@voltro/data-transfer 0.76.0 → 0.77.0

package/CHANGELOG.md

@@ -39,6 +39,61 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.77.0] — 2026-09-22
+
+### ⚠ BREAKING
+
+- **Flow run rows record a cancellation request as `cancelling` until confirmed** — `@voltro/plugin-ai-flows`, `@voltro/devtools-ui`, `@voltro/cli`
+
+  `cancelFlow` used to write the flow row to `cancelled` before asking the engine, so a receipt reporting `engine: 'unreachable'` or `'unknown'` sat next to a row that read as a stopped run, and a reader of the row alone could not tell the difference. `RunStatus` gains `cancelling`: a live row now records the request as `cancelling` with `cancelledAt` as the request time and reads `cancelled` only once the engine confirmed — through the receipt's `engine: 'cancelled'`, the engine honouring the request at its next step boundary, its own run row turning cancelled, or a repeated confirmed request. Terminal rows are never resubmitted. The plugin documentation now states what a UI renders per `engine` outcome. Migration: extend exhaustive `RunStatus` switches and any filter that treated `cancelled` as the request marker; render `cancelling` as an open request and offer a retry when `engine` was `unreachable` or `unknown`. Only `succeeded`, `failed` and `cancelled` are terminal; `useFlowRun` reports `done` for those alone.
+
+  **`voltro update` carries you across this** — codemod `0.77.0/01_flow-cancelling-row-status`. If you pin versions by hand and never run it, print the notes without changing anything: `voltro update --codemods-only --from <your current version> --dry-run` (this one ships in 0.77.0).
+
+### Added
+
+- **An `@source` glob that matches no file is now reported** — `@voltro/cli`
+
+  Tailwind generates a utility only when it finds the class in a scanned file, and a `@source` pointing at a directory that does not exist is not an error — it is a set with no members. The build stays green and the page renders with classes that name rules which were never generated. `voltro build` now warns for every `@source` glob that matches nothing, and `voltro doctor` reports the same. The usual cause is scanning a dependency at a path it does not publish: a package that ships only its bundle has no `src/` once installed, so `@source "../node_modules/<pkg>/src/**"` matches everything in a workspace (where the dependency is a symlink to its source tree) and nothing in CI. Scan the one path the package publishes — `@source "../node_modules/<pkg>/dist/*.js"` — and rebuild that dependency after editing it, since its bundle is what you scan.
+
+### Fixed
+
+- **A failing admission placement no longer holds the drain at one tick per second** — `@voltro/cli`
+
+  Physical workflow admission drains every placement on a coordinated tick and backs off to a five-second reconciliation bound when a tick finds nothing to admit. A placement whose recovery failed on every tick — a release census page that threw, a placement that could not be opened — kept the tick at its base interval instead: the failure counted as "not idle", the interval never left one second, and the process wrote one schedule claim per second for as long as the condition lasted, with `scanned: 0` on every drain and every run terminal. Such a tick now reports `idle: true` beside its `placementFailures`, `discoveryProblems` and `releaseFailures`, backs off like a healthy idle tick, and retries the failing placement at the reconciliation bound; it is never disarmed, and the `physical recovery incomplete` warning still names the placement, the phase and the database's own reason. Incomplete discovery is unchanged: a further page is known work.
+
+  Two causes of a permanently failing release census are closed with it. The census pager compared row identities in code-unit order to detect a stalled cursor, while the store had ordered and cursor-filtered the page under its own collation; a correctly ordered page could be refused wholesale, and with it every global pool permit release behind it. The pager now walks a page as the store returns it and refuses only a page that repeats its cursor row or an identity within itself, naming both identities. And a census page that throws no longer pins its cursor: the next tick restarts that placement's census from the beginning, so an owner released behind the cursor since is visited again rather than waiting behind a page that fails on every read.
+- **A file migration body runs under test without a database** — `@voltro/database`
+
+  `makeFileMigrationContext` accepts an in-memory store without a `sql` client, so a migration's `each`, `rewrite` (temporal guards included), `expect`, `skipUnless`, `store`, `log` and a Promise body under `transactional` run in a unit test against the framework's own in-memory store. The surfaces that genuinely need a connection — `raw()`, every `ctx.schema` operation, an Effect body under `transactional` — fail with the new typed `MigrationNeedsSqlClient`, whose message names the operation and what is missing. A placeholder handed in as `sql`, or a SQL-backed store arriving without its client, is refused at construction with the same error. Previously `rewrite` introspected the live schema unconditionally and a database-free test died with `TypeError: onDialectOrElse is not a function` from inside the bundle. `FileMigrationContextInput` is now the union of `FileMigrationContextLiveInput` (client + store) and `FileMigrationContextInMemoryInput` (a store without `run`); the runner's call shape is unchanged.
+- **`voltro data restore` accepts an empty target and names a takeable remedy** — `@voltro/cli`, `@voltro/data-transfer`, `@voltro/database`
+
+  A native restore into a freshly created database was refused because the in-progress marker's table did not exist there, and the refusal said to run `voltro db apply` first — which on that target installs the current declared schema, the very state the artefact is about to replace. The restore now creates that one table itself, index- and trigger-free like the migration ledgers, and writes the marker into it before the first destructive statement; a refusal that remains carries the driver's own reason. `--no-marker` now means no marker on every target, warns every time, and no longer reports afterwards that "the restore artefact removed the in-progress marker and it could NOT be written back" over a run that never wrote one. On sqlite and turso the restore closes its bookkeeping connection before the file copy, removes the replaced file's `-wal` / `-shm` sidecars with it, and reopens bookkeeping afterwards: writes through the old connection landed the old database's WAL frames beside the new file, which SQLite replayed over it on the next open.
+- **Rolling-deploy advisory skips tables the same plan creates** — `@voltro/database`, `@voltro/cli`
+
+  `voltro db plan` and `db apply` no longer flag an operation as unsafe under a rolling deploy when the table it targets is created by the same plan. A fresh deployment against an empty database used to print one "old instances may write values … the new CHECK rejects" line per enum-membership CHECK, because the classifier judged each operation alone and never asked whether the plan's own `create-table` list held the table. No instance on a previous release can touch a table that did not exist a moment earlier, so the rule covers every kind — CHECK, foreign key, unique constraint, `NOT NULL`, type change, JSON validation — not only the one reported. A mixed plan still flags the same operations on pre-existing tables. Every remaining verdict now names its premise (`instances on the previous release …`), and the JSON warning carries a `premise` field, so a deployment with no previous release can tell from the message alone that the advisory does not apply. `classifyRollingDeploySafety` accepts an optional plan context (`{ createdTables }`); `createdTablesOf` builds it from a plan.
+- **The precompiled serve bundle boots with a trace exporter on** — `@voltro/cli`
+
+  `voltro serve` from the bundle `voltro build` writes died at boot whenever a trace exporter was active — `FRAMEWORK_TRACING=console` with `ConsoleSpanExporter is not a constructor`, an `OTEL_EXPORTER_OTLP_ENDPOINT` with `OTLPTraceExporter is not a constructor` — while the ring-only serve, dev and every test path booted fine. The OpenTelemetry SDK packages are CommonJS and are reached through a dynamic `import()`; the bundler splits such an import into a chunk that exposes only `default`, so every named member read off that namespace was `undefined`. The production bundler now routes a dynamic import of an inlined CommonJS package through an ESM facade that carries the same named exports Node gives it, so the console and OTLP exporters, the metrics readers and any other lazily imported CommonJS package construct as they do under development. Both exporters are now booted from a relocated production bundle in the bundle test matrix, and each has to deliver a span.
+
+  The facade has a measured cost, split without remainder against the previous release: the web start bundle grows 14 901 B (0.87 %) and the api serve bundle 28 552 B (0.34 %), both from the re-exported CommonJS surfaces; no file count moves. The remaining growth of the same release (22 B and 35 893 B) is ordinary source change. The artefact budgets are re-pinned to the measured sizes with the same 15 % headroom.
+- **A store failure carries the sentence that explains it** — `@voltro/protocol`, `@voltro/database`, `@voltro/runtime`
+
+  `StoreOperationFailed.cause` reduced every error to its class name, so an eager load on a table with no relations registered arrived as `cause: "Error"` while the refusal's own sentence — naming the table, the missing `relations(...)` declaration and the likely fix — was only recoverable by unwrapping the value by hand. A sentence the framework authored now travels whole in `cause`; anything a driver raised is still reduced to its class and code, because the driver's text carries row data and socket addresses. The error's `message` is now one readable sentence (`query on 'x' failed: …`) instead of a JSON rendering of its fields, so a test reporter, `Cause.pretty` and the undeclared-error envelope all show the diagnosis. And when a statement fails and takes the connection with it, `EffectStore.transactional` now reports the statement's failure (with its code) instead of the rollback's uncoded error that used to replace it. `@voltro/database` exports `authoredError` / `authoredMessageOf` for a hand-written store that wants the same treatment.
+- **A boot missing `@effect/opentelemetry` refuses once and names its cause** — `@voltro/runtime`, `@voltro/cli`
+
+  `@effect/opentelemetry` has been an optional peer of `@voltro/runtime` since 0.33.0, and the note that made it one said to skip the install unless traces or metrics are exported. That scope was too narrow: the tracer layer loads the OpenTelemetry SDK whenever a trace sink is installed, and `voltro dev` arms its in-process trace ring by default — so every `voltro dev` needs the package with no tracing variable set, and `voltro serve` needs it when its inspect trace ring or an exporter is on. Measured against the published 0.75.0 and 0.76.0 with the package absent: identical refusals, unrelated to `VOLTRO_TRACING_PERSIST`. Three things change. The refusal is now a marked boot refusal: printed once without a stack on every boot path, listing each cause that kept the layer active with the switch that removes it (the previous message named `FRAMEWORK_TRACING=off` for a ring that variable does not touch). `voltro doctor` reports `@effect/opentelemetry is not installed` when the installed runtime cannot see it, using the runtime's own lookup path, and fails the run unless `VOLTRO_TRACING_BUFFER=off` is set. And the corrected scope is re-issued as `0.77.0/03_tracing-peer`, printed for every project because tracing is configured outside the repository; the codemod text scan now also reads tracked `.env*` files, where those switches live. The golden churn is `otelImportFailure` gaining an optional second parameter, which no existing call can fail to compile against.
+- **TypeScript 7 upgrade note: typed ESLint alias pair and removed tsconfig options** — `@voltro/cli`
+
+  The 0.76.0 dependency note recommended TypeScript `^7.0.2` and read as though a plain bump were sufficient. It is not for a workspace that lints with typescript-eslint: the current release line declares the peer `"typescript": ">=4.8.4 <6.1.0"` and exits 2 on load under TypeScript 7, before linting anything. TypeScript 7 also removed `"moduleResolution": "node"` (TS5108) and `baseUrl` (TS5102), which the note did not mention. A note under an already-published version reaches nobody who acted on it, so the corrected guidance is re-issued under `0.77.0/02_typescript7-side-by-side`: the side-by-side alias pair (`"@typescript/native": "npm:typescript@^7.0.2"`, `"typescript": "npm:@typescript/typescript6@^6.0.2"`) that keeps `tsc` on 7.0 while typed ESLint resolves the 6.0 API, the two removals with their replacements, and when a plain bump is fine. Gated on any `typescript` declaration or removed option, so it reaches workspaces that bumped, reverted, or have not bumped yet.
+
+### Internal (no consumer-facing effect)
+
+- **A release moves `latest` only once every tarball is downloadable** — `@voltro/cli`
+
+  npm writes a new version into a package's metadata before the tarball behind it is downloadable from the CDN, and a consumer installing on `latest` inside that window sees a resolvable version whose download answers 404. The release now holds the promotion of `latest` until every published tarball answers 200 from the URL its own metadata publishes, and refuses to promote — leaving the previous release in place — if one does not within a bounded wait.
+
+---
+
 ## [0.76.0] — 2026-09-21
 
 ### ⚠ BREAKING

package/dist/index.js

@@ -1,8 +1,8 @@
 import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
 import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, STAGING_TABLE_PREFIX as f, _voltroDataTransfersTable as p, classifyConstraintViolation as m, derivedRowId as h, ensureTableRegistered as g, eq as _, extractDbCause as v, getTable as y, inSet as b, isNotNull as x, or as S, recordsTable as C, registerTable as ee, streamTable as w, suspendWriteRecorders as te, suspendWriteRecordersEffect as ne, unregisterTable as re } from "@voltro/database";
 import { fingerprintSchema as T } from "@voltro/database/sql";
-import { createCipheriv as E, createDecipheriv as ie, createHash as ae, createHmac as oe, randomBytes as se, randomUUID as ce, scrypt as le } from "node:crypto";
-import { copyFile as D, createReadStream as ue, createWriteStream as O, existsSync as de, rename as fe, statSync as k, unlinkSync as pe } from "node:fs";
+import { createCipheriv as ie, createDecipheriv as ae, createHash as oe, createHmac as se, randomBytes as ce, randomUUID as le, scrypt as ue } from "node:crypto";
+import { copyFile as E, createReadStream as de, createWriteStream as D, existsSync as fe, rename as pe, statSync as O, unlinkSync as k } from "node:fs";
 import { STORAGE_REFS_TABLE as A, fromNodeReadable as me, getObjectStream as j, putObjectStream as he, toNodeReadable as M } from "@voltro/plugin-storage";
 import * as N from "node:zlib";
 import { PassThrough as P, Readable as ge } from "node:stream";
@@ -57,7 +57,7 @@ var Ce = (e) => {
 		return r.classes?.[e] ?? we[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, De = (e, t) => oe("sha256", e).update(t == null ? "∅" : String(t)).digest(), V = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Oe = [
+}, De = (e, t) => se("sha256", e).update(t == null ? "∅" : String(t)).digest(), V = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Oe = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -566,7 +566,7 @@ var Ce = (e) => {
 		objectBytes: o,
 		missing: u
 	};
-}), ht = (e) => me("bundle", () => ue(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof G ? t : new G({
+}), ht = (e) => me("bundle", () => de(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof G ? t : new G({
 	reason: `asset index unreadable: ${String(t)}`,
 	path: e
 }))), gt = (e) => n.gen(function* () {
@@ -1442,20 +1442,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
 			return r ?? t;
 		}, T = (e, t, n, r = !1) => {
-			let i = k ? X(t.name) : t.name, a = t.primaryKey, o = w(t.name, n);
+			let i = O ? X(t.name) : t.name, a = t.primaryKey, o = w(t.name, n);
 			return f === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : f === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
-		}, E = (e, t) => e.savepoint ? e.savepoint(t) : t(), ie = 0, ae = (t, n, r) => {
-			r.unclassified && (ie++, !(ie > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (ie === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, oe = (e, t, r = !0) => n.tryPromise({
+		}, ie = (e, t) => e.savepoint ? e.savepoint(t) : t(), ae = 0, oe = (t, n, r) => {
+			r.unclassified && (ae++, !(ae > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (ae === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
+		}, se = (e, t, r = !0) => n.tryPromise({
 			try: e,
 			catch: (e) => On(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ae(t.entry, t.row, e)), !1)))), se = (e) => {
+		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, oe(t.entry, t.row, e)), !1)))), ce = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
 				...Object.fromEntries(t.map((e) => [e, null]))
 			};
-		}, ce = (e) => {
+		}, le = (e) => {
 			let t = new Set(e.map((e) => String(e.row[e.entry.primaryKey]))), n = (e) => Object.entries(e.entry.columnTypes).some(([n, r]) => {
 				if (r !== "reference") return !1;
 				let i = e.row[n];
@@ -1483,32 +1483,32 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					primary: t.primary
 				})).sort((e, t) => t.refused - e.refused || e.table.localeCompare(t.table)).slice(0, 100)
 			});
-		}, le = (e, t) => n.gen(function* () {
+		}, ue = (e, t) => n.gen(function* () {
 			let r = t, i = [], a = !0;
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* oe(() => E(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* se(() => ie(e, () => T(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
-					let r = t[n], o = se(r);
-					o !== void 0 && (yield* oe(() => E(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					let r = t[n], o = ce(r);
+					o !== void 0 && (yield* se(() => ie(e, () => T(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* oe(() => E(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
-			if (r.length > 0) return yield* n.fail(ce(r));
-		}), D = (() => {
+			for (let t of i) (yield* se(() => ie(e, () => e.upsert(t.entry.name, t.row, { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			if (r.length > 0) return yield* n.fail(le(r));
+		}), E = (() => {
 			let t = e.targetDialect;
 			return t === "postgres" || t === "mysql" || t === "mariadb" || t === "sqlite" || t === "mssql" ? t : void 0;
-		})(), O = qn({
+		})(), D = qn({
 			mode: f,
 			...e.targetDialect === void 0 ? {} : { targetDialect: e.targetDialect },
 			...e.targetSnapshot === void 0 ? {} : { targetSnapshot: e.targetSnapshot },
 			bundleTables: s.tables.map((e) => e.name),
 			isSkipped: W,
 			canRunSql: Mn(e.store)
-		}), de = O.tables, fe = s.tables.filter((e) => !W(e.name) && C(e.name)).map((e) => e.name), k = O.active, pe = !1, A = 0, j = 0, he, M, N = 0, P = 0, ge = (t, r) => n.gen(function* () {
-			if (f === "replace" && !k && !(r && b.truncated)) {
+		}), fe = D.tables, pe = s.tables.filter((e) => !W(e.name) && C(e.name)).map((e) => e.name), O = D.active, k = !1, A = 0, j = 0, he, M, N = 0, P = 0, ge = (t, r) => n.gen(function* () {
+			if (f === "replace" && !O && !(r && b.truncated)) {
 				e.recordInterruption === !0 && (yield* n.tryPromise({
 					try: () => t.insert(d, {
 						id: h("repl", F),
@@ -1560,22 +1560,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					total: h.rowCount
 				});
 				let y = a.length, x = n.gen(function* () {
-					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = me("bundle", () => ue(_).pipe(xt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
+					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = me("bundle", () => de(_).pipe(xt(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
 						let n = {
 							entry: h,
 							row: e,
 							reason: ""
 						};
 						try {
-							await E(t, () => T(t, h, e));
+							await ie(t, () => T(t, h, e));
 						} catch (t) {
 							let r = On(t);
-							n.reason = r.reason, ae(h, e, r), a.push(n);
+							n.reason = r.reason, oe(h, e, r), a.push(n);
 						}
 					}, d = yield* n.promise(async () => {
 						let n = e.copyLoader;
 						if (!n || n.dialect !== "postgres") return !1;
-						if (m) return pe || (pe = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
+						if (m) return k || (k = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
 						if (f === "replace") return !0;
 						if (f !== "upsert") return !1;
 						try {
@@ -1660,7 +1660,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					checksum: h.checksum
 				}, yield* J(v, b)));
 			}
-			if (a.length > 0 && (yield* le(t, a)), f === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
+			if (a.length > 0 && (yield* ue(t, a)), f === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
 				column: "startedAt",
 				op: "lte",
 				value: I
@@ -1708,14 +1708,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			sourceFingerprint: s.source.schemaFingerprint ?? null,
 			tablesWritten: 0,
 			rowsWritten: 0,
-			staged: f === "replace" ? k : null
+			staged: f === "replace" ? O : null
 		}).then(() => {
 			ve = !0;
 		}, (t) => {
 			e.onWarn?.(`the import trace could not be written (${String(t?.message ?? t)}).\n  The import continues — this is a record of what happened, not a safety check. Run
   \`voltro db apply\` so the next one is recorded.`);
 		}))), e.traceId !== void 0 && B && (yield* n.promise(() => e.store.update(u, z, {
-			staged: f === "replace" ? k : null,
+			staged: f === "replace" ? O : null,
 			sourceFingerprint: s.source.schemaFingerprint ?? null
 		}).then(() => void 0, () => void 0)));
 		let ye = 0, be = !1;
@@ -1735,17 +1735,17 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			rowsWritten: A,
 			failure: t
 		}).then(() => void 0, () => void 0) : Promise.resolve();
-		if (t = (e) => xe(e), f === "replace" && !k && O.blocker !== void 0 && e.onWarn?.(Nn(O.blocker)), f === "replace" && fe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${fe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
+		if (t = (e) => xe(e), f === "replace" && !O && D.blocker !== void 0 && e.onWarn?.(Nn(D.blocker)), f === "replace" && pe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${pe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
   something that did not happen — and this path already writes through the raw store, without
-  tenant scoping or \`audit()\` stamping, for the same reason.`), k) {
-			e.onWarn?.(`staging ${de.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
-			let t = e.store, r = de.map((e) => e.name), i = h("repl", `staging-${F}`), a = !1;
+  tenant scoping or \`audit()\` stamping, for the same reason.`), O) {
+			e.onWarn?.(`staging ${fe.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
+			let t = e.store, r = fe.map((e) => e.name), i = h("repl", `staging-${F}`), a = !1;
 			if (e.recordInterruption === !0) {
 				yield* n.promise(() => e.store.insert(d, {
 					id: i,
 					startedAt: I,
 					kind: "staging",
-					tables: String(de.length),
+					tables: String(fe.length),
 					capture: L?.dir ?? null,
 					via: e.via ?? "direct",
 					staging: r.map(X).join(","),
@@ -1776,20 +1776,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				let i = m ? r : r.filter((e) => !Ut(b, e));
 				yield* n.tryPromise({
 					try: async () => {
-						await Hn(t, i.map((e) => In(e, D))), await Hn(t, i.map((e) => Fn(e, D)));
+						await Hn(t, i.map((e) => In(e, E))), await Hn(t, i.map((e) => Fn(e, E)));
 					},
 					catch: (e) => new G({ reason: `could not prepare the staging tables, so the import did not start and the target is untouched: ${String(e?.message ?? e)}` })
 				}), yield* R(ge(e.store, !m)), !m && b.truncated === !0 ? c = !0 : yield* n.tryPromise({
-					try: () => Un(t, de, D).then(() => {
+					try: () => Un(t, fe, E).then(() => {
 						c = !0;
 					}),
 					catch: (e) => new G({ reason: String(e?.message ?? e) })
 				}).pipe(n.catchAll((i) => n.gen(function* () {
-					let a = Vn(yield* n.promise(() => Wn(t, zn(e.targetSnapshot, r), D).then((e) => e, () => [])));
+					let a = Vn(yield* n.promise(() => Wn(t, zn(e.targetSnapshot, r), E).then((e) => e, () => [])));
 					return yield* n.fail(new G({ reason: a ?? `the swap failed and the target is UNCHANGED: ${i.reason}` }));
 				}))), !m && c && b.truncated !== !0 && (b.truncated = !0, yield* J(v, b));
 			} finally {
-				s.undo(), c || m ? (M = void 0, yield* n.promise(() => Hn(t, r.map((e) => In(e, D))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
+				s.undo(), c || m ? (M = void 0, yield* n.promise(() => Hn(t, r.map((e) => In(e, E))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
 			}
 		} else m ? yield* n.tryPromise({
 			try: () => e.store.transactional(async (e) => {
@@ -1852,11 +1852,11 @@ async function* vr(e) {
 	yield new Uint8Array(Q);
 	for (let t of await hr(e.dir)) {
 		let n = B(e.dir, t), r = await _e(n);
-		if (yield new Uint8Array(gr(t, r.size)), r.size > 0) for await (let e of ue(n)) yield new Uint8Array(e);
+		if (yield new Uint8Array(gr(t, r.size)), r.size > 0) for await (let e of de(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
 		yield new Uint8Array(_r(t.key, t.contentType, t.size));
-		let n = ae("sha256"), r = 0;
+		let n = oe("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
 			n.update(e), r += e.length, yield new Uint8Array(e);
@@ -1893,7 +1893,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 				let i = c(8).readBigUInt64BE(0), a = ye(n, t);
 				if (a !== n && !a.startsWith(n + be)) throw Error(`archive path '${t}' escapes the destination`);
 				await I(ve(a), { recursive: !0 });
-				let o = O(a);
+				let o = D(a);
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
@@ -1910,7 +1910,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = ae("sha256"), d = new P(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = oe("sha256"), d = new P(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
@@ -1970,10 +1970,10 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 		write: async (n, r, i) => {
 			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = B(e, "assets");
 			await I(c, { recursive: !0 });
-			let l = ae("sha256"), u = 0, d = new s({ transform(e, t, n) {
+			let l = oe("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
 			} }), f = B(c, `.tmp-${Date.now()}-${t.size}`);
-			await o(r, d, O(f));
+			await o(r, d, D(f));
 			let p = l.digest("hex");
 			await a.rename(f, B(c, p)), await a.appendFile(B(c, "index.ndjson"), `${JSON.stringify({
 				key: n,
@@ -1983,7 +1983,7 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 			})}\n`), t.add(n);
 		}
 	};
-}, Tr = xe(le), Er = Buffer.from("VENC1\0\0\0"), Dr = 32, Or = 16, kr = 7, Ar = 16, jr = 262144, Mr = {
+}, Tr = xe(ue), Er = Buffer.from("VENC1\0\0\0"), Dr = 32, Or = 16, kr = 7, Ar = 16, jr = 262144, Mr = {
 	N: 32768,
 	r: 8,
 	p: 1
@@ -1993,13 +1993,13 @@ var yr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), br
 };
 async function* Ir(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = se(Or), r = se(kr), i = await Tr(t, n, Dr, {
+	let n = ce(Or), r = ce(kr), i = await Tr(t, n, Dr, {
 		...Mr,
 		maxmem: Nr
 	}), a = Buffer.alloc(Pr);
 	Er.copy(a, 0), a.writeUInt32BE(Mr.N, 8), a.writeUInt32BE(Mr.r, 12), a.writeUInt32BE(Mr.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = E("aes-256-gcm", i, Fr(r, o, t));
+		let n = ie("aes-256-gcm", i, Fr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
@@ -2040,7 +2040,7 @@ async function* Lr(e, t) {
 		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
 		let n = r.subarray(5, 5 + t - Ar), i = r.subarray(5 + t - Ar, 5 + t);
 		r = r.subarray(5 + t);
-		let a = ie("aes-256-gcm", p, Fr(f, m, e));
+		let a = ae("aes-256-gcm", p, Fr(f, m, e));
 		m === 0 && a.setAAD(s), a.setAuthTag(i);
 		let c = Buffer.concat([a.update(n), a.final()]);
 		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
@@ -2086,7 +2086,7 @@ var Rr = (e, t) => ({
 		tool: r,
 		hint: `'${n}' is not on PATH, so this ran '${r}' instead. If that binary came from Oracle's MySQL client it queries information_schema.COLUMN_STATISTICS, which MariaDB does not have, and the run dies with error 1109 after the first table. Install the MariaDB client package (which ships '${n}') and re-run. Do NOT reach for --column-statistics=0: that flag does not exist on '${n}', so it fixes the wrong client and breaks the right one. Note: a MariaDB 12.x client requires TLS by default, so running '${n}' BY HAND against a server without it fails with "TLS/SSL error: SSL is required" (2026) and needs --skip-ssl. This command is not affected.`
 	} : { tool: r };
-}, Hr = (e) => (process.env.PATH ?? "").split(z).filter((e) => e !== "").some((t) => de(B(t, e))), Ur = (e) => {
+}, Hr = (e) => (process.env.PATH ?? "").split(z).filter((e) => e !== "").some((t) => fe(B(t, e))), Ur = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -2290,21 +2290,28 @@ var Rr = (e, t) => ({
 		});
 	}
 }, Zr = (e) => e.kind === "copy" ? n.async((t) => {
-	let r = `${e.to}.restoring-${ce()}`, i = (e) => {
+	let r = `${e.to}.restoring-${le()}`, i = (e) => {
 		try {
-			pe(r);
+			k(r);
 		} catch {}
 		t(n.fail(new K({
 			tool: "copy",
 			reason: e
 		})));
 	};
-	D(e.from, r, (a) => {
+	E(e.from, r, (a) => {
 		if (a) {
 			i(`copy ${e.from} → ${e.to}: ${a.message}`);
 			return;
 		}
-		fe(r, e.to, (r) => {
+		for (let t of [
+			`${e.to}-wal`,
+			`${e.to}-shm`,
+			`${e.to}-journal`
+		]) try {
+			k(t);
+		} catch {}
+		pe(r, e.to, (r) => {
 			if (r) {
 				i(`copy ${e.from} → ${e.to}: ${r.message}`);
 				return;
@@ -2333,12 +2340,12 @@ var Rr = (e, t) => ({
 		s ??= e;
 	};
 	if (e.stdoutFile && r.stdout) {
-		let t = O(e.stdoutFile);
+		let t = D(e.stdoutFile);
 		t.on("error", (t) => c(`writing ${R(e.stdoutFile)}: ${t.message}`)), r.stdout.on("error", (e) => c(`reading the tool's output: ${e.message}`)), r.stdout.pipe(t);
 	}
 	let l = 0;
 	if (e.stdinFile && r.stdin) {
-		let t = ue(e.stdinFile);
+		let t = de(e.stdinFile);
 		t.on("data", (e) => {
 			l += e.length;
 		}), t.on("error", (t) => {
@@ -2349,7 +2356,7 @@ var Rr = (e, t) => ({
 	}
 	let u = () => {
 		if (e.stdoutFile !== void 0) try {
-			pe(e.stdoutFile);
+			k(e.stdoutFile);
 		} catch {}
 	};
 	r.on("error", (t) => {
@@ -2374,7 +2381,7 @@ var Rr = (e, t) => ({
 	});
 }), Qr = (e) => {
 	try {
-		return String(k(e).size);
+		return String(O(e).size);
 	} catch {
 		return "?";
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/data-transfer",
-  "version": "0.76.0",
+  "version": "0.77.0",
   "description": "Portable export/import for a Voltro app's data + assets — typed-NDJSON row codec, content-addressed assets, framed compression, a resumable chunk ledger, and FK-ordered idempotent import. Dialect-agnostic; the resilient backbone under `voltro data export|import` and native backups.",
   "keywords": [
     "voltro",
@@ -33,8 +33,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.76.0",
-    "@voltro/plugin-storage": "0.76.0"
+    "@voltro/database": "0.77.0",
+    "@voltro/plugin-storage": "0.77.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2"