@voltro/data-transfer 0.50.0 → 0.50.1

package/dist/index.js

@@ -1,18 +1,18 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
 import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, _voltroDataTransfersTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as C, streamTable as w, suspendWriteRecorders as ee, suspendWriteRecordersEffect as te, unregisterTable as ne } from "@voltro/database";
 import { fingerprintSchema as re } from "@voltro/database/sql";
-import { createCipheriv as ie, createDecipheriv as T, createHash as E, createHmac as ae, randomBytes as D, randomUUID as oe, scrypt as se } from "node:crypto";
-import { copyFile as ce, createReadStream as le, createWriteStream as O, existsSync as k, rename as ue, unlinkSync as de } from "node:fs";
-import { STORAGE_REFS_TABLE as A, fromNodeReadable as fe, getObjectStream as pe, putObjectStream as j, toNodeReadable as M } from "@voltro/plugin-storage";
-import * as N from "node:zlib";
-import { PassThrough as P, Readable as me } from "node:stream";
-import { SqlClient as F } from "@effect/sql";
-import { mkdir as he, readdir as ge, stat as I } from "node:fs/promises";
-import { basename as _e, delimiter as ve, dirname as L, join as R, resolve as ye, sep as be } from "node:path";
-import { promisify as xe } from "node:util";
-import { spawn as Se } from "node:child_process";
+import { createCipheriv as T, createDecipheriv as E, createHash as D, createHmac as ie, randomBytes as ae, randomUUID as oe, scrypt as se } from "node:crypto";
+import { copyFile as ce, createReadStream as le, createWriteStream as O, existsSync as ue, rename as de, statSync as fe, unlinkSync as k } from "node:fs";
+import { STORAGE_REFS_TABLE as pe, fromNodeReadable as me, getObjectStream as A, putObjectStream as j, toNodeReadable as he } from "@voltro/plugin-storage";
+import * as M from "node:zlib";
+import { PassThrough as N, Readable as ge } from "node:stream";
+import { SqlClient as _e } from "@effect/sql";
+import { mkdir as P, readdir as F, stat as ve } from "node:fs/promises";
+import { basename as I, delimiter as L, dirname as ye, join as R, resolve as be, sep as xe } from "node:path";
+import { promisify as Se } from "node:util";
+import { spawn as Ce } from "node:child_process";
 //#region src/consistency.ts
-var Ce = (e) => {
+var we = (e) => {
 	switch (e) {
 		case "postgres": return ["SET TRANSACTION ISOLATION LEVEL REPEATABLE READ"];
 		case "mysql":
@@ -22,7 +22,7 @@ var Ce = (e) => {
 		case "turso": return [];
 		default: return [];
 	}
-}, we = {
+}, Te = {
 	email: { fake: "email" },
 	fullName: { fake: "fullName" },
 	firstName: { fake: "firstName" },
@@ -37,7 +37,7 @@ var Ce = (e) => {
 	date: "dateShift",
 	secret: "null",
 	freeText: "redact"
-}, Te = (e) => {
+}, Ee = (e) => {
 	let t = {};
 	for (let n of e.tables) {
 		let e = {};
@@ -49,15 +49,15 @@ var Ce = (e) => {
 		t[n.name] = e;
 	}
 	return t;
-}, Ee = (e, t, n, r) => {
+}, De = (e, t, n, r) => {
 	let i = r.columns?.[`${e}.${t}`];
 	if (i) return i;
 	if (n?.sensitive) {
 		let e = n.sensitive.class;
-		return r.classes?.[e] ?? we[e] ?? "redact";
+		return r.classes?.[e] ?? Te[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, De = (e, t) => ae("sha256", e).update(t == null ? "∅" : String(t)).digest(), z = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Oe = [
+}, Oe = (e, t) => ie("sha256", e).update(t == null ? "∅" : String(t)).digest(), z = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), ke = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -70,7 +70,7 @@ var Ce = (e) => {
 	"Guido",
 	"Margaret",
 	"Bjarne"
-], ke = [
+], Ae = [
 	"Lovelace",
 	"Turing",
 	"Hopper",
@@ -83,7 +83,7 @@ var Ce = (e) => {
 	"Rossum",
 	"Hamilton",
 	"Stroustrup"
-], Ae = [
+], je = [
 	"Maple",
 	"Oak",
 	"Cedar",
@@ -92,7 +92,7 @@ var Ce = (e) => {
 	"Birch",
 	"Willow",
 	"Ash"
-], je = [
+], Me = [
 	"Initech",
 	"Hooli",
 	"Umbrella",
@@ -101,23 +101,23 @@ var Ce = (e) => {
 	"Soylent",
 	"Stark",
 	"Wayne"
-], B = (e, t, n) => e[z(t, n) % e.length], Me = (e, t, n) => {
-	let r = De(n, `${e}:${String(t)}`), i = z(r, 1) % 1e4;
+], B = (e, t, n) => e[z(t, n) % e.length], Ne = (e, t, n) => {
+	let r = Oe(n, `${e}:${String(t)}`), i = z(r, 1) % 1e4;
 	switch (e) {
-		case "email": return `${B(Oe, r, 0).toLowerCase()}.${B(ke, r, 2).toLowerCase()}${i}@example.com`;
-		case "fullName": return `${B(Oe, r, 0)} ${B(ke, r, 1)}`;
-		case "firstName": return B(Oe, r, 0);
-		case "lastName": return B(ke, r, 1);
-		case "username": return `${B(Oe, r, 0).toLowerCase()}${i}`;
+		case "email": return `${B(ke, r, 0).toLowerCase()}.${B(Ae, r, 2).toLowerCase()}${i}@example.com`;
+		case "fullName": return `${B(ke, r, 0)} ${B(Ae, r, 1)}`;
+		case "firstName": return B(ke, r, 0);
+		case "lastName": return B(Ae, r, 1);
+		case "username": return `${B(ke, r, 0).toLowerCase()}${i}`;
 		case "phone": return `+1${String(z(r, 0) % 1e10).padStart(10, "0")}`;
-		case "address": return `${z(r, 0) % 9899 + 100} ${B(Ae, r, 1)} St`;
-		case "company": return B(je, r, 0);
+		case "address": return `${z(r, 0) % 9899 + 100} ${B(je, r, 1)} St`;
+		case "company": return B(Me, r, 0);
 		case "url": return `https://example.com/${r.toString("hex").slice(0, 12)}`;
 		case "ip": return `${z(r, 0) % 256}.${z(r, 1) % 256}.${z(r, 2) % 256}.${z(r, 3) % 254 + 1}`;
-		case "creditCard": return Ne(`4${r.toString("hex").replace(/\D/g, "").padEnd(14, "0").slice(0, 14)}`);
+		case "creditCard": return Pe(`4${r.toString("hex").replace(/\D/g, "").padEnd(14, "0").slice(0, 14)}`);
 		default: return `${e}_${r.toString("hex").slice(0, 8)}`;
 	}
-}, Ne = (e) => {
+}, Pe = (e) => {
 	let t = e.slice(0, 15).split("").map(Number), n = 0;
 	t.forEach((e, t) => {
 		let r = e;
@@ -125,31 +125,31 @@ var Ce = (e) => {
 	});
 	let r = (10 - n % 10) % 10;
 	return e.slice(0, 15) + String(r);
-}, Pe = 864e5, Fe = (e, t) => {
+}, Fe = 864e5, Ie = (e, t) => {
 	let n = e instanceof Date ? e.getTime() : Date.parse(String(e));
 	if (Number.isNaN(n)) return e;
-	let r = z(De(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Pe);
+	let r = z(Oe(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Fe);
 	return e instanceof Date ? i : i.toISOString();
-}, Ie = (e, t) => {
+}, Le = (e, t) => {
 	if (t.value === null || t.value === void 0) return null;
 	if (e === "error") throw Error(`masking: unresolved 'error' action for ${t.table}.${t.column}`);
 	if (e === "keep") return t.value;
 	if (e === "null") return null;
 	if (e === "redact") return t.columnType === "text" || typeof t.value == "string" ? "[redacted]" : null;
-	if (e === "hash") return De(t.seed, t.value).toString("hex").slice(0, 16);
-	if (e === "dateShift") return Fe(t.value, t.seed);
-	if (typeof e == "object" && "fake" in e) return Me(e.fake, t.value, t.seed);
+	if (e === "hash") return Oe(t.seed, t.value).toString("hex").slice(0, 16);
+	if (e === "dateShift") return Ie(t.value, t.seed);
+	if (typeof e == "object" && "fake" in e) return Ne(e.fake, t.value, t.seed);
 	if (typeof e == "object" && "custom" in e) return e.custom(t);
 	throw Error(`masking: '${t.table}.${t.column}' resolved to an action this build does not understand (${JSON.stringify(e)}). Refusing to copy the value through. Valid actions: 'keep' | 'null' | 'redact' | 'hash' | 'dateShift' | { fake: '<class>' } | { custom: fn }.`);
-}, Le = (e) => typeof e == "string" ? e === "keep" || e === "null" || e === "redact" || e === "hash" || e === "dateShift" || e === "error" : typeof e != "object" || !e ? !1 : "fake" in e ? typeof e.fake == "string" : "custom" in e && typeof e.custom == "function", Re = (e, t, n) => {
+}, Re = (e) => typeof e == "string" ? e === "keep" || e === "null" || e === "redact" || e === "hash" || e === "dateShift" || e === "error" : typeof e != "object" || !e ? !1 : "fake" in e ? typeof e.fake == "string" : "custom" in e && typeof e.custom == "function", ze = (e, t, n) => {
 	let r = {}, i = [], a = [];
 	for (let o of e) for (let e of o.columns) {
-		let s = `${o.name}.${e.name}`, c = Ee(o.name, e.name, t[o.name]?.[e.name], n);
+		let s = `${o.name}.${e.name}`, c = De(o.name, e.name, t[o.name]?.[e.name], n);
 		if (c === "error") {
 			i.push(s);
 			continue;
 		}
-		if (!Le(c)) {
+		if (!Re(c)) {
 			a.push({
 				column: s,
 				action: c
@@ -163,7 +163,7 @@ var Ce = (e) => {
 		unclassified: i,
 		invalid: a
 	};
-}, ze = [
+}, Be = [
 	{
 		name: "email",
 		re: /[\w.+-]+@[\w-]+\.[\w.-]+/
@@ -180,7 +180,7 @@ var Ce = (e) => {
 		name: "creditCard",
 		re: /\b(?:\d[ -]?){13,16}\b/
 	}
-], Be = (e, t, n) => {
+], Ve = (e, t, n) => {
 	let r = [], i = /* @__PURE__ */ new Set();
 	for (let [a, o] of Object.entries(n)) {
 		if (!a.startsWith(`${t}.`) || o !== "keep") continue;
@@ -188,7 +188,7 @@ var Ce = (e) => {
 		for (let a of e) {
 			let e = a[n];
 			if (typeof e != "string" || e.length === 0) continue;
-			let o = ze.find((t) => t.re.test(e));
+			let o = Be.find((t) => t.re.test(e));
 			if (o && !i.has(n)) {
 				i.add(n), r.push({
 					table: t,
@@ -201,9 +201,9 @@ var Ce = (e) => {
 		}
 	}
 	return r;
-}, Ve = (e, t, n, r, i) => {
+}, He = (e, t, n, r, i) => {
 	let a = {};
-	for (let [o, s] of Object.entries(e)) a[o] = Ie(n[`${t}.${o}`] ?? "keep", {
+	for (let [o, s] of Object.entries(e)) a[o] = Le(n[`${t}.${o}`] ?? "keep", {
 		value: s,
 		table: t,
 		column: o,
@@ -211,7 +211,7 @@ var Ce = (e) => {
 		...i?.[o] ? { columnType: i[o] } : {}
 	});
 	return a;
-}, He = /* @__PURE__ */ new Map([
+}, Ue = /* @__PURE__ */ new Map([
 	["_voltro_migration_plans", "the schema fingerprint THIS deployment applied — a foreign row makes the next boot refuse"],
 	["_voltro_migrations", "which file-based migrations ran HERE — a foreign row marks unrun migrations as done"],
 	["_voltro_seeds", "which seeds ran HERE — a foreign row suppresses seeding the target still needs"],
@@ -243,7 +243,7 @@ var Ce = (e) => {
 	["_voltro_notification_held", "notifications waiting to be SENT from here — a foreign row makes the target deliver something queued elsewhere"],
 	["_voltro_webhook_event_stats", "per-deployment delivery counters a backoff decision reads — foreign counts steer the target's retries"],
 	["_voltro_webhook_rate_windows", "the live rate-limit windows this deployment is inside — a foreign window throttles or releases wrongly"]
-]), Ue = /* @__PURE__ */ new Map([
+]), We = /* @__PURE__ */ new Map([
 	["_voltro_agent_threads", "conversations the app's users had — app data"],
 	["_voltro_agent_messages", "the messages in those conversations — app data"],
 	["_voltro_prompts", "prompt definitions the app authored — app data"],
@@ -274,21 +274,21 @@ var Ce = (e) => {
 	["_voltro_audit_log", "the app's audit trail — compliance data the app owns, not deployment bookkeeping"],
 	["_voltro_feature_flags", "the flags the app defined — app configuration"],
 	["_voltro_feature_flag_audit", "who changed which flag — belongs with the flags"]
-]), V = (e) => He.has(e), We = (e) => He.get(e), Ge = (e, t) => {
+]), V = (e) => Ue.has(e), Ge = (e) => Ue.get(e), Ke = (e, t) => {
 	if (e.length === 0) return;
-	let n = e.map((e) => `    ${e} — ${We(e) ?? "describes this deployment"}`);
+	let n = e.map((e) => `    ${e} — ${Ge(e) ?? "describes this deployment"}`);
 	return `${t} ${e.length} table(s) that describe a deployment rather than its data:\n${n.join("\n")}\n  A row from another environment is not stale there, it is a false statement about this one.`;
 }, H = class extends c.TaggedError()("BundleError", {
 	reason: c.String,
 	path: c.optional(c.String)
-}) {}, Ke = class extends c.TaggedError()("CodecError", {
+}) {}, qe = class extends c.TaggedError()("CodecError", {
 	table: c.String,
 	reason: c.String
-}) {}, qe = class extends c.TaggedError()("IntegrityError", {
+}) {}, Je = class extends c.TaggedError()("IntegrityError", {
 	what: c.String,
 	expected: c.String,
 	actual: c.String
-}) {}, Je = class extends t.TaggedError("CompressionError") {}, U = class extends c.TaggedError()("ScopeError", { reason: c.String }) {}, Ye = class extends c.TaggedError()("RowsRefusedError", {
+}) {}, Ye = class extends t.TaggedError("CompressionError") {}, U = class extends c.TaggedError()("ScopeError", { reason: c.String }) {}, Xe = class extends c.TaggedError()("RowsRefusedError", {
 	rows: c.Array(c.Struct({
 		table: c.String,
 		id: c.String,
@@ -302,7 +302,7 @@ var Ce = (e) => {
 		refused: c.Number,
 		primary: c.Number
 	}))
-}) {}, Xe = class extends c.TaggedError()("SchemaDriftError", {
+}) {}, Ze = class extends c.TaggedError()("SchemaDriftError", {
 	bundleFingerprint: c.String,
 	targetFingerprint: c.String,
 	diff: c.Array(c.String)
@@ -311,20 +311,20 @@ var Ce = (e) => {
 		let e = this.stderr?.trim(), t = this.hint?.trim();
 		return `${this.tool}: ${this.reason}${e ? `\n${e}` : ""}${t ? `\n\nhint: ${t}` : ""}`;
 	}
-}, Ze = class extends c.TaggedError()("MaskingError", {
+}, Qe = class extends c.TaggedError()("MaskingError", {
 	unclassified: c.Array(c.String),
 	invalidActions: c.optional(c.Array(c.String))
-}) {}, Qe = class extends c.TaggedError()("ImportModeError", {
+}) {}, $e = class extends c.TaggedError()("ImportModeError", {
 	mode: c.String,
 	reason: c.String
-}) {}, $e = class extends c.TaggedError()("CrossDialectError", {
+}) {}, et = class extends c.TaggedError()("CrossDialectError", {
 	sourceDialect: c.String,
 	targetDialect: c.String,
 	blocking: c.Array(c.String)
-}) {}, G = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", et = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.references).map((e) => ({
+}) {}, G = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", tt = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.references).map((e) => ({
 	col: e.name,
 	refTable: e.references.table
-})), tt = (e, t, r) => n.gen(function* () {
+})), nt = (e, t, r) => n.gen(function* () {
 	let i = r.maxDepth ?? 12, a = new Set(r.pinned ?? []), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = /* @__PURE__ */ new Map(), u = (e) => {
 		let t = s.get(e) ?? /* @__PURE__ */ new Set();
 		return s.set(e, t), t;
@@ -342,7 +342,7 @@ var Ce = (e) => {
 			for (let t of n) d(t.refTable, e[t.col]);
 		};
 	}, p = (r, i) => {
-		let a = f(r, G(t, r), et(t, r));
+		let a = f(r, G(t, r), tt(t, r));
 		return l.runForEach(w(e, {
 			table: r,
 			pk: G(t, r),
@@ -377,13 +377,13 @@ var Ce = (e) => {
 		}
 	}
 	return o;
-}), nt = (e, t) => ({
+}), rt = (e, t) => ({
 	tables: [...e.keys()],
 	predicateFor: (n) => {
 		let r = e.get(n);
 		return r ? y(G(t, n), [...r]) : void 0;
 	}
-}), rt = "tenantId", it = (e, t, r) => n.gen(function* () {
+}), it = "tenantId", at = (e, t, r) => n.gen(function* () {
 	let i = t.tables.map((e) => e.name), a = new Map(t.tables.map((e) => [e.name, e]));
 	if (e.kind === "all") {
 		let t = new Set(e.exclude ?? []);
@@ -403,29 +403,29 @@ var Ce = (e) => {
 	}
 	let o = e.tenantId;
 	if (o === void 0 || o === "") return yield* n.fail(new U({ reason: "scope { kind: 'tenant' } requires a tenantId — pass --tenant <id> (CLI) or scope.tenantId (API). Refusing to fall back to an unfiltered export." }));
-	let s = r.tenantTables ? r.tenantTables.filter((e) => a.has(e)) : i.filter((e) => a.get(e)?.columns.some((e) => e.name === rt) ?? !1);
-	if (s.length === 0) return yield* n.fail(new U({ reason: r.tenantTables ? "tenant scope: none of the provided tenantTables exist in the schema — nothing to filter." : `tenant scope: no table carries a '${rt}' column — nothing to filter. A tenant export of a schema without tenant-scoped tables would be the full database; refusing.` }));
-	let c = yield* tt(r.store, t, {
-		seeds: Object.fromEntries(s.map((e) => [e, g(rt, o)])),
+	let s = r.tenantTables ? r.tenantTables.filter((e) => a.has(e)) : i.filter((e) => a.get(e)?.columns.some((e) => e.name === it) ?? !1);
+	if (s.length === 0) return yield* n.fail(new U({ reason: r.tenantTables ? "tenant scope: none of the provided tenantTables exist in the schema — nothing to filter." : `tenant scope: no table carries a '${it}' column — nothing to filter. A tenant export of a schema without tenant-scoped tables would be the full database; refusing.` }));
+	let c = yield* nt(r.store, t, {
+		seeds: Object.fromEntries(s.map((e) => [e, g(it, o)])),
 		pinned: s,
 		children: { roots: s }
 	}), l = [...c.entries()].filter(([, e]) => e.size > 0).map(([e]) => e), u = new Set(s);
 	return {
 		tables: [...s, ...l],
-		predicateFor: (e) => u.has(e) ? g(rt, o) : c.has(e) ? y(G(t, e), [...c.get(e)]) : void 0
+		predicateFor: (e) => u.has(e) ? g(it, o) : c.has(e) ? y(G(t, e), [...c.get(e)]) : void 0
 	};
-}), at = (e, t) => ({
+}), ot = (e, t) => ({
 	list: t,
-	open: (t) => pe(e, t)
-}), ot = (e) => ({
+	open: (t) => A(e, t)
+}), st = (e) => ({
 	write: (t, n, r) => j(e, t, n, r),
 	has: (t) => e.head(t).pipe(n.map((e) => e !== null))
-}), st = (e, t) => n.tryPromise({
+}), ct = (e, t) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), r = await import("node:fs/promises"), { createHash: i, randomUUID: a } = await import("node:crypto"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = await import("node:path"), l = c.join(t, `.tmp-${a()}`), u = i("sha256"), d = 0, f = new s({ transform(e, t, n) {
 			u.update(e), d += e.length, n(null, e);
 		} });
-		await o(await M(e.stream), f, n(l));
+		await o(await he(e.stream), f, n(l));
 		let p = u.digest("hex"), m = c.join(t, p);
 		try {
 			await r.access(m), await r.rm(l, { force: !0 });
@@ -442,44 +442,47 @@ var Ce = (e) => {
 		reason: `asset write failed: ${String(e?.message ?? e)}`,
 		path: t
 	})
-}), ct = (e, t, r) => n.gen(function* () {
-	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), c = o("sha256"), u = fe("bundle", () => a(s)).pipe(l.tap((e) => n.sync(() => c.update(e))));
+}), lt = (e, t, r) => n.gen(function* () {
+	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), c = o("sha256"), u = me("bundle", () => a(s)).pipe(l.tap((e) => n.sync(() => c.update(e))));
 	yield* e.write(r.key, u, {
 		contentType: r.contentType,
 		totalSize: r.size
 	});
 	let d = c.digest("hex");
-	if (d !== r.sha256) return yield* n.fail(new qe({
+	if (d !== r.sha256) return yield* n.fail(new Je({
 		what: `asset ${r.key}`,
 		expected: r.sha256,
 		actual: d
 	}));
-}), lt = {
+}), ut = {
 	done: () => !1,
 	mark: () => n.void
-}, ut = (e) => n.gen(function* () {
-	let t = e.progress ?? lt, r = 0, i = 0;
-	return yield* l.runForEach(e.source.list(), (a) => t.done(a.key) ? n.void : e.source.open(a.key).pipe(n.flatMap((t) => st(t, e.assetsDir)), n.flatMap((e) => {
+}, dt = (e) => typeof e == "object" && !!e && e.status === 404, ft = (e) => n.gen(function* () {
+	let t = e.progress ?? ut, r = 0, i = 0, a = [];
+	return yield* l.runForEach(e.source.list(), (o) => t.done(o.key) ? n.void : e.source.open(o.key).pipe(n.map((e) => e), n.catchIf(dt, () => n.sync(() => {
+		a.push(o.key);
+	})), n.flatMap((a) => a === void 0 ? n.void : ct(a, e.assetsDir).pipe(n.flatMap((e) => {
 		let n = {
-			key: a.key,
+			key: o.key,
 			sha256: e.sha256,
 			size: e.size,
 			contentType: e.contentType
 		};
-		return r++, i += e.size, t.mark(a.key, n);
-	}))).pipe(n.mapError((e) => e instanceof H ? e : new H({ reason: `asset export failed: ${String(e)}` }))), {
+		return r++, i += e.size, t.mark(o.key, n);
+	}))))).pipe(n.mapError((e) => e instanceof H ? e : new H({ reason: `asset export failed: ${String(e)}` }))), {
 		count: r,
-		totalBytes: i
+		totalBytes: i,
+		missing: a
 	};
-}), dt = (e) => fe("bundle", () => le(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof H ? t : new H({
+}), pt = (e) => me("bundle", () => le(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof H ? t : new H({
 	reason: `asset index unreadable: ${String(t)}`,
 	path: e
-}))), ft = (e) => n.gen(function* () {
-	let t = e.progress ?? lt, r = 0;
-	return yield* l.runForEach(dt(e.indexPath), (i) => t.done(i.key) ? n.void : ct(e.sink, e.assetsDir, i).pipe(n.andThen(n.sync(() => {
+}))), mt = (e) => n.gen(function* () {
+	let t = e.progress ?? ut, r = 0;
+	return yield* l.runForEach(pt(e.indexPath), (i) => t.done(i.key) ? n.void : lt(e.sink, e.assetsDir, i).pipe(n.andThen(n.sync(() => {
 		r++;
 	})), n.andThen(t.mark(i.key, i)))), r;
-}), pt = () => typeof N.createZstdCompress == "function", mt = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : pt() ? "zstd" : "gzip", ht = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", gt = (e) => e === "zstd" ? N.createZstdCompress() : e === "gzip" ? N.createGzip() : new P(), _t = (e) => e === "zstd" ? N.createZstdDecompress() : e === "gzip" ? N.createGunzip() : new P(), vt = 1, yt = c.Struct({
+}), ht = () => typeof M.createZstdCompress == "function", gt = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : ht() ? "zstd" : "gzip", _t = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", vt = (e) => e === "zstd" ? M.createZstdCompress() : e === "gzip" ? M.createGzip() : new N(), yt = (e) => e === "zstd" ? M.createZstdDecompress() : e === "gzip" ? M.createGunzip() : new N(), bt = 1, xt = c.Struct({
 	name: c.String,
 	file: c.String,
 	rowCount: c.Number,
@@ -489,12 +492,12 @@ var Ce = (e) => {
 		value: c.String
 	}),
 	primaryKey: c.String
-}), bt = c.Struct({
+}), St = c.Struct({
 	kind: c.Literal("all", "tenant", "tables"),
 	tenantId: c.optional(c.String),
 	tables: c.optional(c.Array(c.String)),
 	exclude: c.optional(c.Array(c.String))
-}), xt = c.Struct({
+}), Ct = c.Struct({
 	count: c.Number,
 	totalBytes: c.Number,
 	index: c.optional(c.String)
@@ -505,23 +508,23 @@ c.Struct({
 	size: c.Number,
 	contentType: c.String
 });
-var St = c.Struct({
+var wt = c.Struct({
 	formatVersion: c.Number,
 	createdAt: c.String,
 	source: c.Struct({
 		dialect: c.String,
 		schemaFingerprint: c.String
 	}),
-	scope: bt,
+	scope: St,
 	consistency: c.Literal("live", "snapshot"),
 	compression: c.Literal("zstd", "gzip", "none"),
-	tables: c.Array(yt),
-	assets: xt,
+	tables: c.Array(xt),
+	assets: Ct,
 	masking: c.optional(c.Struct({
 		policyId: c.optional(c.String),
 		transformed: c.Array(c.String)
 	}))
-}), Ct = c.encodeSync(c.parseJson(St)), wt = c.decodeUnknownSync(c.parseJson(St)), K = "manifest.json", Tt = "README.md", Et = "data", Dt = "assets", Ot = "assets/index.ndjson", kt = ".ledger.json", At = (e) => e.kind === "tenant" ? `tenant \`${e.tenantId}\`` : e.kind === "tables" ? `tables \`${(e.tables ?? []).join(", ")}\`` : "all tables", jt = (e, t) => {
+}), Tt = c.encodeSync(c.parseJson(wt)), Et = c.decodeUnknownSync(c.parseJson(wt)), K = "manifest.json", Dt = "README.md", Ot = "data", kt = "assets", At = "assets/index.ndjson", jt = ".ledger.json", Mt = (e) => e.kind === "tenant" ? `tenant \`${e.tenantId}\`` : e.kind === "tables" ? `tables \`${(e.tables ?? []).join(", ")}\`` : "all tables", Nt = (e, t) => {
 	let n = e.tables.reduce((e, t) => e + t.rowCount, 0), r = e.masking ? `✅ **Masked at the source** — ${e.masking.transformed.length} column(s) transformed${e.masking.policyId ? ` (policy \`${e.masking.policyId}\`)` : ""}. Personal data was replaced with realistic, referentially-consistent fakes before any byte was written.` : "⚠️ **NOT masked — this bundle contains REAL data (PII included).** Treat it as production data: do not copy it into a lower environment or share it without review. To produce a safe copy, re-export under a masking profile (`--profile`).", i = e.masking && e.masking.transformed.length > 0 ? `\n\nMasked columns: ${e.masking.transformed.map((e) => `\`${e}\``).join(", ")}.` : "", a = e.assets.count > 0 ? `${e.assets.count} object(s), ${e.assets.totalBytes} bytes` : "none", o = e.tables.map((e) => `| \`${e.name}\` | ${e.rowCount} |`).join("\n");
 	return `# Voltro data export
 
@@ -535,7 +538,7 @@ The machine-readable manifest is \`manifest.json\`; this file is a human summary
 | **Format version** | ${e.formatVersion} |
 | **Consistency** | ${e.consistency} |
 | **Compression** | ${e.compression} |
-| **Scope** | ${At(e.scope)} |
+| **Scope** | ${Mt(e.scope)} |
 | **Tables** | ${e.tables.length} |
 | **Rows (total)** | ${n} |
 | **Assets** | ${a} |
@@ -560,26 +563,26 @@ voltro data import <this-directory>
 voltro data import <this-directory> --target api --api-url <url> --token <secret>
 \`\`\`
 `;
-}, Mt = i.counter("voltro_data_transfer_rows", { description: "Rows exported/imported by @voltro/data-transfer, tagged by phase + table." }), Nt = a.exponential({
+}, Pt = i.counter("voltro_data_transfer_rows", { description: "Rows exported/imported by @voltro/data-transfer, tagged by phase + table." }), Ft = a.exponential({
 	start: .01,
 	factor: 2,
 	count: 16
-}), Pt = i.histogram("voltro_data_transfer_table_seconds", Nt, "Per-table export/import duration in seconds, tagged by phase."), q = (e, t) => {
+}), It = i.histogram("voltro_data_transfer_table_seconds", Ft, "Per-table export/import duration in seconds, tagged by phase."), q = (e, t) => {
 	if (e) try {
 		e(t);
 	} catch {}
-}, Ft = (e, t, r, a, o, s) => n.Do.pipe(n.bind("start", () => n.clockWith((e) => e.currentTimeMillis)), n.bind("result", () => s), n.tap(({ start: r, result: a }) => n.clockWith((e) => e.currentTimeMillis).pipe(n.flatMap((s) => n.zipRight(Pt.pipe(i.tagged("phase", e), i.update((s - r) / 1e3)), Mt.pipe(i.tagged("phase", e), i.tagged("table", t), i.update(o(a))))))), n.map(({ result: e }) => e), n.withSpan(`data-transfer.${e}.table`, { attributes: {
+}, Lt = (e, t, r, a, o, s) => n.Do.pipe(n.bind("start", () => n.clockWith((e) => e.currentTimeMillis)), n.bind("result", () => s), n.tap(({ start: r, result: a }) => n.clockWith((e) => e.currentTimeMillis).pipe(n.flatMap((s) => n.zipRight(It.pipe(i.tagged("phase", e), i.update((s - r) / 1e3)), Pt.pipe(i.tagged("phase", e), i.tagged("table", t), i.update(o(a))))))), n.map(({ result: e }) => e), n.withSpan(`data-transfer.${e}.table`, { attributes: {
 	table: t,
 	index: r,
 	tableCount: a,
 	phase: e
-} })), It = () => ({
+} })), Rt = () => ({
 	tables: {},
 	assets: {}
-}), Lt = (e) => n.tryPromise(async () => {
+}), zt = (e) => n.tryPromise(async () => {
 	let t = await (await import("node:fs/promises")).readFile(e, "utf8");
 	return JSON.parse(t);
-}).pipe(n.orElseSucceed(It)), J = (e, t) => n.tryPromise({
+}).pipe(n.orElseSucceed(Rt)), J = (e, t) => n.tryPromise({
 	try: async () => {
 		let n = await import("node:fs/promises"), { randomUUID: r } = await import("node:crypto"), i = `${e}.tmp-${r()}`;
 		await n.writeFile(i, JSON.stringify(t)), await n.rename(i, e);
@@ -588,11 +591,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `ledger write failed: ${String(t?.message ?? t)}`,
 		path: e
 	})
-}), Rt = (e, t) => t in e.tables, zt = (e, t) => t in e.assets, Bt = /* @__PURE__ */ new Set([
+}), Bt = (e, t) => t in e.tables, Vt = (e, t) => t in e.assets, Ht = /* @__PURE__ */ new Set([
 	"json",
 	"array",
 	"vector"
-]), Vt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && typeof e.$v == "string", Ht = (e) => Buffer.from(e).toString("base64"), Ut = (e) => new Uint8Array(Buffer.from(e, "base64")), Wt = (e) => e instanceof Date ? e.toISOString() : typeof e == "number" ? new Date(e).toISOString() : String(e), Gt = (e, t) => e == null ? null : t !== void 0 && Bt.has(t) ? e : t === "bytes" ? Ht(e) : t === "timestamp" || t === "date" ? Wt(e) : typeof e == "bigint" ? {
+]), Ut = (e) => typeof e == "object" && !!e && !Array.isArray(e) && typeof e.$v == "string", Wt = (e) => Buffer.from(e).toString("base64"), Gt = (e) => new Uint8Array(Buffer.from(e, "base64")), Kt = (e) => e instanceof Date ? e.toISOString() : typeof e == "number" ? new Date(e).toISOString() : String(e), qt = (e, t) => e == null ? null : t !== void 0 && Ht.has(t) ? e : t === "bytes" ? Wt(e) : t === "timestamp" || t === "date" ? Kt(e) : typeof e == "bigint" ? {
 	$v: "bigint",
 	d: e.toString()
 } : typeof e == "number" && !Number.isFinite(e) ? {
@@ -603,30 +606,30 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	d: e.toISOString()
 } : e instanceof Uint8Array ? {
 	$v: "bytes",
-	d: Ht(e)
-} : e, Kt = (e) => {
+	d: Wt(e)
+} : e, Jt = (e) => {
 	switch (e.$v) {
 		case "bigint": return BigInt(e.d);
 		case "number": return Number(e.d);
 		case "date": return new Date(e.d);
-		case "bytes": return Ut(e.d);
+		case "bytes": return Gt(e.d);
 		default: return e;
 	}
-}, qt = (e, t) => e == null ? null : t !== void 0 && Bt.has(t) ? e : Vt(e) ? Kt(e) : t === "bytes" ? Ut(e) : t === "timestamp" || t === "date" ? new Date(e) : e, Jt = (e, t) => {
+}, Yt = (e, t) => e == null ? null : t !== void 0 && Ht.has(t) ? e : Ut(e) ? Jt(e) : t === "bytes" ? Gt(e) : t === "timestamp" || t === "date" ? new Date(e) : e, Xt = (e, t) => {
 	let n = {};
-	for (let [r, i] of Object.entries(e)) n[r] = Gt(i, t[r]);
+	for (let [r, i] of Object.entries(e)) n[r] = qt(i, t[r]);
 	return n;
-}, Yt = (e, t) => {
+}, Zt = (e, t) => {
 	let n = {};
-	for (let [r, i] of Object.entries(e)) n[r] = qt(i, t[r]);
+	for (let [r, i] of Object.entries(e)) n[r] = Yt(i, t[r]);
 	return n;
-}, Xt = new TextEncoder(), Zt = (e, t) => e.pipe(l.map((e) => Xt.encode(`${JSON.stringify(Jt(e, t))}\n`))), Qt = (e, t, r) => e.pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.mapEffect((e) => n.try({
-	try: () => Yt(JSON.parse(e), r),
-	catch: (e) => new Ke({
+}, Qt = new TextEncoder(), $t = (e, t) => e.pipe(l.map((e) => Qt.encode(`${JSON.stringify(Xt(e, t))}\n`))), en = (e, t, r) => e.pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.mapEffect((e) => n.try({
+	try: () => Zt(JSON.parse(e), r),
+	catch: (e) => new qe({
 		table: t,
 		reason: String(e?.message ?? e)
 	})
-}))), $t = (e, t) => {
+}))), tn = (e, t) => {
 	let n = new Set(e), r = /* @__PURE__ */ new Map();
 	for (let e of t.tables) {
 		if (!n.has(e.name)) continue;
@@ -652,33 +655,33 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	let r = typeof t?.message == "string" ? t.message.trim() : "";
 	if (r === "" ? t?.cause !== void 0 && t.cause !== null && n.push(Y(t.cause)) : n.push(r), n.length === 0) {
 		let t = String(e ?? "").trim();
-		return t === "" || t === "[object Object]" ? en(e) : t;
+		return t === "" || t === "[object Object]" ? nn(e) : t;
 	}
 	return n.join(": ");
-}, en = (e) => {
+}, nn = (e) => {
 	try {
 		let t = JSON.stringify(e);
 		return t === void 0 || t === "{}" ? "unknown error (no message, cause or tag)" : t;
 	} catch {
 		return "unknown error (not serialisable)";
 	}
-}, tn = (e, t) => {
+}, rn = (e, t) => {
 	let n = e.tables.find((e) => e.name === t), r = {};
 	for (let e of n?.columns ?? []) e.generatedAs === void 0 && (r[e.name] = e.type);
 	return r;
-}, nn = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.generatedAs !== void 0).map((e) => e.name), rn = (e, t) => {
+}, an = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.generatedAs !== void 0).map((e) => e.name), on = (e, t) => {
 	if (t.length === 0) return e;
 	let n = { ...e };
 	for (let e of t) delete n[e];
 	return n;
-}, an = (e, t) => {
+}, sn = (e, t) => {
 	let n = e.tables.find((e) => e.name === t);
 	if (n === void 0) return { refusal: `${t}: not in the schema snapshot, so its primary key is unknown.` };
 	let r = n.columns.find((e) => e.type === "id");
 	if (r !== void 0) return { column: r.name };
 	let i = n.indexes.find((e) => e.name === `${t}_pkey`)?.columns ?? n.primaryKey ?? [];
 	return i.length === 1 ? { column: i[0] } : i.length > 1 ? { refusal: `${t}: composite primary key (${i.join(", ")}). Keyset export orders by ONE column; ordering by the first alone would split equal values across pages and drop or duplicate rows. Exclude this table from the scope, or give it a single-column key.` } : { refusal: `${t}: no primary key, so there is no stable order to paginate by. A keyset export would return rows in an order the database may change between pages. Exclude this table from the scope.` };
-}, on = (e, t, r) => n.tryPromise({
+}, cn = (e, t, r) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), i = await import("node:fs/promises"), { createHash: a, randomUUID: o } = await import("node:crypto"), { pipeline: s } = await import("node:stream/promises"), { Readable: c, Transform: u } = await import("node:stream"), d = a("sha256"), f = 0, p = new u({ transform(e, t, n) {
 			d.update(e);
@@ -687,7 +690,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			n(null, e);
 		} }), m = c.fromWeb(l.toReadableStream(e)), h = `${t}.tmp-${o()}`;
 		try {
-			await s(m, p, gt(r), n(h)), await i.rename(h, t);
+			await s(m, p, vt(r), n(h)), await i.rename(h, t);
 		} catch (e) {
 			throw await i.rm(h, { force: !0 }).catch(() => {}), e;
 		}
@@ -700,7 +703,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `write table failed: ${Y(e)}`,
 		path: t
 	})
-}), sn = (e, t) => n.tryPromise({
+}), ln = (e, t) => n.tryPromise({
 	try: async () => {
 		await (await import("node:fs/promises")).appendFile(e, `${t}\n`);
 	},
@@ -708,13 +711,13 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `append failed: ${Y(t)}`,
 		path: e
 	})
-}), cn = (e, t) => n.gen(function* () {
+}), un = (e, t) => n.gen(function* () {
 	let r = [], i = t.ordered.length;
 	for (let a = 0; a < t.ordered.length; a++) {
-		let o = t.ordered[a], s = tn(t.snapshot, o), c = an(t.snapshot, o);
+		let o = t.ordered[a], s = rn(t.snapshot, o), c = sn(t.snapshot, o);
 		if ("refusal" in c) return yield* n.fail(new U({ reason: `export: ${c.refusal}` }));
-		let u = c.column, d = `${Et}/${o}.ndjson${ht(t.compression)}`;
-		if (Rt(t.ledger, o)) {
+		let u = c.column, d = `${Ot}/${o}.ndjson${_t(t.compression)}`;
+		if (Bt(t.ledger, o)) {
 			let e = t.ledger.tables[o];
 			q(t.onProgress, {
 				phase: "export",
@@ -748,7 +751,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			chunkSize: t.chunkSize,
 			retry: t.retry,
 			...f === void 0 ? {} : { where: f }
-		}), m = nn(t.snapshot, o), h = m.length === 0 ? p : p.pipe(l.map((e) => rn(e, m))), g = t.mask ? h.pipe(l.map((e) => Ve(e, o, t.mask.actions, t.mask.seed, s))) : h, { rowCount: _, checksum: v } = yield* Ft("export", o, a, i, (e) => e.rowCount, on(Zt(g, s), t.bundleFile(d), t.compression));
+		}), m = an(t.snapshot, o), h = m.length === 0 ? p : p.pipe(l.map((e) => on(e, m))), g = t.mask ? h.pipe(l.map((e) => He(e, o, t.mask.actions, t.mask.seed, s))) : h, { rowCount: _, checksum: v } = yield* Lt("export", o, a, i, (e) => e.rowCount, cn($t(g, s), t.bundleFile(d), t.compression));
 		t.ledger.tables[o] = {
 			rowCount: _,
 			checksum: v
@@ -770,43 +773,43 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return r;
-}), ln = (e) => ({
+}), dn = (e) => ({
 	_tag: "RawSqlFragment",
 	strings: [e],
 	values: []
-}), un = (t, i, a) => n.tryPromise({
+}), fn = (t, i, a) => n.tryPromise({
 	try: () => t.transactional(async (t) => {
-		if (t.raw) for (let e of Ce(i)) await t.raw(ln(e));
+		if (t.raw) for (let e of we(i)) await t.raw(dn(e));
 		let o = await n.runPromiseExit(a(t));
 		if (r.isFailure(o)) throw Error(e.pretty(o.cause));
 		return o.value;
 	}),
 	catch: (e) => e instanceof H ? e : new H({ reason: `snapshot export failed: ${Y(e)}` })
-}), dn = (e) => n.gen(function* () {
-	let t = e.scope ?? { kind: "all" }, r = mt(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, o = s.exponential("50 millis").pipe(s.jittered, s.intersect(s.recurs(a))), c = yield* n.promise(() => import("node:path")), l = (t) => c.join(e.outDir, t);
+}), pn = (e) => n.gen(function* () {
+	let t = e.scope ?? { kind: "all" }, r = gt(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, o = s.exponential("50 millis").pipe(s.jittered, s.intersect(s.recurs(a))), c = yield* n.promise(() => import("node:path")), l = (t) => c.join(e.outDir, t);
 	yield* n.tryPromise({
 		try: async () => {
 			let t = await import("node:fs/promises");
-			await t.mkdir(l(Et), { recursive: !0 }), e.assets && await t.mkdir(l(Dt), { recursive: !0 });
+			await t.mkdir(l(Ot), { recursive: !0 }), e.assets && await t.mkdir(l(kt), { recursive: !0 });
 		},
 		catch: (t) => new H({
 			reason: `mkdir failed: ${Y(t)}`,
 			path: e.outDir
 		})
 	});
-	let u = l(kt), d = yield* Lt(u), f = e.subset ? nt(yield* tt(e.store, e.snapshot, e.subset), e.snapshot) : yield* it(t, e.snapshot, {
+	let u = l(jt), d = yield* zt(u), f = e.subset ? rt(yield* nt(e.store, e.snapshot, e.subset), e.snapshot) : yield* at(t, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
-	}), p = $t(f.tables, e.snapshot), m = e.consistency ?? "live", h, g;
+	}), p = tn(f.tables, e.snapshot), m = e.consistency ?? "live", h, g;
 	if (e.masking) {
-		let t = e.classification ?? Te(e.snapshot), r = Re(p.map((t) => ({
+		let t = e.classification ?? Ee(e.snapshot), r = ze(p.map((t) => ({
 			name: t,
 			columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 				name: e.name,
 				type: e.type
 			}))
 		})), t, e.masking);
-		if (r.unclassified.length > 0 || r.invalid.length > 0) return yield* n.fail(new Ze({
+		if (r.unclassified.length > 0 || r.invalid.length > 0) return yield* n.fail(new Qe({
 			unclassified: r.unclassified,
 			...r.invalid.length > 0 ? { invalidActions: r.invalid.map((e) => `${e.column}: ${JSON.stringify(e.action)}`) } : {}
 		}));
@@ -832,14 +835,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		bundleFile: l,
 		...g ? { mask: g } : {},
 		...e.onProgress ? { onProgress: e.onProgress } : {}
-	}, v = m === "snapshot" ? yield* un(e.store, e.dialect, (e) => cn(e, _)) : yield* cn(e.store, _), y = 0, b = 0;
+	}, v = m === "snapshot" ? yield* fn(e.store, e.dialect, (e) => un(e, _)) : yield* un(e.store, _), y = 0, b = 0;
 	if (e.assets) {
-		let t = l(Ot), r = yield* ut({
+		let t = l(At), r = yield* ft({
 			source: e.assets,
-			assetsDir: l(Dt),
+			assetsDir: l(kt),
 			progress: {
 				done: (e) => e in d.assets,
-				mark: (e, r) => (d.assets[e] = !0, sn(t, JSON.stringify(r)).pipe(n.andThen(J(u, d))))
+				mark: (e, r) => (d.assets[e] = !0, ln(t, JSON.stringify(r)).pipe(n.andThen(J(u, d))))
 			}
 		});
 		y = r.count, b = r.totalBytes;
@@ -858,7 +861,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		assets: y > 0 ? {
 			count: y,
 			totalBytes: b,
-			index: Ot
+			index: At
 		} : {
 			count: 0,
 			totalBytes: 0
@@ -867,7 +870,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	};
 	return yield* n.tryPromise({
 		try: async () => {
-			await (await import("node:fs/promises")).writeFile(l(K), Ct(x));
+			await (await import("node:fs/promises")).writeFile(l(K), Tt(x));
 		},
 		catch: (e) => new H({
 			reason: `manifest write failed: ${Y(e)}`,
@@ -876,14 +879,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	}), yield* n.tryPromise({
 		try: async () => {
 			let e = await import("node:fs/promises"), t = await import("node:os");
-			await e.writeFile(l(Tt), jt(x, { hostname: t.hostname() }));
+			await e.writeFile(l(Dt), Nt(x, { hostname: t.hostname() }));
 		},
 		catch: (e) => new H({
 			reason: `readme write failed: ${Y(e)}`,
-			path: Tt
+			path: Dt
 		})
 	}), x;
-}), fn = (e, t) => {
+}), mn = (e, t) => {
 	let n = new Set(t), r = [];
 	for (let t of e.tables) if (!n.has(t.name)) for (let e of t.columns) {
 		let i = e.references?.table;
@@ -894,7 +897,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return r;
-}, pn = (e) => {
+}, hn = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) t.set(n.from, [...t.get(n.from) ?? [], n]);
 	let n = [...t.entries()].map(([e, t]) => {
@@ -902,7 +905,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		return `  ${e} (${n} row${n === 1 ? "" : "s"}): ${r}`;
 	});
 	return `replace cannot empty this target: ${t.size} table(s) OUTSIDE the bundle hold rows that reference tables INSIDE it. Emptying the bundle's tables would leave those rows pointing at nothing, and the bundle cannot restore them.\n${n.join("\n")}\nNothing has been deleted. Either re-export with a scope that includes those tables, or use --mode upsert if those rows are meant to survive.`;
-}, mn = (e) => {
+}, gn = (e) => {
 	switch (e) {
 		case "id":
 		case "text":
@@ -921,12 +924,12 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "raw": return "raw";
 		default: return "string";
 	}
-}, hn = {
+}, _n = {
 	vector: /* @__PURE__ */ new Set(["postgres"]),
 	array: /* @__PURE__ */ new Set(["postgres"]),
 	interval: /* @__PURE__ */ new Set(["postgres"])
-}, gn = (e, t, n, r) => {
-	let i = mn(n);
+}, vn = (e, t, n, r) => {
+	let i = gn(n);
 	if (i === "raw") return {
 		table: e,
 		column: t,
@@ -934,7 +937,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `raw() is verbatim source-dialect SQL — it cannot be assumed valid on ${r}`
 	};
-	let a = hn[i];
+	let a = _n[i];
 	return !a || a.has(r) ? null : i === "array" || i === "interval" ? {
 		table: e,
 		column: t,
@@ -948,15 +951,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `${i} columns require a ${[...a].join("/")} target; ${r} has no compatible column type`
 	};
-}, _n = (e, t, n) => {
+}, yn = (e, t, n) => {
 	if (t === n) return [];
 	let r = [];
 	for (let t of e) for (let [e, i] of Object.entries(t.columnTypes)) {
-		let a = gn(t.name, e, i, n);
+		let a = vn(t.name, e, i, n);
 		a && r.push(a);
 	}
 	return r;
-}, vn = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, yn = (e) => {
+}, bn = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, xn = (e) => {
 	let t = e.constraint ?? e.column, n = t === void 0 ? "" : ` ${t}`;
 	switch (e.kind) {
 		case "foreignKey": return `foreign key${n}: the referenced row does not exist (import it first, or check the bundle's table order)`;
@@ -965,35 +968,35 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "notNull": return `not-null constraint${n}: the column requires a value`;
 		case "check": return `check constraint${n}: the row does not satisfy it`;
 	}
-}, bn = (e) => {
+}, Sn = (e) => {
 	let t = [e.dbCode, e.dbErrno ?? e.dbNumber].filter((e) => e !== void 0).map(String);
 	return t.length > 0 ? t.join("/") : void 0;
-}, xn = "Failed to execute statement", Sn = (e) => {
+}, Cn = "Failed to execute statement", wn = (e) => {
 	let t = (e.split("\n", 1)[0] ?? "").trim();
 	for (; t.startsWith("(FiberFailure)");) t = t.slice(14).trim();
-	return t === `SqlError: ${xn}` ? xn : t;
-}, Cn = (e) => {
+	return t === `SqlError: ${Cn}` ? Cn : t;
+}, Tn = (e) => {
 	let t = String(e?.stack ?? e), n = t.length <= 1200 ? t : `${t.slice(0, 1200)}…`, r = (e, t) => ({
 		reason: e.length <= 300 ? e : `${e.slice(0, 300)}…`,
 		unclassified: t,
 		raw: n
-	}), i = _(e), a = p(i), o = bn(i), s = o === void 0 ? "" : ` [${o}]`;
-	if (a !== void 0) return r(`${yn(a)}${s}`, !1);
-	let c = typeof i.dbMessage == "string" ? i.dbMessage : void 0, l = e?.message, u = Sn(typeof l == "string" && l.length > 0 ? l : String(e)), d = c !== void 0 && c !== u && !c.startsWith("SqlError:") ? c : u, f = typeof i.dbCauseChain == "string" ? i.dbCauseChain : void 0, m = f !== void 0 && /[←‖]/.test(f) ? ` (via ${f})` : "";
-	return r(d === xn || d.length === 0 ? `the database refused the write and the driver gave no detail${s}${m}` : `${d}${s}`, d === xn || d.length === 0);
-}, wn = (e) => Cn(e).reason, Tn = (e) => {
+	}), i = _(e), a = p(i), o = Sn(i), s = o === void 0 ? "" : ` [${o}]`;
+	if (a !== void 0) return r(`${xn(a)}${s}`, !1);
+	let c = typeof i.dbMessage == "string" ? i.dbMessage : void 0, l = e?.message, u = wn(typeof l == "string" && l.length > 0 ? l : String(e)), d = c !== void 0 && c !== u && !c.startsWith("SqlError:") ? c : u, f = typeof i.dbCauseChain == "string" ? i.dbCauseChain : void 0, m = f !== void 0 && /[←‖]/.test(f) ? ` (via ${f})` : "";
+	return r(d === Cn || d.length === 0 ? `the database refused the write and the driver gave no detail${s}${m}` : `${d}${s}`, d === Cn || d.length === 0);
+}, En = (e) => Tn(e).reason, Dn = (e) => {
 	let t = _(e), n = p(t);
 	if (n?.kind === "foreignKeyInUse") {
-		let e = n.constraint ?? n.column, r = e === void 0 ? "" : ` ${e}`, i = bn(t);
+		let e = n.constraint ?? n.column, r = e === void 0 ? "" : ` ${e}`, i = Sn(t);
 		return `foreign key${r}: rows elsewhere still reference this table${i === void 0 ? "" : ` [${i}]`}`;
 	}
-	return wn(e);
-}, En = "_voltro_staging_", X = (e) => `${En}${e}`, Dn = (e) => typeof e.run == "function", On = (e) => `staging is not available for this run — loading directly into the target instead: ${e}\n  The load therefore holds the destructive transaction open for its whole duration, so a
+	return En(e);
+}, On = "_voltro_staging_", X = (e) => `${On}${e}`, kn = (e) => typeof e.run == "function", An = (e) => `staging is not available for this run — loading directly into the target instead: ${e}\n  The load therefore holds the destructive transaction open for its whole duration, so a
   process that dies mid-load depends on the database rolling it back. The rollback capture
-  written before the first delete is what covers that case.`, kn = /^[a-zA-Z_][a-zA-Z0-9_]*$/, Z = (e, t) => {
-	if (!kn.test(e)) throw Error(`refusing to build SQL for the table name ${JSON.stringify(e)}: it is outside the identifier class the framework allows. A name from a bundle manifest reaches this concatenation, so it is checked here rather than assumed to still be what the declaration validated.`);
+  written before the first delete is what covers that case.`, jn = /^[a-zA-Z_][a-zA-Z0-9_]*$/, Z = (e, t) => {
+	if (!jn.test(e)) throw Error(`refusing to build SQL for the table name ${JSON.stringify(e)}: it is outside the identifier class the framework allows. A name from a bundle manifest reaches this concatenation, so it is checked here rather than assumed to still be what the declaration validated.`);
 	return t === "mysql" || t === "mariadb" ? `\`${e}\`` : t === "mssql" ? `[${e}]` : `"${e}"`;
-}, An = (e, t) => {
+}, Mn = (e, t) => {
 	let n = Z(e, t), r = Z(X(e), t);
 	switch (t) {
 		case "postgres": return `CREATE TABLE ${r} (LIKE ${n})`;
@@ -1002,10 +1005,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "sqlite": return `CREATE TABLE ${r} AS SELECT * FROM ${n} WHERE 0`;
 		case "mssql": return `SELECT * INTO ${r} FROM ${n} WHERE 1 = 0`;
 	}
-}, jn = (e, t) => {
+}, Nn = (e, t) => {
 	let n = Z(X(e), t);
 	return t === "mssql" ? `IF OBJECT_ID('${X(e)}', 'U') IS NOT NULL DROP TABLE ${n}` : `DROP TABLE IF EXISTS ${n}`;
-}, Mn = (e, t) => {
+}, Pn = (e, t) => {
 	let n = t === "mysql" || t === "mariadb", r = [];
 	n && r.push("SET FOREIGN_KEY_CHECKS = 0");
 	for (let n of [...e].reverse()) r.push(`DELETE FROM ${Z(n.name, t)}`);
@@ -1015,7 +1018,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		r.push(`INSERT INTO ${Z(n.name, t)} (${e}) SELECT ${e} FROM ${Z(X(n.name), t)}`);
 	}
 	return n && r.push("SET FOREIGN_KEY_CHECKS = 1"), r;
-}, Nn = (e, t) => {
+}, Fn = (e, t) => {
 	let n = [], r = () => {
 		for (let e of n) t.unregisterTable(e);
 	};
@@ -1037,7 +1040,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		staged: n,
 		undo: r
 	};
-}, Pn = (e, t) => {
+}, In = (e, t) => {
 	let n = new Set(t), r = [];
 	for (let t of e.tables) {
 		if (!n.has(t.name)) continue;
@@ -1054,22 +1057,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	}
 	return r;
-}, Fn = (e, t) => {
+}, Ln = (e, t) => {
 	let n = Z(X(e.from), t), r = Z(X(e.to), t), i = Z(e.column, t), a = Z(e.toColumn, t);
 	return `SELECT ${Z(e.primaryKey, t)} AS pk, ${i} AS value FROM ${n} c WHERE ${i} IS NOT NULL AND NOT EXISTS (SELECT 1 FROM ${r} p WHERE p.${a} = c.${i})`;
-}, In = (e) => {
+}, Rn = (e) => {
 	if (e.length === 0) return;
 	let t = e.slice(0, 20), n = t.map((e) => `    ${e.table}.${e.primaryKey}: ${e.column} = ${JSON.stringify(e.value)} — no such row in ${e.references}`);
 	return `the swap could not run: ${e.length} row(s) in the bundle reference a row the bundle does not carry.\n${n.join("\n")}\n` + (e.length > t.length ? `    … and ${e.length - t.length} more\n` : "") + "  The target is UNCHANGED — the swap runs in one transaction and none of it committed.\n  Every offending row is listed above rather than only the first, so this can be fixed in one pass.";
-}, Ln = async (e, t) => {
-	t.length !== 0 && await e.run(F.SqlClient.pipe(n.flatMap((e) => n.forEach(t, (t) => e.unsafe(t), { discard: !0 }))));
-}, Rn = async (e, t, r) => {
-	let i = Mn(t, r);
-	i.length !== 0 && await e.run(F.SqlClient.pipe(n.flatMap((e) => e.withTransaction(n.forEach(i, (t) => e.unsafe(t), { discard: !0 })))));
-}, zn = async (e, t, r) => {
+}, zn = async (e, t) => {
+	t.length !== 0 && await e.run(_e.SqlClient.pipe(n.flatMap((e) => n.forEach(t, (t) => e.unsafe(t), { discard: !0 }))));
+}, Bn = async (e, t, r) => {
+	let i = Pn(t, r);
+	i.length !== 0 && await e.run(_e.SqlClient.pipe(n.flatMap((e) => e.withTransaction(n.forEach(i, (t) => e.unsafe(t), { discard: !0 })))));
+}, Vn = async (e, t, r) => {
 	let i = [];
 	for (let a of t) {
-		let t = await e.run(F.SqlClient.pipe(n.flatMap((e) => e.unsafe(Fn(a, r)))));
+		let t = await e.run(_e.SqlClient.pipe(n.flatMap((e) => e.unsafe(Ln(a, r)))));
 		for (let e of t) i.push({
 			table: a.from,
 			primaryKey: String(e.pk ?? ""),
@@ -1079,14 +1082,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return i;
-}, Bn = (e, t) => {
+}, Hn = (e, t) => {
 	let n = new Map(t.map((e, t) => [e, t]));
 	return e.filter((e) => {
 		if (e.from === e.to) return !1;
 		let t = n.get(e.from), r = n.get(e.to);
 		return t === void 0 || r === void 0 ? !1 : r > t;
 	});
-}, Vn = (e) => e === "mysql" || e === "mariadb", Hn = (e) => {
+}, Un = (e) => e === "mysql" || e === "mariadb", Wn = (e) => {
 	if (e.mode !== "replace") return {
 		active: !1,
 		tables: [],
@@ -1136,7 +1139,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		tables: [],
 		blocker: "every table in the bundle is one that describes a deployment, so there is nothing for a staged swap to move."
 	};
-	let s = o.map((e) => e.name), c = Vn(t) ? [] : Bn(Pn(n, s), s);
+	let s = o.map((e) => e.name), c = Un(t) ? [] : Hn(In(n, s), s);
 	return c.length > 0 ? {
 		active: !1,
 		tables: [],
@@ -1145,7 +1148,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		active: !0,
 		tables: o
 	};
-}, Un = (e) => n.gen(function* () {
+}, Gn = (e) => n.gen(function* () {
 	if (e.mode !== "replace" || e.dir === void 0 || e.tables.length === 0) return;
 	if (e.snapshot === void 0) return yield* n.fail(new H({
 		reason: "rollback capture needs the TARGET's schema, and this run has none.\n  `--mode replace` empties the target first, so a run without a capture can leave it\n  emptied and unfilled if the process does not survive to roll back. Pass the target\n  snapshot, or `--no-rollback` to accept that risk deliberately.",
@@ -1158,7 +1161,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	if (t.tables.length === 0) return;
 	e.onWarn?.(`capturing the target's current rows before emptying it → ${e.dir}\n  This is what a failed replace is restored FROM. It is written before the first delete,
   so it survives a run whose process does not.`);
-	let r = yield* dn({
+	let r = yield* pn({
 		store: e.store,
 		snapshot: t,
 		dialect: e.dialect ?? "unknown",
@@ -1174,18 +1177,18 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		rows: r.tables.reduce((e, t) => e + t.rowCount, 0),
 		tables: r.tables.length
 	};
-}), Wn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, Gn = (e, t) => e.tables.find((e) => e.name === t), Kn = (e, t) => new Map((Gn(e, t)?.columns ?? []).map((e) => [e.name, e])), qn = /__dropped_\d+$/, Jn = (e, t) => {
+}), Kn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, qn = (e, t) => e.tables.find((e) => e.name === t), Jn = (e, t) => new Map((qn(e, t)?.columns ?? []).map((e) => [e.name, e])), Yn = /__dropped_\d+$/, Xn = (e, t) => {
 	let n = [];
 	for (let r of [...e.tables].sort((e, t) => e.name.localeCompare(t.name))) {
-		if (Gn(t, r.name) === void 0) {
+		if (qn(t, r.name) === void 0) {
 			n.push(`table '${r.name}' is in the bundle but MISSING from the target — its rows have nowhere to go`);
 			continue;
 		}
-		let e = Kn(t, r.name), i = new Map(r.columns.map((e) => [e.name, e]));
+		let e = Jn(t, r.name), i = new Map(r.columns.map((e) => [e.name, e]));
 		for (let [t, a] of i) {
 			let i = e.get(t);
 			if (i === void 0) {
-				n.push(qn.test(t) ? `${r.name}.${t}: a soft-dropped column, present only in the SOURCE — reclaim it there (voltro db gc-snapshots --before <date>) or re-export without it; the target is not missing anything` : `${r.name}.${t}: in the bundle, MISSING from the target — the value has nowhere to go`);
+				n.push(Yn.test(t) ? `${r.name}.${t}: a soft-dropped column, present only in the SOURCE — reclaim it there (voltro db gc-snapshots --before <date>) or re-export without it; the target is not missing anything` : `${r.name}.${t}: in the bundle, MISSING from the target — the value has nowhere to go`);
 				continue;
 			}
 			i.type !== a.type && n.push(`${r.name}.${t}: type '${a.type}' (bundle) vs '${i.type}' (target)`);
@@ -1193,7 +1196,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		for (let [t, a] of e) i.has(t) || !a.nullable && !a.hasDefault && n.push(`${r.name}.${t}: the target requires it (NOT NULL, no default) and the bundle carries no value — every row of this table would fail`);
 	}
 	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n;
-}, Yn = (e, t, n) => {
+}, Zn = (e, t, n) => {
 	let r = re(t);
 	if (r === e || n === void 0) return {
 		drifted: !1,
@@ -1201,14 +1204,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		targetFingerprint: r,
 		diff: []
 	};
-	let i = Jn(n, t);
+	let i = Xn(n, t);
 	return {
 		drifted: i.length > 0,
 		bundleFingerprint: e,
 		targetFingerprint: r,
 		diff: i
 	};
-}, Xn = 2e3, Zn = 200, Qn = /* @__PURE__ */ new Set([
+}, Qn = 2e3, $n = 200, er = /* @__PURE__ */ new Set([
 	"BundleError",
 	"CodecError",
 	"IntegrityError",
@@ -1217,29 +1220,29 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	"RowsRefusedError",
 	"SchemaDriftError",
 	"StorageError"
-]), $n = (t) => {
+]), tr = (t) => {
 	let n = o.isFiberFailure(t) ? [...e.failures(t[o.FiberFailureCauseId]), ...e.defects(t[o.FiberFailureCauseId])] : [t];
 	for (let e of n) {
 		let t = e?._tag;
-		if (typeof t == "string" && Qn.has(t)) return e;
+		if (typeof t == "string" && er.has(t)) return e;
 		if (o.isFiberFailure(e)) {
-			let t = $n(e);
+			let t = tr(e);
 			if (t) return t;
 		}
 	}
-}, er = (t) => [...e.failures(t)][0] ?? Error(e.pretty(t)), tr = (e) => n.tryPromise({
+}, nr = (t) => [...e.failures(t)][0] ?? Error(e.pretty(t)), rr = (e) => n.tryPromise({
 	try: async () => {
 		let t = await import("node:fs/promises"), n = await import("node:path");
-		return wt(await t.readFile(n.join(e, K), "utf8"));
+		return Et(await t.readFile(n.join(e, K), "utf8"));
 	},
 	catch: (e) => new H({
 		reason: `manifest read/parse failed: ${String(e?.message ?? e)}`,
 		path: K
 	})
-}), nr = (e) => {
+}), ir = (e) => {
 	let t;
 	return n.gen(function* () {
-		let i = yield* n.promise(() => import("node:path")), a = yield* tr(e.bundleDir);
+		let i = yield* n.promise(() => import("node:path")), a = yield* rr(e.bundleDir);
 		if (a.formatVersion !== 1) return yield* n.fail(new H({ reason: `unsupported bundle formatVersion ${a.formatVersion} (expected 1)` }));
 		if (e.tables !== void 0) {
 			let t = new Set(a.tables.map((e) => e.name)), r = e.tables.filter((e) => !t.has(e));
@@ -1260,9 +1263,9 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					unique: !1,
 					hasDefault: !1
 				}))
-			})) }, r = Yn(s.source.schemaFingerprint, e.targetSnapshot, t);
+			})) }, r = Zn(s.source.schemaFingerprint, e.targetSnapshot, t);
 			if (r.drifted) {
-				if (!e.force) return yield* n.fail(new Xe({
+				if (!e.force) return yield* n.fail(new Ze({
 					bundleFingerprint: r.bundleFingerprint,
 					targetFingerprint: r.targetFingerprint,
 					diff: r.diff
@@ -1271,15 +1274,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			}
 		}
 		if (e.targetDialect && e.targetDialect !== s.source.dialect) {
-			let t = _n(s.tables, s.source.dialect, e.targetDialect).filter((e) => e.severity === "block");
-			if (t.length > 0 && !e.allowIncompatible) return yield* n.fail(new $e({
+			let t = yn(s.tables, s.source.dialect, e.targetDialect).filter((e) => e.severity === "block");
+			if (t.length > 0 && !e.allowIncompatible) return yield* n.fail(new et({
 				sourceDialect: s.source.dialect,
 				targetDialect: e.targetDialect,
-				blocking: t.map(vn)
+				blocking: t.map(bn)
 			}));
 		}
-		let c = e.verify ?? !0, p = e.mode ?? "upsert", g = e.atomic ?? p === "replace", _ = e.onConflict ?? "skip", y = e.ledgerPath ?? i.join(e.bundleDir, ".import..ledger.json"), x = yield* Lt(y);
-		if (p === "replace" && s.scope.kind !== "all") return yield* n.fail(new Qe({
+		let c = e.verify ?? !0, p = e.mode ?? "upsert", g = e.atomic ?? p === "replace", _ = e.onConflict ?? "skip", y = e.ledgerPath ?? i.join(e.bundleDir, ".import..ledger.json"), x = yield* zt(y);
+		if (p === "replace" && s.scope.kind !== "all") return yield* n.fail(new $e({
 			mode: p,
 			reason: `replace refuses a partial bundle (scope='${s.scope.kind}') — truncating would delete rows not in the bundle. Use --mode upsert, or re-export with full scope. To leave specific tables out of a FULL export, use \`--exclude a,b\`: it keeps the scope \`all\` and records what it left out.`
 		}));
@@ -1291,8 +1294,8 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		if (p === "replace") {
 			let t = s.tables.map((e) => e.name), r = e.store.incomingForeignKeys ? yield* n.tryPromise({
 				try: () => e.store.incomingForeignKeys(t),
-				catch: (e) => new H({ reason: `foreign-key pre-flight failed: ${Tn(e)}` })
-			}) : e.targetSnapshot === void 0 ? [] : fn(e.targetSnapshot, t), i = [], a = /* @__PURE__ */ new Map();
+				catch: (e) => new H({ reason: `foreign-key pre-flight failed: ${Dn(e)}` })
+			}) : e.targetSnapshot === void 0 ? [] : mn(e.targetSnapshot, t), i = [], a = /* @__PURE__ */ new Map();
 			for (let t of r) {
 				if (!a.has(t.from)) {
 					let r = yield* n.tryPromise({
@@ -1314,9 +1317,9 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					rowCount: r
 				});
 			}
-			if (i.length > 0) return yield* n.fail(new Qe({
+			if (i.length > 0) return yield* n.fail(new $e({
 				mode: p,
-				reason: pn(i)
+				reason: hn(i)
 			}));
 		}
 		if (e.dryRun === !0) return e.traceId !== void 0 && (yield* n.promise(() => e.store.update(u, e.traceId, {
@@ -1343,15 +1346,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			let r;
 			for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
 			return r ?? t;
-		}, ie = (e, t, n, r = !1) => {
-			let i = A ? X(t.name) : t.name, a = t.primaryKey, o = re(t.name, n);
+		}, T = (e, t, n, r = !1) => {
+			let i = k ? X(t.name) : t.name, a = t.primaryKey, o = re(t.name, n);
 			return p === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : p === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
-		}, T = (e, t) => e.savepoint ? e.savepoint(t) : t(), E = 0, ae = (t, n, r) => {
-			r.unclassified && (E++, !(E > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (E === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, D = (e, t, r = !0) => n.tryPromise({
+		}, E = (e, t) => e.savepoint ? e.savepoint(t) : t(), D = 0, ie = (t, n, r) => {
+			r.unclassified && (D++, !(D > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (D === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
+		}, ae = (e, t, r = !0) => n.tryPromise({
 			try: e,
-			catch: (e) => Cn(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), oe = (e) => {
+			catch: (e) => Tn(e)
+		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ie(t.entry, t.row, e)), !1)))), oe = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
@@ -1375,7 +1378,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				};
 				t.refused++, e.derived || t.primary++, a.set(e.table, t);
 			}
-			return new Ye({
+			return new Xe({
 				rows: i.slice(0, 20),
 				primaryCount: r.filter((e) => !e.derived).length,
 				totalCount: e.length,
@@ -1390,33 +1393,33 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* D(() => T(e, () => ie(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* ae(() => E(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
 					let r = t[n], o = oe(r);
-					o !== void 0 && (yield* D(() => T(e, () => ie(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					o !== void 0 && (yield* ae(() => E(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* D(() => T(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			for (let t of i) (yield* ae(() => E(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
 			if (r.length > 0) return yield* n.fail(se(r));
 		}), O = (() => {
 			let t = e.targetDialect;
 			return t === "postgres" || t === "mysql" || t === "mariadb" || t === "sqlite" || t === "mssql" ? t : void 0;
-		})(), k = Hn({
+		})(), ue = Wn({
 			mode: p,
 			...e.targetDialect === void 0 ? {} : { targetDialect: e.targetDialect },
 			...e.targetSnapshot === void 0 ? {} : { targetSnapshot: e.targetSnapshot },
 			bundleTables: s.tables.map((e) => e.name),
 			isSkipped: V,
-			canRunSql: Dn(e.store)
-		}), ue = k.tables, de = s.tables.filter((e) => !V(e.name) && S(e.name)).map((e) => e.name), A = k.active, pe = !1, j = 0, M = 0, N, P = 0, me = 0, F = (t, r) => n.gen(function* () {
-			if (p === "replace" && !A && !(r && x.truncated)) {
+			canRunSql: kn(e.store)
+		}), de = ue.tables, fe = s.tables.filter((e) => !V(e.name) && S(e.name)).map((e) => e.name), k = ue.active, pe = !1, A = 0, j = 0, he, M = 0, N = 0, ge = (t, r) => n.gen(function* () {
+			if (p === "replace" && !k && !(r && x.truncated)) {
 				e.recordInterruption === !0 && (yield* n.tryPromise({
 					try: () => t.insert(d, {
-						id: m("repl", he),
-						startedAt: ge,
+						id: m("repl", _e),
+						startedAt: P,
 						tables: String(s.tables.length),
-						capture: I?.dir ?? null,
+						capture: F?.dir ?? null,
 						via: e.via ?? "direct"
 					}),
 					catch: (e) => new H({ reason: `could not record that this replace started: ${String(e?.message ?? e)}\n  The marker is what makes an interrupted run visible instead of silent, so the run does
@@ -1429,7 +1432,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				});
 				yield* n.tryPromise({
 					try: o,
-					catch: (e) => new H({ reason: `emptying the target for --mode replace failed (nothing was deleted): ${Tn(e)}` })
+					catch: (e) => new H({ reason: `emptying the target for --mode replace failed (nothing was deleted): ${Dn(e)}` })
 				}), r && (x.truncated = !0, yield* J(y, x));
 			}
 			let a = [], o = [], u = [], f = [], h = s.tables.length;
@@ -1440,7 +1443,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					continue;
 				}
 				if (r && m.name in x.tables) {
-					u.push(m.name), me++, P += x.tables[m.name].rowCount, q(e.onProgress, {
+					u.push(m.name), N++, M += x.tables[m.name].rowCount, q(e.onProgress, {
 						phase: "import",
 						table: m.name,
 						index: d,
@@ -1462,17 +1465,17 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					total: m.rowCount
 				});
 				let v = a.length, b = n.gen(function* () {
-					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = fe("bundle", () => le(_).pipe(_t(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
+					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = me("bundle", () => le(_).pipe(yt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
 						let n = {
 							entry: m,
 							row: e,
 							reason: ""
 						};
 						try {
-							await T(t, () => ie(t, m, e));
+							await E(t, () => T(t, m, e));
 						} catch (t) {
-							let r = Cn(t);
-							n.reason = r.reason, ae(m, e, r), a.push(n);
+							let r = Tn(t);
+							n.reason = r.reason, ie(m, e, r), a.push(n);
 						}
 					}, d = yield* n.promise(async () => {
 						let n = e.copyLoader;
@@ -1513,13 +1516,13 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 						S = [];
 						try {
 							await t.savepoint(async () => {
-								for (let n of e) await ie(t, m, n);
+								for (let n of e) await T(t, m, n);
 							});
 						} catch {
 							for (let t of e) await u(t);
 						}
 					};
-					return yield* l.runForEach(Qt(c, m.name, m.columnTypes), (e) => n.promise(async () => {
+					return yield* l.runForEach(en(c, m.name, m.columnTypes), (e) => n.promise(async () => {
 						if (o++, d) {
 							v.push(e), v.length >= h && await y();
 							return;
@@ -1533,14 +1536,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 						rowCount: o,
 						checksum: i.digest("hex")
 					};
-				}), { rowCount: S, checksum: C } = yield* Ft("import", m.name, d, h, (e) => e.rowCount, b);
+				}), { rowCount: S, checksum: C } = yield* Lt("import", m.name, d, h, (e) => e.rowCount, b);
 				if (c) {
-					if (C !== m.checksum) return yield* n.fail(new qe({
+					if (C !== m.checksum) return yield* n.fail(new Je({
 						what: `table ${m.name} checksum`,
 						expected: m.checksum,
 						actual: C
 					}));
-					if (S !== m.rowCount) return yield* n.fail(new qe({
+					if (S !== m.rowCount) return yield* n.fail(new Je({
 						what: `table ${m.name} rowCount`,
 						expected: String(m.rowCount),
 						actual: String(S)
@@ -1554,7 +1557,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					event: "done",
 					rowsDone: S,
 					total: m.rowCount
-				}), M++, j += S, N?.(), r && (a.length > v ? o.push({
+				}), j++, A += S, he?.(), r && (a.length > v ? o.push({
 					name: m.name,
 					rowCount: S
 				}) : (x.tables[m.name] = {
@@ -1565,7 +1568,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			if (a.length > 0 && (yield* ce(t, a)), p === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
 				column: "startedAt",
 				op: "lte",
-				value: ge
+				value: P
 			} }).then(() => void 0, () => void 0))), r && o.length > 0) {
 				for (let e of o) {
 					let t = s.tables.find((t) => t.name === e.name);
@@ -1577,14 +1580,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				yield* J(y, x);
 			}
 			{
-				let t = Ge(f, "skipped");
+				let t = Ke(f, "skipped");
 				t !== void 0 && e.onWarn?.(t);
 			}
 			if (u.length > 0) {
 				let t = u.length === s.tables.length;
 				e.onWarn?.(`resume: ${u.length} of ${s.tables.length} table(s) were already applied by an earlier run of THIS bundle directory, so this run wrote NO rows for them${t ? " — that is every table in the bundle, so nothing was written at all" : ""}. Tables: ${u.join(", ")}. Delete ${y} to force a full re-import.`);
 			}
-		}), he = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`, ge = /* @__PURE__ */ new Date(), I = yield* Un({
+		}), _e = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`, P = /* @__PURE__ */ new Date(), F = yield* Gn({
 			store: e.store,
 			mode: p,
 			dir: e.rollbackDir,
@@ -1593,15 +1596,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			tables: s.tables.map((e) => e.name).filter((e) => !V(e)),
 			onWarn: e.onWarn
 		});
-		I !== void 0 && (e.onRollbackCaptured !== void 0 && (yield* n.tryPromise({
-			try: () => e.onRollbackCaptured(I),
+		F !== void 0 && (e.onRollbackCaptured !== void 0 && (yield* n.tryPromise({
+			try: () => e.onRollbackCaptured(F),
 			catch: (e) => new H({
 				reason: `the rollback capture could not be stored durably, so the import did not start and the target is untouched: ${String(e?.message ?? e)}\n  The capture only helps if it outlives this process — that is the failure it exists for.`,
-				path: I.dir
+				path: F.dir
 			})
-		})), e.onWarn?.(Wn(I)));
-		let _e = (e) => p === "replace" ? ee(e) : e(), ve = (e) => p === "replace" ? te(e) : e, L = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), R = e.traceId !== void 0, ye = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
-		ye && h(f), ye && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(u, {
+		})), e.onWarn?.(Kn(F)));
+		let ve = (e) => p === "replace" ? ee(e) : e(), I = (e) => p === "replace" ? te(e) : e, L = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), ye = e.traceId !== void 0, R = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
+		R && h(f), R && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(u, {
 			id: L,
 			mode: p,
 			via: e.via ?? "direct",
@@ -1610,38 +1613,38 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			sourceFingerprint: s.source.schemaFingerprint ?? null,
 			tablesWritten: 0,
 			rowsWritten: 0,
-			staged: p === "replace" ? A : null
+			staged: p === "replace" ? k : null
 		}).then(() => {
-			R = !0;
+			ye = !0;
 		}, (t) => {
 			e.onWarn?.(`the import trace could not be written (${String(t?.message ?? t)}).\n  The import continues — this is a record of what happened, not a safety check. Run
   \`voltro db apply\` so the next one is recorded.`);
-		}))), e.traceId !== void 0 && ye && (yield* n.promise(() => e.store.update(u, L, {
-			staged: p === "replace" ? A : null,
+		}))), e.traceId !== void 0 && R && (yield* n.promise(() => e.store.update(u, L, {
+			staged: p === "replace" ? k : null,
 			sourceFingerprint: s.source.schemaFingerprint ?? null
 		}).then(() => void 0, () => void 0)));
 		let be = 0, xe = !1;
-		N = () => {
-			if (!R || xe) return;
+		he = () => {
+			if (!ye || xe) return;
 			let t = Date.now();
-			t - be < Xn || (be = t, e.store.update(u, L, {
-				tablesWritten: M,
-				rowsWritten: j
+			t - be < Qn || (be = t, e.store.update(u, L, {
+				tablesWritten: j,
+				rowsWritten: A
 			}).then(() => void 0, () => {
 				xe = !0;
 			}));
 		};
-		let Se = (t) => R ? e.store.update(u, L, {
+		let Se = (t) => ye ? e.store.update(u, L, {
 			finishedAt: t === null ? /* @__PURE__ */ new Date() : null,
-			tablesWritten: M,
-			rowsWritten: j,
+			tablesWritten: j,
+			rowsWritten: A,
 			failure: t
 		}).then(() => void 0, () => void 0) : Promise.resolve();
-		if (t = (e) => Se(e), p === "replace" && !A && k.blocker !== void 0 && e.onWarn?.(On(k.blocker)), p === "replace" && de.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${de.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
+		if (t = (e) => Se(e), p === "replace" && !k && ue.blocker !== void 0 && e.onWarn?.(An(ue.blocker)), p === "replace" && fe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${fe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
   something that did not happen — and this path already writes through the raw store, without
-  tenant scoping or \`audit()\` stamping, for the same reason.`), A) {
-			e.onWarn?.(`staging ${ue.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
-			let t = e.store, r = ue.map((e) => e.name), i = Nn(r, {
+  tenant scoping or \`audit()\` stamping, for the same reason.`), k) {
+			e.onWarn?.(`staging ${de.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
+			let t = e.store, r = de.map((e) => e.name), i = Fn(r, {
 				getTable: (e) => v(e),
 				registerTable: (e) => {
 					C(e);
@@ -1649,36 +1652,36 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				unregisterTable: ne
 			}), a = !1;
 			try {
-				let i = g ? r : r.filter((e) => !Rt(x, e));
+				let i = g ? r : r.filter((e) => !Bt(x, e));
 				yield* n.tryPromise({
 					try: async () => {
-						await Ln(t, i.map((e) => jn(e, O))), await Ln(t, i.map((e) => An(e, O)));
+						await zn(t, i.map((e) => Nn(e, O))), await zn(t, i.map((e) => Mn(e, O)));
 					},
 					catch: (e) => new H({ reason: `could not prepare the staging tables, so the import did not start and the target is untouched: ${String(e?.message ?? e)}` })
-				}), yield* ve(F(e.store, !g)), !g && x.truncated === !0 ? a = !0 : yield* n.tryPromise({
-					try: () => Rn(t, ue, O).then(() => {
+				}), yield* I(ge(e.store, !g)), !g && x.truncated === !0 ? a = !0 : yield* n.tryPromise({
+					try: () => Bn(t, de, O).then(() => {
 						a = !0;
 					}),
 					catch: (e) => new H({ reason: String(e?.message ?? e) })
 				}).pipe(n.catchAll((i) => n.gen(function* () {
-					let a = In(yield* n.promise(() => zn(t, Pn(e.targetSnapshot, r), O).then((e) => e, () => [])));
+					let a = Rn(yield* n.promise(() => Vn(t, In(e.targetSnapshot, r), O).then((e) => e, () => [])));
 					return yield* n.fail(new H({ reason: a ?? `the swap failed and the target is UNCHANGED: ${i.reason}` }));
 				}))), !g && a && x.truncated !== !0 && (x.truncated = !0, yield* J(y, x));
 			} finally {
-				i.undo(), a || g ? yield* n.promise(() => Ln(t, r.map((e) => jn(e, O))).then(() => void 0, () => void 0)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
+				i.undo(), a || g ? yield* n.promise(() => zn(t, r.map((e) => Nn(e, O))).then(() => void 0, () => void 0)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
 			}
 		} else g ? yield* n.tryPromise({
 			try: () => e.store.transactional(async (e) => {
-				let t = await _e(() => n.runPromiseExit(F(e, !1)));
-				if (r.isFailure(t)) throw er(t.cause);
+				let t = await ve(() => n.runPromiseExit(ge(e, !1)));
+				if (r.isFailure(t)) throw nr(t.cause);
 			}),
-			catch: (e) => $n(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
-		}) : yield* ve(F(e.store, !0));
+			catch: (e) => tr(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
+		}) : yield* I(ge(e.store, !0));
 		if (e.assets && s.assets.index && !e.assetsAlreadyRestored) {
 			let t = e.assets;
-			yield* ft({
+			yield* mt({
 				sink: t,
-				assetsDir: i.join(e.bundleDir, Dt),
+				assetsDir: i.join(e.bundleDir, kt),
 				indexPath: i.join(e.bundleDir, s.assets.index ?? "assets/index.ndjson"),
 				progress: {
 					done: (e) => e in x.assets,
@@ -1688,26 +1691,26 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 		return yield* n.promise(() => Se(null)), {
 			manifest: s,
-			tablesWritten: M,
-			rowsWritten: j,
-			tablesSkipped: me,
-			rowsSkipped: P,
-			fullyResumed: M === 0 && me > 0,
-			...I === void 0 ? {} : { rollback: I }
+			tablesWritten: j,
+			rowsWritten: A,
+			tablesSkipped: N,
+			rowsSkipped: M,
+			fullyResumed: j === 0 && N > 0,
+			...F === void 0 ? {} : { rollback: F }
 		};
 	}).pipe(n.tapError((e) => n.promise(() => t?.(e?.reason ?? e?._tag ?? "the import did not finish") ?? Promise.resolve())));
-}, rr = (e) => e, ir = (e) => {
+}, ar = (e) => e, or = (e) => {
 	if (e.allowLive || e.liveInstance === null || e.sameTarget === "different") return { refuse: !1 };
 	let t = e.targetLabel === void 0 ? "" : ` Target: ${e.targetLabel}.`, n = e.sameTarget === "same" ? " That instance is connected to the SAME database." : " We could not confirm which database that instance is connected to, so this is refused on the conservative reading — an older instance, or one whose connection could not be parsed, reports nothing to compare.";
 	return {
 		refuse: !0,
 		message: `refusing to write into a target with a LIVE instance (${e.liveInstance}).${t}${n} A direct import is an uncoordinated concurrent writer — readers see partial state, the reactive layer either storms or goes stale, and rows race with live writes. Re-run with --allow-live to override, or use a live-safe strategy (shadow-swap for replace, or the api target).`
 	};
-}, Q = Buffer.from("VBUNDLE2"), ar = 0, or = 1, sr = 2, cr = 32, lr = async (e) => {
+}, Q = Buffer.from("VBUNDLE2"), sr = 0, cr = 1, lr = 2, ur = 32, dr = async (e) => {
 	let t = [], n = async (r) => {
 		let i;
 		try {
-			i = await ge(R(e, r), { withFileTypes: !0 });
+			i = await F(R(e, r), { withFileTypes: !0 });
 		} catch {
 			return;
 		}
@@ -1717,22 +1720,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	};
 	return await n(""), t.sort();
-}, ur = (e, t) => {
+}, fr = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.alloc(5 + n.length + 8);
-	return r.writeUInt8(or, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
-}, dr = (e, t, n) => {
+	return r.writeUInt8(cr, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
+}, pr = (e, t, n) => {
 	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8"), a = Buffer.alloc(5 + r.length + 2 + i.length + 8), o = 0;
-	return a.writeUInt8(sr, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
+	return a.writeUInt8(lr, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
 };
-async function* fr(e) {
+async function* mr(e) {
 	yield new Uint8Array(Q);
-	for (let t of await lr(e.dir)) {
-		let n = R(e.dir, t), r = await I(n);
-		if (yield new Uint8Array(ur(t, r.size)), r.size > 0) for await (let e of le(n)) yield new Uint8Array(e);
+	for (let t of await dr(e.dir)) {
+		let n = R(e.dir, t), r = await ve(n);
+		if (yield new Uint8Array(fr(t, r.size)), r.size > 0) for await (let e of le(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
-		yield new Uint8Array(dr(t.key, t.contentType, t.size));
-		let n = E("sha256"), r = 0;
+		yield new Uint8Array(pr(t.key, t.contentType, t.size));
+		let n = D("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
 			n.update(e), r += e.length, yield new Uint8Array(e);
@@ -1740,11 +1743,11 @@ async function* fr(e) {
 		if (r !== t.size) throw Error(`blob '${t.key}' size mismatch: header ${t.size}, streamed ${r}`);
 		yield new Uint8Array(n.digest());
 	}
-	yield new Uint8Array(Buffer.from([ar]));
+	yield new Uint8Array(Buffer.from([sr]));
 }
-var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr = (e) => new Promise((t) => e.end(t)), hr = async (e, t) => {
-	let n = ye(t.dir);
-	await he(n, { recursive: !0 });
+var hr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), gr = (e) => new Promise((t) => e.end(t)), _r = async (e, t) => {
+	let n = be(t.dir);
+	await P(n, { recursive: !0 });
 	let r = Buffer.alloc(0), i = e[Symbol.asyncIterator](), a = !1, o = async () => {
 		let { value: e, done: t } = await i.next();
 		return t ? (a = !0, !1) : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
@@ -1759,24 +1762,24 @@ var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr
 		for (;;) {
 			await s(1);
 			let e = c(1).readUInt8(0);
-			if (e === ar) return;
-			if (e === or) {
+			if (e === sr) return;
+			if (e === cr) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
 				let t = c(e).toString("utf8");
 				await s(8);
-				let i = c(8).readBigUInt64BE(0), a = ye(n, t);
-				if (a !== n && !a.startsWith(n + be)) throw Error(`archive path '${t}' escapes the destination`);
-				await he(L(a), { recursive: !0 });
+				let i = c(8).readBigUInt64BE(0), a = be(n, t);
+				if (a !== n && !a.startsWith(n + xe)) throw Error(`archive path '${t}' escapes the destination`);
+				await P(ye(a), { recursive: !0 });
 				let o = O(a);
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
-					await pr(o, c(e)), i -= BigInt(e);
+					await hr(o, c(e)), i -= BigInt(e);
 				}
-				await mr(o);
-			} else if (e === sr) {
+				await gr(o);
+			} else if (e === lr) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
@@ -1786,24 +1789,24 @@ var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = E("sha256"), d = new P(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = D("sha256"), d = new N(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
 				for (; p > 0n;) {
 					r.length === 0 && await s(1);
 					let e = p < BigInt(r.length) ? Number(p) : r.length, t = c(e);
-					u.update(t), l || await pr(d, t), p -= BigInt(e);
+					u.update(t), l || await hr(d, t), p -= BigInt(e);
 				}
-				l ? d.destroy() : await mr(d), await f, await s(cr);
-				let m = c(cr);
+				l ? d.destroy() : await gr(d), await f, await s(ur);
+				let m = c(ur);
 				if (!u.digest().equals(m)) throw Error(`blob '${n}' failed integrity (sha mismatch)`);
 			} else throw Error(`unknown bundle entry kind ${e}`);
 		}
 	} finally {
 		a || await Promise.resolve(i.return?.()).catch(() => void 0);
 	}
-}, gr = async (e, t) => {
+}, vr = async (e, t) => {
 	let n = new Set(t), r = /* @__PURE__ */ new Map(), i = Buffer.alloc(0), a = e[Symbol.asyncIterator](), o = async () => {
 		let { value: e, done: t } = await a.next();
 		return !t && (i = i.length === 0 ? Buffer.from(e) : Buffer.concat([i, Buffer.from(e)]), !0);
@@ -1825,8 +1828,8 @@ var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr
 	if (!await s(Q.length) || !c(Q.length).equals(Q)) throw Error("not a bundle archive (bad magic)");
 	for (; await s(1);) {
 		let e = c(1).readUInt8(0);
-		if (e === ar || e === sr) break;
-		if (e !== or) throw Error(`unknown bundle entry kind ${e}`);
+		if (e === sr || e === lr) break;
+		if (e !== cr) throw Error(`unknown bundle entry kind ${e}`);
 		if (!await s(4)) break;
 		let t = c(4).readUInt32BE(0);
 		if (!await s(t)) break;
@@ -1836,17 +1839,17 @@ var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr
 		if (a === null || n.has(i) && (r.set(i, a), n.delete(i), n.size === 0)) break;
 	}
 	return r;
-}, _r = (e, t) => hr(e, {
+}, yr = (e, t) => _r(e, {
 	dir: t,
-	blobs: vr(t)
-}), vr = (e) => {
+	blobs: br(t)
+}), br = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	return {
 		has: async (e) => t.has(e),
 		write: async (n, r, i) => {
 			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = R(e, "assets");
-			await he(c, { recursive: !0 });
-			let l = E("sha256"), u = 0, d = new s({ transform(e, t, n) {
+			await P(c, { recursive: !0 });
+			let l = D("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
 			} }), f = R(c, `.tmp-${Date.now()}-${t.size}`);
 			await o(r, d, O(f));
@@ -1859,33 +1862,33 @@ var pr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), mr
 			})}\n`), t.add(n);
 		}
 	};
-}, yr = xe(se), br = Buffer.from("VENC1\0\0\0"), xr = 32, Sr = 16, Cr = 7, wr = 16, Tr = 262144, Er = {
+}, xr = Se(se), Sr = Buffer.from("VENC1\0\0\0"), Cr = 32, wr = 16, Tr = 7, Er = 16, Dr = 262144, Or = {
 	N: 32768,
 	r: 8,
 	p: 1
-}, Dr = 134217728, Or = 43, kr = (e, t, n) => {
+}, kr = 134217728, Ar = 43, jr = (e, t, n) => {
 	let r = Buffer.alloc(12);
-	return e.copy(r, 0, 0, Cr), r.writeUInt32BE(t >>> 0, Cr), r.writeUInt8(+!!n, 11), r;
+	return e.copy(r, 0, 0, Tr), r.writeUInt32BE(t >>> 0, Tr), r.writeUInt8(+!!n, 11), r;
 };
-async function* Ar(e, t) {
+async function* Mr(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = D(Sr), r = D(Cr), i = await yr(t, n, xr, {
-		...Er,
-		maxmem: Dr
-	}), a = Buffer.alloc(Or);
-	br.copy(a, 0), a.writeUInt32BE(Er.N, 8), a.writeUInt32BE(Er.r, 12), a.writeUInt32BE(Er.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
+	let n = ae(wr), r = ae(Tr), i = await xr(t, n, Cr, {
+		...Or,
+		maxmem: kr
+	}), a = Buffer.alloc(Ar);
+	Sr.copy(a, 0), a.writeUInt32BE(Or.N, 8), a.writeUInt32BE(Or.r, 12), a.writeUInt32BE(Or.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = ie("aes-256-gcm", i, kr(r, o, t));
+		let n = T("aes-256-gcm", i, jr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
-		let l = Buffer.alloc(5 + s.length + wr);
-		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + wr, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
+		let l = Buffer.alloc(5 + s.length + Er);
+		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + Er, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
 	}, c = Buffer.alloc(0);
-	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > Tr;) yield s(c.subarray(0, Tr), !1), c = c.subarray(Tr);
+	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > Dr;) yield s(c.subarray(0, Dr), !1), c = c.subarray(Dr);
 	yield s(c, !0);
 }
-async function* jr(e, t) {
+async function* Nr(e, t) {
 	if (!t) throw Error("decryptStream: a non-empty passphrase is required");
 	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = !1, a = async () => {
 		let { value: e, done: t } = await n.next();
@@ -1894,16 +1897,16 @@ async function* jr(e, t) {
 		for (; r.length < e && !i && await a(););
 		return r.length >= e;
 	};
-	if (!await o(Or)) throw Error("encrypted bundle truncated (no header)");
-	let s = r.subarray(0, Or);
-	if (!s.subarray(0, 8).equals(br)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
-	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Or)), p = await yr(t, d, xr, {
+	if (!await o(Ar)) throw Error("encrypted bundle truncated (no header)");
+	let s = r.subarray(0, Ar);
+	if (!s.subarray(0, 8).equals(Sr)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
+	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Ar)), p = await xr(t, d, Cr, {
 		N: c,
 		r: l,
 		p: u,
-		maxmem: Dr
+		maxmem: kr
 	});
-	r = r.subarray(Or);
+	r = r.subarray(Ar);
 	let m = 0, h = !1;
 	for (;;) {
 		if (!await o(5)) {
@@ -1912,11 +1915,11 @@ async function* jr(e, t) {
 		}
 		if (h) throw Error("encrypted bundle has trailing data after the final frame");
 		let e = r.readUInt8(0) === 1, t = r.readUInt32BE(1);
-		if (t < wr) throw Error("encrypted bundle corrupt (short frame)");
+		if (t < Er) throw Error("encrypted bundle corrupt (short frame)");
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
-		let n = r.subarray(5, 5 + t - wr), i = r.subarray(5 + t - wr, 5 + t);
+		let n = r.subarray(5, 5 + t - Er), i = r.subarray(5 + t - Er, 5 + t);
 		r = r.subarray(5 + t);
-		let a = T("aes-256-gcm", p, kr(f, m, e));
+		let a = E("aes-256-gcm", p, jr(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -1924,7 +1927,7 @@ async function* jr(e, t) {
 }
 //#endregion
 //#region src/blobStorage.ts
-var Mr = (e, t) => ({
+var Pr = (e, t) => ({
 	list: () => {
 		let e = t();
 		return { async *[Symbol.asyncIterator]() {
@@ -1937,32 +1940,32 @@ var Mr = (e, t) => ({
 		} };
 	},
 	open: (t) => ({ async *[Symbol.asyncIterator]() {
-		let r = await n.runPromise(pe(e, t)), i = await M(r.stream);
+		let r = await n.runPromise(A(e, t)), i = await he(r.stream);
 		for await (let e of i) yield e instanceof Uint8Array ? e : new Uint8Array(e);
 	} })
-}), Nr = (e, t) => Mr(e, () => w(t, {
-	table: A,
+}), Fr = (e, t) => Pr(e, () => w(t, {
+	table: pe,
 	chunkSize: 500
 }).pipe(l.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-})))), Pr = (e) => ({
+})))), Ir = (e) => ({
 	has: (t) => n.runPromise(e.head(t).pipe(n.map((e) => e !== null))),
 	write: async (t, r, i) => {
-		let a = fe("storage", () => me.from(r));
+		let a = me("storage", () => ge.from(r));
 		await n.runPromise(j(e, t, a, {
 			contentType: i.contentType,
 			totalSize: i.size
 		}));
 	}
-}), Fr = (e, t) => {
+}), Lr = (e, t) => {
 	let n = t === "dump" ? "mariadb-dump" : "mariadb", r = t === "dump" ? "mysqldump" : "mysql";
-	return e === "mariadb" ? Ir(n) ? { tool: n } : {
+	return e === "mariadb" ? Rr(n) ? { tool: n } : {
 		tool: r,
-		hint: `'${n}' is not on PATH, so this ran '${r}' instead. If that binary came from Oracle's MySQL client it queries information_schema.COLUMN_STATISTICS, which MariaDB does not have, and the run dies with error 1109 after the first table. Install the MariaDB client package (which ships '${n}') and re-run. Do NOT reach for --column-statistics=0: that flag does not exist on '${n}', so it fixes the wrong client and breaks the right one.`
+		hint: `'${n}' is not on PATH, so this ran '${r}' instead. If that binary came from Oracle's MySQL client it queries information_schema.COLUMN_STATISTICS, which MariaDB does not have, and the run dies with error 1109 after the first table. Install the MariaDB client package (which ships '${n}') and re-run. Do NOT reach for --column-statistics=0: that flag does not exist on '${n}', so it fixes the wrong client and breaks the right one. Note: a MariaDB 12.x client requires TLS by default, so running '${n}' BY HAND against a server without it fails with "TLS/SSL error: SSL is required" (2026) and needs --skip-ssl. This command is not affected.`
 	} : { tool: r };
-}, Ir = (e) => (process.env.PATH ?? "").split(ve).filter((e) => e !== "").some((t) => k(R(t, e))), Lr = (e) => {
+}, Rr = (e) => (process.env.PATH ?? "").split(L).filter((e) => e !== "").some((t) => ue(R(t, e))), zr = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -1972,7 +1975,7 @@ var Mr = (e, t) => ({
 		case "mssql": return "db.bacpac";
 		default: return "db.dump";
 	}
-}, Rr = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
+}, Br = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), $ = (e) => {
 	if (e.host || e.database) return {
 		host: e.host ?? "localhost",
 		port: e.port ?? 3306,
@@ -1988,7 +1991,7 @@ var Mr = (e, t) => ({
 		password: decodeURIComponent(t.password) || "",
 		database: t.pathname.replace(/^\//, "") || ""
 	};
-}, zr = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Br = (e, t, n) => {
+}, Vr = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Hr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -1998,6 +2001,7 @@ var Mr = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
+					...Ur,
 					"--dbname",
 					t.url,
 					"--file",
@@ -2016,6 +2020,7 @@ var Mr = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
+					...Ur,
 					"-h",
 					e.host,
 					"-p",
@@ -2035,13 +2040,14 @@ var Mr = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				...Fr(e, "dump"),
+				...Lr(e, "dump"),
 				args: [
 					"--single-transaction",
 					"--routines",
 					"--triggers",
 					"--no-tablespaces",
 					"--protocol=TCP",
+					`--ignore-table=${r.database}.${d}`,
 					"-h",
 					r.host,
 					"-P",
@@ -2057,7 +2063,7 @@ var Mr = (e, t) => ({
 		case "sqlite":
 		case "turso": return {
 			kind: "copy",
-			from: Rr(t),
+			from: Br(t),
 			to: n
 		};
 		case "mssql": return {
@@ -2065,7 +2071,7 @@ var Mr = (e, t) => ({
 			tool: "sqlpackage",
 			args: [
 				"/Action:Export",
-				`/SourceConnectionString:${zr($({
+				`/SourceConnectionString:${Vr($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -2078,7 +2084,7 @@ var Mr = (e, t) => ({
 			reason: `no native backup for dialect '${e}'`
 		});
 	}
-}, Vr = (e, t, n) => {
+}, Ur = ["--exclude-table", d], Wr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -2123,7 +2129,7 @@ var Mr = (e, t) => ({
 			let r = $(t);
 			return {
 				kind: "spawn",
-				...Fr(e, "client"),
+				...Lr(e, "client"),
 				args: [
 					"--protocol=TCP",
 					"-h",
@@ -2142,14 +2148,14 @@ var Mr = (e, t) => ({
 		case "turso": return {
 			kind: "copy",
 			from: n,
-			to: Rr(t)
+			to: Br(t)
 		};
 		case "mssql": return {
 			kind: "spawn",
 			tool: "sqlpackage",
 			args: [
 				"/Action:Import",
-				`/TargetConnectionString:${zr($({
+				`/TargetConnectionString:${Vr($({
 					...t,
 					port: t.port ?? 1433
 				}))}`,
@@ -2162,10 +2168,10 @@ var Mr = (e, t) => ({
 			reason: `no native restore for dialect '${e}'`
 		});
 	}
-}, Hr = (e) => e.kind === "copy" ? n.async((t) => {
+}, Gr = (e) => e.kind === "copy" ? n.async((t) => {
 	let r = `${e.to}.restoring-${oe()}`, i = (e) => {
 		try {
-			de(r);
+			k(r);
 		} catch {}
 		t(n.fail(new W({
 			tool: "copy",
@@ -2177,7 +2183,7 @@ var Mr = (e, t) => ({
 			i(`copy ${e.from} → ${e.to}: ${a.message}`);
 			return;
 		}
-		ue(r, e.to, (r) => {
+		de(r, e.to, (r) => {
 			if (r) {
 				i(`copy ${e.from} → ${e.to}: ${r.message}`);
 				return;
@@ -2186,7 +2192,7 @@ var Mr = (e, t) => ({
 		});
 	});
 }) : n.async((t) => {
-	let r = Se(e.tool, [...e.args], {
+	let r = Ce(e.tool, [...e.args], {
 		env: {
 			...process.env,
 			...e.env
@@ -2199,35 +2205,63 @@ var Mr = (e, t) => ({
 	}), i = "";
 	r.stderr?.on("data", (e) => {
 		i += String(e);
-	}), e.stdoutFile && r.stdout && r.stdout.pipe(O(e.stdoutFile)), e.stdinFile && r.stdin && le(e.stdinFile).pipe(r.stdin);
-	let a = () => {
+	});
+	let a = !1, o = (e) => {
+		a || (a = !0, t(e));
+	}, s, c = (e) => {
+		s ??= e;
+	};
+	if (e.stdoutFile && r.stdout) {
+		let t = O(e.stdoutFile);
+		t.on("error", (t) => c(`writing ${I(e.stdoutFile)}: ${t.message}`)), r.stdout.on("error", (e) => c(`reading the tool's output: ${e.message}`)), r.stdout.pipe(t);
+	}
+	let l = 0;
+	if (e.stdinFile && r.stdin) {
+		let t = le(e.stdinFile);
+		t.on("data", (e) => {
+			l += e.length;
+		}), t.on("error", (t) => {
+			c(`reading ${I(e.stdinFile)}: ${t.message}`), r.stdin?.end();
+		}), r.stdin.on("error", (t) => {
+			t.code !== "EPIPE" && c(`feeding ${I(e.stdinFile)} to ${e.tool}: ${t.message}`);
+		}), t.pipe(r.stdin);
+	}
+	let u = () => {
 		if (e.stdoutFile !== void 0) try {
-			de(e.stdoutFile);
+			k(e.stdoutFile);
 		} catch {}
 	};
-	r.on("error", (r) => {
-		a(), t(n.fail(new W({
+	r.on("error", (t) => {
+		u(), o(n.fail(new W({
 			tool: e.tool,
-			reason: `failed to launch (is '${e.tool}' installed + on PATH?): ${r.message}`,
+			reason: `failed to launch (is '${e.tool}' installed + on PATH?): ${t.message}`,
 			...e.hint === void 0 ? {} : { hint: e.hint }
 		})));
-	}), r.on("close", (r) => {
-		if (r === 0) {
-			t(n.void);
+	}), r.on("close", (t) => {
+		if (t === 0 && s === void 0) {
+			o(n.void);
 			return;
 		}
-		a(), t(n.fail(new W({
+		u();
+		let r = e.stdinFile === void 0 ? "" : ` — ${l} of ${Kr(e.stdinFile)} byte(s) of ${I(e.stdinFile)} had been fed to it`;
+		o(n.fail(new W({
 			tool: e.tool,
-			reason: `exited with code ${r}` + (e.stdoutFile === void 0 ? "" : ` — the partial ${_e(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
-			stderr: i.slice(-2e3),
+			reason: (t === 0 ? `exited cleanly, but ${s}` : `exited with code ${t}${s === void 0 ? "" : ` (${s})`}`) + r + (e.stdoutFile === void 0 ? "" : ` — the partial ${I(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
+			stderr: i.trim() === "" ? `(${e.tool} printed nothing to stderr)` : i.slice(-2e3),
 			...e.hint === void 0 ? {} : { hint: e.hint }
 		})));
 	});
-}), Ur = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Wr = (e) => n.gen(function* () {
-	let t = yield* it(e.scope ?? { kind: "all" }, e.snapshot, {
+}), Kr = (e) => {
+	try {
+		return String(fe(e).size);
+	} catch {
+		return "?";
+	}
+}, qr = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Jr = (e) => n.gen(function* () {
+	let t = yield* at(e.scope ?? { kind: "all" }, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
-	}), r = $t(t.tables, e.snapshot), i = e.classification ?? Te(e.snapshot), a = e.sampleSize ?? 20, o = Re(r.map((t) => ({
+	}), r = tn(t.tables, e.snapshot), i = e.classification ?? Ee(e.snapshot), a = e.sampleSize ?? 20, o = ze(r.map((t) => ({
 		name: t,
 		columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 			name: e.name,
@@ -2239,15 +2273,15 @@ var Mr = (e, t) => ({
 			table: i,
 			chunkSize: a,
 			...r === void 0 ? {} : { where: r }
-		}).pipe(l.take(a), l.runCollect, n.map((e) => [...e])), d = u.map((t) => Ve(t, i, o.actions, e.masking.seed));
-		c.push(...Be(d, i, o.actions));
+		}).pipe(l.take(a), l.runCollect, n.map((e) => [...e])), d = u.map((t) => He(t, i, o.actions, e.masking.seed));
+		c.push(...Ve(d, i, o.actions));
 		let f = u[0], p = d[0], m = [];
 		if (f && p) for (let [e, t] of Object.entries(o.actions)) {
 			if (!e.startsWith(`${i}.`) || t === "keep") continue;
 			let n = e.slice(i.length + 1);
 			m.push({
 				column: n,
-				action: Ur(t),
+				action: qr(t),
 				before: f[n],
 				after: p[n]
 			});
@@ -2262,7 +2296,7 @@ var Mr = (e, t) => ({
 		leaks: c,
 		unclassified: o.unclassified
 	};
-}), Gr = (e, t) => {
+}), Yr = (e, t) => {
 	let n = new Map(t.map((e) => [e.name, e])), r = [], i = {};
 	for (let t of e) {
 		let e = n.get(t.name);
@@ -2317,7 +2351,7 @@ var Mr = (e, t) => ({
 		skipColumns: i,
 		refuse: r.some((e) => e.verdict === "refuse")
 	};
-}, Kr = (e) => {
+}, Xr = (e) => {
 	if (e.findings.length === 0) return ["  schema matches the bundle"];
 	let t = {
 		safe: "✓",
@@ -2328,4 +2362,4 @@ var Mr = (e, t) => ({
 	return n.push(""), n.push(`  discarded: ${r("value-dropped")}   defaulted: ${r("filled-by-default")}   refused: ${r("refuse")}`), e.refuse && (n.push(""), n.push("  REFUSED — no row was written. These are the differences that would make"), n.push("  imported rows WRONG rather than merely incomplete.")), n;
 };
 //#endregion
-export { Dt as ASSETS_DIR, Ot as ASSET_INDEX_FILE, H as BundleError, Ke as CodecError, Je as CompressionError, $e as CrossDialectError, Et as DATA_DIR, we as DEFAULT_CLASS_ACTIONS, He as ENVIRONMENT_LOCAL_TABLES, Ue as ENVIRONMENT_PORTABLE_TABLES, vt as FORMAT_VERSION, Qe as ImportModeError, qe as IntegrityError, kt as LEDGER_FILE, K as MANIFEST_FILE, Ze as MaskingError, W as NativeToolError, Ye as RowsRefusedError, Zn as SAVEPOINT_BATCH_SIZE, En as STAGING_PREFIX, Xe as SchemaDriftError, U as ScopeError, Ie as applyAction, $n as asImportError, ir as assessLiveImport, zt as assetDone, Lr as backupArtifactName, Br as backupCommand, mn as canonicalType, ut as captureAssetsToCas, _n as checkPortability, Yn as checkSchemaDrift, Te as classificationFromSnapshot, Gr as classifyImportDrift, ht as compressionExt, tt as computeSubsetIds, Hn as decideStaging, wt as decodeManifest, Yt as decodeRow, qt as decodeValue, jr as decryptStream, rr as defineDataProfile, Jn as diffSnapshots, vr as dirBlobSink, jn as dropStagingSql, It as emptyLedger, Ct as encodeManifest, Jt as encodeRow, Gt as encodeValue, Ar as encryptStream, Ge as environmentLocalNotice, We as environmentLocalReason, Ln as execStatements, Kr as formatImportDrift, vn as formatIssue, pt as hasZstd, V as isEnvironmentLocal, gt as makeCompressor, _t as makeDecompressor, Ve as maskRow, Qt as ndjsonToRows, lt as noAssetProgress, pn as outsideReferenceRefusal, fn as outsideReferencesInto, fr as packBundle, gr as peekBundle, mt as pickCompression, Re as planMasking, Wr as previewMasking, dt as readAssetIndex, Lt as readLedger, Ee as resolveAction, it as resolveScope, ct as restoreAssetFromCas, ft as restoreAssetsFromCas, Vr as restoreCommand, Zt as rowsToNdjson, dn as runExport, nr as runImport, Hr as runNativeStep, Be as scanForLeaks, X as stagingNameFor, ot as storageAssetSink, at as storageAssetSource, Pr as storageBlobSink, Mr as storageBlobSource, Nr as storageRefsBlobSource, nt as subsetToScope, Rt as tableDone, $t as topoSortTables, hr as unpackBundle, _r as unpackBundleToDir, st as writeAssetToCas, J as writeLedger };
+export { kt as ASSETS_DIR, At as ASSET_INDEX_FILE, H as BundleError, qe as CodecError, Ye as CompressionError, et as CrossDialectError, Ot as DATA_DIR, Te as DEFAULT_CLASS_ACTIONS, Ue as ENVIRONMENT_LOCAL_TABLES, We as ENVIRONMENT_PORTABLE_TABLES, bt as FORMAT_VERSION, $e as ImportModeError, Je as IntegrityError, jt as LEDGER_FILE, K as MANIFEST_FILE, Qe as MaskingError, W as NativeToolError, Xe as RowsRefusedError, $n as SAVEPOINT_BATCH_SIZE, On as STAGING_PREFIX, Ze as SchemaDriftError, U as ScopeError, Le as applyAction, tr as asImportError, or as assessLiveImport, Vt as assetDone, zr as backupArtifactName, Hr as backupCommand, gn as canonicalType, ft as captureAssetsToCas, yn as checkPortability, Zn as checkSchemaDrift, Ee as classificationFromSnapshot, Yr as classifyImportDrift, _t as compressionExt, nt as computeSubsetIds, Wn as decideStaging, Et as decodeManifest, Zt as decodeRow, Yt as decodeValue, Nr as decryptStream, ar as defineDataProfile, Xn as diffSnapshots, br as dirBlobSink, Nn as dropStagingSql, Rt as emptyLedger, Tt as encodeManifest, Xt as encodeRow, qt as encodeValue, Mr as encryptStream, Ke as environmentLocalNotice, Ge as environmentLocalReason, zn as execStatements, Xr as formatImportDrift, bn as formatIssue, ht as hasZstd, V as isEnvironmentLocal, vt as makeCompressor, yt as makeDecompressor, He as maskRow, en as ndjsonToRows, ut as noAssetProgress, hn as outsideReferenceRefusal, mn as outsideReferencesInto, mr as packBundle, vr as peekBundle, gt as pickCompression, ze as planMasking, Jr as previewMasking, pt as readAssetIndex, zt as readLedger, De as resolveAction, at as resolveScope, lt as restoreAssetFromCas, mt as restoreAssetsFromCas, Wr as restoreCommand, $t as rowsToNdjson, pn as runExport, ir as runImport, Gr as runNativeStep, Ve as scanForLeaks, X as stagingNameFor, st as storageAssetSink, ot as storageAssetSource, Ir as storageBlobSink, Pr as storageBlobSource, Fr as storageRefsBlobSource, rt as subsetToScope, Bt as tableDone, tn as topoSortTables, _r as unpackBundle, yr as unpackBundleToDir, ct as writeAssetToCas, J as writeLedger };