@voltro/data-transfer 0.86.0 → 0.87.0

package/dist/environmentLocal.js

@@ -1,6 +1,44 @@
 //#region src/environmentLocal.ts
 var e = /* @__PURE__ */ new Map([
+	["_voltro_billing_customer_accounts", "financial provider/account/mode intent recorded by THIS deployment — a foreign namespace must not qualify local usage or grant adoption of prior financial rows"],
+	["_voltro_billing_customer_custody", "current and retired customer ownership positively admitted HERE — foreign rows cannot establish this deployment's original customer evidence or replace its current slot"],
+	["_voltro_billing_account_invoices", "account-qualified invoice observations retained HERE — a foreign native record is not a locally admitted provider/customer observation or revision"],
+	["_voltro_billing_invoice_history_walks", "account/customer/custody-qualified history cursor admitted HERE — a foreign walk cannot establish this deployment's retained inventory or traversal progress"],
+	["_voltro_billing_invoice_history_pages", "native history-page admission for THIS deployment's exact custody/walk and revision — foreign page receipts cannot qualify local provider history"],
+	["_voltro_billing_invoice_history_references", "invoice references admitted against THIS deployment's custody and complete native page — foreign references cannot become locally owned processing work"],
+	["_voltro_billing_invoice_history_work", "execution claims and observed/retry results bound to THIS deployment's custody, journal and invoice observation IDs — a foreign result cannot suppress local reconciliation"],
+	["_voltro_billing_invoice_history_scan_accounts", "customer-inventory continuation for THIS deployment and exact provider account — a foreign cursor cannot suppress local invoice-history traversal"],
+	["_voltro_billing_invoice_history_dispatch", "customer/walk/lane traversal positions validated against THIS deployment's native custody and receipts — foreign positions cannot skip local processing work"],
+	["_voltro_cms_output_heads", "activation and safety epochs of THIS deployment — foreign rows invent an active output pointer or disconnect the local durable deny inventory from its exact generation"],
+	["_voltro_cms_output_activations", "signed output activations issued HERE — foreign markers would select another deployment's output roots, region keys and app authority"],
+	["_voltro_cms_output_denies", "durable output withdrawals accepted HERE — preserve the destination deny rows together with their local safety-generation head during logical imports; native backups retain both"],
+	["_voltro_cms_route_history_heads", "complete observed output-history fences of THIS deployment — foreign heads assert local activation/source continuity that never occurred here"],
+	["_voltro_cms_route_history", "output URLs observed by THIS deployment's original activations — foreign history invents local delivery and redirect obligations"],
+	["_voltro_cms_output_deployments", "the current app and policy binding admitted HERE — a foreign binding could authorize or refuse a local output against another deployment's revision"],
+	["_voltro_cms_output_deployment_builds", "original app contracts admitted by THIS deployment — foreign records would invent local build/admission lineage"],
+	["_voltro_cms_output_targets", "original CMS output targets, local signed path jobs and regional output IDs — a foreign record would select another deployment's original jobs and outputs"],
+	["_voltro_cms_build_applications", "prepared application archives admitted by THIS backend for its original deployments — a foreign catalog row would invent local code custody or select an archive this backend never admitted"],
+	["_voltro_cms_build_snapshots", "private snapshots captured HERE against the original local publication, app and storage custody — foreign manifests must not become locally admitted build inputs"],
+	["_voltro_cms_snapshot_resources", "the complete private resource closure of local build snapshots — importing another backend's rows would detach original manifests from this backend's publication and retained bytes"],
+	["_voltro_cms_publication_states", "sealed publication captures with this backend's checkpoint, generation, release and expiry — a logical row copy does not perform a local capture"],
+	["_voltro_cms_publication_state_entries", "the immutable private entry closure of local publication captures — preserve it together with the destination snapshot roots rather than mixing two capture histories"],
+	["_voltro_cms_render_read_grants", "read capabilities issued by THIS backend's keys and credential parents — foreign grants cannot authorize local execution or extend local revocation and expiry state"],
+	["_voltro_cms_snapshot_media_captures", "live snapshot-media capture attempts and retained local custody — foreign nonce, cleanup and completion records would resume work never admitted here"],
+	["_voltro_cms_static_path_sets", "original local signed path jobs bound to the exact consumer, snapshot and execution — foreign jobs cannot establish this backend's native enumeration evidence"],
+	["_voltro_cms_static_path_pages", "input, stage and signed output pages belonging to local path jobs — keep the original complete job/page closure with its local signatures and progress"],
+	["_voltro_cms_public_route_registry_heads", "the current locally admitted app-route namespace revision — a foreign head would select an application definition this backend never bound"],
+	["_voltro_cms_public_route_registry_bindings", "native route-definition admissions with local publication origins and integrity chains — transferring business content must not replace operator code/schema admission"],
+	["_voltro_cms_public_route_history_heads", "local public route-history capture fences — foreign heads invent continuity between destination publication observations that never occurred"],
+	["_voltro_cms_public_route_history", "public routes observed from this backend's original namespace and publication history — foreign observations cannot prove local ownership or redirect obligations"],
+	["_voltro_cms_route_disposition_heads", "the current revision and count of locally approved redirect/disposition policy — a foreign head could activate policy without a destination approval"],
+	["_voltro_cms_route_dispositions", "current native redirect/disposition approvals with credential authority and approval time — preserve destination authority instead of importing another backend's decisions"],
+	["_voltro_cms_route_disposition_revisions", "immutable local redirect/disposition approval revisions and predecessor chains — a copied foreign revision must not establish a local approval or rollback history"],
+	["_voltro_cms_site_state_heads", "site/domain mutation lock roots owned by THIS backend — logical content transfer must preserve the destination coordination identities"],
+	["cms_site_domains", "domain ownership challenges, verified status and primary-host decisions accepted HERE — a foreign record cannot establish ownership of a domain for this deployment"],
 	["_voltro_storage_reference_catalogue", "the identity of THIS deployment's storage reference catalogue — a foreign marker would claim that independent metadata stores are one catalogue"],
+	["_voltro_hot_kv", "live hot counters, values and leases of THIS deployment — a foreign row would admit, throttle or fence local work; rebuild hot state from durable domain data"],
+	["_voltro_hot_z", "live sorted hot projections of THIS deployment — foreign members and scores would drive decisions against another source; rebuild from durable domain rows"],
+	["_voltro_privacy_requests", "erase requests, withdrawal windows and completed-plugin cursors accepted HERE — a foreign request could erase or suppress work this deployment never accepted"],
 	["_voltro_inspect_create_receipts", "inspect creation commands accepted by THIS deployment — a foreign receipt would replay or suppress a creation the target never accepted"],
 	["_voltro_isr_cache", "pages rendered by THIS deployment’s web processes — a foreign row would serve another environment’s HTML here"],
 	["_voltro_web_replicas", "heartbeats of the web processes running HERE — a foreign row advertises replicas that do not exist in the target"],
@@ -22,15 +60,18 @@ var e = /* @__PURE__ */ new Map([
 	["_voltro_notification_push_subscriptions", "browser push endpoints bound to THIS deployment's VAPID key — the browser's applicationServerKey is derived from `VOLTRO_VAPID_PRIVATE_KEY`, so a push service refuses a delivery signed by another one. A foreign row makes the target attempt a delivery that must fail, and the auto-prune then deletes a subscription that was valid where it came from"],
 	["_voltro_schedule_claims", "live leases held by THIS deployment's replicas — a foreign row hands out a lease nobody holds"],
 	["_voltro_change_claims", "the record that ONE of THIS deployment's replicas already handled a given change — a foreign row asserts that an effect fired here when it fired somewhere else, so the subscriber or reaction it gates stands down for a notification nobody sent"],
+	["_voltro_api_role_workload_buckets", "measured loop history of THIS deployment and process incarnations — foreign rows invent local workload evidence"],
 	["_voltro_replica_observations", "what THIS deployment's replicas last published about themselves — a foreign row invents a replica that does not exist here, and a fleet answer would then report it as present or, once it ages, as a replica that has stopped answering"],
 	["_voltro_data_transfers", "which bundles moved through HERE, in or out — a foreign row claims a transfer this deployment never ran"],
 	["_voltro_replace_in_progress", "the marker a destructive import HERE left behind — a foreign row refuses a boot over a healthy database"],
 	["_voltro_wakeups", "pending wakeups addressed to THIS deployment's runners"],
 	["_voltro_workflow_watermarks", "how far a consumer has read THIS deployment's event journal — a foreign position skips events"],
+	["_voltro_workflow_journal_routing", "the routing generation and shard layout of THIS deployment's workflow journal — a foreign row makes the target refuse its own runtimes or route work to the wrong executors"],
 	["_voltro_workflow_pending", "starts waiting to be drained HERE — a foreign row makes the target RUN a workflow somebody queued elsewhere"],
 	["_voltro_workflow_admissions", "the in-flight accounting a concurrency gate decides on — a foreign row makes the target refuse or admit wrongly"],
 	["_voltro_workflow_pauses", "which workflows an operator paused HERE — a foreign row silently pauses them in the target"],
 	["_voltro_workflow_event_deliveries", "which (event, trigger) pairs were already delivered HERE — a foreign row SUPPRESSES a delivery the target owes"],
+	["_voltro_chat_retention", "how far THIS deployment's chat retention sweep has progressed — a foreign cursor makes the target skip channels it still owes a sweep"],
 	["_voltro_traces", "spans recorded HERE — a foreign span claims a request this deployment never served"],
 	["_voltro_undo_log", "the before-images of mutations made HERE — a foreign row offers to undo a write into rows the target does not have"],
 	["_voltro_outbox", "messages waiting to be SENT by this deployment — a foreign row makes the target deliver something queued elsewhere"],
@@ -47,6 +88,8 @@ var e = /* @__PURE__ */ new Map([
 	["_voltro_storage_object_claims", "which callers HERE still hold a shared object — a foreign row keeps the target retaining a key for a claimant it never had, or releases one it does"],
 	["_voltro_storage_put_intents", "the ref a reservation HERE will become — a foreign row makes the target confirm a write it never received"],
 	["_voltro_storage_operation_locks", "the per-tenant serialisation rows the operation transactions lock — a foreign row is a lock nobody here holds"],
+	["_voltro_storage_retained_captures", "a capture HERE pinning physical generations in THIS provider — a foreign row makes the target retain, seal or release keys it does not own"],
+	["_voltro_storage_retained_capture_items", "the work items of a retained capture, by physical pin — they belong with `_voltro_storage_retained_captures`, which stays local"],
 	["_voltro_idempotency", "the request keys this deployment has already answered — a foreign key SUPPRESSES a request the target never served"],
 	["_voltro_webhook_deliveries", "the delivery attempts this deployment made to a subscriber — a foreign row claims a call the target never placed"],
 	["_voltro_schedule_runs", "every schedule firing that happened HERE, replica ids included — a foreign row is history the target did not live"],
@@ -69,12 +112,52 @@ var e = /* @__PURE__ */ new Map([
 	["_voltro_notification_held", "notifications waiting to be SENT from here — a foreign row makes the target deliver something queued elsewhere"],
 	["_voltro_webhook_event_stats", "per-deployment delivery counters a backoff decision reads — foreign counts steer the target's retries"],
 	["_voltro_webhook_rate_windows", "the live rate-limit windows this deployment is inside — a foreign window throttles or releases wrongly"],
+	["_voltro_field_keys", "which field-encryption key id is which in THIS environment, with each key's canary — a foreign row makes the boot demand keys this environment never held; the first boot records the local keys and checks them against the data"],
+	["_voltro_field_key_holders", "the leases THIS deployment's processes hold on their keys — a foreign row is a process that does not exist here, and a rotation would wait for it"],
+	["_voltro_field_key_reports", "the last count and re-key of THIS environment's sealed values — a foreign row reports another database's progress as this one's"],
+	["_voltro_secret_windows", "what THIS deployment's processes signed under each secret and which values they hold — a foreign row holds a replaced secret's window open, or closes it, for signatures this environment never made"],
 	["cluster_runners", "the workflow runners of THIS deployment and their addresses — a foreign row routes shards to a runner that does not exist here"],
 	["cluster_locks", "the shard leases THIS deployment's runners hold — a foreign row holds a shard for nobody, and its work stalls"],
 	["cluster_messages", "workflow messages in flight HERE — a foreign row makes the target run work that was started, and may be running, elsewhere"],
 	["cluster_replies", "replies to those messages — a foreign row answers a request the target never sent"],
-	["cluster_migrations", "which engine migrations ran HERE — a foreign row marks the target's engine tables migrated when they are not"]
+	["cluster_migrations", "which engine migrations ran HERE — a foreign row marks the target's engine tables migrated when they are not"],
+	["_voltro_billing_checkout_operations", "checkout operations in flight against THIS deployment's payment provider account — a foreign row would complete or refuse a checkout the target never started"],
+	["_voltro_billing_close_operations", "account fences and subscription requests made against THIS deployment's provider account — a foreign tombstone closes or blocks an account the target holds"],
+	["_voltro_billing_customers", "the link from a tenant to a customer at THIS deployment's payment provider (live or test mode) — a foreign link would charge or report usage to another account's customer"],
+	["_voltro_billing_dunning_notices", "the dunning notices THIS deployment already claimed and sent — a foreign row suppresses a notice the target never sent"],
+	["_voltro_billing_flush_claims", "which usage flush windows THIS deployment already reported — a foreign claim skips a report the target owes its provider"],
+	["_voltro_billing_subscriptions", "the subscription state THIS deployment's provider account holds per tenant — a foreign row grants or withdraws entitlements the target's provider never sold"],
+	["_voltro_billing_usage", "metered counters THIS deployment reports to its provider — foreign counts would bill usage that never happened here"],
+	["_voltro_billing_usage_events", "the usage events THIS deployment recorded for reporting — foreign events would be billed by the target"],
+	["_voltro_cdcout_claims", "which changes THIS deployment already claimed for outgoing delivery — a foreign claim skips a delivery the target owes"],
+	["_voltro_cdcout_leases", "the delivery leases held by THIS deployment's processes — a foreign lease blocks the target's own deliverer"],
+	["_voltro_cdcout_outbox", "changes queued for delivery FROM this deployment — a foreign row would be delivered again by the target"],
+	["_voltro_feature_flag_usage", "which flags THIS deployment evaluated, per day — foreign observations report usage that did not happen here"],
+	["_voltro_liveops_maintenance", "maintenance windows of THIS deployment — a foreign window puts the target into, or out of, maintenance"],
+	["_voltro_liveops_maintenance_requests", "the receipts of maintenance requests made against THIS deployment — they belong with its maintenance windows"],
+	["_voltro_liveops_maintenance_tenants", "which tenants a maintenance window of THIS deployment covers — they belong with its maintenance windows"],
+	["_voltro_mail_idempotency", "which messages THIS deployment already handed to its mail provider — a foreign receipt suppresses a send the target owes"],
+	["_voltro_mail_suppression", "the recipients THIS deployment's mail provider reported as bounced or complaining — a foreign row skips deliveries the target was never told to skip"],
+	["_voltro_migration_ops", "which migration operations ran HERE, for resuming one — a foreign row marks the target's schema steps done when they are not"],
+	["_voltro_mm_assignments", "matches made by THIS deployment's live queue — a foreign assignment seats players in a match the target never formed"],
+	["_voltro_mm_parties", "ephemeral matchmaking groups of THIS deployment, gone with their last member — a foreign party admits players into a group the target never formed"],
+	["_voltro_mm_party_invites", "invites into those ephemeral parties — they belong with the parties"],
+	["_voltro_mm_party_members", "members of those ephemeral parties — they belong with the parties"],
+	["_voltro_mm_queue_admission", "the live matchmaking queue's admission budget — a foreign row blocks or admits queue entries the target is not deciding"],
+	["_voltro_mm_tickets", "tickets waiting in THIS deployment's live queue — a foreign ticket would be matched by the target"],
+	["_voltro_ratelimit", "request counts against THIS deployment's limits — foreign counts refuse callers the target never saw"],
+	["_voltro_room_hosts", "the Room host processes registered with THIS deployment — a foreign host is an address the target would route players to"],
+	["_voltro_room_outbox", "commands queued for THIS deployment's Room hosts — a foreign command would be executed by the target's hosts"],
+	["_voltro_room_seats", "live seat reservations and sessions on THIS deployment's hosts — a foreign seat admits a session the target never issued"],
+	["_voltro_saml_logout", "SAML logout requests THIS deployment issued — a foreign row ends sessions the target never asked to end"],
+	["_voltro_saml_replay", "SAML assertions THIS deployment already accepted, kept to refuse a replay — a foreign row refuses assertions the target never saw"],
+	["_voltro_search_drift", "how far THIS deployment's search index lags its rows — foreign drift reports an index state the target does not have"],
+	["_voltro_search_stats", "search statistics measured on THIS deployment's index — foreign rows describe another index"],
+	["_voltro_stream_events", "chunks of model streams THIS deployment is serving, kept to resume a reconnect — a foreign row resumes a stream the target never started"],
+	["_voltro_stream_state", "the state of those in-flight model streams — it belongs with them"]
 ]), t = /* @__PURE__ */ new Map([
+	["_voltro_billing_invoice_observations", "retained unqualified invoice history belonging to the app — these rows remain historical data and never establish current account-qualified observation or ownership"],
+	["_voltro_room_lockstep_ticks", "confirmed match input matrices are durable room data — they travel with the parent room journal roster, tick count and chained digest; omitting them makes restored match history incomplete"],
 	["_voltro_comment_thread_events", "the status history of the app's comment threads — belongs with those threads"],
 	["_voltro_agent_threads", "conversations the app's users had — app data"],
 	["_voltro_agent_messages", "the messages in those conversations — app data"],
@@ -110,9 +193,190 @@ var e = /* @__PURE__ */ new Map([
 	["_voltro_feature_flag_audit", "who changed which flag — belongs with the flags"],
 	["_voltro_comments", "the comments the app's users wrote — app data"],
 	["_voltro_comment_threads", "the threads those comments hang on — app data"],
+	["_voltro_comment_thread_events", "thread status changes, actors and reasons — app history that belongs with the threads"],
 	["_voltro_comment_reactions", "the reactions the app's users left — app data"],
 	["_voltro_comment_reads", "which comments each user has read — app data, and losing it re-marks everything unread"],
-	["_voltro_comment_thread_events", "the status changes the app's users made on a thread — app data"]
+	["_voltro_chat_admissions", "durable chat identity admissions and erasure tombstones — app data, and a restore without them re-admits erased subjects"],
+	["_voltro_chat_evidence", "moderation evidence the app retained for its players' messages — app data"],
+	["_voltro_eco_code_claims", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_code_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_code_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_codes", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_container_openings", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_container_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_container_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_containers", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_currencies", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_iap_account_tokens", "the store account tokens bound to the app's players — app data, and a restore without them breaks purchase attribution"],
+	["_voltro_eco_iap_accounts", "the store account tokens bound to the app's players — app data, and a restore without them breaks purchase attribution"],
+	["_voltro_eco_iap_namespaces", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_iap_notice_namespaces", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_iap_notice_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_iap_notices", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_iap_orders", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_iap_receipts", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_iap_refund_adjustments", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_iap_refund_namespaces", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_iap_refund_orders", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_iap_refund_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_iap_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_ledger", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_loyalty_definitions", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_loyalty_entries", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_loyalty_seasons", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_loyalty_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_loyalty_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_offers", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_orders", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_piggy_definitions", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_piggy_events", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_piggy_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_piggy_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_shop_counters", "the players' current economy state — app data"],
+	["_voltro_eco_shop_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_shop_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_subscription_events", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_subscription_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_subscription_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_subscriptions", "economy definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_eco_trade_operations", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_trade_subjects", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_trade_tenants", "fence and count rows for the economy rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_eco_trades", "the players' current economy state — app data"],
+	["_voltro_eco_tx", "the players' economy history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_eco_wallets", "the players' current economy state — app data"],
+	["_voltro_inv_catalog", "inventory definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_inv_catalog_heads", "the current inventory catalog revision per channel and locale — app configuration that its stored history refers to"],
+	["_voltro_inv_catalog_locks", "fence and count rows for the inventory rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_inv_catalog_revisions", "inventory definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_inv_catalog_versions", "inventory definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_inv_items", "the players' current inventory state — app data"],
+	["_voltro_inv_ledger", "the players' inventory history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_inv_loadouts", "the players' current inventory state — app data"],
+	["_voltro_inv_operations", "the players' inventory history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_inv_recipes", "inventory definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_inv_subjects", "fence and count rows for the inventory rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_lb_bucket_assignments", "the players' current leaderboard state — app data"],
+	["_voltro_lb_league_members", "players' current league divisions are durable app data and must travel with leaderboard history"],
+	["_voltro_lb_league_rolls", "league-close movement receipts belong to the app history; preserve retry identity so restored divisions are not promoted or demoted twice"],
+	["_voltro_lb_rating_matches", "the players' leaderboard history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_lb_rating_pools", "leaderboard definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_lb_rating_results", "the players' leaderboard history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_lb_ratings", "the players' current leaderboard state — app data"],
+	["_voltro_prog_achievement_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_achievement_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_achievement_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_achievement_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_achievement_unlock_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_achievements", "the players' current progression state — app data"],
+	["_voltro_prog_daily", "the players' current progression state — app data"],
+	["_voltro_prog_daily_claims", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_daily_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_daily_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_daily_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_daily_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_origins", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_pass", "the players' current progression state — app data"],
+	["_voltro_prog_pass_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_pass_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_pass_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_pass_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_pass_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_quest_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_quest_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_quest_origins", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_quest_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_quest_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_quest_windows", "the players' current progression state — app data"],
+	["_voltro_prog_quests", "the players' current progression state — app data"],
+	["_voltro_prog_rank", "the players' current progression state — app data"],
+	["_voltro_prog_rank_closure_units", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_rank_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_rank_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_rank_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_rank_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_rank_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_resource_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_resource_movements", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_resource_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_resource_origins", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_resource_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_resources", "the players' current progression state — app data"],
+	["_voltro_prog_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_stat_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_stats", "the players' current progression state — app data"],
+	["_voltro_prog_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_tracks", "the players' current progression state — app data"],
+	["_voltro_prog_tutorial", "the players' current progression state — app data"],
+	["_voltro_prog_tutorial_definitions", "progression definitions the app authored or imported — app configuration that its stored history refers to"],
+	["_voltro_prog_tutorial_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_tutorial_operations", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_tutorial_rewards", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_prog_tutorial_subjects", "fence and count rows for the progression rows they guard — they travel with those rows, or the recorded counts no longer match"],
+	["_voltro_prog_xp_ledger", "the players' progression history and receipts — app data, and the idempotent retries it answers"],
+	["_voltro_comment_thread_events", "the status changes the app's users made on a thread — app data"],
+	["_voltro_billing_invoices", "retained invoice-event history belonging to the app, like the invoice observations — historical data that never establishes a current provider account or customer"],
+	["_voltro_brackets", "tournament brackets the app's players compete in — app data"],
+	["_voltro_chat_channels", "the app's chat channels — app data"],
+	["_voltro_chat_media", "media the app's users shared in chat — app data, the bytes travel with the assets"],
+	["_voltro_chat_messages", "messages the app's users wrote — app data"],
+	["_voltro_cms_asset_rendition_history", "the history of rendition selections for the app's CMS assets — belongs with the assets"],
+	["_voltro_cms_asset_rendition_selections", "which rendition of a CMS asset version is selected — belongs with the assets"],
+	["_voltro_cms_asset_renditions", "the rendition catalog of the app's CMS asset versions — belongs with the assets"],
+	["_voltro_cms_change_heads", "the sequence head of the CMS change journal that travels with it — without it the target would issue sequence numbers the journal already holds"],
+	["_voltro_consent", "the consent decisions the app's users made — compliance data the app owns, and a restore without it loses their decisions"],
+	["_voltro_geo_chunk_deltas", "the durable changes to the app's world geometry — app data"],
+	["_voltro_geo_journal", "the journal and receipts of those geometry changes — app data, and the idempotent retries it answers"],
+	["_voltro_geo_journal_archives", "the custody index of archived geometry journal bytes — belongs with the journal, the bytes travel with the assets"],
+	["_voltro_geo_migrations", "the migrations the app's geometry went through, with source and target links — belongs with the geometry"],
+	["_voltro_geo_versions", "the immutable manifests of the app's geometry versions — app data"],
+	["_voltro_guild_members", "who belongs to the app's guilds — app data"],
+	["_voltro_inbox_messages", "what the app's players received in their inbox — app data"],
+	["_voltro_inbox_requests", "the receipts of inbox requests — app data, and the idempotent retries it answers"],
+	["_voltro_inbox_subjects", "the per-player inbox state — app data"],
+	["_voltro_lb_boards", "the app's leaderboards — app data"],
+	["_voltro_lb_periods", "the periods of those leaderboards — app data"],
+	["_voltro_lb_records", "the scores the app's players posted — app data"],
+	["_voltro_lb_subject_admission", "the per-player admission and erasure state of the leaderboards — app data, and a restore without it re-admits erased players"],
+	["_voltro_lb_tournament_entries", "who entered the app's tournaments — app data"],
+	["_voltro_lb_tournaments", "the app's tournaments — app data"],
+	["_voltro_liveops_event_requests", "the receipts of live-event requests — app data, and the idempotent retries it answers"],
+	["_voltro_liveops_event_tenants", "which tenants a live event covers — belongs with the events"],
+	["_voltro_liveops_events", "the live events the app scheduled — app content, like its feature flags"],
+	["_voltro_oauth_identities", "which social login belongs to which of the app's users — app data, and a restore without it locks those users out"],
+	["_voltro_player_name_history", "the players' previous names — app data"],
+	["_voltro_players", "the app's player profiles — app data, and a restore without them loses every player"],
+	["_voltro_rbac_roles", "the roles the app defined — app data its authorisation decisions are made from"],
+	["_voltro_rbac_user_roles", "which user holds which role — app data, like the relationship tuples"],
+	["_voltro_release_apps", "the client apps the app ships releases for — app configuration"],
+	["_voltro_release_artifacts", "the artifacts of those releases — belongs with the releases, the bytes travel with the assets"],
+	["_voltro_release_channels", "the release channels the app defined — app configuration, like its feature flags"],
+	["_voltro_release_events", "the history of those releases — belongs with the releases"],
+	["_voltro_releases", "the releases the app published — app data"],
+	["_voltro_replays", "recorded match replays — app data"],
+	["_voltro_room_creations", "the receipts of Room creation requests — app data, and the idempotent retries it answers"],
+	["_voltro_room_snapshot_segments", "the segments of durable Room snapshots — belongs with the snapshots"],
+	["_voltro_room_snapshots", "durable Room snapshots — the state a Room resumes from, app data"],
+	["_voltro_room_subject_privacy", "per-player Room resume and erasure receipts — app data, and a restore without them re-admits erased players"],
+	["_voltro_rooms", "the app's Rooms with their lockstep journal header — the ticks travel with it (their host binding is re-established by the target's own hosts)"],
+	["_voltro_saves", "the players' saved games — app data"],
+	["_voltro_saves_history", "previous versions of those saves — app data"],
+	["_voltro_saves_requests", "the receipts of save requests — app data, and the idempotent retries it answers"],
+	["_voltro_saves_subjects", "the per-player save state — app data"],
+	["_voltro_social_recent", "who the app's players recently played with — app data"],
+	["_voltro_social_relations", "the players' friends and blocks — app data"],
+	["_voltro_social_settings", "the players' social settings — app data"],
+	["_voltro_tournament_admissions", "the admissions into the app's tournament brackets — app data, and the idempotent retries it answers"],
+	["_voltro_world_cells", "the app's persistent world cells — app data"],
+	["_voltro_world_entities", "the entities living in those worlds — app data"],
+	["_voltro_world_instance_history", "the history of the app's world instances — app data"],
+	["_voltro_world_instance_scopes", "the scopes of those world instances — belongs with them"],
+	["_voltro_world_instances", "the app's world instances — app data"],
+	["_voltro_world_journal", "the journal and receipts of world entity changes — app data, and the idempotent retries it answers"],
+	["_voltro_world_transitions", "durable phases and receipts of entities moving between worlds — app data"]
 ]), n = (t) => e.has(t), r = (t) => e.get(t), i = (e, t) => {
 	if (e.length === 0) return;
 	let n = e.map((e) => `    ${e} — ${r(e) ?? "describes this deployment"}`);

package/dist/errors.js

@@ -53,12 +53,19 @@ var n = class extends t.TaggedError()("BundleError", {
 	get message() {
 		return `bundle schema ${this.bundleFingerprint} does not match target ${this.targetFingerprint}: ${this.diff.join("; ")}`;
 	}
-}, l = class extends e.TaggedError("NativeToolError") {
+}, l = class extends t.TaggedError()("FieldKeysMissingError", {
+	missing: t.Array(t.String),
+	held: t.Array(t.String)
+}) {
+	get message() {
+		return `the bundle's values are sealed under field-encryption key(s) ${this.missing.map((e) => `"${e}"`).join(", ")}, which this environment does not hold (it holds ${this.held.join(", ") || "none"}) — supply them, or, restoring into another environment, import with --null-sealed (a value no key here opens is written as NULL)`;
+	}
+}, u = class extends e.TaggedError("NativeToolError") {
 	get message() {
 		let e = this.stderr?.trim(), t = this.hint?.trim();
 		return `${this.tool}: ${this.reason}${e ? `\n${e}` : ""}${t ? `\n\nhint: ${t}` : ""}`;
 	}
-}, u = class extends t.TaggedError()("MaskingError", {
+}, d = class extends t.TaggedError()("MaskingError", {
 	unclassified: t.Array(t.String),
 	invalidActions: t.optional(t.Array(t.String))
 }) {
@@ -66,17 +73,17 @@ var n = class extends t.TaggedError()("BundleError", {
 		let e = [];
 		return this.unclassified.length > 0 && e.push(`unclassified columns: ${this.unclassified.join(", ")}`), this.invalidActions !== void 0 && this.invalidActions.length > 0 && e.push(`invalidActions: ${this.invalidActions.join(", ")}`), `masking refused — ${e.join("; ") || "no column may be exported"}`;
 	}
-}, d = class extends t.TaggedError()("ImportModeError", {
+}, f = class extends t.TaggedError()("ImportModeError", {
 	mode: t.String,
 	reason: t.String
 }) {
 	get message() {
 		return `import mode '${this.mode}' refused: ${this.reason}`;
 	}
-}, f = class extends t.TaggedError()("CrossDialectError", {
+}, p = class extends t.TaggedError()("CrossDialectError", {
 	sourceDialect: t.String,
 	targetDialect: t.String,
 	blocking: t.Array(t.String)
 }) {};
 //#endregion
-export { n as BundleError, r as CodecError, a as CompressionError, f as CrossDialectError, d as ImportModeError, i as IntegrityError, u as MaskingError, l as NativeToolError, s as RowsRefusedError, c as SchemaDriftError, o as ScopeError };
+export { n as BundleError, r as CodecError, a as CompressionError, p as CrossDialectError, l as FieldKeysMissingError, f as ImportModeError, i as IntegrityError, d as MaskingError, u as NativeToolError, s as RowsRefusedError, c as SchemaDriftError, o as ScopeError };