign key, a hook, a permission)
+ * aborts the rollback with the rows named, before any field is
+ * restored or the manifest reset — so it can be re-run once fixed.
  */
 export async function rollbackImport(options) {
     const { payload, manifest, log = () => { } } = options;
@@ -398,42 +416,130 @@ export async function rollbackImport(options) {
         // the migration's history, not a TODO to undo.
         throw new Error('the migration is finalized; rollback is no longer possible');
     }
-    let deleted = 0;
+    // Every row below is deleted, and every field restored, with
+    // overrideAccess: only a manifest this app signed may drive that.
+    const trust = authenticateManifest(payload.secret, manifest, {
+        allowUnsigned: options.allowUnsignedManifest,
+    });
+    if (trust === 'signed-legacy' && options.allowUnsignedManifest !== true) {
+        throw new Error("the manifest was signed by migrate 0.6.0, whose signature does not cover the 'finalized' flag. If you are sure this migration was never finalized and nobody has edited the manifest, re-run with --allow-unsigned-manifest; the rollback re-signs what it leaves behind");
+    }
+    // The database's own record of `finalize`, independent of the file.
+    // A manifest whose `createdAt` is not covered by a full signature is
+    // checked against every finalized migration of its kind.
+    const marker = await finalizeMarkerState(payload, manifest, { anyOfKind: trust !== 'signed' });
+    if (marker === 'finalized') {
+        throw new Error('the database records this migration as finalized; rollback is no longer possible (the manifest file does not override that)');
+    }
+    if (marker === 'unavailable') {
+        log("rollback: Payload's key-value store is unavailable, so the database finalize marker could not be checked; relying on the manifest's own flag");
+    }
+    assertCreatedRowsScoped(manifest, targetSlugsOf(options.slugs));
+    if (trust === 'unsigned' && options.allowUnsignedDeletes !== true) {
+        const plaintext = manifest.fieldWrites.filter((write) => write.before !== undefined).length;
+        if (manifest.created.length > 0 || plaintext > 0) {
+            throw new Error(`the manifest is unsigned: --allow-unsigned-manifest lets it restore sealed field values only, and it lists ${manifest.created.length} row(s) to delete and ${plaintext} plaintext value(s) to restore. Review the manifest's created rows, then re-run with --allow-unsigned-deletes as well — nothing was changed`);
+        }
+    }
+    // Pre-flight every created row BEFORE the first delete: a present row
+    // must still carry the importer's deterministic baId for its source
+    // key (the imported row, not one that took its id since).
+    const present = [];
+    const foreign = [];
+    let absent = 0;
     for (const row of [...manifest.created].reverse()) {
+        const doc = await findRow(payload, row);
+        if (doc === null) {
+            absent += 1;
+        }
+        else if (baIdMismatch(row, doc)) {
+            foreign.push(`${row.collection}#${String(row.id)} (${row.sourceKey})`);
+        }
+        else {
+            present.push(row);
+        }
+    }
+    if (foreign.length > 0) {
+        throw new Error(`${foreign.length} created row(s) no longer carry the baId the importer gave them, so they are not the imported rows: ${listSome(foreign, ', ')}. Refusing to delete anything`);
+    }
+    let deleted = 0;
+    const failed = [];
+    for (const row of present) {
         try {
             await payload.delete({ collection: row.collection, id: row.id, overrideAccess: true });
             deleted += 1;
         }
-        catch {
-            // Already gone (a crash after delete, a manual cleanup) — the
-            // goal state is "row absent", so absence is success.
-            log(`rollback: ${row.collection}#${row.id} already absent`);
+        catch (error) {
+            if ((await findRow(payload, row)) === null) {
+                // Removed concurrently: the goal state is "row absent".
+                absent += 1;
+                continue;
+            }
+            failed.push(`${row.collection}#${String(row.id)}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (failed.length > 0) {
+        for (const line of failed) {
+            log(`rollback: FAILED to delete ${line}`);
         }
+        throw new Error(`rollback deleted ${deleted} row(s) but could not delete ${failed.length}: ${listSome(failed, '; ')}. No field value was restored and the manifest was kept — fix the cause (e.g. rows that reference them) and re-run rollback`);
+    }
+    if (absent > 0) {
+        log(`rollback: ${absent} created row(s) were already absent`);
     }
     // Captured values go back through the adapter, one write per
     // document, `updatedAt` included — see host-writes.ts for why.
-    const restored = await restoreCaptured(payload, manifest);
+    const restored = await restoreCaptured(payload, manifest, {
+        rolesField: hostRolesField(payload),
+    });
     if (options.manifestPath !== undefined) {
-        const reset = {
+        const reset = signManifest(payload.secret, {
             ...manifest,
-            version: 2,
             created: [],
             fieldWrites: [],
             totals: {},
             rolledBackAt: (options.now ?? (() => new Date()))().toISOString(),
-        };
+        });
         writeManifest(reset, options.manifestPath);
     }
     log(`rollback: ${deleted} row(s) deleted, ${restored} field value(s) restored`);
     return { deleted, restored };
 }
-/** Finalize (issue #50): the point of no return — mark the manifest. */
-export function finalizeManifest(manifest, path) {
-    if (manifest.finalized) {
-        return manifest;
-    }
-    const finalized = { ...manifest, finalized: true };
-    writeManifest(finalized, path);
+/** The created row as stored, or `null` when it does not exist. */
+async function findRow(payload, row) {
+    const doc = await payload.findByID({
+        collection: row.collection,
+        id: row.id,
+        depth: 0,
+        overrideAccess: true,
+        disableErrors: true,
+    });
+    return doc ?? null;
+}
+function listSome(items, separator) {
+    return `${items.slice(0, 10).join(separator)}${items.length > 10 ? `${separator}…` : ''}`;
+}
+/**
+ * Finalize (issue #50): the point of no return. Records a one-way
+ * marker in the target database (Payload's key-value store) that every
+ * later rollback checks independently of the file, then marks the
+ * manifest `finalized` and re-signs it — the signature covers the flag.
+ * Idempotent: finalizing a finalized manifest re-records the marker and
+ * upgrades its signature.
+ */
+export async function finalizeManifest(options) {
+    const { payload, manifest } = options;
+    authenticateManifest(payload.secret, manifest, { allowUnsigned: options.allowUnsignedManifest });
+    const finalizedAt = manifest.finalizedAt ?? (options.now ?? (() => new Date()))().toISOString();
+    // The database marker first: a finalize that cannot record it fails
+    // with the manifest unchanged.
+    await recordFinalizeMarker(payload, manifest, finalizedAt);
+    const finalized = signManifest(payload.secret, {
+        ...manifest,
+        finalized: true,
+        finalizedAt,
+    });
+    writeManifest(finalized, options.path);
     return finalized;
 }
 //# sourceMappingURL=lifecycle.js.map