@voltro/cli 0.49.0 → 0.50.0

package/dist/{dataCommand-CJv_OMoS.js → dataCommand-B93TUBIx.js}

@@ -1,6 +1,6 @@
 import { i as e, t } from "./subcommandNames-DpYs3DXr.js";
 import { t as n } from "./cliError-BmdYnghb.js";
-import { c as r, i, o as a, z as o } from "./dev-C31Nvlbv.js";
+import { c as r, i, o as a, z as o } from "./dev-1yu42ubu.js";
 import { n as s, t as c } from "./cliArgs-D4p8n7EE.js";
 import { r as l } from "./dialectDriver-czCHYpeH.js";
 import { i as u, n as d, r as f, t as p } from "./dataProfile-Du3ztYxv.js";
@@ -8,17 +8,17 @@ import { o as m, t as h } from "./inspectFetch-EMuhTG_9.js";
 import { r as g } from "./dbCommand-Bf7Cy0mn.js";
 import { resolve as _ } from "node:path";
 import { createLogger as v } from "@voltro/logger";
-import { DATA_TRANSFERS_TABLE as y, connectionIdentity as b, normaliseTarget as x, sameDatabase as S, streamTable as C } from "@voltro/database";
-import { Effect as w, Stream as ee } from "effect";
-import { SqlClient as te } from "@effect/sql";
-import { declaredSnapshot as ne, fingerprintSchema as re, introspectSchema as ie } from "@voltro/database/sql";
-import { STORAGE_REFS_TABLE as ae, resolveStorageProvider as T } from "@voltro/plugin-storage";
-import { createHash as oe } from "node:crypto";
-import { asImportError as se, assessLiveImport as ce, backupArtifactName as E, backupCommand as le, classificationFromSnapshot as ue, decryptStream as D, encryptStream as de, packBundle as fe, peekBundle as O, previewMasking as pe, restoreCommand as k, runExport as me, runImport as he, runNativeStep as A, storageAssetSink as ge, storageAssetSource as _e, storageBlobSink as ve, storageBlobSource as ye, unpackBundle as be, unpackBundleToDir as xe } from "@voltro/data-transfer";
-import { request as Se } from "node:http";
-import { request as Ce } from "node:https";
+import { DATA_TRANSFERS_TABLE as y, REPLACE_IN_PROGRESS_TABLE as b, _voltroDataTransfersTable as x, _voltroReplaceInProgressTable as S, connectionIdentity as C, derivedRowId as ee, ensureTableRegistered as te, normaliseTarget as ne, sameDatabase as re, streamTable as ie } from "@voltro/database";
+import { Cause as w, Effect as T, Exit as ae, Option as oe, Stream as se } from "effect";
+import { SqlClient as ce } from "@effect/sql";
+import { declaredSnapshot as le, fingerprintSchema as ue, introspectSchema as de } from "@voltro/database/sql";
+import { STORAGE_REFS_TABLE as fe, resolveStorageProvider as E } from "@voltro/plugin-storage";
+import { createHash as pe } from "node:crypto";
+import { ASSETS_DIR as D, ASSET_INDEX_FILE as O, BundleError as me, asImportError as he, assessLiveImport as ge, backupArtifactName as k, backupCommand as _e, captureAssetsToCas as ve, classificationFromSnapshot as ye, decryptStream as A, encryptStream as be, packBundle as xe, peekBundle as j, previewMasking as Se, restoreAssetsFromCas as Ce, restoreCommand as we, runExport as Te, runImport as Ee, runNativeStep as M, storageAssetSink as De, storageAssetSource as Oe, storageBlobSink as ke, storageBlobSource as Ae, unpackBundle as je, unpackBundleToDir as Me } from "@voltro/data-transfer";
+import { request as Ne } from "node:http";
+import { request as Pe } from "node:https";
 //#region src/longRequest.ts
-var we = /* @__PURE__ */ new Set([
+var Fe = /* @__PURE__ */ new Set([
 	"ECONNREFUSED",
 	"ETIMEDOUT",
 	"EHOSTUNREACH",
@@ -26,7 +26,7 @@ var we = /* @__PURE__ */ new Set([
 	"ENOTFOUND",
 	"ECONNRESET",
 	"EAI_AGAIN"
-]), j = class extends Error {
+]), N = class extends Error {
 	url;
 	cause;
 	constructor(e, t) {
@@ -39,14 +39,14 @@ var we = /* @__PURE__ */ new Set([
 		})();
 		super(`the instance at ${n} is not answering (${t.code ?? "connect failed"}).`), this.url = e, this.cause = t, this.name = "InstanceUnreachable";
 	}
-}, M = class extends Error {
+}, P = class extends Error {
 	elapsedMs;
 	url;
 	constructor(e, t) {
 		super(`no response after ${Math.round(e / 1e3)}s`), this.elapsedMs = e, this.url = t, this.name = "LongRequestTimeout";
 	}
-}, N = async (e, t, n, r) => {
-	let i = new URL(e), a = i.protocol === "https:" ? Ce : Se, o = Date.now();
+}, F = async (e, t, n, r) => {
+	let i = new URL(e), a = i.protocol === "https:" ? Pe : Ne, o = Date.now();
 	return await new Promise((s, c) => {
 		let l = a({
 			protocol: i.protocol,
@@ -64,8 +64,8 @@ var we = /* @__PURE__ */ new Set([
 			})), e.on("error", c);
 		});
 		if (r?.timeoutMs !== void 0 && r.timeoutMs > 0 && l.setTimeout(r.timeoutMs, () => {
-			l.destroy(new M(Date.now() - o, e));
-		}), l.on("error", (t) => c(we.has(t.code ?? "") ? new j(e, t) : t)), typeof t == "string" || Buffer.isBuffer(t)) {
+			l.destroy(new P(Date.now() - o, e));
+		}), l.on("error", (t) => c(Fe.has(t.code ?? "") ? new N(e, t) : t)), typeof t == "string" || Buffer.isBuffer(t)) {
 			l.end(t);
 			return;
 		}
@@ -78,7 +78,7 @@ var we = /* @__PURE__ */ new Set([
 			}
 		})();
 	});
-}, P = (e) => `${e.message}\n  That address came from --api-url (or VOLTRO_API_URL) — it is the running instance, not the database.\n  Nothing was sent, so nothing was imported. Check the instance is up and reachable from here\n  (a VPN, an ingress or a stopped deployment are the usual three), e.g. curl -sS ${e.url}/_voltro/inspect/app`, Te = (e, t) => `the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. This is a client-side deadline, not a failure on the server: the upload itself finished long before, and the response arrives only when the import does. The instance is very probably STILL IMPORTING and will finish.\n` + (t === "replace" ? "  Do NOT simply re-run: --mode replace empties the target first, so a second run started while the first is mid-flight would empty it under the first one. Check the instance's log for the import's completion, and check the target's row counts, before deciding." : `  Re-running the same bundle is safe once the first run has finished (--mode ${t} is idempotent), but check the instance's log first — the work may already be done.`) + "\n  To keep a deadline anyway, pass --timeout <seconds>; the default is to wait.", Ee = 16777216, De = async function* (e, t) {
+}, I = (e) => `${e.message}\n  That address came from --api-url (or VOLTRO_API_URL) — it is the running instance, not the database.\n  Nothing was sent, so nothing was imported. Check the instance is up and reachable from here\n  (a VPN, an ingress or a stopped deployment are the usual three), e.g. curl -sS ${e.url}/_voltro/inspect/app`, Ie = (e, t) => `the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. This is a client-side deadline, not a failure on the server: the upload itself finished long before, and the response arrives only when the import does. The instance is very probably STILL IMPORTING and will finish.\n` + (t === "replace" ? "  Do NOT simply re-run: --mode replace empties the target first, so a second run started while the first is mid-flight would empty it under the first one. Check the instance's log for the import's completion, and check the target's row counts, before deciding." : `  Re-running the same bundle is safe once the first run has finished (--mode ${t} is idempotent), but check the instance's log first — the work may already be done.`) + "\n  To keep a deadline anyway, pass --timeout <seconds>; the default is to wait.", Le = 16777216, Re = async function* (e, t) {
 	let n = [], r = 0, i = 0, a = function* (e) {
 		let t = Buffer.concat(n);
 		n = [], r = 0;
@@ -100,12 +100,12 @@ var we = /* @__PURE__ */ new Set([
 		i += a.byteLength, yield s;
 	}
 	yield* a(!0);
-}, Oe = (e) => oe("sha256").update(Buffer.from(e)).digest("hex"), ke = async (e) => {
+}, ze = (e) => pe("sha256").update(Buffer.from(e)).digest("hex"), Be = async (e) => {
 	let t = 0, n = 0, r = {
 		status: 0,
 		body: {}
 	};
-	for await (let i of De(e.stream, e.chunkBytes)) {
+	for await (let i of Re(e.stream, e.chunkBytes)) {
 		if (i.offset + i.bytes.byteLength <= e.alreadyHeld && !i.final) {
 			n++;
 			continue;
@@ -131,13 +131,14 @@ var we = /* @__PURE__ */ new Set([
 		bytes: t,
 		resumedFrom: e.alreadyHeld
 	};
-}, F = "voltro-backup-stamp.json", Ae = (e) => ({
+}, L = "voltro-backup-stamp.json", Ve = (e) => ({
 	stampVersion: 1,
 	dialect: e.dialect,
 	schemaFingerprint: e.schemaFingerprint,
 	voltroVersion: e.voltroVersion,
-	createdAt: e.createdAt
-}), je = (e) => {
+	createdAt: e.createdAt,
+	assets: e.assets ?? null
+}), He = (e) => {
 	let t;
 	try {
 		t = JSON.parse(e);
@@ -148,17 +149,23 @@ var we = /* @__PURE__ */ new Set([
 	let n = t;
 	if (n.stampVersion !== 1 || typeof n.dialect != "string" || typeof n.voltroVersion != "string" || typeof n.createdAt != "string") return null;
 	let r = n.schemaFingerprint;
-	return r !== null && typeof r != "string" ? null : {
+	if (r !== null && typeof r != "string") return null;
+	let i = n.assets, a = typeof i == "object" && i && typeof i.count == "number" && typeof i.totalBytes == "number" ? {
+		count: i.count,
+		totalBytes: i.totalBytes
+	} : null;
+	return {
 		stampVersion: 1,
 		dialect: n.dialect,
 		schemaFingerprint: r,
 		voltroVersion: n.voltroVersion,
-		createdAt: n.createdAt
+		createdAt: n.createdAt,
+		assets: a
 	};
-}, Me = (e) => {
+}, Ue = (e) => {
 	let { stamp: t, currentDialect: n, currentFingerprint: r } = e;
 	if (t === null) return {
-		warn: `no ${F} beside the dump — an older/handmade backup. Cannot verify dialect or schema version; make sure this dump is a ${n} dump.`,
+		warn: `no ${L} beside the dump — an older/handmade backup. Cannot verify dialect or schema version; make sure this dump is a ${n} dump.`,
 		info: []
 	};
 	let i = [`backup produced by @voltro/cli ${t.voltroVersion} at ${t.createdAt}`, `schema fingerprint: ${t.schemaFingerprint ?? "<none recorded>"}`];
@@ -169,20 +176,82 @@ var we = /* @__PURE__ */ new Set([
 		refuse: `dialect mismatch — backup is a ${t.dialect} dump, but DB_DIALECT is ${n}. A cross-dialect restore is never valid.`,
 		info: i
 	};
-}, I = (e) => {
+}, We = async (e, t) => {
+	let n = ee("dimp", `${t.direction}-${t.artifact}-${Date.now()}-${Math.random()}`);
+	try {
+		return te(x), await e.insert(y, {
+			id: n,
+			direction: t.direction,
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: `native ${t.dialect}${t.assets ? " + assets" : ""}`,
+			via: "cli",
+			bundle: t.artifact,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), {
+			runId: n,
+			recorded: !0
+		};
+	} catch {
+		return {
+			runId: n,
+			recorded: !1
+		};
+	}
+}, R = async (e, t, n) => {
+	t.recorded && await e.update(y, t.runId, {
+		finishedAt: /* @__PURE__ */ new Date(),
+		failure: n.failure ?? null,
+		...n.assets === void 0 ? {} : { rowsWritten: n.assets }
+	}).then(() => void 0, () => void 0);
+}, Ge = async (e, t) => {
+	let n = ee("repl", `restore-${t.artifact}-${Date.now()}-${Math.random()}`);
+	try {
+		te(S), await e.insert(b, {
+			id: n,
+			startedAt: /* @__PURE__ */ new Date(),
+			kind: "restore",
+			tables: null,
+			capture: t.artifact,
+			via: "cli"
+		});
+	} catch {
+		return;
+	}
+	return async () => {
+		await e.deleteMany(b, { where: {
+			column: "id",
+			op: "eq",
+			value: n
+		} }).then(() => void 0, () => void 0);
+	};
+}, Ke = async (e) => {
+	let t = await T.runPromiseExit(e);
+	if (ae.isSuccess(t)) return;
+	let n = w.failureOption(t.cause);
+	if (oe.isSome(n)) {
+		let e = n.value;
+		return String(e?.message ?? e);
+	}
+	return w.pretty(t.cause);
+}, z = (e) => {
 	try {
 		let t = new URL(e), n = t.pathname.replace(/^\//, "");
 		return `${t.hostname.toLowerCase()}:${t.port || "(default)"}/${n}`;
 	} catch {
 		return e.trim();
 	}
-}, Ne = (e) => {
+}, qe = (e) => {
 	let t = e.flagUrl ?? e.envUrl;
 	if (t === void 0 || t.trim() === "") return {
 		ok: !1,
 		error: "no drill target — pass `--drill-url <url>` or set `DRILL_DB_URL`. The drill restores into a THROWAWAY database (never the live one), so it needs its own connection."
 	};
-	let n = I(t);
+	let n = z(t);
 	return e.liveKeys.some((e) => e === n) ? {
 		ok: !1,
 		error: `drill target (${n}) is the LIVE database — a restore drill must target a throwaway DB, never production. It would --clean and overwrite it.`
@@ -190,7 +259,7 @@ var we = /* @__PURE__ */ new Set([
 		ok: !0,
 		url: t
 	};
-}, Pe = (e) => {
+}, Je = (e) => {
 	let { stampFingerprint: t, restoredFingerprint: n, restoredTableCount: r } = e;
 	return r === 0 ? {
 		pass: !1,
@@ -205,24 +274,24 @@ var we = /* @__PURE__ */ new Set([
 		pass: !0,
 		lines: [`PASS — restored ${r} table(s); schema fingerprint matches the backup stamp (${n.slice(0, 12)}).`]
 	};
-}, L = v({ scope: "voltro:data" }), Fe = async () => {
+}, B = v({ scope: "voltro:data" }), Ye = async () => {
 	try {
 		let { createRequire: e } = await import("node:module"), { join: t } = await import("node:path"), { readFileSync: n } = await import("node:fs"), r = e(t(process.cwd(), "package.json")).resolve("@voltro/cli/package.json");
 		return JSON.parse(n(r, "utf8")).version ?? "unknown";
 	} catch {
 		return "unknown";
 	}
-}, R = async (e) => {
+}, Xe = async (e) => {
 	try {
-		return re(await Be(e));
+		return ue(await tt(e));
 	} catch {
 		return null;
 	}
-}, z = (e) => {
+}, V = (e) => {
 	if (e.event !== "done") return;
 	let t = e.total === void 0 ? "" : ` / ${e.total}`;
-	L.info(`${e.phase} [${e.index + 1}/${e.tableCount}] ${e.table}`, { rows: `${e.rowsDone}${t}` });
-}, Ie = async (e) => {
+	B.info(`${e.phase} [${e.index + 1}/${e.tableCount}] ${e.table}`, { rows: `${e.rowsDone}${t}` });
+}, Ze = async (e) => {
 	let t = (e) => e?.meta?.databaseId;
 	if (e) {
 		let n = await h({
@@ -242,21 +311,21 @@ var we = /* @__PURE__ */ new Set([
 		};
 	}
 	return null;
-}, Le = async (e) => {
-	let t = e.includes("--allow-live"), n = t ? null : await Ie(B(e, "--api-url")), r = b({
-		dialect: H(),
+}, Qe = async (e) => {
+	let t = e.includes("--allow-live"), n = t ? null : await Ze(H(e, "--api-url")), r = C({
+		dialect: W(),
 		...a()
-	}), i = x({
-		dialect: H(),
+	}), i = ne({
+		dialect: W(),
 		...a()
-	}), { refuse: o, message: s } = ce({
+	}), { refuse: o, message: s } = ge({
 		liveInstance: n?.label ?? null,
 		allowLive: t,
-		sameTarget: S(r, n?.databaseId),
+		sameTarget: re(r, n?.databaseId),
 		...i === void 0 ? {} : { targetLabel: `${i.host}:${i.port}/${i.database}` }
 	});
-	return !o || (L.error(s ?? "refusing: live instance detected"), !1);
-}, B = s, Re = [
+	return !o || (B.error(s ?? "refusing: live instance detected"), !1);
+}, H = s, $e = [
 	"--api-url",
 	"--bundle-key",
 	"--compression",
@@ -276,50 +345,50 @@ var we = /* @__PURE__ */ new Set([
 	"--timeout",
 	"--tenant",
 	"--token"
-], V = (e) => c(e, Re), H = () => {
+], U = (e) => c(e, $e), W = () => {
 	let e = (process.env.DB_DIALECT ?? "postgres").toLowerCase();
 	if (e === "memory") throw new n("voltro data: requires a real dialect, not DB_DIALECT=memory.");
 	return e;
-}, ze = async (e, t) => {
+}, et = async (e, t) => {
 	let n = (await l(e)).makeSqlLayer(t);
-	return w.runPromise(te.SqlClient.pipe(w.flatMap(ie), w.provide(n)));
-}, Be = (e) => ze(e, a()), Ve = () => {
+	return T.runPromise(ce.SqlClient.pipe(T.flatMap(de), T.provide(n)));
+}, tt = (e) => et(e, a()), nt = () => {
 	let e = a(), t = [];
-	return e.url && t.push(I(e.url)), (e.host || e.database) && t.push(`${(e.host ?? "localhost").toLowerCase()}:${e.port ?? "(default)"}/${e.database ?? ""}`), t;
-}, U = async () => {
+	return e.url && t.push(z(e.url)), (e.host || e.database) && t.push(`${(e.host ?? "localhost").toLowerCase()}:${e.port ?? "(default)"}/${e.database ?? ""}`), t;
+}, G = async () => {
 	let e = process.cwd(), t = await r(e);
 	if (!t) throw new n("voltro data: no app.config.ts found in the current directory.");
-	let a = await i(t, void 0), o = H();
+	let a = await i(t, void 0), o = W();
 	return {
 		store: a,
-		snapshot: await Be(o),
+		snapshot: await tt(o),
 		dialect: o
 	};
-}, W = (e) => C(e, {
-	table: ae,
+}, K = (e) => ie(e, {
+	table: fe,
 	chunkSize: 500
-}).pipe(ee.map((e) => ({
+}).pipe(se.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-}))), G = (e) => !!e && e.endsWith(".vbundle"), K = (e) => B(e, "--passphrase") ?? process.env.VOLTRO_BUNDLE_KEY, He = (e) => e.includes("--encrypt") || B(e, "--passphrase") !== void 0 || process.env.VOLTRO_BUNDLE_KEY !== void 0, Ue = async (e, t) => {
+}))), q = (e) => !!e && e.endsWith(".vbundle"), J = (e) => H(e, "--passphrase") ?? process.env.VOLTRO_BUNDLE_KEY, rt = (e) => e.includes("--encrypt") || H(e, "--passphrase") !== void 0 || process.env.VOLTRO_BUNDLE_KEY !== void 0, it = async (e, t) => {
 	let { createWriteStream: n } = await import("node:fs"), { pipeline: r } = await import("node:stream/promises"), { Readable: i } = await import("node:stream");
 	await r(i.from(e), n(t));
-}, q = (e) => ({ async *[Symbol.asyncIterator]() {
+}, Y = (e) => ({ async *[Symbol.asyncIterator]() {
 	let { createReadStream: t } = await import("node:fs");
 	for await (let n of t(e)) yield n instanceof Uint8Array ? n : new Uint8Array(n);
-} }), We = async (e, t) => {
+} }), at = async (e, t) => {
 	if (t !== void 0 || e === void 0) return null;
 	try {
-		let { resolve: t, join: n } = await import("node:path"), r = await import("node:fs/promises"), i = t(process.cwd(), e), a = G(e) ? (await O(q(i), ["manifest.json"])).get("manifest.json") : await r.readFile(n(i, "manifest.json"));
+		let { resolve: t, join: n } = await import("node:path"), r = await import("node:fs/promises"), i = t(process.cwd(), e), a = q(e) ? (await j(Y(i), ["manifest.json"])).get("manifest.json") : await r.readFile(n(i, "manifest.json"));
 		if (a === void 0) return null;
 		let o = (JSON.parse(Buffer.from(a).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
 		return o.length > 0 ? o : null;
 	} catch {
 		return null;
 	}
-}, Ge = (e) => {
-	let t = B(e, "--max-request-seconds") ?? process.env.VOLTRO_MAX_REQUEST_SECONDS;
+}, ot = (e) => {
+	let t = H(e, "--max-request-seconds") ?? process.env.VOLTRO_MAX_REQUEST_SECONDS;
 	if (t === void 0) return { pollMs: 2e3 };
 	let r = Number(t);
 	if (!Number.isFinite(r) || r <= 0) throw new n(`--max-request-seconds expects a positive number of seconds, got '${t}'`);
@@ -328,8 +397,8 @@ var we = /* @__PURE__ */ new Set([
 		perRequest: { timeoutMs: i },
 		pollMs: Math.max(500, Math.min(2e3, Math.floor(i / 2)))
 	};
-}, Ke = async (e, t, n) => {
-	let r = await fetch(`${e.replace(/\/+$/, "")}/_voltro/admin/imports?limit=50`, { headers: { authorization: `Bearer ${t}` } }).catch(() => null);
+}, st = async (e, t, n) => {
+	let r = await fetch(`${e.replace(/\/+$/, "")}/_voltro/admin/transfers?limit=50`, { headers: { authorization: `Bearer ${t}` } }).catch(() => null);
 	if (r === null || r.status !== 200) return null;
 	let i = ((await r.json().catch(() => null))?.runs ?? []).find((e) => e.id === n);
 	return i === void 0 ? null : {
@@ -337,7 +406,7 @@ var we = /* @__PURE__ */ new Set([
 		startedAt: new Date(String(i.startedAt)),
 		finishedAt: i.finishedAt === null || i.finishedAt === void 0 ? null : new Date(String(i.finishedAt))
 	};
-}, qe = async (e) => {
+}, ct = async (e) => {
 	let t = e.apiUrl.replace(/\/+$/, ""), n = [], r = 0, i;
 	for (;;) {
 		let a = `${t}/_voltro/admin/export/download?runId=${encodeURIComponent(e.runId)}&offset=${r}`, o = new AbortController(), s = e.perRequest === void 0 ? void 0 : setTimeout(() => {
@@ -359,12 +428,12 @@ var we = /* @__PURE__ */ new Set([
 		e.log.info(`  downloading — ${r}/${i ?? "?"} bytes`);
 	}
 	return new Uint8Array(Buffer.concat(n));
-}, J = "transfers", Je = (e) => (e ?? "").split(",").map((e) => e.trim()).filter(Boolean), Ye = (e, t) => {
-	let r = B(e, "--tenant"), i = B(e, "--tables"), a = B(e, "--exclude");
+}, X = "transfers", lt = (e) => (e ?? "").split(",").map((e) => e.trim()).filter(Boolean), ut = (e, t) => {
+	let r = H(e, "--tenant"), i = H(e, "--tables"), a = H(e, "--exclude");
 	if (a !== void 0) {
 		if (i !== void 0) throw new n("voltro data export: --exclude and --tables are two ways to say the same thing; use one.");
 		if (r !== void 0) throw new n("voltro data export: --exclude does not apply to --tenant, whose table set is derived from the tenant closure.");
-		let e = Je(a), o = new Set(t), s = e.filter((e) => !o.has(e));
+		let e = lt(a), o = new Set(t), s = e.filter((e) => !o.has(e));
 		if (s.length > 0) throw new n(`voltro data export: --exclude names ${s.length} table(s) that do not exist: ${s.join(", ")}. An exclusion that excludes nothing would leave the run looking like it worked.`);
 		return {
 			kind: "all",
@@ -376,15 +445,15 @@ var we = /* @__PURE__ */ new Set([
 		tenantId: r
 	} : i ? {
 		kind: "tables",
-		tables: Je(i)
+		tables: lt(i)
 	} : { kind: "all" };
-}, Xe = async () => {
+}, dt = async () => {
 	let e = await g(process.cwd());
-	return ue(ne(e));
-}, Ze = "voltro/tenant", Qe = async () => {
-	let e = (await g(process.cwd())).filter((e) => (e.appliedMixins ?? []).some((e) => e.id === Ze)).map((e) => e.tableName);
+	return ye(le(e));
+}, ft = "voltro/tenant", pt = async () => {
+	let e = (await g(process.cwd())).filter((e) => (e.appliedMixins ?? []).some((e) => e.id === ft)).map((e) => e.tableName);
 	return e.length > 0 ? e : void 0;
-}, $e = (e) => {
+}, mt = (e) => {
 	for (let t of e.tables) if (t.samples.length !== 0) {
 		console.log(`\n  ${t.table}`);
 		for (let e of t.samples) console.log(`    ${e.column}  [${e.action}]  ${JSON.stringify(e.before)} → ${JSON.stringify(e.after)}`);
@@ -397,8 +466,8 @@ var we = /* @__PURE__ */ new Set([
 		console.log("\n  ✗ unclassified (would BLOCK a real export — add .sensitive()/.safe() or a policy override):");
 		for (let t of e.unclassified) console.log(`    ${t}`);
 	} else console.log("\n  ✓ every exported column is classified — safe to run.");
-}, et = async (e) => {
-	let { resolve: t, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = B(e.args, "--chunk-size"), o = a === void 0 ? Ee : Math.round(Number(a) * 1024 * 1024);
+}, ht = async (e) => {
+	let { resolve: t, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = H(e.args, "--chunk-size"), o = a === void 0 ? Le : Math.round(Number(a) * 1024 * 1024);
 	if (!Number.isFinite(o) || o <= 0) throw new n(`--chunk-size expects a positive number of megabytes, got '${String(a)}'`);
 	let s = e.stream[Symbol.asyncIterator](), c = [], l = 0, u = !1;
 	for (; l <= o;) {
@@ -413,11 +482,11 @@ var we = /* @__PURE__ */ new Set([
 		kind: "small",
 		body: Buffer.concat(c)
 	};
-	let d = t(process.cwd(), e.bundleDir), f = Oe(G(e.bundleDir) ? await i.readFile(d) : await i.readFile(r(d, "manifest.json"))), p = `up-${f.slice(0, 32)}`, m = await N(e.url, Buffer.alloc(0), {
+	let d = t(process.cwd(), e.bundleDir), f = ze(q(e.bundleDir) ? await i.readFile(d) : await i.readFile(r(d, "manifest.json"))), p = `up-${f.slice(0, 32)}`, m = await F(e.url, Buffer.alloc(0), {
 		...e.headers,
 		"x-import-upload-id": p,
 		"x-import-probe": "1"
-	}, X(e.args)), h = m.status === 200 ? Number(JSON.parse(m.body.toString("utf8")).bytes ?? 0) : 0;
+	}, Q(e.args)), h = m.status === 200 ? Number(JSON.parse(m.body.toString("utf8")).bytes ?? 0) : 0;
 	h > 0 && e.log.info("api import: resuming a chunked upload the instance already holds", { bytes: h });
 	let g = (async function* () {
 		for (let e of c) yield e;
@@ -426,7 +495,7 @@ var we = /* @__PURE__ */ new Set([
 			if (e.done === !0) return;
 			yield e.value;
 		}
-	})(), _ = 0, v = await ke({
+	})(), _ = 0, v = await Be({
 		stream: g,
 		chunkBytes: o,
 		uploadId: p,
@@ -440,7 +509,7 @@ var we = /* @__PURE__ */ new Set([
 			e.log.info("api import: upload done — the instance is importing now. This request stays open until it finishes, which on a full bundle is minutes, and nothing more is printed until then. It is not a hang; the instance logs the import itself.");
 		},
 		target: { send: async (t, n) => {
-			let r = await N(e.url, t, n, X(e.args)), i = {};
+			let r = await F(e.url, t, n, Q(e.args)), i = {};
 			try {
 				i = JSON.parse(r.body.toString("utf8") || "{}");
 			} catch {}
@@ -462,83 +531,83 @@ var we = /* @__PURE__ */ new Set([
 			body: Buffer.from(JSON.stringify(v.body))
 		}
 	};
-}, tt = (e) => `--mode replace with --no-atomic against a ${e ? "RUNNING instance" : "live database"}: the target is empty between the delete and the load, and anything the application writes in that window can collide with a row from the bundle — or survive the import as a row the bundle never carried. Drop --no-atomic to run the whole load in one transaction (concurrent writers then wait instead of racing), or stop the traffic for the duration.`, Y = (e, t) => e.includes("--no-atomic") ? !1 : e.includes("--atomic") || t === "replace", nt = (e, t, n) => {
+}, gt = (e) => `--mode replace with --no-atomic against a ${e ? "RUNNING instance" : "live database"}: the target is empty between the delete and the load, and anything the application writes in that window can collide with a row from the bundle — or survive the import as a row the bundle never carried. Drop --no-atomic to run the whole load in one transaction (concurrent writers then wait instead of racing), or stop the traffic for the duration.`, Z = (e, t) => e.includes("--no-atomic") ? !1 : e.includes("--atomic") || t === "replace", _t = (e, t, n) => {
 	if (t !== "replace" || e.includes("--no-rollback")) return;
-	let r = B(e, "--rollback-dir");
+	let r = H(e, "--rollback-dir");
 	return r === void 0 ? o(n) : _(r);
-}, rt = (e, t, n) => {
-	let r = nt(e, t, n);
+}, vt = (e, t, n) => {
+	let r = _t(e, t, n);
 	return {
 		...r === void 0 ? {} : { rollbackDir: r },
 		recordInterruption: !0,
 		via: "direct"
 	};
-}, X = (e) => {
-	let t = B(e, "--timeout");
+}, Q = (e) => {
+	let t = H(e, "--timeout");
 	if (t === void 0) return {};
 	let r = Number(t);
 	if (!Number.isFinite(r) || r <= 0) throw new n(`--timeout expects a positive number of seconds, got '${t}'`);
 	return { timeoutMs: Math.round(r * 1e3) };
-}, it = async (e) => {
-	let t = B(e, "--target") === "api", n = B(e, "--bundle-key"), r = V(e);
-	if (!r && !(t && n)) return L.error("usage: voltro data export <outDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--timeout <seconds>] [--profile <name>] [--tenant <id>] [--tables a,b] [--exclude a,b] [--bundle-key <storage-key>] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot] [--dry-run]"), 1;
+}, yt = async (e) => {
+	let t = H(e, "--target") === "api", n = H(e, "--bundle-key"), r = U(e);
+	if (!r && !(t && n)) return B.error("usage: voltro data export <outDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--timeout <seconds>] [--profile <name>] [--tenant <id>] [--tables a,b] [--exclude a,b] [--bundle-key <storage-key>] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot] [--dry-run]"), 1;
 	if (t) {
-		let t = B(e, "--api-url");
-		if (!t) return L.error("--target api requires --api-url <url> (the running instance)"), 1;
-		let i = B(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
-		if (!i) return L.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
-		let a = B(e, "--tables"), o = B(e, "--exclude");
-		if (o !== void 0 && a !== void 0) return L.error("voltro data export: --exclude and --tables are two ways to say the same thing; use one."), 1;
+		let t = H(e, "--api-url");
+		if (!t) return B.error("--target api requires --api-url <url> (the running instance)"), 1;
+		let i = H(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
+		if (!i) return B.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
+		let a = H(e, "--tables"), o = H(e, "--exclude");
+		if (o !== void 0 && a !== void 0) return B.error("voltro data export: --exclude and --tables are two ways to say the same thing; use one."), 1;
 		let s = {
-			...B(e, "--profile") ? { profile: B(e, "--profile") } : {},
-			...B(e, "--tenant") ? { tenant: B(e, "--tenant") } : {},
+			...H(e, "--profile") ? { profile: H(e, "--profile") } : {},
+			...H(e, "--tenant") ? { tenant: H(e, "--tenant") } : {},
 			...a ? { tables: a.split(",").map((e) => e.trim()).filter(Boolean) } : {},
 			...o ? { exclude: o.split(",").map((e) => e.trim()).filter(Boolean) } : {},
-			...B(e, "--consistency") === "snapshot" ? { consistency: "snapshot" } : {},
-			...B(e, "--compression") ? { compression: B(e, "--compression") } : {},
+			...H(e, "--consistency") === "snapshot" ? { consistency: "snapshot" } : {},
+			...H(e, "--compression") ? { compression: H(e, "--compression") } : {},
 			...e.includes("--assets") ? { assets: !0 } : {},
 			...n ? { bundleKey: n } : {}
-		}, c = Ge(e), l;
+		}, c = ot(e), l;
 		try {
-			let n = await N(`${t.replace(/\/+$/, "")}/_voltro/admin/export`, JSON.stringify(s), {
+			let n = await F(`${t.replace(/\/+$/, "")}/_voltro/admin/export`, JSON.stringify(s), {
 				"content-type": "application/json",
 				authorization: `Bearer ${i}`
-			}, c.perRequest ?? X(e));
-			if (n.status < 200 || n.status >= 300) return L.error(`api export failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
+			}, c.perRequest ?? Q(e));
+			if (n.status < 200 || n.status >= 300) return B.error(`api export failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
 			l = JSON.parse(n.body.toString("utf8"));
 		} catch (e) {
-			if (e instanceof M) return L.error(`api export: the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. That is a client-side deadline. Nothing was written locally; re-run, or raise --timeout.`), 1;
-			if (e instanceof j) return L.error(`api export: ${P(e)}`), 1;
+			if (e instanceof P) return B.error(`api export: the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. That is a client-side deadline. Nothing was written locally; re-run, or raise --timeout.`), 1;
+			if (e instanceof N) return B.error(`api export: ${I(e)}`), 1;
 			throw e;
 		}
-		if (e.includes("--detach")) return L.info(`api export: started as ${l.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${J} --target api --api-url ${t}`), 0;
-		if (l.recorded === !1) return L.warn(`api export: started as ${l.runId}, but this instance could not record the run — so its outcome\n  cannot be read back. Run \`voltro db apply\` against it so the next one is watchable.`), 0;
+		if (e.includes("--detach")) return B.info(`api export: started as ${l.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${X} --target api --api-url ${t}`), 0;
+		if (l.recorded === !1) return B.warn(`api export: started as ${l.runId}, but this instance could not record the run — so its outcome\n  cannot be read back. Run \`voltro db apply\` against it so the next one is watchable.`), 0;
 		let p = await d({
-			read: () => Ke(t, i, l.runId),
+			read: () => st(t, i, l.runId),
 			onTick: (e) => {
-				L.info(f(e));
+				B.info(f(e));
 			},
 			intervalMs: c.pollMs,
 			...c.total === void 0 ? {} : { timeoutMs: c.total }
 		}), m = u(p);
-		if (m !== 0) return L.error(m === 1 ? `api export FAILED (${l.runId}): ${String(p?.failure ?? "no reason recorded")}` : `api export: no outcome visible for ${l.runId}. The run is not cancelled; it is simply not readable from here.`), m;
-		if (n) return L.info("api export complete (pushed to storage)", {
+		if (m !== 0) return B.error(m === 1 ? `api export FAILED (${l.runId}): ${String(p?.failure ?? "no reason recorded")}` : `api export: no outcome visible for ${l.runId}. The run is not cancelled; it is simply not readable from here.`), m;
+		if (n) return B.info("api export complete (pushed to storage)", {
 			via: t,
 			runId: l.runId,
 			bundleKey: n,
 			tables: p?.tablesWritten ?? 0,
 			rows: p?.rowsWritten ?? 0
 		}), 0;
-		let { resolve: h } = await import("node:path"), g = await qe({
+		let { resolve: h } = await import("node:path"), g = await ct({
 			apiUrl: t,
 			secret: i,
 			runId: l.runId,
-			log: L,
+			log: B,
 			...c.perRequest ? { perRequest: c.perRequest } : {}
 		});
-		return g === null ? 1 : (await xe((async function* () {
+		return g === null ? 1 : (await Me((async function* () {
 			yield g;
-		})(), h(process.cwd(), r)), L.info("api export complete (downloaded from the running instance)", {
+		})(), h(process.cwd(), r)), B.info("api export complete (downloaded from the running instance)", {
 			outDir: r,
 			runId: l.runId,
 			tables: p?.tablesWritten ?? 0,
@@ -546,11 +615,11 @@ var we = /* @__PURE__ */ new Set([
 			bytes: g.byteLength
 		}), 0);
 	}
-	if (!r) return L.error("a <outDir> is required for a direct export"), 1;
-	let i = B(e, "--profile"), a = i ? await p(i, { allowPath: !0 }) : {}, { store: o, snapshot: s, dialect: c } = await U(), l = e.includes("--assets") || a.assets === !0, m = l ? T({}) : void 0, h = B(e, "--compression") ?? a.compression, g = B(e, "--consistency") === "snapshot" ? "snapshot" : a.consistency ?? "live", _ = a.masking, v = a.subset, y = a.scope ?? Ye(e, s.tables.map((e) => e.name)), b = _ ? await Xe() : void 0, x = y.kind === "tenant" ? await Qe() : void 0, S = x ? { tenantTables: x } : {};
+	if (!r) return B.error("a <outDir> is required for a direct export"), 1;
+	let i = H(e, "--profile"), a = i ? await p(i, { allowPath: !0 }) : {}, { store: o, snapshot: s, dialect: c } = await G(), l = e.includes("--assets") || a.assets === !0, m = l ? E({}) : void 0, h = H(e, "--compression") ?? a.compression, g = H(e, "--consistency") === "snapshot" ? "snapshot" : a.consistency ?? "live", _ = a.masking, v = a.subset, y = a.scope ?? ut(e, s.tables.map((e) => e.name)), b = _ ? await dt() : void 0, x = y.kind === "tenant" ? await pt() : void 0, S = x ? { tenantTables: x } : {};
 	if (e.includes("--dry-run")) {
 		let e = y.kind === "tables" && y.tables ? [...y.tables] : s.tables.map((e) => e.name);
-		if (L.info("export DRY RUN — nothing was written", {
+		if (B.info("export DRY RUN — nothing was written", {
 			outDir: r,
 			tables: e.length,
 			scope: y.kind,
@@ -558,8 +627,8 @@ var we = /* @__PURE__ */ new Set([
 			compression: h ?? "zstd",
 			assets: l,
 			masking: _ ? "profile policy applies" : "none"
-		}), L.info(`would export: ${e.join(", ")}`), !_) return 0;
-		let t = await w.runPromise(pe({
+		}), B.info(`would export: ${e.join(", ")}`), !_) return 0;
+		let t = await T.runPromise(Se({
 			store: o,
 			snapshot: s,
 			masking: _,
@@ -569,12 +638,12 @@ var we = /* @__PURE__ */ new Set([
 				...S
 			}
 		}));
-		return $e(t), +(t.unclassified.length > 0);
+		return mt(t), +(t.unclassified.length > 0);
 	}
-	if (G(r)) {
+	if (q(r)) {
 		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: i, join: a } = await import("node:path"), u = await n.mkdtemp(a(t.tmpdir(), "voltro-export-"));
 		try {
-			let t = await w.runPromise(me({
+			let t = await T.runPromise(Te({
 				store: o,
 				snapshot: s,
 				dialect: c,
@@ -587,17 +656,17 @@ var we = /* @__PURE__ */ new Set([
 				...h ? { compression: h } : {},
 				..._ ? { masking: _ } : {},
 				...b ? { classification: b } : {},
-				onProgress: z
-			})), n = fe({
+				onProgress: V
+			})), n = xe({
 				dir: u,
-				...m ? { blobs: ye(m, () => W(o)) } : {}
-			}), a = He(e);
+				...m ? { blobs: Ae(m, () => K(o)) } : {}
+			}), a = rt(e);
 			if (a) {
-				let t = K(e);
-				if (!t) return L.error("--encrypt requires --passphrase <p> or VOLTRO_BUNDLE_KEY (a dedicated key, NOT the transfer secret)"), 1;
-				n = de(n, t);
+				let t = J(e);
+				if (!t) return B.error("--encrypt requires --passphrase <p> or VOLTRO_BUNDLE_KEY (a dedicated key, NOT the transfer secret)"), 1;
+				n = be(n, t);
 			}
-			return await Ue(n, i(process.cwd(), r)), L.info("export complete (single file)", {
+			return await it(n, i(process.cwd(), r)), B.info("export complete (single file)", {
 				file: r,
 				encrypted: a,
 				assets: l,
@@ -611,7 +680,7 @@ var we = /* @__PURE__ */ new Set([
 			});
 		}
 	}
-	let C = await w.runPromise(me({
+	let C = await T.runPromise(Te({
 		store: o,
 		snapshot: s,
 		dialect: c,
@@ -624,10 +693,10 @@ var we = /* @__PURE__ */ new Set([
 		...h ? { compression: h } : {},
 		..._ ? { masking: _ } : {},
 		...b ? { classification: b } : {},
-		...m ? { assets: _e(m, () => W(o)) } : {},
-		onProgress: z
+		...m ? { assets: Oe(m, () => K(o)) } : {},
+		onProgress: V
 	}));
-	return L.info("export complete", {
+	return B.info("export complete", {
 		outDir: r,
 		tables: C.tables.length,
 		rows: C.tables.reduce((e, t) => e + t.rowCount, 0),
@@ -635,13 +704,13 @@ var we = /* @__PURE__ */ new Set([
 		compression: C.compression,
 		...C.masking ? { maskedColumns: C.masking.transformed.length } : {}
 	}), 0;
-}, Z = () => "dry run checked: schema fit, cross-dialect portability, mode legality, the table selection. It did NOT read per-table checksums (those stream during the load) and cannot see conflicts that depend on the target's current rows.", at = (e) => {
-	let t = B(e, "--tables");
+}, bt = () => "dry run checked: schema fit, cross-dialect portability, mode legality, the table selection. It did NOT read per-table checksums (those stream during the load) and cannot see conflicts that depend on the target's current rows.", xt = (e) => {
+	let t = H(e, "--tables");
 	return {
 		...t ? { tables: t.split(",").map((e) => e.trim()).filter(Boolean) } : {},
 		...e.includes("--dry-run") ? { dryRun: !0 } : {}
 	};
-}, ot = (e) => ({
+}, St = (e) => ({
 	tables: e.tablesWritten,
 	rows: e.rowsWritten,
 	carried: e.manifest.tables.reduce((e, t) => e + t.rowCount, 0),
@@ -649,28 +718,28 @@ var we = /* @__PURE__ */ new Set([
 		skippedTables: e.tablesSkipped,
 		skippedRows: e.rowsSkipped
 	} : {}
-}), st = (e, t) => {
+}), Ct = (e, t) => {
 	if (e.includes("--dry-run")) {
-		L.info("import DRY RUN — nothing was written", t), L.info(Z());
+		B.info("import DRY RUN — nothing was written", t), B.info(bt());
 		return;
 	}
 	if (t.rows === 0 && typeof t.skippedRows == "number" && t.skippedRows !== 0) {
-		L.info("import complete — 0 rows written, every table was already applied by an earlier run of this bundle directory", t);
+		B.info("import complete — 0 rows written, every table was already applied by an earlier run of this bundle directory", t);
 		return;
 	}
-	L.info("import complete", t);
-}, ct = Symbol("refused"), Q = (e) => {
-	let t = se(e) ?? e;
+	B.info("import complete", t);
+}, wt = Symbol("refused"), Tt = (e) => {
+	let t = he(e) ?? e;
 	if (t?._tag !== "RowsRefusedError" || !Array.isArray(t.rows)) return !1;
 	let n = t.rows, r = n.filter((e) => !e.derived), i = Number(t.totalCount ?? n.length), a = Number(t.primaryCount ?? r.length);
-	L.error(`import refused ${i} row(s), of which ${a} are the actual failures — the rest could not land because a row they reference did not.`);
+	B.error(`import refused ${i} row(s), of which ${a} are the actual failures — the rest could not land because a row they reference did not.`);
 	let o = Array.isArray(t.byTable) ? t.byTable : [];
-	o.length > 1 && L.error(`  by table: ${o.map((e) => `${e.table} ${e.refused}`).join(", ")}`);
-	for (let e of r) L.error(`  ${e.table} ${e.id}  ${e.reason}`);
-	n.length < i && L.error(`  (the list above is capped at ${n.length} of ${i} — the counts by table are complete)`);
+	o.length > 1 && B.error(`  by table: ${o.map((e) => `${e.table} ${e.refused}`).join(", ")}`);
+	for (let e of r) B.error(`  ${e.table} ${e.id}  ${e.reason}`);
+	n.length < i && B.error(`  (the list above is capped at ${n.length} of ${i} — the counts by table are complete)`);
 	let s = i - a;
-	return s > 0 && L.error(`  … and ${s} row(s) behind them. Fix the ${a} above and re-run; they resolve with their parents.`), !0;
-}, lt = (e) => {
+	return s > 0 && B.error(`  … and ${s} row(s) behind them. Fix the ${a} above and re-run; they resolve with their parents.`), !0;
+}, Et = (e) => {
 	let t = typeof e == "string" ? e : e.toString("utf8"), n = t;
 	try {
 		let e = JSON.parse(t), r = e.error ?? e.message;
@@ -710,22 +779,22 @@ var we = /* @__PURE__ */ new Set([
 			return;
 		}
 	}
-}, ut = async (e) => {
-	let t = B(e, "--target") === "api", n = B(e, "--bundle-key"), r = V(e);
-	if (!r && !(t && n)) return L.error("usage: voltro data import <bundleDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--timeout <seconds>] [--bundle-key <storage-key>] [--tables a,b] [--mode upsert|append|replace] [--on-conflict skip|fail] [--atomic] [--assets] [--no-verify] [--force] [--allow-live] [--dry-run]  (--force: import despite schema drift AND cross-dialect warnings; --dry-run: report what would move, write nothing)"), 1;
-	let i = B(e, "--mode") ?? "upsert", o = B(e, "--on-conflict") ?? "skip";
+}, Dt = async (e) => {
+	let t = H(e, "--target") === "api", n = H(e, "--bundle-key"), r = U(e);
+	if (!r && !(t && n)) return B.error("usage: voltro data import <bundleDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--timeout <seconds>] [--bundle-key <storage-key>] [--tables a,b] [--mode upsert|append|replace] [--on-conflict skip|fail] [--atomic] [--assets] [--no-verify] [--force] [--allow-live] [--dry-run]  (--force: import despite schema drift AND cross-dialect warnings; --dry-run: report what would move, write nothing)"), 1;
+	let i = H(e, "--mode") ?? "upsert", o = H(e, "--on-conflict") ?? "skip";
 	if (t) {
-		let t = B(e, "--api-url");
-		if (!t) return L.error("--target api requires --api-url <url> (the running instance)"), 1;
-		let a = B(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
-		if (!a) return L.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
-		let s = B(e, "--tables"), c = B(e, "--rollback-key");
-		i === "replace" && c === void 0 && L.warn("api replace: no rollback capture — this run empties the target first and nothing was asked to be kept.\n  Pass --rollback-key <storage-key> and the INSTANCE stores the target's current rows in its own\n  object storage before deleting them, which is the one place that survives the pod going away.");
+		let t = H(e, "--api-url");
+		if (!t) return B.error("--target api requires --api-url <url> (the running instance)"), 1;
+		let a = H(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
+		if (!a) return B.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET) matching the instance secret"), 1;
+		let s = H(e, "--tables"), c = H(e, "--rollback-key");
+		i === "replace" && c === void 0 && B.warn("api replace: no rollback capture — this run empties the target first and nothing was asked to be kept.\n  Pass --rollback-key <storage-key> and the INSTANCE stores the target's current rows in its own\n  object storage before deleting them, which is the one place that survives the pod going away.");
 		let l = {
 			authorization: `Bearer ${a}`,
 			"x-import-mode": i,
 			"x-import-on-conflict": o,
-			...Y(e, i) ? { "x-import-atomic": "1" } : {},
+			...Z(e, i) ? { "x-import-atomic": "1" } : {},
 			...e.includes("--no-atomic") ? { "x-import-atomic": "0" } : {},
 			...c === void 0 ? {} : { "x-import-rollback-key": c },
 			...e.includes("--force") ? { "x-import-force": "1" } : {},
@@ -733,66 +802,66 @@ var we = /* @__PURE__ */ new Set([
 			...s ? { "x-import-tables": s } : {}
 		}, { resolve: p } = await import("node:path"), m;
 		if (n) l["content-type"] = "application/json", m = JSON.stringify({ bundleKey: n });
-		else if (G(r)) {
-			let t = q(p(process.cwd(), r)), n = K(e);
-			n && (t = D(t, n)), l["content-type"] = "application/octet-stream", m = t;
-		} else await (await import("node:fs/promises")).access(p(process.cwd(), r, "assets", "index.ndjson")).then(() => !0, () => !1) && L.warn("this directory bundle has assets; --target api uploads DATA ONLY. Pack a single-file `.vbundle` (voltro data export <name>.vbundle --assets) to transfer assets over the API."), l["content-type"] = "application/octet-stream", m = fe({ dir: p(process.cwd(), r) });
+		else if (q(r)) {
+			let t = Y(p(process.cwd(), r)), n = J(e);
+			n && (t = A(t, n)), l["content-type"] = "application/octet-stream", m = t;
+		} else await (await import("node:fs/promises")).access(p(process.cwd(), r, "assets", "index.ndjson")).then(() => !0, () => !1) && B.warn("this directory bundle has assets; --target api uploads DATA ONLY. Pack a single-file `.vbundle` (voltro data export <name>.vbundle --assets) to transfer assets over the API."), l["content-type"] = "application/octet-stream", m = xe({ dir: p(process.cwd(), r) });
 		if (i === "replace") {
-			let i = await We(r, n);
+			let i = await at(r, n);
 			{
-				let r = i === null ? { bundleKey: n } : { tables: i }, a = await N(`${t.replace(/\/+$/, "")}/_voltro/admin/import`, JSON.stringify(r), {
+				let r = i === null ? { bundleKey: n } : { tables: i }, a = await F(`${t.replace(/\/+$/, "")}/_voltro/admin/import`, JSON.stringify(r), {
 					...l,
 					"content-type": "application/json",
 					"x-import-preflight": "1"
-				}, X(e)).catch(() => null), o = a !== null && a.status === 200 ? JSON.parse(a.body.toString("utf8")) : null;
-				o === null ? L.warn("api replace: the instance did not answer the preflight (an older build does not have it). The run still works; the decision will only be visible in the pod log.") : o.staged === !0 ? L.info(`api replace: the instance WILL stage — ${o.stagedTables ?? 0} table(s) load into copies and the\n  target keeps its rows until one short swap at the end. Interrupting the load leaves the target intact.`) : L.warn(`api replace: the instance will NOT stage — it empties the target first and refills it, so an
+				}, Q(e)).catch(() => null), o = a !== null && a.status === 200 ? JSON.parse(a.body.toString("utf8")) : null;
+				o === null ? B.warn("api replace: the instance did not answer the preflight (an older build does not have it). The run still works; the decision will only be visible in the pod log.") : o.staged === !0 ? B.info(`api replace: the instance WILL stage — ${o.stagedTables ?? 0} table(s) load into copies and the\n  target keeps its rows until one short swap at the end. Interrupting the load leaves the target intact.`) : B.warn(`api replace: the instance will NOT stage — it empties the target first and refills it, so an
   interrupted run leaves the target empty.\n  Reason: ${o.reason ?? "not stated"}`);
 			}
 		}
-		i === "replace" && !Y(e, i) && L.warn(tt(!0));
-		let h = `${t.replace(/\/+$/, "")}/_voltro/admin/import`, g = Ge(e), _;
+		i === "replace" && !Z(e, i) && B.warn(gt(!0));
+		let h = `${t.replace(/\/+$/, "")}/_voltro/admin/import`, g = ot(e), _;
 		try {
-			let t = typeof m == "string" ? null : await et({
+			let t = typeof m == "string" ? null : await ht({
 				stream: m,
 				url: h,
 				headers: l,
 				bundleDir: r,
 				args: e,
-				log: L
-			}), n = t === null ? await N(h, m, l, g.perRequest ?? X(e)) : t.kind === "sent" ? t.res : await N(h, t.body, l, g.perRequest ?? X(e));
-			if (n.status < 200 || n.status >= 300) return Q(lt(n.body)) || L.error(`api import failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
+				log: B
+			}), n = t === null ? await F(h, m, l, g.perRequest ?? Q(e)) : t.kind === "sent" ? t.res : await F(h, t.body, l, g.perRequest ?? Q(e));
+			if (n.status < 200 || n.status >= 300) return Tt(Et(n.body)) || B.error(`api import failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
 			_ = JSON.parse(n.body.toString("utf8"));
 		} catch (e) {
-			if (e instanceof M) return L.error(`api import: ${Te(e, i)}`), 1;
-			if (e instanceof j) return L.error(`api import: ${P(e)}`), 1;
+			if (e instanceof P) return B.error(`api import: ${Ie(e, i)}`), 1;
+			if (e instanceof N) return B.error(`api import: ${I(e)}`), 1;
 			throw e;
 		}
-		let v = await N(`${t.replace(/\/+$/, "")}/_voltro/admin/import/start`, JSON.stringify(_.bundleKey === void 0 ? { uploadId: _.uploadId } : { bundleKey: _.bundleKey }), {
+		let v = await F(`${t.replace(/\/+$/, "")}/_voltro/admin/import/start`, JSON.stringify(_.bundleKey === void 0 ? { uploadId: _.uploadId } : { bundleKey: _.bundleKey }), {
 			...l,
 			"content-type": "application/json"
-		}, g.perRequest ?? X(e)).catch((e) => {
-			if (e instanceof j) return L.error(`api import: ${P(e)}`), null;
+		}, g.perRequest ?? Q(e)).catch((e) => {
+			if (e instanceof N) return B.error(`api import: ${I(e)}`), null;
 			throw e;
 		});
 		if (v === null) return 1;
-		if (v.status < 200 || v.status >= 300) return Q(lt(v.body)) || L.error(`api import refused: HTTP ${v.status} — ${v.body.toString("utf8")}`), 1;
+		if (v.status < 200 || v.status >= 300) return Tt(Et(v.body)) || B.error(`api import refused: HTTP ${v.status} — ${v.body.toString("utf8")}`), 1;
 		let y = JSON.parse(v.body.toString("utf8"));
-		if (y.alreadyStarted === !0 && L.info(`api import: this bundle is already being imported as ${y.runId} — watching that run instead of starting a second one`), e.includes("--detach")) return L.info(`api import: started as ${y.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${J} --target api --api-url ${t}`), 0;
-		if (y.recorded === !1) return L.warn(`api import: started as ${y.runId}, but this instance could not record the run — so its outcome\n  cannot be read back. Run \`voltro db apply\` against it so the next import is watchable.`), 0;
+		if (y.alreadyStarted === !0 && B.info(`api import: this bundle is already being imported as ${y.runId} — watching that run instead of starting a second one`), e.includes("--detach")) return B.info(`api import: started as ${y.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${X} --target api --api-url ${t}`), 0;
+		if (y.recorded === !1) return B.warn(`api import: started as ${y.runId}, but this instance could not record the run — so its outcome\n  cannot be read back. Run \`voltro db apply\` against it so the next import is watchable.`), 0;
 		let b = await d({
-			read: () => Ke(t, a, y.runId),
+			read: () => st(t, a, y.runId),
 			onTick: (e) => {
-				L.info(f(e));
+				B.info(f(e));
 			},
 			intervalMs: g.pollMs,
 			...g.total === void 0 ? {} : { timeoutMs: g.total }
 		}), x = u(b);
-		return x === 2 ? (L.warn(b === null ? `api import: started as ${y.runId}, but its record could not be READ back from this instance.\n  That is a channel problem, not a slow import — an older instance without the history route, a
+		return x === 2 ? (B.warn(b === null ? `api import: started as ${y.runId}, but its record could not be READ back from this instance.\n  That is a channel problem, not a slow import — an older instance without the history route, a
   proxy dropping the GET, or a target with no history table. The run itself is unaffected and
-  is NOT cancelled; its outcome is simply not visible from here.` : `api import: still running after the time allowed. The run is NOT cancelled — it is decoupled from\n  this client by design. Watch it with:  voltro data ${J} --target api --api-url ${t}`), 2) : x === 1 ? (L.error(`api import FAILED (${y.runId}): ${String(b?.failure ?? "no reason recorded")}`), 1) : e.includes("--dry-run") ? (L.info("api import DRY RUN — nothing was written", {
+  is NOT cancelled; its outcome is simply not visible from here.` : `api import: still running after the time allowed. The run is NOT cancelled — it is decoupled from\n  this client by design. Watch it with:  voltro data ${X} --target api --api-url ${t}`), 2) : x === 1 ? (B.error(`api import FAILED (${y.runId}): ${String(b?.failure ?? "no reason recorded")}`), 1) : e.includes("--dry-run") ? (B.info("api import DRY RUN — nothing was written", {
 			via: t,
 			runId: y.runId
-		}), L.info(Z()), 0) : (L.info("api import complete (imported by the running instance)", {
+		}), B.info(bt()), 0) : (B.info("api import complete (imported by the running instance)", {
 			via: t,
 			runId: y.runId,
 			tables: b?.tablesWritten ?? 0,
@@ -800,37 +869,37 @@ var we = /* @__PURE__ */ new Set([
 			...b?.staged !== null && b?.staged !== void 0 ? { staged: b.staged } : {}
 		}), 0);
 	}
-	if (!r) return L.error("a <bundleDir> is required for a direct import"), 1;
-	if (!await Le(e)) return 1;
-	i === "replace" && e.includes("--allow-live") && !Y(e, i) && L.warn(tt(!1));
-	let { store: s, snapshot: c } = await U();
-	c.tables.some((e) => e.name === y) || L.warn(`this target has no \`${y}\` table, so this import will not be recorded.\n  The import itself is unaffected. \`voltro db apply\` creates it.`);
-	let l = e.includes("--force"), p = (e) => L.warn(e), m = e.includes("--assets") ? T({}) : void 0, h = H() === "postgres" ? (await import("@voltro/sql-postgres")).makePgCopySession(a()) : void 0;
-	if (G(r)) {
+	if (!r) return B.error("a <bundleDir> is required for a direct import"), 1;
+	if (!await Qe(e)) return 1;
+	i === "replace" && e.includes("--allow-live") && !Z(e, i) && B.warn(gt(!1));
+	let { store: s, snapshot: c } = await G();
+	c.tables.some((e) => e.name === y) || B.warn(`this target has no \`${y}\` table, so this import will not be recorded.\n  The import itself is unaffected. \`voltro db apply\` creates it.`);
+	let l = e.includes("--force"), p = (e) => B.warn(e), m = e.includes("--assets") ? E({}) : void 0, h = W() === "postgres" ? (await import("@voltro/sql-postgres")).makePgCopySession(a()) : void 0;
+	if (q(r)) {
 		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: a, join: u } = await import("node:path"), d = await n.mkdtemp(u(t.tmpdir(), "voltro-import-"));
 		try {
-			let t = q(a(process.cwd(), r)), n = K(e);
-			return n && (t = D(t, n)), await be(t, {
+			let t = Y(a(process.cwd(), r)), n = J(e);
+			return n && (t = A(t, n)), await je(t, {
 				dir: d,
-				blobs: ve(m ?? T({}))
-			}), st(e, {
+				blobs: ke(m ?? E({}))
+			}), Ct(e, {
 				file: r,
-				...ot(await w.runPromise(he({
+				...St(await T.runPromise(Ee({
 					store: s,
 					bundleDir: d,
 					mode: i,
 					onConflict: o,
-					atomic: Y(e, i),
-					...rt(e, i, r),
+					atomic: Z(e, i),
+					...vt(e, i, r),
 					verify: !e.includes("--no-verify"),
-					targetDialect: H(),
+					targetDialect: W(),
 					allowIncompatible: l,
 					targetSnapshot: c,
 					force: l,
 					onWarn: p,
-					onProgress: z,
+					onProgress: V,
 					assetsAlreadyRestored: !0,
-					...at(e),
+					...xt(e),
 					...h ? { copyLoader: h } : {}
 				})))
 			}), 0;
@@ -841,33 +910,33 @@ var we = /* @__PURE__ */ new Set([
 			});
 		}
 	}
-	let g = await w.runPromise(he({
-		...rt(e, i, r),
+	let g = await T.runPromise(Ee({
+		...vt(e, i, r),
 		store: s,
 		bundleDir: r,
 		mode: i,
 		onConflict: o,
-		atomic: Y(e, i),
+		atomic: Z(e, i),
 		verify: !e.includes("--no-verify"),
-		targetDialect: H(),
+		targetDialect: W(),
 		allowIncompatible: l,
 		targetSnapshot: c,
 		force: l,
 		onWarn: p,
-		onProgress: z,
-		...at(e),
-		...m ? { assets: ge(m) } : {},
+		onProgress: V,
+		...xt(e),
+		...m ? { assets: De(m) } : {},
 		...h ? { copyLoader: h } : {}
 	})).catch((e) => {
-		if (Q(e)) return ct;
+		if (Tt(e)) return wt;
 		throw e;
 	}).finally(() => h?.close());
-	return typeof g == "symbol" ? 1 : (st(e, {
+	return typeof g == "symbol" ? 1 : (Ct(e, {
 		bundleDir: r,
-		...ot(g),
+		...St(g),
 		assets: g.manifest.assets.count
 	}), 0);
-}, dt = () => {
+}, Ot = () => {
 	let e = a();
 	return {
 		...e.url ? { url: e.url } : {},
@@ -877,75 +946,155 @@ var we = /* @__PURE__ */ new Set([
 		...e.password ? { password: e.password } : {},
 		...e.database ? { database: e.database } : {}
 	};
-}, ft = async (e) => {
-	let t = V(e);
-	if (!t) return L.error("usage: voltro data backup <outDir>  (native pg_dump/mysqldump/… + consistent artifact)"), 1;
-	let n = H(), { mkdir: r, writeFile: i } = await import("node:fs/promises"), { join: a } = await import("node:path");
-	await r(t, { recursive: !0 });
-	let o = a(t, E(n));
-	await w.runPromise(A(le(n, dt(), o)));
-	let s = Ae({
+}, kt = async (e) => {
+	let t = U(e);
+	if (!t) return B.error("usage: voltro data backup <outDir> [--assets]  (native pg_dump/mariadb-dump/… + consistent artifact)"), 1;
+	let n = W(), r = e.includes("--assets"), { mkdir: i, writeFile: a } = await import("node:fs/promises"), { join: o } = await import("node:path"), s = r ? E({}) : void 0;
+	if (r && !s) return B.error("--assets: this app has no storage provider configured, so there are no blobs to capture.\n  Configure one in app.config.ts, or drop the flag to take the rows-only dump."), 1;
+	await i(t, { recursive: !0 });
+	let c = o(t, k(n)), l = await At(), u = l ? await We(l.store, {
+		direction: "backup",
+		dialect: n,
+		artifact: c,
+		assets: r
+	}) : void 0, d = await Ke(M(_e(n, Ot(), c)));
+	if (d !== void 0) return l && u && await R(l.store, u, { failure: d }), B.error(`native backup failed: ${d}`), 1;
+	let f = 0, p = 0;
+	if (s && l) {
+		let e = o(t, D);
+		await i(e, { recursive: !0 });
+		let n = o(t, O), r = l.store, a = await T.runPromiseExit(ve({
+			source: Oe(s, () => K(r)),
+			assetsDir: e,
+			progress: {
+				done: () => !1,
+				mark: (e, t) => T.tryPromise({
+					try: async () => {
+						await (await import("node:fs/promises")).appendFile(n, `${JSON.stringify(t)}\n`);
+					},
+					catch: (e) => new me({
+						reason: `asset index append failed: ${String(e)}`,
+						path: n
+					})
+				})
+			}
+		}));
+		if (a._tag === "Failure") {
+			let e = w.pretty(a.cause);
+			return u && await R(l.store, u, { failure: `assets: ${e}` }), B.error(`the rows were dumped to ${c}, but the asset capture failed: ${e}\n  This directory holds a ROWS-ONLY backup. Re-run with --assets once the storage
+  backend is reachable, or restore without --assets and accept the dangling refs.`), 1;
+		}
+		f = a.value.count, p = a.value.totalBytes;
+	}
+	let m = Ve({
 		dialect: n,
-		schemaFingerprint: await R(n),
-		voltroVersion: await Fe(),
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		schemaFingerprint: await Xe(n),
+		voltroVersion: await Ye(),
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		assets: r ? {
+			count: f,
+			totalBytes: p
+		} : null
 	});
-	return await i(a(t, F), `${JSON.stringify(s, null, 2)}\n`, "utf8"), L.info("native backup complete", {
+	return await a(o(t, L), `${JSON.stringify(m, null, 2)}\n`, "utf8"), l && u && await R(l.store, u, { assets: f }), B.info("native backup complete", {
 		dialect: n,
-		artifact: o,
-		stamp: F,
-		schemaFingerprint: s.schemaFingerprint ?? "<none>",
-		assets: "NOT included — use `voltro data export --assets` for rows + blobs"
+		artifact: c,
+		stamp: L,
+		schemaFingerprint: m.schemaFingerprint ?? "<none>",
+		assets: r ? `${f} blob(s), ${p} byte(s) under ${D}/` : "NOT included — re-run with --assets, or use `voltro data export --assets`",
+		recorded: u?.recorded === !0 ? "voltro data transfers" : "NOT recorded (this target keeps no transfer history)"
 	}), 0;
-}, pt = async (e, t) => {
-	let n = H(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(e, E(n)), o = Ne({
-		flagUrl: B(t, "--drill-url"),
+}, At = async () => {
+	try {
+		let e = await r(process.cwd());
+		return e ? { store: await i(e, void 0) } : void 0;
+	} catch {
+		return;
+	}
+}, jt = async (e, t) => {
+	let n = W(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(e, k(n)), o = qe({
+		flagUrl: H(t, "--drill-url"),
 		envUrl: process.env.DRILL_DB_URL,
-		liveKeys: Ve()
+		liveKeys: nt()
 	});
-	if (!o.ok) return L.error(`restore --drill: ${o.error}`), 1;
-	let s = await i(r(e, F), "utf8").then(je, () => null);
-	if (s && s.dialect !== n) return L.error(`restore --drill: backup is a ${s.dialect} dump but DB_DIALECT is ${n} — cross-dialect restore is never valid.`), 1;
-	L.info("restore drill: restoring into throwaway DB", {
+	if (!o.ok) return B.error(`restore --drill: ${o.error}`), 1;
+	let s = await i(r(e, L), "utf8").then(He, () => null);
+	if (s && s.dialect !== n) return B.error(`restore --drill: backup is a ${s.dialect} dump but DB_DIALECT is ${n} — cross-dialect restore is never valid.`), 1;
+	B.info("restore drill: restoring into throwaway DB", {
 		dialect: n,
-		target: I(o.url)
-	}), await w.runPromise(A(k(n, { url: o.url }, a)));
+		target: z(o.url)
+	}), await T.runPromise(M(we(n, { url: o.url }, a)));
 	let c = null, l = 0;
 	try {
-		let e = await ze(n, { url: o.url });
-		c = re(e), l = e.tables.length;
+		let e = await et(n, { url: o.url });
+		c = ue(e), l = e.tables.length;
 	} catch (e) {
-		return L.error(`restore --drill: could not introspect the restored DB — ${String(e)}`), 1;
+		return B.error(`restore --drill: could not introspect the restored DB — ${String(e)}`), 1;
 	}
-	let u = Pe({
+	let u = Je({
 		stampFingerprint: s?.schemaFingerprint ?? null,
 		restoredFingerprint: c,
 		restoredTableCount: l
 	});
-	for (let e of u.lines) u.pass ? L.info(`restore drill: ${e}`) : L.error(`restore drill: ${e}`);
+	for (let e of u.lines) u.pass ? B.info(`restore drill: ${e}`) : B.error(`restore drill: ${e}`);
 	return +!u.pass;
-}, mt = async (e) => {
-	let t = V(e);
-	if (!t) return L.error("usage: voltro data restore <backupDir> [--allow-live] [--api-url <url>] [--force] [--drill [--drill-url <url>]]  (native pg_restore/mysql/…)"), 1;
-	if (e.includes("--drill")) return pt(t, e);
-	if (!await Le(e)) return 1;
-	let n = H(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(t, E(n)), o = Me({
-		stamp: await i(r(t, F), "utf8").then(je, () => null),
+}, Mt = async (e) => {
+	let t = U(e);
+	if (!t) return B.error("usage: voltro data restore <backupDir> [--assets] [--allow-live] [--api-url <url>] [--force] [--drill [--drill-url <url>]]  (native pg_restore/mariadb/…)"), 1;
+	if (e.includes("--drill")) return jt(t, e);
+	if (!await Qe(e)) return 1;
+	let n = W(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(t, k(n)), o = e.includes("--assets"), s = Ue({
+		stamp: await i(r(t, L), "utf8").then(He, () => null),
 		currentDialect: n,
-		currentFingerprint: await R(n)
+		currentFingerprint: await Xe(n)
 	});
-	for (let e of o.info) L.info(`backup stamp: ${e}`);
-	if (o.warn && L.warn(o.warn), o.refuse) {
-		if (!e.includes("--force")) return L.error(`restore refused: ${o.refuse} (pass --force to override)`), 1;
-		L.warn(`restore proceeding despite: ${o.refuse} (--force)`);
+	for (let e of s.info) B.info(`backup stamp: ${e}`);
+	if (s.warn && B.warn(s.warn), s.refuse) {
+		if (!e.includes("--force")) return B.error(`restore refused: ${s.refuse} (pass --force to override)`), 1;
+		B.warn(`restore proceeding despite: ${s.refuse} (--force)`);
+	}
+	let c = r(t, O), l = await i(c, "utf8").then(() => !0, () => !1);
+	if (o && !l) return B.error(`--assets: this backup carries no assets — there is no ${O} in ${t}.\n  It was taken without --assets, so its rows will reference blobs this restore cannot
+  put back. Restore from a backup taken with --assets, or drop the flag to accept that.`), 1;
+	!o && l && B.warn("this backup CARRIES assets and --assets was not passed: the rows will be restored and the blobs will not. Pass --assets to restore both.");
+	let u = o ? E({}) : void 0;
+	if (o && !u) return B.error("--assets: this app has no storage provider configured, so there is nowhere to put the blobs."), 1;
+	let d = await At(), f = d ? await Ge(d.store, { artifact: a }) : void 0;
+	if (d && f === void 0) return B.error(`refusing to restore: could not write the in-progress marker.
+  It is one row in \`${b}\`, written before the first destructive\n  statement so a killed restore refuses the next boot rather than serving a half-loaded
+  database. Run \`voltro db apply\` so the table exists, then retry.`), 1;
+	let p = d ? await We(d.store, {
+		direction: "restore",
+		dialect: n,
+		artifact: a,
+		assets: o
+	}) : void 0, m = await Ke(M(we(n, Ot(), a)));
+	if (m !== void 0) return d && p && await R(d.store, p, { failure: m }), B.error(`native restore failed: ${m}\n  This database is now in an unknown state and the next boot will REFUSE, by design.
+  Re-run the restore to completion, or clear the marker deliberately with
+  \`voltro data clear-replace-marker --yes\` once you have decided the state is correct.`), 1;
+	let h = 0;
+	if (u) {
+		let e = await T.runPromiseExit(Ce({
+			sink: De(u),
+			assetsDir: r(t, D),
+			indexPath: c
+		}));
+		if (e._tag === "Failure") {
+			let t = w.pretty(e.cause);
+			return d && p && await R(d.store, p, { failure: `assets: ${t}` }), B.error(`the rows were restored, but the asset restore failed: ${t}\n  The in-progress marker is still set and the next boot will refuse. Re-run
+  \`voltro data restore <dir> --assets\` once storage is reachable.`), 1;
+		}
+		h = e.value;
 	}
-	return await w.runPromise(A(k(n, dt(), a))), L.info("native restore complete", {
+	return f && await f(), d && p && await R(d.store, p, { assets: h }), B.info("native restore complete", {
 		dialect: n,
-		artifact: a
+		artifact: a,
+		assets: o ? `${h} blob(s) restored` : "not restored (no --assets)",
+		recorded: p?.recorded === !0 ? "voltro data transfers" : "NOT recorded (this target keeps no transfer history)"
 	}), 0;
-}, ht = async (e) => {
-	let t = V(e);
-	if (!t) return L.error("usage: voltro data inspect <file.vbundle|dir> [--json] [--passphrase <p>]"), 1;
+}, Nt = async (e) => {
+	let t = U(e);
+	if (!t) return B.error("usage: voltro data inspect <file.vbundle|dir> [--json] [--passphrase <p>]"), 1;
 	let { resolve: n, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = n(process.cwd(), t);
 	if ((await i.stat(a).catch(() => void 0))?.isDirectory()) {
 		let n = r(a, "manifest.json"), o = r(a, "README.md");
@@ -954,24 +1103,24 @@ var we = /* @__PURE__ */ new Set([
 			if (e !== void 0) return console.log(e), 0;
 		}
 		let s = await i.readFile(n, "utf8").catch(() => void 0);
-		return s === void 0 ? (L.error(`'${t}' is a directory but holds no manifest.json — is it an unpacked bundle? (a bundle exported with --target api is always unpacked into a directory, even when the path ends in .vbundle)`), 1) : (console.log(s), 0);
+		return s === void 0 ? (B.error(`'${t}' is a directory but holds no manifest.json — is it an unpacked bundle? (a bundle exported with --target api is always unpacked into a directory, even when the path ends in .vbundle)`), 1) : (console.log(s), 0);
 	}
-	let o = K(e), s = () => {
-		let e = q(a);
-		return o ? D(e, o) : e;
+	let o = J(e), s = () => {
+		let e = Y(a);
+		return o ? A(e, o) : e;
 	};
 	if (e.includes("--json")) {
-		let e = (await O(s(), ["manifest.json"])).get("manifest.json");
-		return e ? (console.log(e.toString("utf8")), 0) : (L.error("no manifest.json found in the bundle"), 1);
+		let e = (await j(s(), ["manifest.json"])).get("manifest.json");
+		return e ? (console.log(e.toString("utf8")), 0) : (B.error("no manifest.json found in the bundle"), 1);
 	}
-	let c = (await O(s(), ["README.md"])).get("README.md");
+	let c = (await j(s(), ["README.md"])).get("README.md");
 	if (c) return console.log(c.toString("utf8")), 0;
-	let l = (await O(s(), ["manifest.json"])).get("manifest.json");
-	return l ? (console.log(l.toString("utf8")), 0) : (L.error("bundle has no README.md or manifest.json"), 1);
-}, gt = async (e) => {
-	let { REPLACE_IN_PROGRESS_TABLE: t } = await import("@voltro/database"), { interruptedReplaceAtBoot: n } = await import("./interruptedReplace-DNJ7MKph.js"), { store: r } = await U(), i = await n(r);
-	if (i === void 0) return L.info("no interrupted replace is recorded — nothing to clear"), 0;
-	if (!e.includes("--yes")) return L.error(`${i}\n\n  Re-run with --yes to clear it.`), 1;
+	let l = (await j(s(), ["manifest.json"])).get("manifest.json");
+	return l ? (console.log(l.toString("utf8")), 0) : (B.error("bundle has no README.md or manifest.json"), 1);
+}, Pt = async (e) => {
+	let { REPLACE_IN_PROGRESS_TABLE: t } = await import("@voltro/database"), { interruptedReplaceAtBoot: n } = await import("./interruptedReplace-CvmiAM9K.js"), { store: r } = await G(), i = await n(r);
+	if (i === void 0) return B.info("no interrupted replace is recorded — nothing to clear"), 0;
+	if (!e.includes("--yes")) return B.error(`${i}\n\n  Re-run with --yes to clear it.`), 1;
 	let a = await r.query({
 		table: t,
 		predicate: void 0,
@@ -981,30 +1130,30 @@ var we = /* @__PURE__ */ new Set([
 		projection: void 0
 	});
 	for (let e of a) await r.delete(t, String(e.id));
-	return L.info(`cleared ${a.length} interrupted-replace marker(s) — the next boot will start`), 0;
-}, _t = async (e) => {
-	let { STAGING_PREFIX: t, dropStagingSql: n, execStatements: r } = await import("@voltro/data-transfer"), { store: i } = await U(), a = H();
-	if (a !== "postgres" && a !== "mysql" && a !== "mariadb" && a !== "sqlite" && a !== "mssql") return L.error(`this store has no staging tables to clear (dialect: ${a})`), 1;
+	return B.info(`cleared ${a.length} interrupted-replace marker(s) — the next boot will start`), 0;
+}, Ft = async (e) => {
+	let { STAGING_PREFIX: t, dropStagingSql: n, execStatements: r } = await import("@voltro/data-transfer"), { store: i } = await G(), a = W();
+	if (a !== "postgres" && a !== "mysql" && a !== "mariadb" && a !== "sqlite" && a !== "mssql") return B.error(`this store has no staging tables to clear (dialect: ${a})`), 1;
 	let { introspectSchema: o } = await import("@voltro/database/sql"), s = (await i.run((await import("@effect/sql")).SqlClient.SqlClient.pipe((await import("effect")).Effect.flatMap(o)))).tables.map((e) => e.name).filter((e) => e.startsWith(t));
-	return s.length === 0 ? (L.info("no staging tables are present — nothing to clear"), 0) : e.includes("--yes") ? (await r(i, s.map((e) => n(e.slice(t.length), a))), L.info(`dropped ${s.length} staging table(s)`), 0) : (L.error(`${s.length} staging table(s) from an earlier \`--mode replace\`:\n` + s.map((e) => `    ${e}`).join("\n") + "\n\n  Each holds a copy of what a run was loading. Nothing else removes them.\n  Make sure no import is running right now — this cannot tell a leftover from one in flight.\n  Re-run with --yes to drop them."), 1);
-}, vt = async (e) => {
-	let { describeTransferRun: t, DATA_TRANSFERS_TABLE: n } = await import("@voltro/database"), r = Number(B(e, "--limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20;
-	if (B(e, "--target") === "api") {
-		let t = B(e, "--api-url");
-		if (!t) return L.error("--target api requires --api-url <url> (the running instance)"), 1;
-		let n = B(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
-		if (!n) return L.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET)"), 1;
-		let r = await fetch(`${t.replace(/\/+$/, "")}/_voltro/admin/imports?limit=${i}`, { headers: { authorization: `Bearer ${n}` } }), a = await r.text();
-		if (r.status !== 200) return L.error(`api imports: ${r.status} ${a}`), 1;
+	return s.length === 0 ? (B.info("no staging tables are present — nothing to clear"), 0) : e.includes("--yes") ? (await r(i, s.map((e) => n(e.slice(t.length), a))), B.info(`dropped ${s.length} staging table(s)`), 0) : (B.error(`${s.length} staging table(s) from an earlier \`--mode replace\`:\n` + s.map((e) => `    ${e}`).join("\n") + "\n\n  Each holds a copy of what a run was loading. Nothing else removes them.\n  Make sure no import is running right now — this cannot tell a leftover from one in flight.\n  Re-run with --yes to drop them."), 1);
+}, It = async (e) => {
+	let { describeTransferRun: t, DATA_TRANSFERS_TABLE: n } = await import("@voltro/database"), r = Number(H(e, "--limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20;
+	if (H(e, "--target") === "api") {
+		let t = H(e, "--api-url");
+		if (!t) return B.error("--target api requires --api-url <url> (the running instance)"), 1;
+		let n = H(e, "--token") ?? process.env.VOLTRO_DATA_TRANSFER_SECRET;
+		if (!n) return B.error("--target api requires --token <secret> (or VOLTRO_DATA_TRANSFER_SECRET)"), 1;
+		let r = await fetch(`${t.replace(/\/+$/, "")}/_voltro/admin/transfers?limit=${i}`, { headers: { authorization: `Bearer ${n}` } }), a = await r.text();
+		if (r.status !== 200) return B.error(`api transfers: ${r.status} ${a}`), 1;
 		let o = JSON.parse(a);
 		if (e.includes("--json")) return console.log(a), 0;
 		let s = o.runs ?? [];
-		if (s.length === 0) return L.info("no imports recorded on this instance"), 0;
-		(o.running ?? 0) > 0 && L.info(`${o.running} import(s) IN FLIGHT — re-run this to watch the counters move`);
-		for (let e of s) L.info(`  ${e.line ?? ""}`);
+		if (s.length === 0) return B.info("no data transfers recorded on this instance"), 0;
+		(o.running ?? 0) > 0 && B.info(`${o.running} transfer(s) IN FLIGHT — re-run this to watch the counters move`);
+		for (let e of s) B.info(`  ${e.line ?? ""}`);
 		return 0;
 	}
-	let { store: a } = await U(), o;
+	let { store: a } = await G(), o;
 	try {
 		o = await a.query({
 			table: n,
@@ -1018,23 +1167,23 @@ var we = /* @__PURE__ */ new Set([
 			take: i
 		});
 	} catch {
-		return L.error(`this target has no \`${n}\` table, so no import has been recorded here.\n  Run \`voltro db apply\`; imports themselves are unaffected by its absence.`), 1;
+		return B.error(`this target has no \`${n}\` table, so no transfer has been recorded here.\n  Run \`voltro db apply\`; the transfers themselves are unaffected by its absence.`), 1;
 	}
-	if (o.length === 0) return L.info("no imports recorded against this target"), 0;
+	if (o.length === 0) return B.info("no data transfers recorded against this target"), 0;
 	for (let e of o) {
 		let n = e;
-		L.info(`  ${t({
+		B.info(`  ${t({
 			...e,
 			startedAt: new Date(n.startedAt),
 			finishedAt: n.finishedAt === null ? null : new Date(n.finishedAt)
 		})}`);
 	}
 	return 0;
-}, yt = async (e) => {
-	let t = V(e), n = V(e.filter((e) => e !== t));
-	if (!t || !n) return L.error("usage: voltro data unpack <file.vbundle> <dir> [--passphrase <p>]"), 1;
-	let { resolve: r } = await import("node:path"), i = q(r(process.cwd(), t)), a = K(e);
-	return a && (i = D(i, a)), await xe(i, r(process.cwd(), n)), L.info("unpack complete", {
+}, Lt = async (e) => {
+	let t = U(e), n = U(e.filter((e) => e !== t));
+	if (!t || !n) return B.error("usage: voltro data unpack <file.vbundle> <dir> [--passphrase <p>]"), 1;
+	let { resolve: r } = await import("node:path"), i = Y(r(process.cwd(), t)), a = J(e);
+	return a && (i = A(i, a)), await Me(i, r(process.cwd(), n)), B.info("unpack complete", {
 		file: t,
 		dir: n
 	}), 0;
@@ -1111,19 +1260,20 @@ var we = /* @__PURE__ */ new Set([
 	backup: { common: ["--json", "--assets"] },
 	restore: { common: [
 		"--json",
+		"--assets",
 		"--allow-live",
 		"--force",
 		"--drill",
 		"--drill-url",
 		"--api-url"
 	] }
-}, bt = (e) => e.split("=")[0], xt = (e, t) => {
+}, Rt = (e) => e.split("=")[0], zt = (e, t) => {
 	let n = $[e];
 	if (!n) return;
-	let r = B(t, "--target") === "api" ? "api" : "direct", i = /* @__PURE__ */ new Set([...n.common, ...r === "api" ? n.apiOnly ?? [] : n.directOnly ?? []]), a = new Set(r === "api" ? n.directOnly ?? [] : n.apiOnly ?? []);
+	let r = H(t, "--target") === "api" ? "api" : "direct", i = /* @__PURE__ */ new Set([...n.common, ...r === "api" ? n.apiOnly ?? [] : n.directOnly ?? []]), a = new Set(r === "api" ? n.directOnly ?? [] : n.apiOnly ?? []);
 	for (let n of t) {
 		if (!n.startsWith("--")) continue;
-		let t = bt(n);
+		let t = Rt(n);
 		if (i.has(t)) continue;
 		if (a.has(t)) return `voltro data ${e}: ${t} is not read with --target ${r} (it is a --target ${r === "api" ? "direct" : "api"} flag). Remove it, or change --target.`;
 		let o = Object.entries($).filter(([n, r]) => n !== e && [
@@ -1133,24 +1283,24 @@ var we = /* @__PURE__ */ new Set([
 		].includes(t)).map(([e]) => e);
 		return o.length > 0 ? `voltro data ${e}: ${t} is not a \`${e}\` flag (it belongs to \`voltro data ${o.join("` / `")}\`). Remove it.` : `voltro data ${e}: unknown flag ${t}. Run \`voltro data --help\` for the flags this command reads.`;
 	}
-}, St = {
-	export: it,
-	import: ut,
-	transfers: vt,
-	inspect: ht,
-	unpack: yt,
-	backup: ft,
-	restore: mt,
-	"clear-replace-marker": gt,
-	"clear-staging": _t
-}, Ct = async (n) => {
+}, Bt = {
+	export: yt,
+	import: Dt,
+	transfers: It,
+	inspect: Nt,
+	unpack: Lt,
+	backup: kt,
+	restore: Mt,
+	"clear-replace-marker": Pt,
+	"clear-staging": Ft
+}, Vt = async (n) => {
 	let [r, ...i] = n;
 	if (r !== void 0 && $[r] !== void 0) {
-		let e = xt(r, i);
-		if (e) return L.error(e), 2;
+		let e = zt(r, i);
+		if (e) return B.error(e), 2;
 	}
-	let a = r === void 0 ? void 0 : St[r];
-	return a === void 0 ? (L.error(`usage: voltro data ${e(t)} … (logical: export/import; native: backup/restore; \`imports\` reads the history, incl. a run in flight)`), r ? 2 : 1) : a(i);
+	let a = r === void 0 ? void 0 : Bt[r];
+	return a === void 0 ? (B.error(`usage: voltro data ${e(t)} … (logical: export/import; native: backup/restore; \`imports\` reads the history, incl. a run in flight)`), r ? 2 : 1) : a(i);
 };
 //#endregion
-export { Ct as runDataCommand };
+export { Vt as runDataCommand };