@voltro/cli 0.54.0 → 0.55.0

package/dist/{dataCommand-DYzW8vkv.js → dataCommand-BEPPQiTl.js}

@@ -1,24 +1,24 @@
 import { a as e, t } from "./subcommandNames-CDzfEtKV.js";
 import { t as n } from "./cliError-BmdYnghb.js";
-import { B as r, c as i, i as a, o } from "./dev-CmuvUKRq.js";
+import { B as r, c as i, i as a, o } from "./dev-Ca_A_S9v.js";
 import { n as s, t as c } from "./cliArgs-D4p8n7EE.js";
 import { r as l } from "./dialectDriver-czCHYpeH.js";
 import { i as u, n as d, r as f, t as p } from "./dataProfile-Du3ztYxv.js";
 import { o as m, t as h } from "./inspectFetch-EMuhTG_9.js";
-import { r as g } from "./dbCommand-B4NWZtGL.js";
+import { r as g } from "./dbCommand-DZTmOFT4.js";
 import { resolve as _ } from "node:path";
 import { createLogger as v } from "@voltro/logger";
 import { DATA_TRANSFERS_TABLE as y, REPLACE_IN_PROGRESS_TABLE as b, _voltroDataTransfersTable as x, _voltroReplaceInProgressTable as S, connectionIdentity as C, derivedRowId as w, ensureTableRegistered as T, normaliseTarget as ee, sameDatabase as te, streamTable as ne } from "@voltro/database";
 import { Cause as E, Effect as D, Exit as re, Option as ie, Stream as ae } from "effect";
 import { SqlClient as oe } from "@effect/sql";
-import { declaredSnapshot as se, fingerprintSchema as ce, introspectSchema as le } from "@voltro/database/sql";
-import { STORAGE_REFS_TABLE as ue, appStorageProvider as de, configuredStorageProvider as O } from "@voltro/plugin-storage";
-import { createHash as fe } from "node:crypto";
-import { ASSETS_DIR as k, ASSET_INDEX_FILE as A, BundleError as pe, asImportError as me, assessLiveImport as he, backupArtifactName as j, backupCommand as ge, captureAssetsToCas as _e, classificationFromSnapshot as ve, decryptStream as M, encryptStream as ye, packBundle as be, peekBundle as N, previewMasking as xe, restoreAssetsFromCas as Se, restoreCommand as Ce, runExport as we, runImport as Te, runNativeStep as Ee, storageAssetSink as De, storageAssetSource as Oe, storageBlobSink as ke, storageBlobSource as Ae, unpackBundle as je, unpackBundleToDir as Me } from "@voltro/data-transfer";
-import { request as Ne } from "node:http";
-import { request as Pe } from "node:https";
+import { declaredSnapshot as se, fingerprintSchema as O, introspectSchema as ce } from "@voltro/database/sql";
+import { STORAGE_REFS_TABLE as le, appStorageProvider as ue, configuredStorageProvider as k } from "@voltro/plugin-storage";
+import { createHash as de } from "node:crypto";
+import { ASSETS_DIR as A, ASSET_INDEX_FILE as j, BundleError as fe, asImportError as pe, assessLiveImport as me, backupArtifactName as M, backupCommand as he, captureAssetsToCas as ge, classificationFromSnapshot as _e, decryptStream as N, dumpExcludedTables as ve, encryptStream as ye, packBundle as be, peekBundle as P, previewMasking as xe, restoreAssetsFromCas as Se, restoreCommand as Ce, runExport as we, runImport as Te, runNativeStep as F, storageAssetSink as Ee, storageAssetSource as De, storageBlobSink as Oe, storageBlobSource as ke, unpackBundle as Ae, unpackBundleToDir as je } from "@voltro/data-transfer";
+import { request as Me } from "node:http";
+import { request as Ne } from "node:https";
 //#region src/longRequest.ts
-var Fe = /* @__PURE__ */ new Set([
+var Pe = /* @__PURE__ */ new Set([
 	"ECONNREFUSED",
 	"ETIMEDOUT",
 	"EHOSTUNREACH",
@@ -26,7 +26,7 @@ var Fe = /* @__PURE__ */ new Set([
 	"ENOTFOUND",
 	"ECONNRESET",
 	"EAI_AGAIN"
-]), P = class extends Error {
+]), I = class extends Error {
 	url;
 	cause;
 	constructor(e, t) {
@@ -39,14 +39,14 @@ var Fe = /* @__PURE__ */ new Set([
 		})();
 		super(`the instance at ${n} is not answering (${t.code ?? "connect failed"}).`), this.url = e, this.cause = t, this.name = "InstanceUnreachable";
 	}
-}, F = class extends Error {
+}, Fe = class extends Error {
 	elapsedMs;
 	url;
 	constructor(e, t) {
 		super(`no response after ${Math.round(e / 1e3)}s`), this.elapsedMs = e, this.url = t, this.name = "LongRequestTimeout";
 	}
-}, I = async (e, t, n, r) => {
-	let i = new URL(e), a = i.protocol === "https:" ? Pe : Ne, o = Date.now();
+}, L = async (e, t, n, r) => {
+	let i = new URL(e), a = i.protocol === "https:" ? Ne : Me, o = Date.now();
 	return await new Promise((s, c) => {
 		let l = a({
 			protocol: i.protocol,
@@ -64,8 +64,8 @@ var Fe = /* @__PURE__ */ new Set([
 			})), e.on("error", c);
 		});
 		if (r?.timeoutMs !== void 0 && r.timeoutMs > 0 && l.setTimeout(r.timeoutMs, () => {
-			l.destroy(new F(Date.now() - o, e));
-		}), l.on("error", (t) => c(Fe.has(t.code ?? "") ? new P(e, t) : t)), typeof t == "string" || Buffer.isBuffer(t)) {
+			l.destroy(new Fe(Date.now() - o, e));
+		}), l.on("error", (t) => c(Pe.has(t.code ?? "") ? new I(e, t) : t)), typeof t == "string" || Buffer.isBuffer(t)) {
 			l.end(t);
 			return;
 		}
@@ -78,7 +78,7 @@ var Fe = /* @__PURE__ */ new Set([
 			}
 		})();
 	});
-}, L = (e) => `${e.message}\n  That address came from --api-url (or VOLTRO_API_URL) — it is the running instance, not the database.\n  Nothing was sent, so nothing was imported. Check the instance is up and reachable from here\n  (a VPN, an ingress or a stopped deployment are the usual three), e.g. curl -sS ${e.url}/_voltro/inspect/app`, Ie = (e, t) => `the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. This is a client-side deadline, not a failure on the server: the upload itself finished long before, and the response arrives only when the import does. The instance is very probably STILL IMPORTING and will finish.\n` + (t === "replace" ? "  Do NOT simply re-run: --mode replace empties the target first, so a second run started while the first is mid-flight would empty it under the first one. Check the instance's log for the import's completion, and check the target's row counts, before deciding." : `  Re-running the same bundle is safe once the first run has finished (--mode ${t} is idempotent), but check the instance's log first — the work may already be done.`) + "\n  To keep a deadline anyway, pass --timeout <seconds>; the default is to wait.", Le = 16777216, Re = async function* (e, t) {
+}, Ie = (e) => `${e.message}\n  That address came from --api-url (or VOLTRO_API_URL) — it is the running instance, not the database.\n  Nothing was sent, so nothing was imported. Check the instance is up and reachable from here\n  (a VPN, an ingress or a stopped deployment are the usual three), e.g. curl -sS ${e.url}/_voltro/inspect/app`, Le = (e, t) => `the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. This is a client-side deadline, not a failure on the server: the upload itself finished long before, and the response arrives only when the import does. The instance is very probably STILL IMPORTING and will finish.\n` + (t === "replace" ? "  Do NOT simply re-run: --mode replace empties the target first, so a second run started while the first is mid-flight would empty it under the first one. Check the instance's log for the import's completion, and check the target's row counts, before deciding." : `  Re-running the same bundle is safe once the first run has finished (--mode ${t} is idempotent), but check the instance's log first — the work may already be done.`) + "\n  To keep a deadline anyway, pass --timeout <seconds>; the default is to wait.", Re = 16777216, ze = async function* (e, t) {
 	let n = [], r = 0, i = 0, a = function* (e) {
 		let t = Buffer.concat(n);
 		n = [], r = 0;
@@ -100,12 +100,12 @@ var Fe = /* @__PURE__ */ new Set([
 		i += a.byteLength, yield s;
 	}
 	yield* a(!0);
-}, ze = (e) => fe("sha256").update(Buffer.from(e)).digest("hex"), Be = async (e) => {
+}, Be = (e) => de("sha256").update(Buffer.from(e)).digest("hex"), Ve = async (e) => {
 	let t = 0, n = 0, r = {
 		status: 0,
 		body: {}
 	};
-	for await (let i of Re(e.stream, e.chunkBytes)) {
+	for await (let i of ze(e.stream, e.chunkBytes)) {
 		if (i.offset + i.bytes.byteLength <= e.alreadyHeld && !i.final) {
 			n++;
 			continue;
@@ -131,14 +131,15 @@ var Fe = /* @__PURE__ */ new Set([
 		bytes: t,
 		resumedFrom: e.alreadyHeld
 	};
-}, R = "voltro-backup-stamp.json", Ve = (e) => ({
+}, R = "voltro-backup-stamp.json", He = (e) => ({
 	stampVersion: 1,
 	dialect: e.dialect,
 	schemaFingerprint: e.schemaFingerprint,
+	dumpFingerprint: e.dumpFingerprint ?? null,
 	voltroVersion: e.voltroVersion,
 	createdAt: e.createdAt,
 	assets: e.assets ?? null
-}), He = (e) => {
+}), Ue = (e) => {
 	let t;
 	try {
 		t = JSON.parse(e);
@@ -150,25 +151,26 @@ var Fe = /* @__PURE__ */ new Set([
 	if (n.stampVersion !== 1 || typeof n.dialect != "string" || typeof n.voltroVersion != "string" || typeof n.createdAt != "string") return null;
 	let r = n.schemaFingerprint;
 	if (r !== null && typeof r != "string") return null;
-	let i = n.assets, a = (e) => {
-		let t = i?.[e];
+	let i = n.dumpFingerprint, a = n.assets, o = (e) => {
+		let t = a?.[e];
 		return typeof t == "number" ? t : void 0;
-	}, o = typeof i == "object" && i && typeof i.count == "number" && typeof i.totalBytes == "number" ? {
-		count: i.count,
-		totalBytes: i.totalBytes,
-		...a("references") === void 0 ? {} : { references: a("references") },
-		...a("objects") === void 0 ? {} : { objects: a("objects") },
-		...a("objectBytes") === void 0 ? {} : { objectBytes: a("objectBytes") }
+	}, s = typeof a == "object" && a && typeof a.count == "number" && typeof a.totalBytes == "number" ? {
+		count: a.count,
+		totalBytes: a.totalBytes,
+		...o("references") === void 0 ? {} : { references: o("references") },
+		...o("objects") === void 0 ? {} : { objects: o("objects") },
+		...o("objectBytes") === void 0 ? {} : { objectBytes: o("objectBytes") }
 	} : null;
 	return {
 		stampVersion: 1,
 		dialect: n.dialect,
 		schemaFingerprint: r,
+		dumpFingerprint: typeof i == "string" ? i : null,
 		voltroVersion: n.voltroVersion,
 		createdAt: n.createdAt,
-		assets: o
+		assets: s
 	};
-}, Ue = (e) => {
+}, We = (e) => {
 	let { stamp: t, currentDialect: n, targetFingerprint: r } = e;
 	if (t === null) return {
 		warn: `no ${R} beside the dump — an older/handmade backup. Cannot verify dialect or schema version; make sure this dump is a ${n} dump.`,
@@ -182,7 +184,7 @@ var Fe = /* @__PURE__ */ new Set([
 		refuse: `dialect mismatch — backup is a ${t.dialect} dump, but DB_DIALECT is ${n}. A cross-dialect restore is never valid.`,
 		info: i
 	};
-}, We = async (e, t) => {
+}, Ge = async (e, t) => {
 	let n = w("dimp", `${t.direction}-${t.artifact}-${Date.now()}-${Math.random()}`), r = {
 		id: n,
 		direction: t.direction,
@@ -230,7 +232,7 @@ var Fe = /* @__PURE__ */ new Set([
 			...r
 		});
 	} catch {}
-}, Ge = async (e, t) => {
+}, Ke = async (e, t) => {
 	let n = w("repl", `restore-${t.artifact}-${Date.now()}-${Math.random()}`), r = {
 		id: n,
 		startedAt: /* @__PURE__ */ new Date(),
@@ -271,7 +273,7 @@ var Fe = /* @__PURE__ */ new Set([
 			} }).then(() => void 0, () => void 0);
 		}
 	};
-}, Ke = async (e) => {
+}, qe = async (e) => {
 	let t = await D.runPromiseExit(e);
 	if (re.isSuccess(t)) return;
 	let n = E.failureOption(t.cause);
@@ -287,7 +289,7 @@ var Fe = /* @__PURE__ */ new Set([
 	} catch {
 		return e.trim();
 	}
-}, qe = (e) => {
+}, Je = (e) => {
 	let t = e.flagUrl ?? e.envUrl;
 	if (t === void 0 || t.trim() === "") return {
 		ok: !1,
@@ -301,39 +303,67 @@ var Fe = /* @__PURE__ */ new Set([
 		ok: !0,
 		url: t
 	};
-}, Je = (e) => {
-	let { stampFingerprint: t, restoredFingerprint: n, restoredTableCount: r } = e;
-	return r === 0 ? {
+}, Ye = (e) => {
+	let { dumpFingerprint: t, liveFingerprintAtBackup: n, restoredFingerprint: r, restoredTableCount: i, ledger: a } = e;
+	if (i === 0) return {
 		pass: !1,
 		lines: ["FAIL — the restore produced ZERO tables. The dump is empty or unreadable; this backup would NOT recover your app."]
-	} : t !== null && n !== null && t !== n ? {
+	};
+	if (t !== null && r !== null && t !== r) return {
+		pass: !1,
+		lines: [`FAIL — restored ${i} table(s), but the schema fingerprint (${r.slice(0, 12)}) does NOT match what the backup's artifact should carry (${t.slice(0, 12)}).`, "The restore did not reproduce the schema that was backed up — the artifact is inconsistent."]
+	};
+	if (a.kind === "empty") return {
 		pass: !1,
-		lines: [`FAIL — restored ${r} table(s), but the schema fingerprint (${n.slice(0, 12)}) does NOT match the backup's stamp (${t.slice(0, 12)}).`, "The restore did not reproduce the schema that was backed up — the artifact is inconsistent."]
-	} : t === null || n === null ? {
+		lines: [
+			`FAIL — restored ${i} table(s) with the right shape, but \`_voltro_migration_plans\` came back EMPTY.`,
+			"`voltro serve` reads the newest row of that table as its boot gate and refuses with `prod-mismatch` when there is none — no source tree makes an empty ledger boot. Restoring this artifact would give you a database the app will not serve.",
+			"Run `voltro db apply` after a real restore to record a baseline, or find out why the ledger rows did not cross."
+		]
+	};
+	let o = a.kind === "recorded" ? `Migration ledger restored — newest recorded schema ${a.fingerprint.slice(0, 12)}; \`voltro serve\` boots against this database when your code declares that same schema.` : "No `_voltro_migration_plans` in the restored DB — not a voltro-managed schema, so nothing is claimed about booting against it.";
+	return t === null || r === null ? {
 		pass: !0,
-		lines: [`PASS (partial) — restored ${r} table(s) into the throwaway DB.`, "No stamped fingerprint to cross-check the schema shape (older/hand-made backup) — the bytes restore, but the shape was not verified."]
+		lines: [
+			`PASS (partial) — restored ${i} table(s) into the throwaway DB.`,
+			n === null ? "No stamped fingerprint to cross-check the schema shape (older/hand-made backup) — the bytes restore, but the shape was not verified." : "The stamp predates the dump-scoped fingerprint, and its `schemaFingerprint` covers the SOURCE database rather than the artifact — comparing against it would fail a healthy backup. Re-take the backup to cross-check the shape.",
+			o
+		]
 	} : {
 		pass: !0,
-		lines: [`PASS — restored ${r} table(s); schema fingerprint matches the backup stamp (${n.slice(0, 12)}).`]
+		lines: [`PASS — restored ${i} table(s); schema fingerprint matches the backup stamp (${r.slice(0, 12)}).`, o]
 	};
-}, V = v({ scope: "voltro:data" }), Ye = async () => {
+}, V = v({ scope: "voltro:data" }), Xe = async () => {
 	try {
 		let { createRequire: e } = await import("node:module"), { join: t } = await import("node:path"), { readFileSync: n } = await import("node:fs"), r = e(t(process.cwd(), "package.json")).resolve("@voltro/cli/package.json");
 		return JSON.parse(n(r, "utf8")).version ?? "unknown";
 	} catch {
 		return "unknown";
 	}
-}, Xe = async (e) => {
+}, Ze = async (e) => {
 	try {
-		return ce(await tt(e));
+		return O(await K(e));
 	} catch {
 		return null;
 	}
+}, Qe = async (e) => {
+	try {
+		let t = await K(e), n = new Set(ve(e));
+		return {
+			live: O(t),
+			dump: O({ tables: t.tables.filter((e) => !n.has(e.name)) })
+		};
+	} catch {
+		return {
+			live: null,
+			dump: null
+		};
+	}
 }, H = (e) => {
 	if (e.event !== "done") return;
 	let t = e.total === void 0 ? "" : ` / ${e.total}`;
 	V.info(`${e.phase} [${e.index + 1}/${e.tableCount}] ${e.table}`, { rows: `${e.rowsDone}${t}` });
-}, Ze = async (e) => {
+}, $e = async (e) => {
 	let t = (e) => e?.meta?.databaseId;
 	if (e) {
 		let n = await h({
@@ -353,21 +383,21 @@ var Fe = /* @__PURE__ */ new Set([
 		};
 	}
 	return null;
-}, Qe = async (e) => {
-	let t = e.includes("--allow-live"), n = t ? null : await Ze(U(e, "--api-url")), r = C({
+}, et = async (e) => {
+	let t = e.includes("--allow-live"), n = t ? null : await $e(U(e, "--api-url")), r = C({
 		dialect: G(),
 		...o()
 	}), i = ee({
 		dialect: G(),
 		...o()
-	}), { refuse: a, message: s } = he({
+	}), { refuse: a, message: s } = me({
 		liveInstance: n?.label ?? null,
 		allowLive: t,
 		sameTarget: te(r, n?.databaseId),
 		...i === void 0 ? {} : { targetLabel: `${i.host}:${i.port}/${i.database}` }
 	});
 	return !a || (V.error(s ?? "refusing: live instance detected"), !1);
-}, U = s, $e = [
+}, U = s, tt = [
 	"--api-url",
 	"--bundle-key",
 	"--compression",
@@ -387,42 +417,42 @@ var Fe = /* @__PURE__ */ new Set([
 	"--timeout",
 	"--tenant",
 	"--token"
-], W = (e) => c(e, $e), G = () => {
+], W = (e) => c(e, tt), G = () => {
 	let e = (process.env.DB_DIALECT ?? "postgres").toLowerCase();
 	if (e === "memory") throw new n("voltro data: requires a real dialect, not DB_DIALECT=memory.");
 	return e;
-}, et = async (e, t) => {
+}, nt = async (e, t) => {
 	let n = (await l(e)).makeSqlLayer(t);
-	return D.runPromise(oe.SqlClient.pipe(D.flatMap(le), D.provide(n)));
-}, tt = (e) => et(e, o()), nt = () => {
+	return D.runPromise(oe.SqlClient.pipe(D.flatMap(ce), D.provide(n)));
+}, K = (e) => nt(e, o()), rt = () => {
 	let e = o(), t = [];
 	return e.url && t.push(B(e.url)), (e.host || e.database) && t.push(`${(e.host ?? "localhost").toLowerCase()}:${e.port ?? "(default)"}/${e.database ?? ""}`), t;
-}, K = async () => {
+}, q = async () => {
 	let e = process.cwd(), t = await i(e);
 	if (!t) throw new n("voltro data: no app.config.ts found in the current directory.");
 	let r = await a(t, void 0), o = G();
 	return {
 		store: r,
-		snapshot: await tt(o),
+		snapshot: await K(o),
 		dialect: o
 	};
-}, rt = (e) => ne(e, {
-	table: ue,
+}, J = (e) => ne(e, {
+	table: le,
 	chunkSize: 500
 }).pipe(ae.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-}))), q = (e) => !!e && e.endsWith(".vbundle"), J = (e) => U(e, "--passphrase") ?? process.env.VOLTRO_BUNDLE_KEY, it = (e) => e.includes("--encrypt") || U(e, "--passphrase") !== void 0 || process.env.VOLTRO_BUNDLE_KEY !== void 0, at = async (e, t) => {
+}))), Y = (e) => !!e && e.endsWith(".vbundle"), X = (e) => U(e, "--passphrase") ?? process.env.VOLTRO_BUNDLE_KEY, it = (e) => e.includes("--encrypt") || U(e, "--passphrase") !== void 0 || process.env.VOLTRO_BUNDLE_KEY !== void 0, at = async (e, t) => {
 	let { createWriteStream: n } = await import("node:fs"), { pipeline: r } = await import("node:stream/promises"), { Readable: i } = await import("node:stream");
 	await r(i.from(e), n(t));
-}, Y = (e) => ({ async *[Symbol.asyncIterator]() {
+}, Z = (e) => ({ async *[Symbol.asyncIterator]() {
 	let { createReadStream: t } = await import("node:fs");
 	for await (let n of t(e)) yield n instanceof Uint8Array ? n : new Uint8Array(n);
 } }), ot = async (e, t) => {
 	if (t !== void 0 || e === void 0) return null;
 	try {
-		let { resolve: t, join: n } = await import("node:path"), r = await import("node:fs/promises"), i = t(process.cwd(), e), a = q(e) ? (await N(Y(i), ["manifest.json"])).get("manifest.json") : await r.readFile(n(i, "manifest.json"));
+		let { resolve: t, join: n } = await import("node:path"), r = await import("node:fs/promises"), i = t(process.cwd(), e), a = Y(e) ? (await P(Z(i), ["manifest.json"])).get("manifest.json") : await r.readFile(n(i, "manifest.json"));
 		if (a === void 0) return null;
 		let o = (JSON.parse(Buffer.from(a).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
 		return o.length > 0 ? o : null;
@@ -491,7 +521,7 @@ var Fe = /* @__PURE__ */ new Set([
 	} : { kind: "all" };
 }, pt = async () => {
 	let e = await g(process.cwd());
-	return ve(se(e));
+	return _e(se(e));
 }, mt = "voltro/tenant", ht = async () => {
 	let e = (await g(process.cwd())).filter((e) => (e.appliedMixins ?? []).some((e) => e.id === mt)).map((e) => e.tableName);
 	return e.length > 0 ? e : void 0;
@@ -509,7 +539,7 @@ var Fe = /* @__PURE__ */ new Set([
 		for (let t of e.unclassified) console.log(`    ${t}`);
 	} else console.log("\n  ✓ every exported column is classified — safe to run.");
 }, _t = async (e) => {
-	let { resolve: t, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = U(e.args, "--chunk-size"), o = a === void 0 ? Le : Math.round(Number(a) * 1024 * 1024);
+	let { resolve: t, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = U(e.args, "--chunk-size"), o = a === void 0 ? Re : Math.round(Number(a) * 1024 * 1024);
 	if (!Number.isFinite(o) || o <= 0) throw new n(`--chunk-size expects a positive number of megabytes, got '${String(a)}'`);
 	let s = e.stream[Symbol.asyncIterator](), c = [], l = 0, u = !1;
 	for (; l <= o;) {
@@ -524,11 +554,11 @@ var Fe = /* @__PURE__ */ new Set([
 		kind: "small",
 		body: Buffer.concat(c)
 	};
-	let d = t(process.cwd(), e.bundleDir), f = ze(q(e.bundleDir) ? await i.readFile(d) : await i.readFile(r(d, "manifest.json"))), p = `up-${f.slice(0, 32)}`, m = await I(e.url, Buffer.alloc(0), {
+	let d = t(process.cwd(), e.bundleDir), f = Be(Y(e.bundleDir) ? await i.readFile(d) : await i.readFile(r(d, "manifest.json"))), p = `up-${f.slice(0, 32)}`, m = await L(e.url, Buffer.alloc(0), {
 		...e.headers,
 		"x-import-upload-id": p,
 		"x-import-probe": "1"
-	}, Z(e.args)), h = m.status === 200 ? Number(JSON.parse(m.body.toString("utf8")).bytes ?? 0) : 0;
+	}, $(e.args)), h = m.status === 200 ? Number(JSON.parse(m.body.toString("utf8")).bytes ?? 0) : 0;
 	h > 0 && e.log.info("api import: resuming a chunked upload the instance already holds", { bytes: h });
 	let g = (async function* () {
 		for (let e of c) yield e;
@@ -537,7 +567,7 @@ var Fe = /* @__PURE__ */ new Set([
 			if (e.done === !0) return;
 			yield e.value;
 		}
-	})(), _ = 0, v = await Be({
+	})(), _ = 0, v = await Ve({
 		stream: g,
 		chunkBytes: o,
 		uploadId: p,
@@ -551,7 +581,7 @@ var Fe = /* @__PURE__ */ new Set([
 			e.log.info("api import: upload done — the instance is importing now. This request stays open until it finishes, which on a full bundle is minutes, and nothing more is printed until then. It is not a hang; the instance logs the import itself.");
 		},
 		target: { send: async (t, n) => {
-			let r = await I(e.url, t, n, Z(e.args)), i = {};
+			let r = await L(e.url, t, n, $(e.args)), i = {};
 			try {
 				i = JSON.parse(r.body.toString("utf8") || "{}");
 			} catch {}
@@ -573,7 +603,7 @@ var Fe = /* @__PURE__ */ new Set([
 			body: Buffer.from(JSON.stringify(v.body))
 		}
 	};
-}, vt = (e) => `--mode replace with --no-atomic against a ${e ? "RUNNING instance" : "live database"}: the target is empty between the delete and the load, and anything the application writes in that window can collide with a row from the bundle — or survive the import as a row the bundle never carried. Drop --no-atomic to run the whole load in one transaction (concurrent writers then wait instead of racing), or stop the traffic for the duration.`, X = (e, t) => e.includes("--no-atomic") ? !1 : e.includes("--atomic") || t === "replace", yt = (e, t, n) => {
+}, vt = (e) => `--mode replace with --no-atomic against a ${e ? "RUNNING instance" : "live database"}: the target is empty between the delete and the load, and anything the application writes in that window can collide with a row from the bundle — or survive the import as a row the bundle never carried. Drop --no-atomic to run the whole load in one transaction (concurrent writers then wait instead of racing), or stop the traffic for the duration.`, Q = (e, t) => e.includes("--no-atomic") ? !1 : e.includes("--atomic") || t === "replace", yt = (e, t, n) => {
 	if (t !== "replace" || e.includes("--no-rollback")) return;
 	let i = U(e, "--rollback-dir");
 	return i === void 0 ? r(n) : _(i);
@@ -584,7 +614,7 @@ var Fe = /* @__PURE__ */ new Set([
 		recordInterruption: !0,
 		via: "direct"
 	};
-}, Z = (e) => {
+}, $ = (e) => {
 	let t = U(e, "--timeout");
 	if (t === void 0) return {};
 	let r = Number(t);
@@ -611,15 +641,15 @@ var Fe = /* @__PURE__ */ new Set([
 			...n ? { bundleKey: n } : {}
 		}, c = st(e), l;
 		try {
-			let n = await I(`${t.replace(/\/+$/, "")}/_voltro/admin/export`, JSON.stringify(s), {
+			let n = await L(`${t.replace(/\/+$/, "")}/_voltro/admin/export`, JSON.stringify(s), {
 				"content-type": "application/json",
 				authorization: `Bearer ${i}`
-			}, c.perRequest ?? Z(e));
+			}, c.perRequest ?? $(e));
 			if (n.status < 200 || n.status >= 300) return V.error(`api export failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
 			l = JSON.parse(n.body.toString("utf8"));
 		} catch (e) {
-			if (e instanceof F) return V.error(`api export: the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. That is a client-side deadline. Nothing was written locally; re-run, or raise --timeout.`), 1;
-			if (e instanceof P) return V.error(`api export: ${L(e)}`), 1;
+			if (e instanceof Fe) return V.error(`api export: the instance did not answer within ${Math.round(e.elapsedMs / 1e3)}s. That is a client-side deadline. Nothing was written locally; re-run, or raise --timeout.`), 1;
+			if (e instanceof I) return V.error(`api export: ${Ie(e)}`), 1;
 			throw e;
 		}
 		if (e.includes("--detach")) return V.info(`api export: started as ${l.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${ut} --target api --api-url ${t}`), 0;
@@ -647,7 +677,7 @@ var Fe = /* @__PURE__ */ new Set([
 			log: V,
 			...c.perRequest ? { perRequest: c.perRequest } : {}
 		});
-		return g === null ? 1 : (await Me((async function* () {
+		return g === null ? 1 : (await je((async function* () {
 			yield g;
 		})(), h(process.cwd(), r)), V.info("api export complete (downloaded from the running instance)", {
 			outDir: r,
@@ -658,7 +688,7 @@ var Fe = /* @__PURE__ */ new Set([
 		}), 0);
 	}
 	if (!r) return V.error("a <outDir> is required for a direct export"), 1;
-	let i = U(e, "--profile"), a = i ? await p(i, { allowPath: !0 }) : {}, { store: o, snapshot: s, dialect: c } = await K(), l = e.includes("--assets") || a.assets === !0, m = l ? O() : void 0;
+	let i = U(e, "--profile"), a = i ? await p(i, { allowPath: !0 }) : {}, { store: o, snapshot: s, dialect: c } = await q(), l = e.includes("--assets") || a.assets === !0, m = l ? k() : void 0;
 	if (l && !m) return V.error("--assets: this app has no storage provider configured, so there are no blobs to export.\n  Install `storagePlugin(...)` in app.config.ts or set STORAGE_PROVIDER, or drop the flag."), 1;
 	let h = U(e, "--compression") ?? a.compression, g = U(e, "--consistency") === "snapshot" ? "snapshot" : a.consistency ?? "live", _ = a.masking, v = a.subset, y = a.scope ?? ft(e, s.tables.map((e) => e.name)), b = _ ? await pt() : void 0, x = y.kind === "tenant" ? await ht() : void 0, S = x ? { tenantTables: x } : {};
 	if (e.includes("--dry-run")) {
@@ -684,7 +714,7 @@ var Fe = /* @__PURE__ */ new Set([
 		}));
 		return gt(t), +(t.unclassified.length > 0);
 	}
-	if (q(r)) {
+	if (Y(r)) {
 		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: i, join: a } = await import("node:path"), u = await n.mkdtemp(a(t.tmpdir(), "voltro-export-"));
 		try {
 			let t = await D.runPromise(we({
@@ -703,10 +733,10 @@ var Fe = /* @__PURE__ */ new Set([
 				onProgress: H
 			})), n = be({
 				dir: u,
-				...m ? { blobs: Ae(m, () => rt(o)) } : {}
+				...m ? { blobs: ke(m, () => J(o)) } : {}
 			}), a = it(e);
 			if (a) {
-				let t = J(e);
+				let t = X(e);
 				if (!t) return V.error("--encrypt requires --passphrase <p> or VOLTRO_BUNDLE_KEY (a dedicated key, NOT the transfer secret)"), 1;
 				n = ye(n, t);
 			}
@@ -737,7 +767,7 @@ var Fe = /* @__PURE__ */ new Set([
 		...h ? { compression: h } : {},
 		..._ ? { masking: _ } : {},
 		...b ? { classification: b } : {},
-		...m ? { assets: Oe(m, () => rt(o)) } : {},
+		...m ? { assets: De(m, () => J(o)) } : {},
 		onProgress: H
 	}));
 	return V.info("export complete", {
@@ -772,8 +802,8 @@ var Fe = /* @__PURE__ */ new Set([
 		return;
 	}
 	V.info("import complete", t);
-}, Et = Symbol("refused"), Q = (e) => {
-	let t = me(e) ?? e;
+}, Et = Symbol("refused"), Dt = (e) => {
+	let t = pe(e) ?? e;
 	if (t?._tag !== "RowsRefusedError" || !Array.isArray(t.rows)) return !1;
 	let n = t.rows, r = n.filter((e) => !e.derived), i = Number(t.totalCount ?? n.length), a = Number(t.primaryCount ?? r.length);
 	V.error(`import refused ${i} row(s), of which ${a} are the actual failures — the rest could not land because a row they reference did not.`);
@@ -783,7 +813,7 @@ var Fe = /* @__PURE__ */ new Set([
 	n.length < i && V.error(`  (the list above is capped at ${n.length} of ${i} — the counts by table are complete)`);
 	let s = i - a;
 	return s > 0 && V.error(`  … and ${s} row(s) behind them. Fix the ${a} above and re-run; they resolve with their parents.`), !0;
-}, Dt = (e) => {
+}, Ot = (e) => {
 	let t = typeof e == "string" ? e : e.toString("utf8"), n = t;
 	try {
 		let e = JSON.parse(t), r = e.error ?? e.message;
@@ -823,7 +853,7 @@ var Fe = /* @__PURE__ */ new Set([
 			return;
 		}
 	}
-}, Ot = async (e) => {
+}, kt = async (e) => {
 	let t = U(e, "--target") === "api", n = U(e, "--bundle-key"), r = W(e);
 	if (!r && !(t && n)) return V.error("usage: voltro data import <bundleDir> [--target direct|api] [--api-url <url>] [--token <secret>] [--timeout <seconds>] [--bundle-key <storage-key>] [--tables a,b] [--mode upsert|append|replace] [--on-conflict skip|fail] [--atomic] [--assets] [--no-verify] [--force] [--allow-live] [--dry-run]  (--force: import despite schema drift AND cross-dialect warnings; --dry-run: report what would move, write nothing)"), 1;
 	let i = U(e, "--mode") ?? "upsert", a = U(e, "--on-conflict") ?? "skip";
@@ -838,7 +868,7 @@ var Fe = /* @__PURE__ */ new Set([
 			authorization: `Bearer ${o}`,
 			"x-import-mode": i,
 			"x-import-on-conflict": a,
-			...X(e, i) ? { "x-import-atomic": "1" } : {},
+			...Q(e, i) ? { "x-import-atomic": "1" } : {},
 			...e.includes("--no-atomic") ? { "x-import-atomic": "0" } : {},
 			...c === void 0 ? {} : { "x-import-rollback-key": c },
 			...e.includes("--force") ? { "x-import-force": "1" } : {},
@@ -846,23 +876,23 @@ var Fe = /* @__PURE__ */ new Set([
 			...s ? { "x-import-tables": s } : {}
 		}, { resolve: p } = await import("node:path"), m;
 		if (n) l["content-type"] = "application/json", m = JSON.stringify({ bundleKey: n });
-		else if (q(r)) {
-			let t = Y(p(process.cwd(), r)), n = J(e);
-			n && (t = M(t, n)), l["content-type"] = "application/octet-stream", m = t;
+		else if (Y(r)) {
+			let t = Z(p(process.cwd(), r)), n = X(e);
+			n && (t = N(t, n)), l["content-type"] = "application/octet-stream", m = t;
 		} else await (await import("node:fs/promises")).access(p(process.cwd(), r, "assets", "index.ndjson")).then(() => !0, () => !1) && V.warn("this directory bundle has assets; --target api uploads DATA ONLY. Pack a single-file `.vbundle` (voltro data export <name>.vbundle --assets) to transfer assets over the API."), l["content-type"] = "application/octet-stream", m = be({ dir: p(process.cwd(), r) });
 		if (i === "replace") {
 			let i = await ot(r, n);
 			{
-				let r = i === null ? { bundleKey: n } : { tables: i }, a = await I(`${t.replace(/\/+$/, "")}/_voltro/admin/import`, JSON.stringify(r), {
+				let r = i === null ? { bundleKey: n } : { tables: i }, a = await L(`${t.replace(/\/+$/, "")}/_voltro/admin/import`, JSON.stringify(r), {
 					...l,
 					"content-type": "application/json",
 					"x-import-preflight": "1"
-				}, Z(e)).catch(() => null), o = a !== null && a.status === 200 ? JSON.parse(a.body.toString("utf8")) : null;
+				}, $(e)).catch(() => null), o = a !== null && a.status === 200 ? JSON.parse(a.body.toString("utf8")) : null;
 				o === null ? V.warn("api replace: the instance did not answer the preflight (an older build does not have it). The run still works; the decision will only be visible in the pod log.") : o.staged === !0 ? V.info(`api replace: the instance WILL stage — ${o.stagedTables ?? 0} table(s) load into copies and the\n  target keeps its rows until one short swap at the end. Interrupting the load leaves the target intact.`) : V.warn(`api replace: the instance will NOT stage — it empties the target first and refills it, so an
   interrupted run leaves the target empty.\n  Reason: ${o.reason ?? "not stated"}`);
 			}
 		}
-		i === "replace" && !X(e, i) && V.warn(vt(!0));
+		i === "replace" && !Q(e, i) && V.warn(vt(!0));
 		let h = `${t.replace(/\/+$/, "")}/_voltro/admin/import`, g = st(e), _;
 		try {
 			let t = typeof m == "string" ? null : await _t({
@@ -872,23 +902,23 @@ var Fe = /* @__PURE__ */ new Set([
 				bundleDir: r,
 				args: e,
 				log: V
-			}), n = t === null ? await I(h, m, l, g.perRequest ?? Z(e)) : t.kind === "sent" ? t.res : await I(h, t.body, l, g.perRequest ?? Z(e));
-			if (n.status < 200 || n.status >= 300) return Q(Dt(n.body)) || V.error(`api import failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
+			}), n = t === null ? await L(h, m, l, g.perRequest ?? $(e)) : t.kind === "sent" ? t.res : await L(h, t.body, l, g.perRequest ?? $(e));
+			if (n.status < 200 || n.status >= 300) return Dt(Ot(n.body)) || V.error(`api import failed: HTTP ${n.status} — ${n.body.toString("utf8")}`), 1;
 			_ = JSON.parse(n.body.toString("utf8"));
 		} catch (e) {
-			if (e instanceof F) return V.error(`api import: ${Ie(e, i)}`), 1;
-			if (e instanceof P) return V.error(`api import: ${L(e)}`), 1;
+			if (e instanceof Fe) return V.error(`api import: ${Le(e, i)}`), 1;
+			if (e instanceof I) return V.error(`api import: ${Ie(e)}`), 1;
 			throw e;
 		}
-		let v = await I(`${t.replace(/\/+$/, "")}/_voltro/admin/import/start`, JSON.stringify(_.bundleKey === void 0 ? { uploadId: _.uploadId } : { bundleKey: _.bundleKey }), {
+		let v = await L(`${t.replace(/\/+$/, "")}/_voltro/admin/import/start`, JSON.stringify(_.bundleKey === void 0 ? { uploadId: _.uploadId } : { bundleKey: _.bundleKey }), {
 			...l,
 			"content-type": "application/json"
-		}, g.perRequest ?? Z(e)).catch((e) => {
-			if (e instanceof P) return V.error(`api import: ${L(e)}`), null;
+		}, g.perRequest ?? $(e)).catch((e) => {
+			if (e instanceof I) return V.error(`api import: ${Ie(e)}`), null;
 			throw e;
 		});
 		if (v === null) return 1;
-		if (v.status < 200 || v.status >= 300) return Q(Dt(v.body)) || V.error(`api import refused: HTTP ${v.status} — ${v.body.toString("utf8")}`), 1;
+		if (v.status < 200 || v.status >= 300) return Dt(Ot(v.body)) || V.error(`api import refused: HTTP ${v.status} — ${v.body.toString("utf8")}`), 1;
 		let y = JSON.parse(v.body.toString("utf8"));
 		if (y.alreadyStarted === !0 && V.info(`api import: this bundle is already being imported as ${y.runId} — watching that run instead of starting a second one`), e.includes("--detach")) return V.info(`api import: started as ${y.runId}. NOT waiting for it.\n  The outcome is not known yet — read it with:  voltro data ${ut} --target api --api-url ${t}`), 0;
 		if (y.recorded === !1) return V.warn(`api import: started as ${y.runId}, but this instance could not record the run — so its outcome\n  cannot be read back. Run \`voltro db apply\` against it so the next import is watchable.`), 0;
@@ -914,20 +944,20 @@ var Fe = /* @__PURE__ */ new Set([
 		}), 0);
 	}
 	if (!r) return V.error("a <bundleDir> is required for a direct import"), 1;
-	if (!await Qe(e)) return 1;
-	i === "replace" && e.includes("--allow-live") && !X(e, i) && V.warn(vt(!1));
-	let { store: s, snapshot: c } = await K();
+	if (!await et(e)) return 1;
+	i === "replace" && e.includes("--allow-live") && !Q(e, i) && V.warn(vt(!1));
+	let { store: s, snapshot: c } = await q();
 	c.tables.some((e) => e.name === y) || V.warn(`this target has no \`${y}\` table, so this import will not be recorded.\n  The import itself is unaffected. \`voltro db apply\` creates it.`);
-	let l = e.includes("--force"), p = (e) => V.warn(e), m = e.includes("--assets"), h = m ? O() : void 0;
+	let l = e.includes("--force"), p = (e) => V.warn(e), m = e.includes("--assets"), h = m ? k() : void 0;
 	if (m && !h) return V.error("--assets: this app has no storage provider configured, so there is nowhere to put the blobs.\n  Install `storagePlugin(...)` in app.config.ts or set STORAGE_PROVIDER, or drop the flag."), 1;
 	let g = G() === "postgres" ? (await import("@voltro/sql-postgres")).makePgCopySession(o()) : void 0;
-	if (q(r)) {
+	if (Y(r)) {
 		let t = await import("node:os"), n = await import("node:fs/promises"), { resolve: o, join: u } = await import("node:path"), d = await n.mkdtemp(u(t.tmpdir(), "voltro-import-"));
 		try {
-			let t = Y(o(process.cwd(), r)), n = J(e);
-			return n && (t = M(t, n)), await je(t, {
+			let t = Z(o(process.cwd(), r)), n = X(e);
+			return n && (t = N(t, n)), await Ae(t, {
 				dir: d,
-				blobs: ke(h ?? de())
+				blobs: Oe(h ?? ue())
 			}), Tt(e, {
 				file: r,
 				...wt(await D.runPromise(Te({
@@ -935,7 +965,7 @@ var Fe = /* @__PURE__ */ new Set([
 					bundleDir: d,
 					mode: i,
 					onConflict: a,
-					atomic: X(e, i),
+					atomic: Q(e, i),
 					...bt(e, i, r),
 					verify: !e.includes("--no-verify"),
 					targetDialect: G(),
@@ -962,7 +992,7 @@ var Fe = /* @__PURE__ */ new Set([
 		bundleDir: r,
 		mode: i,
 		onConflict: a,
-		atomic: X(e, i),
+		atomic: Q(e, i),
 		verify: !e.includes("--no-verify"),
 		targetDialect: G(),
 		allowIncompatible: l,
@@ -971,10 +1001,10 @@ var Fe = /* @__PURE__ */ new Set([
 		onWarn: p,
 		onProgress: H,
 		...Ct(e),
-		...h ? { assets: De(h) } : {},
+		...h ? { assets: Ee(h) } : {},
 		...g ? { copyLoader: g } : {}
 	})).catch((e) => {
-		if (Q(e)) return Et;
+		if (Dt(e)) return Et;
 		throw e;
 	}).finally(() => g?.close());
 	return typeof _ == "symbol" ? 1 : (Tt(e, {
@@ -982,7 +1012,7 @@ var Fe = /* @__PURE__ */ new Set([
 		...wt(_),
 		assets: _.manifest.assets.count
 	}), 0);
-}, kt = () => {
+}, At = () => {
 	let e = o();
 	return {
 		...e.url ? { url: e.url } : {},
@@ -992,23 +1022,24 @@ var Fe = /* @__PURE__ */ new Set([
 		...e.password ? { password: e.password } : {},
 		...e.database ? { database: e.database } : {}
 	};
-}, At = async (e) => {
+}, jt = async (e) => {
 	let t = W(e);
 	if (!t) return V.error("usage: voltro data backup <outDir> [--assets]  (native pg_dump/mariadb-dump/… + consistent artifact)"), 1;
-	let n = G(), r = e.includes("--assets"), { mkdir: i, writeFile: a } = await import("node:fs/promises"), { join: o } = await import("node:path"), s = await Mt(), c = r ? O() : void 0;
+	let n = G(), r = e.includes("--assets"), { mkdir: i, writeFile: a } = await import("node:fs/promises"), { join: o } = await import("node:path"), s = await Nt(), c = r ? k() : void 0;
 	if (r && !c) return V.error("--assets: this app has no storage provider configured, so there are no blobs to capture.\n  Install `storagePlugin(...)` in app.config.ts or set STORAGE_PROVIDER, or drop the\n  flag to take the rows-only dump."), 1;
 	await i(t, { recursive: !0 });
-	let l = o(t, j(n)), u = Pt(s), d = Ft(s), f = u ? await We(u, {
+	let l = o(t, M(n)), u = Ft(s), d = It(s), f = u ? await Ge(u, {
 		direction: "backup",
 		dialect: n,
 		artifact: l,
 		assets: r
-	}) : void 0, p = await Ke(Ee(ge(n, kt(), l)));
+	}) : void 0, p = await qe(F(he(n, At(), l)));
 	if (p !== void 0) return u && f && await z(u, f, { failure: p }), V.error(`native backup failed: ${p}`), 1;
-	let m = await Xe(n), h = await Ye(), g = (/* @__PURE__ */ new Date()).toISOString(), _ = async (e) => {
-		let r = Ve({
+	let m = await Qe(n), h = await Xe(), g = (/* @__PURE__ */ new Date()).toISOString(), _ = async (e) => {
+		let r = He({
 			dialect: n,
-			schemaFingerprint: m,
+			schemaFingerprint: m.live,
+			dumpFingerprint: m.dump,
 			voltroVersion: h,
 			createdAt: g,
 			assets: e
@@ -1016,10 +1047,10 @@ var Fe = /* @__PURE__ */ new Set([
 		return await a(o(t, R), `${JSON.stringify(r, null, 2)}\n`, "utf8"), r;
 	}, v = 0, y = 0, b = [], x = 0, S = 0, C = 0;
 	if (c && u) {
-		let e = o(t, k);
+		let e = o(t, A);
 		await i(e, { recursive: !0 });
-		let n = o(t, A), r = u, a = await D.runPromiseExit(_e({
-			source: Oe(c, () => rt(r)),
+		let n = o(t, j), r = u, a = await D.runPromiseExit(ge({
+			source: De(c, () => J(r)),
 			assetsDir: e,
 			progress: {
 				done: () => !1,
@@ -1027,7 +1058,7 @@ var Fe = /* @__PURE__ */ new Set([
 					try: async () => {
 						await (await import("node:fs/promises")).appendFile(n, `${JSON.stringify(t)}\n`);
 					},
-					catch: (e) => new pe({
+					catch: (e) => new fe({
 						reason: `asset index append failed: ${String(e)}`,
 						path: n
 					})
@@ -1054,17 +1085,17 @@ var Fe = /* @__PURE__ */ new Set([
 		artifact: l,
 		stamp: R,
 		schemaFingerprint: w.schemaFingerprint ?? "<none>",
-		assets: r ? `${v} key(s) → ${x} object(s), ${S} byte(s) under ${k}/ (from ${C} reference(s))` + (b.length > 0 ? ` — ${b.length} reference(s) had no object and are NOT in here` : "") : "NOT included — re-run with --assets, or use `voltro data export --assets`",
-		recorded: jt(f, d)
+		assets: r ? `${v} key(s) → ${x} object(s), ${S} byte(s) under ${A}/ (from ${C} reference(s))` + (b.length > 0 ? ` — ${b.length} reference(s) had no object and are NOT in here` : "") : "NOT included — re-run with --assets, or use `voltro data export --assets`",
+		recorded: Mt(f, d)
 	}), 0;
-}, jt = (e, t) => e?.recorded === !0 ? "voltro data transfers" : t === void 0 ? "NOT recorded (this target keeps no transfer history)" : `NOT recorded — bookkeeping was unavailable HERE, not at the target: ${t}`, Mt = async () => {
+}, Mt = (e, t) => e?.recorded === !0 ? "voltro data transfers" : t === void 0 ? "NOT recorded (this target keeps no transfer history)" : `NOT recorded — bookkeeping was unavailable HERE, not at the target: ${t}`, Nt = async () => {
 	let e;
 	try {
 		e = await i(process.cwd());
 	} catch (e) {
 		return {
 			unavailable: "store-unopenable",
-			reason: `app.config.ts could not be loaded: ${Nt(e)}`
+			reason: `app.config.ts could not be loaded: ${Pt(e)}`
 		};
 	}
 	if (!e) return { unavailable: "no-app-config" };
@@ -1073,61 +1104,77 @@ var Fe = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return {
 			unavailable: "store-unopenable",
-			reason: Nt(e)
+			reason: Pt(e)
 		};
 	}
-}, Nt = (e) => {
+}, Pt = (e) => {
 	let t = e?.message, n = typeof t == "string" && t.trim() !== "" ? t : String(e);
 	return n.split("\n")[0] ?? n;
-}, Pt = (e) => "store" in e ? e.store : void 0, Ft = (e) => "store" in e ? void 0 : e.unavailable === "no-app-config" ? "no app.config.ts was found from this directory, so there is no store to record through" : e.reason, It = async (e, t) => {
-	let n = G(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(e, j(n)), o = qe({
+}, Ft = (e) => "store" in e ? e.store : void 0, It = (e) => "store" in e ? void 0 : e.unavailable === "no-app-config" ? "no app.config.ts was found from this directory, so there is no store to record through" : e.reason, Lt = "_voltro_migration_plans", Rt = async (e, t, n) => {
+	if (!n.has(Lt)) return { kind: "no-table" };
+	try {
+		let n = (await l(e)).makeSqlLayer({ url: t }), r = (await D.runPromise(oe.SqlClient.pipe(D.flatMap((e) => e`
+          SELECT ${e("fingerprint")} FROM ${e(Lt)}
+          ORDER BY ${e("appliedAt")} DESC
+        `), D.provide(n))))[0];
+		return r === void 0 ? { kind: "empty" } : {
+			kind: "recorded",
+			fingerprint: r.fingerprint
+		};
+	} catch {
+		return { kind: "no-table" };
+	}
+}, zt = async (e, t) => {
+	let n = G(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(e, M(n)), o = Je({
 		flagUrl: U(t, "--drill-url"),
 		envUrl: process.env.DRILL_DB_URL,
-		liveKeys: nt()
+		liveKeys: rt()
 	});
 	if (!o.ok) return V.error(`restore --drill: ${o.error}`), 1;
-	let s = await i(r(e, R), "utf8").then(He, () => null);
+	let s = await i(r(e, R), "utf8").then(Ue, () => null);
 	if (s && s.dialect !== n) return V.error(`restore --drill: backup is a ${s.dialect} dump but DB_DIALECT is ${n} — cross-dialect restore is never valid.`), 1;
 	V.info("restore drill: restoring into throwaway DB", {
 		dialect: n,
 		target: B(o.url)
-	}), await D.runPromise(Ee(Ce(n, { url: o.url }, a)));
-	let c = null, l = 0;
+	}), await D.runPromise(F(Ce(n, { url: o.url }, a)));
+	let c = null, l = 0, u = /* @__PURE__ */ new Set();
 	try {
-		let e = await et(n, { url: o.url });
-		c = ce(e), l = e.tables.length;
+		let e = await nt(n, { url: o.url });
+		c = O(e), l = e.tables.length, u = new Set(e.tables.map((e) => e.name));
 	} catch (e) {
 		return V.error(`restore --drill: could not introspect the restored DB — ${String(e)}`), 1;
 	}
-	let u = Je({
-		stampFingerprint: s?.schemaFingerprint ?? null,
+	let d = Ye({
+		dumpFingerprint: s?.dumpFingerprint ?? null,
+		liveFingerprintAtBackup: s?.schemaFingerprint ?? null,
 		restoredFingerprint: c,
-		restoredTableCount: l
+		restoredTableCount: l,
+		ledger: await Rt(n, o.url, u)
 	});
-	for (let e of u.lines) u.pass ? V.info(`restore drill: ${e}`) : V.error(`restore drill: ${e}`);
-	return +!u.pass;
-}, Lt = async (e) => {
+	for (let e of d.lines) d.pass ? V.info(`restore drill: ${e}`) : V.error(`restore drill: ${e}`);
+	return +!d.pass;
+}, Bt = async (e) => {
 	let t = W(e);
 	if (!t) return V.error("usage: voltro data restore <backupDir> [--assets] [--allow-live] [--api-url <url>] [--force] [--no-marker] [--drill [--drill-url <url>]]  (native pg_restore/mariadb/…)"), 1;
-	if (e.includes("--drill")) return It(t, e);
-	if (!await Qe(e)) return 1;
-	let n = G(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(t, j(n)), o = e.includes("--assets"), s = Ue({
-		stamp: await i(r(t, R), "utf8").then(He, () => null),
+	if (e.includes("--drill")) return zt(t, e);
+	if (!await et(e)) return 1;
+	let n = G(), { join: r } = await import("node:path"), { readFile: i } = await import("node:fs/promises"), a = r(t, M(n)), o = e.includes("--assets"), s = We({
+		stamp: await i(r(t, R), "utf8").then(Ue, () => null),
 		currentDialect: n,
-		targetFingerprint: await Xe(n)
+		targetFingerprint: await Ze(n)
 	});
 	for (let e of s.info) V.info(`backup stamp: ${e}`);
 	if (s.warn && V.warn(s.warn), s.refuse) {
 		if (!e.includes("--force")) return V.error(`restore refused: ${s.refuse} (pass --force to override)`), 1;
 		V.warn(`restore proceeding despite: ${s.refuse} (--force)`);
 	}
-	let c = r(t, A), l = await i(c, "utf8").then(() => !0, () => !1);
-	if (o && !l) return V.error(`--assets: this backup carries no assets — there is no ${A} in ${t}.\n  It was taken without --assets, so its rows will reference blobs this restore cannot
+	let c = r(t, j), l = await i(c, "utf8").then(() => !0, () => !1);
+	if (o && !l) return V.error(`--assets: this backup carries no assets — there is no ${j} in ${t}.\n  It was taken without --assets, so its rows will reference blobs this restore cannot
   put back. Restore from a backup taken with --assets, or drop the flag to accept that.`), 1;
 	!o && l && V.warn("this backup CARRIES assets and --assets was not passed: the rows will be restored and the blobs will not. Pass --assets to restore both.");
-	let u = await Mt(), d = o ? O() : void 0;
+	let u = await Nt(), d = o ? k() : void 0;
 	if (o && !d) return V.error("--assets: this app has no storage provider configured, so there is nowhere to put the blobs.\n  Install `storagePlugin(...)` in app.config.ts or set STORAGE_PROVIDER, or drop the flag."), 1;
-	let f = Ft(u), p = e.includes("--no-marker"), m = Pt(u), h = m ? await Ge(m, { artifact: a }) : void 0, g = f === void 0 ? h === void 0 ? `the marker row could not be written to \`${b}\` (run \`voltro db apply\` so the table exists)` : void 0 : `bookkeeping is unavailable: ${f}`;
+	let f = It(u), p = e.includes("--no-marker"), m = Ft(u), h = m ? await Ke(m, { artifact: a }) : void 0, g = f === void 0 ? h === void 0 ? `the marker row could not be written to \`${b}\` (run \`voltro db apply\` so the table exists)` : void 0 : `bookkeeping is unavailable: ${f}`;
 	if (g !== void 0 && !p) return V.error(`refusing to restore: the in-progress marker cannot be written.
   reason: ${g}\n  The marker is one row in \`${b}\`, written before the first\n  destructive statement so a killed restore refuses the next boot instead of serving a
   half-loaded database. Without it this restore has no guard at all.
@@ -1136,20 +1183,20 @@ var Fe = /* @__PURE__ */ new Set([
 	g !== void 0 && V.warn(`--no-marker: restoring with NO in-progress marker. If this run does not finish, nothing
   will stop the next boot from serving a half-loaded database.
   ${g}`);
-	let _ = m ? await We(m, {
+	let _ = m ? await Ge(m, {
 		direction: "restore",
 		dialect: n,
 		artifact: a,
 		assets: o
-	}) : void 0, v = await Ke(Ee(Ce(n, kt(), a))), y = h === void 0 ? "lost" : await h.reassert();
+	}) : void 0, v = await qe(F(Ce(n, At(), a))), y = h === void 0 ? "lost" : await h.reassert();
 	if (y === "rewritten" ? V.warn(`the restore artefact removed the in-progress marker (it carries \`${b}\`) — it has been written back.\n  Backups taken from this version on exclude that table, so this only affects older
   and hand-made dumps.`) : y === "lost" && V.error(`the restore artefact removed the in-progress marker and it could NOT be written back.\n  \`${b}\` is unwritable, so if this restore does not finish,\n  nothing will stop the next boot from serving a half-loaded database. Check the
   result of this command before you start the app.`), v !== void 0) return m && _ && await z(m, _, { failure: v }), V.error(`native restore failed: ${v}\n` + (y === "lost" ? "  This database is now in an unknown state and NOTHING WILL STOP THE NEXT BOOT — see above.\n" : "  This database is now in an unknown state and the next boot will REFUSE, by design.\n") + "  Re-run the restore to completion, or clear the marker deliberately with\n  `voltro data clear-replace-marker --yes` once you have decided the state is correct."), 1;
 	let x = 0, S = 0;
 	if (d) {
 		let e = await D.runPromiseExit(Se({
-			sink: De(d),
-			assetsDir: r(t, k),
+			sink: Ee(d),
+			assetsDir: r(t, A),
 			indexPath: c
 		}));
 		if (e._tag === "Failure") {
@@ -1163,9 +1210,9 @@ var Fe = /* @__PURE__ */ new Set([
 		dialect: n,
 		artifact: a,
 		assets: o ? `${x} key(s) restored from ${S} object(s)` : "not restored (no --assets)",
-		recorded: jt(_, f)
+		recorded: Mt(_, f)
 	}), 0;
-}, Rt = async (e) => {
+}, Vt = async (e) => {
 	let t = W(e);
 	if (!t) return V.error("usage: voltro data inspect <file.vbundle|dir> [--json] [--passphrase <p>]"), 1;
 	let { resolve: n, join: r } = await import("node:path"), i = await import("node:fs/promises"), a = n(process.cwd(), t);
@@ -1178,38 +1225,63 @@ var Fe = /* @__PURE__ */ new Set([
 		let s = await i.readFile(n, "utf8").catch(() => void 0);
 		return s === void 0 ? (V.error(`'${t}' is a directory but holds no manifest.json — is it an unpacked bundle? (a bundle exported with --target api is always unpacked into a directory, even when the path ends in .vbundle)`), 1) : (console.log(s), 0);
 	}
-	let o = J(e), s = () => {
-		let e = Y(a);
-		return o ? M(e, o) : e;
+	let o = X(e), s = () => {
+		let e = Z(a);
+		return o ? N(e, o) : e;
 	};
 	if (e.includes("--json")) {
-		let e = (await N(s(), ["manifest.json"])).get("manifest.json");
+		let e = (await P(s(), ["manifest.json"])).get("manifest.json");
 		return e ? (console.log(e.toString("utf8")), 0) : (V.error("no manifest.json found in the bundle"), 1);
 	}
-	let c = (await N(s(), ["README.md"])).get("README.md");
+	let c = (await P(s(), ["README.md"])).get("README.md");
 	if (c) return console.log(c.toString("utf8")), 0;
-	let l = (await N(s(), ["manifest.json"])).get("manifest.json");
+	let l = (await P(s(), ["manifest.json"])).get("manifest.json");
 	return l ? (console.log(l.toString("utf8")), 0) : (V.error("bundle has no README.md or manifest.json"), 1);
-}, zt = async (e) => {
-	let { REPLACE_IN_PROGRESS_TABLE: t } = await import("@voltro/database"), { interruptedReplaceAtBoot: n } = await import("./interruptedReplace-CvmiAM9K.js"), { store: r } = await K(), i = await n(r);
+}, Ht = async (e) => {
+	let { REPLACE_IN_PROGRESS_TABLE: t } = await import("@voltro/database"), { interruptedReplaceAtBoot: n } = await import("./interruptedReplace-qzmFI020.js"), { store: r } = await q(), i = await n(r);
 	if (i === void 0) return V.info("no interrupted replace is recorded — nothing to clear"), 0;
 	if (!e.includes("--yes")) return V.error(`${i}\n\n  Re-run with --yes to clear it.`), 1;
-	let a = await r.query({
+	let a = (await r.query({
 		table: t,
 		predicate: void 0,
 		order: [],
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	});
+	})).filter((e) => String(e.kind ?? "replace") !== "staging");
 	for (let e of a) await r.delete(t, String(e.id));
 	return V.info(`cleared ${a.length} interrupted-replace marker(s) — the next boot will start`), 0;
-}, Bt = async (e) => {
-	let { STAGING_PREFIX: t, dropStagingSql: n, execStatements: r } = await import("@voltro/data-transfer"), { store: i } = await K(), a = G();
+}, Ut = async (e) => {
+	let { STAGING_PREFIX: t, dropStagingSql: n, execStatements: r } = await import("@voltro/data-transfer"), { store: i } = await q(), a = G();
 	if (a !== "postgres" && a !== "mysql" && a !== "mariadb" && a !== "sqlite" && a !== "mssql") return V.error(`this store has no staging tables to clear (dialect: ${a})`), 1;
 	let { introspectSchema: o } = await import("@voltro/database/sql"), s = (await i.run((await import("@effect/sql")).SqlClient.SqlClient.pipe((await import("effect")).Effect.flatMap(o)))).tables.map((e) => e.name).filter((e) => e.startsWith(t));
-	return s.length === 0 ? (V.info("no staging tables are present — nothing to clear"), 0) : e.includes("--yes") ? (await r(i, s.map((e) => n(e.slice(t.length), a))), V.info(`dropped ${s.length} staging table(s)`), 0) : (V.error(`${s.length} staging table(s) from an earlier \`--mode replace\`:\n` + s.map((e) => `    ${e}`).join("\n") + "\n\n  Each holds a copy of what a run was loading. Nothing else removes them.\n  Make sure no import is running right now — this cannot tell a leftover from one in flight.\n  Re-run with --yes to drop them."), 1);
-}, Vt = async (e) => {
+	if (s.length === 0) return V.info("no staging tables are present — nothing to clear"), 0;
+	let { REPLACE_IN_PROGRESS_TABLE: c, stagingNamesOf: l } = await import("@voltro/database"), u = await (async () => {
+		try {
+			return (await i.query({
+				table: c,
+				predicate: void 0,
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0
+			})).filter((e) => String(e.kind ?? "") === "staging");
+		} catch {
+			return [];
+		}
+	})(), d = /* @__PURE__ */ new Map();
+	for (let e of u) for (let t of l(e.staging)) d.set(t, e);
+	let f = (e) => {
+		let t = d.get(e);
+		if (t === void 0) return `${e} — no run claims it (an orphan, or from before the marker)`;
+		let n = t.heartbeatAt, r = n == null ? "never" : `${Math.max(0, Math.round((Date.now() - new Date(String(n)).getTime()) / 6e4))} min ago`;
+		return `${e} — ${t.resumable === !0 || t.resumable === 1 ? "RESUMABLE: a `--no-atomic` re-run continues from it" : "from an interrupted run"}, last active ${r}`;
+	};
+	if (!e.includes("--yes")) return V.error(`${s.length} staging table(s) from an earlier \`--mode replace\`:\n` + s.map((e) => `    ${f(e)}`).join("\n") + "\n\n  Each holds a copy of what a run was loading. Nothing else removes them.\n  A RESUMABLE one is a resume point — dropping it makes the next run reload the whole bundle.\n  Re-run with --yes to drop them all."), 1;
+	await r(i, s.map((e) => n(e.slice(t.length), a)));
+	for (let e of u) l(e.staging).some((e) => s.includes(e)) && await i.delete(c, String(e.id)).catch(() => void 0);
+	return V.info(`dropped ${s.length} staging table(s)`), 0;
+}, Wt = async (e) => {
 	let { describeTransferRun: t, DATA_TRANSFERS_TABLE: n } = await import("@voltro/database"), r = Number(U(e, "--limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20;
 	if (U(e, "--target") === "api") {
 		let t = U(e, "--api-url");
@@ -1226,7 +1298,7 @@ var Fe = /* @__PURE__ */ new Set([
 		for (let e of s) V.info(`  ${e.line ?? ""}`);
 		return 0;
 	}
-	let { store: a } = await K(), o;
+	let { store: a } = await q(), o;
 	try {
 		o = await a.query({
 			table: n,
@@ -1252,15 +1324,15 @@ var Fe = /* @__PURE__ */ new Set([
 		})}`);
 	}
 	return 0;
-}, Ht = async (e) => {
+}, Gt = async (e) => {
 	let t = W(e), n = W(e.filter((e) => e !== t));
 	if (!t || !n) return V.error("usage: voltro data unpack <file.vbundle> <dir> [--passphrase <p>]"), 1;
-	let { resolve: r } = await import("node:path"), i = Y(r(process.cwd(), t)), a = J(e);
-	return a && (i = M(i, a)), await Me(i, r(process.cwd(), n)), V.info("unpack complete", {
+	let { resolve: r } = await import("node:path"), i = Z(r(process.cwd(), t)), a = X(e);
+	return a && (i = N(i, a)), await je(i, r(process.cwd(), n)), V.info("unpack complete", {
 		file: t,
 		dir: n
 	}), 0;
-}, $ = {
+}, Kt = {
 	export: {
 		common: [
 			"--target",
@@ -1341,40 +1413,40 @@ var Fe = /* @__PURE__ */ new Set([
 		"--drill-url",
 		"--api-url"
 	] }
-}, Ut = (e) => e.split("=")[0], Wt = (e, t) => {
-	let n = $[e];
+}, qt = (e) => e.split("=")[0], Jt = (e, t) => {
+	let n = Kt[e];
 	if (!n) return;
 	let r = U(t, "--target") === "api" ? "api" : "direct", i = /* @__PURE__ */ new Set([...n.common, ...r === "api" ? n.apiOnly ?? [] : n.directOnly ?? []]), a = new Set(r === "api" ? n.directOnly ?? [] : n.apiOnly ?? []);
 	for (let n of t) {
 		if (!n.startsWith("--")) continue;
-		let t = Ut(n);
+		let t = qt(n);
 		if (i.has(t)) continue;
 		if (a.has(t)) return `voltro data ${e}: ${t} is not read with --target ${r} (it is a --target ${r === "api" ? "direct" : "api"} flag). Remove it, or change --target.`;
-		let o = Object.entries($).filter(([n, r]) => n !== e && [
+		let o = Object.entries(Kt).filter(([n, r]) => n !== e && [
 			...r.common,
 			...r.directOnly ?? [],
 			...r.apiOnly ?? []
 		].includes(t)).map(([e]) => e);
 		return o.length > 0 ? `voltro data ${e}: ${t} is not a \`${e}\` flag (it belongs to \`voltro data ${o.join("` / `")}\`). Remove it.` : `voltro data ${e}: unknown flag ${t}. Run \`voltro data --help\` for the flags this command reads.`;
 	}
-}, Gt = {
+}, Yt = {
 	export: xt,
-	import: Ot,
-	transfers: Vt,
-	inspect: Rt,
-	unpack: Ht,
-	backup: At,
-	restore: Lt,
-	"clear-replace-marker": zt,
-	"clear-staging": Bt
-}, Kt = async (n) => {
+	import: kt,
+	transfers: Wt,
+	inspect: Vt,
+	unpack: Gt,
+	backup: jt,
+	restore: Bt,
+	"clear-replace-marker": Ht,
+	"clear-staging": Ut
+}, Xt = async (n) => {
 	let [r, ...i] = n;
-	if (r !== void 0 && $[r] !== void 0) {
-		let e = Wt(r, i);
+	if (r !== void 0 && Kt[r] !== void 0) {
+		let e = Jt(r, i);
 		if (e) return V.error(e), 2;
 	}
-	let a = r === void 0 ? void 0 : Gt[r];
+	let a = r === void 0 ? void 0 : Yt[r];
 	return a === void 0 ? (V.error(`usage: voltro data ${e(t)} … (logical: export/import; native: backup/restore; \`imports\` reads the history, incl. a run in flight)`), r ? 2 : 1) : a(i);
 };
 //#endregion
-export { Kt as runDataCommand };
+export { Xt as runDataCommand };