@voltro/data-transfer 0.1.0

package/dist/index.js

@@ -0,0 +1,1501 @@
+import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Schedule as o, Schema as s, Stream as c } from "effect";
+import { eq as l, inSet as u, isNotNull as d, or as f, streamTable as p } from "@voltro/database";
+import { fingerprintSchema as m } from "@voltro/database/sql";
+import { createCipheriv as h, createDecipheriv as g, createHash as _, createHmac as v, randomBytes as y, scrypt as b } from "node:crypto";
+import { STORAGE_REFS_TABLE as x, fromNodeReadable as S, getObjectStream as C, putObjectStream as ee, toNodeReadable as te } from "@voltro/plugin-storage";
+import * as w from "node:zlib";
+import { PassThrough as T, Readable as ne } from "node:stream";
+import { copyFile as re, createReadStream as E, createWriteStream as ie } from "node:fs";
+import { mkdir as ae, readdir as oe, stat as se } from "node:fs/promises";
+import { dirname as ce, join as D, resolve as le, sep as ue } from "node:path";
+import { promisify as de } from "node:util";
+import { spawn as fe } from "node:child_process";
+//#region src/consistency.ts
+var pe = (e) => {
+	switch (e) {
+		case "postgres": return ["SET TRANSACTION ISOLATION LEVEL REPEATABLE READ"];
+		case "mysql":
+		case "mariadb": return ["SET TRANSACTION ISOLATION LEVEL REPEATABLE READ"];
+		case "mssql": return ["SET TRANSACTION ISOLATION LEVEL SNAPSHOT"];
+		case "sqlite":
+		case "turso": return [];
+		default: return [];
+	}
+}, me = {
+	email: { fake: "email" },
+	fullName: { fake: "fullName" },
+	firstName: { fake: "firstName" },
+	lastName: { fake: "lastName" },
+	username: { fake: "username" },
+	phone: { fake: "phone" },
+	address: { fake: "address" },
+	company: { fake: "company" },
+	url: { fake: "url" },
+	ip: { fake: "ip" },
+	creditCard: { fake: "creditCard" },
+	date: "dateShift",
+	secret: "null",
+	freeText: "redact"
+}, O = (e) => {
+	let t = {};
+	for (let n of e.tables) {
+		let e = {};
+		for (let t of n.columns) e[t.name] = {
+			...t.sensitive ? { sensitive: t.sensitive } : {},
+			...t.safe ? { safe: !0 } : {},
+			columnType: t.type
+		};
+		t[n.name] = e;
+	}
+	return t;
+}, he = (e, t, n, r) => {
+	let i = r.columns?.[`${e}.${t}`];
+	if (i) return i;
+	if (n?.sensitive) {
+		let e = n.sensitive.class;
+		return r.classes?.[e] ?? me[e] ?? "redact";
+	}
+	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
+}, k = (e, t) => v("sha256", e).update(t == null ? "∅" : String(t)).digest(), A = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), j = [
+	"Ada",
+	"Alan",
+	"Grace",
+	"Linus",
+	"Ida",
+	"Ken",
+	"Barbara",
+	"Dennis",
+	"Radia",
+	"Guido",
+	"Margaret",
+	"Bjarne"
+], ge = [
+	"Lovelace",
+	"Turing",
+	"Hopper",
+	"Torvalds",
+	"Rhodes",
+	"Thompson",
+	"Liskov",
+	"Ritchie",
+	"Perlman",
+	"Rossum",
+	"Hamilton",
+	"Stroustrup"
+], _e = [
+	"Maple",
+	"Oak",
+	"Cedar",
+	"Pine",
+	"Elm",
+	"Birch",
+	"Willow",
+	"Ash"
+], ve = [
+	"Initech",
+	"Hooli",
+	"Umbrella",
+	"Acme",
+	"Globex",
+	"Soylent",
+	"Stark",
+	"Wayne"
+], M = (e, t, n) => e[A(t, n) % e.length], ye = (e, t, n) => {
+	let r = k(n, `${e}:${String(t)}`), i = A(r, 1) % 1e4;
+	switch (e) {
+		case "email": return `${M(j, r, 0).toLowerCase()}.${M(ge, r, 2).toLowerCase()}${i}@example.com`;
+		case "fullName": return `${M(j, r, 0)} ${M(ge, r, 1)}`;
+		case "firstName": return M(j, r, 0);
+		case "lastName": return M(ge, r, 1);
+		case "username": return `${M(j, r, 0).toLowerCase()}${i}`;
+		case "phone": return `+1${String(A(r, 0) % 1e10).padStart(10, "0")}`;
+		case "address": return `${A(r, 0) % 9899 + 100} ${M(_e, r, 1)} St`;
+		case "company": return M(ve, r, 0);
+		case "url": return `https://example.com/${r.toString("hex").slice(0, 12)}`;
+		case "ip": return `${A(r, 0) % 256}.${A(r, 1) % 256}.${A(r, 2) % 256}.${A(r, 3) % 254 + 1}`;
+		case "creditCard": return be(`4${r.toString("hex").replace(/\D/g, "").padEnd(14, "0").slice(0, 14)}`);
+		default: return `${e}_${r.toString("hex").slice(0, 8)}`;
+	}
+}, be = (e) => {
+	let t = e.slice(0, 15).split("").map(Number), n = 0;
+	t.forEach((e, t) => {
+		let r = e;
+		(15 - t) % 2 == 1 && (r *= 2, r > 9 && (r -= 9)), n += r;
+	});
+	let r = (10 - n % 10) % 10;
+	return e.slice(0, 15) + String(r);
+}, xe = 864e5, Se = (e, t) => {
+	let n = e instanceof Date ? e.getTime() : Date.parse(String(e));
+	if (Number.isNaN(n)) return e;
+	let r = A(k(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * xe);
+	return e instanceof Date ? i : i.toISOString();
+}, Ce = (e, t) => {
+	if (t.value === null || t.value === void 0) return null;
+	if (e === "error") throw Error(`masking: unresolved 'error' action for ${t.table}.${t.column}`);
+	return e === "keep" ? t.value : e === "null" ? null : e === "redact" ? t.columnType === "text" || typeof t.value == "string" ? "[redacted]" : null : e === "hash" ? k(t.seed, t.value).toString("hex").slice(0, 16) : e === "dateShift" ? Se(t.value, t.seed) : typeof e == "object" && "fake" in e ? ye(e.fake, t.value, t.seed) : typeof e == "object" && "custom" in e ? e.custom(t) : t.value;
+}, N = (e, t, n) => {
+	let r = {}, i = [];
+	for (let a of e) for (let e of a.columns) {
+		let o = `${a.name}.${e.name}`, s = he(a.name, e.name, t[a.name]?.[e.name], n);
+		s === "error" ? i.push(o) : r[o] = s;
+	}
+	return {
+		actions: r,
+		unclassified: i
+	};
+}, we = [
+	{
+		name: "email",
+		re: /[\w.+-]+@[\w-]+\.[\w.-]+/
+	},
+	{
+		name: "phone",
+		re: /(?:\+?\d[\d\s().-]{8,}\d)/
+	},
+	{
+		name: "ipv4",
+		re: /\b(?:\d{1,3}\.){3}\d{1,3}\b/
+	},
+	{
+		name: "creditCard",
+		re: /\b(?:\d[ -]?){13,16}\b/
+	}
+], Te = (e, t, n) => {
+	let r = [], i = /* @__PURE__ */ new Set();
+	for (let [a, o] of Object.entries(n)) {
+		if (!a.startsWith(`${t}.`) || o !== "keep") continue;
+		let n = a.slice(t.length + 1);
+		for (let a of e) {
+			let e = a[n];
+			if (typeof e != "string" || e.length === 0) continue;
+			let o = we.find((t) => t.re.test(e));
+			if (o && !i.has(n)) {
+				i.add(n), r.push({
+					table: t,
+					column: n,
+					pattern: o.name,
+					sample: e.slice(0, 40)
+				});
+				break;
+			}
+		}
+	}
+	return r;
+}, P = (e, t, n, r, i) => {
+	let a = {};
+	for (let [o, s] of Object.entries(e)) a[o] = Ce(n[`${t}.${o}`] ?? "keep", {
+		value: s,
+		table: t,
+		column: o,
+		seed: r,
+		...i?.[o] ? { columnType: i[o] } : {}
+	});
+	return a;
+}, F = class extends s.TaggedError()("BundleError", {
+	reason: s.String,
+	path: s.optional(s.String)
+}) {}, Ee = class extends s.TaggedError()("CodecError", {
+	table: s.String,
+	reason: s.String
+}) {}, I = class extends s.TaggedError()("IntegrityError", {
+	what: s.String,
+	expected: s.String,
+	actual: s.String
+}) {}, De = class extends t.TaggedError("CompressionError") {}, Oe = class extends s.TaggedError()("ScopeError", { reason: s.String }) {}, ke = class extends s.TaggedError()("DanglingReferenceError", {
+	rows: s.Array(s.Struct({
+		table: s.String,
+		id: s.String,
+		reason: s.String
+	})),
+	totalCount: s.Number
+}) {}, Ae = class extends s.TaggedError()("SchemaDriftError", {
+	bundleFingerprint: s.String,
+	targetFingerprint: s.String,
+	diff: s.Array(s.String)
+}) {}, L = class extends t.TaggedError("NativeToolError") {}, je = class extends s.TaggedError()("MaskingError", { unclassified: s.Array(s.String) }) {}, Me = class extends s.TaggedError()("ImportModeError", {
+	mode: s.String,
+	reason: s.String
+}) {}, Ne = class extends s.TaggedError()("CrossDialectError", {
+	sourceDialect: s.String,
+	targetDialect: s.String,
+	blocking: s.Array(s.String)
+}) {}, R = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", Pe = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.references).map((e) => ({
+	col: e.name,
+	refTable: e.references.table
+})), Fe = (e, t, r) => n.gen(function* () {
+	let i = r.maxDepth ?? 12, a = new Set(r.pinned ?? []), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), d = (e) => {
+		let t = s.get(e) ?? /* @__PURE__ */ new Set();
+		return s.set(e, t), t;
+	}, m = (e, t) => {
+		if (t == null || a.has(e) || s.get(e)?.has(t)) return;
+		let n = l.get(e) ?? /* @__PURE__ */ new Set();
+		n.add(t), l.set(e, n);
+	}, h = (e, t, n) => {
+		let r = d(e), i = a.has(e) ? void 0 : o.get(e) ?? (() => {
+			let t = /* @__PURE__ */ new Set();
+			return o.set(e, t), t;
+		})();
+		return (e) => {
+			r.add(e[t]), i?.add(e[t]);
+			for (let t of n) m(t.refTable, e[t.col]);
+		};
+	}, g = (r, i) => {
+		let a = h(r, R(t, r), Pe(t, r));
+		return c.runForEach(p(e, {
+			table: r,
+			pk: R(t, r),
+			...i === void 0 ? {} : { where: i }
+		}), (e) => n.sync(() => a(e)));
+	}, _ = n.gen(function* () {
+		for (let e = 0; e < i && l.size > 0; e++) {
+			let e = [...l.entries()];
+			l.clear();
+			for (let [n, r] of e) {
+				let e = [...r].filter((e) => !s.get(n)?.has(e));
+				e.length !== 0 && (yield* g(n, u(R(t, n), e)));
+			}
+		}
+	});
+	for (let [e, t] of Object.entries(r.seeds)) yield* g(e, t);
+	if (yield* _, r.children) {
+		let e = new Set(r.children === !0 ? [...s.keys()] : r.children.roots.filter((e) => s.has(e)));
+		for (let n = 0; n < i; n++) {
+			let n = !1, r = [];
+			for (let i of t.tables) {
+				let t = i.name, a = i.columns.map((e) => ({
+					col: e.name,
+					refTable: e.references?.table
+				})).filter((t) => !!t.refTable && e.has(t.refTable) && (s.get(t.refTable)?.size ?? 0) > 0);
+				if (a.length === 0) continue;
+				let o = s.get(t)?.size ?? 0, c = a.map((e) => u(e.col, [...s.get(e.refTable)]));
+				yield* g(t, c.length === 1 ? c[0] : f(...c)), (s.get(t)?.size ?? 0) > o && !e.has(t) && r.push(t), (s.get(t)?.size ?? 0) > o && (n = !0);
+			}
+			for (let t of r) e.add(t);
+			if (yield* _, !n) break;
+		}
+	}
+	return o;
+}), Ie = (e, t) => ({
+	tables: [...e.keys()],
+	predicateFor: (n) => {
+		let r = e.get(n);
+		return r ? u(R(t, n), [...r]) : void 0;
+	}
+}), z = "tenantId", Le = (e, t, r) => n.gen(function* () {
+	let i = t.tables.map((e) => e.name), a = new Map(t.tables.map((e) => [e.name, e]));
+	if (e.kind === "all") return {
+		tables: i,
+		predicateFor: () => void 0
+	};
+	if (e.kind === "tables") {
+		let t = new Set(e.tables ?? []);
+		return {
+			tables: i.filter((e) => t.has(e)),
+			predicateFor: () => void 0
+		};
+	}
+	let o = e.tenantId;
+	if (o === void 0 || o === "") return yield* n.fail(new Oe({ reason: "scope { kind: 'tenant' } requires a tenantId — pass --tenant <id> (CLI) or scope.tenantId (API). Refusing to fall back to an unfiltered export." }));
+	let s = r.tenantTables ? r.tenantTables.filter((e) => a.has(e)) : i.filter((e) => a.get(e)?.columns.some((e) => e.name === z) ?? !1);
+	if (s.length === 0) return yield* n.fail(new Oe({ reason: r.tenantTables ? "tenant scope: none of the provided tenantTables exist in the schema — nothing to filter." : `tenant scope: no table carries a '${z}' column — nothing to filter. A tenant export of a schema without tenant-scoped tables would be the full database; refusing.` }));
+	let c = yield* Fe(r.store, t, {
+		seeds: Object.fromEntries(s.map((e) => [e, l(z, o)])),
+		pinned: s,
+		children: { roots: s }
+	}), d = [...c.entries()].filter(([, e]) => e.size > 0).map(([e]) => e), f = new Set(s);
+	return {
+		tables: [...s, ...d],
+		predicateFor: (e) => f.has(e) ? l(z, o) : c.has(e) ? u(R(t, e), [...c.get(e)]) : void 0
+	};
+}), Re = (e, t) => ({
+	list: t,
+	open: (t) => C(e, t)
+}), ze = (e) => ({
+	write: (t, n, r) => ee(e, t, n, r),
+	has: (t) => e.head(t).pipe(n.map((e) => e !== null))
+}), Be = (e, t) => n.tryPromise({
+	try: async () => {
+		let { createWriteStream: n } = await import("node:fs"), r = await import("node:fs/promises"), { createHash: i, randomUUID: a } = await import("node:crypto"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = await import("node:path"), l = c.join(t, `.tmp-${a()}`), u = i("sha256"), d = 0, f = new s({ transform(e, t, n) {
+			u.update(e), d += e.length, n(null, e);
+		} });
+		await o(await te(e.stream), f, n(l));
+		let p = u.digest("hex"), m = c.join(t, p);
+		try {
+			await r.access(m), await r.rm(l, { force: !0 });
+		} catch {
+			await r.rename(l, m);
+		}
+		return {
+			sha256: p,
+			size: d,
+			contentType: e.contentType
+		};
+	},
+	catch: (e) => new F({
+		reason: `asset write failed: ${String(e?.message ?? e)}`,
+		path: t
+	})
+}), Ve = (e, t, r) => n.gen(function* () {
+	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), l = o("sha256"), u = S("bundle", () => a(s)).pipe(c.tap((e) => n.sync(() => l.update(e))));
+	yield* e.write(r.key, u, {
+		contentType: r.contentType,
+		totalSize: r.size
+	});
+	let d = l.digest("hex");
+	if (d !== r.sha256) return yield* n.fail(new I({
+		what: `asset ${r.key}`,
+		expected: r.sha256,
+		actual: d
+	}));
+}), He = () => typeof w.createZstdCompress == "function", Ue = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : He() ? "zstd" : "gzip", We = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", Ge = (e) => e === "zstd" ? w.createZstdCompress() : e === "gzip" ? w.createGzip() : new T(), Ke = (e) => e === "zstd" ? w.createZstdDecompress() : e === "gzip" ? w.createGunzip() : new T(), qe = 1, Je = s.Struct({
+	name: s.String,
+	file: s.String,
+	rowCount: s.Number,
+	checksum: s.String,
+	columnTypes: s.Record({
+		key: s.String,
+		value: s.String
+	}),
+	primaryKey: s.String
+}), Ye = s.Struct({
+	kind: s.Literal("all", "tenant", "tables"),
+	tenantId: s.optional(s.String),
+	tables: s.optional(s.Array(s.String))
+}), Xe = s.Struct({
+	count: s.Number,
+	totalBytes: s.Number,
+	index: s.optional(s.String)
+});
+s.Struct({
+	key: s.String,
+	sha256: s.String,
+	size: s.Number,
+	contentType: s.String
+});
+var Ze = s.Struct({
+	formatVersion: s.Number,
+	createdAt: s.String,
+	source: s.Struct({
+		dialect: s.String,
+		schemaFingerprint: s.String
+	}),
+	scope: Ye,
+	consistency: s.Literal("live", "snapshot"),
+	compression: s.Literal("zstd", "gzip", "none"),
+	tables: s.Array(Je),
+	assets: Xe,
+	masking: s.optional(s.Struct({
+		policyId: s.optional(s.String),
+		transformed: s.Array(s.String)
+	}))
+}), Qe = s.encodeSync(s.parseJson(Ze)), $e = s.decodeUnknownSync(s.parseJson(Ze)), B = "manifest.json", et = "README.md", V = "data", H = "assets", U = "assets/index.ndjson", tt = ".ledger.json", nt = (e) => e.kind === "tenant" ? `tenant \`${e.tenantId}\`` : e.kind === "tables" ? `tables \`${(e.tables ?? []).join(", ")}\`` : "all tables", rt = (e, t) => {
+	let n = e.tables.reduce((e, t) => e + t.rowCount, 0), r = e.masking ? `✅ **Masked at the source** — ${e.masking.transformed.length} column(s) transformed${e.masking.policyId ? ` (policy \`${e.masking.policyId}\`)` : ""}. Personal data was replaced with realistic, referentially-consistent fakes before any byte was written.` : "⚠️ **NOT masked — this bundle contains REAL data (PII included).** Treat it as production data: do not copy it into a lower environment or share it without review. To produce a safe copy, re-export under a masking profile (`--profile`).", i = e.masking && e.masking.transformed.length > 0 ? `\n\nMasked columns: ${e.masking.transformed.map((e) => `\`${e}\``).join(", ")}.` : "", a = e.assets.count > 0 ? `${e.assets.count} object(s), ${e.assets.totalBytes} bytes` : "none", o = e.tables.map((e) => `| \`${e.name}\` | ${e.rowCount} |`).join("\n");
+	return `# Voltro data export
+
+The machine-readable manifest is \`manifest.json\`; this file is a human summary.
+
+| | |
+|---|---|
+| **Generated** | ${e.createdAt} |
+| **Exported from** | \`${t.hostname}\` |
+| **Source dialect** | \`${e.source.dialect}\` |
+| **Format version** | ${e.formatVersion} |
+| **Consistency** | ${e.consistency} |
+| **Compression** | ${e.compression} |
+| **Scope** | ${nt(e.scope)} |
+| **Tables** | ${e.tables.length} |
+| **Rows (total)** | ${n} |
+| **Assets** | ${a} |
+
+## Data sensitivity
+
+${r}${i}
+
+## Tables
+
+| Table | Rows |
+|---|---|
+${o}
+
+## Restore
+
+\`\`\`bash
+# into a stopped/replica DB directly:
+voltro data import <this-directory>
+
+# or into a running instance (needs the data-transfer secret):
+voltro data import <this-directory> --target api --api-url <url> --token <secret>
+\`\`\`
+`;
+}, it = i.counter("voltro_data_transfer_rows", { description: "Rows exported/imported by @voltro/data-transfer, tagged by phase + table." }), at = a.exponential({
+	start: .01,
+	factor: 2,
+	count: 16
+}), ot = i.histogram("voltro_data_transfer_table_seconds", at, "Per-table export/import duration in seconds, tagged by phase."), W = (e, t) => {
+	if (e) try {
+		e(t);
+	} catch {}
+}, st = (e, t, r, a, o, s) => n.Do.pipe(n.bind("start", () => n.clockWith((e) => e.currentTimeMillis)), n.bind("result", () => s), n.tap(({ start: r, result: a }) => n.clockWith((e) => e.currentTimeMillis).pipe(n.flatMap((s) => n.zipRight(ot.pipe(i.tagged("phase", e), i.update((s - r) / 1e3)), it.pipe(i.tagged("phase", e), i.tagged("table", t), i.update(o(a))))))), n.map(({ result: e }) => e), n.withSpan(`data-transfer.${e}.table`, { attributes: {
+	table: t,
+	index: r,
+	tableCount: a,
+	phase: e
+} })), ct = () => ({
+	tables: {},
+	assets: {}
+}), G = (e) => n.tryPromise(async () => {
+	let t = await (await import("node:fs/promises")).readFile(e, "utf8");
+	return JSON.parse(t);
+}).pipe(n.orElseSucceed(ct)), K = (e, t) => n.tryPromise({
+	try: async () => {
+		let n = await import("node:fs/promises"), { randomUUID: r } = await import("node:crypto"), i = `${e}.tmp-${r()}`;
+		await n.writeFile(i, JSON.stringify(t)), await n.rename(i, e);
+	},
+	catch: (t) => new F({
+		reason: `ledger write failed: ${String(t?.message ?? t)}`,
+		path: e
+	})
+}), lt = (e, t) => t in e.tables, ut = (e, t) => t in e.assets, dt = /* @__PURE__ */ new Set([
+	"json",
+	"array",
+	"vector"
+]), ft = (e) => typeof e == "object" && !!e && !Array.isArray(e) && typeof e.$v == "string", pt = (e) => Buffer.from(e).toString("base64"), mt = (e) => new Uint8Array(Buffer.from(e, "base64")), ht = (e) => e instanceof Date ? e.toISOString() : typeof e == "number" ? new Date(e).toISOString() : String(e), gt = (e, t) => e == null ? null : t !== void 0 && dt.has(t) ? e : t === "bytes" ? pt(e) : t === "timestamp" || t === "date" ? ht(e) : typeof e == "bigint" ? {
+	$v: "bigint",
+	d: e.toString()
+} : typeof e == "number" && !Number.isFinite(e) ? {
+	$v: "number",
+	d: String(e)
+} : e instanceof Date ? {
+	$v: "date",
+	d: e.toISOString()
+} : e instanceof Uint8Array ? {
+	$v: "bytes",
+	d: pt(e)
+} : e, _t = (e) => {
+	switch (e.$v) {
+		case "bigint": return BigInt(e.d);
+		case "number": return Number(e.d);
+		case "date": return new Date(e.d);
+		case "bytes": return mt(e.d);
+		default: return e;
+	}
+}, vt = (e, t) => e == null ? null : t !== void 0 && dt.has(t) ? e : ft(e) ? _t(e) : t === "bytes" ? mt(e) : t === "timestamp" || t === "date" ? new Date(e) : e, yt = (e, t) => {
+	let n = {};
+	for (let [r, i] of Object.entries(e)) n[r] = gt(i, t[r]);
+	return n;
+}, bt = (e, t) => {
+	let n = {};
+	for (let [r, i] of Object.entries(e)) n[r] = vt(i, t[r]);
+	return n;
+}, xt = new TextEncoder(), St = (e, t) => e.pipe(c.map((e) => xt.encode(`${JSON.stringify(yt(e, t))}\n`))), Ct = (e, t, r) => e.pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.mapEffect((e) => n.try({
+	try: () => bt(JSON.parse(e), r),
+	catch: (e) => new Ee({
+		table: t,
+		reason: String(e?.message ?? e)
+	})
+}))), q = (e, t) => {
+	let n = new Set(e), r = /* @__PURE__ */ new Map();
+	for (let e of t.tables) {
+		if (!n.has(e.name)) continue;
+		let t = /* @__PURE__ */ new Set();
+		for (let r of e.columns) {
+			let i = r.references?.table;
+			i && i !== e.name && n.has(i) && t.add(i);
+		}
+		r.set(e.name, t);
+	}
+	let i = [], a = /* @__PURE__ */ new Set(), o = /* @__PURE__ */ new Set(), s = (e) => {
+		if (!(a.has(e) || o.has(e))) {
+			o.add(e);
+			for (let t of r.get(e) ?? []) s(t);
+			o.delete(e), a.add(e), i.push(e);
+		}
+	};
+	for (let t of e) n.has(t) && s(t);
+	return i;
+}, wt = (e, t) => {
+	let n = e.tables.find((e) => e.name === t), r = {};
+	for (let e of n?.columns ?? []) r[e.name] = e.type;
+	return r;
+}, Tt = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", Et = (e, t, r) => n.tryPromise({
+	try: async () => {
+		let { createWriteStream: n } = await import("node:fs"), i = await import("node:fs/promises"), { createHash: a, randomUUID: o } = await import("node:crypto"), { pipeline: s } = await import("node:stream/promises"), { Readable: l, Transform: u } = await import("node:stream"), d = a("sha256"), f = 0, p = new u({ transform(e, t, n) {
+			d.update(e);
+			let r = e;
+			for (let e = 0; e < r.length; e++) r[e] === 10 && f++;
+			n(null, e);
+		} }), m = l.fromWeb(c.toReadableStream(e)), h = `${t}.tmp-${o()}`;
+		try {
+			await s(m, p, Ge(r), n(h)), await i.rename(h, t);
+		} catch (e) {
+			throw await i.rm(h, { force: !0 }).catch(() => {}), e;
+		}
+		return {
+			rowCount: f,
+			checksum: d.digest("hex")
+		};
+	},
+	catch: (e) => new F({
+		reason: `write table failed: ${String(e?.message ?? e)}`,
+		path: t
+	})
+}), Dt = (e, t) => n.tryPromise({
+	try: async () => {
+		await (await import("node:fs/promises")).appendFile(e, `${t}\n`);
+	},
+	catch: (t) => new F({
+		reason: `append failed: ${String(t?.message ?? t)}`,
+		path: e
+	})
+}), Ot = (e, t) => n.gen(function* () {
+	let n = [], r = t.ordered.length;
+	for (let i = 0; i < t.ordered.length; i++) {
+		let a = t.ordered[i], o = wt(t.snapshot, a), s = Tt(t.snapshot, a), l = `${V}/${a}.ndjson${We(t.compression)}`;
+		if (lt(t.ledger, a)) {
+			let e = t.ledger.tables[a];
+			W(t.onProgress, {
+				phase: "export",
+				table: a,
+				index: i,
+				tableCount: r,
+				event: "done",
+				rowsDone: e.rowCount,
+				total: e.rowCount
+			}), n.push({
+				name: a,
+				file: l,
+				rowCount: e.rowCount,
+				checksum: e.checksum,
+				columnTypes: o,
+				primaryKey: s
+			});
+			continue;
+		}
+		W(t.onProgress, {
+			phase: "export",
+			table: a,
+			index: i,
+			tableCount: r,
+			event: "start",
+			rowsDone: 0
+		});
+		let u = t.resolved.predicateFor(a), d = p(e, {
+			table: a,
+			pk: s,
+			chunkSize: t.chunkSize,
+			retry: t.retry,
+			...u === void 0 ? {} : { where: u }
+		}), f = t.mask ? d.pipe(c.map((e) => P(e, a, t.mask.actions, t.mask.seed, o))) : d, { rowCount: m, checksum: h } = yield* st("export", a, i, r, (e) => e.rowCount, Et(St(f, o), t.bundleFile(l), t.compression));
+		t.ledger.tables[a] = {
+			rowCount: m,
+			checksum: h
+		}, yield* K(t.ledgerPath, t.ledger), W(t.onProgress, {
+			phase: "export",
+			table: a,
+			index: i,
+			tableCount: r,
+			event: "done",
+			rowsDone: m,
+			total: m
+		}), n.push({
+			name: a,
+			file: l,
+			rowCount: m,
+			checksum: h,
+			columnTypes: o,
+			primaryKey: s
+		});
+	}
+	return n;
+}), kt = (e) => ({
+	_tag: "RawSqlFragment",
+	strings: [e],
+	values: []
+}), At = (t, i, a) => n.tryPromise({
+	try: () => t.transactional(async (t) => {
+		if (t.raw) for (let e of pe(i)) await t.raw(kt(e));
+		let o = await n.runPromiseExit(a(t));
+		if (r.isFailure(o)) throw Error(e.pretty(o.cause));
+		return o.value;
+	}),
+	catch: (e) => e instanceof F ? e : new F({ reason: `snapshot export failed: ${String(e?.message ?? e)}` })
+}), jt = (e) => n.gen(function* () {
+	let t = e.scope ?? { kind: "all" }, r = Ue(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, s = o.exponential("50 millis").pipe(o.jittered, o.intersect(o.recurs(a))), l = yield* n.promise(() => import("node:path")), u = (t) => l.join(e.outDir, t);
+	yield* n.tryPromise({
+		try: async () => {
+			let t = await import("node:fs/promises");
+			await t.mkdir(u(V), { recursive: !0 }), e.assets && await t.mkdir(u(H), { recursive: !0 });
+		},
+		catch: (t) => new F({
+			reason: `mkdir failed: ${String(t?.message ?? t)}`,
+			path: e.outDir
+		})
+	});
+	let d = u(tt), f = yield* G(d), p = e.subset ? Ie(yield* Fe(e.store, e.snapshot, e.subset), e.snapshot) : yield* Le(t, e.snapshot, {
+		store: e.store,
+		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
+	}), h = q(p.tables, e.snapshot), g = e.consistency ?? "live", _, v;
+	if (e.masking) {
+		let t = e.classification ?? O(e.snapshot), r = N(h.map((t) => ({
+			name: t,
+			columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
+				name: e.name,
+				type: e.type
+			}))
+		})), t, e.masking);
+		if (r.unclassified.length > 0) return yield* n.fail(new je({ unclassified: r.unclassified }));
+		v = {
+			actions: r.actions,
+			seed: e.masking.seed
+		};
+		let i = Object.entries(r.actions).filter(([, e]) => e !== "keep").map(([e]) => e);
+		_ = {
+			...e.masking.id ? { policyId: e.masking.id } : {},
+			transformed: i
+		};
+	}
+	let y = {
+		snapshot: e.snapshot,
+		ordered: h,
+		resolved: p,
+		compression: r,
+		chunkSize: i,
+		retry: s,
+		ledger: f,
+		ledgerPath: d,
+		bundleFile: u,
+		...v ? { mask: v } : {},
+		...e.onProgress ? { onProgress: e.onProgress } : {}
+	}, b = g === "snapshot" ? yield* At(e.store, e.dialect, (e) => Ot(e, y)) : yield* Ot(e.store, y), x = 0, S = 0;
+	if (e.assets) {
+		let t = u(U);
+		yield* c.runForEach(e.assets.list(), (r) => r.key in f.assets ? n.void : e.assets.open(r.key).pipe(n.flatMap((e) => Be(e, u(H))), n.flatMap((e) => {
+			let i = {
+				key: r.key,
+				sha256: e.sha256,
+				size: e.size,
+				contentType: e.contentType
+			};
+			return x++, S += e.size, f.assets[r.key] = !0, Dt(t, JSON.stringify(i)).pipe(n.andThen(K(d, f)));
+		}))).pipe(n.mapError((e) => e instanceof F ? e : new F({ reason: `asset export failed: ${String(e)}` })));
+	}
+	let C = {
+		formatVersion: 1,
+		createdAt: e.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: {
+			dialect: e.dialect,
+			schemaFingerprint: m(e.snapshot)
+		},
+		scope: t,
+		consistency: g,
+		compression: r,
+		tables: b,
+		assets: x > 0 ? {
+			count: x,
+			totalBytes: S,
+			index: U
+		} : {
+			count: 0,
+			totalBytes: 0
+		},
+		..._ ? { masking: _ } : {}
+	};
+	return yield* n.tryPromise({
+		try: async () => {
+			await (await import("node:fs/promises")).writeFile(u(B), Qe(C));
+		},
+		catch: (e) => new F({
+			reason: `manifest write failed: ${String(e?.message ?? e)}`,
+			path: B
+		})
+	}), yield* n.tryPromise({
+		try: async () => {
+			let e = await import("node:fs/promises"), t = await import("node:os");
+			await e.writeFile(u(et), rt(C, { hostname: t.hostname() }));
+		},
+		catch: (e) => new F({
+			reason: `readme write failed: ${String(e?.message ?? e)}`,
+			path: et
+		})
+	}), C;
+}), Mt = (e) => {
+	switch (e) {
+		case "id":
+		case "text":
+		case "enum": return e === "enum" ? "enum" : "string";
+		case "integer": return "integer";
+		case "real": return "float";
+		case "boolean": return "boolean";
+		case "timestamp": return "datetime";
+		case "date": return "date";
+		case "json": return "json";
+		case "bytes": return "binary";
+		case "reference": return "reference";
+		case "vector": return "vector";
+		case "array": return "array";
+		case "interval": return "interval";
+		case "raw": return "raw";
+		default: return "string";
+	}
+}, Nt = {
+	vector: /* @__PURE__ */ new Set(["postgres"]),
+	array: /* @__PURE__ */ new Set(["postgres"]),
+	interval: /* @__PURE__ */ new Set(["postgres"])
+}, Pt = (e, t, n, r) => {
+	let i = Mt(n);
+	if (i === "raw") return {
+		table: e,
+		column: t,
+		type: n,
+		severity: "block",
+		reason: `raw() is verbatim source-dialect SQL — it cannot be assumed valid on ${r}`
+	};
+	let a = Nt[i];
+	return !a || a.has(r) ? null : i === "array" || i === "interval" ? {
+		table: e,
+		column: t,
+		type: n,
+		severity: "warn",
+		reason: `${i} is native to postgres; ${r} will represent it as json/text — verify downstream reads`
+	} : {
+		table: e,
+		column: t,
+		type: n,
+		severity: "block",
+		reason: `${i} columns require a ${[...a].join("/")} target; ${r} has no compatible column type`
+	};
+}, Ft = (e, t, n) => {
+	if (t === n) return [];
+	let r = [];
+	for (let t of e) for (let [e, i] of Object.entries(t.columnTypes)) {
+		let a = Pt(t.name, e, i, n);
+		a && r.push(a);
+	}
+	return r;
+}, It = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, Lt = (e, t) => new Map((e.tables.find((e) => e.name === t)?.columns ?? []).map((e) => [e.name, e.type])), Rt = (e, t) => {
+	let n = [], r = new Set(e.tables.map((e) => e.name)), i = new Set(t.tables.map((e) => e.name));
+	for (let e of [...r].filter((e) => !i.has(e)).sort()) n.push(`table '${e}' is in the bundle but MISSING from the target`);
+	for (let e of [...i].filter((e) => !r.has(e)).sort()) n.push(`table '${e}' is in the target but NOT in the bundle (import leaves it untouched)`);
+	for (let a of [...r].filter((e) => i.has(e)).sort()) {
+		let r = Lt(e, a), i = Lt(t, a);
+		for (let [e] of r) i.has(e) || n.push(`${a}.${e}: in the bundle, MISSING from the target`);
+		for (let [e] of i) r.has(e) || n.push(`${a}.${e}: in the target, not in the bundle`);
+		for (let [e, t] of r) {
+			let r = i.get(e);
+			r !== void 0 && r !== t && n.push(`${a}.${e}: type '${t}' (bundle) vs '${r}' (target)`);
+		}
+	}
+	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n.length > 0 ? n : ["the schema shape differs (indexes, nullability, or defaults) — the specific change is below the table/column granularity shown here"];
+}, zt = (e, t, n) => {
+	let r = m(t);
+	return r === e ? {
+		drifted: !1,
+		bundleFingerprint: e,
+		targetFingerprint: r,
+		diff: []
+	} : {
+		drifted: !0,
+		bundleFingerprint: e,
+		targetFingerprint: r,
+		diff: n ? Rt(n, t) : ["the target schema fingerprint does not match the bundle (no source schema available to itemise the diff — the manifest records only the fingerprint)"]
+	};
+}, Bt = (e) => n.tryPromise({
+	try: async () => {
+		let t = await import("node:fs/promises"), n = await import("node:path");
+		return $e(await t.readFile(n.join(e, B), "utf8"));
+	},
+	catch: (e) => new F({
+		reason: `manifest read/parse failed: ${String(e?.message ?? e)}`,
+		path: B
+	})
+}), Vt = (t) => n.gen(function* () {
+	let i = yield* n.promise(() => import("node:path")), a = yield* Bt(t.bundleDir);
+	if (a.formatVersion !== 1) return yield* n.fail(new F({ reason: `unsupported bundle formatVersion ${a.formatVersion} (expected 1)` }));
+	if (t.targetSnapshot) {
+		let e = { tables: a.tables.map((e) => ({
+			name: e.name,
+			indexes: [],
+			columns: Object.entries(e.columnTypes).map(([e, t]) => ({
+				name: e,
+				type: t,
+				nullable: !0,
+				unique: !1,
+				hasDefault: !1
+			}))
+		})) }, r = zt(a.source.schemaFingerprint, t.targetSnapshot, e);
+		if (r.drifted) {
+			if (!t.force) return yield* n.fail(new Ae({
+				bundleFingerprint: r.bundleFingerprint,
+				targetFingerprint: r.targetFingerprint,
+				diff: r.diff
+			}));
+			t.onWarn?.(`schema drift: the target schema (fingerprint ${r.targetFingerprint.slice(0, 16)}) differs from the bundle's source (${r.bundleFingerprint.slice(0, 16)}); importing anyway (--force). ${r.diff.join("; ")}`);
+		}
+	}
+	if (t.targetDialect && t.targetDialect !== a.source.dialect) {
+		let e = Ft(a.tables, a.source.dialect, t.targetDialect).filter((e) => e.severity === "block");
+		if (e.length > 0 && !t.allowIncompatible) return yield* n.fail(new Ne({
+			sourceDialect: a.source.dialect,
+			targetDialect: t.targetDialect,
+			blocking: e.map(It)
+		}));
+	}
+	let o = t.verify ?? !0, s = t.mode ?? "upsert", l = t.onConflict ?? "skip", u = t.ledgerPath ?? i.join(t.bundleDir, ".import..ledger.json"), f = yield* G(u);
+	if (s === "replace" && a.scope.kind !== "all") return yield* n.fail(new Me({
+		mode: s,
+		reason: `replace refuses a partial bundle (scope='${a.scope.kind}') — truncating would delete rows not in the bundle. Use --mode upsert, or re-export with full scope.`
+	}));
+	let p = (e, t, n) => {
+		let r = t.name, i = t.primaryKey;
+		return s === "append" ? l === "fail" ? e.insert(r, n) : e.insertIgnore(r, n, { conflictColumns: [i] }) : s === "replace" ? e.insert(r, n) : e.upsert(r, n, { conflictColumns: [i] });
+	}, m = (e, t) => n.tryPromise({
+		try: e,
+		catch: (e) => String(e?.message ?? e)
+	}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (t.reason = e, !1)))), h = (e) => {
+		let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
+		if (t.length !== 0) return {
+			...e.row,
+			...Object.fromEntries(t.map((e) => [e, null]))
+		};
+	}, g = (e, t) => n.gen(function* () {
+		let r = t, i = [], a = !0;
+		for (; r.length > 0 && a;) {
+			a = !1;
+			let t = [];
+			for (let n of r) (yield* m(() => p(e, n.entry, n.row), n)) ? a = !0 : t.push(n);
+			if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
+				let r = t[n], o = h(r);
+				o !== void 0 && (yield* m(() => p(e, r.entry, o), r)) && (i.push(r), t.splice(n, 1), a = !0);
+			}
+			r = t;
+		}
+		for (let t of i) (yield* m(() => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] }), t)) || (r = [...r, t]);
+		if (r.length > 0) return yield* n.fail(new ke({
+			rows: r.slice(0, 20).map((e) => ({
+				table: e.entry.name,
+				id: String(e.row[e.entry.primaryKey]),
+				reason: e.reason
+			})),
+			totalCount: r.length
+		}));
+	}), _ = (e, r) => n.gen(function* () {
+		if (s === "replace" && !(r && f.truncated)) {
+			for (let t of [...a.tables].reverse()) yield* n.tryPromise({
+				try: () => e.deleteMany(t.name, { where: d(t.primaryKey) }),
+				catch: (e) => new F({ reason: `truncate ${t.name} failed: ${String(e?.message ?? e)}` })
+			});
+			r && (f.truncated = !0, yield* K(u, f));
+		}
+		let l = [], h = [], _ = a.tables.length;
+		for (let s = 0; s < a.tables.length; s++) {
+			let d = a.tables[s];
+			if (r && d.name in f.tables) {
+				W(t.onProgress, {
+					phase: "import",
+					table: d.name,
+					index: s,
+					tableCount: _,
+					event: "done",
+					rowsDone: f.tables[d.name].rowCount,
+					total: d.rowCount
+				});
+				continue;
+			}
+			let g = i.join(t.bundleDir, d.file);
+			W(t.onProgress, {
+				phase: "import",
+				table: d.name,
+				index: s,
+				tableCount: _,
+				event: "start",
+				rowsDone: 0,
+				total: d.rowCount
+			});
+			let v = l.length, y = n.gen(function* () {
+				let { createHash: t } = yield* n.promise(() => import("node:crypto")), r = t("sha256"), i = 0, o = S("bundle", () => E(g).pipe(Ke(a.compression))).pipe(c.tap((e) => n.sync(() => r.update(e))));
+				return yield* c.runForEach(Ct(o, d.name, d.columnTypes), (t) => {
+					i++;
+					let r = {
+						entry: d,
+						row: t,
+						reason: ""
+					};
+					return m(() => p(e, d, t), r).pipe(n.map((e) => {
+						e || l.push(r);
+					}));
+				}), {
+					rowCount: i,
+					checksum: r.digest("hex")
+				};
+			}), { rowCount: b, checksum: x } = yield* st("import", d.name, s, _, (e) => e.rowCount, y);
+			if (o) {
+				if (x !== d.checksum) return yield* n.fail(new I({
+					what: `table ${d.name} checksum`,
+					expected: d.checksum,
+					actual: x
+				}));
+				if (b !== d.rowCount) return yield* n.fail(new I({
+					what: `table ${d.name} rowCount`,
+					expected: String(d.rowCount),
+					actual: String(b)
+				}));
+			}
+			W(t.onProgress, {
+				phase: "import",
+				table: d.name,
+				index: s,
+				tableCount: _,
+				event: "done",
+				rowsDone: b,
+				total: d.rowCount
+			}), r && (l.length > v ? h.push({
+				name: d.name,
+				rowCount: b
+			}) : (f.tables[d.name] = {
+				rowCount: b,
+				checksum: d.checksum
+			}, yield* K(u, f)));
+		}
+		if (l.length > 0 && (yield* g(e, l)), r && h.length > 0) {
+			for (let e of h) {
+				let t = a.tables.find((t) => t.name === e.name);
+				f.tables[e.name] = {
+					rowCount: e.rowCount,
+					checksum: t.checksum
+				};
+			}
+			yield* K(u, f);
+		}
+	});
+	if (t.atomic ? yield* n.tryPromise({
+		try: () => t.store.transactional(async (t) => {
+			let i = await n.runPromiseExit(_(t, !1));
+			if (r.isFailure(i)) throw Error(e.pretty(i.cause));
+		}),
+		catch: (e) => new F({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
+	}) : yield* _(t.store, !0), t.assets && a.assets.index && !t.assetsAlreadyRestored) {
+		let e = t.assets, r = i.join(t.bundleDir, H), o = i.join(t.bundleDir, a.assets.index ?? "assets/index.ndjson"), s = S("bundle", () => E(o)).pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.map((e) => JSON.parse(e)));
+		yield* c.runForEach(s, (t) => t.key in f.assets ? n.void : Ve(e, r, t).pipe(n.andThen(n.sync(() => {
+			f.assets[t.key] = !0;
+		})), n.andThen(K(u, f))));
+	}
+	return a;
+}), Ht = (e) => e, Ut = (e) => e.allowLive || e.liveInstance === null ? { refuse: !1 } : {
+	refuse: !0,
+	message: `refusing to write into a target with a LIVE instance (${e.liveInstance}). A direct import is an uncoordinated concurrent writer — readers see partial state, the reactive layer either storms or goes stale, and rows race with live writes. Re-run with --allow-live to override, or use a live-safe strategy (shadow-swap for replace, or the api target).`
+}, J = Buffer.from("VBUNDLE2"), Wt = 0, Gt = 1, Kt = 2, qt = 32, Jt = async (e) => {
+	let t = [], n = async (r) => {
+		let i;
+		try {
+			i = await oe(D(e, r), { withFileTypes: !0 });
+		} catch {
+			return;
+		}
+		for (let e of i) {
+			let i = r ? `${r}/${e.name}` : e.name;
+			e.isDirectory() ? await n(i) : e.isFile() && t.push(i);
+		}
+	};
+	return await n(""), t.sort();
+}, Yt = (e, t) => {
+	let n = Buffer.from(e, "utf8"), r = Buffer.alloc(5 + n.length + 8);
+	return r.writeUInt8(Gt, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
+}, Xt = (e, t, n) => {
+	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8"), a = Buffer.alloc(5 + r.length + 2 + i.length + 8), o = 0;
+	return a.writeUInt8(Kt, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
+};
+async function* Zt(e) {
+	yield new Uint8Array(J);
+	for (let t of await Jt(e.dir)) {
+		let n = D(e.dir, t), r = await se(n);
+		if (yield new Uint8Array(Yt(t, r.size)), r.size > 0) for await (let e of E(n)) yield new Uint8Array(e);
+	}
+	if (e.blobs) for await (let t of e.blobs.list()) {
+		yield new Uint8Array(Xt(t.key, t.contentType, t.size));
+		let n = _("sha256"), r = 0;
+		for await (let i of e.blobs.open(t.key)) {
+			let e = Buffer.from(i);
+			n.update(e), r += e.length, yield new Uint8Array(e);
+		}
+		if (r !== t.size) throw Error(`blob '${t.key}' size mismatch: header ${t.size}, streamed ${r}`);
+		yield new Uint8Array(n.digest());
+	}
+	yield new Uint8Array(Buffer.from([Wt]));
+}
+var Qt = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), $t = (e) => new Promise((t) => e.end(t)), en = async (e, t) => {
+	let n = le(t.dir);
+	await ae(n, { recursive: !0 });
+	let r = Buffer.alloc(0), i = e[Symbol.asyncIterator](), a = async () => {
+		let { value: e, done: t } = await i.next();
+		return t ? !1 : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
+	}, o = async (e) => {
+		for (; r.length < e;) if (!await a()) throw Error("truncated bundle archive");
+	}, s = (e) => {
+		let t = r.subarray(0, e);
+		return r = r.subarray(e), t;
+	};
+	if (await o(J.length), !s(J.length).equals(J)) throw Error("not a bundle archive (bad magic)");
+	for (;;) {
+		await o(1);
+		let e = s(1).readUInt8(0);
+		if (e === Wt) return;
+		if (e === Gt) {
+			await o(4);
+			let e = s(4).readUInt32BE(0);
+			await o(e);
+			let t = s(e).toString("utf8");
+			await o(8);
+			let i = s(8).readBigUInt64BE(0), a = le(n, t);
+			if (a !== n && !a.startsWith(n + ue)) throw Error(`archive path '${t}' escapes the destination`);
+			await ae(ce(a), { recursive: !0 });
+			let c = ie(a);
+			for (; i > 0n;) {
+				r.length === 0 && await o(1);
+				let e = i < BigInt(r.length) ? Number(i) : r.length;
+				await Qt(c, s(e)), i -= BigInt(e);
+			}
+			await $t(c);
+		} else if (e === Kt) {
+			await o(4);
+			let e = s(4).readUInt32BE(0);
+			await o(e);
+			let n = s(e).toString("utf8");
+			await o(2);
+			let i = s(2).readUInt16BE(0);
+			await o(i);
+			let a = s(i).toString("utf8");
+			await o(8);
+			let c = s(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = _("sha256"), d = new T(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				contentType: a,
+				size: Number(c)
+			}), p = c;
+			for (; p > 0n;) {
+				r.length === 0 && await o(1);
+				let e = p < BigInt(r.length) ? Number(p) : r.length, t = s(e);
+				u.update(t), l || await Qt(d, t), p -= BigInt(e);
+			}
+			l ? d.destroy() : await $t(d), await f, await o(qt);
+			let m = s(qt);
+			if (!u.digest().equals(m)) throw Error(`blob '${n}' failed integrity (sha mismatch)`);
+		} else throw Error(`unknown bundle entry kind ${e}`);
+	}
+}, tn = async (e, t) => {
+	let n = new Set(t), r = /* @__PURE__ */ new Map(), i = Buffer.alloc(0), a = e[Symbol.asyncIterator](), o = async () => {
+		let { value: e, done: t } = await a.next();
+		return t ? !1 : (i = i.length === 0 ? Buffer.from(e) : Buffer.concat([i, Buffer.from(e)]), !0);
+	}, s = async (e) => {
+		for (; i.length < e;) if (!await o()) return !1;
+		return !0;
+	}, c = (e) => {
+		let t = i.subarray(0, e);
+		return i = i.subarray(e), t;
+	}, l = async (e) => {
+		let t = [], n = e;
+		for (; n > 0n;) {
+			if (i.length === 0 && !await s(1)) return null;
+			let e = n < BigInt(i.length) ? Number(n) : i.length;
+			t.push(c(e)), n -= BigInt(e);
+		}
+		return Buffer.concat(t);
+	};
+	if (!await s(J.length) || !c(J.length).equals(J)) throw Error("not a bundle archive (bad magic)");
+	for (; await s(1);) {
+		let e = c(1).readUInt8(0);
+		if (e === Wt || e === Kt) break;
+		if (e !== Gt) throw Error(`unknown bundle entry kind ${e}`);
+		if (!await s(4)) break;
+		let t = c(4).readUInt32BE(0);
+		if (!await s(t)) break;
+		let i = c(t).toString("utf8");
+		if (!await s(8)) break;
+		let a = await l(c(8).readBigUInt64BE(0));
+		if (a === null || n.has(i) && (r.set(i, a), n.delete(i), n.size === 0)) break;
+	}
+	return r;
+}, nn = (e, t) => en(e, {
+	dir: t,
+	blobs: rn(t)
+}), rn = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	return {
+		has: async (e) => t.has(e),
+		write: async (n, r, i) => {
+			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = D(e, "assets");
+			await ae(c, { recursive: !0 });
+			let l = _("sha256"), u = 0, d = new s({ transform(e, t, n) {
+				l.update(e), u += e.length, n(null, e);
+			} }), f = D(c, `.tmp-${Date.now()}-${t.size}`);
+			await o(r, d, ie(f));
+			let p = l.digest("hex");
+			await a.rename(f, D(c, p)), await a.appendFile(D(c, "index.ndjson"), `${JSON.stringify({
+				key: n,
+				sha256: p,
+				size: u,
+				contentType: i.contentType
+			})}\n`), t.add(n);
+		}
+	};
+}, an = de(b), on = Buffer.from("VENC1\0\0\0"), sn = 32, cn = 16, ln = 7, Y = 16, X = 256 * 1024, Z = {
+	N: 32768,
+	r: 8,
+	p: 1
+}, un = 128 * 1024 * 1024, Q = 43, dn = (e, t, n) => {
+	let r = Buffer.alloc(12);
+	return e.copy(r, 0, 0, ln), r.writeUInt32BE(t >>> 0, ln), r.writeUInt8(+!!n, 11), r;
+};
+async function* fn(e, t) {
+	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
+	let n = y(cn), r = y(ln), i = await an(t, n, sn, {
+		...Z,
+		maxmem: un
+	}), a = Buffer.alloc(Q);
+	on.copy(a, 0), a.writeUInt32BE(Z.N, 8), a.writeUInt32BE(Z.r, 12), a.writeUInt32BE(Z.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
+	let o = 0, s = (e, t) => {
+		let n = h("aes-256-gcm", i, dn(r, o, t));
+		o === 0 && n.setAAD(a);
+		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
+		o++;
+		let l = Buffer.alloc(5 + s.length + Y);
+		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + Y, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
+	}, c = Buffer.alloc(0);
+	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > X;) yield s(c.subarray(0, X), !1), c = c.subarray(X);
+	yield s(c, !0);
+}
+async function* pn(e, t) {
+	if (!t) throw Error("decryptStream: a non-empty passphrase is required");
+	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = !1, a = async () => {
+		let { value: e, done: t } = await n.next();
+		return t ? (i = !0, !1) : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
+	}, o = async (e) => {
+		for (; r.length < e && !i && await a(););
+		return r.length >= e;
+	};
+	if (!await o(Q)) throw Error("encrypted bundle truncated (no header)");
+	let s = r.subarray(0, Q);
+	if (!s.subarray(0, 8).equals(on)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
+	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Q)), p = await an(t, d, sn, {
+		N: c,
+		r: l,
+		p: u,
+		maxmem: un
+	});
+	r = r.subarray(Q);
+	let m = 0, h = !1;
+	for (;;) {
+		if (!await o(5)) {
+			if (r.length === 0 && h) return;
+			throw Error("encrypted bundle truncated (no authenticated final frame)");
+		}
+		if (h) throw Error("encrypted bundle has trailing data after the final frame");
+		let e = r.readUInt8(0) === 1, t = r.readUInt32BE(1);
+		if (t < Y) throw Error("encrypted bundle corrupt (short frame)");
+		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
+		let n = r.subarray(5, 5 + t - Y), i = r.subarray(5 + t - Y, 5 + t);
+		r = r.subarray(5 + t);
+		let a = g("aes-256-gcm", p, dn(f, m, e));
+		m === 0 && a.setAAD(s), a.setAuthTag(i);
+		let c = Buffer.concat([a.update(n), a.final()]);
+		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
+	}
+}
+//#endregion
+//#region src/blobStorage.ts
+var mn = (e, t) => ({
+	list: () => {
+		let e = t();
+		return { async *[Symbol.asyncIterator]() {
+			let t = await n.runPromise(c.runCollect(e));
+			for (let e of t) yield {
+				key: e.key,
+				contentType: e.contentType,
+				size: e.size
+			};
+		} };
+	},
+	open: (t) => ({ async *[Symbol.asyncIterator]() {
+		let r = await te((await n.runPromise(C(e, t))).stream);
+		for await (let e of r) yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} })
+}), hn = (e, t) => mn(e, () => p(t, {
+	table: x,
+	chunkSize: 500
+}).pipe(c.map((e) => ({
+	key: String(e.key),
+	contentType: String(e.contentType ?? "application/octet-stream"),
+	size: Number(e.size ?? 0)
+})))), gn = (e) => ({
+	has: (t) => n.runPromise(e.head(t).pipe(n.map((e) => e !== null))),
+	write: async (t, r, i) => {
+		let a = S("storage", () => ne.from(r));
+		await n.runPromise(ee(e, t, a, {
+			contentType: i.contentType,
+			totalSize: i.size
+		}));
+	}
+}), _n = (e) => {
+	switch (e) {
+		case "postgres": return "db.dump";
+		case "mysql":
+		case "mariadb": return "db.sql";
+		case "sqlite":
+		case "turso": return "db.sqlite";
+		case "mssql": return "db.bacpac";
+		default: return "db.dump";
+	}
+}, vn = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
+	if (e.host || e.database) return {
+		host: e.host ?? "localhost",
+		port: e.port ?? 3306,
+		username: e.username ?? "root",
+		password: e.password ?? "",
+		database: e.database ?? ""
+	};
+	let t = new URL(e.url ?? "");
+	return {
+		host: t.hostname || "localhost",
+		port: t.port ? Number(t.port) : 3306,
+		username: decodeURIComponent(t.username) || "root",
+		password: decodeURIComponent(t.password) || "",
+		database: t.pathname.replace(/^\//, "") || ""
+	};
+}, yn = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, bn = (e, t, n) => {
+	switch (e) {
+		case "postgres": {
+			if (t.url) return {
+				kind: "spawn",
+				tool: "pg_dump",
+				args: [
+					"--format=custom",
+					"--no-owner",
+					"--no-privileges",
+					"--dbname",
+					t.url,
+					"--file",
+					n
+				],
+				env: {}
+			};
+			let e = $({
+				...t,
+				port: t.port ?? 5432
+			});
+			return {
+				kind: "spawn",
+				tool: "pg_dump",
+				args: [
+					"--format=custom",
+					"--no-owner",
+					"--no-privileges",
+					"-h",
+					e.host,
+					"-p",
+					String(e.port),
+					"-U",
+					e.username,
+					"-d",
+					e.database,
+					"--file",
+					n
+				],
+				env: { PGPASSWORD: e.password }
+			};
+		}
+		case "mysql":
+		case "mariadb": {
+			let e = $(t);
+			return {
+				kind: "spawn",
+				tool: "mysqldump",
+				args: [
+					"--single-transaction",
+					"--routines",
+					"--triggers",
+					"--no-tablespaces",
+					"-h",
+					e.host,
+					"-P",
+					String(e.port),
+					"-u",
+					e.username,
+					e.database
+				],
+				env: { MYSQL_PWD: e.password },
+				stdoutFile: n
+			};
+		}
+		case "sqlite":
+		case "turso": return {
+			kind: "copy",
+			from: vn(t),
+			to: n
+		};
+		case "mssql": return {
+			kind: "spawn",
+			tool: "sqlpackage",
+			args: [
+				"/Action:Export",
+				`/SourceConnectionString:${yn($({
+					...t,
+					port: t.port ?? 1433
+				}))}`,
+				`/TargetFile:${n}`
+			],
+			env: {}
+		};
+		default: throw new L({
+			tool: "backup",
+			reason: `no native backup for dialect '${e}'`
+		});
+	}
+}, xn = (e, t, n) => {
+	switch (e) {
+		case "postgres": {
+			if (t.url) return {
+				kind: "spawn",
+				tool: "pg_restore",
+				args: [
+					"--clean",
+					"--if-exists",
+					"--no-owner",
+					"--dbname",
+					t.url,
+					n
+				],
+				env: {}
+			};
+			let e = $({
+				...t,
+				port: t.port ?? 5432
+			});
+			return {
+				kind: "spawn",
+				tool: "pg_restore",
+				args: [
+					"--clean",
+					"--if-exists",
+					"--no-owner",
+					"-h",
+					e.host,
+					"-p",
+					String(e.port),
+					"-U",
+					e.username,
+					"-d",
+					e.database,
+					n
+				],
+				env: { PGPASSWORD: e.password }
+			};
+		}
+		case "mysql":
+		case "mariadb": {
+			let e = $(t);
+			return {
+				kind: "spawn",
+				tool: "mysql",
+				args: [
+					"-h",
+					e.host,
+					"-P",
+					String(e.port),
+					"-u",
+					e.username,
+					e.database
+				],
+				env: { MYSQL_PWD: e.password },
+				stdinFile: n
+			};
+		}
+		case "sqlite":
+		case "turso": return {
+			kind: "copy",
+			from: n,
+			to: vn(t)
+		};
+		case "mssql": return {
+			kind: "spawn",
+			tool: "sqlpackage",
+			args: [
+				"/Action:Import",
+				`/TargetConnectionString:${yn($({
+					...t,
+					port: t.port ?? 1433
+				}))}`,
+				`/SourceFile:${n}`
+			],
+			env: {}
+		};
+		default: throw new L({
+			tool: "restore",
+			reason: `no native restore for dialect '${e}'`
+		});
+	}
+}, Sn = (e) => e.kind === "copy" ? n.async((t) => {
+	re(e.from, e.to, (r) => t(r ? n.fail(new L({
+		tool: "copy",
+		reason: `copy ${e.from} → ${e.to}: ${r.message}`
+	})) : n.void));
+}) : n.async((t) => {
+	let r = fe(e.tool, [...e.args], {
+		env: {
+			...process.env,
+			...e.env
+		},
+		stdio: [
+			"pipe",
+			e.stdoutFile ? "pipe" : "inherit",
+			"pipe"
+		]
+	}), i = "";
+	r.stderr?.on("data", (e) => {
+		i += String(e);
+	}), e.stdoutFile && r.stdout && r.stdout.pipe(ie(e.stdoutFile)), e.stdinFile && r.stdin && E(e.stdinFile).pipe(r.stdin), r.on("error", (r) => t(n.fail(new L({
+		tool: e.tool,
+		reason: `failed to launch (is '${e.tool}' installed + on PATH?): ${r.message}`
+	})))), r.on("close", (r) => t(r === 0 ? n.void : n.fail(new L({
+		tool: e.tool,
+		reason: `exited with code ${r}`,
+		stderr: i.slice(-2e3)
+	}))));
+}), Cn = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), wn = (e) => n.gen(function* () {
+	let t = yield* Le(e.scope ?? { kind: "all" }, e.snapshot, {
+		store: e.store,
+		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
+	}), r = q(t.tables, e.snapshot), i = e.classification ?? O(e.snapshot), a = e.sampleSize ?? 20, o = N(r.map((t) => ({
+		name: t,
+		columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
+			name: e.name,
+			type: e.type
+		}))
+	})), i, e.masking), s = [], l = [];
+	for (let i of r) {
+		let r = t.predicateFor(i), u = yield* p(e.store, {
+			table: i,
+			chunkSize: a,
+			...r === void 0 ? {} : { where: r }
+		}).pipe(c.take(a), c.runCollect, n.map((e) => [...e])), d = u.map((t) => P(t, i, o.actions, e.masking.seed));
+		l.push(...Te(d, i, o.actions));
+		let f = u[0], m = d[0], h = [];
+		if (f && m) for (let [e, t] of Object.entries(o.actions)) {
+			if (!e.startsWith(`${i}.`) || t === "keep") continue;
+			let n = e.slice(i.length + 1);
+			h.push({
+				column: n,
+				action: Cn(t),
+				before: f[n],
+				after: m[n]
+			});
+		}
+		s.push({
+			table: i,
+			samples: h
+		});
+	}
+	return {
+		tables: s,
+		leaks: l,
+		unclassified: o.unclassified
+	};
+});
+//#endregion
+export { H as ASSETS_DIR, U as ASSET_INDEX_FILE, F as BundleError, Ee as CodecError, De as CompressionError, Ne as CrossDialectError, V as DATA_DIR, me as DEFAULT_CLASS_ACTIONS, ke as DanglingReferenceError, qe as FORMAT_VERSION, Me as ImportModeError, I as IntegrityError, tt as LEDGER_FILE, B as MANIFEST_FILE, je as MaskingError, L as NativeToolError, Ae as SchemaDriftError, Oe as ScopeError, Ce as applyAction, Ut as assessLiveImport, ut as assetDone, _n as backupArtifactName, bn as backupCommand, Mt as canonicalType, Ft as checkPortability, zt as checkSchemaDrift, O as classificationFromSnapshot, We as compressionExt, Fe as computeSubsetIds, $e as decodeManifest, bt as decodeRow, vt as decodeValue, pn as decryptStream, Ht as defineDataProfile, Rt as diffSnapshots, rn as dirBlobSink, ct as emptyLedger, Qe as encodeManifest, yt as encodeRow, gt as encodeValue, fn as encryptStream, It as formatIssue, He as hasZstd, Ge as makeCompressor, Ke as makeDecompressor, P as maskRow, Ct as ndjsonToRows, Zt as packBundle, tn as peekBundle, Ue as pickCompression, N as planMasking, wn as previewMasking, G as readLedger, he as resolveAction, Le as resolveScope, Ve as restoreAssetFromCas, xn as restoreCommand, St as rowsToNdjson, jt as runExport, Vt as runImport, Sn as runNativeStep, Te as scanForLeaks, ze as storageAssetSink, Re as storageAssetSource, gn as storageBlobSink, mn as storageBlobSource, hn as storageRefsBlobSource, Ie as subsetToScope, lt as tableDone, q as topoSortTables, en as unpackBundle, nn as unpackBundleToDir, Be as writeAssetToCas, K as writeLedger };