@voltro/data-transfer 0.84.0 → 0.85.0

package/dist/index.js

@@ -1,18 +1,18 @@
-import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, MetricBoundaries as a, Runtime as o, Schedule as s, Schema as c, Stream as l } from "effect";
-import { DATA_TRANSFERS_TABLE as u, REPLACE_IN_PROGRESS_TABLE as d, STAGING_TABLE_PREFIX as f, _voltroDataTransfersTable as p, classifyConstraintViolation as m, derivedRowId as h, ensureTableRegistered as g, eq as _, extractDbCause as v, getTable as y, inSet as b, isNotNull as x, or as S, recordsTable as ee, registerTable as te, streamTable as C, suspendWriteRecorders as ne, suspendWriteRecordersEffect as re, unregisterTable as ie } from "@voltro/database";
-import { fingerprintSchema as w } from "@voltro/database/sql";
-import { createCipheriv as ae, createDecipheriv as oe, createHash as T, createHmac as se, randomBytes as ce, randomUUID as le, scrypt as ue } from "node:crypto";
-import { copyFile as de, createReadStream as fe, createWriteStream as pe, existsSync as E, rename as D, statSync as me, unlinkSync as he } from "node:fs";
-import { STORAGE_REFS_TABLE as O, fromNodeReadable as ge, getObjectStream as _e, putObjectStream as k, toNodeReadable as A } from "@voltro/plugin-storage";
-import * as j from "node:zlib";
-import { PassThrough as M, Readable as ve } from "node:stream";
-import { SqlClient as N } from "@effect/sql";
-import { mkdir as P, readdir as ye, stat as be } from "node:fs/promises";
-import { basename as F, delimiter as xe, dirname as Se, join as I, resolve as L, sep as Ce } from "node:path";
-import { promisify as we } from "node:util";
-import { spawn as Te } from "node:child_process";
+import { Cause as e, Data as t, Effect as n, Exit as r, Metric as i, Option as a, Schedule as o, Schema as s, Stream as c } from "effect";
+import { DATA_TRANSFERS_TABLE as l, REPLACE_IN_PROGRESS_TABLE as u, STAGING_TABLE_PREFIX as d, _voltroDataTransfersTable as f, classifyConstraintViolation as p, derivedRowId as m, ensureTableRegistered as h, eq as g, extractDbCause as _, getTable as v, inSet as y, isNotNull as b, or as x, recordsTable as S, registerTable as ee, streamTable as C, suspendWriteRecorders as te, suspendWriteRecordersEffect as ne, unregisterTable as re } from "@voltro/database";
+import { fingerprintSchema as ie } from "@voltro/database/sql";
+import { createCipheriv as ae, createDecipheriv as oe, createHash as w, createHmac as T, randomBytes as E, randomUUID as se, scrypt as ce } from "node:crypto";
+import { copyFile as le, createReadStream as ue, createWriteStream as de, existsSync as fe, rename as D, statSync as O, unlinkSync as k } from "node:fs";
+import { STORAGE_REFS_TABLE as pe, fromNodeReadable as me, getObjectStream as A, putObjectStream as he, toNodeReadable as j } from "@voltro/plugin-storage";
+import * as M from "node:zlib";
+import { PassThrough as ge, Readable as _e } from "node:stream";
+import { SqlClient as ve } from "effect/sql";
+import { mkdir as N, readdir as ye, stat as be } from "node:fs/promises";
+import { basename as P, delimiter as F, dirname as xe, join as I, resolve as L, sep as Se } from "node:path";
+import { promisify as Ce } from "node:util";
+import { spawn as we } from "node:child_process";
 //#region src/consistency.ts
-var Ee = (e) => {
+var Te = (e) => {
 	switch (e) {
 		case "postgres": return ["SET TRANSACTION ISOLATION LEVEL REPEATABLE READ"];
 		case "mysql":
@@ -22,7 +22,7 @@ var Ee = (e) => {
 		case "turso": return [];
 		default: return [];
 	}
-}, De = {
+}, Ee = {
 	email: { fake: "email" },
 	fullName: { fake: "fullName" },
 	firstName: { fake: "firstName" },
@@ -37,7 +37,7 @@ var Ee = (e) => {
 	date: "dateShift",
 	secret: "null",
 	freeText: "redact"
-}, Oe = (e) => {
+}, De = (e) => {
 	let t = {};
 	for (let n of e.tables) {
 		let e = {};
@@ -49,15 +49,15 @@ var Ee = (e) => {
 		t[n.name] = e;
 	}
 	return t;
-}, ke = (e, t, n, r) => {
+}, Oe = (e, t, n, r) => {
 	let i = r.columns?.[`${e}.${t}`];
 	if (i) return i;
 	if (n?.sensitive) {
 		let e = n.sensitive.class;
-		return r.classes?.[e] ?? De[e] ?? "redact";
+		return r.classes?.[e] ?? Ee[e] ?? "redact";
 	}
 	return n?.safe ? r.onSafe ?? "keep" : n?.columnType === "id" || n?.columnType === "reference" ? "keep" : r.onUnclassified ?? "error";
-}, Ae = (e, t) => se("sha256", e).update(t == null ? "∅" : String(t)).digest(), R = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), je = [
+}, ke = (e, t) => T("sha256", e).update(t == null ? "∅" : String(t)).digest(), R = (e, t) => e.readUInt32BE(t * 4 % (e.length - 4)), Ae = [
 	"Ada",
 	"Alan",
 	"Grace",
@@ -70,7 +70,7 @@ var Ee = (e) => {
 	"Guido",
 	"Margaret",
 	"Bjarne"
-], Me = [
+], je = [
 	"Lovelace",
 	"Turing",
 	"Hopper",
@@ -83,7 +83,7 @@ var Ee = (e) => {
 	"Rossum",
 	"Hamilton",
 	"Stroustrup"
-], Ne = [
+], Me = [
 	"Maple",
 	"Oak",
 	"Cedar",
@@ -92,7 +92,7 @@ var Ee = (e) => {
 	"Birch",
 	"Willow",
 	"Ash"
-], Pe = [
+], Ne = [
 	"Initech",
 	"Hooli",
 	"Umbrella",
@@ -101,23 +101,23 @@ var Ee = (e) => {
 	"Soylent",
 	"Stark",
 	"Wayne"
-], z = (e, t, n) => e[R(t, n) % e.length], Fe = (e, t, n) => {
-	let r = Ae(n, `${e}:${String(t)}`), i = R(r, 1) % 1e4;
+], z = (e, t, n) => e[R(t, n) % e.length], Pe = (e, t, n) => {
+	let r = ke(n, `${e}:${String(t)}`), i = R(r, 1) % 1e4;
 	switch (e) {
-		case "email": return `${z(je, r, 0).toLowerCase()}.${z(Me, r, 2).toLowerCase()}${i}@example.com`;
-		case "fullName": return `${z(je, r, 0)} ${z(Me, r, 1)}`;
-		case "firstName": return z(je, r, 0);
-		case "lastName": return z(Me, r, 1);
-		case "username": return `${z(je, r, 0).toLowerCase()}${i}`;
+		case "email": return `${z(Ae, r, 0).toLowerCase()}.${z(je, r, 2).toLowerCase()}${i}@example.com`;
+		case "fullName": return `${z(Ae, r, 0)} ${z(je, r, 1)}`;
+		case "firstName": return z(Ae, r, 0);
+		case "lastName": return z(je, r, 1);
+		case "username": return `${z(Ae, r, 0).toLowerCase()}${i}`;
 		case "phone": return `+1${String(R(r, 0) % 1e10).padStart(10, "0")}`;
-		case "address": return `${R(r, 0) % 9899 + 100} ${z(Ne, r, 1)} St`;
-		case "company": return z(Pe, r, 0);
+		case "address": return `${R(r, 0) % 9899 + 100} ${z(Me, r, 1)} St`;
+		case "company": return z(Ne, r, 0);
 		case "url": return `https://example.com/${r.toString("hex").slice(0, 12)}`;
 		case "ip": return `${R(r, 0) % 256}.${R(r, 1) % 256}.${R(r, 2) % 256}.${R(r, 3) % 254 + 1}`;
-		case "creditCard": return Ie(`4${r.toString("hex").replace(/\D/g, "").padEnd(14, "0").slice(0, 14)}`);
+		case "creditCard": return Fe(`4${r.toString("hex").replace(/\D/g, "").padEnd(14, "0").slice(0, 14)}`);
 		default: return `${e}_${r.toString("hex").slice(0, 8)}`;
 	}
-}, Ie = (e) => {
+}, Fe = (e) => {
 	let t = e.slice(0, 15).split("").map(Number), n = 0;
 	t.forEach((e, t) => {
 		let r = e;
@@ -125,10 +125,10 @@ var Ee = (e) => {
 	});
 	let r = (10 - n % 10) % 10;
 	return e.slice(0, 15) + String(r);
-}, Le = 864e5, Re = (e, t) => {
+}, Ie = 864e5, Le = (e, t) => {
 	let n = e instanceof Date ? e.getTime() : Date.parse(String(e));
 	if (Number.isNaN(n)) return e;
-	let r = R(Ae(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Le);
+	let r = R(ke(t, "date-shift-offset"), 0) % 730 - 365, i = new Date(n + r * Ie);
 	return e instanceof Date ? i : i.toISOString();
 }, B = (e, t) => {
 	if (t.value === null || t.value === void 0) return null;
@@ -136,14 +136,14 @@ var Ee = (e) => {
 	if (e === "keep") return t.value;
 	if (e === "null") return null;
 	if (e === "redact") return t.columnType === "text" || typeof t.value == "string" ? "[redacted]" : null;
-	if (e === "hash") return Ae(t.seed, t.value).toString("hex").slice(0, 16);
-	if (e === "dateShift") return Re(t.value, t.seed);
-	if (typeof e == "object" && "fake" in e) return Fe(e.fake, t.value, t.seed);
+	if (e === "hash") return ke(t.seed, t.value).toString("hex").slice(0, 16);
+	if (e === "dateShift") return Le(t.value, t.seed);
+	if (typeof e == "object" && "fake" in e) return Pe(e.fake, t.value, t.seed);
 	if (typeof e == "object" && "custom" in e) return e.custom(t);
-	if (typeof e == "object" && "json" in e) return ze(e, t);
+	if (typeof e == "object" && "json" in e) return Re(e, t);
 	throw Error(`masking: '${t.table}.${t.column}' resolved to an action this build does not understand (${JSON.stringify(e)}). Refusing to copy the value through. Valid actions: 'keep' | 'null' | 'redact' | 'hash' | 'dateShift' | { fake: '<class>' } | { custom: fn } | { json: { fields, rest? } }.`);
-}, ze = (e, t) => {
-	let { fields: n, rest: r = "redact" } = e.json, i = typeof t.value == "string" ? Be(t.value) : {
+}, Re = (e, t) => {
+	let { fields: n, rest: r = "redact" } = e.json, i = typeof t.value == "string" ? ze(t.value) : {
 		ok: !0,
 		value: t.value
 	};
@@ -158,7 +158,7 @@ var Ee = (e) => {
 			let a = {};
 			for (let [o, s] of Object.entries(e)) {
 				let e = n[o] ?? r, c = `${i}.${o}`;
-				a[o] = typeof e == "object" && "json" in e ? ze(e, {
+				a[o] = typeof e == "object" && "json" in e ? Re(e, {
 					...t,
 					value: s,
 					column: c,
@@ -180,7 +180,7 @@ var Ee = (e) => {
 		});
 	}, o = a(i.value, t.column);
 	return typeof t.value == "string" ? JSON.stringify(o) : o;
-}, Be = (e) => {
+}, ze = (e) => {
 	try {
 		return {
 			ok: !0,
@@ -189,7 +189,7 @@ var Ee = (e) => {
 	} catch {
 		return { ok: !1 };
 	}
-}, Ve = (e) => {
+}, Be = (e) => {
 	if (typeof e == "string") return e === "keep" || e === "null" || e === "redact" || e === "hash" || e === "dateShift" || e === "error";
 	if (typeof e != "object" || !e) return !1;
 	if ("fake" in e) return typeof e.fake == "string";
@@ -198,18 +198,18 @@ var Ee = (e) => {
 		let t = e.json;
 		if (typeof t != "object" || !t) return !1;
 		let { fields: n, rest: r } = t;
-		return typeof n != "object" || !n ? !1 : Object.values(n).every(Ve) && (r === void 0 || Ve(r));
+		return typeof n != "object" || !n ? !1 : Object.values(n).every(Be) && (r === void 0 || Be(r));
 	}
 	return !1;
-}, He = (e, t, n) => {
+}, Ve = (e, t, n) => {
 	let r = {}, i = [], a = [];
 	for (let o of e) for (let e of o.columns) {
-		let s = `${o.name}.${e.name}`, c = ke(o.name, e.name, t[o.name]?.[e.name], n);
+		let s = `${o.name}.${e.name}`, c = Oe(o.name, e.name, t[o.name]?.[e.name], n);
 		if (c === "error") {
 			i.push(s);
 			continue;
 		}
-		if (!Ve(c)) {
+		if (!Be(c)) {
 			a.push({
 				column: s,
 				action: c
@@ -223,7 +223,7 @@ var Ee = (e) => {
 		unclassified: i,
 		invalid: a
 	};
-}, Ue = [
+}, He = [
 	{
 		name: "email",
 		re: /[\w.+-]+@[\w-]+\.[\w.-]+/
@@ -240,7 +240,7 @@ var Ee = (e) => {
 		name: "creditCard",
 		re: /\b(?:\d[ -]?){13,16}\b/
 	}
-], We = (e, t, n) => {
+], Ue = (e, t, n) => {
 	let r = [], i = /* @__PURE__ */ new Set();
 	for (let [a, o] of Object.entries(n)) {
 		if (!a.startsWith(`${t}.`) || o !== "keep") continue;
@@ -248,7 +248,7 @@ var Ee = (e) => {
 		for (let a of e) {
 			let e = a[n];
 			if (typeof e != "string" || e.length === 0) continue;
-			let o = Ue.find((t) => t.re.test(e));
+			let o = He.find((t) => t.re.test(e));
 			if (o && !i.has(n)) {
 				i.add(n), r.push({
 					table: t,
@@ -261,7 +261,7 @@ var Ee = (e) => {
 		}
 	}
 	return r;
-}, Ge = (e, t, n, r, i) => {
+}, We = (e, t, n, r, i) => {
 	let a = {};
 	for (let [o, s] of Object.entries(e)) a[o] = B(n[`${t}.${o}`] ?? "keep", {
 		value: s,
@@ -271,7 +271,7 @@ var Ee = (e) => {
 		...i?.[o] ? { columnType: i[o] } : {}
 	});
 	return a;
-}, Ke = /* @__PURE__ */ new Map([
+}, Ge = /* @__PURE__ */ new Map([
 	["_voltro_inspect_create_receipts", "inspect creation commands accepted by THIS deployment — a foreign receipt would replay or suppress a creation the target never accepted"],
 	["_voltro_isr_cache", "pages rendered by THIS deployment’s web processes — a foreign row would serve another environment’s HTML here"],
 	["_voltro_web_replicas", "heartbeats of the web processes running HERE — a foreign row advertises replicas that do not exist in the target"],
@@ -345,7 +345,8 @@ var Ee = (e) => {
 	["cluster_messages", "workflow messages in flight HERE — a foreign row makes the target run work that was started, and may be running, elsewhere"],
 	["cluster_replies", "replies to those messages — a foreign row answers a request the target never sent"],
 	["cluster_migrations", "which engine migrations ran HERE — a foreign row marks the target's engine tables migrated when they are not"]
-]), qe = /* @__PURE__ */ new Map([
+]), Ke = /* @__PURE__ */ new Map([
+	["_voltro_comment_thread_events", "the status history of the app's comment threads — belongs with those threads"],
 	["_voltro_agent_threads", "conversations the app's users had — app data"],
 	["_voltro_agent_messages", "the messages in those conversations — app data"],
 	["_voltro_prompts", "prompt definitions the app authored — app data"],
@@ -381,117 +382,165 @@ var Ee = (e) => {
 	["_voltro_comments", "the comments the app's users wrote — app data"],
 	["_voltro_comment_threads", "the threads those comments hang on — app data"],
 	["_voltro_comment_reactions", "the reactions the app's users left — app data"],
-	["_voltro_comment_reads", "which comments each user has read — app data, and losing it re-marks everything unread"]
-]), V = (e) => Ke.has(e), Je = (e) => Ke.get(e), Ye = (e, t) => {
+	["_voltro_comment_reads", "which comments each user has read — app data, and losing it re-marks everything unread"],
+	["_voltro_comment_thread_events", "the status changes the app's users made on a thread — app data"]
+]), V = (e) => Ge.has(e), qe = (e) => Ge.get(e), Je = (e, t) => {
 	if (e.length === 0) return;
-	let n = e.map((e) => `    ${e} — ${Je(e) ?? "describes this deployment"}`);
+	let n = e.map((e) => `    ${e} — ${qe(e) ?? "describes this deployment"}`);
 	return `${t} ${e.length} table(s) that describe a deployment rather than its data:\n${n.join("\n")}\n  A row from another environment is not stale there, it is a false statement about this one.`;
-}, H = class extends c.TaggedError()("BundleError", {
-	reason: c.String,
-	path: c.optional(c.String)
-}) {}, Xe = class extends c.TaggedError()("CodecError", {
-	table: c.String,
-	reason: c.String
-}) {}, Ze = class extends c.TaggedError()("IntegrityError", {
-	what: c.String,
-	expected: c.String,
-	actual: c.String
-}) {}, Qe = class extends t.TaggedError("CompressionError") {}, U = class extends c.TaggedError()("ScopeError", { reason: c.String }) {}, $e = class extends c.TaggedError()("RowsRefusedError", {
-	rows: c.Array(c.Struct({
-		table: c.String,
-		id: c.String,
-		reason: c.String,
-		derived: c.Boolean
+}, H = class extends s.TaggedError()("BundleError", {
+	reason: s.String,
+	path: s.optional(s.String)
+}) {
+	get message() {
+		return this.path === void 0 ? this.reason : `${this.reason} (${this.path})`;
+	}
+}, Ye = class extends s.TaggedError()("CodecError", {
+	table: s.String,
+	reason: s.String
+}) {}, Xe = class extends s.TaggedError()("IntegrityError", {
+	what: s.String,
+	expected: s.String,
+	actual: s.String
+}) {
+	get message() {
+		return `${this.what}: expected ${this.expected}, got ${this.actual}`;
+	}
+}, Ze = class extends t.TaggedError("CompressionError") {}, Qe = class extends s.TaggedError()("ScopeError", { reason: s.String }) {
+	get message() {
+		return this.reason;
+	}
+}, $e = class extends s.TaggedError()("RowsRefusedError", {
+	rows: s.Array(s.Struct({
+		table: s.String,
+		id: s.String,
+		reason: s.String,
+		derived: s.Boolean
 	})),
-	primaryCount: c.Number,
-	totalCount: c.Number,
-	byTable: c.Array(c.Struct({
-		table: c.String,
-		refused: c.Number,
-		primary: c.Number
+	primaryCount: s.Number,
+	totalCount: s.Number,
+	byTable: s.Array(s.Struct({
+		table: s.String,
+		refused: s.Number,
+		primary: s.Number
 	}))
-}) {}, et = class extends c.TaggedError()("SchemaDriftError", {
-	bundleFingerprint: c.String,
-	targetFingerprint: c.String,
-	diff: c.Array(c.String)
-}) {}, W = class extends t.TaggedError("NativeToolError") {
+}) {}, et = class extends s.TaggedError()("SchemaDriftError", {
+	bundleFingerprint: s.String,
+	targetFingerprint: s.String,
+	diff: s.Array(s.String)
+}) {
+	get message() {
+		return `bundle schema ${this.bundleFingerprint} does not match target ${this.targetFingerprint}: ${this.diff.join("; ")}`;
+	}
+}, U = class extends t.TaggedError("NativeToolError") {
 	get message() {
 		let e = this.stderr?.trim(), t = this.hint?.trim();
 		return `${this.tool}: ${this.reason}${e ? `\n${e}` : ""}${t ? `\n\nhint: ${t}` : ""}`;
 	}
-}, tt = class extends c.TaggedError()("MaskingError", {
-	unclassified: c.Array(c.String),
-	invalidActions: c.optional(c.Array(c.String))
-}) {}, nt = class extends c.TaggedError()("ImportModeError", {
-	mode: c.String,
-	reason: c.String
-}) {}, rt = class extends c.TaggedError()("CrossDialectError", {
-	sourceDialect: c.String,
-	targetDialect: c.String,
-	blocking: c.Array(c.String)
-}) {}, it = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", at = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.references).map((e) => ({
-	col: e.name,
-	refTable: e.references.table
-})), ot = (e, t, r) => n.gen(function* () {
-	let i = r.maxDepth ?? 12, a = new Set(r.pinned ?? []), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = /* @__PURE__ */ new Map(), u = (e) => {
+}, tt = class extends s.TaggedError()("MaskingError", {
+	unclassified: s.Array(s.String),
+	invalidActions: s.optional(s.Array(s.String))
+}) {
+	get message() {
+		let e = [];
+		return this.unclassified.length > 0 && e.push(`unclassified columns: ${this.unclassified.join(", ")}`), this.invalidActions !== void 0 && this.invalidActions.length > 0 && e.push(`invalidActions: ${this.invalidActions.join(", ")}`), `masking refused — ${e.join("; ") || "no column may be exported"}`;
+	}
+}, nt = class extends s.TaggedError()("ImportModeError", {
+	mode: s.String,
+	reason: s.String
+}) {
+	get message() {
+		return `import mode '${this.mode}' refused: ${this.reason}`;
+	}
+}, rt = class extends s.TaggedError()("CrossDialectError", {
+	sourceDialect: s.String,
+	targetDialect: s.String,
+	blocking: s.Array(s.String)
+}) {}, it = (e, t) => e.tables.find((e) => e.name === t)?.columns.find((e) => e.type === "id")?.name ?? "id", at = (e, t, r) => n.gen(function* () {
+	let i = r.maxDepth ?? 12, a = new Set(r.pinned ?? []), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = /* @__PURE__ */ new Map();
+	for (let e of t.tables) u.has(e.name) || u.set(e.name, e);
+	let d = /* @__PURE__ */ new Map();
+	for (let [e, t] of u) d.set(e, {
+		pk: t.columns.find((e) => e.type === "id")?.name ?? "id",
+		fks: t.columns.filter((e) => e.references !== void 0).map((e) => ({
+			col: e.name,
+			refTable: e.references.table
+		}))
+	});
+	let f = (e) => d.get(e)?.pk ?? "id", p = (e) => {
 		let t = s.get(e) ?? /* @__PURE__ */ new Set();
 		return s.set(e, t), t;
-	}, d = (e, t) => {
+	}, m = (e, t) => {
 		if (t == null || a.has(e) || s.get(e)?.has(t)) return;
-		let n = c.get(e) ?? /* @__PURE__ */ new Set();
-		n.add(t), c.set(e, n);
-	}, f = (e, t, n) => {
-		let r = u(e), i = a.has(e) ? void 0 : o.get(e) ?? (() => {
+		let n = l.get(e) ?? /* @__PURE__ */ new Set();
+		n.add(t), l.set(e, n);
+	}, h = (e, t, n) => {
+		let r = p(e), i = a.has(e) ? void 0 : o.get(e) ?? (() => {
 			let t = /* @__PURE__ */ new Set();
 			return o.set(e, t), t;
 		})();
 		return (e) => {
 			r.add(e[t]), i?.add(e[t]);
-			for (let t of n) d(t.refTable, e[t.col]);
+			for (let t of n) m(t.refTable, e[t.col]);
 		};
-	}, p = (r, i) => {
-		let a = f(r, it(t, r), at(t, r));
-		return l.runForEach(C(e, {
-			table: r,
-			pk: it(t, r),
-			...i === void 0 ? {} : { where: i }
-		}), (e) => n.sync(() => a(e)));
-	}, m = n.gen(function* () {
-		for (let e = 0; e < i && c.size > 0; e++) {
-			let e = [...c.entries()];
-			c.clear();
-			for (let [n, r] of e) {
-				let e = [...r].filter((e) => !s.get(n)?.has(e));
-				e.length !== 0 && (yield* p(n, b(it(t, n), e)));
+	}, g = (t, r) => {
+		let i = h(t, f(t), d.get(t)?.fks ?? []);
+		return c.runForEach(C(e, {
+			table: t,
+			pk: f(t),
+			...r === void 0 ? {} : { where: r }
+		}), (e) => n.sync(() => i(e)));
+	}, _ = n.gen(function* () {
+		for (let e = 0; e < i && l.size > 0; e++) {
+			let e = [...l.entries()];
+			l.clear();
+			for (let [t, n] of e) {
+				let e = [...n].filter((e) => !s.get(t)?.has(e));
+				if (e.length !== 0) for (let n = 0; n < e.length; n += 500) yield* g(t, y(f(t), e.slice(n, n + 500)));
 			}
 		}
 	});
-	for (let [e, t] of Object.entries(r.seeds)) yield* p(e, t);
-	if (yield* m, r.children) {
-		let e = new Set(r.children === !0 ? [...s.keys()] : r.children.roots.filter((e) => s.has(e)));
-		for (let n = 0; n < i; n++) {
-			let n = !1, r = [];
-			for (let i of t.tables) {
-				let t = i.name, a = i.columns.map((e) => ({
+	for (let [e, t] of Object.entries(r.seeds)) yield* g(e, t);
+	if (yield* _, r.children) {
+		let e = new Set(r.children === !0 ? [...s.keys()] : r.children.roots.filter((e) => s.has(e))), a = /* @__PURE__ */ new Map();
+		for (let r = 0; r < i; r++) {
+			let r = !1, i = [];
+			for (let o of t.tables) {
+				let t = o.name, c = o.columns.map((e) => ({
 					col: e.name,
 					refTable: e.references?.table
 				})).filter((t) => !!t.refTable && e.has(t.refTable) && (s.get(t.refTable)?.size ?? 0) > 0);
-				if (a.length === 0) continue;
-				let o = s.get(t)?.size ?? 0, c = a.map((e) => b(e.col, [...s.get(e.refTable)]));
-				yield* p(t, c.length === 1 ? c[0] : S(...c)), (s.get(t)?.size ?? 0) > o && !e.has(t) && r.push(t), (s.get(t)?.size ?? 0) > o && (n = !0);
+				if (c.length === 0) continue;
+				let l = s.get(t)?.size ?? 0, u = a.get(t);
+				u === void 0 && (u = /* @__PURE__ */ new Map(), a.set(t, u));
+				let d = [], f = 0, p = () => {
+					let e = d;
+					return d = [], f = 0, e.length === 0 ? n.void : g(t, e.length === 1 ? e[0] : x(...e));
+				};
+				for (let e of c) {
+					let t = u.get(e.col);
+					t === void 0 && (t = /* @__PURE__ */ new Set(), u.set(e.col, t));
+					let n = [...s.get(e.refTable)].filter((e) => !t.has(e));
+					for (let t = 0; t < n.length; t += 500) {
+						let r = n.slice(t, t + 500);
+						f + r.length > 500 && (yield* p()), d.push(y(e.col, r)), f += r.length;
+					}
+					for (let e of n) t.add(e);
+				}
+				yield* p(), (s.get(t)?.size ?? 0) > l && !e.has(t) && i.push(t), (s.get(t)?.size ?? 0) > l && (r = !0);
 			}
-			for (let t of r) e.add(t);
-			if (yield* m, !n) break;
+			for (let t of i) e.add(t);
+			if (yield* _, !r) break;
 		}
 	}
 	return o;
-}), st = (e, t) => ({
+}), ot = (e, t) => ({
 	tables: [...e.keys()],
 	predicateFor: (n) => {
 		let r = e.get(n);
-		return r ? b(it(t, n), [...r]) : void 0;
+		return r ? y(it(t, n), [...r]) : void 0;
 	}
-}), ct = "tenantId", lt = (e, t, r) => n.gen(function* () {
+}), st = "tenantId", ct = (e, t, r) => n.gen(function* () {
 	let i = t.tables.map((e) => e.name), a = new Map(t.tables.map((e) => [e.name, e]));
 	if (e.kind === "all") {
 		let t = new Set(e.exclude ?? []);
@@ -502,7 +551,7 @@ var Ee = (e) => {
 	}
 	if (e.kind === "tables") {
 		let t = e.tables ?? [], r = new Set(i), a = t.filter((e) => !r.has(e));
-		if (a.length > 0) return yield* n.fail(new U({ reason: `scope { kind: 'tables' } names ${a.length} table(s) that are not in the schema: ${a.join(", ")}. Refusing to write a bundle that silently omits them. Known tables: ${i.length}.` }));
+		if (a.length > 0) return yield* n.fail(new Qe({ reason: `scope { kind: 'tables' } names ${a.length} table(s) that are not in the schema: ${a.join(", ")}. Refusing to write a bundle that silently omits them. Known tables: ${i.length}.` }));
 		let o = new Set(t);
 		return {
 			tables: i.filter((e) => o.has(e)),
@@ -510,30 +559,30 @@ var Ee = (e) => {
 		};
 	}
 	let o = e.tenantId;
-	if (o === void 0 || o === "") return yield* n.fail(new U({ reason: "scope { kind: 'tenant' } requires a tenantId — pass --tenant <id> (CLI) or scope.tenantId (API). Refusing to fall back to an unfiltered export." }));
-	let s = r.tenantTables ? r.tenantTables.filter((e) => a.has(e)) : i.filter((e) => a.get(e)?.columns.some((e) => e.name === ct) ?? !1);
-	if (s.length === 0) return yield* n.fail(new U({ reason: r.tenantTables ? "tenant scope: none of the provided tenantTables exist in the schema — nothing to filter." : `tenant scope: no table carries a '${ct}' column — nothing to filter. A tenant export of a schema without tenant-scoped tables would be the full database; refusing.` }));
-	let c = yield* ot(r.store, t, {
-		seeds: Object.fromEntries(s.map((e) => [e, _(ct, o)])),
+	if (o === void 0 || o === "") return yield* n.fail(new Qe({ reason: "scope { kind: 'tenant' } requires a tenantId — pass --tenant <id> (CLI) or scope.tenantId (API). Refusing to fall back to an unfiltered export." }));
+	let s = r.tenantTables ? r.tenantTables.filter((e) => a.has(e)) : i.filter((e) => a.get(e)?.columns.some((e) => e.name === st) ?? !1);
+	if (s.length === 0) return yield* n.fail(new Qe({ reason: r.tenantTables ? "tenant scope: none of the provided tenantTables exist in the schema — nothing to filter." : `tenant scope: no table carries a '${st}' column — nothing to filter. A tenant export of a schema without tenant-scoped tables would be the full database; refusing.` }));
+	let c = yield* at(r.store, t, {
+		seeds: Object.fromEntries(s.map((e) => [e, g(st, o)])),
 		pinned: s,
 		children: { roots: s }
 	}), l = [...c.entries()].filter(([, e]) => e.size > 0).map(([e]) => e), u = new Set(s);
 	return {
 		tables: [...s, ...l],
-		predicateFor: (e) => u.has(e) ? _(ct, o) : c.has(e) ? b(it(t, e), [...c.get(e)]) : void 0
+		predicateFor: (e) => u.has(e) ? g(st, o) : c.has(e) ? y(it(t, e), [...c.get(e)]) : void 0
 	};
-}), ut = (e, t) => ({
+}), lt = (e, t) => ({
 	list: t,
-	open: (t) => _e(e, t)
-}), dt = (e) => ({
-	write: (t, n, r) => k(e, t, n, r),
+	open: (t) => A(e, t)
+}), ut = (e) => ({
+	write: (t, n, r) => he(e, t, n, r),
 	has: (t) => e.head(t).pipe(n.map((e) => e !== null))
-}), ft = (e, t) => n.tryPromise({
+}), dt = (e, t) => n.tryPromise({
 	try: async () => {
 		let { createWriteStream: n } = await import("node:fs"), r = await import("node:fs/promises"), { createHash: i, randomUUID: a } = await import("node:crypto"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = await import("node:path"), l = c.join(t, `.tmp-${a()}`), u = i("sha256"), d = 0, f = new s({ transform(e, t, n) {
 			u.update(e), d += e.length, n(null, e);
 		} });
-		await o(await A(e.stream), f, n(l));
+		await o(await j(e.stream), f, n(l));
 		let p = u.digest("hex"), m = c.join(t, p);
 		try {
 			await r.access(m), await r.rm(l, { force: !0 });
@@ -550,33 +599,33 @@ var Ee = (e) => {
 		reason: `asset write failed: ${String(e?.message ?? e)}`,
 		path: t
 	})
-}), pt = (e, t, r) => n.gen(function* () {
-	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), c = o("sha256"), u = ge("bundle", () => a(s)).pipe(l.tap((e) => n.sync(() => c.update(e))));
+}), ft = (e, t, r) => n.gen(function* () {
+	let i = yield* n.promise(() => import("node:path")), { createReadStream: a } = yield* n.promise(() => import("node:fs")), { createHash: o } = yield* n.promise(() => import("node:crypto")), s = i.join(t, r.sha256), l = o("sha256"), u = me("bundle", () => a(s)).pipe(c.tap((e) => n.sync(() => l.update(e))));
 	yield* e.write(r.key, u, {
 		contentType: r.contentType,
 		totalSize: r.size
 	});
-	let d = c.digest("hex");
-	if (d !== r.sha256) return yield* n.fail(new Ze({
+	let d = l.digest("hex");
+	if (d !== r.sha256) return yield* n.fail(new Xe({
 		what: `asset ${r.key}`,
 		expected: r.sha256,
 		actual: d
 	}));
-}), mt = {
+}), pt = {
 	done: () => !1,
 	mark: () => n.void
-}, ht = (e) => typeof e == "object" && !!e && e.status === 404, gt = (e) => n.gen(function* () {
-	let t = e.progress ?? mt, r = 0, i = 0, a = 0, o = 0, s = /* @__PURE__ */ new Set(), c = /* @__PURE__ */ new Set(), u = [];
-	return yield* l.runForEach(e.source.list(), (l) => (a++, t.done(l.key) || c.has(l.key) ? n.void : (c.add(l.key), e.source.open(l.key).pipe(n.map((e) => e), n.catchIf(ht, () => n.sync(() => {
-		u.push(l.key);
-	})), n.flatMap((a) => a === void 0 ? n.void : ft(a, e.assetsDir).pipe(n.flatMap((e) => {
+}, mt = (e) => typeof e == "object" && !!e && e.status === 404, ht = (e) => n.gen(function* () {
+	let t = e.progress ?? pt, r = 0, i = 0, a = 0, o = 0, s = /* @__PURE__ */ new Set(), l = /* @__PURE__ */ new Set(), u = [];
+	return yield* c.runForEach(e.source.list(), (c) => (a++, t.done(c.key) || l.has(c.key) ? n.void : (l.add(c.key), e.source.open(c.key).pipe(n.map((e) => e), n.catchIf(mt, () => n.sync(() => {
+		u.push(c.key);
+	})), n.flatMap((a) => a === void 0 ? n.void : dt(a, e.assetsDir).pipe(n.flatMap((e) => {
 		let n = {
-			key: l.key,
+			key: c.key,
 			sha256: e.sha256,
 			size: e.size,
 			contentType: e.contentType
 		};
-		return r++, i += e.size, s.has(e.sha256) || (s.add(e.sha256), o += e.size), t.mark(l.key, n);
+		return r++, i += e.size, s.has(e.sha256) || (s.add(e.sha256), o += e.size), t.mark(c.key, n);
 	}))))))).pipe(n.mapError((e) => e instanceof H ? e : new H({ reason: `asset export failed: ${String(e)}` }))), {
 		count: r,
 		totalBytes: i,
@@ -585,60 +634,65 @@ var Ee = (e) => {
 		objectBytes: o,
 		missing: u
 	};
-}), _t = (e) => ge("bundle", () => fe(e)).pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.map((e) => JSON.parse(e)), l.mapError((t) => t instanceof H ? t : new H({
+}), gt = (e) => me("bundle", () => ue(e)).pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.map((e) => JSON.parse(e)), c.mapError((t) => t instanceof H ? t : new H({
 	reason: `asset index unreadable: ${String(t)}`,
 	path: e
-}))), vt = (e) => n.gen(function* () {
-	let t = e.progress ?? mt, r = 0, i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Set();
-	return yield* l.runForEach(_t(e.indexPath), (o) => t.done(o.key) || a.has(o.key) ? n.void : (a.add(o.key), pt(e.sink, e.assetsDir, o)).pipe(n.andThen(n.sync(() => {
+}))), _t = (e) => n.gen(function* () {
+	let t = e.progress ?? pt, r = 0, i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Set();
+	return yield* c.runForEach(gt(e.indexPath), (o) => t.done(o.key) || a.has(o.key) ? n.void : (a.add(o.key), ft(e.sink, e.assetsDir, o)).pipe(n.andThen(n.sync(() => {
 		r++, i.add(o.sha256);
 	})), n.andThen(t.mark(o.key, o)))), {
 		count: r,
 		objects: i.size
 	};
-}), yt = () => typeof j.createZstdCompress == "function", bt = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : yt() ? "zstd" : "gzip", xt = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", St = (e) => e === "zstd" ? j.createZstdCompress() : e === "gzip" ? j.createGzip() : new M(), Ct = (e) => e === "zstd" ? j.createZstdDecompress() : e === "gzip" ? j.createGunzip() : new M(), wt = 1, Tt = c.Struct({
-	name: c.String,
-	file: c.String,
-	rowCount: c.Number,
-	checksum: c.String,
-	columnTypes: c.Record({
-		key: c.String,
-		value: c.String
-	}),
-	primaryKey: c.String
-}), Et = c.Struct({
-	kind: c.Literal("all", "tenant", "tables"),
-	tenantId: c.optional(c.String),
-	tables: c.optional(c.Array(c.String)),
-	exclude: c.optional(c.Array(c.String))
-}), Dt = c.Struct({
-	count: c.Number,
-	totalBytes: c.Number,
-	index: c.optional(c.String)
+}), vt = () => typeof M.createZstdCompress == "function", yt = (e) => e === "none" ? "none" : e === "gzip" ? "gzip" : vt() ? "zstd" : "gzip", bt = (e) => e === "zstd" ? ".zst" : e === "gzip" ? ".gz" : "", xt = (e) => e === "zstd" ? M.createZstdCompress() : e === "gzip" ? M.createGzip() : new ge(), St = (e) => e === "zstd" ? M.createZstdDecompress() : e === "gzip" ? M.createGunzip() : new ge(), Ct = 1, wt = s.Struct({
+	name: s.String,
+	file: s.String,
+	rowCount: s.Number,
+	checksum: s.String,
+	columnTypes: s.Record(s.String, s.String),
+	primaryKey: s.String
+}), Tt = s.Struct({
+	kind: s.Literals([
+		"all",
+		"tenant",
+		"tables"
+	]),
+	tenantId: s.optional(s.String),
+	tables: s.optional(s.Array(s.String)),
+	exclude: s.optional(s.Array(s.String))
+}), Et = s.Struct({
+	count: s.Number,
+	totalBytes: s.Number,
+	index: s.optional(s.String)
 });
-c.Struct({
-	key: c.String,
-	sha256: c.String,
-	size: c.Number,
-	contentType: c.String
+s.Struct({
+	key: s.String,
+	sha256: s.String,
+	size: s.Number,
+	contentType: s.String
 });
-var Ot = c.Struct({
-	formatVersion: c.Number,
-	createdAt: c.String,
-	source: c.Struct({
-		dialect: c.String,
-		schemaFingerprint: c.String
+var Dt = s.Struct({
+	formatVersion: s.Number,
+	createdAt: s.String,
+	source: s.Struct({
+		dialect: s.String,
+		schemaFingerprint: s.String
 	}),
-	scope: Et,
-	consistency: c.Literal("live", "snapshot"),
-	compression: c.Literal("zstd", "gzip", "none"),
-	tables: c.Array(Tt),
-	assets: Dt,
-	masking: c.optional(c.Struct({
-		policyId: c.optional(c.String),
-		transformed: c.Array(c.String)
+	scope: Tt,
+	consistency: s.Literals(["live", "snapshot"]),
+	compression: s.Literals([
+		"zstd",
+		"gzip",
+		"none"
+	]),
+	tables: s.Array(wt),
+	assets: Et,
+	masking: s.optional(s.Struct({
+		policyId: s.optional(s.String),
+		transformed: s.Array(s.String)
 	}))
-}), kt = c.encodeSync(c.parseJson(Ot)), At = c.decodeUnknownSync(c.parseJson(Ot)), jt = "manifest.json", Mt = "README.md", Nt = "data", Pt = "assets", Ft = "assets/index.ndjson", It = ".ledger.json", Lt = (e) => e.kind === "tenant" ? `tenant \`${e.tenantId}\`` : e.kind === "tables" ? `tables \`${(e.tables ?? []).join(", ")}\`` : "all tables", Rt = (e, t) => {
+}), Ot = s.encodeSync(s.fromJsonString(Dt)), kt = s.decodeUnknownSync(s.fromJsonString(Dt)), At = "manifest.json", jt = "README.md", Mt = "data", Nt = "assets", Pt = "assets/index.ndjson", Ft = ".ledger.json", It = (e) => e.kind === "tenant" ? `tenant \`${e.tenantId}\`` : e.kind === "tables" ? `tables \`${(e.tables ?? []).join(", ")}\`` : "all tables", Lt = (e, t) => {
 	let n = e.tables.reduce((e, t) => e + t.rowCount, 0), r = e.masking ? `✅ **Masked at the source** — ${e.masking.transformed.length} column(s) transformed${e.masking.policyId ? ` (policy \`${e.masking.policyId}\`)` : ""}. Personal data was replaced with realistic, referentially-consistent fakes before any byte was written.` : "⚠️ **NOT masked — this bundle contains REAL data (PII included).** Treat it as production data: do not copy it into a lower environment or share it without review. To produce a safe copy, re-export under a masking profile (`--profile`).", i = e.masking && e.masking.transformed.length > 0 ? `\n\nMasked columns: ${e.masking.transformed.map((e) => `\`${e}\``).join(", ")}.` : "", a = e.assets.count > 0 ? `${e.assets.count} object(s), ${e.assets.totalBytes} bytes` : "none", o = e.tables.map((e) => `| \`${e.name}\` | ${e.rowCount} |`).join("\n");
 	return `# Voltro data export
 
@@ -652,7 +706,7 @@ The machine-readable manifest is \`manifest.json\`; this file is a human summary
 | **Format version** | ${e.formatVersion} |
 | **Consistency** | ${e.consistency} |
 | **Compression** | ${e.compression} |
-| **Scope** | ${Lt(e.scope)} |
+| **Scope** | ${It(e.scope)} |
 | **Tables** | ${e.tables.length} |
 | **Rows (total)** | ${n} |
 | **Assets** | ${a} |
@@ -677,26 +731,25 @@ voltro data import <this-directory>
 voltro data import <this-directory> --target api --api-url <url> --token <secret>
 \`\`\`
 `;
-}, zt = i.counter("voltro_data_transfer_rows", { description: "Rows exported/imported by @voltro/data-transfer, tagged by phase + table." }), Bt = a.exponential({
-	start: .01,
-	factor: 2,
-	count: 16
-}), Vt = i.histogram("voltro_data_transfer_table_seconds", Bt, "Per-table export/import duration in seconds, tagged by phase."), G = (e, t) => {
+}, Rt = i.counter("voltro_data_transfer_rows", { description: "Rows exported/imported by @voltro/data-transfer, tagged by phase + table." }), zt = Array.from({ length: 16 }, (e, t) => .01 * 2 ** t), Bt = i.histogram("voltro_data_transfer_table_seconds", {
+	boundaries: zt,
+	description: "Per-table export/import duration in seconds, tagged by phase."
+}), W = (e, t) => {
 	if (e) try {
 		e(t);
 	} catch {}
-}, Ht = (e, t, r, a, o, s) => n.Do.pipe(n.bind("start", () => n.clockWith((e) => e.currentTimeMillis)), n.bind("result", () => s), n.tap(({ start: r, result: a }) => n.clockWith((e) => e.currentTimeMillis).pipe(n.flatMap((s) => n.zipRight(Vt.pipe(i.tagged("phase", e), i.update((s - r) / 1e3)), zt.pipe(i.tagged("phase", e), i.tagged("table", t), i.update(o(a))))))), n.map(({ result: e }) => e), n.withSpan(`data-transfer.${e}.table`, { attributes: {
+}, Vt = (e, t, r, a, o, s) => n.Do.pipe(n.bind("start", () => n.clockWith((e) => e.currentTimeMillis)), n.bind("result", () => s), n.tap(({ start: r, result: a }) => n.clockWith((e) => e.currentTimeMillis).pipe(n.flatMap((s) => n.andThen(Bt.pipe(i.withAttributes({ phase: e }), i.update((s - r) / 1e3)), Rt.pipe(i.withAttributes({ phase: e }), i.withAttributes({ table: t }), i.update(o(a))))))), n.map(({ result: e }) => e), n.withSpan(`data-transfer.${e}.table`, { attributes: {
 	table: t,
 	index: r,
 	tableCount: a,
 	phase: e
-} })), Ut = () => ({
+} })), Ht = () => ({
 	tables: {},
 	assets: {}
-}), Wt = (e) => n.tryPromise(async () => {
+}), Ut = (e) => n.tryPromise(async () => {
 	let t = await (await import("node:fs/promises")).readFile(e, "utf8");
 	return JSON.parse(t);
-}).pipe(n.orElseSucceed(Ut)), K = (e, t) => n.tryPromise({
+}).pipe(n.orElseSucceed(Ht)), G = (e, t) => n.tryPromise({
 	try: async () => {
 		let n = await import("node:fs/promises"), { randomUUID: r } = await import("node:crypto"), i = `${e}.tmp-${r()}`;
 		await n.writeFile(i, JSON.stringify(t)), await n.rename(i, e);
@@ -705,11 +758,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		reason: `ledger write failed: ${String(t?.message ?? t)}`,
 		path: e
 	})
-}), Gt = (e, t) => t in e.tables, Kt = (e, t) => t in e.assets, qt = /* @__PURE__ */ new Set([
+}), Wt = (e, t) => t in e.tables, Gt = (e, t) => t in e.assets, Kt = /* @__PURE__ */ new Set([
 	"json",
 	"array",
 	"vector"
-]), Jt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && typeof e.$v == "string", Yt = (e) => Buffer.from(e).toString("base64"), Xt = (e) => new Uint8Array(Buffer.from(e, "base64")), Zt = (e) => e instanceof Date ? e.toISOString() : typeof e == "number" ? new Date(e).toISOString() : String(e), Qt = (e, t) => e == null ? null : t !== void 0 && qt.has(t) ? e : t === "bytes" ? Yt(e) : t === "timestamp" || t === "date" ? Zt(e) : typeof e == "bigint" ? {
+]), qt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && typeof e.$v == "string", Jt = (e) => Buffer.from(e).toString("base64"), Yt = (e) => new Uint8Array(Buffer.from(e, "base64")), Xt = (e) => e instanceof Date ? e.toISOString() : typeof e == "number" ? new Date(e).toISOString() : String(e), Zt = (e, t) => e == null ? null : t !== void 0 && Kt.has(t) ? e : t === "bytes" ? Jt(e) : t === "timestamp" || t === "date" ? Xt(e) : typeof e == "bigint" ? {
 	$v: "bigint",
 	d: e.toString()
 } : typeof e == "number" && !Number.isFinite(e) ? {
@@ -720,30 +773,30 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	d: e.toISOString()
 } : e instanceof Uint8Array ? {
 	$v: "bytes",
-	d: Yt(e)
-} : e, $t = (e) => {
+	d: Jt(e)
+} : e, Qt = (e) => {
 	switch (e.$v) {
 		case "bigint": return BigInt(e.d);
 		case "number": return Number(e.d);
 		case "date": return new Date(e.d);
-		case "bytes": return Xt(e.d);
+		case "bytes": return Yt(e.d);
 		default: return e;
 	}
-}, en = (e, t) => e == null ? null : t !== void 0 && qt.has(t) ? e : Jt(e) ? $t(e) : t === "bytes" ? Xt(e) : t === "timestamp" || t === "date" ? new Date(e) : e, tn = (e, t) => {
+}, $t = (e, t) => e == null ? null : t !== void 0 && Kt.has(t) ? e : qt(e) ? Qt(e) : t === "bytes" ? Yt(e) : t === "timestamp" || t === "date" ? new Date(e) : e, en = (e, t) => {
 	let n = {};
-	for (let [r, i] of Object.entries(e)) n[r] = Qt(i, t[r]);
+	for (let [r, i] of Object.entries(e)) n[r] = Zt(i, t[r]);
 	return n;
-}, nn = (e, t) => {
+}, tn = (e, t) => {
 	let n = {};
-	for (let [r, i] of Object.entries(e)) n[r] = en(i, t[r]);
+	for (let [r, i] of Object.entries(e)) n[r] = $t(i, t[r]);
 	return n;
-}, rn = new TextEncoder(), an = (e, t) => e.pipe(l.map((e) => rn.encode(`${JSON.stringify(tn(e, t))}\n`))), on = (e, t, r) => e.pipe(l.decodeText(), l.splitLines, l.filter((e) => e.trim().length > 0), l.mapEffect((e) => n.try({
-	try: () => nn(JSON.parse(e), r),
-	catch: (e) => new Xe({
+}, nn = new TextEncoder(), rn = (e, t) => e.pipe(c.map((e) => nn.encode(`${JSON.stringify(en(e, t))}\n`))), an = (e, t, r) => e.pipe(c.decodeText(), c.splitLines, c.filter((e) => e.trim().length > 0), c.mapEffect((e) => n.try({
+	try: () => tn(JSON.parse(e), r),
+	catch: (e) => new Ye({
 		table: t,
 		reason: String(e?.message ?? e)
 	})
-}))), sn = (e, t) => {
+}))), on = (e, t) => {
 	let n = new Set(e), r = /* @__PURE__ */ new Map();
 	for (let e of t.tables) {
 		if (!n.has(e.name)) continue;
@@ -763,48 +816,48 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	};
 	for (let t of e) n.has(t) && s(t);
 	return i;
-}, q = (e) => {
+}, K = (e) => {
 	let t = e, n = [];
 	typeof t?._tag == "string" && t._tag !== "" && n.push(t._tag);
 	let r = typeof t?.message == "string" ? t.message.trim() : "";
-	if (r === "" ? t?.cause !== void 0 && t.cause !== null && n.push(q(t.cause)) : n.push(r), n.length === 0) {
+	if (r === "" ? t?.cause !== void 0 && t.cause !== null && n.push(K(t.cause)) : n.push(r), n.length === 0) {
 		let t = String(e ?? "").trim();
-		return t === "" || t === "[object Object]" ? cn(e) : t;
+		return t === "" || t === "[object Object]" ? sn(e) : t;
 	}
 	return n.join(": ");
-}, cn = (e) => {
+}, sn = (e) => {
 	try {
 		let t = JSON.stringify(e);
 		return t === void 0 || t === "{}" ? "unknown error (no message, cause or tag)" : t;
 	} catch {
 		return "unknown error (not serialisable)";
 	}
-}, ln = (e, t) => {
+}, cn = (e, t) => {
 	let n = e.tables.find((e) => e.name === t), r = {};
 	for (let e of n?.columns ?? []) e.generatedAs === void 0 && (r[e.name] = e.type);
 	return r;
-}, un = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.generatedAs !== void 0).map((e) => e.name), dn = (e, t) => {
+}, ln = (e, t) => (e.tables.find((e) => e.name === t)?.columns ?? []).filter((e) => e.generatedAs !== void 0).map((e) => e.name), un = (e, t) => {
 	if (t.length === 0) return e;
 	let n = { ...e };
 	for (let e of t) delete n[e];
 	return n;
-}, fn = (e, t) => {
+}, dn = (e, t) => {
 	let n = e.tables.find((e) => e.name === t);
 	if (n === void 0) return { refusal: `${t}: not in the schema snapshot, so its primary key is unknown.` };
 	let r = n.columns.find((e) => e.type === "id");
 	if (r !== void 0) return { column: r.name };
 	let i = n.indexes.find((e) => e.name === `${t}_pkey`)?.columns ?? n.primaryKey ?? [];
 	return i.length === 1 ? { column: i[0] } : i.length > 1 ? { refusal: `${t}: composite primary key (${i.join(", ")}). Keyset export orders by ONE column; ordering by the first alone would split equal values across pages and drop or duplicate rows. Exclude this table from the scope, or give it a single-column key.` } : { refusal: `${t}: no primary key, so there is no stable order to paginate by. A keyset export would return rows in an order the database may change between pages. Exclude this table from the scope.` };
-}, pn = (e, t, r) => n.tryPromise({
+}, fn = (e, t, r) => n.tryPromise({
 	try: async () => {
-		let { createWriteStream: n } = await import("node:fs"), i = await import("node:fs/promises"), { createHash: a, randomUUID: o } = await import("node:crypto"), { pipeline: s } = await import("node:stream/promises"), { Readable: c, Transform: u } = await import("node:stream"), d = a("sha256"), f = 0, p = new u({ transform(e, t, n) {
+		let { createWriteStream: n } = await import("node:fs"), i = await import("node:fs/promises"), { createHash: a, randomUUID: o } = await import("node:crypto"), { pipeline: s } = await import("node:stream/promises"), { Readable: l, Transform: u } = await import("node:stream"), d = a("sha256"), f = 0, p = new u({ transform(e, t, n) {
 			d.update(e);
 			let r = e;
 			for (let e = 0; e < r.length; e++) r[e] === 10 && f++;
 			n(null, e);
-		} }), m = c.fromWeb(l.toReadableStream(e)), h = `${t}.tmp-${o()}`;
+		} }), m = l.fromWeb(c.toReadableStream(e)), h = `${t}.tmp-${o()}`;
 		try {
-			await s(m, p, St(r), n(h)), await i.rename(h, t);
+			await s(m, p, xt(r), n(h)), await i.rename(h, t);
 		} catch (e) {
 			throw await i.rm(h, { force: !0 }).catch(() => {}), e;
 		}
@@ -814,26 +867,26 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		};
 	},
 	catch: (e) => new H({
-		reason: `write table failed: ${q(e)}`,
+		reason: `write table failed: ${K(e)}`,
 		path: t
 	})
-}), mn = (e, t) => n.tryPromise({
+}), pn = (e, t) => n.tryPromise({
 	try: async () => {
 		await (await import("node:fs/promises")).appendFile(e, `${t}\n`);
 	},
 	catch: (t) => new H({
-		reason: `append failed: ${q(t)}`,
+		reason: `append failed: ${K(t)}`,
 		path: e
 	})
-}), hn = (e, t) => n.gen(function* () {
+}), mn = (e, t) => n.gen(function* () {
 	let r = [], i = t.ordered.length;
 	for (let a = 0; a < t.ordered.length; a++) {
-		let o = t.ordered[a], s = ln(t.snapshot, o), c = fn(t.snapshot, o);
-		if ("refusal" in c) return yield* n.fail(new U({ reason: `export: ${c.refusal}` }));
-		let u = c.column, d = `${Nt}/${o}.ndjson${xt(t.compression)}`;
-		if (Gt(t.ledger, o)) {
+		let o = t.ordered[a], s = cn(t.snapshot, o), l = dn(t.snapshot, o);
+		if ("refusal" in l) return yield* n.fail(new Qe({ reason: `export: ${l.refusal}` }));
+		let u = l.column, d = `${Mt}/${o}.ndjson${bt(t.compression)}`;
+		if (Wt(t.ledger, o)) {
 			let e = t.ledger.tables[o];
-			G(t.onProgress, {
+			W(t.onProgress, {
 				phase: "export",
 				table: o,
 				index: a,
@@ -851,7 +904,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			});
 			continue;
 		}
-		G(t.onProgress, {
+		W(t.onProgress, {
 			phase: "export",
 			table: o,
 			index: a,
@@ -865,11 +918,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			chunkSize: t.chunkSize,
 			retry: t.retry,
 			...f === void 0 ? {} : { where: f }
-		}), m = un(t.snapshot, o), h = m.length === 0 ? p : p.pipe(l.map((e) => dn(e, m))), g = t.mask ? h.pipe(l.map((e) => Ge(e, o, t.mask.actions, t.mask.seed, s))) : h, { rowCount: _, checksum: v } = yield* Ht("export", o, a, i, (e) => e.rowCount, pn(an(g, s), t.bundleFile(d), t.compression));
+		}), m = ln(t.snapshot, o), h = m.length === 0 ? p : p.pipe(c.map((e) => un(e, m))), g = t.mask ? h.pipe(c.map((e) => We(e, o, t.mask.actions, t.mask.seed, s))) : h, { rowCount: _, checksum: v } = yield* Vt("export", o, a, i, (e) => e.rowCount, fn(rn(g, s), t.bundleFile(d), t.compression));
 		t.ledger.tables[o] = {
 			rowCount: _,
 			checksum: v
-		}, yield* K(t.ledgerPath, t.ledger), G(t.onProgress, {
+		}, yield* G(t.ledgerPath, t.ledger), W(t.onProgress, {
 			phase: "export",
 			table: o,
 			index: a,
@@ -887,36 +940,36 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return r;
-}), gn = (e) => ({
+}), hn = (e) => ({
 	_tag: "RawSqlFragment",
 	strings: [e],
 	values: []
-}), _n = (t, i, a) => n.tryPromise({
+}), gn = (t, i, a) => n.tryPromise({
 	try: () => t.transactional(async (t) => {
-		if (t.raw) for (let e of Ee(i)) await t.raw(gn(e));
+		if (t.raw) for (let e of Te(i)) await t.raw(hn(e));
 		let o = await n.runPromiseExit(a(t));
 		if (r.isFailure(o)) throw Error(e.pretty(o.cause));
 		return o.value;
 	}),
-	catch: (e) => e instanceof H ? e : new H({ reason: `snapshot export failed: ${q(e)}` })
-}), vn = (e) => n.gen(function* () {
-	let t = e.scope ?? { kind: "all" }, r = bt(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, o = s.exponential("50 millis").pipe(s.jittered, s.intersect(s.recurs(a))), c = yield* n.promise(() => import("node:path")), l = (t) => c.join(e.outDir, t);
+	catch: (e) => e instanceof H ? e : new H({ reason: `snapshot export failed: ${K(e)}` })
+}), _n = (e) => n.gen(function* () {
+	let t = e.scope ?? { kind: "all" }, r = yt(e.compression), i = e.chunkSize ?? 1e3, a = e.retryTimes ?? 5, s = o.max([o.exponential("50 millis").pipe(o.jittered), o.recurs(a)]), c = yield* n.promise(() => import("node:path")), l = (t) => c.join(e.outDir, t);
 	yield* n.tryPromise({
 		try: async () => {
 			let t = await import("node:fs/promises");
-			await t.mkdir(l(Nt), { recursive: !0 }), e.assets && await t.mkdir(l(Pt), { recursive: !0 });
+			await t.mkdir(l(Mt), { recursive: !0 }), e.assets && await t.mkdir(l(Nt), { recursive: !0 });
 		},
 		catch: (t) => new H({
-			reason: `mkdir failed: ${q(t)}`,
+			reason: `mkdir failed: ${K(t)}`,
 			path: e.outDir
 		})
 	});
-	let u = l(It), d = yield* Wt(u), f = e.subset ? st(yield* ot(e.store, e.snapshot, e.subset), e.snapshot) : yield* lt(t, e.snapshot, {
+	let u = l(Ft), d = yield* Ut(u), f = e.subset ? ot(yield* at(e.store, e.snapshot, e.subset), e.snapshot) : yield* ct(t, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
-	}), p = sn(f.tables, e.snapshot), m = e.consistency ?? "live", h, g;
+	}), p = on(f.tables, e.snapshot), m = e.consistency ?? "live", h, g;
 	if (e.masking) {
-		let t = e.classification ?? Oe(e.snapshot), r = He(p.map((t) => ({
+		let t = e.classification ?? De(e.snapshot), r = Ve(p.map((t) => ({
 			name: t,
 			columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 				name: e.name,
@@ -943,20 +996,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		resolved: f,
 		compression: r,
 		chunkSize: i,
-		retry: o,
+		retry: s,
 		ledger: d,
 		ledgerPath: u,
 		bundleFile: l,
 		...g ? { mask: g } : {},
 		...e.onProgress ? { onProgress: e.onProgress } : {}
-	}, v = m === "snapshot" ? yield* _n(e.store, e.dialect, (e) => hn(e, _)) : yield* hn(e.store, _), y = 0, b = 0;
+	}, v = m === "snapshot" ? yield* gn(e.store, e.dialect, (e) => mn(e, _)) : yield* mn(e.store, _), y = 0, b = 0;
 	if (e.assets) {
-		let t = l(Ft), r = yield* gt({
+		let t = l(Pt), r = yield* ht({
 			source: e.assets,
-			assetsDir: l(Pt),
+			assetsDir: l(Nt),
 			progress: {
 				done: (e) => e in d.assets,
-				mark: (e, r) => (d.assets[e] = !0, mn(t, JSON.stringify(r)).pipe(n.andThen(K(u, d))))
+				mark: (e, r) => (d.assets[e] = !0, pn(t, JSON.stringify(r)).pipe(n.andThen(G(u, d))))
 			}
 		});
 		y = r.count, b = r.totalBytes, r.missing.length > 0 && (yield* n.logWarning(`${r.missing.length} of ${r.missing.length + r.count} blob reference(s) point at objects the storage provider does not have; they are NOT in this bundle and no import can bring them back. e.g. ${r.missing.slice(0, 3).map((e) => `'${e}'`).join(", ")}` + (r.missing.length > 3 ? `, and ${r.missing.length - 3} more` : "")));
@@ -966,7 +1019,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		createdAt: e.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
 		source: {
 			dialect: e.dialect,
-			schemaFingerprint: w(e.snapshot)
+			schemaFingerprint: ie(e.snapshot)
 		},
 		scope: t,
 		consistency: m,
@@ -975,7 +1028,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		assets: y > 0 ? {
 			count: y,
 			totalBytes: b,
-			index: Ft
+			index: Pt
 		} : {
 			count: 0,
 			totalBytes: 0
@@ -984,23 +1037,23 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	};
 	return yield* n.tryPromise({
 		try: async () => {
-			await (await import("node:fs/promises")).writeFile(l(jt), kt(x));
+			await (await import("node:fs/promises")).writeFile(l(At), Ot(x));
 		},
 		catch: (e) => new H({
-			reason: `manifest write failed: ${q(e)}`,
-			path: jt
+			reason: `manifest write failed: ${K(e)}`,
+			path: At
 		})
 	}), yield* n.tryPromise({
 		try: async () => {
 			let e = await import("node:fs/promises"), t = await import("node:os");
-			await e.writeFile(l(Mt), Rt(x, { hostname: t.hostname() }));
+			await e.writeFile(l(jt), Lt(x, { hostname: t.hostname() }));
 		},
 		catch: (e) => new H({
-			reason: `readme write failed: ${q(e)}`,
-			path: Mt
+			reason: `readme write failed: ${K(e)}`,
+			path: jt
 		})
 	}), x;
-}), yn = (e, t) => {
+}), vn = (e, t) => {
 	let n = new Set(t), r = [];
 	for (let t of e.tables) if (!n.has(t.name)) for (let e of t.columns) {
 		let i = e.references?.table;
@@ -1011,7 +1064,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return r;
-}, bn = (e) => {
+}, yn = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) t.set(n.from, [...t.get(n.from) ?? [], n]);
 	let n = [...t.entries()].map(([e, t]) => {
@@ -1019,7 +1072,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		return `  ${e} (${n} row${n === 1 ? "" : "s"}): ${r}`;
 	});
 	return `replace cannot empty this target: ${t.size} table(s) OUTSIDE the bundle hold rows that reference tables INSIDE it. Emptying the bundle's tables would leave those rows pointing at nothing, and the bundle cannot restore them.\n${n.join("\n")}\nNothing has been deleted. Either re-export with a scope that includes those tables, or use --mode upsert if those rows are meant to survive.`;
-}, xn = (e) => {
+}, bn = (e) => {
 	switch (e) {
 		case "id":
 		case "text":
@@ -1038,12 +1091,12 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "raw": return "raw";
 		default: return "string";
 	}
-}, Sn = {
+}, xn = {
 	vector: /* @__PURE__ */ new Set(["postgres"]),
 	array: /* @__PURE__ */ new Set(["postgres"]),
 	interval: /* @__PURE__ */ new Set(["postgres"])
-}, Cn = (e, t, n, r) => {
-	let i = xn(n);
+}, Sn = (e, t, n, r) => {
+	let i = bn(n);
 	if (i === "raw") return {
 		table: e,
 		column: t,
@@ -1051,7 +1104,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `raw() is verbatim source-dialect SQL — it cannot be assumed valid on ${r}`
 	};
-	let a = Sn[i];
+	let a = xn[i];
 	return !a || a.has(r) ? null : i === "array" || i === "interval" ? {
 		table: e,
 		column: t,
@@ -1065,15 +1118,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		severity: "block",
 		reason: `${i} columns require a ${[...a].join("/")} target; ${r} has no compatible column type`
 	};
-}, wn = (e, t, n) => {
+}, Cn = (e, t, n) => {
 	if (t === n) return [];
 	let r = [];
 	for (let t of e) for (let [e, i] of Object.entries(t.columnTypes)) {
-		let a = Cn(t.name, e, i, n);
+		let a = Sn(t.name, e, i, n);
 		a && r.push(a);
 	}
 	return r;
-}, Tn = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, En = (e) => {
+}, wn = (e) => `[${e.severity}] ${e.table}.${e.column} (${e.type}): ${e.reason}`, Tn = (e) => {
 	let t = e.constraint ?? e.column, n = t === void 0 ? "" : ` ${t}`;
 	switch (e.kind) {
 		case "foreignKey": return `foreign key${n}: the referenced row does not exist (import it first, or check the bundle's table order)`;
@@ -1082,36 +1135,35 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "notNull": return `not-null constraint${n}: the column requires a value`;
 		case "check": return `check constraint${n}: the row does not satisfy it`;
 	}
-}, Dn = (e) => {
+}, En = (e) => {
 	let t = [e.dbCode, e.dbErrno ?? e.dbNumber].filter((e) => e !== void 0).map(String);
 	return t.length > 0 ? t.join("/") : void 0;
-}, On = "Failed to execute statement", kn = (e) => {
+}, Dn = "Failed to execute statement", On = (e) => {
 	let t = (e.split("\n", 1)[0] ?? "").trim();
-	for (; t.startsWith("(FiberFailure)");) t = t.slice(14).trim();
-	return t === `SqlError: ${On}` ? On : t;
-}, An = (e) => {
+	return t === `SqlError: ${Dn}` ? Dn : t;
+}, kn = (e) => {
 	let t = String(e?.stack ?? e), n = t.length <= 1200 ? t : `${t.slice(0, 1200)}…`, r = (e, t) => ({
 		reason: e.length <= 300 ? e : `${e.slice(0, 300)}…`,
 		unclassified: t,
 		raw: n
-	}), i = v(e), a = m(i), o = Dn(i), s = o === void 0 ? "" : ` [${o}]`;
-	if (a !== void 0) return r(`${En(a)}${s}`, !1);
-	let c = typeof i.dbMessage == "string" ? i.dbMessage : void 0, l = e?.message, u = kn(typeof l == "string" && l.length > 0 ? l : String(e)), d = c !== void 0 && c !== u && !c.startsWith("SqlError:") ? c : u, f = typeof i.dbCauseChain == "string" ? i.dbCauseChain : void 0, p = f !== void 0 && /[←‖]/.test(f) ? ` (via ${f})` : "";
-	return r(d === On || d.length === 0 ? `the database refused the write and the driver gave no detail${s}${p}` : `${d}${s}`, d === On || d.length === 0);
-}, jn = (e) => An(e).reason, Mn = (e) => {
-	let t = v(e), n = m(t);
+	}), i = _(e), a = p(i), o = En(i), s = o === void 0 ? "" : ` [${o}]`;
+	if (a !== void 0) return r(`${Tn(a)}${s}`, !1);
+	let c = typeof i.dbMessage == "string" ? i.dbMessage : void 0, l = e?.message, u = On(typeof l == "string" && l.length > 0 ? l : String(e)), d = c !== void 0 && c !== u && !c.startsWith("SqlError:") ? c : u, f = typeof i.dbCauseChain == "string" ? i.dbCauseChain : void 0, m = f !== void 0 && /[←‖]/.test(f) ? ` (via ${f})` : "";
+	return r(d === Dn || d.length === 0 ? `the database refused the write and the driver gave no detail${s}${m}` : `${d}${s}`, d === Dn || d.length === 0);
+}, An = (e) => kn(e).reason, jn = (e) => {
+	let t = _(e), n = p(t);
 	if (n?.kind === "foreignKeyInUse") {
-		let e = n.constraint ?? n.column, r = e === void 0 ? "" : ` ${e}`, i = Dn(t);
+		let e = n.constraint ?? n.column, r = e === void 0 ? "" : ` ${e}`, i = En(t);
 		return `foreign key${r}: rows elsewhere still reference this table${i === void 0 ? "" : ` [${i}]`}`;
 	}
-	return jn(e);
-}, Nn = f, J = (e) => `${Nn}${e}`, Pn = (e) => typeof e.run == "function", Fn = (e) => `staging is not available for this run — loading directly into the target instead: ${e}\n  The load therefore holds the destructive transaction open for its whole duration, so a
+	return An(e);
+}, Mn = d, q = (e) => `${Mn}${e}`, Nn = (e) => typeof e.run == "function", Pn = (e) => `staging is not available for this run — loading directly into the target instead: ${e}\n  The load therefore holds the destructive transaction open for its whole duration, so a
   process that dies mid-load depends on the database rolling it back. The rollback capture
-  written before the first delete is what covers that case.`, In = /^[a-zA-Z_][a-zA-Z0-9_]*$/, Y = (e, t) => {
-	if (!In.test(e)) throw Error(`refusing to build SQL for the table name ${JSON.stringify(e)}: it is outside the identifier class the framework allows. A name from a bundle manifest reaches this concatenation, so it is checked here rather than assumed to still be what the declaration validated.`);
+  written before the first delete is what covers that case.`, Fn = /^[a-zA-Z_][a-zA-Z0-9_]*$/, J = (e, t) => {
+	if (!Fn.test(e)) throw Error(`refusing to build SQL for the table name ${JSON.stringify(e)}: it is outside the identifier class the framework allows. A name from a bundle manifest reaches this concatenation, so it is checked here rather than assumed to still be what the declaration validated.`);
 	return t === "mysql" || t === "mariadb" ? `\`${e}\`` : t === "mssql" ? `[${e}]` : `"${e}"`;
-}, Ln = (e, t) => {
-	let n = Y(e, t), r = Y(J(e), t);
+}, In = (e, t) => {
+	let n = J(e, t), r = J(q(e), t);
 	switch (t) {
 		case "postgres": return `CREATE TABLE ${r} (LIKE ${n})`;
 		case "mysql":
@@ -1119,20 +1171,20 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		case "sqlite": return `CREATE TABLE ${r} AS SELECT * FROM ${n} WHERE 0`;
 		case "mssql": return `SELECT * INTO ${r} FROM ${n} WHERE 1 = 0`;
 	}
+}, Ln = (e, t) => {
+	let n = J(q(e), t);
+	return t === "mssql" ? `IF OBJECT_ID('${q(e)}', 'U') IS NOT NULL DROP TABLE ${n}` : `DROP TABLE IF EXISTS ${n}`;
 }, Rn = (e, t) => {
-	let n = Y(J(e), t);
-	return t === "mssql" ? `IF OBJECT_ID('${J(e)}', 'U') IS NOT NULL DROP TABLE ${n}` : `DROP TABLE IF EXISTS ${n}`;
-}, zn = (e, t) => {
 	let n = t === "mysql" || t === "mariadb", r = [];
 	n && r.push("SET FOREIGN_KEY_CHECKS = 0");
-	for (let n of [...e].reverse()) r.push(`DELETE FROM ${Y(n.name, t)}`);
+	for (let n of [...e].reverse()) r.push(`DELETE FROM ${J(n.name, t)}`);
 	for (let n of e) {
 		if (n.columns.length === 0) throw Error(`refusing to build a swap for '${n.name}' with no columns: an empty list would have to mean \`SELECT *\`, which is the shape that fails on a generated column.`);
-		let e = n.columns.map((e) => Y(e, t)).join(", ");
-		r.push(`INSERT INTO ${Y(n.name, t)} (${e}) SELECT ${e} FROM ${Y(J(n.name), t)}`);
+		let e = n.columns.map((e) => J(e, t)).join(", ");
+		r.push(`INSERT INTO ${J(n.name, t)} (${e}) SELECT ${e} FROM ${J(q(n.name), t)}`);
 	}
 	return n && r.push("SET FOREIGN_KEY_CHECKS = 1"), r;
-}, Bn = (e, t) => {
+}, zn = (e, t) => {
 	let n = [], r = () => {
 		for (let e of n) t.unregisterTable(e);
 	};
@@ -1140,7 +1192,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		for (let r of e) {
 			let e = t.getTable(r);
 			if (e === void 0) continue;
-			let i = J(r);
+			let i = q(r);
 			t.registerTable({
 				...e,
 				tableName: i,
@@ -1154,7 +1206,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		staged: n,
 		undo: r
 	};
-}, Vn = (e, t) => {
+}, Bn = (e, t) => {
 	let n = new Set(t), r = [];
 	for (let t of e.tables) {
 		if (!n.has(t.name)) continue;
@@ -1171,22 +1223,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	}
 	return r;
-}, Hn = (e, t) => {
-	let n = Y(J(e.from), t), r = Y(J(e.to), t), i = Y(e.column, t), a = Y(e.toColumn, t);
-	return `SELECT ${Y(e.primaryKey, t)} AS pk, ${i} AS value FROM ${n} c WHERE ${i} IS NOT NULL AND NOT EXISTS (SELECT 1 FROM ${r} p WHERE p.${a} = c.${i})`;
-}, Un = (e) => {
+}, Vn = (e, t) => {
+	let n = J(q(e.from), t), r = J(q(e.to), t), i = J(e.column, t), a = J(e.toColumn, t);
+	return `SELECT ${J(e.primaryKey, t)} AS pk, ${i} AS value FROM ${n} c WHERE ${i} IS NOT NULL AND NOT EXISTS (SELECT 1 FROM ${r} p WHERE p.${a} = c.${i})`;
+}, Hn = (e) => {
 	if (e.length === 0) return;
 	let t = e.slice(0, 20), n = t.map((e) => `    ${e.table}.${e.primaryKey}: ${e.column} = ${JSON.stringify(e.value)} — no such row in ${e.references}`);
 	return `the swap could not run: ${e.length} row(s) in the bundle reference a row the bundle does not carry.\n${n.join("\n")}\n` + (e.length > t.length ? `    … and ${e.length - t.length} more\n` : "") + "  The target is UNCHANGED — the swap runs in one transaction and none of it committed.\n  Every offending row is listed above rather than only the first, so this can be fixed in one pass.";
-}, Wn = async (e, t) => {
-	t.length !== 0 && await e.run(N.SqlClient.pipe(n.flatMap((e) => n.forEach(t, (t) => e.unsafe(t), { discard: !0 }))));
+}, Un = async (e, t) => {
+	t.length !== 0 && await e.run(ve.SqlClient.pipe(n.flatMap((e) => n.forEach(t, (t) => e.unsafe(t), { discard: !0 }))));
+}, Wn = async (e, t, r) => {
+	let i = Rn(t, r);
+	i.length !== 0 && await e.run(ve.SqlClient.pipe(n.flatMap((e) => e.withTransaction(n.forEach(i, (t) => e.unsafe(t), { discard: !0 })))));
 }, Gn = async (e, t, r) => {
-	let i = zn(t, r);
-	i.length !== 0 && await e.run(N.SqlClient.pipe(n.flatMap((e) => e.withTransaction(n.forEach(i, (t) => e.unsafe(t), { discard: !0 })))));
-}, Kn = async (e, t, r) => {
 	let i = [];
 	for (let a of t) {
-		let t = await e.run(N.SqlClient.pipe(n.flatMap((e) => e.unsafe(Hn(a, r)))));
+		let t = await e.run(ve.SqlClient.pipe(n.flatMap((e) => e.unsafe(Vn(a, r)))));
 		for (let e of t) i.push({
 			table: a.from,
 			primaryKey: String(e.pk ?? ""),
@@ -1196,14 +1248,14 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		});
 	}
 	return i;
-}, qn = (e, t) => {
+}, Kn = (e, t) => {
 	let n = new Map(t.map((e, t) => [e, t]));
 	return e.filter((e) => {
 		if (e.from === e.to) return !1;
 		let t = n.get(e.from), r = n.get(e.to);
 		return t === void 0 || r === void 0 ? !1 : r > t;
 	});
-}, Jn = (e) => e === "mysql" || e === "mariadb", Yn = (e) => {
+}, qn = (e) => e === "mysql" || e === "mariadb", Jn = (e) => {
 	if (e.mode !== "replace") return {
 		active: !1,
 		tables: [],
@@ -1253,7 +1305,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		tables: [],
 		blocker: "every table in the bundle is one that describes a deployment, so there is nothing for a staged swap to move."
 	};
-	let s = o.map((e) => e.name), c = Jn(t) ? [] : qn(Vn(n, s), s);
+	let s = o.map((e) => e.name), c = qn(t) ? [] : Kn(Bn(n, s), s);
 	return c.length > 0 ? {
 		active: !1,
 		tables: [],
@@ -1262,7 +1314,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		active: !0,
 		tables: o
 	};
-}, Xn = (e) => n.gen(function* () {
+}, Yn = (e) => n.gen(function* () {
 	if (e.mode !== "replace" || e.dir === void 0 || e.tables.length === 0) return;
 	if (e.snapshot === void 0) return yield* n.fail(new H({
 		reason: "rollback capture needs the TARGET's schema, and this run has none.\n  `--mode replace` empties the target first, so a run without a capture can leave it\n  emptied and unfilled if the process does not survive to roll back. Pass the target\n  snapshot, or `--no-rollback` to accept that risk deliberately.",
@@ -1275,7 +1327,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	if (t.tables.length === 0) return;
 	e.onWarn?.(`capturing the target's current rows before emptying it → ${e.dir}\n  This is what a failed replace is restored FROM. It is written before the first delete,
   so it survives a run whose process does not.`);
-	let r = yield* vn({
+	let r = yield* _n({
 		store: e.store,
 		snapshot: t,
 		dialect: e.dialect ?? "unknown",
@@ -1291,41 +1343,46 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		rows: r.tables.reduce((e, t) => e + t.rowCount, 0),
 		tables: r.tables.length
 	};
-}), Zn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, Qn = (e, t) => e.tables.find((e) => e.name === t), $n = (e, t) => new Map((Qn(e, t)?.columns ?? []).map((e) => [e.name, e])), er = /__dropped_\d+$/, tr = (e, t) => {
-	let n = [];
-	for (let r of [...e.tables].sort((e, t) => e.name.localeCompare(t.name))) {
-		if (Qn(t, r.name) === void 0) {
-			n.push(`table '${r.name}' is in the bundle but MISSING from the target — its rows have nowhere to go`);
+}), Xn = (e) => `rollback capture: ${e.rows} row(s) across ${e.tables} table(s) → ${e.dir}\n  If this run does not finish, restore with:  voltro data import ${e.dir} --mode replace`, Zn = /__dropped_\d+$/, Qn = (e, t) => {
+	let n = [], r = /* @__PURE__ */ new Map();
+	for (let e of t.tables) {
+		let t = e.name;
+		r.has(t) || r.set(t, e);
+	}
+	for (let t of [...e.tables].sort((e, t) => e.name.localeCompare(t.name))) {
+		let e = r.get(t.name);
+		if (e === void 0) {
+			n.push(`table '${t.name}' is in the bundle but MISSING from the target — its rows have nowhere to go`);
 			continue;
 		}
-		let e = $n(t, r.name), i = new Map(r.columns.map((e) => [e.name, e]));
-		for (let [t, a] of i) {
-			let i = e.get(t);
-			if (i === void 0) {
-				n.push(er.test(t) ? `${r.name}.${t}: a soft-dropped column, present only in the SOURCE — reclaim it there (voltro db gc-snapshots --before <date>) or re-export without it; the target is not missing anything` : `${r.name}.${t}: in the bundle, MISSING from the target — the value has nowhere to go`);
+		let i = new Map(e.columns.map((e) => [e.name, e])), a = new Map(t.columns.map((e) => [e.name, e]));
+		for (let [e, r] of a) {
+			let a = i.get(e);
+			if (a === void 0) {
+				n.push(Zn.test(e) ? `${t.name}.${e}: a soft-dropped column, present only in the SOURCE — reclaim it there (voltro db gc-snapshots --before <date>) or re-export without it; the target is not missing anything` : `${t.name}.${e}: in the bundle, MISSING from the target — the value has nowhere to go`);
 				continue;
 			}
-			i.type !== a.type && n.push(`${r.name}.${t}: type '${a.type}' (bundle) vs '${i.type}' (target)`);
+			a.type !== r.type && n.push(`${t.name}.${e}: type '${r.type}' (bundle) vs '${a.type}' (target)`);
 		}
-		for (let [t, a] of e) i.has(t) || !a.nullable && !a.hasDefault && n.push(`${r.name}.${t}: the target requires it (NOT NULL, no default) and the bundle carries no value — every row of this table would fail`);
+		for (let [e, r] of i) a.has(e) || !r.nullable && !r.hasDefault && n.push(`${t.name}.${e}: the target requires it (NOT NULL, no default) and the bundle carries no value — every row of this table would fail`);
 	}
 	return n.length > 30 ? [...n.slice(0, 30), `… and ${n.length - 30} more difference(s)`] : n;
-}, nr = (e, t, n) => {
-	let r = w(t);
+}, $n = (e, t, n) => {
+	let r = ie(t);
 	if (r === e || n === void 0) return {
 		drifted: !1,
 		bundleFingerprint: e,
 		targetFingerprint: r,
 		diff: []
 	};
-	let i = tr(n, t);
+	let i = Qn(n, t);
 	return {
 		drifted: i.length > 0,
 		bundleFingerprint: e,
 		targetFingerprint: r,
 		diff: i
 	};
-}, rr = 2e3, ir = 2e3, ar = 200, or = /* @__PURE__ */ new Set([
+}, er = 2e3, tr = 2e3, nr = 200, rr = /* @__PURE__ */ new Set([
 	"BundleError",
 	"CodecError",
 	"IntegrityError",
@@ -1334,29 +1391,29 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 	"RowsRefusedError",
 	"SchemaDriftError",
 	"StorageError"
-]), sr = (t) => {
-	let n = o.isFiberFailure(t) ? [...e.failures(t[o.FiberFailureCauseId]), ...e.defects(t[o.FiberFailureCauseId])] : [t];
-	for (let e of n) {
-		let t = e?._tag;
-		if (typeof t == "string" && or.has(t)) return e;
-		if (o.isFiberFailure(e)) {
-			let t = sr(e);
-			if (t) return t;
+]), ir = (t) => {
+	let n = e.isCause(t) ? t : r.isExit(t) && r.isFailure(t) ? t.cause : void 0, i = n === void 0 ? [t] : n.reasons.flatMap((t) => e.isFailReason(t) ? [t.error] : e.isDieReason(t) ? [t.defect] : []);
+	for (let n of i) {
+		let i = n?._tag;
+		if (typeof i == "string" && rr.has(i)) return n;
+		if (n !== t && (e.isCause(n) || r.isExit(n))) {
+			let e = ir(n);
+			if (e) return e;
 		}
 	}
-}, cr = (t) => [...e.failures(t)][0] ?? Error(e.pretty(t)), lr = (e) => n.tryPromise({
+}, ar = (t) => a.getOrUndefined(e.findErrorOption(t)) ?? Error(e.pretty(t)), or = (e) => n.tryPromise({
 	try: async () => {
 		let t = await import("node:fs/promises"), n = await import("node:path");
-		return At(await t.readFile(n.join(e, jt), "utf8"));
+		return kt(await t.readFile(n.join(e, At), "utf8"));
 	},
 	catch: (e) => new H({
 		reason: `manifest read/parse failed: ${String(e?.message ?? e)}`,
-		path: jt
+		path: At
 	})
-}), ur = (e) => {
+}), sr = (e) => {
 	let t;
 	return n.gen(function* () {
-		let i = yield* n.promise(() => import("node:path")), a = yield* lr(e.bundleDir);
+		let i = yield* n.promise(() => import("node:path")), a = yield* or(e.bundleDir);
 		if (a.formatVersion !== 1) return yield* n.fail(new H({ reason: `unsupported bundle formatVersion ${a.formatVersion} (expected 1)` }));
 		if (e.tables !== void 0) {
 			let t = new Set(a.tables.map((e) => e.name)), r = e.tables.filter((e) => !t.has(e));
@@ -1377,7 +1434,7 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					unique: !1,
 					hasDefault: !1
 				}))
-			})) }, r = nr(s.source.schemaFingerprint, e.targetSnapshot, t);
+			})) }, r = $n(s.source.schemaFingerprint, e.targetSnapshot, t);
 			if (r.drifted) {
 				if (!e.force) return yield* n.fail(new et({
 					bundleFingerprint: r.bundleFingerprint,
@@ -1388,28 +1445,28 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			}
 		}
 		if (e.targetDialect && e.targetDialect !== s.source.dialect) {
-			let t = wn(s.tables, s.source.dialect, e.targetDialect).filter((e) => e.severity === "block");
+			let t = Cn(s.tables, s.source.dialect, e.targetDialect).filter((e) => e.severity === "block");
 			if (t.length > 0 && !e.allowIncompatible) return yield* n.fail(new rt({
 				sourceDialect: s.source.dialect,
 				targetDialect: e.targetDialect,
-				blocking: t.map(Tn)
+				blocking: t.map(wn)
 			}));
 		}
-		let c = e.verify ?? !0, f = e.mode ?? "upsert", m = e.atomic ?? f === "replace", _ = e.onConflict ?? "skip", v = e.ledgerPath ?? i.join(e.bundleDir, ".import..ledger.json"), b = yield* Wt(v);
-		if (f === "replace" && s.scope.kind !== "all") return yield* n.fail(new nt({
-			mode: f,
+		let d = e.verify ?? !0, p = e.mode ?? "upsert", g = e.atomic ?? p === "replace", _ = e.onConflict ?? "skip", y = e.ledgerPath ?? i.join(e.bundleDir, ".import..ledger.json"), x = yield* Ut(y);
+		if (p === "replace" && s.scope.kind !== "all") return yield* n.fail(new nt({
+			mode: p,
 			reason: `replace refuses a partial bundle (scope='${s.scope.kind}') — truncating would delete rows not in the bundle. Use --mode upsert, or re-export with full scope. To leave specific tables out of a FULL export, use \`--exclude a,b\`: it keeps the scope \`all\` and records what it left out.`
 		}));
-		if (f === "replace" && (s.scope.exclude?.length ?? 0) > 0) {
+		if (p === "replace" && (s.scope.exclude?.length ?? 0) > 0) {
 			let t = s.scope.exclude;
 			e.onWarn?.(`this bundle was exported with ${t.length} table(s) excluded: ${t.join(", ")}.\n  A replace empties and refills the tables the bundle CARRIES, so those keep whatever rows the
   target already holds. That is not "everything the bundle says" — check it is what you meant.`);
 		}
-		if (f === "replace") {
+		if (p === "replace") {
 			let t = s.tables.map((e) => e.name), r = e.store.incomingForeignKeys ? yield* n.tryPromise({
 				try: () => e.store.incomingForeignKeys(t),
-				catch: (e) => new H({ reason: `foreign-key pre-flight failed: ${Mn(e)}` })
-			}) : e.targetSnapshot === void 0 ? [] : yn(e.targetSnapshot, t), i = [], a = /* @__PURE__ */ new Map();
+				catch: (e) => new H({ reason: `foreign-key pre-flight failed: ${jn(e)}` })
+			}) : e.targetSnapshot === void 0 ? [] : vn(e.targetSnapshot, t), i = [], a = /* @__PURE__ */ new Map();
 			for (let t of r) {
 				if (!a.has(t.from)) {
 					let r = yield* n.tryPromise({
@@ -1432,11 +1489,11 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				});
 			}
 			if (i.length > 0) return yield* n.fail(new nt({
-				mode: f,
-				reason: bn(i)
+				mode: p,
+				reason: yn(i)
 			}));
 		}
-		if (e.dryRun === !0) return e.traceId !== void 0 && (yield* n.promise(() => e.store.update(u, e.traceId, {
+		if (e.dryRun === !0) return e.traceId !== void 0 && (yield* n.promise(() => e.store.update(l, e.traceId, {
 			finishedAt: /* @__PURE__ */ new Date(),
 			tablesWritten: 0,
 			rowsWritten: 0,
@@ -1449,34 +1506,34 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 			rowsSkipped: 0,
 			fullyResumed: !1
 		};
-		let S = /* @__PURE__ */ new Map();
+		let C = /* @__PURE__ */ new Map();
 		for (let t of e.targetSnapshot?.tables ?? []) {
 			let e = t.columns.filter((e) => e.generatedAs !== void 0).map((e) => e.name);
-			e.length > 0 && S.set(t.name, e);
+			e.length > 0 && C.set(t.name, e);
 		}
-		let C = (e, t) => {
-			let n = S.get(e);
+		let ie = (e, t) => {
+			let n = C.get(e);
 			if (n === void 0) return t;
 			let r;
 			for (let e of n) e in t && (r ??= { ...t }, delete r[e]);
 			return r ?? t;
-		}, w = (e, t, n, r = !1) => {
-			let i = O ? J(t.name) : t.name, a = t.primaryKey, o = oe(t.name, C(t.name, n), t.columnTypes);
-			return f === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : f === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
-		}, ae = e.targetDialect !== void 0 && e.targetDialect !== "memory", oe = (e, t, n) => {
-			if (!ae || n === void 0 || y(e) !== void 0) return t;
+		}, ae = (e, t, n, r = !1) => {
+			let i = A ? q(t.name) : t.name, a = t.primaryKey, o = w(t.name, ie(t.name, n), t.columnTypes);
+			return p === "append" ? _ === "fail" ? e.insert(i, o) : e.insertIgnore(i, o, { conflictColumns: [a] }) : p === "replace" ? r ? e.upsert(i, o, { conflictColumns: [a] }) : e.insert(i, o) : e.upsert(i, o, { conflictColumns: [a] });
+		}, oe = e.targetDialect !== void 0 && e.targetDialect !== "memory", w = (e, t, n) => {
+			if (!oe || n === void 0 || v(e) !== void 0) return t;
 			let r = null;
 			for (let [e, i] of Object.entries(n)) {
 				let n = t[e];
 				i === "json" && n != null && (r === null && (r = { ...t }), r[e] = JSON.stringify(n));
 			}
 			return r ?? t;
-		}, T = (e, t) => e.savepoint ? e.savepoint(t) : t(), se = 0, ce = (t, n, r) => {
-			r.unclassified && (se++, !(se > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (se === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
-		}, le = (e, t, r = !0) => n.tryPromise({
+		}, T = (e, t) => e.savepoint ? e.savepoint(t) : t(), E = 0, se = (t, n, r) => {
+			r.unclassified && (E++, !(E > 3) && e.onWarn?.(`row refused with no driver detail — table '${t.name}', row '${String(n.id ?? "?")}'. The full rendering follows so the LAYER that refused is on the record; it is logged, never returned. ${r.raw}` + (E === 3 ? " (further unclassified refusals are counted, not logged)" : "")));
+		}, ce = (e, t, r = !0) => n.tryPromise({
 			try: e,
-			catch: (e) => An(e)
-		}).pipe(n.map(() => !0), n.catchAll((e) => n.sync(() => (r && (t.reason = e.reason, ce(t.entry, t.row, e)), !1)))), ue = (e) => {
+			catch: (e) => kn(e)
+		}).pipe(n.map(() => !0), n.catch((e) => n.sync(() => (r && (t.reason = e.reason, se(t.entry, t.row, e)), !1)))), le = (e) => {
 			let t = Object.entries(e.entry.columnTypes).filter(([t, n]) => n === "reference" && e.row[t] !== null && e.row[t] !== void 0).map(([e]) => e);
 			if (t.length !== 0) return {
 				...e.row,
@@ -1510,36 +1567,36 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 					primary: t.primary
 				})).sort((e, t) => t.refused - e.refused || e.table.localeCompare(t.table)).slice(0, 100)
 			});
-		}, pe = (e, t) => n.gen(function* () {
+		}, fe = (e, t) => n.gen(function* () {
 			let r = t, i = [], a = !0;
 			for (; r.length > 0 && a;) {
 				a = !1;
 				let t = [];
-				for (let n of r) (yield* le(() => T(e, () => w(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
+				for (let n of r) (yield* ce(() => T(e, () => ae(e, n.entry, n.row, !0)), n)) ? a = !0 : t.push(n);
 				if (!a && t.length > 0) for (let n = t.length - 1; n >= 0; n--) {
-					let r = t[n], o = ue(r);
-					o !== void 0 && (yield* le(() => T(e, () => w(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
+					let r = t[n], o = le(r);
+					o !== void 0 && (yield* ce(() => T(e, () => ae(e, r.entry, o, !0)), r, !1)) && (i.push(r), t.splice(n, 1), a = !0);
 				}
 				r = t;
 			}
-			for (let t of i) (yield* le(() => T(e, () => e.upsert(t.entry.name, oe(t.entry.name, t.row, t.entry.columnTypes), { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
+			for (let t of i) (yield* ce(() => T(e, () => e.upsert(t.entry.name, w(t.entry.name, t.row, t.entry.columnTypes), { conflictColumns: [t.entry.primaryKey] })), t)) || (r = [...r, t]);
 			if (r.length > 0) return yield* n.fail(de(r));
-		}), E = (() => {
+		}), D = (() => {
 			let t = e.targetDialect;
 			return t === "postgres" || t === "mysql" || t === "mariadb" || t === "sqlite" || t === "mssql" ? t : void 0;
-		})(), D = Yn({
-			mode: f,
+		})(), O = Jn({
+			mode: p,
 			...e.targetDialect === void 0 ? {} : { targetDialect: e.targetDialect },
 			...e.targetSnapshot === void 0 ? {} : { targetSnapshot: e.targetSnapshot },
 			bundleTables: s.tables.map((e) => e.name),
 			isSkipped: V,
-			canRunSql: Pn(e.store)
-		}), me = D.tables, he = s.tables.filter((e) => !V(e.name) && ee(e.name)).map((e) => e.name), O = D.active, _e = !1, k = 0, A = 0, j, M, ve = 0, N = 0, P = (t, r) => n.gen(function* () {
-			if (f === "replace" && !O && !(r && b.truncated)) {
+			canRunSql: Nn(e.store)
+		}), k = O.tables, pe = s.tables.filter((e) => !V(e.name) && S(e.name)).map((e) => e.name), A = O.active, he = !1, j = 0, M = 0, ge, _e, ve = 0, N = 0, ye = (t, r) => n.gen(function* () {
+			if (p === "replace" && !A && !(r && x.truncated)) {
 				e.recordInterruption === !0 && (yield* n.tryPromise({
-					try: () => t.insert(d, {
-						id: h("repl", ye),
-						startedAt: be,
+					try: () => t.insert(u, {
+						id: m("repl", be),
+						startedAt: P,
 						tables: String(s.tables.length),
 						capture: F?.dir ?? null,
 						via: e.via ?? "direct"
@@ -1548,66 +1605,66 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
   not proceed without it.` })
 				}));
 				let i = [...s.tables].reverse().map((e) => e.name).filter((e) => !V(e)), a = !r, o = t.emptyTables ? () => t.emptyTables(i) : a ? async () => {
-					for (let e of [...s.tables].reverse()) await t.deleteMany(e.name, { where: x(e.primaryKey) });
+					for (let e of [...s.tables].reverse()) await t.deleteMany(e.name, { where: b(e.primaryKey) });
 				} : () => t.transactional(async (e) => {
-					for (let t of [...s.tables].reverse()) await e.deleteMany(t.name, { where: x(t.primaryKey) });
+					for (let t of [...s.tables].reverse()) await e.deleteMany(t.name, { where: b(t.primaryKey) });
 				});
 				yield* n.tryPromise({
 					try: o,
-					catch: (e) => new H({ reason: `emptying the target for --mode replace failed (nothing was deleted): ${Mn(e)}` })
-				}), r && (b.truncated = !0, yield* K(v, b));
+					catch: (e) => new H({ reason: `emptying the target for --mode replace failed (nothing was deleted): ${jn(e)}` })
+				}), r && (x.truncated = !0, yield* G(y, x));
 			}
-			let a = [], o = [], u = [], p = [], g = s.tables.length;
-			for (let d = 0; d < s.tables.length; d++) {
-				let h = s.tables[d];
-				if (V(h.name)) {
-					p.push(h.name);
+			let a = [], o = [], l = [], f = [], h = s.tables.length;
+			for (let u = 0; u < s.tables.length; u++) {
+				let m = s.tables[u];
+				if (V(m.name)) {
+					f.push(m.name);
 					continue;
 				}
-				if (r && h.name in b.tables) {
-					u.push(h.name), N++, ve += b.tables[h.name].rowCount, G(e.onProgress, {
+				if (r && m.name in x.tables) {
+					l.push(m.name), N++, ve += x.tables[m.name].rowCount, W(e.onProgress, {
 						phase: "import",
-						table: h.name,
-						index: d,
-						tableCount: g,
+						table: m.name,
+						index: u,
+						tableCount: h,
 						event: "done",
-						rowsDone: b.tables[h.name].rowCount,
-						total: h.rowCount
+						rowsDone: x.tables[m.name].rowCount,
+						total: m.rowCount
 					});
 					continue;
 				}
-				let _ = i.join(e.bundleDir, h.file);
-				G(e.onProgress, {
+				let _ = i.join(e.bundleDir, m.file);
+				W(e.onProgress, {
 					phase: "import",
-					table: h.name,
-					index: d,
-					tableCount: g,
+					table: m.name,
+					index: u,
+					tableCount: h,
 					event: "start",
 					rowsDone: 0,
-					total: h.rowCount
+					total: m.rowCount
 				});
-				let y = a.length, x = n.gen(function* () {
-					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, c = ge("bundle", () => fe(_).pipe(Ct(s.compression))).pipe(l.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
+				let v = a.length, b = n.gen(function* () {
+					let { createHash: r } = yield* n.promise(() => import("node:crypto")), i = r("sha256"), o = 0, l = me("bundle", () => ue(_).pipe(St(s.compression))).pipe(c.tap((e) => n.sync(() => i.update(e)))), u = async (e) => {
 						let n = {
-							entry: h,
+							entry: m,
 							row: e,
 							reason: ""
 						};
 						try {
-							await T(t, () => w(t, h, e));
+							await T(t, () => ae(t, m, e));
 						} catch (t) {
-							let r = An(t);
-							n.reason = r.reason, ce(h, e, r), a.push(n);
+							let r = kn(t);
+							n.reason = r.reason, se(m, e, r), a.push(n);
 						}
 					}, d = yield* n.promise(async () => {
 						let n = e.copyLoader;
 						if (!n || n.dialect !== "postgres") return !1;
-						if (m) return _e || (_e = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
-						if (f === "replace") return !0;
-						if (f !== "upsert") return !1;
+						if (g) return he || (he = !0, e.onWarn?.("bulk COPY is off for this run: it needs its own connection and this import runs in ONE transaction (the default for --mode replace, so a failure mid-load cannot leave the target emptied and unfilled). Pass --no-atomic to trade that guarantee back for COPY.")), !1;
+						if (p === "replace") return !0;
+						if (p !== "upsert") return !1;
 						try {
 							return (await t.query({
-								table: h.name,
+								table: m.name,
 								predicate: void 0,
 								order: [],
 								take: 1,
@@ -1617,19 +1674,19 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 						} catch {
 							return !1;
 						}
-					}), p = Object.keys(h.columnTypes), g = Math.max(1, e.copyBatchSize ?? 5e3), v = [], y = async () => {
+					}), f = Object.keys(m.columnTypes), h = Math.max(1, e.copyBatchSize ?? 5e3), v = [], y = async () => {
 						if (v.length === 0) return;
 						let t = v;
 						v = [];
 						try {
 							await e.copyLoader.copyInto({
-								table: h.name,
-								columns: p,
-								columnTypes: h.columnTypes,
+								table: m.name,
+								columns: f,
+								columnTypes: m.columnTypes,
 								rows: t
 							});
 						} catch (n) {
-							d = !1, e.onWarn?.(`bulk COPY into ${h.name} failed (${String(n?.message ?? n)}); falling back to per-row writes for this table`);
+							d = !1, e.onWarn?.(`bulk COPY into ${m.name} failed (${String(n?.message ?? n)}); falling back to per-row writes for this table`);
 							for (let e of t) await u(e);
 						}
 					}, b = Math.max(1, e.savepointBatchSize ?? 200), x = typeof t.savepoint == "function", S = [], ee = async () => {
@@ -1638,15 +1695,15 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 						S = [];
 						try {
 							await t.savepoint(async () => {
-								for (let n of e) await w(t, h, n);
+								for (let n of e) await ae(t, m, n);
 							});
 						} catch {
 							for (let t of e) await u(t);
 						}
 					};
-					return yield* l.runForEach(on(c, h.name, h.columnTypes), (e) => n.promise(async () => {
-						if (o++, M?.(), d) {
-							v.push(e), v.length >= g && await y();
+					return yield* c.runForEach(an(l, m.name, m.columnTypes), (e) => n.promise(async () => {
+						if (o++, _e?.(), d) {
+							v.push(e), v.length >= h && await y();
 							return;
 						}
 						if (x) {
@@ -1658,60 +1715,60 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 						rowCount: o,
 						checksum: i.digest("hex")
 					};
-				}), { rowCount: S, checksum: ee } = yield* Ht("import", h.name, d, g, (e) => e.rowCount, x);
-				if (c) {
-					if (ee !== h.checksum) return yield* n.fail(new Ze({
-						what: `table ${h.name} checksum`,
-						expected: h.checksum,
+				}), { rowCount: S, checksum: ee } = yield* Vt("import", m.name, u, h, (e) => e.rowCount, b);
+				if (d) {
+					if (ee !== m.checksum) return yield* n.fail(new Xe({
+						what: `table ${m.name} checksum`,
+						expected: m.checksum,
 						actual: ee
 					}));
-					if (S !== h.rowCount) return yield* n.fail(new Ze({
-						what: `table ${h.name} rowCount`,
-						expected: String(h.rowCount),
+					if (S !== m.rowCount) return yield* n.fail(new Xe({
+						what: `table ${m.name} rowCount`,
+						expected: String(m.rowCount),
 						actual: String(S)
 					}));
 				}
-				G(e.onProgress, {
+				W(e.onProgress, {
 					phase: "import",
-					table: h.name,
-					index: d,
-					tableCount: g,
+					table: m.name,
+					index: u,
+					tableCount: h,
 					event: "done",
 					rowsDone: S,
-					total: h.rowCount
-				}), A++, k += S, j?.(), M?.(), r && (a.length > y ? o.push({
-					name: h.name,
+					total: m.rowCount
+				}), M++, j += S, ge?.(), _e?.(), r && (a.length > v ? o.push({
+					name: m.name,
 					rowCount: S
-				}) : (b.tables[h.name] = {
+				}) : (x.tables[m.name] = {
 					rowCount: S,
-					checksum: h.checksum
-				}, yield* K(v, b)));
+					checksum: m.checksum
+				}, yield* G(y, x)));
 			}
-			if (a.length > 0 && (yield* pe(t, a)), f === "replace" && (yield* n.promise(() => t.deleteMany(d, { where: {
+			if (a.length > 0 && (yield* fe(t, a)), p === "replace" && (yield* n.promise(() => t.deleteMany(u, { where: {
 				column: "startedAt",
 				op: "lte",
-				value: be
+				value: P
 			} }).then(() => void 0, () => void 0))), r && o.length > 0) {
 				for (let e of o) {
 					let t = s.tables.find((t) => t.name === e.name);
-					b.tables[e.name] = {
+					x.tables[e.name] = {
 						rowCount: e.rowCount,
 						checksum: t.checksum
 					};
 				}
-				yield* K(v, b);
+				yield* G(y, x);
 			}
 			{
-				let t = Ye(p, "skipped");
+				let t = Je(f, "skipped");
 				t !== void 0 && e.onWarn?.(t);
 			}
-			if (u.length > 0) {
-				let t = u.length === s.tables.length;
-				e.onWarn?.(`resume: ${u.length} of ${s.tables.length} table(s) were already applied by an earlier run of THIS bundle directory, so this run wrote NO rows for them${t ? " — that is every table in the bundle, so nothing was written at all" : ""}. Tables: ${u.join(", ")}. Delete ${v} to force a full re-import.`);
+			if (l.length > 0) {
+				let t = l.length === s.tables.length;
+				e.onWarn?.(`resume: ${l.length} of ${s.tables.length} table(s) were already applied by an earlier run of THIS bundle directory, so this run wrote NO rows for them${t ? " — that is every table in the bundle, so nothing was written at all" : ""}. Tables: ${l.join(", ")}. Delete ${y} to force a full re-import.`);
 			}
-		}), ye = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`, be = /* @__PURE__ */ new Date(), F = yield* Xn({
+		}), be = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`, P = /* @__PURE__ */ new Date(), F = yield* Yn({
 			store: e.store,
-			mode: f,
+			mode: p,
 			dir: e.rollbackDir,
 			snapshot: e.targetSnapshot,
 			dialect: e.targetDialect,
@@ -1724,60 +1781,60 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 				reason: `the rollback capture could not be stored durably, so the import did not start and the target is untouched: ${String(e?.message ?? e)}\n  The capture only helps if it outlives this process — that is the failure it exists for.`,
 				path: F.dir
 			})
-		})), e.onWarn?.(Zn(F)));
-		let xe = (e) => f === "replace" ? ne(e) : e(), Se = (e) => f === "replace" ? re(e) : e, I = e.traceId ?? h("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), L = e.traceId !== void 0, Ce = (e.targetSnapshot?.tables.some((e) => e.name === u) ?? !1) || y(u) !== void 0;
-		Ce && g(p), Ce && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(u, {
-			id: I,
-			mode: f,
+		})), e.onWarn?.(Xn(F)));
+		let xe = (e) => p === "replace" ? te(e) : e(), I = (e) => p === "replace" ? ne(e) : e, L = e.traceId ?? m("dimp", `${Date.now()}-${s.source.schemaFingerprint ?? ""}`), Se = e.traceId !== void 0, Ce = (e.targetSnapshot?.tables.some((e) => e.name === l) ?? !1) || v(l) !== void 0;
+		Ce && h(f), Ce && e.traceId === void 0 && (yield* n.promise(() => e.store.insert(l, {
+			id: L,
+			mode: p,
 			via: e.via ?? "direct",
 			direction: "import",
 			bundle: e.bundleDir,
 			sourceFingerprint: s.source.schemaFingerprint ?? null,
 			tablesWritten: 0,
 			rowsWritten: 0,
-			staged: f === "replace" ? O : null
+			staged: p === "replace" ? A : null
 		}).then(() => {
-			L = !0;
+			Se = !0;
 		}, (t) => {
 			e.onWarn?.(`the import trace could not be written (${String(t?.message ?? t)}).\n  The import continues — this is a record of what happened, not a safety check. Run
   \`voltro db apply\` so the next one is recorded.`);
-		}))), e.traceId !== void 0 && Ce && (yield* n.promise(() => e.store.update(u, I, {
-			staged: f === "replace" ? O : null,
+		}))), e.traceId !== void 0 && Ce && (yield* n.promise(() => e.store.update(l, L, {
+			staged: p === "replace" ? A : null,
 			sourceFingerprint: s.source.schemaFingerprint ?? null
 		}).then(() => void 0, () => void 0)));
 		let we = 0, Te = !1;
-		j = () => {
-			if (!L || Te) return;
+		ge = () => {
+			if (!Se || Te) return;
 			let t = Date.now();
-			t - we < rr || (we = t, e.store.update(u, I, {
-				tablesWritten: A,
-				rowsWritten: k
+			t - we < er || (we = t, e.store.update(l, L, {
+				tablesWritten: M,
+				rowsWritten: j
 			}).then(() => void 0, () => {
 				Te = !0;
 			}));
 		};
-		let Ee = (t) => L ? e.store.update(u, I, {
+		let Ee = (t) => Se ? e.store.update(l, L, {
 			finishedAt: t === null ? /* @__PURE__ */ new Date() : null,
-			tablesWritten: A,
-			rowsWritten: k,
+			tablesWritten: M,
+			rowsWritten: j,
 			failure: t
 		}).then(() => void 0, () => void 0) : Promise.resolve();
-		if (t = (e) => Ee(e), f === "replace" && !O && D.blocker !== void 0 && e.onWarn?.(Fn(D.blocker)), f === "replace" && he.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${he.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
+		if (t = (e) => Ee(e), p === "replace" && !A && O.blocker !== void 0 && e.onWarn?.(Pn(O.blocker)), p === "replace" && pe.length > 0 && e.onWarn?.(`write recorders are SUSPENDED for this replace (${pe.length} table(s) have one).\n  A replace sets a state rather than changing rows, so a per-row history entry would describe
   something that did not happen — and this path already writes through the raw store, without
-  tenant scoping or \`audit()\` stamping, for the same reason.`), O) {
-			e.onWarn?.(`staging ${me.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
-			let t = e.store, r = me.map((e) => e.name), i = h("repl", `staging-${ye}`), a = !1;
+  tenant scoping or \`audit()\` stamping, for the same reason.`), A) {
+			e.onWarn?.(`staging ${k.length} table(s) before the swap — the target keeps its rows until the load stands.\n  The destructive step is one server-side transaction at the end, not the whole load.`);
+			let t = e.store, r = k.map((e) => e.name), i = m("repl", `staging-${be}`), a = !1;
 			if (e.recordInterruption === !0) {
-				yield* n.promise(() => e.store.insert(d, {
+				yield* n.promise(() => e.store.insert(u, {
 					id: i,
-					startedAt: be,
+					startedAt: P,
 					kind: "staging",
-					tables: String(me.length),
+					tables: String(k.length),
 					capture: F?.dir ?? null,
 					via: e.via ?? "direct",
-					staging: r.map(J).join(","),
+					staging: r.map(q).join(","),
 					heartbeatAt: /* @__PURE__ */ new Date(),
-					resumable: !m
+					resumable: !g
 				}).then(() => {
 					a = !0;
 				}, (t) => {
@@ -1786,75 +1843,75 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
   them by introspection.`);
 				}));
 				let t = Date.now();
-				M = () => {
+				_e = () => {
 					if (!a) return;
 					let n = Date.now();
-					n - t < ir || (t = n, e.store.update(d, i, { heartbeatAt: /* @__PURE__ */ new Date() }).then(() => void 0, () => void 0));
+					n - t < tr || (t = n, e.store.update(u, i, { heartbeatAt: /* @__PURE__ */ new Date() }).then(() => void 0, () => void 0));
 				};
 			}
-			let o = () => a ? e.store.delete(d, i).then(() => void 0, () => void 0) : Promise.resolve(), s = Bn(r, {
-				getTable: (e) => y(e),
+			let o = () => a ? e.store.delete(u, i).then(() => void 0, () => void 0) : Promise.resolve(), s = zn(r, {
+				getTable: (e) => v(e),
 				registerTable: (e) => {
-					te(e);
+					ee(e);
 				},
-				unregisterTable: ie
+				unregisterTable: re
 			}), c = !1;
 			try {
-				let i = m ? r : r.filter((e) => !Gt(b, e));
+				let i = g ? r : r.filter((e) => !Wt(x, e));
 				yield* n.tryPromise({
 					try: async () => {
-						await Wn(t, i.map((e) => Rn(e, E))), await Wn(t, i.map((e) => Ln(e, E)));
+						await Un(t, i.map((e) => Ln(e, D))), await Un(t, i.map((e) => In(e, D)));
 					},
 					catch: (e) => new H({ reason: `could not prepare the staging tables, so the import did not start and the target is untouched: ${String(e?.message ?? e)}` })
-				}), yield* Se(P(e.store, !m)), !m && b.truncated === !0 ? c = !0 : yield* n.tryPromise({
-					try: () => Gn(t, me, E).then(() => {
+				}), yield* I(ye(e.store, !g)), !g && x.truncated === !0 ? c = !0 : yield* n.tryPromise({
+					try: () => Wn(t, k, D).then(() => {
 						c = !0;
 					}),
 					catch: (e) => new H({ reason: String(e?.message ?? e) })
-				}).pipe(n.catchAll((i) => n.gen(function* () {
-					let a = Un(yield* n.promise(() => Kn(t, Vn(e.targetSnapshot, r), E).then((e) => e, () => [])));
+				}).pipe(n.catch((i) => n.gen(function* () {
+					let a = Hn(yield* n.promise(() => Gn(t, Bn(e.targetSnapshot, r), D).then((e) => e, () => [])));
 					return yield* n.fail(new H({ reason: a ?? `the swap failed and the target is UNCHANGED: ${i.reason}` }));
-				}))), !m && c && b.truncated !== !0 && (b.truncated = !0, yield* K(v, b));
+				}))), !g && c && x.truncated !== !0 && (x.truncated = !0, yield* G(y, x));
 			} finally {
-				s.undo(), c || m ? (M = void 0, yield* n.promise(() => Wn(t, r.map((e) => Rn(e, E))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
+				s.undo(), c || g ? (_e = void 0, yield* n.promise(() => Un(t, r.map((e) => Ln(e, D))).then(() => void 0, () => void 0)), yield* n.promise(o)) : e.onWarn?.("the staged rows are KEPT so a re-run can continue from them rather than reload.\n  If you are not going to re-run this bundle, drop them: voltro data clear-staging --yes");
 			}
-		} else m ? yield* n.tryPromise({
+		} else g ? yield* n.tryPromise({
 			try: () => e.store.transactional(async (e) => {
-				let t = await xe(() => n.runPromiseExit(P(e, !1)));
-				if (r.isFailure(t)) throw cr(t.cause);
+				let t = await xe(() => n.runPromiseExit(ye(e, !1)));
+				if (r.isFailure(t)) throw ar(t.cause);
 			}),
-			catch: (e) => sr(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
-		}) : yield* Se(P(e.store, !0));
+			catch: (e) => ir(e) ?? new H({ reason: `atomic import failed (rolled back): ${String(e?.message ?? e)}` })
+		}) : yield* I(ye(e.store, !0));
 		if (e.assets && s.assets.index && !e.assetsAlreadyRestored) {
 			let t = e.assets;
-			yield* vt({
+			yield* _t({
 				sink: t,
-				assetsDir: i.join(e.bundleDir, Pt),
+				assetsDir: i.join(e.bundleDir, Nt),
 				indexPath: i.join(e.bundleDir, s.assets.index ?? "assets/index.ndjson"),
 				progress: {
-					done: (e) => e in b.assets,
-					mark: (e) => (b.assets[e] = !0, K(v, b))
+					done: (e) => e in x.assets,
+					mark: (e) => (x.assets[e] = !0, G(y, x))
 				}
 			});
 		}
 		return yield* n.promise(() => Ee(null)), {
 			manifest: s,
-			tablesWritten: A,
-			rowsWritten: k,
+			tablesWritten: M,
+			rowsWritten: j,
 			tablesSkipped: N,
 			rowsSkipped: ve,
-			fullyResumed: A === 0 && N > 0,
+			fullyResumed: M === 0 && N > 0,
 			...F === void 0 ? {} : { rollback: F }
 		};
 	}).pipe(n.tapError((e) => n.promise(() => t?.(e?.reason ?? e?._tag ?? "the import did not finish") ?? Promise.resolve())));
-}, dr = (e) => e, fr = (e) => {
+}, cr = (e) => e, lr = (e) => {
 	if (e.allowLive || e.liveInstance === null || e.sameTarget === "different") return { refuse: !1 };
 	let t = e.targetLabel === void 0 ? "" : ` Target: ${e.targetLabel}.`, n = e.sameTarget === "same" ? " That instance is connected to the SAME database." : " We could not confirm which database that instance is connected to, so this is refused on the conservative reading — an older instance, or one whose connection could not be parsed, reports nothing to compare.";
 	return {
 		refuse: !0,
 		message: `refusing to write into a target with a LIVE instance (${e.liveInstance}).${t}${n} A direct import is an uncoordinated concurrent writer — readers see partial state, the reactive layer either storms or goes stale, and rows race with live writes. Re-run with --allow-live to override, or use a live-safe strategy (shadow-swap for replace, or the api target).`
 	};
-}, X = Buffer.from("VBUNDLE2"), pr = 0, mr = 1, hr = 2, gr = 32, _r = async (e) => {
+}, Y = Buffer.from("VBUNDLE2"), ur = 0, dr = 1, fr = 2, pr = 32, mr = async (e) => {
 	let t = [], n = async (r) => {
 		let i;
 		try {
@@ -1868,22 +1925,22 @@ voltro data import <this-directory> --target api --api-url <url> --token <secret
 		}
 	};
 	return await n(""), t.sort();
-}, vr = (e, t) => {
+}, hr = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.alloc(5 + n.length + 8);
-	return r.writeUInt8(mr, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
-}, yr = (e, t, n) => {
+	return r.writeUInt8(dr, 0), r.writeUInt32BE(n.length, 1), n.copy(r, 5), r.writeBigUInt64BE(BigInt(t), 5 + n.length), r;
+}, gr = (e, t, n) => {
 	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8"), a = Buffer.alloc(5 + r.length + 2 + i.length + 8), o = 0;
-	return a.writeUInt8(hr, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
+	return a.writeUInt8(fr, o), o += 1, a.writeUInt32BE(r.length, o), o += 4, r.copy(a, o), o += r.length, a.writeUInt16BE(i.length, o), o += 2, i.copy(a, o), o += i.length, a.writeBigUInt64BE(BigInt(n), o), a;
 };
-async function* br(e) {
-	yield new Uint8Array(X);
-	for (let t of await _r(e.dir)) {
+async function* _r(e) {
+	yield new Uint8Array(Y);
+	for (let t of await mr(e.dir)) {
 		let n = I(e.dir, t), r = await be(n);
-		if (yield new Uint8Array(vr(t, r.size)), r.size > 0) for await (let e of fe(n)) yield new Uint8Array(e);
+		if (yield new Uint8Array(hr(t, r.size)), r.size > 0) for await (let e of ue(n)) yield new Uint8Array(e);
 	}
 	if (e.blobs) for await (let t of e.blobs.list()) {
-		yield new Uint8Array(yr(t.key, t.contentType, t.size));
-		let n = T("sha256"), r = 0;
+		yield new Uint8Array(gr(t.key, t.contentType, t.size));
+		let n = w("sha256"), r = 0;
 		for await (let i of e.blobs.open(t.key)) {
 			let e = Buffer.from(i);
 			n.update(e), r += e.length, yield new Uint8Array(e);
@@ -1891,11 +1948,11 @@ async function* br(e) {
 		if (r !== t.size) throw Error(`blob '${t.key}' size mismatch: header ${t.size}, streamed ${r}`);
 		yield new Uint8Array(n.digest());
 	}
-	yield new Uint8Array(Buffer.from([pr]));
+	yield new Uint8Array(Buffer.from([ur]));
 }
-var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr = (e) => new Promise((t) => e.end(t)), Cr = async (e, t) => {
+var vr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), yr = (e) => new Promise((t) => e.end(t)), br = async (e, t) => {
 	let n = L(t.dir);
-	await P(n, { recursive: !0 });
+	await N(n, { recursive: !0 });
 	let r = Buffer.alloc(0), i = e[Symbol.asyncIterator](), a = !1, o = async () => {
 		let { value: e, done: t } = await i.next();
 		return t ? (a = !0, !1) : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
@@ -1906,28 +1963,28 @@ var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr
 		return r = r.subarray(e), t;
 	};
 	try {
-		if (await s(X.length), !c(X.length).equals(X)) throw Error("not a bundle archive (bad magic)");
+		if (await s(Y.length), !c(Y.length).equals(Y)) throw Error("not a bundle archive (bad magic)");
 		for (;;) {
 			await s(1);
 			let e = c(1).readUInt8(0);
-			if (e === pr) return;
-			if (e === mr) {
+			if (e === ur) return;
+			if (e === dr) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
 				let t = c(e).toString("utf8");
 				await s(8);
 				let i = c(8).readBigUInt64BE(0), a = L(n, t);
-				if (a !== n && !a.startsWith(n + Ce)) throw Error(`archive path '${t}' escapes the destination`);
-				await P(Se(a), { recursive: !0 });
-				let o = pe(a);
+				if (a !== n && !a.startsWith(n + Se)) throw Error(`archive path '${t}' escapes the destination`);
+				await N(xe(a), { recursive: !0 });
+				let o = de(a);
 				for (; i > 0n;) {
 					r.length === 0 && await s(1);
 					let e = i < BigInt(r.length) ? Number(i) : r.length;
-					await xr(o, c(e)), i -= BigInt(e);
+					await vr(o, c(e)), i -= BigInt(e);
 				}
-				await Sr(o);
-			} else if (e === hr) {
+				await yr(o);
+			} else if (e === fr) {
 				await s(4);
 				let e = c(4).readUInt32BE(0);
 				await s(e);
@@ -1937,24 +1994,24 @@ var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr
 				await s(i);
 				let a = c(i).toString("utf8");
 				await s(8);
-				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = T("sha256"), d = new M(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
+				let o = c(8).readBigUInt64BE(0), l = await t.blobs.has(n), u = w("sha256"), d = new ge(), f = l ? Promise.resolve() : t.blobs.write(n, d, {
 					contentType: a,
 					size: Number(o)
 				}), p = o;
 				for (; p > 0n;) {
 					r.length === 0 && await s(1);
 					let e = p < BigInt(r.length) ? Number(p) : r.length, t = c(e);
-					u.update(t), l || await xr(d, t), p -= BigInt(e);
+					u.update(t), l || await vr(d, t), p -= BigInt(e);
 				}
-				l ? d.destroy() : await Sr(d), await f, await s(gr);
-				let m = c(gr);
+				l ? d.destroy() : await yr(d), await f, await s(pr);
+				let m = c(pr);
 				if (!u.digest().equals(m)) throw Error(`blob '${n}' failed integrity (sha mismatch)`);
 			} else throw Error(`unknown bundle entry kind ${e}`);
 		}
 	} finally {
 		a || await Promise.resolve(i.return?.()).catch(() => void 0);
 	}
-}, wr = async (e, t) => {
+}, xr = async (e, t) => {
 	let n = new Set(t), r = /* @__PURE__ */ new Map(), i = Buffer.alloc(0), a = e[Symbol.asyncIterator](), o = async () => {
 		let { value: e, done: t } = await a.next();
 		return !t && (i = i.length === 0 ? Buffer.from(e) : Buffer.concat([i, Buffer.from(e)]), !0);
@@ -1973,11 +2030,11 @@ var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr
 		}
 		return Buffer.concat(t);
 	};
-	if (!await s(X.length) || !c(X.length).equals(X)) throw Error("not a bundle archive (bad magic)");
+	if (!await s(Y.length) || !c(Y.length).equals(Y)) throw Error("not a bundle archive (bad magic)");
 	for (; await s(1);) {
 		let e = c(1).readUInt8(0);
-		if (e === pr || e === hr) break;
-		if (e !== mr) throw Error(`unknown bundle entry kind ${e}`);
+		if (e === ur || e === fr) break;
+		if (e !== dr) throw Error(`unknown bundle entry kind ${e}`);
 		if (!await s(4)) break;
 		let t = c(4).readUInt32BE(0);
 		if (!await s(t)) break;
@@ -1987,20 +2044,20 @@ var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr
 		if (a === null || n.has(i) && (r.set(i, a), n.delete(i), n.size === 0)) break;
 	}
 	return r;
-}, Tr = (e, t) => Cr(e, {
+}, Sr = (e, t) => br(e, {
 	dir: t,
-	blobs: Er(t)
-}), Er = (e) => {
+	blobs: Cr(t)
+}), Cr = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	return {
 		has: async (e) => t.has(e),
 		write: async (n, r, i) => {
 			let a = await import("node:fs/promises"), { pipeline: o } = await import("node:stream/promises"), { Transform: s } = await import("node:stream"), c = I(e, "assets");
-			await P(c, { recursive: !0 });
-			let l = T("sha256"), u = 0, d = new s({ transform(e, t, n) {
+			await N(c, { recursive: !0 });
+			let l = w("sha256"), u = 0, d = new s({ transform(e, t, n) {
 				l.update(e), u += e.length, n(null, e);
 			} }), f = I(c, `.tmp-${Date.now()}-${t.size}`);
-			await o(r, d, pe(f));
+			await o(r, d, de(f));
 			let p = l.digest("hex");
 			await a.rename(f, I(c, p)), await a.appendFile(I(c, "index.ndjson"), `${JSON.stringify({
 				key: n,
@@ -2010,76 +2067,114 @@ var xr = (e, t) => new Promise((n, r) => e.write(t, (e) => e ? r(e) : n())), Sr
 			})}\n`), t.add(n);
 		}
 	};
-}, Dr = we(ue), Or = Buffer.from("VENC1\0\0\0"), kr = 32, Ar = 16, jr = 7, Mr = 16, Nr = 262144, Pr = {
+}, wr = Ce(ce), Tr = Buffer.from("VENC1\0\0\0"), Er = 32, Dr = 16, Or = 7, kr = 16, X = 262144, Ar = {
 	N: 32768,
 	r: 8,
 	p: 1
-}, Fr = 134217728, Ir = 43, Lr = (e, t, n) => {
+}, jr = 134217728, Mr = 43, Nr = (e, t, n) => {
 	let r = Buffer.alloc(12);
-	return e.copy(r, 0, 0, jr), r.writeUInt32BE(t >>> 0, jr), r.writeUInt8(+!!n, 11), r;
+	return e.copy(r, 0, 0, Or), r.writeUInt32BE(t >>> 0, Or), r.writeUInt8(+!!n, 11), r;
 };
-async function* Rr(e, t) {
+async function* Pr(e, t) {
 	if (!t) throw Error("encryptStream: a non-empty passphrase is required");
-	let n = ce(Ar), r = ce(jr), i = await Dr(t, n, kr, {
-		...Pr,
-		maxmem: Fr
-	}), a = Buffer.alloc(Ir);
-	Or.copy(a, 0), a.writeUInt32BE(Pr.N, 8), a.writeUInt32BE(Pr.r, 12), a.writeUInt32BE(Pr.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
+	let n = E(Dr), r = E(Or), i = await wr(t, n, Er, {
+		...Ar,
+		maxmem: jr
+	}), a = Buffer.alloc(Mr);
+	Tr.copy(a, 0), a.writeUInt32BE(Ar.N, 8), a.writeUInt32BE(Ar.r, 12), a.writeUInt32BE(Ar.p, 16), n.copy(a, 20), r.copy(a, 36), yield new Uint8Array(a);
 	let o = 0, s = (e, t) => {
-		let n = ae("aes-256-gcm", i, Lr(r, o, t));
+		let n = ae("aes-256-gcm", i, Nr(r, o, t));
 		o === 0 && n.setAAD(a);
 		let s = Buffer.concat([n.update(e), n.final()]), c = n.getAuthTag();
 		o++;
-		let l = Buffer.alloc(5 + s.length + Mr);
-		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + Mr, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
-	}, c = Buffer.alloc(0);
-	for await (let t of e) for (c = c.length === 0 ? Buffer.from(t) : Buffer.concat([c, Buffer.from(t)]); c.length > Nr;) yield s(c.subarray(0, Nr), !1), c = c.subarray(Nr);
-	yield s(c, !0);
+		let l = Buffer.alloc(5 + s.length + kr);
+		return l.writeUInt8(+!!t, 0), l.writeUInt32BE(s.length + kr, 1), s.copy(l, 5), c.copy(l, 5 + s.length), new Uint8Array(l);
+	}, c = Buffer.alloc(0), l = 0;
+	for await (let t of e) {
+		let e = Buffer.from(t), n = 0;
+		for (; n < e.length;) {
+			if (l === X && (yield s(c, !1), l = 0), l === 0 && e.length - n >= X) {
+				let t = e.subarray(n, n + X);
+				n += X, n < e.length ? yield s(t, !1) : (c = t, l = X);
+				continue;
+			}
+			c.length !== X && (c = Buffer.alloc(X));
+			let t = Math.min(X - l, e.length - n);
+			e.copy(c, l, n, n + t), l += t, n += t;
+		}
+	}
+	yield s(c.subarray(0, l), !0);
 }
-async function* zr(e, t) {
+async function* Fr(e, t) {
 	if (!t) throw Error("decryptStream: a non-empty passphrase is required");
-	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = !1, a = async () => {
-		let { value: e, done: t } = await n.next();
-		return t ? (i = !0, !1) : (r = r.length === 0 ? Buffer.from(e) : Buffer.concat([r, Buffer.from(e)]), !0);
-	}, o = async (e) => {
-		for (; r.length < e && !i && await a(););
-		return r.length >= e;
-	};
-	if (!await o(Ir)) throw Error("encrypted bundle truncated (no header)");
-	let s = r.subarray(0, Ir);
-	if (!s.subarray(0, 8).equals(Or)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
-	let c = s.readUInt32BE(8), l = s.readUInt32BE(12), u = s.readUInt32BE(16), d = Buffer.from(s.subarray(20, 36)), f = Buffer.from(s.subarray(36, Ir)), p = await Dr(t, d, kr, {
-		N: c,
-		r: l,
-		p: u,
-		maxmem: Fr
-	});
-	r = r.subarray(Ir);
-	let m = 0, h = !1;
-	for (;;) {
-		if (!await o(5)) {
-			if (r.length === 0 && h) return;
-			throw Error("encrypted bundle truncated (no authenticated final frame)");
+	let n = e[Symbol.asyncIterator](), r = Buffer.alloc(0), i = 0, a = !1, o = async (e) => {
+		let t, o = 0;
+		for (; o < e;) {
+			if (i === r.length) {
+				if (a) break;
+				let e = await n.next();
+				if (e.done) {
+					a = !0;
+					break;
+				}
+				if (r = Buffer.from(e.value), i = 0, r.length === 0) continue;
+			}
+			if (o === 0 && r.length - i >= e) {
+				let t = r.subarray(i, i + e);
+				return i += e, t;
+			}
+			t ??= Buffer.alloc(e);
+			let s = Math.min(e - o, r.length - i);
+			r.copy(t, o, i, i + s), i += s, o += s;
+		}
+		return t?.subarray(0, o) ?? Buffer.alloc(0);
+	}, s = !1;
+	try {
+		let e = await o(Mr);
+		if (e.length !== Mr) throw Error("encrypted bundle truncated (no header)");
+		if (!e.subarray(0, 8).equals(Tr)) throw Error("not an encrypted bundle (bad magic / wrong passphrase target)");
+		let n = e.readUInt32BE(8), r = e.readUInt32BE(12), i = e.readUInt32BE(16), a = Buffer.from(e.subarray(20, 36)), s = Buffer.from(e.subarray(36, Mr)), c = await wr(t, a, Er, {
+			N: n,
+			r,
+			p: i,
+			maxmem: jr
+		}), l = 0, u = !1;
+		for (;;) {
+			let t = await o(5);
+			if (t.length !== 5) {
+				if (t.length === 0 && u) return;
+				throw Error("encrypted bundle truncated (no authenticated final frame)");
+			}
+			if (u) throw Error("encrypted bundle has trailing data after the final frame");
+			let n = t.readUInt8(0);
+			if (n !== 0 && n !== 1) throw Error("encrypted bundle corrupt (invalid final flag)");
+			let r = n === 1, i = t.readUInt32BE(1);
+			if (i < kr) throw Error("encrypted bundle corrupt (short frame)");
+			if (i > 262160) throw Error("encrypted bundle corrupt (oversized frame)");
+			let a = await o(i);
+			if (a.length !== i) throw Error("encrypted bundle truncated (frame body)");
+			let d = a.subarray(0, i - kr), f = a.subarray(i - kr), p = oe("aes-256-gcm", c, Nr(s, l, r));
+			l === 0 && p.setAAD(e), p.setAuthTag(f);
+			let m = Buffer.concat([p.update(d), p.final()]);
+			l++, r && (u = !0), m.length > 0 && (yield new Uint8Array(m));
+		}
+	} catch (e) {
+		throw s = !0, e;
+	} finally {
+		if (!a) try {
+			await n.return?.();
+		} catch (e) {
+			if (!s) throw e;
 		}
-		if (h) throw Error("encrypted bundle has trailing data after the final frame");
-		let e = r.readUInt8(0) === 1, t = r.readUInt32BE(1);
-		if (t < Mr) throw Error("encrypted bundle corrupt (short frame)");
-		if (!await o(5 + t)) throw Error("encrypted bundle truncated (frame body)");
-		let n = r.subarray(5, 5 + t - Mr), i = r.subarray(5 + t - Mr, 5 + t);
-		r = r.subarray(5 + t);
-		let a = oe("aes-256-gcm", p, Lr(f, m, e));
-		m === 0 && a.setAAD(s), a.setAuthTag(i);
-		let c = Buffer.concat([a.update(n), a.final()]);
-		m++, e && (h = !0), c.length > 0 && (yield new Uint8Array(c));
 	}
 }
 //#endregion
 //#region src/blobStorage.ts
-var Br = (e, t) => ({
+var Ir = (e, t) => ({
 	list: () => {
 		let e = t();
 		return { async *[Symbol.asyncIterator]() {
-			let t = await n.runPromise(l.runCollect(e));
+			let t = await n.runPromise(c.runCollect(e));
 			for (let e of t) yield {
 				key: e.key,
 				contentType: e.contentType,
@@ -2088,32 +2183,32 @@ var Br = (e, t) => ({
 		} };
 	},
 	open: (t) => ({ async *[Symbol.asyncIterator]() {
-		let r = await n.runPromise(_e(e, t)), i = await A(r.stream);
+		let r = await n.runPromise(A(e, t)), i = await j(r.stream);
 		for await (let e of i) yield e instanceof Uint8Array ? e : new Uint8Array(e);
 	} })
-}), Vr = (e, t) => Br(e, () => C(t, {
-	table: O,
+}), Lr = (e, t) => Ir(e, () => C(t, {
+	table: pe,
 	chunkSize: 500
-}).pipe(l.map((e) => ({
+}).pipe(c.map((e) => ({
 	key: String(e.key),
 	contentType: String(e.contentType ?? "application/octet-stream"),
 	size: Number(e.size ?? 0)
-})))), Hr = (e) => ({
+})))), Rr = (e) => ({
 	has: (t) => n.runPromise(e.head(t).pipe(n.map((e) => e !== null))),
 	write: async (t, r, i) => {
-		let a = ge("storage", () => ve.from(r));
-		await n.runPromise(k(e, t, a, {
+		let a = me("storage", () => _e.from(r));
+		await n.runPromise(he(e, t, a, {
 			contentType: i.contentType,
 			totalSize: i.size
 		}));
 	}
-}), Ur = (e, t) => {
+}), zr = (e, t) => {
 	let n = t === "dump" ? "mariadb-dump" : "mariadb", r = t === "dump" ? "mysqldump" : "mysql";
-	return e === "mariadb" ? Wr(n) ? { tool: n } : {
+	return e === "mariadb" ? Br(n) ? { tool: n } : {
 		tool: r,
 		hint: `'${n}' is not on PATH, so this ran '${r}' instead. If that binary came from Oracle's MySQL client it queries information_schema.COLUMN_STATISTICS, which MariaDB does not have, and the run dies with error 1109 after the first table. Install the MariaDB client package (which ships '${n}') and re-run. Do NOT reach for --column-statistics=0: that flag does not exist on '${n}', so it fixes the wrong client and breaks the right one. Note: a MariaDB 12.x client requires TLS by default, so running '${n}' BY HAND against a server without it fails with "TLS/SSL error: SSL is required" (2026) and needs --skip-ssl. This command is not affected.`
 	} : { tool: r };
-}, Wr = (e) => (process.env.PATH ?? "").split(xe).filter((e) => e !== "").some((t) => E(I(t, e))), Gr = (e) => {
+}, Br = (e) => (process.env.PATH ?? "").split(F).filter((e) => e !== "").some((t) => fe(I(t, e))), Vr = (e) => {
 	switch (e) {
 		case "postgres": return "db.dump";
 		case "mysql":
@@ -2123,7 +2218,7 @@ var Br = (e, t) => ({
 		case "mssql": return "db.bacpac";
 		default: return "db.dump";
 	}
-}, Kr = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), Z = (e, t = 3306) => {
+}, Hr = (e) => e.filename ?? e.database ?? ((e.url ?? "").replace(/^file:/, "") || "app.sqlite"), Z = (e, t = 3306) => {
 	if (e.host || e.database) return {
 		host: e.host ?? "localhost",
 		port: e.port ?? t,
@@ -2139,7 +2234,7 @@ var Br = (e, t) => ({
 		password: decodeURIComponent(n.password) || "",
 		database: n.pathname.replace(/^\//, "") || ""
 	};
-}, qr = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Jr = (e, t, n) => {
+}, Ur = (e) => `Server=${e.host},${e.port};Database=${e.database};User ID=${e.username};Password=${e.password};TrustServerCertificate=True`, Wr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -2149,7 +2244,7 @@ var Br = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
-					...Xr,
+					...Kr,
 					"--dbname",
 					t.url,
 					"--file",
@@ -2165,7 +2260,7 @@ var Br = (e, t) => ({
 					"--format=custom",
 					"--no-owner",
 					"--no-privileges",
-					...Xr,
+					...Kr,
 					"-h",
 					e.host,
 					"-p",
@@ -2185,14 +2280,14 @@ var Br = (e, t) => ({
 			let r = Z(t);
 			return {
 				kind: "spawn",
-				...Ur(e, "dump"),
+				...zr(e, "dump"),
 				args: [
 					"--single-transaction",
 					"--routines",
 					"--triggers",
 					"--no-tablespaces",
 					"--protocol=TCP",
-					...Yr.map((e) => `--ignore-table=${r.database}.${e}`),
+					...Gr.map((e) => `--ignore-table=${r.database}.${e}`),
 					"-h",
 					r.host,
 					"-P",
@@ -2208,7 +2303,7 @@ var Br = (e, t) => ({
 		case "sqlite":
 		case "turso": return {
 			kind: "copy",
-			from: Kr(t),
+			from: Hr(t),
 			to: n
 		};
 		case "mssql": return {
@@ -2216,17 +2311,17 @@ var Br = (e, t) => ({
 			tool: "sqlpackage",
 			args: [
 				"/Action:Export",
-				`/SourceConnectionString:${qr(Z(t, 1433))}`,
+				`/SourceConnectionString:${Ur(Z(t, 1433))}`,
 				`/TargetFile:${n}`
 			],
 			env: {}
 		};
-		default: throw new W({
+		default: throw new U({
 			tool: "backup",
 			reason: `no native backup for dialect '${e}'`
 		});
 	}
-}, Yr = [d, u], Xr = Yr.flatMap((e) => ["--exclude-table", e]), Zr = (e) => e === "postgres" || e === "mysql" || e === "mariadb" ? Yr : [], Qr = (e, t, n) => {
+}, Gr = [u, l], Kr = Gr.flatMap((e) => ["--exclude-table", e]), qr = (e) => e === "postgres" || e === "mysql" || e === "mariadb" ? Gr : [], Jr = (e, t, n) => {
 	switch (e) {
 		case "postgres": {
 			if (t.url) return {
@@ -2268,7 +2363,7 @@ var Br = (e, t) => ({
 			let r = Z(t);
 			return {
 				kind: "spawn",
-				...Ur(e, "client"),
+				...zr(e, "client"),
 				args: [
 					"--protocol=TCP",
 					"-h",
@@ -2287,10 +2382,10 @@ var Br = (e, t) => ({
 		case "turso": return {
 			kind: "copy",
 			from: n,
-			to: Kr(t)
+			to: Hr(t)
 		};
 		case "mssql": {
-			let e = Z(t, 1433), r = ei(e.database);
+			let e = Z(t, 1433), r = Xr(e.database);
 			return {
 				kind: "mssql-replace",
 				load: {
@@ -2298,7 +2393,7 @@ var Br = (e, t) => ({
 					tool: "sqlpackage",
 					args: [
 						"/Action:Import",
-						`/TargetConnectionString:${qr({
+						`/TargetConnectionString:${Ur({
 							...e,
 							database: r
 						})}`,
@@ -2315,25 +2410,25 @@ var Br = (e, t) => ({
 				},
 				live: e.database,
 				scratch: r,
-				carry: Yr
+				carry: Gr
 			};
 		}
-		default: throw new W({
+		default: throw new U({
 			tool: "restore",
 			reason: `no native restore for dialect '${e}'`
 		});
 	}
-}, Q = (e) => `[${e.replaceAll("]", "]]")}]`, $ = (e) => `N'${e.replaceAll("'", "''")}'`, $r = "__voltro_restore_", ei = (e, t = le().slice(0, 8)) => `${e}${$r}${t}`, ti = (e) => e.replace($r, "__voltro_replaced_"), ni = (e) => `IF DB_ID(${$(e)}) IS NOT NULL BEGIN ALTER DATABASE ${Q(e)} SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE ${Q(e)} END`, ri = (e) => `DECLARE @leftover sysname, @drop nvarchar(max);
-DECLARE leftovers CURSOR LOCAL FAST_FORWARD FOR SELECT name FROM sys.databases WHERE name LIKE ${$(`${`${e}${$r}`.replace(/[\\%_[]/g, (e) => `\\${e}`)}%`)} ESCAPE N'\\';
+}, Q = (e) => `[${e.replaceAll("]", "]]")}]`, $ = (e) => `N'${e.replaceAll("'", "''")}'`, Yr = "__voltro_restore_", Xr = (e, t = se().slice(0, 8)) => `${e}${Yr}${t}`, Zr = (e) => e.replace(Yr, "__voltro_replaced_"), Qr = (e) => `IF DB_ID(${$(e)}) IS NOT NULL BEGIN ALTER DATABASE ${Q(e)} SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE ${Q(e)} END`, $r = (e) => `DECLARE @leftover sysname, @drop nvarchar(max);
+DECLARE leftovers CURSOR LOCAL FAST_FORWARD FOR SELECT name FROM sys.databases WHERE name LIKE ${$(`${`${e}${Yr}`.replace(/[\\%_[]/g, (e) => `\\${e}`)}%`)} ESCAPE N'\\';
 OPEN leftovers; FETCH NEXT FROM leftovers INTO @leftover;
 WHILE @@FETCH_STATUS = 0 BEGIN
   SET @drop = N'ALTER DATABASE ' + QUOTENAME(@leftover) + N' SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE ' + QUOTENAME(@leftover);
   EXEC(@drop);
   FETCH NEXT FROM leftovers INTO @leftover;
-END`, ii = (e) => {
-	let t = Q(e.live), n = Q(e.scratch), r = ti(e.scratch);
+END`, ei = (e) => {
+	let t = Q(e.live), n = Q(e.scratch), r = Zr(e.scratch);
 	return {
-		prepare: [ri(e.live)],
+		prepare: [$r(e.live)],
 		carry: e.carry.map((e) => {
 			let r = $(`${n}.dbo.${Q(e)}`), i = $(`${t}.dbo.${Q(e)}`);
 			return `IF OBJECT_ID(${r}) IS NOT NULL BEGIN
@@ -2350,41 +2445,41 @@ END`;
 			`ALTER DATABASE ${t} SET SINGLE_USER WITH ROLLBACK IMMEDIATE`,
 			`ALTER DATABASE ${t} MODIFY NAME = ${Q(r)}`,
 			`ALTER DATABASE ${n} MODIFY NAME = ${t}`,
-			ni(r)
+			Qr(r)
 		],
 		undoSwap: [`IF DB_ID(${$(e.live)}) IS NULL AND DB_ID(${$(r)}) IS NOT NULL ALTER DATABASE ${Q(r)} MODIFY NAME = ${t}`, `IF DB_ID(${$(e.live)}) IS NOT NULL ALTER DATABASE ${t} SET MULTI_USER`],
-		cleanup: [ni(e.scratch)]
+		cleanup: [Qr(e.scratch)]
 	};
-}, ai = (e) => {
+}, ti = (e) => {
 	let t = [];
 	for (let n = e, r = 0; n != null && r < 4; r++) {
 		let e = n instanceof Error ? n.message : typeof n == "object" && "message" in n ? String(n.message) : String(n);
 		e && !t.includes(e) && t.push(e), n = typeof n == "object" && "cause" in n ? n.cause : void 0;
 	}
 	return t.join(": ");
-}, oi = (e, t) => {
-	if (t === void 0) return n.fail(new W({
+}, ni = (e, t) => {
+	if (t === void 0) return n.fail(new U({
 		tool: "sqlpackage",
 		reason: "an mssql restore swaps databases and needs a SQL connection to the server; none was provided"
 	}));
-	let r = ii(e), i = (r, i) => t(e.server, i).pipe(n.mapError((e) => new W({
+	let r = ei(e), i = (r, i) => t(e.server, i).pipe(n.mapError((e) => new U({
 		tool: "sqlpackage",
-		reason: `${r}: ${ai(e)}`
+		reason: `${r}: ${ti(e)}`
 	}))), a = i("dropping the scratch database", r.cleanup).pipe(n.ignore);
 	return n.gen(function* () {
-		yield* i(`preparing ${e.scratch}`, r.prepare), yield* si(e.load).pipe(n.tapError(() => a)), yield* i(`carrying ${e.carry.join(", ")} into the imported copy`, r.carry).pipe(n.tapError(() => a)), yield* i(`swapping ${e.scratch} in as ${e.live}`, r.swap).pipe(n.tapError(() => i("putting the original database back", r.undoSwap).pipe(n.ignore)));
+		yield* i(`preparing ${e.scratch}`, r.prepare), yield* ri(e.load).pipe(n.tapError(() => a)), yield* i(`carrying ${e.carry.join(", ")} into the imported copy`, r.carry).pipe(n.tapError(() => a)), yield* i(`swapping ${e.scratch} in as ${e.live}`, r.swap).pipe(n.tapError(() => i("putting the original database back", r.undoSwap).pipe(n.ignore)));
 	});
-}, si = (e, t) => e.kind === "mssql-replace" ? oi(e, t) : e.kind === "copy" ? n.async((t) => {
-	let r = `${e.to}.restoring-${le()}`, i = (e) => {
+}, ri = (e, t) => e.kind === "mssql-replace" ? ni(e, t) : e.kind === "copy" ? n.callback((t) => {
+	let r = `${e.to}.restoring-${se()}`, i = (e) => {
 		try {
-			he(r);
+			k(r);
 		} catch {}
-		t(n.fail(new W({
+		t(n.fail(new U({
 			tool: "copy",
 			reason: e
 		})));
 	};
-	de(e.from, r, (a) => {
+	le(e.from, r, (a) => {
 		if (a) {
 			i(`copy ${e.from} → ${e.to}: ${a.message}`);
 			return;
@@ -2394,7 +2489,7 @@ END`;
 			`${e.to}-shm`,
 			`${e.to}-journal`
 		]) try {
-			he(t);
+			k(t);
 		} catch {}
 		D(r, e.to, (r) => {
 			if (r) {
@@ -2404,8 +2499,8 @@ END`;
 			t(n.void);
 		});
 	});
-}) : n.async((t) => {
-	let r = Te(e.tool, [...e.args], {
+}) : n.callback((t) => {
+	let r = we(e.tool, [...e.args], {
 		env: {
 			...process.env,
 			...e.env
@@ -2425,27 +2520,27 @@ END`;
 		s ??= e;
 	};
 	if (e.stdoutFile && r.stdout) {
-		let t = pe(e.stdoutFile);
-		t.on("error", (t) => c(`writing ${F(e.stdoutFile)}: ${t.message}`)), r.stdout.on("error", (e) => c(`reading the tool's output: ${e.message}`)), r.stdout.pipe(t);
+		let t = de(e.stdoutFile);
+		t.on("error", (t) => c(`writing ${P(e.stdoutFile)}: ${t.message}`)), r.stdout.on("error", (e) => c(`reading the tool's output: ${e.message}`)), r.stdout.pipe(t);
 	}
 	let l = 0;
 	if (e.stdinFile && r.stdin) {
-		let t = fe(e.stdinFile);
+		let t = ue(e.stdinFile);
 		t.on("data", (e) => {
 			l += e.length;
 		}), t.on("error", (t) => {
-			c(`reading ${F(e.stdinFile)}: ${t.message}`), r.stdin?.end();
+			c(`reading ${P(e.stdinFile)}: ${t.message}`), r.stdin?.end();
 		}), r.stdin.on("error", (t) => {
-			t.code !== "EPIPE" && c(`feeding ${F(e.stdinFile)} to ${e.tool}: ${t.message}`);
+			t.code !== "EPIPE" && c(`feeding ${P(e.stdinFile)} to ${e.tool}: ${t.message}`);
 		}), t.pipe(r.stdin);
 	}
 	let u = () => {
 		if (e.stdoutFile !== void 0) try {
-			he(e.stdoutFile);
+			k(e.stdoutFile);
 		} catch {}
 	};
 	r.on("error", (t) => {
-		u(), o(n.fail(new W({
+		u(), o(n.fail(new U({
 			tool: e.tool,
 			reason: `failed to launch (is '${e.tool}' installed + on PATH?): ${t.message}`,
 			...e.hint === void 0 ? {} : { hint: e.hint }
@@ -2456,45 +2551,45 @@ END`;
 			return;
 		}
 		u();
-		let r = e.stdinFile === void 0 ? "" : ` — ${l} of ${ci(e.stdinFile)} byte(s) of ${F(e.stdinFile)} had been fed to it`;
-		o(n.fail(new W({
+		let r = e.stdinFile === void 0 ? "" : ` — ${l} of ${ii(e.stdinFile)} byte(s) of ${P(e.stdinFile)} had been fed to it`;
+		o(n.fail(new U({
 			tool: e.tool,
-			reason: (t === 0 ? `exited cleanly, but ${s}` : `exited with code ${t}${s === void 0 ? "" : ` (${s})`}`) + r + (e.stdoutFile === void 0 ? "" : ` — the partial ${F(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
+			reason: (t === 0 ? `exited cleanly, but ${s}` : `exited with code ${t}${s === void 0 ? "" : ` (${s})`}`) + r + (e.stdoutFile === void 0 ? "" : ` — the partial ${P(e.stdoutFile)} was removed, so it cannot be mistaken for a backup`),
 			stderr: i.trim() === "" ? `(${e.tool} printed nothing to stderr)` : i.slice(-2e3),
 			...e.hint === void 0 ? {} : { hint: e.hint }
 		})));
 	});
-}), ci = (e) => {
+}), ii = (e) => {
 	try {
-		return String(me(e).size);
+		return String(O(e).size);
 	} catch {
 		return "?";
 	}
-}, li = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), ui = (e) => n.gen(function* () {
-	let t = yield* lt(e.scope ?? { kind: "all" }, e.snapshot, {
+}, ai = (e) => typeof e == "object" && e ? "fake" in e ? `fake:${e.fake}` : "custom" : String(e), oi = (e) => n.gen(function* () {
+	let t = yield* ct(e.scope ?? { kind: "all" }, e.snapshot, {
 		store: e.store,
 		...e.tenantTables ? { tenantTables: e.tenantTables } : {}
-	}), r = sn(t.tables, e.snapshot), i = e.classification ?? Oe(e.snapshot), a = e.sampleSize ?? 20, o = He(r.map((t) => ({
+	}), r = on(t.tables, e.snapshot), i = e.classification ?? De(e.snapshot), a = e.sampleSize ?? 20, o = Ve(r.map((t) => ({
 		name: t,
 		columns: (e.snapshot.tables.find((e) => e.name === t)?.columns ?? []).map((e) => ({
 			name: e.name,
 			type: e.type
 		}))
-	})), i, e.masking), s = [], c = [];
+	})), i, e.masking), s = [], l = [];
 	for (let i of r) {
 		let r = t.predicateFor(i), u = yield* C(e.store, {
 			table: i,
 			chunkSize: a,
 			...r === void 0 ? {} : { where: r }
-		}).pipe(l.take(a), l.runCollect, n.map((e) => [...e])), d = u.map((t) => Ge(t, i, o.actions, e.masking.seed));
-		c.push(...We(d, i, o.actions));
+		}).pipe(c.take(a), c.runCollect, n.map((e) => [...e])), d = u.map((t) => We(t, i, o.actions, e.masking.seed));
+		l.push(...Ue(d, i, o.actions));
 		let f = u[0], p = d[0], m = [];
 		if (f && p) for (let [e, t] of Object.entries(o.actions)) {
 			if (!e.startsWith(`${i}.`) || t === "keep") continue;
 			let n = e.slice(i.length + 1);
 			m.push({
 				column: n,
-				action: li(t),
+				action: ai(t),
 				before: f[n],
 				after: p[n]
 			});
@@ -2506,10 +2601,10 @@ END`;
 	}
 	return {
 		tables: s,
-		leaks: c,
+		leaks: l,
 		unclassified: o.unclassified
 	};
-}), di = (e, t) => {
+}), si = (e, t) => {
 	let n = new Map(t.map((e) => [e.name, e])), r = [], i = {};
 	for (let t of e) {
 		let e = n.get(t.name);
@@ -2564,7 +2659,7 @@ END`;
 		skipColumns: i,
 		refuse: r.some((e) => e.verdict === "refuse")
 	};
-}, fi = (e) => {
+}, ci = (e) => {
 	if (e.findings.length === 0) return ["  schema matches the bundle"];
 	let t = {
 		safe: "✓",
@@ -2575,4 +2670,4 @@ END`;
 	return n.push(""), n.push(`  discarded: ${r("value-dropped")}   defaulted: ${r("filled-by-default")}   refused: ${r("refuse")}`), e.refuse && (n.push(""), n.push("  REFUSED — no row was written. These are the differences that would make"), n.push("  imported rows WRONG rather than merely incomplete.")), n;
 };
 //#endregion
-export { Pt as ASSETS_DIR, Ft as ASSET_INDEX_FILE, H as BundleError, Xe as CodecError, Qe as CompressionError, rt as CrossDialectError, Nt as DATA_DIR, De as DEFAULT_CLASS_ACTIONS, Ke as ENVIRONMENT_LOCAL_TABLES, qe as ENVIRONMENT_PORTABLE_TABLES, Yr as EXCLUDED_FROM_DUMP, wt as FORMAT_VERSION, nt as ImportModeError, Ze as IntegrityError, It as LEDGER_FILE, jt as MANIFEST_FILE, tt as MaskingError, W as NativeToolError, $e as RowsRefusedError, ar as SAVEPOINT_BATCH_SIZE, Nn as STAGING_PREFIX, et as SchemaDriftError, U as ScopeError, B as applyAction, sr as asImportError, fr as assessLiveImport, Kt as assetDone, Gr as backupArtifactName, Jr as backupCommand, Pn as canStage, xn as canonicalType, gt as captureAssetsToCas, wn as checkPortability, nr as checkSchemaDrift, Oe as classificationFromSnapshot, di as classifyImportDrift, xt as compressionExt, ot as computeSubsetIds, Yn as decideStaging, At as decodeManifest, nn as decodeRow, en as decodeValue, zr as decryptStream, dr as defineDataProfile, tr as diffSnapshots, Er as dirBlobSink, Rn as dropStagingSql, Zr as dumpExcludedTables, Ut as emptyLedger, kt as encodeManifest, tn as encodeRow, Qt as encodeValue, Rr as encryptStream, Ye as environmentLocalNotice, Je as environmentLocalReason, Wn as execStatements, fi as formatImportDrift, Tn as formatIssue, yt as hasZstd, V as isEnvironmentLocal, St as makeCompressor, Ct as makeDecompressor, Ge as maskRow, ii as mssqlReplaceStatements, ei as mssqlScratchName, on as ndjsonToRows, mt as noAssetProgress, bn as outsideReferenceRefusal, yn as outsideReferencesInto, br as packBundle, wr as peekBundle, bt as pickCompression, He as planMasking, ui as previewMasking, _t as readAssetIndex, Wt as readLedger, ke as resolveAction, lt as resolveScope, pt as restoreAssetFromCas, vt as restoreAssetsFromCas, Qr as restoreCommand, an as rowsToNdjson, vn as runExport, ur as runImport, si as runNativeStep, We as scanForLeaks, J as stagingNameFor, dt as storageAssetSink, ut as storageAssetSource, Hr as storageBlobSink, Br as storageBlobSource, Vr as storageRefsBlobSource, st as subsetToScope, Gt as tableDone, sn as topoSortTables, Cr as unpackBundle, Tr as unpackBundleToDir, ft as writeAssetToCas, K as writeLedger };
+export { Nt as ASSETS_DIR, Pt as ASSET_INDEX_FILE, H as BundleError, Ye as CodecError, Ze as CompressionError, rt as CrossDialectError, Mt as DATA_DIR, Ee as DEFAULT_CLASS_ACTIONS, Ge as ENVIRONMENT_LOCAL_TABLES, Ke as ENVIRONMENT_PORTABLE_TABLES, Gr as EXCLUDED_FROM_DUMP, Ct as FORMAT_VERSION, nt as ImportModeError, Xe as IntegrityError, Ft as LEDGER_FILE, At as MANIFEST_FILE, tt as MaskingError, U as NativeToolError, $e as RowsRefusedError, nr as SAVEPOINT_BATCH_SIZE, Mn as STAGING_PREFIX, et as SchemaDriftError, Qe as ScopeError, B as applyAction, ir as asImportError, lr as assessLiveImport, Gt as assetDone, Vr as backupArtifactName, Wr as backupCommand, Nn as canStage, bn as canonicalType, ht as captureAssetsToCas, Cn as checkPortability, $n as checkSchemaDrift, De as classificationFromSnapshot, si as classifyImportDrift, bt as compressionExt, at as computeSubsetIds, Jn as decideStaging, kt as decodeManifest, tn as decodeRow, $t as decodeValue, Fr as decryptStream, cr as defineDataProfile, Qn as diffSnapshots, Cr as dirBlobSink, Ln as dropStagingSql, qr as dumpExcludedTables, Ht as emptyLedger, Ot as encodeManifest, en as encodeRow, Zt as encodeValue, Pr as encryptStream, Je as environmentLocalNotice, qe as environmentLocalReason, Un as execStatements, ci as formatImportDrift, wn as formatIssue, vt as hasZstd, V as isEnvironmentLocal, xt as makeCompressor, St as makeDecompressor, We as maskRow, ei as mssqlReplaceStatements, Xr as mssqlScratchName, an as ndjsonToRows, pt as noAssetProgress, yn as outsideReferenceRefusal, vn as outsideReferencesInto, _r as packBundle, xr as peekBundle, yt as pickCompression, Ve as planMasking, oi as previewMasking, gt as readAssetIndex, Ut as readLedger, Oe as resolveAction, ct as resolveScope, ft as restoreAssetFromCas, _t as restoreAssetsFromCas, Jr as restoreCommand, rn as rowsToNdjson, _n as runExport, sr as runImport, ri as runNativeStep, Ue as scanForLeaks, q as stagingNameFor, ut as storageAssetSink, lt as storageAssetSource, Rr as storageBlobSink, Ir as storageBlobSource, Lr as storageRefsBlobSource, ot as subsetToScope, Wt as tableDone, on as topoSortTables, br as unpackBundle, Sr as unpackBundleToDir, dt as writeAssetToCas, G as writeLedger };