/**
 * T-PORTABILITY POR.1 — `opensquid export` / `import` / `rebuild`.
 *
 * Roadmap stage ②: migration-grade whole-home portability. The bundle carries
 * TRUTH ONLY (the files-are-truth / projections-rebuild split the local-first
 * design already guarantees): everything under `~/.opensquid/` EXCEPT the
 * denylist below is exported by default (fail-portable for future truth
 * stores); the sqlite projections are rebuilt on import via the existing
 * idempotent entries.
 *
 * SECRETS (engineered, not assumed — a live bot_token was found in the export
 * set during design review): the catalogued credential fields in config.json
 * are REDACTED in the bundled copy (the live file is never touched), and a
 * fail-closed key-name scan over every bundled JSON/YAML REFUSES the export
 * on any uncatalogued secret-shaped value. Scope: structured config only —
 * user-authored .md/inbox content is not scanned (stated in the summary).
 *
 * IMPORT REFUSALS (different override semantics, by design): a lived-in home
 * refuses with NO override (no-silent-mutation; merge is v2); a newer-version
 * bundle refuses unless --force (forward-parse tolerance is unproven).
 * Rebuild failure never deletes extracted truth — the exact re-run commands
 * print (all three are real verbs: migrate-memories, migrate-lessons, and
 * the `rebuild` verb shipped here).
 *
 * Imports from: commander, node:fs(/promises), node:os, node:path, tar,
 *   ../../rag/migrate_memories.js, ../../rag/wedge/migrate.js,
 *   ../../workgraph/store.js, ../../rag/embedders/fastembed.js, yaml.
 * Imported by: src/cli.ts.
 */
import type { Command } from 'commander';
import { fastembedEmbedder } from '../../rag/embedders/fastembed.js';
export declare function isExcluded(rel: string): boolean;
/** Redact the catalogued credential fields (channels/config.ts schema:
 *  chat_connections.<platform>.bot_token|app_token). Pure — operates on the
 *  parsed copy bound for the bundle; the live file is never modified. */
export declare function redactConfig(parsed: Record<string, unknown>): Record<string, unknown>;
/** Fail-closed: any uncatalogued secret-shaped value in structured config
 *  refuses the export, naming the exact path. `env:` URIs and the redaction
 *  marker are exempt. */
export declare function scanForSecrets(rel: string, parsed: unknown, path?: string): string[];
/** The truth file list for a home (denylist applied). */
export declare function buildExportList(homeDir: string): Promise<string[]>;
export declare function runExport(opts: {
    homeDir?: string;
    out?: string;
    dryRun?: boolean;
    print?: (line: string) => void;
}): Promise<string>;
export declare function truthPresent(homeDir: string): Promise<string[]>;
/** Each rebuild attempts independently; failure NEVER deletes extracted truth —
 *  the exact re-run command records and the caller exits non-zero. */
export declare function rebuildProjections(homeDir: string, embedder?: import("../../rag/embedders/types.js").Embedder): Promise<{
    rebuilt: string[];
    failed: string[];
}>;
export declare function runImport(opts: {
    bundle: string;
    homeDir?: string;
    list?: boolean;
    force?: boolean;
    embedder?: ReturnType<typeof fastembedEmbedder>;
    print?: (line: string) => void;
}): Promise<{
    rebuilt: string[];
    failed: string[];
}>;
export declare function registerPortability(program: Command): void;
//# sourceMappingURL=portability.d.ts.map