@voltro/data-transfer 0.48.0 → 0.49.0

package/CHANGELOG.md

@@ -39,6 +39,73 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.49.0] — 2026-08-23
+
+### ⚠ BREAKING
+
+- **@voltro/cli, @voltro/data-transfer, @voltro/database, @voltro/sql-sqlite, @voltro/voltro** — A data transfer is a series of short requests now — no single one may outlive a caller's budget.
+
+  **The rule:** *a request that carries bytes never runs a transfer; a request that starts a transfer never carries bytes.* It was broken in the worst available place. The upload was already chunked and resumable — many short requests, each abandonable — and then the FINAL chunk fell through and ran the whole import. So the longest request of the flow arrived AFTER the entire upload had succeeded, and a caller under a policy that caps a single request (a job runner that kills a client at ten minutes; a 30 s ingress ceiling) lost the most expensive thing they had already paid for. A single-request upload had the same shape without the excuse, and the export had no protocol at all: one request that read the whole database and streamed it back.
+
+  **Import.** `POST /_voltro/admin/import` accumulates and answers `202`. `POST /_voltro/admin/import/start` begins the run and answers `202 { runId }` as soon as the run's first row exists. `start` is idempotent per upload — it is a short request and therefore a retryable one, and without a claim a retry would begin a second destructive run from the same bytes. A claim whose run has ENDED is taken over rather than honoured forever, so a process that dies holding one cannot poison a bundle.
+
+  **Export.** `POST /_voltro/admin/export` answers `202 { runId }` and produces in the background; the bytes come back from `GET /_voltro/admin/export/download?runId=&offset=&length=` in ranges, resumable, with the total in a header. Object storage (`--bundle-key`) remains for a bundle you want to KEEP — it is no longer the only way to get one out, because requiring it would leave an instance without storage unable to export at all.
+
+  **The client.** `--max-request-seconds` (or `VOLTRO_MAX_REQUEST_SECONDS`) declares the budget — declared rather than probed, because the thing that kills a request is a policy on the caller's side and only they know it. `--detach` returns once the run has started and says the outcome is NOT known. Attached, the CLI polls the record and prints per-table progress; Ctrl-C then loses the watching and never the run.
+
+  **The trap, stated because it is the one way to get this wrong:** a failure used to arrive in the response (409 on drift, 409 on a refused mode, 500 otherwise). After the split the response is a `202`, so **a client deriving its exit code from the status line reports a failed import as a success.** The exit code comes from the polled record, in one shared function, and the drift check moved into `start` where it can still be a refusal that leaves no history.
+
+  **Two knobs that were constants.** `VOLTRO_IMPORT_UPLOAD_DIR` and `VOLTRO_EXPORT_ARTIFACT_DIR` move the staging areas off the default temp filesystem — which on a container is frequently a small tmpfs, so an instance simply could not accept a bundle the size a grown database produces, and the failure arrived as a write error halfway through an upload somebody had been waiting on.
+
+  **Renamed:** `voltro data imports` → `voltro data transfers`, and `_voltro_data_imports` → `_voltro_data_transfers` with a `direction` column. The command showed one direction and now shows both; the table rename carries its rows via the declarative differ on every dialect and needs nothing from you. The CLI rename ships a `manual` codemod — the command lives in scripts, CI jobs and runbooks, which `voltro update` cannot see or rewrite. The four PUBLIC exports that named the same record were renamed with it (`ImportRun`, `describeImportRun`, `IMPORT_RUNS_TABLE`, `_voltroImportRunsTable`); those are application source, they ship their own `transform` codemod, and they have their own entry.
+- **@voltro/database, @voltro/voltro** — The run-history exports say `transfer`, not `import`.
+
+  `@voltro/database` (and `voltro/database`) renamed four public exports along with the table behind them:
+
+  | was | is | |---|---| | `ImportRun` | `DataTransferRun` | | `describeImportRun` | `describeTransferRun` | | `IMPORT_RUNS_TABLE` | `DATA_TRANSFERS_TABLE` | | `_voltroImportRunsTable` | `_voltroDataTransfersTable` |
+
+  An EXPORT writes to this record now — the row carries a `direction` — so every one of those names described half of what it holds.
+
+  A `transform` codemod rewrites all four, alias-aware, from either module spelling. It also rewrites a hand-spelled `_voltro_data_imports` in a string, template or raw-SQL fragment, and that is the half worth stating: the four identifiers announce themselves as compile errors, while a query that addresses the table by name has nothing to fail on. The table itself moves with its rows via the declarative differ on every dialect.
+
+  This is filed apart from the transfer-protocol entry beside it deliberately. That one's codemod is `manual` and is about a CLI invocation living in scripts and CI jobs; this one is application source and is rewritten for you. Reading the first as covering both is what would leave a build broken with a note saying nothing in your source was affected.
+
+### Added
+
+- **@voltro/database, @voltro/data-transfer, @voltro/cli** — An import records WHETHER it staged, and a soft-dropped column says so in a drift refusal.
+
+  **`_voltro_data_imports.staged`.** The pre-upload preflight says what the instance WILL do; the run's own line says what it did — and that line is printed inside the instance, which is exactly where an operator using `--target api` cannot read it. So "we were told it would stage" and "it staged" were two claims with no way to close the gap between them from outside. The column is `null` for a mode where the question does not arise; `voltro data imports` and `GET /_voltro/admin/imports` both carry it.
+
+  **A soft-dropped column is named as one.** `<original>__dropped_<stamp>` is what the differ leaves behind when an app stops declaring a column — only the database that did the drop has it, so it drifts against every target. The refusal reported it as an ordinary missing column ("the value has nowhere to go"), which points at the TARGET's schema: the one place the fix does not lie. It now says where the column lives and how to reclaim it.
+
+### Fixed
+
+- **@voltro/data-transfer, @voltro/sql-sqlite, @voltro/database** — A successful `--mode replace --no-atomic` left a marker that refused the next boot.
+
+  Two defects, one visible symptom, and both were silent by construction.
+
+  **The clear was gated on the WRITE's condition.** `!(useLedger && ledger.truncated)` means "an earlier attempt already recorded this destructive run, do not write a second row" — correct on the write. Copied down to the clear its meaning inverts: `ledger.truncated` is set by the emptying step of THIS run, so on `--no-atomic` (the only mode where `useLedger` is true) the clear was skipped by the very run that wrote the marker.
+
+  **And a `Date` in a predicate is not bindable on sqlite.** `better-sqlite3` binds numbers, strings, bigints, buffers and null; the row path has coerced Dates since that store was written, and the eager-join compiler carried its own private copy of the fix, but `query` / `updateMany` / `deleteMany` bound the raw value. So every comparison of a timestamp column against a `Date` failed with `Failed to execute statement` — including the marker's clear, which swallows its errors ON PURPOSE (a store with no marker table must not fail an import over a bookkeeping row) and therefore said nothing. The retention sweep compares `lt(column, cutoff)` the same way.
+
+  Together: a fully successful replace left the marker standing, and the next boot REFUSED with "a destructive import did not finish" over a database that was completely fine. The one recovery is a command the operator has no reason to think they need. It stayed invisible because `atomic` defaults to true for `replace`, and because a staged replace writes no marker at all — two defaults hiding the one mode that exists for large, interruptible loads.
+
+  The coercion is shared now and applied at all three predicate sites, with a guard that fails on a fourth that forgets. A dry run also closes its trace row: a preview that finished instantly used to leave the record open, so a polling caller waited out its whole budget over a run that was long done.
+- **@voltro/cli** — `voltro codegen` declared twenty framework tables fewer than a boot.
+
+  The app half of this was fixed last release and looked like the whole thing. It was not: `codegen` derived the FEATURE MIX from the file list it had just walked, and that list is the entity/relations set — which contains no `*.workflow.tsx`, no `*.agent.ts`, no `*.cron.tsx`. So every feature flag came back false, and the dialect was never passed at all, taking `_voltro_cdc_offsets` with it. Measured on an app with two workflow files: 18 framework tables where the shared assembly produces 33.
+
+  It calls `assembleFrameworkTables({ root })` now — the same entry `voltro db plan/apply` uses, which detects the mix from the root rather than being handed one.
+
+  The parity guard moved with it. Comparing the two WALKS could not see this: both walks were right about files, and the divergence was introduced one layer past them. It compares the assembled SETS now, and runs codegen's own table function on a tree whose only feature signals are a workflow file and an agent file — a source assertion that the right function is CALLED cannot see a wrong argument handed to it, and a wrong argument is what this was.
+- **@voltro/cli** — `voltro data --help` advertised four subcommands out of nine.
+
+  It printed `<export|import|backup|restore>` while the command dispatched those four plus `imports`, `inspect`, `unpack`, `clear-replace-marker` and `clear-staging`. A quoted enumeration is read as exhaustive — the same failure `subcommandNames.ts` was written for after a `db` list cost two wrong conclusions — and the missing entry here is the one that answers "what is my import doing right now" for somebody who cannot reach the pod.
+
+  `subcommandHelpParity.test.ts` had listed `data` among the commands it could not check, loudly and correctly: there was no name list to check against. There is one now (`DATA_SUBCOMMANDS`), the dispatch is a keyed `Record`, so a subcommand with no name and a name with no handler are both compile errors, and the usage line is generated from the same array. `data` is out of the unchecked list.
+
+---
+
 ## [0.48.0] — 2026-08-22
 
 ### Added

package/dist/index.d.ts

@@ -366,15 +366,6 @@ export declare const DEFAULT_CLASS_ACTIONS: Readonly<Record<string, MaskAction>>
 /** Identity helper for authoring a profile with full type-checking + inference. */
 export declare const defineDataProfile: (profile: DataTransferProfile) => DataTransferProfile;
 
-/**
- * Differences that would actually break THIS import, in a stable order.
- *
- * `bundle` is the shape reconstructed from the manifest, so only its table
- * names, column names and column TYPES are meaningful — its `nullable` /
- * `hasDefault` are placeholders and are never read here. Every judgement about
- * required-ness is therefore made from the TARGET side, which is introspected
- * and real.
- */
 export declare const diffSnapshots: (bundle: SchemaSnapshot, target: SchemaSnapshot) => ReadonlyArray<string>;
 
 /** A {@link BlobSink} that writes blobs to the LOCAL dir as `assets/<sha>` files
@@ -710,6 +701,19 @@ export declare interface ImportOptions {
     /** Which transport is running this — named in the refusal a later boot prints,
      *  so the reader knows where to look for logs. */
     readonly via?: string;
+    /**
+     * The id of a trace row the CALLER has already written.
+     *
+     * The admin-import `start` endpoint answers `202` with a run id before the
+     * import has done anything, and a caller who polls immediately must find a
+     * row rather than an absence — "not started" and "no record" are the two
+     * states a poll loop cannot be allowed to confuse. So `start` opens the row
+     * itself and hands the id here; this run then ADVANCES and CLOSES that row
+     * instead of opening a second one.
+     *
+     * Absent, the run opens its own row exactly as before.
+     */
+    readonly traceId?: string;
     /**
      * Record that this run emptied the target, so a later boot can refuse over a
      * database it left half-replaced.

package/dist/index.js

@@ -1,10 +1,10 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
-import { IMPORT_RUNS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, _voltroImportRunsTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as C, streamTable as w, suspendWriteRecorders as ee, suspendWriteRecordersEffect as te, unregisterTable as ne } from "@voltro/database";
+import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, _voltroDataTransfersTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as C, streamTable as w, suspendWriteRecorders as ee, suspendWriteRecordersEffect as te, unregisterTable as ne } from "@voltro/database";
 import { fingerprintSchema as re } from "@voltro/database/sql";
-import { createCipheriv as T, createDecipheriv as ie, createHash as E, createHmac as ae, randomBytes as oe, scrypt as se } from "node:crypto";
-import { STORAGE_REFS_TABLE as ce, fromNodeReadable as le, getObjectStream as ue, putObjectStream as D, toNodeReadable as O } from "@voltro/plugin-storage";
-import * as k from "node:zlib";
-import { PassThrough as A, Readable as j } from "node:stream";
+import { createCipheriv as T, createDecipheriv as ie, createHash as E, createHmac as ae, randomBytes as D, scrypt as oe } from "node:crypto";
+import { STORAGE_REFS_TABLE as se, fromNodeReadable as ce, getObjectStream as le, putObjectStream as O, toNodeReadable as k } from "@voltro/plugin-storage";
+import * as A from "node:zlib";
+import { PassThrough as ue, Readable as j } from "node:stream";
 import { copyFile as de, createReadStream as fe, createWriteStream as M, existsSync as N, unlinkSync as pe } from "node:fs";
 import { SqlClient as P } from "@effect/sql";
 import { mkdir as F, readdir as me, stat as he } from "node:fs/promises";
@@ -217,7 +217,7 @@ var xe = (e) => {
 	["_voltro_seeds", "which seeds ran HERE — a foreign row suppresses seeding the target still needs"],
 	["_voltro_cdc_offsets", "binlog/WAL positions of the SOURCE server — meaningless and unsafe against another one"],
 	["_voltro_schedule_claims", "live leases held by THIS deployment's replicas — a foreign row hands out a lease nobody holds"],
-	["_voltro_data_imports", "which bundles were imported HERE — a foreign row claims an import this deployment never ran"],
+	["_voltro_data_transfers", "which bundles moved through HERE, in or out — a foreign row claims a transfer this deployment never ran"],
 	["_voltro_replace_in_progress", "the marker a destructive import HERE left behind — a foreign row refuses a boot over a healthy database"],
 	["_voltro_wakeups", "pending wakeups addressed to THIS deployment's runners"],
 	["_voltro_workflow_watermarks", "how far a consumer has read THIS deployment's event journal — a foreign position skips events"],
@@ -416,16 +416,16 @@ var xe = (e) => {
 	};
 }), rt = (e, t) => ({
 	list: t,
-	open: (t) => ue(e, t)
+	open: (t) => le(e, t)
 }), it = (e) => ({
-	write: (t, n, r) => D(e, t, n, r),
+	write: (t, n, r) => O(e, t, n, r),
 	has: (t) => e.head(t).pipe(n.map((e) => e !== null))
 }), at = (e, t) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), r = await import("node:fs/promises"), { createHash: i, randomUUID: a } = await import("node:crypto"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = await import("node:path"), l = c.join(t, `.tmp-${a()}`), u = i("sha256"), d = 0, f = new s({ transform(e, t, n) {
 			u.update(e), d += e.length, n(null, e);
 		} });
-		await o(await O(e.stream), f, n(l));
+		await o(await k(e.stream), f, n(l));
 		let p = u.digest("hex"), m = c.join(t, p);
 		try {
 			await r.access(m), await r.rm(l, { force: !0 });
@@ -443,7 +443,7 @@ var xe = (e) => {
 		path: t
 	})
 }), ot = (e, t, r) => n.gen(function* () {
-	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), c = o("sha256"), u = le("bundle", () => a(s)).pipe(l.tap((e) => n.sync(() => c.update(e))));
+	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), c = o("sha256"), u = ce("bundle", () => a(s)).pipe(l.tap((e) => n.sync(() => c.update(e))));
 	yield* e.write(r.key, u, {
 		contentType: r.contentType,
 		totalSize: r.size
@@ -454,7 +454,7 @@ var xe = (e) => {
 		expected: r.sha256,
 		actual: d
 	}));
-}), st = () => typeof k.createZstdCompress == "function", ct = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : st() ? "zstd" : "gzip", lt = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", ut = (e) => e === "zstd" ? k.createZstdCompress() : e === "gzip" ? k.createGzip() : new A(), dt = (e) => e === "zstd" ? k.createZstdDecompress() : e === "gzip" ? k.createGunzip() : new A(), ft = 1, pt = c.Struct({
+}), st = () => typeof A.createZstdCompress == "function", ct = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : st() ? "zstd" : "gzip", lt = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", ut = (e) => e === "zstd" ? A.createZstdCompress() : e === "gzip" ? A.createGzip() : new ue(), dt = (e) => e === "zstd" ? A.createZstdDecompress() : e === "gzip" ? A.createGunzip() : new ue(), ft = 1, pt = c.Struct({
 	name: c.String,
 	file: c.String,
 	rowCount: c.Number,
@@ -1150,7 +1150,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		rows: r.tables.reduce((e, t) => e + t.rowCount, 0),
 		tables: r.tables.length
 	};
-}), Rn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, zn = (e, t) => e.tables.find((e) => e.name === t), Bn = (e, t) => new Map((zn(e, t)?.columns ?? []).map((e) => [e.name, e])), Vn = (e, t) => {
+}), Rn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, zn = (e, t) => e.tables.find((e) => e.name === t), Bn = (e, t) => new Map((zn(e, t)?.columns ?? []).map((e) => [e.name, e])), Vn = /__dropped_\d+$/, Hn = (e, t) => {
 	let n = [];
 	for (let r of [...e.tables].sort((e, t) => e.name.localeCompare(t.name))) {
 		if (zn(t, r.name) === void 0) {
@@ -1161,7 +1161,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		for (let [t, a] of i) {
 			let i = e.get(t);
 			if (i === void 0) {
-				n.push(`${r.name}.${t}: in the bundle, MISSING from the target — the value has nowhere to go`);
+				n.push(Vn.test(t) ? `${r.name}.${t}: a soft-dropped column, present only in the SOURCE — reclaim it there (voltro db gc-snapshots --before <date>) or re-export without it; the target is not missing anything` : `${r.name}.${t}: in the bundle, MISSING from the target — the value has nowhere to go`);
 				continue;
 			}
 			i.type !== a.type && n.push(`${r.name}.${t}: type '${a.type}' (bundle) vs '${i.type}' (target)`);
@@ -1169,7 +1169,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		for (let [t, a] of e) i.has(t) || !a.nullable && !a.hasDefault && n.push(`${r.name}.${t}: the target requires it (NOT NULL, no default) and the bundle carries no value — every row of this table would fail`);
 	}
 	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n;
-}, Hn = (e, t, n) => {
+}, Un = (e, t, n) => {
 	let r = re(t);
 	if (r === e || n === void 0) return {
 		drifted: !1,
@@ -1177,14 +1177,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		targetFingerprint: r,
 		diff: []
 	};
-	let i = Vn(n, t);
+	let i = Hn(n, t);
 	return {
 		drifted: i.length > 0,
 		bundleFingerprint: e,
 		targetFingerprint: r,
 		diff: i
 	};
-}, Un = 2e3, Wn = 200, Gn = /* @__PURE__ */ new Set([
+}, Wn = 2e3, Gn = 200, Kn = /* @__PURE__ */ new Set([
 	"BundleError",
 	"CodecError",
 	"IntegrityError",
@@ -1193,17 +1193,17 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	"RowsRefusedError",
 	"SchemaDriftError",
 	"StorageError"
-]), Kn = (t) => {
+]), qn = (t) => {
 	let n = o.isFiberFailure(t) ? [...e.failures(t[o.FiberFailureCauseId]), ...e.defects(t[o.FiberFailureCauseId])] : [t];
 	for (let e of n) {
 		let t = e?._tag;
-		if (typeof t == "string" && Gn.has(t)) return e;
+		if (typeof t == "string" && Kn.has(t)) return e;
 		if (o.isFiberFailure(e)) {
-			let t = Kn(e);
+			let t = qn(e);
 			if (t) return t;
 		}
 	}
-}, qn = (t) => [...e.failures(t)][0] ?? Error(e.pretty(t)), Jn = (e) => n.tryPromise({
+}, Jn = (t) => [...e.failures(t)][0] ?? Error(e.pretty(t)), Yn = (e) => n.tryPromise({
 	try: async () => {
 		let t = await import("node:fs/promises"), n = await import("node:path");
 		return vt(await t.readFile(n.join(e, K), "utf8"));
@@ -1212,10 +1212,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `manifest read/parse failed: ${String(e?.message ?? e)}`,
 		path: K
 	})
-}), Yn = (e) => {
+}), Xn = (e) => {
 	let t;
 	return n.gen(function* () {
-		let i = yield* n.promise(() => import("node:path")), a = yield* Jn(e.bundleDir);
+		let i = yield* n.promise(() => import("node:path")), a = yield* Yn(e.bundleDir);
 		if (a.formatVersion !== 1) return yield* n.fail(new H({ reason: `unsupported bundle formatVersion ${a.formatVersion} (expected 1)` }));
 		if (e.tables !== void 0) {
 			let t = new Set(a.tables.map((e) => e.name)), r = e.tables.filter((e) => !t.has(e));
@@ -1236,7 +1236,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					unique: !1,
 					hasDefault: !1
 				}))
-			})) }, r = Hn(s.source.schemaFingerprint, e.targetSnapshot, t);
+			})) }, r = Un(s.source.schemaFingerprint, e.targetSnapshot, t);
 			if (r.drifted) {
 				if (!e.force) return yield* n.fail(new Je({
 					bundleFingerprint: r.bundleFingerprint,
@@ -1295,7 +1295,12 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				reason: sn(i)
 			}));
 		}
-		if (e.dryRun === !0) return {
+		if (e.dryRun === !0) return e.traceId !== void 0 && (yield* n.promise(() => e.store.update(u, e.traceId, {
+			finishedAt: /* @__PURE__ */ new Date(),
+			tablesWritten: 0,
+			rowsWritten: 0,
+			failure: null
+		}).then(() => void 0, () => void 0))), {
 			manifest: s,
 			tablesWritten: 0,
 			rowsWritten: 0,
@@ -1319,16 +1324,16 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			return p === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : p === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
 		}, ie = (e, t) => e.savepoint ? e.savepoint(t) : t(), E = 0, ae = (t, n, r) => {
 			r.unclassified && (E++, !(E > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (E === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, oe = (e, t, r = !0) => n.tryPromise({
+		}, D = (e, t, r = !0) => n.tryPromise({
 			try: e,
 			catch: (e) => _n(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), se = (e) => {
+		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), oe = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
 				...Object.fromEntries(t.map((e) => [e, null]))
 			};
-		}, ce = (e) => {
+		}, se = (e) => {
 			let t = new Set(e.map((e) => String(e.row[e.entry.primaryKey]))), n = (e) => Object.entries(e.entry.columnTypes).some(([n, r]) => {
 				if (r !== "reference") return !1;
 				let i = e.row[n];
@@ -1356,31 +1361,31 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					primary: t.primary
 				})).sort((e, t) => t.refused - e.refused || e.table.localeCompare(t.table)).slice(0, 100)
 			});
-		}, ue = (e, t) => n.gen(function* () {
+		}, le = (e, t) => n.gen(function* () {
 			let r = t, i = [], a = !0;
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* oe(() => ie(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* D(() => ie(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
-					let r = t[n], o = se(r);
-					o !== void 0 && (yield* oe(() => ie(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					let r = t[n], o = oe(r);
+					o !== void 0 && (yield* D(() => ie(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* oe(() => ie(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
-			if (r.length > 0) return yield* n.fail(ce(r));
-		}), D = (() => {
+			for (let t of i) (yield* D(() => ie(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			if (r.length > 0) return yield* n.fail(se(r));
+		}), O = (() => {
 			let t = e.targetDialect;
 			return t === "postgres" || t === "mysql" || t === "mariadb" || t === "sqlite" || t === "mssql" ? t : void 0;
-		})(), O = In({
+		})(), k = In({
 			mode: p,
 			...e.targetDialect === void 0 ? {} : { targetDialect: e.targetDialect },
 			...e.targetSnapshot === void 0 ? {} : { targetSnapshot: e.targetSnapshot },
 			bundleTables: s.tables.map((e) => e.name),
 			isSkipped: V,
 			canRunSql: xn(e.store)
-		}), k = O.tables, A = s.tables.filter((e) => !V(e.name) && S(e.name)).map((e) => e.name), j = O.active, de = !1, M = 0, N = 0, pe, P = 0, F = 0, me = (t, r) => n.gen(function* () {
+		}), A = k.tables, ue = s.tables.filter((e) => !V(e.name) && S(e.name)).map((e) => e.name), j = k.active, de = !1, M = 0, N = 0, pe, P = 0, F = 0, me = (t, r) => n.gen(function* () {
 			if (p === "replace" && !j && !(r && x.truncated)) {
 				e.recordInterruption === !0 && (yield* n.tryPromise({
 					try: () => t.insert(d, {
@@ -1433,7 +1438,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					total: m.rowCount
 				});
 				let v = a.length, b = n.gen(function* () {
-					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = le("bundle", () => fe(_).pipe(dt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
+					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = ce("bundle", () => fe(_).pipe(dt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
 						let n = {
 							entry: m,
 							row: e,
@@ -1533,7 +1538,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					checksum: m.checksum
 				}, yield* J(y, x)));
 			}
-			if (a.length > 0 && (yield* ue(t, a)), p === "replace" && !(r && x.truncated) && (yield* n.promise(() => t.deleteMany(d, { where: {
+			if (a.length > 0 && (yield* le(t, a)), p === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
 				column: "startedAt",
 				op: "lte",
 				value: ge
@@ -1571,26 +1576,31 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				path: I.dir
 			})
 		})), e.onWarn?.(Rn(I)));
-		let _e = (e) => p === "replace" ? ee(e) : e(), L = (e) => p === "replace" ? te(e) : e, R = m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), ve = !1, ye = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
-		ye && h(f), ye && (yield* n.promise(() => e.store.insert(u, {
+		let _e = (e) => p === "replace" ? ee(e) : e(), L = (e) => p === "replace" ? te(e) : e, R = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), ve = e.traceId !== void 0, ye = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
+		ye && h(f), ye && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(u, {
 			id: R,
 			mode: p,
 			via: e.via ?? "direct",
+			direction: "import",
 			bundle: e.bundleDir,
 			sourceFingerprint: s.source.schemaFingerprint ?? null,
 			tablesWritten: 0,
-			rowsWritten: 0
+			rowsWritten: 0,
+			staged: p === "replace" ? j : null
 		}).then(() => {
 			ve = !0;
 		}, (t) => {
 			e.onWarn?.(`the import trace could not be written (${String(t?.message ?? t)}).\n  The import continues — this is a record of what happened, not a safety check. Run
   \`voltro db apply\` so the next one is recorded.`);
-		})));
+		}))), e.traceId !== void 0 && ye && (yield* n.promise(() => e.store.update(u, R, {
+			staged: p === "replace" ? j : null,
+			sourceFingerprint: s.source.schemaFingerprint ?? null
+		}).then(() => void 0, () => void 0)));
 		let be = 0, xe = !1;
 		pe = () => {
 			if (!ve || xe) return;
 			let t = Date.now();
-			t - be < Un || (be = t, e.store.update(u, R, {
+			t - be < Wn || (be = t, e.store.update(u, R, {
 				tablesWritten: N,
 				rowsWritten: M
 			}).then(() => void 0, () => {
@@ -1603,11 +1613,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			rowsWritten: M,
 			failure: t
 		}).then(() => void 0, () => void 0) : Promise.resolve();
-		if (t = (e) => Se(e), p === "replace" && !j && O.blocker !== void 0 && e.onWarn?.(Sn(O.blocker)), p === "replace" && A.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${A.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
+		if (t = (e) => Se(e), p === "replace" && !j && k.blocker !== void 0 && e.onWarn?.(Sn(k.blocker)), p === "replace" && ue.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${ue.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
   something that did not happen — and this path already writes through the raw store, without
   tenant scoping or \`audit()\` stamping, for the same reason.`), j) {
-			e.onWarn?.(`staging ${k.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
-			let t = e.store, r = k.map((e) => e.name), i = Dn(r, {
+			e.onWarn?.(`staging ${A.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
+			let t = e.store, r = A.map((e) => e.name), i = Dn(r, {
 				getTable: (e) => v(e),
 				registerTable: (e) => {
 					C(e);
@@ -1618,30 +1628,30 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				let i = g ? r : r.filter((e) => !Mt(x, e));
 				yield* n.tryPromise({
 					try: async () => {
-						await jn(t, i.map((e) => Tn(e, D))), await jn(t, i.map((e) => wn(e, D)));
+						await jn(t, i.map((e) => Tn(e, O))), await jn(t, i.map((e) => wn(e, O)));
 					},
 					catch: (e) => new H({ reason: `could not prepare the staging tables, so the import did not start and the target is untouched: ${String(e?.message ?? e)}` })
 				}), yield* L(me(e.store, !g)), !g && x.truncated === !0 ? a = !0 : yield* n.tryPromise({
-					try: () => Mn(t, k, D).then(() => {
+					try: () => Mn(t, A, O).then(() => {
 						a = !0;
 					}),
 					catch: (e) => new H({ reason: String(e?.message ?? e) })
 				}).pipe(n.catchAll((i) => n.gen(function* () {
-					let a = An(yield* n.promise(() => Nn(t, On(e.targetSnapshot, r), D).then((e) => e, () => [])));
+					let a = An(yield* n.promise(() => Nn(t, On(e.targetSnapshot, r), O).then((e) => e, () => [])));
 					return yield* n.fail(new H({ reason: a ?? `the swap failed and the target is UNCHANGED: ${i.reason}` }));
 				}))), !g && a && x.truncated !== !0 && (x.truncated = !0, yield* J(y, x));
 			} finally {
-				i.undo(), a || g ? yield* n.promise(() => jn(t, r.map((e) => Tn(e, D))).then(() => void 0, () => void 0)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
+				i.undo(), a || g ? yield* n.promise(() => jn(t, r.map((e) => Tn(e, O))).then(() => void 0, () => void 0)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
 			}
 		} else g ? yield* n.tryPromise({
 			try: () => e.store.transactional(async (e) => {
 				let t = await _e(() => n.runPromiseExit(me(e, !1)));
-				if (r.isFailure(t)) throw qn(t.cause);
+				if (r.isFailure(t)) throw Jn(t.cause);
 			}),
-			catch: (e) => Kn(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
+			catch: (e) => qn(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
 		}) : yield* L(me(e.store, !0));
 		if (e.assets && s.assets.index && !e.assetsAlreadyRestored) {
-			let t = e.assets, r = i.join(e.bundleDir, xt), a = i.join(e.bundleDir, s.assets.index ?? "assets/index.ndjson"), o = le("bundle", () => fe(a)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)));
+			let t = e.assets, r = i.join(e.bundleDir, xt), a = i.join(e.bundleDir, s.assets.index ?? "assets/index.ndjson"), o = ce("bundle", () => fe(a)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)));
 			yield* l.runForEach(o, (e) => e.key in x.assets ? n.void : ot(t, r, e).pipe(n.andThen(n.sync(() => {
 				x.assets[e.key] = !0;
 			})), n.andThen(J(y, x))));
@@ -1656,14 +1666,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			...I === void 0 ? {} : { rollback: I }
 		};
 	}).pipe(n.tapError((e) => n.promise(() => t?.(e?.reason ?? e?._tag ?? "the import did not finish") ?? Promise.resolve())));
-}, Xn = (e) => e, Zn = (e) => {
+}, Zn = (e) => e, Qn = (e) => {
 	if (e.allowLive || e.liveInstance === null || e.sameTarget === "different") return { refuse: !1 };
 	let t = e.targetLabel === void 0 ? "" : ` Target: ${e.targetLabel}.`, n = e.sameTarget === "same" ? " That instance is connected to the SAME database." : " We could not confirm which database that instance is connected to, so this is refused on the conservative reading — an older instance, or one whose connection could not be parsed, reports nothing to compare.";
 	return {
 		refuse: !0,
 		message: `refusing to write into a target with a LIVE instance (${e.liveInstance}).${t}${n} A direct import is an uncoordinated concurrent writer — readers see partial state, the reactive layer either storms or goes stale, and rows race with live writes. Re-run with --allow-live to override, or use a live-safe strategy (shadow-swap for replace, or the api target).`
 	};
-}, Q = Buffer.from("VBUNDLE2"), Qn = 0, $n = 1, er = 2, tr = 32, nr = async (e) => {
+}, Q = Buffer.from("VBUNDLE2"), $n = 0, er = 1, tr = 2, nr = 32, rr = async (e) => {
 	let t = [], n = async (r) => {
 		let i;
 		try {
@@ -1677,21 +1687,21 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	};
 	return await n(""), t.sort();
-}, rr = (e, t) => {
+}, ir = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.alloc(5 + n.length + 8);
-	return r.writeUInt8($n, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
-}, ir = (e, t, n) => {
+	return r.writeUInt8(er, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
+}, ar = (e, t, n) => {
 	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8"), a = Buffer.alloc(5 + r.length + 2 + i.length + 8), o = 0;
-	return a.writeUInt8(er, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
+	return a.writeUInt8(tr, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
 };
-async function* ar(e) {
+async function* or(e) {
 	yield new Uint8Array(Q);
-	for (let t of await nr(e.dir)) {
+	for (let t of await rr(e.dir)) {
 		let n = L(e.dir, t), r = await he(n);
-		if (yield new Uint8Array(rr(t, r.size)), r.size > 0) for await (let e of fe(n)) yield new Uint8Array(e);
+		if (yield new Uint8Array(ir(t, r.size)), r.size > 0) for await (let e of fe(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
-		yield new Uint8Array(ir(t.key, t.contentType, t.size));
+		yield new Uint8Array(ar(t.key, t.contentType, t.size));
 		let n = E("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
@@ -1700,9 +1710,9 @@ async function* ar(e) {
 		if (r !== t.size) throw Error(`blob '${t.key}' size mismatch: header ${t.size}, streamed ${r}`);
 		yield new Uint8Array(n.digest());
 	}
-	yield new Uint8Array(Buffer.from([Qn]));
+	yield new Uint8Array(Buffer.from([$n]));
 }
-var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr = (e) => new Promise((t) => e.end(t)), cr = async (e, t) => {
+var sr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), cr = (e) => new Promise((t) => e.end(t)), lr = async (e, t) => {
 	let n = R(t.dir);
 	await F(n, { recursive: !0 });
 	let r = Buffer.alloc(0), i = e[Symbol.asyncIterator](), a = !1, o = async () => {
@@ -1719,8 +1729,8 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 		for (;;) {
 			await s(1);
 			let e = c(1).readUInt8(0);
-			if (e === Qn) return;
-			if (e === $n) {
+			if (e === $n) return;
+			if (e === er) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
@@ -1733,10 +1743,10 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
-					await or(o, c(e)), i -= BigInt(e);
+					await sr(o, c(e)), i -= BigInt(e);
 				}
-				await sr(o);
-			} else if (e === er) {
+				await cr(o);
+			} else if (e === tr) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
@@ -1746,24 +1756,24 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = E("sha256"), d = new A(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = E("sha256"), d = new ue(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
 				for (; p > 0n;) {
 					r.length === 0 && await s(1);
 					let e = p < BigInt(r.length) ? Number(p) : r.length, t = c(e);
-					u.update(t), l || await or(d, t), p -= BigInt(e);
+					u.update(t), l || await sr(d, t), p -= BigInt(e);
 				}
-				l ? d.destroy() : await sr(d), await f, await s(tr);
-				let m = c(tr);
+				l ? d.destroy() : await cr(d), await f, await s(nr);
+				let m = c(nr);
 				if (!u.digest().equals(m)) throw Error(`blob '${n}' failed integrity (sha mismatch)`);
 			} else throw Error(`unknown bundle entry kind ${e}`);
 		}
 	} finally {
 		a || await Promise.resolve(i.return?.()).catch(() => void 0);
 	}
-}, lr = async (e, t) => {
+}, ur = async (e, t) => {
 	let n = new Set(t), r = /* @__PURE__ */ new Map(), i = Buffer.alloc(0), a = e[Symbol.asyncIterator](), o = async () => {
 		let { value: e, done: t } = await a.next();
 		return !t && (i = i.length === 0 ? Buffer.from(e) : Buffer.concat([i, Buffer.from(e)]), !0);
@@ -1785,8 +1795,8 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 	if (!await s(Q.length) || !c(Q.length).equals(Q)) throw Error("not a bundle archive (bad magic)");
 	for (; await s(1);) {
 		let e = c(1).readUInt8(0);
-		if (e === Qn || e === er) break;
-		if (e !== $n) throw Error(`unknown bundle entry kind ${e}`);
+		if (e === $n || e === tr) break;
+		if (e !== er) throw Error(`unknown bundle entry kind ${e}`);
 		if (!await s(4)) break;
 		let t = c(4).readUInt32BE(0);
 		if (!await s(t)) break;
@@ -1796,10 +1806,10 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 		if (a === null || n.has(i) && (r.set(i, a), n.delete(i), n.size === 0)) break;
 	}
 	return r;
-}, ur = (e, t) => cr(e, {
+}, dr = (e, t) => lr(e, {
 	dir: t,
-	blobs: dr(t)
-}), dr = (e) => {
+	blobs: fr(t)
+}), fr = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	return {
 		has: async (e) => t.has(e),
@@ -1819,33 +1829,33 @@ var or = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), sr
 			})}\n`), t.add(n);
 		}
 	};
-}, fr = ye(se), pr = Buffer.from("VENC1\0\0\0"), mr = 32, hr = 16, gr = 7, _r = 16, vr = 262144, yr = {
+}, pr = ye(oe), mr = Buffer.from("VENC1\0\0\0"), hr = 32, gr = 16, _r = 7, vr = 16, yr = 262144, br = {
 	N: 32768,
 	r: 8,
 	p: 1
-}, br = 134217728, xr = 43, Sr = (e, t, n) => {
+}, xr = 134217728, Sr = 43, Cr = (e, t, n) => {
 	let r = Buffer.alloc(12);
-	return e.copy(r, 0, 0, gr), r.writeUInt32BE(t >>> 0, gr), r.writeUInt8(+!!n, 11), r;
+	return e.copy(r, 0, 0, _r), r.writeUInt32BE(t >>> 0, _r), r.writeUInt8(+!!n, 11), r;
 };
-async function* Cr(e, t) {
+async function* wr(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = oe(hr), r = oe(gr), i = await fr(t, n, mr, {
-		...yr,
-		maxmem: br
-	}), a = Buffer.alloc(xr);
-	pr.copy(a, 0), a.writeUInt32BE(yr.N, 8), a.writeUInt32BE(yr.r, 12), a.writeUInt32BE(yr.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
+	let n = D(gr), r = D(_r), i = await pr(t, n, hr, {
+		...br,
+		maxmem: xr
+	}), a = Buffer.alloc(Sr);
+	mr.copy(a, 0), a.writeUInt32BE(br.N, 8), a.writeUInt32BE(br.r, 12), a.writeUInt32BE(br.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = T("aes-256-gcm", i, Sr(r, o, t));
+		let n = T("aes-256-gcm", i, Cr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
-		let l = Buffer.alloc(5 + s.length + _r);
-		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + _r, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
+		let l = Buffer.alloc(5 + s.length + vr);
+		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + vr, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
 	}, c = Buffer.alloc(0);
-	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > vr;) yield s(c.subarray(0, vr), !1), c = c.subarray(vr);
+	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > yr;) yield s(c.subarray(0, yr), !1), c = c.subarray(yr);
 	yield s(c, !0);
 }
-async function* wr(e, t) {
+async function* Tr(e, t) {
 	if (!t) throw Error("decryptStream: a non-empty passphrase is required");
 	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = !1, a = async () => {
 		let { value: e, done: t } = await n.next();
@@ -1854,16 +1864,16 @@ async function* wr(e, t) {
 		for (; r.length < e && !i && await a(););
 		return r.length >= e;
 	};
-	if (!await o(xr)) throw Error("encrypted bundle truncated (no header)");
-	let s = r.subarray(0, xr);
-	if (!s.subarray(0, 8).equals(pr)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
-	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, xr)), p = await fr(t, d, mr, {
+	if (!await o(Sr)) throw Error("encrypted bundle truncated (no header)");
+	let s = r.subarray(0, Sr);
+	if (!s.subarray(0, 8).equals(mr)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
+	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Sr)), p = await pr(t, d, hr, {
 		N: c,
 		r: l,
 		p: u,
-		maxmem: br
+		maxmem: xr
 	});
-	r = r.subarray(xr);
+	r = r.subarray(Sr);
 	let m = 0, h = !1;
 	for (;;) {
 		if (!await o(5)) {
@@ -1872,11 +1882,11 @@ async function* wr(e, t) {
 		}
 		if (h) throw Error("encrypted bundle has trailing data after the final frame");
 		let e = r.readUInt8(0) === 1, t = r.readUInt32BE(1);
-		if (t < _r) throw Error("encrypted bundle corrupt (short frame)");
+		if (t < vr) throw Error("encrypted bundle corrupt (short frame)");
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
-		let n = r.subarray(5, 5 + t - _r), i = r.subarray(5 + t - _r, 5 + t);
+		let n = r.subarray(5, 5 + t - vr), i = r.subarray(5 + t - vr, 5 + t);
 		r = r.subarray(5 + t);
-		let a = ie("aes-256-gcm", p, Sr(f, m, e));
+		let a = ie("aes-256-gcm", p, Cr(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -1884,7 +1894,7 @@ async function* wr(e, t) {
 }
 //#endregion
 //#region src/blobStorage.ts
-var Tr = (e, t) => ({
+var Er = (e, t) => ({
 	list: () => {
 		let e = t();
 		return { async *[Symbol.asyncIterator]() {
@@ -1897,29 +1907,29 @@ var Tr = (e, t) => ({
 		} };
 	},
 	open: (t) => ({ async *[Symbol.asyncIterator]() {
-		let r = await n.runPromise(ue(e, t)), i = await O(r.stream);
+		let r = await n.runPromise(le(e, t)), i = await k(r.stream);
 		for await (let e of i) yield e instanceof Uint8Array ? e : new Uint8Array(e);
 	} })
-}), Er = (e, t) => Tr(e, () => w(t, {
-	table: ce,
+}), Dr = (e, t) => Er(e, () => w(t, {
+	table: se,
 	chunkSize: 500
 }).pipe(l.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-})))), Dr = (e) => ({
+})))), Or = (e) => ({
 	has: (t) => n.runPromise(e.head(t).pipe(n.map((e) => e !== null))),
 	write: async (t, r, i) => {
-		let a = le("storage", () => j.from(r));
-		await n.runPromise(D(e, t, a, {
+		let a = ce("storage", () => j.from(r));
+		await n.runPromise(O(e, t, a, {
 			contentType: i.contentType,
 			totalSize: i.size
 		}));
 	}
-}), Or = (e, t) => {
+}), kr = (e, t) => {
 	let n = t === "dump" ? "mariadb-dump" : "mariadb", r = t === "dump" ? "mysqldump" : "mysql";
-	return e === "mariadb" && kr(n) ? n : r;
-}, kr = (e) => (process.env.PATH ?? "").split(I).filter((e) => e !== "").some((t) => N(L(t, e))), Ar = (e) => {
+	return e === "mariadb" && Ar(n) ? n : r;
+}, Ar = (e) => (process.env.PATH ?? "").split(I).filter((e) => e !== "").some((t) => N(L(t, e))), jr = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -1929,7 +1939,7 @@ var Tr = (e, t) => ({
 		case "mssql": return "db.bacpac";
 		default: return "db.dump";
 	}
-}, jr = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
+}, Mr = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
 	if (e.host || e.database) return {
 		host: e.host ?? "localhost",
 		port: e.port ?? 3306,
@@ -1945,7 +1955,7 @@ var Tr = (e, t) => ({
 		password: decodeURIComponent(t.password) || "",
 		database: t.pathname.replace(/^\//, "") || ""
 	};
-}, Mr = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Nr = (e, t, n) => {
+}, Nr = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Pr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -1992,7 +2002,7 @@ var Tr = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				tool: Or(e, "dump"),
+				tool: kr(e, "dump"),
 				args: [
 					"--single-transaction",
 					"--routines",
@@ -2014,7 +2024,7 @@ var Tr = (e, t) => ({
 		case "sqlite":
 		case "turso": return {
 			kind: "copy",
-			from: jr(t),
+			from: Mr(t),
 			to: n
 		};
 		case "mssql": return {
@@ -2022,7 +2032,7 @@ var Tr = (e, t) => ({
 			tool: "sqlpackage",
 			args: [
 				"/Action:Export",
-				`/SourceConnectionString:${Mr($({
+				`/SourceConnectionString:${Nr($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -2035,7 +2045,7 @@ var Tr = (e, t) => ({
 			reason: `no native backup for dialect '${e}'`
 		});
 	}
-}, Pr = (e, t, n) => {
+}, Fr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -2080,7 +2090,7 @@ var Tr = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				tool: Or(e, "client"),
+				tool: kr(e, "client"),
 				args: [
 					"--protocol=TCP",
 					"-h",
@@ -2099,14 +2109,14 @@ var Tr = (e, t) => ({
 		case "turso": return {
 			kind: "copy",
 			from: n,
-			to: jr(t)
+			to: Mr(t)
 		};
 		case "mssql": return {
 			kind: "spawn",
 			tool: "sqlpackage",
 			args: [
 				"/Action:Import",
-				`/TargetConnectionString:${Mr($({
+				`/TargetConnectionString:${Nr($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -2119,7 +2129,7 @@ var Tr = (e, t) => ({
 			reason: `no native restore for dialect '${e}'`
 		});
 	}
-}, Fr = (e) => e.kind === "copy" ? n.async((t) => {
+}, Ir = (e) => e.kind === "copy" ? n.async((t) => {
 	de(e.from, e.to, (r) => t(r ? n.fail(new W({
 		tool: "copy",
 		reason: `copy ${e.from} → ${e.to}: ${r.message}`
@@ -2160,7 +2170,7 @@ var Tr = (e, t) => ({
 			stderr: i.slice(-2e3)
 		})));
 	});
-}), Ir = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Lr = (e) => n.gen(function* () {
+}), Lr = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Rr = (e) => n.gen(function* () {
 	let t = yield* nt(e.scope ?? { kind: "all" }, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
@@ -2184,7 +2194,7 @@ var Tr = (e, t) => ({
 			let n = e.slice(i.length + 1);
 			m.push({
 				column: n,
-				action: Ir(t),
+				action: Lr(t),
 				before: f[n],
 				after: p[n]
 			});
@@ -2199,7 +2209,7 @@ var Tr = (e, t) => ({
 		leaks: c,
 		unclassified: o.unclassified
 	};
-}), Rr = (e, t) => {
+}), zr = (e, t) => {
 	let n = new Map(t.map((e) => [e.name, e])), r = [], i = {};
 	for (let t of e) {
 		let e = n.get(t.name);
@@ -2254,7 +2264,7 @@ var Tr = (e, t) => ({
 		skipColumns: i,
 		refuse: r.some((e) => e.verdict === "refuse")
 	};
-}, zr = (e) => {
+}, Br = (e) => {
 	if (e.findings.length === 0) return ["  schema matches the bundle"];
 	let t = {
 		safe: "✓",
@@ -2265,4 +2275,4 @@ var Tr = (e, t) => ({
 	return n.push(""), n.push(`  discarded: ${r("value-dropped")}   defaulted: ${r("filled-by-default")}   refused: ${r("refuse")}`), e.refuse && (n.push(""), n.push("  REFUSED — no row was written. These are the differences that would make"), n.push("  imported rows WRONG rather than merely incomplete.")), n;
 };
 //#endregion
-export { xt as ASSETS_DIR, St as ASSET_INDEX_FILE, H as BundleError, We as CodecError, Ke as CompressionError, Ze as CrossDialectError, bt as DATA_DIR, Se as DEFAULT_CLASS_ACTIONS, Be as ENVIRONMENT_LOCAL_TABLES, Ve as ENVIRONMENT_PORTABLE_TABLES, ft as FORMAT_VERSION, Xe as ImportModeError, Ge as IntegrityError, Ct as LEDGER_FILE, K as MANIFEST_FILE, Ye as MaskingError, W as NativeToolError, qe as RowsRefusedError, Wn as SAVEPOINT_BATCH_SIZE, bn as STAGING_PREFIX, Je as SchemaDriftError, U as ScopeError, Pe as applyAction, Kn as asImportError, Zn as assessLiveImport, Nt as assetDone, Ar as backupArtifactName, Nr as backupCommand, cn as canonicalType, dn as checkPortability, Hn as checkSchemaDrift, Ce as classificationFromSnapshot, Rr as classifyImportDrift, lt as compressionExt, $e as computeSubsetIds, In as decideStaging, vt as decodeManifest, Ut as decodeRow, Vt as decodeValue, wr as decryptStream, Xn as defineDataProfile, Vn as diffSnapshots, dr as dirBlobSink, Tn as dropStagingSql, At as emptyLedger, _t as encodeManifest, Ht as encodeRow, zt as encodeValue, Cr as encryptStream, Ue as environmentLocalNotice, He as environmentLocalReason, jn as execStatements, zr as formatImportDrift, fn as formatIssue, st as hasZstd, V as isEnvironmentLocal, ut as makeCompressor, dt as makeDecompressor, ze as maskRow, Kt as ndjsonToRows, sn as outsideReferenceRefusal, on as outsideReferencesInto, ar as packBundle, lr as peekBundle, ct as pickCompression, Ie as planMasking, Lr as previewMasking, jt as readLedger, we as resolveAction, nt as resolveScope, ot as restoreAssetFromCas, Pr as restoreCommand, Gt as rowsToNdjson, an as runExport, Yn as runImport, Fr as runNativeStep, Re as scanForLeaks, X as stagingNameFor, it as storageAssetSink, rt as storageAssetSource, Dr as storageBlobSink, Tr as storageBlobSource, Er as storageRefsBlobSource, et as subsetToScope, Mt as tableDone, qt as topoSortTables, cr as unpackBundle, ur as unpackBundleToDir, at as writeAssetToCas, J as writeLedger };
+export { xt as ASSETS_DIR, St as ASSET_INDEX_FILE, H as BundleError, We as CodecError, Ke as CompressionError, Ze as CrossDialectError, bt as DATA_DIR, Se as DEFAULT_CLASS_ACTIONS, Be as ENVIRONMENT_LOCAL_TABLES, Ve as ENVIRONMENT_PORTABLE_TABLES, ft as FORMAT_VERSION, Xe as ImportModeError, Ge as IntegrityError, Ct as LEDGER_FILE, K as MANIFEST_FILE, Ye as MaskingError, W as NativeToolError, qe as RowsRefusedError, Gn as SAVEPOINT_BATCH_SIZE, bn as STAGING_PREFIX, Je as SchemaDriftError, U as ScopeError, Pe as applyAction, qn as asImportError, Qn as assessLiveImport, Nt as assetDone, jr as backupArtifactName, Pr as backupCommand, cn as canonicalType, dn as checkPortability, Un as checkSchemaDrift, Ce as classificationFromSnapshot, zr as classifyImportDrift, lt as compressionExt, $e as computeSubsetIds, In as decideStaging, vt as decodeManifest, Ut as decodeRow, Vt as decodeValue, Tr as decryptStream, Zn as defineDataProfile, Hn as diffSnapshots, fr as dirBlobSink, Tn as dropStagingSql, At as emptyLedger, _t as encodeManifest, Ht as encodeRow, zt as encodeValue, wr as encryptStream, Ue as environmentLocalNotice, He as environmentLocalReason, jn as execStatements, Br as formatImportDrift, fn as formatIssue, st as hasZstd, V as isEnvironmentLocal, ut as makeCompressor, dt as makeDecompressor, ze as maskRow, Kt as ndjsonToRows, sn as outsideReferenceRefusal, on as outsideReferencesInto, or as packBundle, ur as peekBundle, ct as pickCompression, Ie as planMasking, Rr as previewMasking, jt as readLedger, we as resolveAction, nt as resolveScope, ot as restoreAssetFromCas, Fr as restoreCommand, Gt as rowsToNdjson, an as runExport, Xn as runImport, Ir as runNativeStep, Re as scanForLeaks, X as stagingNameFor, it as storageAssetSink, rt as storageAssetSource, Or as storageBlobSink, Er as storageBlobSource, Dr as storageRefsBlobSource, et as subsetToScope, Mt as tableDone, qt as topoSortTables, lr as unpackBundle, dr as unpackBundleToDir, at as writeAssetToCas, J as writeLedger };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/data-transfer",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Portable export/import for a Voltro app's data + assets — typed-NDJSON row codec, content-addressed assets, framed compression, a resumable chunk ledger, and FK-ordered idempotent import. Dialect-agnostic; the resilient backbone under `voltro data export|import` and native backups.",
   "keywords": [
     "voltro",
@@ -33,8 +33,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.48.0",
-    "@voltro/plugin-storage": "0.48.0"
+    "@voltro/database": "0.49.0",
+    "@voltro/plugin-storage": "0.49.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"