@voltro/data-transfer 0.42.0 → 0.43.0

package/dist/index.js

@@ -1,17 +1,17 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Schedule as o, Schema as s, Stream as c } from "effect";
 import { classifyConstraintViolation as l, eq as u, extractDbCause as d, inSet as f, isNotNull as p, or as m, streamTable as h } from "@voltro/database";
 import { fingerprintSchema as g } from "@voltro/database/sql";
-import { createCipheriv as _, createDecipheriv as v, createHash as y, createHmac as ee, randomBytes as b, scrypt as x } from "node:crypto";
-import { STORAGE_REFS_TABLE as S, fromNodeReadable as C, getObjectStream as te, putObjectStream as ne, toNodeReadable as re } from "@voltro/plugin-storage";
-import * as w from "node:zlib";
-import { PassThrough as ie, Readable as ae } from "node:stream";
-import { copyFile as oe, createReadStream as T, createWriteStream as E, existsSync as se, unlinkSync as ce } from "node:fs";
-import { mkdir as D, readdir as le, stat as ue } from "node:fs/promises";
-import { basename as de, delimiter as fe, dirname as pe, join as O, resolve as me, sep as he } from "node:path";
-import { promisify as ge } from "node:util";
-import { spawn as _e } from "node:child_process";
+import { createCipheriv as _, createDecipheriv as v, createHash as y, createHmac as b, randomBytes as x, scrypt as S } from "node:crypto";
+import { STORAGE_REFS_TABLE as C, fromNodeReadable as w, getObjectStream as ee, putObjectStream as te, toNodeReadable as ne } from "@voltro/plugin-storage";
+import * as T from "node:zlib";
+import { PassThrough as re, Readable as ie } from "node:stream";
+import { copyFile as ae, createReadStream as E, createWriteStream as D, existsSync as oe, unlinkSync as se } from "node:fs";
+import { mkdir as O, readdir as ce, stat as le } from "node:fs/promises";
+import { basename as ue, delimiter as de, dirname as fe, join as k, resolve as pe, sep as me } from "node:path";
+import { promisify as he } from "node:util";
+import { spawn as ge } from "node:child_process";
 //#region src/consistency.ts
-var ve = (e) => {
+var _e = (e) => {
 	switch (e) {
 		case "postgres": return ["SET TRANSACTION ISOLATION LEVEL REPEATABLE READ"];
 		case "mysql":
@@ -21,7 +21,7 @@ var ve = (e) => {
 		case "turso": return [];
 		default: return [];
 	}
-}, ye = {
+}, ve = {
 	email: { fake: "email" },
 	fullName: { fake: "fullName" },
 	firstName: { fake: "firstName" },
@@ -36,7 +36,7 @@ var ve = (e) => {
 	date: "dateShift",
 	secret: "null",
 	freeText: "redact"
-}, k = (e) => {
+}, A = (e) => {
 	let t = {};
 	for (let n of e.tables) {
 		let e = {};
@@ -48,15 +48,15 @@ var ve = (e) => {
 		t[n.name] = e;
 	}
 	return t;
-}, be = (e, t, n, r) => {
+}, ye = (e, t, n, r) => {
 	let i = r.columns?.[`${e}.${t}`];
 	if (i) return i;
 	if (n?.sensitive) {
 		let e = n.sensitive.class;
-		return r.classes?.[e] ?? ye[e] ?? "redact";
+		return r.classes?.[e] ?? ve[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, A = (e, t) => ee("sha256", e).update(t == null ? "∅" : String(t)).digest(), j = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), M = [
+}, be = (e, t) => b("sha256", e).update(t == null ? "∅" : String(t)).digest(), j = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), M = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -101,7 +101,7 @@ var ve = (e) => {
 	"Stark",
 	"Wayne"
 ], N = (e, t, n) => e[j(t, n) % e.length], we = (e, t, n) => {
-	let r = A(n, `${e}:${String(t)}`), i = j(r, 1) % 1e4;
+	let r = be(n, `${e}:${String(t)}`), i = j(r, 1) % 1e4;
 	switch (e) {
 		case "email": return `${N(M, r, 0).toLowerCase()}.${N(xe, r, 2).toLowerCase()}${i}@example.com`;
 		case "fullName": return `${N(M, r, 0)} ${N(xe, r, 1)}`;
@@ -127,7 +127,7 @@ var ve = (e) => {
 }, Ee = 864e5, De = (e, t) => {
 	let n = e instanceof Date ? e.getTime() : Date.parse(String(e));
 	if (Number.isNaN(n)) return e;
-	let r = j(A(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Ee);
+	let r = j(be(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Ee);
 	return e instanceof Date ? i : i.toISOString();
 }, Oe = (e, t) => {
 	if (t.value === null || t.value === void 0) return null;
@@ -135,7 +135,7 @@ var ve = (e) => {
 	if (e === "keep") return t.value;
 	if (e === "null") return null;
 	if (e === "redact") return t.columnType === "text" || typeof t.value == "string" ? "[redacted]" : null;
-	if (e === "hash") return A(t.seed, t.value).toString("hex").slice(0, 16);
+	if (e === "hash") return be(t.seed, t.value).toString("hex").slice(0, 16);
 	if (e === "dateShift") return De(t.value, t.seed);
 	if (typeof e == "object" && "fake" in e) return we(e.fake, t.value, t.seed);
 	if (typeof e == "object" && "custom" in e) return e.custom(t);
@@ -143,7 +143,7 @@ var ve = (e) => {
 }, ke = (e) => typeof e == "string" ? e === "keep" || e === "null" || e === "redact" || e === "hash" || e === "dateShift" || e === "error" : typeof e != "object" || !e ? !1 : "fake" in e ? typeof e.fake == "string" : "custom" in e && typeof e.custom == "function", Ae = (e, t, n) => {
 	let r = {}, i = [], a = [];
 	for (let o of e) for (let e of o.columns) {
-		let s = `${o.name}.${e.name}`, c = be(o.name, e.name, t[o.name]?.[e.name], n);
+		let s = `${o.name}.${e.name}`, c = ye(o.name, e.name, t[o.name]?.[e.name], n);
 		if (c === "error") {
 			i.push(s);
 			continue;
@@ -220,12 +220,14 @@ var ve = (e) => {
 	what: s.String,
 	expected: s.String,
 	actual: s.String
-}) {}, Fe = class extends t.TaggedError("CompressionError") {}, I = class extends s.TaggedError()("ScopeError", { reason: s.String }) {}, Ie = class extends s.TaggedError()("DanglingReferenceError", {
+}) {}, Fe = class extends t.TaggedError("CompressionError") {}, I = class extends s.TaggedError()("ScopeError", { reason: s.String }) {}, Ie = class extends s.TaggedError()("RowsRefusedError", {
 	rows: s.Array(s.Struct({
 		table: s.String,
 		id: s.String,
-		reason: s.String
+		reason: s.String,
+		derived: s.Boolean
 	})),
+	primaryCount: s.Number,
 	totalCount: s.Number
 }) {}, Le = class extends s.TaggedError()("SchemaDriftError", {
 	bundleFingerprint: s.String,
@@ -338,16 +340,16 @@ var ve = (e) => {
 	};
 }), Ue = (e, t) => ({
 	list: t,
-	open: (t) => te(e, t)
+	open: (t) => ee(e, t)
 }), We = (e) => ({
-	write: (t, n, r) => ne(e, t, n, r),
+	write: (t, n, r) => te(e, t, n, r),
 	has: (t) => e.head(t).pipe(n.map((e) => e !== null))
 }), Ge = (e, t) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), r = await import("node:fs/promises"), { createHash: i, randomUUID: a } = await import("node:crypto"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = await import("node:path"), l = c.join(t, `.tmp-${a()}`), u = i("sha256"), d = 0, f = new s({ transform(e, t, n) {
 			u.update(e), d += e.length, n(null, e);
 		} });
-		await o(await re(e.stream), f, n(l));
+		await o(await ne(e.stream), f, n(l));
 		let p = u.digest("hex"), m = c.join(t, p);
 		try {
 			await r.access(m), await r.rm(l, { force: !0 });
@@ -365,7 +367,7 @@ var ve = (e) => {
 		path: t
 	})
 }), Ke = (e, t, r) => n.gen(function* () {
-	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), l = o("sha256"), u = C("bundle", () => a(s)).pipe(c.tap((e) => n.sync(() => l.update(e))));
+	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), l = o("sha256"), u = w("bundle", () => a(s)).pipe(c.tap((e) => n.sync(() => l.update(e))));
 	yield* e.write(r.key, u, {
 		contentType: r.contentType,
 		totalSize: r.size
@@ -376,7 +378,7 @@ var ve = (e) => {
 		expected: r.sha256,
 		actual: d
 	}));
-}), qe = () => typeof w.createZstdCompress == "function", Je = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : qe() ? "zstd" : "gzip", Ye = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", Xe = (e) => e === "zstd" ? w.createZstdCompress() : e === "gzip" ? w.createGzip() : new ie(), Ze = (e) => e === "zstd" ? w.createZstdDecompress() : e === "gzip" ? w.createGunzip() : new ie(), Qe = 1, $e = s.Struct({
+}), qe = () => typeof T.createZstdCompress == "function", Je = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : qe() ? "zstd" : "gzip", Ye = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", Xe = (e) => e === "zstd" ? T.createZstdCompress() : e === "gzip" ? T.createGzip() : new re(), Ze = (e) => e === "zstd" ? T.createZstdDecompress() : e === "gzip" ? T.createGunzip() : new re(), Qe = 1, $e = s.Struct({
 	name: s.String,
 	file: s.String,
 	rowCount: s.Number,
@@ -560,16 +562,21 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	}
 }, Mt = (e, t) => {
 	let n = e.tables.find((e) => e.name === t), r = {};
-	for (let e of n?.columns ?? []) r[e.name] = e.type;
+	for (let e of n?.columns ?? []) e.generatedAs === void 0 && (r[e.name] = e.type);
 	return r;
-}, Nt = (e, t) => {
+}, Nt = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.generatedAs !== void 0).map((e) => e.name), Pt = (e, t) => {
+	if (t.length === 0) return e;
+	let n = { ...e };
+	for (let e of t) delete n[e];
+	return n;
+}, Ft = (e, t) => {
 	let n = e.tables.find((e) => e.name === t);
 	if (n === void 0) return { refusal: `${t}: not in the schema snapshot, so its primary key is unknown.` };
 	let r = n.columns.find((e) => e.type === "id");
 	if (r !== void 0) return { column: r.name };
 	let i = n.indexes.find((e) => e.name === `${t}_pkey`)?.columns ?? n.primaryKey ?? [];
 	return i.length === 1 ? { column: i[0] } : i.length > 1 ? { refusal: `${t}: composite primary key (${i.join(", ")}). Keyset export orders by ONE column; ordering by the first alone would split equal values across pages and drop or duplicate rows. Exclude this table from the scope, or give it a single-column key.` } : { refusal: `${t}: no primary key, so there is no stable order to paginate by. A keyset export would return rows in an order the database may change between pages. Exclude this table from the scope.` };
-}, Pt = (e, t, r) => n.tryPromise({
+}, It = (e, t, r) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), i = await import("node:fs/promises"), { createHash: a, randomUUID: o } = await import("node:crypto"), { pipeline: s } = await import("node:stream/promises"), { Readable: l, Transform: u } = await import("node:stream"), d = a("sha256"), f = 0, p = new u({ transform(e, t, n) {
 			d.update(e);
@@ -591,7 +598,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `write table failed: ${J(e)}`,
 		path: t
 	})
-}), Ft = (e, t) => n.tryPromise({
+}), Lt = (e, t) => n.tryPromise({
 	try: async () => {
 		await (await import("node:fs/promises")).appendFile(e, `${t}\n`);
 	},
@@ -599,10 +606,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `append failed: ${J(t)}`,
 		path: e
 	})
-}), It = (e, t) => n.gen(function* () {
+}), Rt = (e, t) => n.gen(function* () {
 	let r = [], i = t.ordered.length;
 	for (let a = 0; a < t.ordered.length; a++) {
-		let o = t.ordered[a], s = Mt(t.snapshot, o), l = Nt(t.snapshot, o);
+		let o = t.ordered[a], s = Mt(t.snapshot, o), l = Ft(t.snapshot, o);
 		if ("refusal" in l) return yield* n.fail(new I({ reason: `export: ${l.refusal}` }));
 		let u = l.column, d = `${U}/${o}.ndjson${Ye(t.compression)}`;
 		if (ht(t.ledger, o)) {
@@ -639,41 +646,41 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			chunkSize: t.chunkSize,
 			retry: t.retry,
 			...f === void 0 ? {} : { where: f }
-		}), m = t.mask ? p.pipe(c.map((e) => Ne(e, o, t.mask.actions, t.mask.seed, s))) : p, { rowCount: g, checksum: _ } = yield* ft("export", o, a, i, (e) => e.rowCount, Pt(Ot(m, s), t.bundleFile(d), t.compression));
+		}), m = Nt(t.snapshot, o), g = m.length === 0 ? p : p.pipe(c.map((e) => Pt(e, m))), _ = t.mask ? g.pipe(c.map((e) => Ne(e, o, t.mask.actions, t.mask.seed, s))) : g, { rowCount: v, checksum: y } = yield* ft("export", o, a, i, (e) => e.rowCount, It(Ot(_, s), t.bundleFile(d), t.compression));
 		t.ledger.tables[o] = {
-			rowCount: g,
-			checksum: _
+			rowCount: v,
+			checksum: y
 		}, yield* q(t.ledgerPath, t.ledger), K(t.onProgress, {
 			phase: "export",
 			table: o,
 			index: a,
 			tableCount: i,
 			event: "done",
-			rowsDone: g,
-			total: g
+			rowsDone: v,
+			total: v
 		}), r.push({
 			name: o,
 			file: d,
-			rowCount: g,
-			checksum: _,
+			rowCount: v,
+			checksum: y,
 			columnTypes: s,
 			primaryKey: u
 		});
 	}
 	return r;
-}), Lt = (e) => ({
+}), zt = (e) => ({
 	_tag: "RawSqlFragment",
 	strings: [e],
 	values: []
-}), Rt = (t, i, a) => n.tryPromise({
+}), Bt = (t, i, a) => n.tryPromise({
 	try: () => t.transactional(async (t) => {
-		if (t.raw) for (let e of ve(i)) await t.raw(Lt(e));
+		if (t.raw) for (let e of _e(i)) await t.raw(zt(e));
 		let o = await n.runPromiseExit(a(t));
 		if (r.isFailure(o)) throw Error(e.pretty(o.cause));
 		return o.value;
 	}),
 	catch: (e) => e instanceof P ? e : new P({ reason: `snapshot export failed: ${J(e)}` })
-}), zt = (e) => n.gen(function* () {
+}), Vt = (e) => n.gen(function* () {
 	let t = e.scope ?? { kind: "all" }, r = Je(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, s = o.exponential("50 millis").pipe(o.jittered, o.intersect(o.recurs(a))), l = yield* n.promise(() => import("node:path")), u = (t) => l.join(e.outDir, t);
 	yield* n.tryPromise({
 		try: async () => {
@@ -690,7 +697,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
 	}), m = At(p.tables, e.snapshot), h = e.consistency ?? "live", _, v;
 	if (e.masking) {
-		let t = e.classification ?? k(e.snapshot), r = Ae(m.map((t) => ({
+		let t = e.classification ?? A(e.snapshot), r = Ae(m.map((t) => ({
 			name: t,
 			columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 				name: e.name,
@@ -723,7 +730,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		bundleFile: u,
 		...v ? { mask: v } : {},
 		...e.onProgress ? { onProgress: e.onProgress } : {}
-	}, ee = h === "snapshot" ? yield* Rt(e.store, e.dialect, (e) => It(e, y)) : yield* It(e.store, y), b = 0, x = 0;
+	}, b = h === "snapshot" ? yield* Bt(e.store, e.dialect, (e) => Rt(e, y)) : yield* Rt(e.store, y), x = 0, S = 0;
 	if (e.assets) {
 		let t = u(G);
 		yield* c.runForEach(e.assets.list(), (r) => r.key in f.assets ? n.void : e.assets.open(r.key).pipe(n.flatMap((e) => Ge(e, u(W))), n.flatMap((e) => {
@@ -733,10 +740,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				size: e.size,
 				contentType: e.contentType
 			};
-			return b++, x += e.size, f.assets[r.key] = !0, Ft(t, JSON.stringify(i)).pipe(n.andThen(q(d, f)));
+			return x++, S += e.size, f.assets[r.key] = !0, Lt(t, JSON.stringify(i)).pipe(n.andThen(q(d, f)));
 		}))).pipe(n.mapError((e) => e instanceof P ? e : new P({ reason: `asset export failed: ${String(e)}` })));
 	}
-	let S = {
+	let C = {
 		formatVersion: 1,
 		createdAt: e.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
 		source: {
@@ -746,10 +753,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		scope: t,
 		consistency: h,
 		compression: r,
-		tables: ee,
-		assets: b > 0 ? {
-			count: b,
-			totalBytes: x,
+		tables: b,
+		assets: x > 0 ? {
+			count: x,
+			totalBytes: S,
 			index: G
 		} : {
 			count: 0,
@@ -759,7 +766,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	};
 	return yield* n.tryPromise({
 		try: async () => {
-			await (await import("node:fs/promises")).writeFile(u(H), rt(S));
+			await (await import("node:fs/promises")).writeFile(u(H), rt(C));
 		},
 		catch: (e) => new P({
 			reason: `manifest write failed: ${J(e)}`,
@@ -768,14 +775,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	}), yield* n.tryPromise({
 		try: async () => {
 			let e = await import("node:fs/promises"), t = await import("node:os");
-			await e.writeFile(u(at), ct(S, { hostname: t.hostname() }));
+			await e.writeFile(u(at), ct(C, { hostname: t.hostname() }));
 		},
 		catch: (e) => new P({
 			reason: `readme write failed: ${J(e)}`,
 			path: at
 		})
-	}), S;
-}), Bt = (e) => {
+	}), C;
+}), Ht = (e) => {
 	switch (e) {
 		case "id":
 		case "text":
@@ -794,12 +801,12 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "raw": return "raw";
 		default: return "string";
 	}
-}, Vt = {
+}, Ut = {
 	vector: /* @__PURE__ */ new Set(["postgres"]),
 	array: /* @__PURE__ */ new Set(["postgres"]),
 	interval: /* @__PURE__ */ new Set(["postgres"])
-}, Ht = (e, t, n, r) => {
-	let i = Bt(n);
+}, Wt = (e, t, n, r) => {
+	let i = Ht(n);
 	if (i === "raw") return {
 		table: e,
 		column: t,
@@ -807,7 +814,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `raw() is verbatim source-dialect SQL — it cannot be assumed valid on ${r}`
 	};
-	let a = Vt[i];
+	let a = Ut[i];
 	return !a || a.has(r) ? null : i === "array" || i === "interval" ? {
 		table: e,
 		column: t,
@@ -821,15 +828,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `${i} columns require a ${[...a].join("/")} target; ${r} has no compatible column type`
 	};
-}, Ut = (e, t, n) => {
+}, Gt = (e, t, n) => {
 	if (t === n) return [];
 	let r = [];
 	for (let t of e) for (let [e, i] of Object.entries(t.columnTypes)) {
-		let a = Ht(t.name, e, i, n);
+		let a = Wt(t.name, e, i, n);
 		a && r.push(a);
 	}
 	return r;
-}, Wt = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, Gt = (e) => {
+}, Kt = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, qt = (e) => {
 	let t = e.constraint ?? e.column, n = t === void 0 ? "" : ` ${t}`;
 	switch (e.kind) {
 		case "foreignKey": return `foreign key${n}: the referenced row does not exist (import it first, or check the bundle's table order)`;
@@ -838,22 +845,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "notNull": return `not-null constraint${n}: the column requires a value`;
 		case "check": return `check constraint${n}: the row does not satisfy it`;
 	}
-}, Kt = (e) => {
+}, Jt = (e) => {
 	let t = [e.dbCode, e.dbErrno ?? e.dbNumber].filter((e) => e !== void 0).map(String);
 	return t.length > 0 ? t.join("/") : void 0;
-}, qt = (e) => {
-	let t = d(e), n = l(t), r = Kt(t), i = r === void 0 ? "" : ` [${r}]`;
-	if (n !== void 0) return `${Gt(n)}${i}`;
+}, Yt = (e) => {
+	let t = d(e), n = l(t), r = Jt(t), i = r === void 0 ? "" : ` [${r}]`;
+	if (n !== void 0) return `${qt(n)}${i}`;
 	let a = typeof t.dbMessage == "string" ? t.dbMessage : void 0, o = e?.message, s = typeof o == "string" && o.length > 0 ? o : String(e), c = a !== void 0 && a !== s && !a.startsWith("SqlError:") ? a : s, u = c === "Failed to execute statement" ? `the database refused the write and the driver gave no detail${i}` : `${c}${i}`;
 	return u.length <= 300 ? u : `${u.slice(0, 300)}…`;
-}, Jt = (e, t) => e.tables.find((e) => e.name === t), Yt = (e, t) => new Map((Jt(e, t)?.columns ?? []).map((e) => [e.name, e])), Xt = (e, t) => {
+}, Xt = (e, t) => e.tables.find((e) => e.name === t), Zt = (e, t) => new Map((Xt(e, t)?.columns ?? []).map((e) => [e.name, e])), Qt = (e, t) => {
 	let n = [];
 	for (let r of [...e.tables].sort((e, t) => e.name.localeCompare(t.name))) {
-		if (Jt(t, r.name) === void 0) {
+		if (Xt(t, r.name) === void 0) {
 			n.push(`table '${r.name}' is in the bundle but MISSING from the target — its rows have nowhere to go`);
 			continue;
 		}
-		let e = Yt(t, r.name), i = new Map(r.columns.map((e) => [e.name, e]));
+		let e = Zt(t, r.name), i = new Map(r.columns.map((e) => [e.name, e]));
 		for (let [t, a] of i) {
 			let i = e.get(t);
 			if (i === void 0) {
@@ -865,7 +872,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		for (let [t, a] of e) i.has(t) || !a.nullable && !a.hasDefault && n.push(`${r.name}.${t}: the target requires it (NOT NULL, no default) and the bundle carries no value — every row of this table would fail`);
 	}
 	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n;
-}, Zt = (e, t, n) => {
+}, $t = (e, t, n) => {
 	let r = g(t);
 	if (r === e || n === void 0) return {
 		drifted: !1,
@@ -873,14 +880,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		targetFingerprint: r,
 		diff: []
 	};
-	let i = Xt(n, t);
+	let i = Qt(n, t);
 	return {
 		drifted: i.length > 0,
 		bundleFingerprint: e,
 		targetFingerprint: r,
 		diff: i
 	};
-}, Qt = (e) => n.tryPromise({
+}, en = (e) => n.tryPromise({
 	try: async () => {
 		let t = await import("node:fs/promises"), n = await import("node:path");
 		return it(await t.readFile(n.join(e, H), "utf8"));
@@ -889,8 +896,8 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `manifest read/parse failed: ${String(e?.message ?? e)}`,
 		path: H
 	})
-}), $t = (t) => n.gen(function* () {
-	let i = yield* n.promise(() => import("node:path")), a = yield* Qt(t.bundleDir);
+}), tn = (t) => n.gen(function* () {
+	let i = yield* n.promise(() => import("node:path")), a = yield* en(t.bundleDir);
 	if (a.formatVersion !== 1) return yield* n.fail(new P({ reason: `unsupported bundle formatVersion ${a.formatVersion} (expected 1)` }));
 	if (t.tables !== void 0) {
 		let e = new Set(a.tables.map((e) => e.name)), r = t.tables.filter((t) => !e.has(t));
@@ -911,7 +918,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				unique: !1,
 				hasDefault: !1
 			}))
-		})) }, r = Zt(s.source.schemaFingerprint, t.targetSnapshot, e);
+		})) }, r = $t(s.source.schemaFingerprint, t.targetSnapshot, e);
 		if (r.drifted) {
 			if (!t.force) return yield* n.fail(new Le({
 				bundleFingerprint: r.bundleFingerprint,
@@ -922,11 +929,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	}
 	if (t.targetDialect && t.targetDialect !== s.source.dialect) {
-		let e = Ut(s.tables, s.source.dialect, t.targetDialect).filter((e) => e.severity === "block");
+		let e = Gt(s.tables, s.source.dialect, t.targetDialect).filter((e) => e.severity === "block");
 		if (e.length > 0 && !t.allowIncompatible) return yield* n.fail(new Be({
 			sourceDialect: s.source.dialect,
 			targetDialect: t.targetDialect,
-			blocking: e.map(Wt)
+			blocking: e.map(Kt)
 		}));
 	}
 	let l = t.verify ?? !0, u = t.mode ?? "upsert", d = t.onConflict ?? "skip", f = t.ledgerPath ?? i.join(t.bundleDir, ".import..ledger.json"), m = yield* mt(f);
@@ -935,40 +942,60 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `replace refuses a partial bundle (scope='${s.scope.kind}') — truncating would delete rows not in the bundle. Use --mode upsert, or re-export with full scope.`
 	}));
 	if (t.dryRun === !0) return s;
-	let h = (e, t, n) => {
-		let r = t.name, i = t.primaryKey;
-		return u === "append" ? d === "fail" ? e.insert(r, n) : e.insertIgnore(r, n, { conflictColumns: [i] }) : u === "replace" ? e.insert(r, n) : e.upsert(r, n, { conflictColumns: [i] });
-	}, g = (e, t, r = !0) => n.tryPromise({
+	let h = /* @__PURE__ */ new Map();
+	for (let e of t.targetSnapshot?.tables ?? []) {
+		let t = e.columns.filter((e) => e.generatedAs !== void 0).map((e) => e.name);
+		t.length > 0 && h.set(e.name, t);
+	}
+	let g = (e, t) => {
+		let n = h.get(e);
+		if (n === void 0) return t;
+		let r;
+		for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
+		return r ?? t;
+	}, _ = (e, t, n) => {
+		let r = t.name, i = t.primaryKey, a = g(r, n);
+		return u === "append" ? d === "fail" ? e.insert(r, a) : e.insertIgnore(r, a, { conflictColumns: [i] }) : u === "replace" ? e.insert(r, a) : e.upsert(r, a, { conflictColumns: [i] });
+	}, v = (e, t, r = !0) => n.tryPromise({
 		try: e,
-		catch: (e) => qt(e)
-	}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e), !1)))), _ = (e) => {
+		catch: (e) => Yt(e)
+	}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e), !1)))), y = (e) => {
 		let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 		if (t.length !== 0) return {
 			...e.row,
 			...Object.fromEntries(t.map((e) => [e, null]))
 		};
-	}, v = (e, t) => n.gen(function* () {
+	}, b = (e) => {
+		let t = new Set(e.map((e) => String(e.row[e.entry.primaryKey]))), n = (e) => Object.entries(e.entry.columnTypes).some(([n, r]) => {
+			if (r !== "reference") return !1;
+			let i = e.row[n];
+			return i != null && t.has(String(i));
+		}), r = e.map((e) => ({
+			table: e.entry.name,
+			id: String(e.row[e.entry.primaryKey]),
+			reason: e.reason,
+			derived: n(e)
+		}));
+		return new Ie({
+			rows: [...r.filter((e) => !e.derived), ...r.filter((e) => e.derived)].slice(0, 20),
+			primaryCount: r.filter((e) => !e.derived).length,
+			totalCount: e.length
+		});
+	}, x = (e, t) => n.gen(function* () {
 		let r = t, i = [], a = !0;
 		for (; r.length > 0 && a;) {
 			a = !1;
 			let t = [];
-			for (let n of r) (yield* g(() => h(e, n.entry, n.row), n)) ? a = !0 : t.push(n);
+			for (let n of r) (yield* v(() => _(e, n.entry, n.row), n)) ? a = !0 : t.push(n);
 			if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
-				let r = t[n], o = _(r);
-				o !== void 0 && (yield* g(() => h(e, r.entry, o), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+				let r = t[n], o = y(r);
+				o !== void 0 && (yield* v(() => _(e, r.entry, o), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 			}
 			r = t;
 		}
-		for (let t of i) (yield* g(() => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] }), t)) || (r = [...r, t]);
-		if (r.length > 0) return yield* n.fail(new Ie({
-			rows: r.slice(0, 20).map((e) => ({
-				table: e.entry.name,
-				id: String(e.row[e.entry.primaryKey]),
-				reason: e.reason
-			})),
-			totalCount: r.length
-		}));
-	}), y = (e, r) => n.gen(function* () {
+		for (let t of i) (yield* v(() => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] }), t)) || (r = [...r, t]);
+		if (r.length > 0) return yield* n.fail(b(r));
+	}), S = (e, r) => n.gen(function* () {
 		if (u === "replace" && !(r && m.truncated)) {
 			for (let t of [...s.tables].reverse()) yield* n.tryPromise({
 				try: () => e.deleteMany(t.name, { where: p(t.primaryKey) }),
@@ -976,42 +1003,42 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			});
 			r && (m.truncated = !0, yield* q(f, m));
 		}
-		let a = [], o = [], d = [], g = s.tables.length;
+		let a = [], o = [], d = [], h = s.tables.length;
 		for (let p = 0; p < s.tables.length; p++) {
-			let _ = s.tables[p];
-			if (r && _.name in m.tables) {
-				d.push(_.name), K(t.onProgress, {
+			let g = s.tables[p];
+			if (r && g.name in m.tables) {
+				d.push(g.name), K(t.onProgress, {
 					phase: "import",
-					table: _.name,
+					table: g.name,
 					index: p,
-					tableCount: g,
+					tableCount: h,
 					event: "done",
-					rowsDone: m.tables[_.name].rowCount,
-					total: _.rowCount
+					rowsDone: m.tables[g.name].rowCount,
+					total: g.rowCount
 				});
 				continue;
 			}
-			let v = i.join(t.bundleDir, _.file);
+			let v = i.join(t.bundleDir, g.file);
 			K(t.onProgress, {
 				phase: "import",
-				table: _.name,
+				table: g.name,
 				index: p,
-				tableCount: g,
+				tableCount: h,
 				event: "start",
 				rowsDone: 0,
-				total: _.rowCount
+				total: g.rowCount
 			});
-			let y = a.length, ee = n.gen(function* () {
-				let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, l = C("bundle", () => T(v).pipe(Ze(s.compression))).pipe(c.tap((e) => n.sync(() => i.update(e)))), d = async (t) => {
+			let y = a.length, b = n.gen(function* () {
+				let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, l = w("bundle", () => E(v).pipe(Ze(s.compression))).pipe(c.tap((e) => n.sync(() => i.update(e)))), d = async (t) => {
 					let n = {
-						entry: _,
+						entry: g,
 						row: t,
 						reason: ""
 					};
 					try {
-						await h(e, _, t);
+						await _(e, g, t);
 					} catch (e) {
-						n.reason = qt(e), a.push(n);
+						n.reason = Yt(e), a.push(n);
 					}
 				}, f = yield* n.promise(async () => {
 					let n = t.copyLoader;
@@ -1020,7 +1047,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					if (u !== "upsert") return !1;
 					try {
 						return (await e.query({
-							table: _.name,
+							table: g.name,
 							predicate: void 0,
 							order: [],
 							take: 1,
@@ -1030,25 +1057,25 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					} catch {
 						return !1;
 					}
-				}), p = Object.keys(_.columnTypes), m = Math.max(1, t.copyBatchSize ?? 5e3), g = [], y = async () => {
-					if (g.length === 0) return;
-					let e = g;
-					g = [];
+				}), p = Object.keys(g.columnTypes), m = Math.max(1, t.copyBatchSize ?? 5e3), h = [], y = async () => {
+					if (h.length === 0) return;
+					let e = h;
+					h = [];
 					try {
 						await t.copyLoader.copyInto({
-							table: _.name,
+							table: g.name,
 							columns: p,
-							columnTypes: _.columnTypes,
+							columnTypes: g.columnTypes,
 							rows: e
 						});
 					} catch (n) {
-						f = !1, t.onWarn?.(`bulk COPY into ${_.name} failed (${String(n?.message ?? n)}); falling back to per-row writes for this table`);
+						f = !1, t.onWarn?.(`bulk COPY into ${g.name} failed (${String(n?.message ?? n)}); falling back to per-row writes for this table`);
 						for (let t of e) await d(t);
 					}
 				};
-				return yield* c.runForEach(kt(l, _.name, _.columnTypes), (e) => n.promise(async () => {
+				return yield* c.runForEach(kt(l, g.name, g.columnTypes), (e) => n.promise(async () => {
 					if (o++, f) {
-						g.push(e), g.length >= m && await y();
+						h.push(e), h.length >= m && await y();
 						return;
 					}
 					await d(e);
@@ -1056,36 +1083,36 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					rowCount: o,
 					checksum: i.digest("hex")
 				};
-			}), { rowCount: b, checksum: x } = yield* ft("import", _.name, p, g, (e) => e.rowCount, ee);
+			}), { rowCount: x, checksum: S } = yield* ft("import", g.name, p, h, (e) => e.rowCount, b);
 			if (l) {
-				if (x !== _.checksum) return yield* n.fail(new F({
-					what: `table ${_.name} checksum`,
-					expected: _.checksum,
-					actual: x
+				if (S !== g.checksum) return yield* n.fail(new F({
+					what: `table ${g.name} checksum`,
+					expected: g.checksum,
+					actual: S
 				}));
-				if (b !== _.rowCount) return yield* n.fail(new F({
-					what: `table ${_.name} rowCount`,
-					expected: String(_.rowCount),
-					actual: String(b)
+				if (x !== g.rowCount) return yield* n.fail(new F({
+					what: `table ${g.name} rowCount`,
+					expected: String(g.rowCount),
+					actual: String(x)
 				}));
 			}
 			K(t.onProgress, {
 				phase: "import",
-				table: _.name,
+				table: g.name,
 				index: p,
-				tableCount: g,
+				tableCount: h,
 				event: "done",
-				rowsDone: b,
-				total: _.rowCount
+				rowsDone: x,
+				total: g.rowCount
 			}), r && (a.length > y ? o.push({
-				name: _.name,
-				rowCount: b
-			}) : (m.tables[_.name] = {
-				rowCount: b,
-				checksum: _.checksum
+				name: g.name,
+				rowCount: x
+			}) : (m.tables[g.name] = {
+				rowCount: x,
+				checksum: g.checksum
 			}, yield* q(f, m)));
 		}
-		if (a.length > 0 && (yield* v(e, a)), r && o.length > 0) {
+		if (a.length > 0 && (yield* x(e, a)), r && o.length > 0) {
 			for (let e of o) {
 				let t = s.tables.find((t) => t.name === e.name);
 				m.tables[e.name] = {
@@ -1102,29 +1129,29 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	});
 	if (t.atomic ? yield* n.tryPromise({
 		try: () => t.store.transactional(async (t) => {
-			let i = await n.runPromiseExit(y(t, !1));
+			let i = await n.runPromiseExit(S(t, !1));
 			if (r.isFailure(i)) throw Error(e.pretty(i.cause));
 		}),
 		catch: (e) => new P({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
-	}) : yield* y(t.store, !0), t.assets && s.assets.index && !t.assetsAlreadyRestored) {
-		let e = t.assets, r = i.join(t.bundleDir, W), a = i.join(t.bundleDir, s.assets.index ?? "assets/index.ndjson"), o = C("bundle", () => T(a)).pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.map((e) => JSON.parse(e)));
+	}) : yield* S(t.store, !0), t.assets && s.assets.index && !t.assetsAlreadyRestored) {
+		let e = t.assets, r = i.join(t.bundleDir, W), a = i.join(t.bundleDir, s.assets.index ?? "assets/index.ndjson"), o = w("bundle", () => E(a)).pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.map((e) => JSON.parse(e)));
 		yield* c.runForEach(o, (t) => t.key in m.assets ? n.void : Ke(e, r, t).pipe(n.andThen(n.sync(() => {
 			m.assets[t.key] = !0;
 		})), n.andThen(q(f, m))));
 	}
 	return s;
-}), en = (e) => e, tn = (e) => {
+}), nn = (e) => e, rn = (e) => {
 	if (e.allowLive || e.liveInstance === null || e.sameTarget === "different") return { refuse: !1 };
 	let t = e.targetLabel === void 0 ? "" : ` Target: ${e.targetLabel}.`, n = e.sameTarget === "same" ? " That instance is connected to the SAME database." : " We could not confirm which database that instance is connected to, so this is refused on the conservative reading — an older instance, or one whose connection could not be parsed, reports nothing to compare.";
 	return {
 		refuse: !0,
 		message: `refusing to write into a target with a LIVE instance (${e.liveInstance}).${t}${n} A direct import is an uncoordinated concurrent writer — readers see partial state, the reactive layer either storms or goes stale, and rows race with live writes. Re-run with --allow-live to override, or use a live-safe strategy (shadow-swap for replace, or the api target).`
 	};
-}, Y = Buffer.from("VBUNDLE2"), nn = 0, rn = 1, an = 2, on = 32, sn = async (e) => {
+}, Y = Buffer.from("VBUNDLE2"), an = 0, on = 1, sn = 2, cn = 32, ln = async (e) => {
 	let t = [], n = async (r) => {
 		let i;
 		try {
-			i = await le(O(e, r), { withFileTypes: !0 });
+			i = await ce(k(e, r), { withFileTypes: !0 });
 		} catch {
 			return;
 		}
@@ -1134,21 +1161,21 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	};
 	return await n(""), t.sort();
-}, cn = (e, t) => {
+}, un = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.alloc(5 + n.length + 8);
-	return r.writeUInt8(rn, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
-}, ln = (e, t, n) => {
+	return r.writeUInt8(on, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
+}, dn = (e, t, n) => {
 	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8"), a = Buffer.alloc(5 + r.length + 2 + i.length + 8), o = 0;
-	return a.writeUInt8(an, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
+	return a.writeUInt8(sn, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
 };
-async function* un(e) {
+async function* fn(e) {
 	yield new Uint8Array(Y);
-	for (let t of await sn(e.dir)) {
-		let n = O(e.dir, t), r = await ue(n);
-		if (yield new Uint8Array(cn(t, r.size)), r.size > 0) for await (let e of T(n)) yield new Uint8Array(e);
+	for (let t of await ln(e.dir)) {
+		let n = k(e.dir, t), r = await le(n);
+		if (yield new Uint8Array(un(t, r.size)), r.size > 0) for await (let e of E(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
-		yield new Uint8Array(ln(t.key, t.contentType, t.size));
+		yield new Uint8Array(dn(t.key, t.contentType, t.size));
 		let n = y("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
@@ -1157,11 +1184,11 @@ async function* un(e) {
 		if (r !== t.size) throw Error(`blob '${t.key}' size mismatch: header ${t.size}, streamed ${r}`);
 		yield new Uint8Array(n.digest());
 	}
-	yield new Uint8Array(Buffer.from([nn]));
+	yield new Uint8Array(Buffer.from([an]));
 }
-var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn = (e) => new Promise((t) => e.end(t)), pn = async (e, t) => {
-	let n = me(t.dir);
-	await D(n, { recursive: !0 });
+var pn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mn = (e) => new Promise((t) => e.end(t)), hn = async (e, t) => {
+	let n = pe(t.dir);
+	await O(n, { recursive: !0 });
 	let r = Buffer.alloc(0), i = e[Symbol.asyncIterator](), a = !1, o = async () => {
 		let { value: e, done: t } = await i.next();
 		return t ? (a = !0, !1) : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
@@ -1176,24 +1203,24 @@ var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn
 		for (;;) {
 			await s(1);
 			let e = c(1).readUInt8(0);
-			if (e === nn) return;
-			if (e === rn) {
+			if (e === an) return;
+			if (e === on) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
 				let t = c(e).toString("utf8");
 				await s(8);
-				let i = c(8).readBigUInt64BE(0), a = me(n, t);
-				if (a !== n && !a.startsWith(n + he)) throw Error(`archive path '${t}' escapes the destination`);
-				await D(pe(a), { recursive: !0 });
-				let o = E(a);
+				let i = c(8).readBigUInt64BE(0), a = pe(n, t);
+				if (a !== n && !a.startsWith(n + me)) throw Error(`archive path '${t}' escapes the destination`);
+				await O(fe(a), { recursive: !0 });
+				let o = D(a);
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
-					await dn(o, c(e)), i -= BigInt(e);
+					await pn(o, c(e)), i -= BigInt(e);
 				}
-				await fn(o);
-			} else if (e === an) {
+				await mn(o);
+			} else if (e === sn) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
@@ -1203,24 +1230,24 @@ var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = y("sha256"), d = new ie(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = y("sha256"), d = new re(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
 				for (; p > 0n;) {
 					r.length === 0 && await s(1);
 					let e = p < BigInt(r.length) ? Number(p) : r.length, t = c(e);
-					u.update(t), l || await dn(d, t), p -= BigInt(e);
+					u.update(t), l || await pn(d, t), p -= BigInt(e);
 				}
-				l ? d.destroy() : await fn(d), await f, await s(on);
-				let m = c(on);
+				l ? d.destroy() : await mn(d), await f, await s(cn);
+				let m = c(cn);
 				if (!u.digest().equals(m)) throw Error(`blob '${n}' failed integrity (sha mismatch)`);
 			} else throw Error(`unknown bundle entry kind ${e}`);
 		}
 	} finally {
 		a || await Promise.resolve(i.return?.()).catch(() => void 0);
 	}
-}, mn = async (e, t) => {
+}, gn = async (e, t) => {
 	let n = new Set(t), r = /* @__PURE__ */ new Map(), i = Buffer.alloc(0), a = e[Symbol.asyncIterator](), o = async () => {
 		let { value: e, done: t } = await a.next();
 		return !t && (i = i.length === 0 ? Buffer.from(e) : Buffer.concat([i, Buffer.from(e)]), !0);
@@ -1242,8 +1269,8 @@ var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn
 	if (!await s(Y.length) || !c(Y.length).equals(Y)) throw Error("not a bundle archive (bad magic)");
 	for (; await s(1);) {
 		let e = c(1).readUInt8(0);
-		if (e === nn || e === an) break;
-		if (e !== rn) throw Error(`unknown bundle entry kind ${e}`);
+		if (e === an || e === sn) break;
+		if (e !== on) throw Error(`unknown bundle entry kind ${e}`);
 		if (!await s(4)) break;
 		let t = c(4).readUInt32BE(0);
 		if (!await s(t)) break;
@@ -1253,22 +1280,22 @@ var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn
 		if (a === null || n.has(i) && (r.set(i, a), n.delete(i), n.size === 0)) break;
 	}
 	return r;
-}, hn = (e, t) => pn(e, {
+}, _n = (e, t) => hn(e, {
 	dir: t,
-	blobs: gn(t)
-}), gn = (e) => {
+	blobs: vn(t)
+}), vn = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	return {
 		has: async (e) => t.has(e),
 		write: async (n, r, i) => {
-			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = O(e, "assets");
-			await D(c, { recursive: !0 });
+			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = k(e, "assets");
+			await O(c, { recursive: !0 });
 			let l = y("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
-			} }), f = O(c, `.tmp-${Date.now()}-${t.size}`);
-			await o(r, d, E(f));
+			} }), f = k(c, `.tmp-${Date.now()}-${t.size}`);
+			await o(r, d, D(f));
 			let p = l.digest("hex");
-			await a.rename(f, O(c, p)), await a.appendFile(O(c, "index.ndjson"), `${JSON.stringify({
+			await a.rename(f, k(c, p)), await a.appendFile(k(c, "index.ndjson"), `${JSON.stringify({
 				key: n,
 				sha256: p,
 				size: u,
@@ -1276,33 +1303,33 @@ var dn = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), fn
 			})}\n`), t.add(n);
 		}
 	};
-}, _n = ge(x), vn = Buffer.from("VENC1\0\0\0"), yn = 32, bn = 16, xn = 7, X = 16, Sn = 262144, Z = {
+}, yn = he(S), bn = Buffer.from("VENC1\0\0\0"), xn = 32, Sn = 16, Cn = 7, X = 16, wn = 262144, Z = {
 	N: 32768,
 	r: 8,
 	p: 1
-}, Cn = 134217728, Q = 43, wn = (e, t, n) => {
+}, Tn = 134217728, Q = 43, En = (e, t, n) => {
 	let r = Buffer.alloc(12);
-	return e.copy(r, 0, 0, xn), r.writeUInt32BE(t >>> 0, xn), r.writeUInt8(+!!n, 11), r;
+	return e.copy(r, 0, 0, Cn), r.writeUInt32BE(t >>> 0, Cn), r.writeUInt8(+!!n, 11), r;
 };
-async function* Tn(e, t) {
+async function* Dn(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = b(bn), r = b(xn), i = await _n(t, n, yn, {
+	let n = x(Sn), r = x(Cn), i = await yn(t, n, xn, {
 		...Z,
-		maxmem: Cn
+		maxmem: Tn
 	}), a = Buffer.alloc(Q);
-	vn.copy(a, 0), a.writeUInt32BE(Z.N, 8), a.writeUInt32BE(Z.r, 12), a.writeUInt32BE(Z.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
+	bn.copy(a, 0), a.writeUInt32BE(Z.N, 8), a.writeUInt32BE(Z.r, 12), a.writeUInt32BE(Z.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = _("aes-256-gcm", i, wn(r, o, t));
+		let n = _("aes-256-gcm", i, En(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
 		let l = Buffer.alloc(5 + s.length + X);
 		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + X, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
 	}, c = Buffer.alloc(0);
-	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > Sn;) yield s(c.subarray(0, Sn), !1), c = c.subarray(Sn);
+	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > wn;) yield s(c.subarray(0, wn), !1), c = c.subarray(wn);
 	yield s(c, !0);
 }
-async function* En(e, t) {
+async function* On(e, t) {
 	if (!t) throw Error("decryptStream: a non-empty passphrase is required");
 	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = !1, a = async () => {
 		let { value: e, done: t } = await n.next();
@@ -1313,12 +1340,12 @@ async function* En(e, t) {
 	};
 	if (!await o(Q)) throw Error("encrypted bundle truncated (no header)");
 	let s = r.subarray(0, Q);
-	if (!s.subarray(0, 8).equals(vn)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
-	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Q)), p = await _n(t, d, yn, {
+	if (!s.subarray(0, 8).equals(bn)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
+	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Q)), p = await yn(t, d, xn, {
 		N: c,
 		r: l,
 		p: u,
-		maxmem: Cn
+		maxmem: Tn
 	});
 	r = r.subarray(Q);
 	let m = 0, h = !1;
@@ -1333,7 +1360,7 @@ async function* En(e, t) {
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
 		let n = r.subarray(5, 5 + t - X), i = r.subarray(5 + t - X, 5 + t);
 		r = r.subarray(5 + t);
-		let a = v("aes-256-gcm", p, wn(f, m, e));
+		let a = v("aes-256-gcm", p, En(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -1341,7 +1368,7 @@ async function* En(e, t) {
 }
 //#endregion
 //#region src/blobStorage.ts
-var Dn = (e, t) => ({
+var kn = (e, t) => ({
 	list: () => {
 		let e = t();
 		return { async *[Symbol.asyncIterator]() {
@@ -1354,29 +1381,29 @@ var Dn = (e, t) => ({
 		} };
 	},
 	open: (t) => ({ async *[Symbol.asyncIterator]() {
-		let r = await n.runPromise(te(e, t)), i = await re(r.stream);
+		let r = await n.runPromise(ee(e, t)), i = await ne(r.stream);
 		for await (let e of i) yield e instanceof Uint8Array ? e : new Uint8Array(e);
 	} })
-}), On = (e, t) => Dn(e, () => h(t, {
-	table: S,
+}), An = (e, t) => kn(e, () => h(t, {
+	table: C,
 	chunkSize: 500
 }).pipe(c.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-})))), kn = (e) => ({
+})))), jn = (e) => ({
 	has: (t) => n.runPromise(e.head(t).pipe(n.map((e) => e !== null))),
 	write: async (t, r, i) => {
-		let a = C("storage", () => ae.from(r));
-		await n.runPromise(ne(e, t, a, {
+		let a = w("storage", () => ie.from(r));
+		await n.runPromise(te(e, t, a, {
 			contentType: i.contentType,
 			totalSize: i.size
 		}));
 	}
-}), An = (e, t) => {
+}), Mn = (e, t) => {
 	let n = t === "dump" ? "mariadb-dump" : "mariadb", r = t === "dump" ? "mysqldump" : "mysql";
-	return e === "mariadb" && jn(n) ? n : r;
-}, jn = (e) => (process.env.PATH ?? "").split(fe).filter((e) => e !== "").some((t) => se(O(t, e))), Mn = (e) => {
+	return e === "mariadb" && Nn(n) ? n : r;
+}, Nn = (e) => (process.env.PATH ?? "").split(de).filter((e) => e !== "").some((t) => oe(k(t, e))), Pn = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -1386,7 +1413,7 @@ var Dn = (e, t) => ({
 		case "mssql": return "db.bacpac";
 		default: return "db.dump";
 	}
-}, Nn = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
+}, Fn = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
 	if (e.host || e.database) return {
 		host: e.host ?? "localhost",
 		port: e.port ?? 3306,
@@ -1402,7 +1429,7 @@ var Dn = (e, t) => ({
 		password: decodeURIComponent(t.password) || "",
 		database: t.pathname.replace(/^\//, "") || ""
 	};
-}, Pn = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Fn = (e, t, n) => {
+}, In = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Ln = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -1449,7 +1476,7 @@ var Dn = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				tool: An(e, "dump"),
+				tool: Mn(e, "dump"),
 				args: [
 					"--single-transaction",
 					"--routines",
@@ -1471,7 +1498,7 @@ var Dn = (e, t) => ({
 		case "sqlite":
 		case "turso": return {
 			kind: "copy",
-			from: Nn(t),
+			from: Fn(t),
 			to: n
 		};
 		case "mssql": return {
@@ -1479,7 +1506,7 @@ var Dn = (e, t) => ({
 			tool: "sqlpackage",
 			args: [
 				"/Action:Export",
-				`/SourceConnectionString:${Pn($({
+				`/SourceConnectionString:${In($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -1492,7 +1519,7 @@ var Dn = (e, t) => ({
 			reason: `no native backup for dialect '${e}'`
 		});
 	}
-}, In = (e, t, n) => {
+}, Rn = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -1537,7 +1564,7 @@ var Dn = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				tool: An(e, "client"),
+				tool: Mn(e, "client"),
 				args: [
 					"--protocol=TCP",
 					"-h",
@@ -1556,14 +1583,14 @@ var Dn = (e, t) => ({
 		case "turso": return {
 			kind: "copy",
 			from: n,
-			to: Nn(t)
+			to: Fn(t)
 		};
 		case "mssql": return {
 			kind: "spawn",
 			tool: "sqlpackage",
 			args: [
 				"/Action:Import",
-				`/TargetConnectionString:${Pn($({
+				`/TargetConnectionString:${In($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -1576,13 +1603,13 @@ var Dn = (e, t) => ({
 			reason: `no native restore for dialect '${e}'`
 		});
 	}
-}, Ln = (e) => e.kind === "copy" ? n.async((t) => {
-	oe(e.from, e.to, (r) => t(r ? n.fail(new L({
+}, zn = (e) => e.kind === "copy" ? n.async((t) => {
+	ae(e.from, e.to, (r) => t(r ? n.fail(new L({
 		tool: "copy",
 		reason: `copy ${e.from} → ${e.to}: ${r.message}`
 	})) : n.void));
 }) : n.async((t) => {
-	let r = _e(e.tool, [...e.args], {
+	let r = ge(e.tool, [...e.args], {
 		env: {
 			...process.env,
 			...e.env
@@ -1595,10 +1622,10 @@ var Dn = (e, t) => ({
 	}), i = "";
 	r.stderr?.on("data", (e) => {
 		i += String(e);
-	}), e.stdoutFile && r.stdout && r.stdout.pipe(E(e.stdoutFile)), e.stdinFile && r.stdin && T(e.stdinFile).pipe(r.stdin);
+	}), e.stdoutFile && r.stdout && r.stdout.pipe(D(e.stdoutFile)), e.stdinFile && r.stdin && E(e.stdinFile).pipe(r.stdin);
 	let a = () => {
 		if (e.stdoutFile !== void 0) try {
-			ce(e.stdoutFile);
+			se(e.stdoutFile);
 		} catch {}
 	};
 	r.on("error", (r) => {
@@ -1613,15 +1640,15 @@ var Dn = (e, t) => ({
 		}
 		a(), t(n.fail(new L({
 			tool: e.tool,
-			reason: `exited with code ${r}` + (e.stdoutFile === void 0 ? "" : ` — the partial ${de(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
+			reason: `exited with code ${r}` + (e.stdoutFile === void 0 ? "" : ` — the partial ${ue(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
 			stderr: i.slice(-2e3)
 		})));
 	});
-}), Rn = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), zn = (e) => n.gen(function* () {
+}), Bn = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Vn = (e) => n.gen(function* () {
 	let t = yield* V(e.scope ?? { kind: "all" }, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
-	}), r = At(t.tables, e.snapshot), i = e.classification ?? k(e.snapshot), a = e.sampleSize ?? 20, o = Ae(r.map((t) => ({
+	}), r = At(t.tables, e.snapshot), i = e.classification ?? A(e.snapshot), a = e.sampleSize ?? 20, o = Ae(r.map((t) => ({
 		name: t,
 		columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 			name: e.name,
@@ -1641,7 +1668,7 @@ var Dn = (e, t) => ({
 			let n = e.slice(i.length + 1);
 			m.push({
 				column: n,
-				action: Rn(t),
+				action: Bn(t),
 				before: f[n],
 				after: p[n]
 			});
@@ -1656,7 +1683,7 @@ var Dn = (e, t) => ({
 		leaks: l,
 		unclassified: o.unclassified
 	};
-}), Bn = (e, t) => {
+}), Hn = (e, t) => {
 	let n = new Map(t.map((e) => [e.name, e])), r = [], i = {};
 	for (let t of e) {
 		let e = n.get(t.name);
@@ -1711,7 +1738,7 @@ var Dn = (e, t) => ({
 		skipColumns: i,
 		refuse: r.some((e) => e.verdict === "refuse")
 	};
-}, Vn = (e) => {
+}, Un = (e) => {
 	if (e.findings.length === 0) return ["  schema matches the bundle"];
 	let t = {
 		safe: "✓",
@@ -1722,4 +1749,4 @@ var Dn = (e, t) => ({
 	return n.push(""), n.push(`  discarded: ${r("value-dropped")}   defaulted: ${r("filled-by-default")}   refused: ${r("refuse")}`), e.refuse && (n.push(""), n.push("  REFUSED — no row was written. These are the differences that would make"), n.push("  imported rows WRONG rather than merely incomplete.")), n;
 };
 //#endregion
-export { W as ASSETS_DIR, G as ASSET_INDEX_FILE, P as BundleError, Pe as CodecError, Fe as CompressionError, Be as CrossDialectError, U as DATA_DIR, ye as DEFAULT_CLASS_ACTIONS, Ie as DanglingReferenceError, Qe as FORMAT_VERSION, ze as ImportModeError, F as IntegrityError, ot as LEDGER_FILE, H as MANIFEST_FILE, Re as MaskingError, L as NativeToolError, Le as SchemaDriftError, I as ScopeError, Oe as applyAction, tn as assessLiveImport, gt as assetDone, Mn as backupArtifactName, Fn as backupCommand, Bt as canonicalType, Ut as checkPortability, Zt as checkSchemaDrift, k as classificationFromSnapshot, Bn as classifyImportDrift, Ye as compressionExt, z as computeSubsetIds, it as decodeManifest, Et as decodeRow, wt as decodeValue, En as decryptStream, en as defineDataProfile, Xt as diffSnapshots, gn as dirBlobSink, pt as emptyLedger, rt as encodeManifest, Tt as encodeRow, St as encodeValue, Tn as encryptStream, Vn as formatImportDrift, Wt as formatIssue, qe as hasZstd, Xe as makeCompressor, Ze as makeDecompressor, Ne as maskRow, kt as ndjsonToRows, un as packBundle, mn as peekBundle, Je as pickCompression, Ae as planMasking, zn as previewMasking, mt as readLedger, be as resolveAction, V as resolveScope, Ke as restoreAssetFromCas, In as restoreCommand, Ot as rowsToNdjson, zt as runExport, $t as runImport, Ln as runNativeStep, Me as scanForLeaks, We as storageAssetSink, Ue as storageAssetSource, kn as storageBlobSink, Dn as storageBlobSource, On as storageRefsBlobSource, He as subsetToScope, ht as tableDone, At as topoSortTables, pn as unpackBundle, hn as unpackBundleToDir, Ge as writeAssetToCas, q as writeLedger };
+export { W as ASSETS_DIR, G as ASSET_INDEX_FILE, P as BundleError, Pe as CodecError, Fe as CompressionError, Be as CrossDialectError, U as DATA_DIR, ve as DEFAULT_CLASS_ACTIONS, Qe as FORMAT_VERSION, ze as ImportModeError, F as IntegrityError, ot as LEDGER_FILE, H as MANIFEST_FILE, Re as MaskingError, L as NativeToolError, Ie as RowsRefusedError, Le as SchemaDriftError, I as ScopeError, Oe as applyAction, rn as assessLiveImport, gt as assetDone, Pn as backupArtifactName, Ln as backupCommand, Ht as canonicalType, Gt as checkPortability, $t as checkSchemaDrift, A as classificationFromSnapshot, Hn as classifyImportDrift, Ye as compressionExt, z as computeSubsetIds, it as decodeManifest, Et as decodeRow, wt as decodeValue, On as decryptStream, nn as defineDataProfile, Qt as diffSnapshots, vn as dirBlobSink, pt as emptyLedger, rt as encodeManifest, Tt as encodeRow, St as encodeValue, Dn as encryptStream, Un as formatImportDrift, Kt as formatIssue, qe as hasZstd, Xe as makeCompressor, Ze as makeDecompressor, Ne as maskRow, kt as ndjsonToRows, fn as packBundle, gn as peekBundle, Je as pickCompression, Ae as planMasking, Vn as previewMasking, mt as readLedger, ye as resolveAction, V as resolveScope, Ke as restoreAssetFromCas, Rn as restoreCommand, Ot as rowsToNdjson, Vt as runExport, tn as runImport, zn as runNativeStep, Me as scanForLeaks, We as storageAssetSink, Ue as storageAssetSource, jn as storageBlobSink, kn as storageBlobSource, An as storageRefsBlobSource, He as subsetToScope, ht as tableDone, At as topoSortTables, hn as unpackBundle, _n as unpackBundleToDir, Ge as writeAssetToCas, q as writeLedger };