@voltro/cli 0.33.0 → 0.34.0

package/dist/connectionConfig-UFlIEiys.js

@@ -0,0 +1,66 @@
+//#region src/connectionConfig.ts
+var e = () => {
+	let e = t(process.env.DB_ACQUIRE_TIMEOUT_MS), n = t(process.env.DB_ACQUIRE_QUEUE_LIMIT);
+	return {
+		...e === void 0 ? {} : { acquireTimeoutMs: e },
+		...n === void 0 ? {} : { acquireQueueLimit: n }
+	};
+}, t = (e) => {
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isInteger(t) && t >= 0 ? t : void 0;
+}, n = () => {
+	let e = process.env.DB_STATEMENT_TIMEOUT_MS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isInteger(t) && t > 0 ? t : void 0;
+}, r = () => {
+	let e = process.env.PG_SSL;
+	if (!(e === void 0 || e === "")) {
+		if (e === "require") return !0;
+		if (e === "disable") return !1;
+		throw Error(`PG_SSL '${e}' is not supported — use 'require' (TLS without certificate verification) or 'disable' (plaintext).`);
+	}
+}, i = () => {
+	let e = process.env.DB_MAX_CONNECTIONS ?? process.env.PG_MAX_CONNECTIONS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isInteger(t) && t > 0 ? t : void 0;
+}, a = () => !process.env.DB_URL && !process.env.DB_PRIMARY_URL && !process.env.DB_DIRECT_URL && !process.env.DB_MIGRATE_URL && !process.env.DB_HOST && !process.env.PG_HOST, o = (t) => {
+	let a = i(), o = process.env.DB_SCHEMA, s = r(), c = t === "runtime" ? n() : void 0, l = {
+		...a === void 0 ? {} : { maxConnections: a },
+		...s === void 0 ? {} : { ssl: s },
+		...o !== void 0 && o.length > 0 ? { schema: o } : {},
+		...c === void 0 ? {} : { statementTimeoutMs: c },
+		...e()
+	}, u = t === "migration" ? process.env.DB_DIRECT_URL ?? process.env.DB_MIGRATE_URL ?? process.env.DB_URL ?? process.env.DB_PRIMARY_URL : process.env.DB_URL ?? process.env.DB_PRIMARY_URL;
+	return u ? {
+		url: u,
+		...l
+	} : {
+		host: process.env.DB_HOST ?? process.env.PG_HOST ?? "localhost",
+		port: Number(process.env.DB_PORT ?? process.env.PG_PORT ?? 5432),
+		username: process.env.DB_USER ?? process.env.PG_USER ?? "app",
+		password: process.env.DB_PASSWORD ?? process.env.PG_PASSWORD ?? "app",
+		database: process.env.DB_DATABASE ?? process.env.PG_DATABASE ?? "app",
+		...l
+	};
+}, s = (e, t) => ({
+	...e,
+	url: t
+}), c = () => {
+	let e = o("runtime"), t = e.ssl === !0 ? { ssl: { rejectUnauthorized: !1 } } : {};
+	return e.url === void 0 ? {
+		host: e.host ?? "localhost",
+		port: e.port ?? 5432,
+		user: e.username ?? "app",
+		password: e.password ?? "app",
+		database: e.database ?? "app",
+		...t
+	} : {
+		connectionString: e.url,
+		...t
+	};
+}, l = () => !a();
+//#endregion
+export { o as a, s as i, i as n, c as o, a as r, l as t };

package/dist/dashboardCommand-3YG8p-UA.js

@@ -0,0 +1,25 @@
+import { d as e } from "./dev-CerMd0mW.js";
+import { P as t, j as n } from "./webDev-CBYvPqQr.js";
+import { t as r } from "./start-9LiUOfES.js";
+import { join as i } from "node:path";
+import { existsSync as a } from "node:fs";
+import { createLogger as o } from "@voltro/logger";
+//#region src/dashboardCommand.ts
+var s = o({ scope: "voltro:dashboard" }), c = (e, t) => {
+	let n = e.indexOf(t);
+	return n >= 0 ? e[n + 1] : void 0;
+}, l = async (o) => {
+	process.env[n] = "1";
+	let l = c(o, "--port") ?? process.env.VOLTRO_DASHBOARD_PORT ?? "5179";
+	process.env.VOLTRO_DASHBOARD_PORT = l;
+	let u = t(process.cwd());
+	if (!u) return s.error("dashboard app not found. Install it with `pnpm add @voltro/dashboard`, or set VOLTRO_DASHBOARD_PATH to a dashboard app directory."), 1;
+	let d = a(i(u, ".framework", "dist", "index.html"));
+	return s.info(`serving the Voltro dashboard on :${l}`, {
+		from: u,
+		mode: d ? "start" : "dev",
+		apps: process.env.VOLTRO_DASHBOARD_APPS ? "configured" : "none (set VOLTRO_DASHBOARD_APPS)"
+	}), d ? r([u]) : e([u]);
+};
+//#endregion
+export { l as runDashboardCommand };

package/dist/dataCommand-qL0r7fPO.js

@@ -0,0 +1,535 @@
+import { t as e } from "./cliError-BmdYnghb.js";
+import { c as t, i as n, o as r } from "./dev-CerMd0mW.js";
+import { n as i, t as a } from "./cliArgs-D4p8n7EE.js";
+import { r as o } from "./dialectDriver-CgXnDfec.js";
+import { t as s } from "./dataProfile-dW-PsfLB.js";
+import { o as c, t as l } from "./inspectFetch-Cm8_wVvp.js";
+import { r as u } from "./dbCommand-B6X0FZbq.js";
+import { createLogger as d } from "@voltro/logger";
+import { Effect as f, Stream as p } from "effect";
+import { SqlClient as m } from "@effect/sql";
+import { declaredSnapshot as h, fingerprintSchema as g, introspectSchema as _ } from "@voltro/database/sql";
+import { connectionIdentity as v, normaliseTarget as y, sameDatabase as b, streamTable as x } from "@voltro/database";
+import { STORAGE_REFS_TABLE as S, resolveStorageProvider as C } from "@voltro/plugin-storage";
+import { assessLiveImport as ee, backupArtifactName as w, backupCommand as te, classificationFromSnapshot as ne, decryptStream as T, encryptStream as re, packBundle as E, peekBundle as D, previewMasking as ie, restoreCommand as O, runExport as k, runImport as A, runNativeStep as j, storageAssetSink as M, storageAssetSource as ae, storageBlobSink as oe, storageBlobSource as se, unpackBundle as ce, unpackBundleToDir as N } from "@voltro/data-transfer";
+//#region src/backupStamp.ts
+var P = "voltro-backup-stamp.json", le = (e) => ({
+	stampVersion: 1,
+	dialect: e.dialect,
+	schemaFingerprint: e.schemaFingerprint,
+	voltroVersion: e.voltroVersion,
+	createdAt: e.createdAt
+}), F = (e) => {
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch {
+		return null;
+	}
+	if (typeof t != "object" || !t) return null;
+	let n = t;
+	if (n.stampVersion !== 1 || typeof n.dialect != "string" || typeof n.voltroVersion != "string" || typeof n.createdAt != "string") return null;
+	let r = n.schemaFingerprint;
+	return r !== null && typeof r != "string" ? null : {
+		stampVersion: 1,
+		dialect: n.dialect,
+		schemaFingerprint: r,
+		voltroVersion: n.voltroVersion,
+		createdAt: n.createdAt
+	};
+}, ue = (e) => {
+	let { stamp: t, currentDialect: n, currentFingerprint: r } = e;
+	if (t === null) return {
+		warn: `no ${P} beside the dump — an older/handmade backup. Cannot verify dialect or schema version; make sure this dump is a ${n} dump.`,
+		info: []
+	};
+	let i = [`backup produced by @voltro/cli ${t.voltroVersion} at ${t.createdAt}`, `schema fingerprint: ${t.schemaFingerprint ?? "<none recorded>"}`];
+	return t.dialect === n ? t.schemaFingerprint !== null && r !== null && t.schemaFingerprint !== r ? {
+		warn: `schema skew — the backup's schema (${t.schemaFingerprint.slice(0, 12)}) differs from what this code declares (${r.slice(0, 12)}). Run \`voltro db apply\` after the restore, or the app may boot against a schema it doesn't understand.`,
+		info: i
+	} : { info: i } : {
+		refuse: `dialect mismatch — backup is a ${t.dialect} dump, but DB_DIALECT is ${n}. A cross-dialect restore is never valid.`,
+		info: i
+	};
+}, I = (e) => {
+	try {
+		let t = new URL(e), n = t.pathname.replace(/^\//, "");
+		return `${t.hostname.toLowerCase()}:${t.port || "(default)"}/${n}`;
+	} catch {
+		return e.trim();
+	}
+}, de = (e) => {
+	let t = e.flagUrl ?? e.envUrl;
+	if (t === void 0 || t.trim() === "") return {
+		ok: !1,
+		error: "no drill target — pass `--drill-url <url>` or set `DRILL_DB_URL`. The drill restores into a THROWAWAY database (never the live one), so it needs its own connection."
+	};
+	let n = I(t);
+	return e.liveKeys.some((e) => e === n) ? {
+		ok: !1,
+		error: `drill target (${n}) is the LIVE database — a restore drill must target a throwaway DB, never production. It would --clean and overwrite it.`
+	} : {
+		ok: !0,
+		url: t
+	};
+}, fe = (e) => {
+	let { stampFingerprint: t, restoredFingerprint: n, restoredTableCount: r } = e;
+	return r === 0 ? {
+		pass: !1,
+		lines: ["FAIL — the restore produced ZERO tables. The dump is empty or unreadable; this backup would NOT recover your app."]
+	} : t !== null && n !== null && t !== n ? {
+		pass: !1,
+		lines: [`FAIL — restored ${r} table(s), but the schema fingerprint (${n.slice(0, 12)}) does NOT match the backup's stamp (${t.slice(0, 12)}).`, "The restore did not reproduce the schema that was backed up — the artifact is inconsistent."]
+	} : t === null || n === null ? {
+		pass: !0,
+		lines: [`PASS (partial) — restored ${r} table(s) into the throwaway DB.`, "No stamped fingerprint to cross-check the schema shape (older/hand-made backup) — the bytes restore, but the shape was not verified."]
+	} : {
+		pass: !0,
+		lines: [`PASS — restored ${r} table(s); schema fingerprint matches the backup stamp (${n.slice(0, 12)}).`]
+	};
+}, L = d({ scope: "voltro:data" }), pe = async () => {
+	try {
+		let { createRequire: e } = await import("node:module"), { join: t } = await import("node:path"), { readFileSync: n } = await import("node:fs"), r = e(t(process.cwd(), "package.json")).resolve("@voltro/cli/package.json");
+		return JSON.parse(n(r, "utf8")).version ?? "unknown";
+	} catch {
+		return "unknown";
+	}
+}, R = async (e) => {
+	try {
+		return g(await K(e));
+	} catch {
+		return null;
+	}
+}, z = (e) => {
+	if (e.event !== "done") return;
+	let t = e.total === void 0 ? "" : ` / ${e.total}`;
+	L.info(`${e.phase} [${e.index + 1}/${e.tableCount}] ${e.table}`, { rows: `${e.rowsDone}${t}` });
+}, B = async (e) => {
+	let t = (e) => e?.meta?.databaseId;
+	if (e) {
+		let n = await l({
+			name: "target",
+			url: e
+		}, "/_voltro/inspect/app");
+		if (n.kind === "ok") return {
+			label: e,
+			databaseId: t(n.data)
+		};
+	}
+	for (let e of await c()) {
+		let n = await l(e, "/_voltro/inspect/app");
+		if (n.kind === "ok") return {
+			label: `${e.name} (${e.url})`,
+			databaseId: t(n.data)
+		};
+	}
+	return null;
+}, V = async (e) => {
+	let t = e.includes("--allow-live"), n = t ? null : await B(H(e, "--api-url")), i = v({
+		dialect: W(),
+		...r()
+	}), a = y({
+		dialect: W(),
+		...r()
+	}), { refuse: o, message: s } = ee({
+		liveInstance: n?.label ?? null,
+		allowLive: t,
+		sameTarget: b(i, n?.databaseId),
+		...a === void 0 ? {} : { targetLabel: `${a.host}:${a.port}/${a.database}` }
+	});
+	return o ? (L.error(s ?? "refusing: live instance detected"), !1) : !0;
+}, H = i, me = [
+	"--api-url",
+	"--bundle-key",
+	"--compression",
+	"--consistency",
+	"--drill-url",
+	"--mode",
+	"--on-conflict",
+	"--passphrase",
+	"--profile",
+	"--tables",
+	"--target",
+	"--tenant",
+	"--token"
+], U = (e) => a(e, me), W = () => {
+	let t = (process.env.DB_DIALECT ?? "postgres").toLowerCase();
+	if (t === "memory") throw new e("voltro data: requires a real dialect, not DB_DIALECT=memory.");
+	return t;
+}, G = async (e, t) => {
+	let n = (await o(e)).makeSqlLayer(t);
+	return f.runPromise(m.SqlClient.pipe(f.flatMap(_), f.provide(n)));
+}, K = (e) => G(e, r()), he = () => {
+	let e = r(), t = [];
+	return e.url && t.push(I(e.url)), (e.host || e.database) && t.push(`${(e.host ?? "localhost").toLowerCase()}:${e.port ?? "(default)"}/${e.database ?? ""}`), t;
+}, q = async () => {
+	let r = await t(process.cwd());
+	if (!r) throw new e("voltro data: no app.config.ts found in the current directory.");
+	let i = await n(r, void 0), a = W();
+	return {
+		store: i,
+		snapshot: await K(a),
+		dialect: a
+	};
+}, J = (e) => x(e, {
+	table: S,
+	chunkSize: 500
+}).pipe(p.map((e) => ({
+	key: String(e.key),
+	contentType: String(e.contentType ?? "application/octet-stream"),
+	size: Number(e.size ?? 0)
+}))), Y = (e) => !!e && e.endsWith(".vbundle"), X = (e) => H(e, "--passphrase") ?? process.env.VOLTRO_BUNDLE_KEY, ge = (e) => e.includes("--encrypt") || H(e, "--passphrase") !== void 0 || process.env.VOLTRO_BUNDLE_KEY !== void 0, _e = async (e, t) => {
+	let { createWriteStream: n } = await import("node:fs"), { pipeline: r } = await import("node:stream/promises"), { Readable: i } = await import("node:stream");
+	await r(i.from(e), n(t));
+}, Z = (e) => ({ async *[Symbol.asyncIterator]() {
+	let { createReadStream: t } = await import("node:fs");
+	for await (let n of t(e)) yield n instanceof Uint8Array ? n : new Uint8Array(n);
+} }), ve = (e) => {
+	let t = H(e, "--tenant");
+	if (t) return {
+		kind: "tenant",
+		tenantId: t
+	};
+	let n = H(e, "--tables");
+	return n ? {
+		kind: "tables",
+		tables: n.split(",").map((e) => e.trim()).filter(Boolean)
+	} : { kind: "all" };
+}, ye = async () => ne(h(await u(process.cwd()))), be = "voltro/tenant", xe = async () => {
+	let e = (await u(process.cwd())).filter((e) => (e.appliedMixins ?? []).some((e) => e.id === be)).map((e) => e.tableName);
+	return e.length > 0 ? e : void 0;
+}, Q = (e) => {
+	for (let t of e.tables) if (t.samples.length !== 0) {
+		console.log(`\n  ${t.table}`);
+		for (let e of t.samples) console.log(`    ${e.column}  [${e.action}]  ${JSON.stringify(e.before)} → ${JSON.stringify(e.after)}`);
+	}
+	if (e.leaks.length > 0) {
+		console.log("\n  ⚠ possible leaks in KEPT columns:");
+		for (let t of e.leaks) console.log(`    ${t.table}.${t.column} looks like ${t.pattern}: ${JSON.stringify(t.sample)}`);
+	}
+	if (e.unclassified.length > 0) {
+		console.log("\n  ✗ unclassified (would BLOCK a real export — add .sensitive()/.safe() or a policy override):");
+		for (let t of e.unclassified) console.log(`    ${t}`);
+	} else console.log("\n  ✓ every exported column is classified — safe to run.");
+}, Se = async (e) => {
+	let t = H(e, "--target") === "api", n = H(e, "--bundle-key"), r = U(e);
+	if (!r && !(t && n)) return L.error("usage: voltro data export <outDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--profile <name>] [--tenant <id>] [--tables a,b] [--bundle-key <storage-key>] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot] [--dry-run]"), 1;
+	if (t) {
+		let t = H(e, "--api-url");
+		if (!t) return L.error("--target api requires --api-url <url> (the running instance)"), 1;
+		let i = H(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
+		if (!i) return L.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
+		let a = H(e, "--tables"), o = {
+			...H(e, "--profile") ? { profile: H(e, "--profile") } : {},
+			...H(e, "--tenant") ? { tenant: H(e, "--tenant") } : {},
+			...a ? { tables: a.split(",").map((e) => e.trim()).filter(Boolean) } : {},
+			...H(e, "--consistency") === "snapshot" ? { consistency: "snapshot" } : {},
+			...H(e, "--compression") ? { compression: H(e, "--compression") } : {},
+			...e.includes("--assets") ? { assets: !0 } : {},
+			...n ? { bundleKey: n } : {}
+		}, s = await fetch(`${t.replace(/\/+$/, "")}/_voltro/admin/export`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${i}`
+			},
+			body: JSON.stringify(o)
+		});
+		if (!s.ok) return L.error(`api export failed: HTTP ${s.status} — ${await s.text()}`), 1;
+		if (n) return L.info("api export complete (pushed to storage)", {
+			via: t,
+			...await s.json()
+		}), 0;
+		let { resolve: c } = await import("node:path"), l = new Uint8Array(await s.arrayBuffer());
+		return await N((async function* () {
+			yield l;
+		})(), c(process.cwd(), r)), L.info("api export complete (downloaded from the running instance)", {
+			outDir: r,
+			tables: s.headers.get("x-export-tables") ?? void 0,
+			rows: s.headers.get("x-export-rows") ?? void 0,
+			masked: s.headers.get("x-export-masked") ?? void 0
+		}), 0;
+	}
+	if (!r) return L.error("a <outDir> is required for a direct export"), 1;
+	let i = H(e, "--profile"), a = i ? await s(i) : {}, { store: o, snapshot: c, dialect: l } = await q(), u = e.includes("--assets") || a.assets === !0, d = u ? C({}) : void 0, p = H(e, "--compression") ?? a.compression, m = H(e, "--consistency") === "snapshot" ? "snapshot" : a.consistency ?? "live", h = a.masking, g = a.subset, _ = a.scope ?? ve(e), v = h ? await ye() : void 0, y = _.kind === "tenant" ? await xe() : void 0, b = y ? { tenantTables: y } : {};
+	if (e.includes("--dry-run")) {
+		if (!h) return L.error("--dry-run previews masking, but the profile sets no masking policy"), 1;
+		let e = await f.runPromise(ie({
+			store: o,
+			snapshot: c,
+			masking: h,
+			...v ? { classification: v } : {},
+			...g ? {} : {
+				scope: _,
+				...b
+			}
+		}));
+		return Q(e), +(e.unclassified.length > 0);
+	}
+	if (Y(r)) {
+		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: i, join: a } = await import("node:path"), s = await n.mkdtemp(a(t.tmpdir(), "voltro-export-"));
+		try {
+			let t = await f.runPromise(k({
+				store: o,
+				snapshot: c,
+				dialect: l,
+				outDir: s,
+				...g ? { subset: g } : {
+					scope: _,
+					...b
+				},
+				consistency: m,
+				...p ? { compression: p } : {},
+				...h ? { masking: h } : {},
+				...v ? { classification: v } : {},
+				onProgress: z
+			})), n = E({
+				dir: s,
+				...d ? { blobs: se(d, () => J(o)) } : {}
+			}), a = ge(e);
+			if (a) {
+				let t = X(e);
+				if (!t) return L.error("--encrypt requires --passphrase <p> or VOLTRO_BUNDLE_KEY (a dedicated key, NOT the transfer secret)"), 1;
+				n = re(n, t);
+			}
+			return await _e(n, i(process.cwd(), r)), L.info("export complete (single file)", {
+				file: r,
+				encrypted: a,
+				assets: u,
+				tables: t.tables.length,
+				rows: t.tables.reduce((e, t) => e + t.rowCount, 0)
+			}), 0;
+		} finally {
+			await n.rm(s, {
+				recursive: !0,
+				force: !0
+			});
+		}
+	}
+	let x = await f.runPromise(k({
+		store: o,
+		snapshot: c,
+		dialect: l,
+		outDir: r,
+		...g ? { subset: g } : {
+			scope: _,
+			...b
+		},
+		consistency: m,
+		...p ? { compression: p } : {},
+		...h ? { masking: h } : {},
+		...v ? { classification: v } : {},
+		...d ? { assets: ae(d, () => J(o)) } : {},
+		onProgress: z
+	}));
+	return L.info("export complete", {
+		outDir: r,
+		tables: x.tables.length,
+		rows: x.tables.reduce((e, t) => e + t.rowCount, 0),
+		assets: x.assets.count,
+		compression: x.compression,
+		...x.masking ? { maskedColumns: x.masking.transformed.length } : {}
+	}), 0;
+}, Ce = async (e) => {
+	let t = H(e, "--target") === "api", n = H(e, "--bundle-key"), r = U(e);
+	if (!r && !(t && n)) return L.error("usage: voltro data import <bundleDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--bundle-key <storage-key>] [--mode upsert|append|replace] [--on-conflict skip|fail] [--atomic] [--assets] [--no-verify] [--force] [--allow-live]  (--force: import despite schema drift AND cross-dialect warnings)"), 1;
+	let i = H(e, "--mode") ?? "upsert", a = H(e, "--on-conflict") ?? "skip";
+	if (t) {
+		let t = H(e, "--api-url");
+		if (!t) return L.error("--target api requires --api-url <url> (the running instance)"), 1;
+		let o = H(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
+		if (!o) return L.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
+		let s = {
+			authorization: `Bearer ${o}`,
+			"x-import-mode": i,
+			"x-import-on-conflict": a,
+			...e.includes("--atomic") ? { "x-import-atomic": "1" } : {},
+			...e.includes("--force") ? { "x-import-force": "1" } : {}
+		}, { resolve: c } = await import("node:path"), l;
+		if (n) s["content-type"] = "application/json", l = JSON.stringify({ bundleKey: n });
+		else if (Y(r)) {
+			let t = Z(c(process.cwd(), r)), n = X(e);
+			n && (t = T(t, n));
+			let i = [];
+			for await (let e of t) i.push(Buffer.from(e));
+			s["content-type"] = "application/octet-stream", l = Buffer.concat(i);
+		} else {
+			await (await import("node:fs/promises")).access(c(process.cwd(), r, "assets", "index.ndjson")).then(() => !0, () => !1) && L.warn("this directory bundle has assets; --target api uploads DATA ONLY. Pack a single-file `.vbundle` (voltro data export <name>.vbundle --assets) to transfer assets over the API.");
+			let e = [];
+			for await (let t of E({ dir: c(process.cwd(), r) })) e.push(Buffer.from(t));
+			s["content-type"] = "application/octet-stream", l = Buffer.concat(e);
+		}
+		let u = await fetch(`${t.replace(/\/+$/, "")}/_voltro/admin/import`, {
+			method: "POST",
+			body: l,
+			headers: s
+		});
+		return u.ok ? (L.info("api import complete (imported by the running instance)", {
+			via: t,
+			...await u.json()
+		}), 0) : (L.error(`api import failed: HTTP ${u.status} — ${await u.text()}`), 1);
+	}
+	if (!r) return L.error("a <bundleDir> is required for a direct import"), 1;
+	if (!await V(e)) return 1;
+	let { store: o, snapshot: s } = await q(), c = e.includes("--force"), l = (e) => L.warn(e), u = e.includes("--assets") ? C({}) : void 0;
+	if (Y(r)) {
+		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: d, join: p } = await import("node:path"), m = await n.mkdtemp(p(t.tmpdir(), "voltro-import-"));
+		try {
+			let t = Z(d(process.cwd(), r)), n = X(e);
+			n && (t = T(t, n)), await ce(t, {
+				dir: m,
+				blobs: oe(u ?? C({}))
+			});
+			let p = await f.runPromise(A({
+				store: o,
+				bundleDir: m,
+				mode: i,
+				onConflict: a,
+				atomic: e.includes("--atomic"),
+				verify: !e.includes("--no-verify"),
+				targetDialect: W(),
+				allowIncompatible: c,
+				targetSnapshot: s,
+				force: c,
+				onWarn: l,
+				onProgress: z,
+				assetsAlreadyRestored: !0
+			}));
+			return L.info("import complete (single file)", {
+				file: r,
+				tables: p.tables.length,
+				rows: p.tables.reduce((e, t) => e + t.rowCount, 0)
+			}), 0;
+		} finally {
+			await n.rm(m, {
+				recursive: !0,
+				force: !0
+			});
+		}
+	}
+	let d = await f.runPromise(A({
+		store: o,
+		bundleDir: r,
+		mode: i,
+		onConflict: a,
+		atomic: e.includes("--atomic"),
+		verify: !e.includes("--no-verify"),
+		targetDialect: W(),
+		allowIncompatible: c,
+		targetSnapshot: s,
+		force: c,
+		onWarn: l,
+		onProgress: z,
+		...u ? { assets: M(u) } : {}
+	}));
+	return L.info("import complete", {
+		bundleDir: r,
+		tables: d.tables.length,
+		rows: d.tables.reduce((e, t) => e + t.rowCount, 0),
+		assets: d.assets.count
+	}), 0;
+}, $ = () => {
+	let e = r();
+	return {
+		...e.url ? { url: e.url } : {},
+		...e.host ? { host: e.host } : {},
+		...e.port ? { port: e.port } : {},
+		...e.username ? { username: e.username } : {},
+		...e.password ? { password: e.password } : {},
+		...e.database ? { database: e.database } : {}
+	};
+}, we = async (e) => {
+	let t = U(e);
+	if (!t) return L.error("usage: voltro data backup <outDir>  (native pg_dump/mysqldump/… + consistent artifact)"), 1;
+	let n = W(), { mkdir: r, writeFile: i } = await import("node:fs/promises"), { join: a } = await import("node:path");
+	await r(t, { recursive: !0 });
+	let o = a(t, w(n));
+	await f.runPromise(j(te(n, $(), o)));
+	let s = le({
+		dialect: n,
+		schemaFingerprint: await R(n),
+		voltroVersion: await pe(),
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	return await i(a(t, P), `${JSON.stringify(s, null, 2)}\n`, "utf8"), L.info("native backup complete", {
+		dialect: n,
+		artifact: o,
+		stamp: P,
+		schemaFingerprint: s.schemaFingerprint ?? "<none>",
+		assets: "NOT included — use `voltro data export --assets` for rows + blobs"
+	}), 0;
+}, Te = async (e, t) => {
+	let n = W(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(e, w(n)), o = de({
+		flagUrl: H(t, "--drill-url"),
+		envUrl: process.env.DRILL_DB_URL,
+		liveKeys: he()
+	});
+	if (!o.ok) return L.error(`restore --drill: ${o.error}`), 1;
+	let s = await i(r(e, P), "utf8").then(F, () => null);
+	if (s && s.dialect !== n) return L.error(`restore --drill: backup is a ${s.dialect} dump but DB_DIALECT is ${n} — cross-dialect restore is never valid.`), 1;
+	L.info("restore drill: restoring into throwaway DB", {
+		dialect: n,
+		target: I(o.url)
+	}), await f.runPromise(j(O(n, { url: o.url }, a)));
+	let c = null, l = 0;
+	try {
+		let e = await G(n, { url: o.url });
+		c = g(e), l = e.tables.length;
+	} catch (e) {
+		return L.error(`restore --drill: could not introspect the restored DB — ${String(e)}`), 1;
+	}
+	let u = fe({
+		stampFingerprint: s?.schemaFingerprint ?? null,
+		restoredFingerprint: c,
+		restoredTableCount: l
+	});
+	for (let e of u.lines) u.pass ? L.info(`restore drill: ${e}`) : L.error(`restore drill: ${e}`);
+	return +!u.pass;
+}, Ee = async (e) => {
+	let t = U(e);
+	if (!t) return L.error("usage: voltro data restore <backupDir> [--allow-live] [--api-url <url>] [--force] [--drill [--drill-url <url>]]  (native pg_restore/mysql/…)"), 1;
+	if (e.includes("--drill")) return Te(t, e);
+	if (!await V(e)) return 1;
+	let n = W(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(t, w(n)), o = ue({
+		stamp: await i(r(t, P), "utf8").then(F, () => null),
+		currentDialect: n,
+		currentFingerprint: await R(n)
+	});
+	for (let e of o.info) L.info(`backup stamp: ${e}`);
+	if (o.warn && L.warn(o.warn), o.refuse) {
+		if (!e.includes("--force")) return L.error(`restore refused: ${o.refuse} (pass --force to override)`), 1;
+		L.warn(`restore proceeding despite: ${o.refuse} (--force)`);
+	}
+	return await f.runPromise(j(O(n, $(), a))), L.info("native restore complete", {
+		dialect: n,
+		artifact: a
+	}), 0;
+}, De = async (e) => {
+	let t = U(e);
+	if (!t) return L.error("usage: voltro data inspect <file.vbundle> [--json] [--passphrase <p>]"), 1;
+	let { resolve: n } = await import("node:path"), r = n(process.cwd(), t), i = X(e), a = () => {
+		let e = Z(r);
+		return i ? T(e, i) : e;
+	};
+	if (e.includes("--json")) {
+		let e = (await D(a(), ["manifest.json"])).get("manifest.json");
+		return e ? (console.log(e.toString("utf8")), 0) : (L.error("no manifest.json found in the bundle"), 1);
+	}
+	let o = (await D(a(), ["README.md"])).get("README.md");
+	if (o) return console.log(o.toString("utf8")), 0;
+	let s = (await D(a(), ["manifest.json"])).get("manifest.json");
+	return s ? (console.log(s.toString("utf8")), 0) : (L.error("bundle has no README.md or manifest.json"), 1);
+}, Oe = async (e) => {
+	let t = U(e), n = U(e.filter((e) => e !== t));
+	if (!t || !n) return L.error("usage: voltro data unpack <file.vbundle> <dir> [--passphrase <p>]"), 1;
+	let { resolve: r } = await import("node:path"), i = Z(r(process.cwd(), t)), a = X(e);
+	return a && (i = T(i, a)), await N(i, r(process.cwd(), n)), L.info("unpack complete", {
+		file: t,
+		dir: n
+	}), 0;
+}, ke = async (e) => {
+	let [t, ...n] = e;
+	return t === "export" ? Se(n) : t === "import" ? Ce(n) : t === "unpack" ? Oe(n) : t === "inspect" ? De(n) : t === "backup" ? we(n) : t === "restore" ? Ee(n) : (L.error("usage: voltro data <export|import|unpack|inspect|backup|restore> … (logical: export/import; native: backup/restore)"), t ? 2 : 1);
+};
+//#endregion
+export { ke as runDataCommand };

package/dist/dataProfile-dW-PsfLB.js

@@ -0,0 +1,15 @@
+//#region src/dataProfile.ts
+var e = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+};
+//#endregion
+export { e as t };