@voltro/data-transfer 0.50.1 → 0.51.0

package/CHANGELOG.md

@@ -39,6 +39,110 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.51.0] — 2026-08-24
+
+### ⚠ BREAKING
+
+- **@voltro/data-transfer, @voltro/cli** — The asset counts reported references as if they were blobs. `_voltro_storage_refs` holds one row per reference and several rows legitimately name one key, so a capture of 57 rows over 16 keys wrote `count: 57` into the stamp beside an `assets/` directory holding 16 files, and the restore reported "57 blob(s) restored" while 16 objects appeared. Nothing was lost; what was lost is the ability to check. Anyone answering "are all the blobs there?" after a restore compared the stamp's number against one they counted and found a 3.5x gap that was not one.
+
+  A key named by several references is now fetched once rather than downloaded, hashed and discarded once per row, and the three numbers are stated separately: `references` (rows enumerated), `count` (distinct keys), `objects` (distinct sha256 bodies), with `totalBytes` and `objectBytes` beside them. The stamp's existing fields keep their names and now mean what a reader always took them for; the new ones are optional, so a stamp written before them still parses.
+
+  **Breaking on one export.** `restoreAssetsFromCas` returns `{ count, objects }` instead of a bare `number` — one number could not answer both questions, which is the defect. `count` is what the old value was, so the migration that changes nothing is `.count`.
+
+  **`voltro update` carries you across this** — codemod `0.51.0/03_restore-assets-returns-counts`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.51.0).
+- **@voltro/i18n** — `<I18nProvider>` takes `timeZone` as its own prop, and `intlConfig` no longer accepts one.
+
+  `intlConfig` exists to forward props to react-intl UNMODIFIED, and for every other member of `IntlConfig` that is the right shape. `timeZone` is the one member this package's own formatters read — and they did not read it: `useFormatDate` built `Intl.DateTimeFormat` itself and took only the locale from the provider. So a zone passed through `intlConfig` configured `<T>`'s ICU dates and NOT the `useFormatDate()` beside them. Measured under one provider, one instant (`2026-08-24T23:30:00Z`), `locale: 'de'`, `intlConfig: { timeZone: 'Europe/Berlin' }`, process zone UTC: react-intl rendered `25.08.26, 01:30` and the hook rendered `24.08.26, 23:30`. A different hour, and a different day.
+
+  The zone has to be a prop this package can see. It is validated once at the provider (an unusable zone — a stale cookie, a typo, a runtime with a trimmed ICU — is dropped, because `Intl` THROWS on an unknown zone and `useFormatDate` catches, which would degrade every timestamp in the app to a raw `Date` string). It is what the new `useTimeZone()` reports. And it is what the framework fills per request.
+
+  **Migration:** `intlConfig={{ timeZone: 'Europe/Berlin' }}` → `timeZone="Europe/Berlin"`. The codemod does it, including the case where the zone was the bag's only member. An `intlConfig` naming a variable is reported by file and line rather than guessed at — the property would otherwise stop being read with nothing red anywhere.
+- **@voltro/cli** — A native restore whose bookkeeping store would not open ran anyway, with no in-progress marker and no word about it. `nativeBookkeeping` was `try { … } catch { return undefined }`, and that `undefined` guarded every branch below — including the refusal for a marker that could not be written. So the failure removed the precaution AND the sentence that would have reported it missing, and `markerState` was never computed, defaulting to "held".
+
+  What it produced was worse than silence: a failed restore printed "This database is now in an unknown state and the next boot will REFUSE, by design" over a database with zero marker rows. The next boot did not refuse, and `voltro data clear-replace-marker` had nothing to clear. The trigger is not exotic — wrong credentials, an unreachable database, a missing env var, no `app.config.ts` from here — and a restore is the operation you run against a target that is already unwell, so the guard fell away exactly when it was needed.
+
+  The reason now travels instead of being caught and dropped. A restore that cannot write the marker REFUSES and names which of the two reasons it was (the store would not open, or the table is not there); those were two separate refusals and are now one, because they are one decision for the operator. `--no-marker` is the deliberate way past it and warns every time. And the `recorded:` line no longer reports a local failure as a property of the target — it says where the failure was.
+
+  **This changes an exit code.** A restore that could not write the marker used to exit 0; it now exits 1. Two invocations are affected — the bookkeeping store will not open, or there is no `app.config.ts` from the working directory — and the second surprises people, because `restore` reads its target from the environment and so looks like it needs no project. It does not, for the dump; it needs one for the marker. `--no-marker` is the deliberate way through and warns every time. The note ships under `reach: 'beyond-source'` because the affected invocations live in cron entries, CI jobs and runbooks rather than in TypeScript.
+
+  **`voltro update` carries you across this** — codemod `0.51.0/02_restore-refuses-without-marker`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.51.0).
+
+### Added
+
+- **@voltro/i18n, @voltro/cli, @voltro/voltro** — `timeZone` in the web `app.config.ts` — the zone every date/time formatter renders in, resolved per request and published so the client agrees.
+
+  A formatter is deterministic given the value, the locale, the zone and the clock. The locale already came from the provider and was already agreed across the hydration boundary — the server publishes it as `<html lang>` and the client reads that attribute rather than `navigator.languages`, precisely because the browser's own answer can differ from what the server saw. The zone had no such source. `Intl` fell back to the zone of whichever runtime was formatting: the pod on the server (UTC on a container with no `TZ`), the viewer's machine in the browser. Every server-rendered timestamp was therefore a hydration mismatch waiting for a wide enough offset, and across midnight it was a different calendar day.
+
+  timeZone: 'Europe/Berlin' // one zone for every viewer timeZone: 'viewer' // per request, from the `voltro:tz` cookie defaultTimeZone: 'UTC' // before the viewer's zone is known
+
+  Whatever it resolves to is stamped on the document as `<html data-voltro-tz>`, and the generated client entry reads that attribute. Both sides then format against one value — which is the property that removes the mismatch, whether or not the value is the viewer's true zone: being wrong together is repairable after mount, being different is not.
+
+  Under `'viewer'` the framework injects a script that seeds `voltro:tz` from the browser when the cookie is absent, so the server renders in the viewer's zone from the second request with no login. It never overwrites an existing value — the APP is the authoritative writer, at login, from the zone it holds for the signed-in user (`TIMEZONE_COOKIE` and `isSupportedTimeZone` are exported for that). Unset, nothing changes: each runtime keeps using its own zone, and `useTimeZone()` returns `undefined` to say so.
+
+  This is the RENDER zone. The server-side compute zone — what `startOfDay` resolves against inside a handler — is still `@voltro/datetime/context`'s seam, unwired.
+
+  **`apiSurface: compatible`** covers the two golden lines that moved, and they are the same change twice: `makeSsgWrap`'s returned wrapper, and the `wraps` record on the SSG shell input, each gained an OPTIONAL second parameter (the per-request zone + render instant; the wrapper is built once per locale, so they cannot live in the factory). A function with an optional extra parameter is assignable wherever the one-parameter type was expected, so no call site that compiled stops compiling — and both are the framework's SSG bridge, documented as never imported by app code. Everything else this release adds to these packages is a pure addition; the one genuine break in `@voltro/i18n` is the `timeZone` prop, which has its own entry and its own codemod.
+
+### Changed
+
+- **@voltro/cli** — A `BREAKING` entry's changelog footer now tells a reader who pins versions by hand how to print the codemod's note without upgrading anything:
+
+  voltro update --codemods-only --from <your current version> --dry-run
+
+  The footer used to stop at the codemod's id, which is enough for anyone who runs `voltro update` and nothing at all for anyone who does not. A deployment said so plainly: they pin every `@voltro/*` version from their own container scripts, have never run the command, and `CHANGELOG.md` out of the tarball is the only channel anything reaches them through. So a note deliberately filed under an unreached version — our one mechanism for correcting guidance that can no longer be corrected in place — reached that population not at all, and the id told them a fix existed without telling them what it was.
+
+  No new surface: every flag in that invocation is already parsed, which is what lets `check-message-apis.mjs` verify the line rather than trust it.
+- **@voltro/cli** — Two fingerprint labels now say what they compare.
+
+  The restore's skew warning said the backup's schema "differs from what this code declares". It does not: the value it compares against is the TARGET database's live schema, read by introspection at restore time. Bringing a target to the backup's shape makes the warning disappear while the declared fingerprint is a third value entirely, which is how the mislabel was caught. The comparison is the useful one and is unchanged; the sentence sent readers looking for a code change where a database differed.
+
+  `voltro db plan` prints `fingerprint: live … · declared …` instead of `from … → to …`, plus a line saying the two are not meant to match. A hash of a live database never equals the hash of the declaration it came from — introspection cannot recover generated expressions, `maxLength` or sensitivity markers — which is why `db drift` keeps a separate live baseline. Printed as `from → to`, `0 operations` under two differing hashes read as a contradiction.
+
+### Fixed
+
+- **@voltro/cli** — `voltro check` reported a reactivity CHANNEL as a missing table, at `error` severity — so it set the exit code:
+
+  ✗ error reference/dangling-source query(presence.list) reads table 'channel:presence' which does not exist fix: declare a 'channel:presence.entity.ts' table or fix the query's source
+
+  A `source:` entry is a table name OR a channel's routing key (`channel:<name>`), and every rule resolved entries against the table set. The advice cannot be followed — a channel exists precisely because no table is meant — and because it is an error rather than a warning, `voltro check` could not be a CI gate for any app that uses a channel. That includes an app whose only channel comes from `@voltro/plugin-presence`, whose own `presence.list` declares one: a first-party feature meeting a rule that did not know about it, inside a first-party plugin.
+
+  Channels are filtered in the ONE helper every table rule reads, rather than at each rule, because a per-rule filter is how the next rule joins without one. The same cause was live one rule over: `observed/declared-but-unobserved` reported "declares source 'channel:presence' but never read it while running" for every exercised procedure that declares a channel. Both are covered, each with a negative control — a filter that dropped the whole source list would have silenced the rules instead of narrowing them.
+- **@voltro/data-transfer** — A native dump no longer carries `_voltro_data_transfers`, for the same reason it stopped carrying the in-progress marker one release ago. The restore opens its own run row there BEFORE the tool runs; the dump then dropped the table mid-flight, and the update recording the outcome wrote into a table that no longer held the row. Measured downstream: after a deliberately failed native restore, `voltro data transfers` showed no restore at all — only the `backup` row the dump had carried over from the SOURCE database. The command that answers "did the restore finish" could not see the run asking the question.
+
+  Exactly two tables are excluded and the line is deliberate: a native restore into the same deployment should bring the migration ledger, the stored plans, the CDC offsets and the schedule claims, because they describe the data being restored. These two describe the RESTORE, and a record of an operation must not be overwritten by the operation it records. Covered per dialect against real servers and real vendor tools, including a non-vacuity check that a table which SHOULD travel still does.
+- **@voltro/i18n, @voltro/cli** — `useRelativeTime` used `Date.now()` as its base, which under SSR is two different numbers. The server rendered at T and wrote "3 minutes ago" into the HTML; the browser hydrated at T+Δ and rendered "4 minutes ago" whenever a unit boundary fell in the gap. The gap is network latency, so it reproduced on a slow connection and never on the developer's machine, and it had nothing to do with timezones — a correctly zoned app hit it just the same.
+
+  The server states its render instant (`<html data-voltro-now>`, `renderedAt` on the provider), the first client render uses that same number, and the clock goes live once hydration commits. Server markup and hydration markup are therefore identical BY CONSTRUCTION — the property `await.tsx` and `deferred.ts` already hold, rather than `suppressHydrationWarning`, which would hide a real mismatch along with this one. An explicit `{ now }` still wins.
+
+  The mount state lives in the provider, not in the hook: a table of ten thousand rows would otherwise pay a state hook and a passive effect each to learn one fact that is true for the whole document. An app that never renders on the server publishes no stamp and takes no second render pass.
+- **@voltro/cli** — `closeNativeRun` writes the transfer row BACK when the restore's own artefact dropped the table it lives in, instead of issuing an `UPDATE` that matches nothing and returning happily. Excluding `_voltro_data_transfers` from our own dumps shortens that window; it does nothing for a dump taken before that change, for a hand-made one, or for mssql and sqlite, whose restores have no per-table exclusion at all. The write-back covers every dialect and every artefact, which is why it is the rule and the exclusion is the optimisation.
+
+  The row is read back rather than trusted — an update that matched nothing is indistinguishable from one that matched — and a read that itself fails writes nothing, because a duplicate row invented on a guess is its own defect in a history somebody reads under pressure.
+- **@voltro/cli** — A prerendered page shipped the shell's baked `lang="en"` whatever locale it was rendered in.
+
+  `voltro dev` and `voltro start` both set `<html lang>` per request; the prerender never did. So a `/de/...` artefact — rendered with the German catalog, handed `locale: 'de'` in its `meta` — served `<html lang="en">`. That attribute is what a screen reader pronounces in, what Chrome offers to translate FROM, and what hyphenation uses, so the failure was silent to whoever shipped it and loud only to the people it excluded. The same shape as the 0.30.0 cookie-name drift, one document path over.
+
+  It surfaced while giving the zone somewhere to travel: `<html lang>` was set by four hand-written copies of one `.replace(/<html…/)` and by nothing in the prerender, and adding a second attribute to that arrangement is how the next one reaches three paths out of five. There is one `applyDocumentAttrs` now, and the prerender is one of its callers — which fixes the locale as a side effect of having somewhere to put the zone.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/cli** — `voltro data backup --assets` / `restore --assets` are now driven against a REAL S3 API (MinIO in the test stack), over the network, with a real backup and a real restore into a second bucket and the bytes compared.
+
+  The asset half rests on one field: a provider must map "there is no object at that key" to `status === 404`, and nothing looser — a 403 from a rotated credential is also non-transient, and calling that "the object is gone" turns a recoverable outage into a backup that quietly contains nothing. That mapping was measured against memory, filesystem and database live, and against the s3/azure SDK error SHAPES constructed. A constructed shape is a claim about an SDK, not about a round trip: nothing in it exercises signing, path-style addressing, or what the SDK actually raises when a server answers `NoSuchKey`. Two deployments listed exactly this as the gap they could not close either.
+
+  Both directions are covered against the real server: a dangling reference is stepped over and reported, and a bad credential fails the capture rather than being read as a missing object.
+
+  The native dialect lane also stops being silent about mssql. It was absent from the array entirely — an absent lane and a covered one look identical from the outside — and it is now listed with a written reason for why it does not register here (`sqlpackage` is a separate Microsoft download on a .NET runtime, absent from `mcr.microsoft.com/mssql-tools`). It is registered rather than skipped-forever, because a skip present on every healthy run teaches readers to ignore skip lines; and an assertion fails if any lane drops out WITHOUT a written reason, or if a reason names a lane that is in fact running.
+- **@voltro/cli, @voltro/plugin-storage** — Coverage for the data commands, at the level the defects actually live.
+
+  `dataDirectFlags.e2e.test.ts` drives every DIRECT-target flag of `voltro data export` / `import` through the real binary against a real sqlite database, and carries the same `DATA_FLAGS`-driven self-check the native suite has: a new direct flag has to be driven there or the file goes red. The api-only flags are listed explicitly with the reason they are not here, and that list is asserted against `DATA_FLAGS` so it cannot become a place to hide an untested flag.
+
+  `missingObjectIs404.test.ts` pins the contract the dangling-reference skip rests on: every provider maps "no object at that key" to `status === 404`, and nothing looser. Five providers, three of them live, s3 and azure through their SDK's real error shapes — which read DIFFERENT fields (`$metadata.httpStatusCode` vs a bare `statusCode`), so a mapping copied from one to the other would turn dangling references back into hard capture failures on that backend alone.
+
+  `codegenFeatureTables.integration.test.ts` measures the count a report was about: `voltro codegen` must carry the tables a `*.cron.tsx` contributes, which the entity walk cannot see. The structural guards beside it were TRUE while that count was wrong. `frameworkSourceTypo.integration.test.ts` measures what catches a misspelled `_voltro_*` source given that the type deliberately does not — `voltro check` reports it as a dangling source and exits 1, with a negative control so the check is not merely flagging every framework name.
+
+---
+
 ## [0.50.1] — 2026-08-24
 
 ### Added

package/dist/index.d.ts

@@ -181,8 +181,32 @@ export declare const captureAssetsToCas: (opts: {
 }) => Effect.Effect<CapturedAssets, BundleError>;
 
 export declare interface CapturedAssets {
+    /**
+     * Distinct KEYS captured. Not rows enumerated.
+     *
+     * `_voltro_storage_refs` holds one row per reference, and several references
+     * legitimately point at one stored object. The loop used to count rows, so a
+     * deployment's stamp said `count: 57` over an artefact holding 16 blobs — and
+     * the same object was downloaded, hashed and thrown away 3.5 times on the way.
+     * `restore` then reported "57 blob(s) restored" while 16 files appeared.
+     *
+     * Nothing was lost either way; what was lost is the ability to check. Anyone
+     * answering "are all the blobs there?" after a restore compared a number from
+     * the stamp against a number they counted, and found a gap that was not one.
+     */
     readonly count: number;
+    /** Bytes of the distinct keys above — what the artefact actually carries
+     *  before content-dedup, not the sum over references. */
     readonly totalBytes: number;
+    /** References the source enumerated, INCLUDING repeats of one key. Reported
+     *  beside `count` so "57 references → 16 keys" is legible rather than looking
+     *  like a shortfall. */
+    readonly references: number;
+    /** Distinct `sha256` bodies on disk. Below `count` when two keys hold
+     *  identical content — the content-addressed store keeps one copy. */
+    readonly objects: number;
+    /** Bytes those distinct bodies occupy — the size of `assets/` itself. */
+    readonly objectBytes: number;
     /**
      * Keys the refs table names and the provider does not have (404).
      *
@@ -546,6 +570,52 @@ export declare const environmentLocalNotice: (skipped: ReadonlyArray<string>, ve
  *  rule rather than that a table went missing. */
 export declare const environmentLocalReason: (tableName: string) => string | undefined;
 
+/**
+ * A dump must not carry the in-progress MARKER TABLE.
+ *
+ * The marker is one row in `_voltro_replace_in_progress`, written before a
+ * restore's first destructive statement so a restore that dies half-way refuses
+ * the next boot instead of serving a database that is neither the old one nor
+ * the new one.
+ *
+ * This module's own notes claimed that row survives a native restore on every
+ * dialect but sqlite, on the reasoning that a table-scoped restore only touches
+ * what the dump names. The reasoning is right and the premise was wrong: a
+ * `mariadb-dump` / `pg_dump` names the WHOLE database, marker table included,
+ * and a mysql-family dump writes `DROP TABLE IF EXISTS` in front of each one. A
+ * deployment measured it — 1 row before the restore, 0 after, twice, once by
+ * hand and once through this command. The table sorts early, so the marker was
+ * gone for almost the entire window it exists to cover, and a restore that then
+ * died left a half-loaded database with nothing to stop the next boot.
+ *
+ * Excluding it here makes the claim true rather than documenting it as false: a
+ * backup WE take can no longer contain the thing that erases the guard on the
+ * way back in. It does not help a dump taken before this change or by hand,
+ * which is why the restore re-asserts the marker after the tool exits — the two
+ * halves cover different dumps and neither replaces the other.
+ *
+ * ── The second table, for the same reason one table over ────────────────────
+ *
+ * `_voltro_data_transfers` is excluded too. The restore opens its own run row
+ * there BEFORE the tool runs; the dump then drops the table mid-flight, and the
+ * update that would have recorded the outcome writes into a table that no longer
+ * holds the row. A deployment measured the consequence: after a deliberately
+ * failed native restore, `voltro data transfers` showed no restore at all — only
+ * the `backup` row the dump had carried over from the SOURCE database. The
+ * command that answers "did last night's restore finish" could not see the run
+ * asking the question.
+ *
+ * These two are excluded and the other `_voltro_*` tables are not, and the line
+ * between them is deliberate: a native restore into the same deployment SHOULD
+ * bring the migration ledger, the plans, the CDC offsets and the schedule claims
+ * — they describe the data being restored. These two describe the RESTORE, and a
+ * record of an operation must not be overwritten by the operation it records.
+ *
+ * mssql (`sqlpackage`) and the sqlite/turso file copy have no such flag; the
+ * copy is atomic for exactly this reason (see the `copy` branch).
+ */
+export declare const EXCLUDED_FROM_DUMP: readonly ["_voltro_replace_in_progress", "_voltro_data_transfers"];
+
 /**
  * Run statements against the store's own connection.
  *
@@ -1352,17 +1422,32 @@ export declare const restoreAssetFromCas: (sink: AssetSink, assetsDir: string, e
  * A hash mismatch is an {@link IntegrityError} and stops the phase — a corrupted
  * artefact must never silently re-upload bad bytes over good ones, which is the
  * one failure a restore has no way to notice afterwards.
+ *
+ * Returns {@link RestoredAssets} rather than a bare count: keys and distinct
+ * bodies are different numbers, and reporting one of them as "blobs" is how a
+ * reader came to compare a restore's number against files on disk and find a
+ * 3.5x gap that was not one.
  */
 export declare const restoreAssetsFromCas: (opts: {
     readonly sink: AssetSink;
     readonly assetsDir: string;
     readonly indexPath: string;
     readonly progress?: AssetProgress;
-}) => Effect.Effect<number, BundleError | IntegrityError | StorageError>;
+}) => Effect.Effect<RestoredAssets, BundleError | IntegrityError | StorageError>;
 
 /** Build the restore step for a dialect reading `inFile`. */
 export declare const restoreCommand: (dialect: string, conn: NativeConn, inFile: string) => NativeStep;
 
+/** What a restore put back. */
+export declare interface RestoredAssets {
+    /** Distinct KEYS written to the sink. */
+    readonly count: number;
+    /** Distinct `sha256` bodies read out of `assets/`. Below `count` when two keys
+     *  hold identical content. Reported so "16 objects, 16 keys" can be checked
+     *  against what is on the destination instead of guessed at. */
+    readonly objects: number;
+}
+
 declare interface RollbackCapture {
     /** Where the target's previous rows were written. */
     readonly dir: string;

package/dist/index.js

@@ -1,7 +1,7 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
-import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, _voltroDataTransfersTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as C, streamTable as w, suspendWriteRecorders as ee, suspendWriteRecordersEffect as te, unregisterTable as ne } from "@voltro/database";
-import { fingerprintSchema as re } from "@voltro/database/sql";
-import { createCipheriv as T, createDecipheriv as E, createHash as D, createHmac as ie, randomBytes as ae, randomUUID as oe, scrypt as se } from "node:crypto";
+import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, _voltroDataTransfersTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as ee, streamTable as C, suspendWriteRecorders as te, suspendWriteRecordersEffect as ne, unregisterTable as re } from "@voltro/database";
+import { fingerprintSchema as ie } from "@voltro/database/sql";
+import { createCipheriv as w, createDecipheriv as T, createHash as E, createHmac as ae, randomBytes as D, randomUUID as oe, scrypt as se } from "node:crypto";
 import { copyFile as ce, createReadStream as le, createWriteStream as O, existsSync as ue, rename as de, statSync as fe, unlinkSync as k } from "node:fs";
 import { STORAGE_REFS_TABLE as pe, fromNodeReadable as me, getObjectStream as A, putObjectStream as j, toNodeReadable as he } from "@voltro/plugin-storage";
 import * as M from "node:zlib";
@@ -57,7 +57,7 @@ var we = (e) => {
 		return r.classes?.[e] ?? Te[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, Oe = (e, t) => ie("sha256", e).update(t == null ? "∅" : String(t)).digest(), z = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), ke = [
+}, Oe = (e, t) => ae("sha256", e).update(t == null ? "∅" : String(t)).digest(), z = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), ke = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -343,7 +343,7 @@ var we = (e) => {
 		};
 	}, p = (r, i) => {
 		let a = f(r, G(t, r), tt(t, r));
-		return l.runForEach(w(e, {
+		return l.runForEach(C(e, {
 			table: r,
 			pk: G(t, r),
 			...i === void 0 ? {} : { where: i }
@@ -458,30 +458,36 @@ var we = (e) => {
 	done: () => !1,
 	mark: () => n.void
 }, dt = (e) => typeof e == "object" && !!e && e.status === 404, ft = (e) => n.gen(function* () {
-	let t = e.progress ?? ut, r = 0, i = 0, a = [];
-	return yield* l.runForEach(e.source.list(), (o) => t.done(o.key) ? n.void : e.source.open(o.key).pipe(n.map((e) => e), n.catchIf(dt, () => n.sync(() => {
-		a.push(o.key);
+	let t = e.progress ?? ut, r = 0, i = 0, a = 0, o = 0, s = /* @__PURE__ */ new Set(), c = /* @__PURE__ */ new Set(), u = [];
+	return yield* l.runForEach(e.source.list(), (l) => (a++, t.done(l.key) || c.has(l.key) ? n.void : (c.add(l.key), e.source.open(l.key).pipe(n.map((e) => e), n.catchIf(dt, () => n.sync(() => {
+		u.push(l.key);
 	})), n.flatMap((a) => a === void 0 ? n.void : ct(a, e.assetsDir).pipe(n.flatMap((e) => {
 		let n = {
-			key: o.key,
+			key: l.key,
 			sha256: e.sha256,
 			size: e.size,
 			contentType: e.contentType
 		};
-		return r++, i += e.size, t.mark(o.key, n);
-	}))))).pipe(n.mapError((e) => e instanceof H ? e : new H({ reason: `asset export failed: ${String(e)}` }))), {
+		return r++, i += e.size, s.has(e.sha256) || (s.add(e.sha256), o += e.size), t.mark(l.key, n);
+	}))))))).pipe(n.mapError((e) => e instanceof H ? e : new H({ reason: `asset export failed: ${String(e)}` }))), {
 		count: r,
 		totalBytes: i,
-		missing: a
+		references: a,
+		objects: s.size,
+		objectBytes: o,
+		missing: u
 	};
 }), pt = (e) => me("bundle", () => le(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof H ? t : new H({
 	reason: `asset index unreadable: ${String(t)}`,
 	path: e
 }))), mt = (e) => n.gen(function* () {
-	let t = e.progress ?? ut, r = 0;
-	return yield* l.runForEach(pt(e.indexPath), (i) => t.done(i.key) ? n.void : lt(e.sink, e.assetsDir, i).pipe(n.andThen(n.sync(() => {
-		r++;
-	})), n.andThen(t.mark(i.key, i)))), r;
+	let t = e.progress ?? ut, r = 0, i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Set();
+	return yield* l.runForEach(pt(e.indexPath), (o) => t.done(o.key) || a.has(o.key) ? n.void : (a.add(o.key), lt(e.sink, e.assetsDir, o)).pipe(n.andThen(n.sync(() => {
+		r++, i.add(o.sha256);
+	})), n.andThen(t.mark(o.key, o)))), {
+		count: r,
+		objects: i.size
+	};
 }), ht = () => typeof M.createZstdCompress == "function", gt = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : ht() ? "zstd" : "gzip", _t = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", vt = (e) => e === "zstd" ? M.createZstdCompress() : e === "gzip" ? M.createGzip() : new N(), yt = (e) => e === "zstd" ? M.createZstdDecompress() : e === "gzip" ? M.createGunzip() : new N(), bt = 1, xt = c.Struct({
 	name: c.String,
 	file: c.String,
@@ -745,7 +751,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			event: "start",
 			rowsDone: 0
 		});
-		let f = t.resolved.predicateFor(o), p = w(e, {
+		let f = t.resolved.predicateFor(o), p = C(e, {
 			table: o,
 			pk: u,
 			chunkSize: t.chunkSize,
@@ -845,14 +851,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				mark: (e, r) => (d.assets[e] = !0, ln(t, JSON.stringify(r)).pipe(n.andThen(J(u, d))))
 			}
 		});
-		y = r.count, b = r.totalBytes;
+		y = r.count, b = r.totalBytes, r.missing.length > 0 && (yield* n.logWarning(`${r.missing.length} of ${r.missing.length + r.count} blob reference(s) point at objects the storage provider does not have; they are NOT in this bundle and no import can bring them back. e.g. ${r.missing.slice(0, 3).map((e) => `'${e}'`).join(", ")}` + (r.missing.length > 3 ? `, and ${r.missing.length - 3} more` : "")));
 	}
 	let x = {
 		formatVersion: 1,
 		createdAt: e.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
 		source: {
 			dialect: e.dialect,
-			schemaFingerprint: re(e.snapshot)
+			schemaFingerprint: ie(e.snapshot)
 		},
 		scope: t,
 		consistency: m,
@@ -1197,7 +1203,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	}
 	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n;
 }, Zn = (e, t, n) => {
-	let r = re(t);
+	let r = ie(t);
 	if (r === e || n === void 0) return {
 		drifted: !1,
 		bundleFingerprint: e,
@@ -1335,26 +1341,26 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			rowsSkipped: 0,
 			fullyResumed: !1
 		};
-		let w = /* @__PURE__ */ new Map();
+		let C = /* @__PURE__ */ new Map();
 		for (let t of e.targetSnapshot?.tables ?? []) {
 			let e = t.columns.filter((e) => e.generatedAs !== void 0).map((e) => e.name);
-			e.length > 0 && w.set(t.name, e);
+			e.length > 0 && C.set(t.name, e);
 		}
-		let re = (e, t) => {
-			let n = w.get(e);
+		let ie = (e, t) => {
+			let n = C.get(e);
 			if (n === void 0) return t;
 			let r;
 			for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
 			return r ?? t;
-		}, T = (e, t, n, r = !1) => {
-			let i = k ? X(t.name) : t.name, a = t.primaryKey, o = re(t.name, n);
+		}, w = (e, t, n, r = !1) => {
+			let i = k ? X(t.name) : t.name, a = t.primaryKey, o = ie(t.name, n);
 			return p === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : p === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
-		}, E = (e, t) => e.savepoint ? e.savepoint(t) : t(), D = 0, ie = (t, n, r) => {
-			r.unclassified && (D++, !(D > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (D === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, ae = (e, t, r = !0) => n.tryPromise({
+		}, T = (e, t) => e.savepoint ? e.savepoint(t) : t(), E = 0, ae = (t, n, r) => {
+			r.unclassified && (E++, !(E > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (E === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
+		}, D = (e, t, r = !0) => n.tryPromise({
 			try: e,
 			catch: (e) => Tn(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ie(t.entry, t.row, e)), !1)))), oe = (e) => {
+		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), oe = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
@@ -1393,14 +1399,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* ae(() => E(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* D(() => T(e, () => w(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
 					let r = t[n], o = oe(r);
-					o !== void 0 && (yield* ae(() => E(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					o !== void 0 && (yield* D(() => T(e, () => w(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* ae(() => E(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			for (let t of i) (yield* D(() => T(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
 			if (r.length > 0) return yield* n.fail(se(r));
 		}), O = (() => {
 			let t = e.targetDialect;
@@ -1472,10 +1478,10 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 							reason: ""
 						};
 						try {
-							await E(t, () => T(t, m, e));
+							await T(t, () => w(t, m, e));
 						} catch (t) {
 							let r = Tn(t);
-							n.reason = r.reason, ie(m, e, r), a.push(n);
+							n.reason = r.reason, ae(m, e, r), a.push(n);
 						}
 					}, d = yield* n.promise(async () => {
 						let n = e.copyLoader;
@@ -1510,13 +1516,13 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 							d = !1, e.onWarn?.(`bulk COPY into ${m.name} failed (${String(n?.message ?? n)}); falling back to per-row writes for this table`);
 							for (let e of t) await u(e);
 						}
-					}, b = Math.max(1, e.savepointBatchSize ?? 200), x = typeof t.savepoint == "function", S = [], C = async () => {
+					}, b = Math.max(1, e.savepointBatchSize ?? 200), x = typeof t.savepoint == "function", S = [], ee = async () => {
 						if (S.length === 0) return;
 						let e = S;
 						S = [];
 						try {
 							await t.savepoint(async () => {
-								for (let n of e) await T(t, m, n);
+								for (let n of e) await w(t, m, n);
 							});
 						} catch {
 							for (let t of e) await u(t);
@@ -1528,20 +1534,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 							return;
 						}
 						if (x) {
-							S.push(e), S.length >= b && await C();
+							S.push(e), S.length >= b && await ee();
 							return;
 						}
 						await u(e);
-					})), yield* n.promise(C), yield* n.promise(y), {
+					})), yield* n.promise(ee), yield* n.promise(y), {
 						rowCount: o,
 						checksum: i.digest("hex")
 					};
-				}), { rowCount: S, checksum: C } = yield* Lt("import", m.name, d, h, (e) => e.rowCount, b);
+				}), { rowCount: S, checksum: ee } = yield* Lt("import", m.name, d, h, (e) => e.rowCount, b);
 				if (c) {
-					if (C !== m.checksum) return yield* n.fail(new Je({
+					if (ee !== m.checksum) return yield* n.fail(new Je({
 						what: `table ${m.name} checksum`,
 						expected: m.checksum,
-						actual: C
+						actual: ee
 					}));
 					if (S !== m.rowCount) return yield* n.fail(new Je({
 						what: `table ${m.name} rowCount`,
@@ -1603,7 +1609,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				path: F.dir
 			})
 		})), e.onWarn?.(Kn(F)));
-		let ve = (e) => p === "replace" ? ee(e) : e(), I = (e) => p === "replace" ? te(e) : e, L = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), ye = e.traceId !== void 0, R = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
+		let ve = (e) => p === "replace" ? te(e) : e(), I = (e) => p === "replace" ? ne(e) : e, L = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), ye = e.traceId !== void 0, R = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || v(u) !== void 0;
 		R && h(f), R && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(u, {
 			id: L,
 			mode: p,
@@ -1647,9 +1653,9 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			let t = e.store, r = de.map((e) => e.name), i = Fn(r, {
 				getTable: (e) => v(e),
 				registerTable: (e) => {
-					C(e);
+					ee(e);
 				},
-				unregisterTable: ne
+				unregisterTable: re
 			}), a = !1;
 			try {
 				let i = g ? r : r.filter((e) => !Bt(x, e));
@@ -1735,7 +1741,7 @@ async function* mr(e) {
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
 		yield new Uint8Array(pr(t.key, t.contentType, t.size));
-		let n = D("sha256"), r = 0;
+		let n = E("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
 			n.update(e), r += e.length, yield new Uint8Array(e);
@@ -1789,7 +1795,7 @@ var hr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), gr
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = D("sha256"), d = new N(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = E("sha256"), d = new N(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
@@ -1849,7 +1855,7 @@ var hr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), gr
 		write: async (n, r, i) => {
 			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = R(e, "assets");
 			await P(c, { recursive: !0 });
-			let l = D("sha256"), u = 0, d = new s({ transform(e, t, n) {
+			let l = E("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
 			} }), f = R(c, `.tmp-${Date.now()}-${t.size}`);
 			await o(r, d, O(f));
@@ -1872,13 +1878,13 @@ var hr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), gr
 };
 async function* Mr(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = ae(wr), r = ae(Tr), i = await xr(t, n, Cr, {
+	let n = D(wr), r = D(Tr), i = await xr(t, n, Cr, {
 		...Or,
 		maxmem: kr
 	}), a = Buffer.alloc(Ar);
 	Sr.copy(a, 0), a.writeUInt32BE(Or.N, 8), a.writeUInt32BE(Or.r, 12), a.writeUInt32BE(Or.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = T("aes-256-gcm", i, jr(r, o, t));
+		let n = w("aes-256-gcm", i, jr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
@@ -1919,7 +1925,7 @@ async function* Nr(e, t) {
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
 		let n = r.subarray(5, 5 + t - Er), i = r.subarray(5 + t - Er, 5 + t);
 		r = r.subarray(5 + t);
-		let a = E("aes-256-gcm", p, jr(f, m, e));
+		let a = T("aes-256-gcm", p, jr(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -1943,7 +1949,7 @@ var Pr = (e, t) => ({
 		let r = await n.runPromise(A(e, t)), i = await he(r.stream);
 		for await (let e of i) yield e instanceof Uint8Array ? e : new Uint8Array(e);
 	} })
-}), Fr = (e, t) => Pr(e, () => w(t, {
+}), Fr = (e, t) => Pr(e, () => C(t, {
 	table: pe,
 	chunkSize: 500
 }).pipe(l.map((e) => ({
@@ -2001,7 +2007,7 @@ var Pr = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
-					...Ur,
+					...Wr,
 					"--dbname",
 					t.url,
 					"--file",
@@ -2020,7 +2026,7 @@ var Pr = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
-					...Ur,
+					...Wr,
 					"-h",
 					e.host,
 					"-p",
@@ -2047,7 +2053,7 @@ var Pr = (e, t) => ({
 					"--triggers",
 					"--no-tablespaces",
 					"--protocol=TCP",
-					`--ignore-table=${r.database}.${d}`,
+					...Ur.map((e) => `--ignore-table=${r.database}.${e}`),
 					"-h",
 					r.host,
 					"-P",
@@ -2084,7 +2090,7 @@ var Pr = (e, t) => ({
 			reason: `no native backup for dialect '${e}'`
 		});
 	}
-}, Ur = ["--exclude-table", d], Wr = (e, t, n) => {
+}, Ur = [d, u], Wr = Ur.flatMap((e) => ["--exclude-table", e]), Gr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -2168,7 +2174,7 @@ var Pr = (e, t) => ({
 			reason: `no native restore for dialect '${e}'`
 		});
 	}
-}, Gr = (e) => e.kind === "copy" ? n.async((t) => {
+}, Kr = (e) => e.kind === "copy" ? n.async((t) => {
 	let r = `${e.to}.restoring-${oe()}`, i = (e) => {
 		try {
 			k(r);
@@ -2243,7 +2249,7 @@ var Pr = (e, t) => ({
 			return;
 		}
 		u();
-		let r = e.stdinFile === void 0 ? "" : ` — ${l} of ${Kr(e.stdinFile)} byte(s) of ${I(e.stdinFile)} had been fed to it`;
+		let r = e.stdinFile === void 0 ? "" : ` — ${l} of ${qr(e.stdinFile)} byte(s) of ${I(e.stdinFile)} had been fed to it`;
 		o(n.fail(new W({
 			tool: e.tool,
 			reason: (t === 0 ? `exited cleanly, but ${s}` : `exited with code ${t}${s === void 0 ? "" : ` (${s})`}`) + r + (e.stdoutFile === void 0 ? "" : ` — the partial ${I(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
@@ -2251,13 +2257,13 @@ var Pr = (e, t) => ({
 			...e.hint === void 0 ? {} : { hint: e.hint }
 		})));
 	});
-}), Kr = (e) => {
+}), qr = (e) => {
 	try {
 		return String(fe(e).size);
 	} catch {
 		return "?";
 	}
-}, qr = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Jr = (e) => n.gen(function* () {
+}, Jr = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), Yr = (e) => n.gen(function* () {
 	let t = yield* at(e.scope ?? { kind: "all" }, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
@@ -2269,7 +2275,7 @@ var Pr = (e, t) => ({
 		}))
 	})), i, e.masking), s = [], c = [];
 	for (let i of r) {
-		let r = t.predicateFor(i), u = yield* w(e.store, {
+		let r = t.predicateFor(i), u = yield* C(e.store, {
 			table: i,
 			chunkSize: a,
 			...r === void 0 ? {} : { where: r }
@@ -2281,7 +2287,7 @@ var Pr = (e, t) => ({
 			let n = e.slice(i.length + 1);
 			m.push({
 				column: n,
-				action: qr(t),
+				action: Jr(t),
 				before: f[n],
 				after: p[n]
 			});
@@ -2296,7 +2302,7 @@ var Pr = (e, t) => ({
 		leaks: c,
 		unclassified: o.unclassified
 	};
-}), Yr = (e, t) => {
+}), Xr = (e, t) => {
 	let n = new Map(t.map((e) => [e.name, e])), r = [], i = {};
 	for (let t of e) {
 		let e = n.get(t.name);
@@ -2351,7 +2357,7 @@ var Pr = (e, t) => ({
 		skipColumns: i,
 		refuse: r.some((e) => e.verdict === "refuse")
 	};
-}, Xr = (e) => {
+}, Zr = (e) => {
 	if (e.findings.length === 0) return ["  schema matches the bundle"];
 	let t = {
 		safe: "✓",
@@ -2362,4 +2368,4 @@ var Pr = (e, t) => ({
 	return n.push(""), n.push(`  discarded: ${r("value-dropped")}   defaulted: ${r("filled-by-default")}   refused: ${r("refuse")}`), e.refuse && (n.push(""), n.push("  REFUSED — no row was written. These are the differences that would make"), n.push("  imported rows WRONG rather than merely incomplete.")), n;
 };
 //#endregion
-export { kt as ASSETS_DIR, At as ASSET_INDEX_FILE, H as BundleError, qe as CodecError, Ye as CompressionError, et as CrossDialectError, Ot as DATA_DIR, Te as DEFAULT_CLASS_ACTIONS, Ue as ENVIRONMENT_LOCAL_TABLES, We as ENVIRONMENT_PORTABLE_TABLES, bt as FORMAT_VERSION, $e as ImportModeError, Je as IntegrityError, jt as LEDGER_FILE, K as MANIFEST_FILE, Qe as MaskingError, W as NativeToolError, Xe as RowsRefusedError, $n as SAVEPOINT_BATCH_SIZE, On as STAGING_PREFIX, Ze as SchemaDriftError, U as ScopeError, Le as applyAction, tr as asImportError, or as assessLiveImport, Vt as assetDone, zr as backupArtifactName, Hr as backupCommand, gn as canonicalType, ft as captureAssetsToCas, yn as checkPortability, Zn as checkSchemaDrift, Ee as classificationFromSnapshot, Yr as classifyImportDrift, _t as compressionExt, nt as computeSubsetIds, Wn as decideStaging, Et as decodeManifest, Zt as decodeRow, Yt as decodeValue, Nr as decryptStream, ar as defineDataProfile, Xn as diffSnapshots, br as dirBlobSink, Nn as dropStagingSql, Rt as emptyLedger, Tt as encodeManifest, Xt as encodeRow, qt as encodeValue, Mr as encryptStream, Ke as environmentLocalNotice, Ge as environmentLocalReason, zn as execStatements, Xr as formatImportDrift, bn as formatIssue, ht as hasZstd, V as isEnvironmentLocal, vt as makeCompressor, yt as makeDecompressor, He as maskRow, en as ndjsonToRows, ut as noAssetProgress, hn as outsideReferenceRefusal, mn as outsideReferencesInto, mr as packBundle, vr as peekBundle, gt as pickCompression, ze as planMasking, Jr as previewMasking, pt as readAssetIndex, zt as readLedger, De as resolveAction, at as resolveScope, lt as restoreAssetFromCas, mt as restoreAssetsFromCas, Wr as restoreCommand, $t as rowsToNdjson, pn as runExport, ir as runImport, Gr as runNativeStep, Ve as scanForLeaks, X as stagingNameFor, st as storageAssetSink, ot as storageAssetSource, Ir as storageBlobSink, Pr as storageBlobSource, Fr as storageRefsBlobSource, rt as subsetToScope, Bt as tableDone, tn as topoSortTables, _r as unpackBundle, yr as unpackBundleToDir, ct as writeAssetToCas, J as writeLedger };
+export { kt as ASSETS_DIR, At as ASSET_INDEX_FILE, H as BundleError, qe as CodecError, Ye as CompressionError, et as CrossDialectError, Ot as DATA_DIR, Te as DEFAULT_CLASS_ACTIONS, Ue as ENVIRONMENT_LOCAL_TABLES, We as ENVIRONMENT_PORTABLE_TABLES, Ur as EXCLUDED_FROM_DUMP, bt as FORMAT_VERSION, $e as ImportModeError, Je as IntegrityError, jt as LEDGER_FILE, K as MANIFEST_FILE, Qe as MaskingError, W as NativeToolError, Xe as RowsRefusedError, $n as SAVEPOINT_BATCH_SIZE, On as STAGING_PREFIX, Ze as SchemaDriftError, U as ScopeError, Le as applyAction, tr as asImportError, or as assessLiveImport, Vt as assetDone, zr as backupArtifactName, Hr as backupCommand, gn as canonicalType, ft as captureAssetsToCas, yn as checkPortability, Zn as checkSchemaDrift, Ee as classificationFromSnapshot, Xr as classifyImportDrift, _t as compressionExt, nt as computeSubsetIds, Wn as decideStaging, Et as decodeManifest, Zt as decodeRow, Yt as decodeValue, Nr as decryptStream, ar as defineDataProfile, Xn as diffSnapshots, br as dirBlobSink, Nn as dropStagingSql, Rt as emptyLedger, Tt as encodeManifest, Xt as encodeRow, qt as encodeValue, Mr as encryptStream, Ke as environmentLocalNotice, Ge as environmentLocalReason, zn as execStatements, Zr as formatImportDrift, bn as formatIssue, ht as hasZstd, V as isEnvironmentLocal, vt as makeCompressor, yt as makeDecompressor, He as maskRow, en as ndjsonToRows, ut as noAssetProgress, hn as outsideReferenceRefusal, mn as outsideReferencesInto, mr as packBundle, vr as peekBundle, gt as pickCompression, ze as planMasking, Yr as previewMasking, pt as readAssetIndex, zt as readLedger, De as resolveAction, at as resolveScope, lt as restoreAssetFromCas, mt as restoreAssetsFromCas, Gr as restoreCommand, $t as rowsToNdjson, pn as runExport, ir as runImport, Kr as runNativeStep, Ve as scanForLeaks, X as stagingNameFor, st as storageAssetSink, ot as storageAssetSource, Ir as storageBlobSink, Pr as storageBlobSource, Fr as storageRefsBlobSource, rt as subsetToScope, Bt as tableDone, tn as topoSortTables, _r as unpackBundle, yr as unpackBundleToDir, ct as writeAssetToCas, J as writeLedger };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/data-transfer",
-  "version": "0.50.1",
+  "version": "0.51.0",
   "description": "Portable export/import for a Voltro app's data + assets — typed-NDJSON row codec, content-addressed assets, framed compression, a resumable chunk ledger, and FK-ordered idempotent import. Dialect-agnostic; the resilient backbone under `voltro data export|import` and native backups.",
   "keywords": [
     "voltro",
@@ -33,8 +33,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.50.1",
-    "@voltro/plugin-storage": "0.50.1"
+    "@voltro/database": "0.51.0",
+    "@voltro/plugin-storage": "0.51.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"