@voltro/data-transfer 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,1080 @@
+import { ByteStream } from '@voltro/plugin-storage';
+import { ColumnType } from '@voltro/database';
+import { DataStore } from '@voltro/database';
+import { Duplex } from 'node:stream';
+import { Effect } from 'effect';
+import { ParseOptions } from 'effect/SchemaAST';
+import { Predicate } from '@voltro/database';
+import { Row } from '@voltro/database';
+import { Schema } from 'effect';
+import { SchemaSnapshot } from '@voltro/database/sql';
+import { StorageError } from '@voltro/plugin-storage';
+import { StorageProvider } from '@voltro/plugin-storage';
+import { StoredStream } from '@voltro/plugin-storage';
+import { Stream } from 'effect';
+import { TableStreamError } from '@voltro/database';
+import { VoidIfEmpty } from 'effect/Types';
+import { YieldableError } from 'effect/Cause';
+
+/** Apply one action to one value. A null value is always passed through. */
+export declare const applyAction: (action: MaskAction, input: MaskInput) => unknown;
+
+/**
+ * Refuse a direct/native import when a live instance is detected, unless the
+ * operator passed `--allow-live`. `liveInstance` is a human label (url/name) of
+ * the detected instance, or `null` when none was found (or detection was
+ * inconclusive — the CLI treats "can't tell" as "not detected" so the common
+ * import-into-a-stopped-target case isn't blocked).
+ */
+export declare const assessLiveImport: (opts: {
+    readonly liveInstance: string | null;
+    readonly allowLive: boolean;
+}) => LiveGuardResult;
+
+export declare const ASSET_INDEX_FILE = "assets/index.ndjson";
+
+export declare const assetDone: (ledger: Ledger, sha256: string) => boolean;
+
+/** One content-addressed asset. `path` is `assets/<sha256>`; `key` is the
+ *  original storage key so the importer restores it under the same key. */
+export declare const AssetEntry: Schema.Struct<{
+    key: typeof Schema.String;
+    sha256: typeof Schema.String;
+    size: typeof Schema.Number;
+    contentType: typeof Schema.String;
+}>;
+
+export declare type AssetEntry = Schema.Schema.Type<typeof AssetEntry>;
+
+/** Metadata for one asset to export — enough to enumerate without reading the
+ *  bytes. Sourced from the storage refs table by the caller. */
+export declare interface AssetInfo {
+    readonly key: string;
+    readonly contentType: string;
+    readonly size: number;
+}
+
+export declare const ASSETS_DIR = "assets";
+
+/** Where import writes assets TO. */
+export declare interface AssetSink {
+    readonly write: (key: string, stream: ByteStream, meta: {
+        readonly contentType: string;
+        readonly totalSize?: number;
+    }) => Effect.Effect<unknown, StorageError>;
+    /** Whether the key already exists at the destination (skip re-upload). */
+    readonly has: (key: string) => Effect.Effect<boolean, StorageError>;
+}
+
+/** Where export reads assets FROM. */
+export declare interface AssetSource {
+    /** Lazily enumerate every asset (metadata only; bytes stream on demand). */
+    readonly list: () => Stream.Stream<AssetInfo, unknown>;
+    /** Open one asset as a byte stream. */
+    readonly open: (key: string) => Effect.Effect<StoredStream, StorageError>;
+}
+
+export declare const AssetSummary: Schema.Struct<{
+    count: typeof Schema.Number;
+    totalBytes: typeof Schema.Number;
+    /** Bundle-relative path of the asset index (`assets/index.ndjson`), when any
+     *  assets were exported. Each line is an {@link AssetEntry}. */
+    index: Schema.optional<typeof Schema.String>;
+}>;
+
+export declare type AssetSummary = Schema.Schema.Type<typeof AssetSummary>;
+
+/** The artifact file name a backup produces for a dialect. */
+export declare const backupArtifactName: (dialect: string) => string;
+
+/** Build the backup step for a dialect writing to `outFile`. */
+export declare const backupCommand: (dialect: string, conn: NativeConn, outFile: string) => NativeStep;
+
+/** Where blobs stream TO on import. `has` lets a resumed run skip existing keys. */
+export declare interface BlobSink {
+    has: (key: string) => Promise<boolean>;
+    write: (key: string, content: AsyncIterable<Uint8Array>, meta: {
+        readonly contentType: string;
+        readonly size: number;
+    }) => Promise<void>;
+}
+
+/** Where blobs stream FROM on export (metadata + a byte stream per key). */
+export declare interface BlobSource {
+    list: () => AsyncIterable<{
+        readonly key: string;
+        readonly contentType: string;
+        readonly size: number;
+    }>;
+    open: (key: string) => AsyncIterable<Uint8Array>;
+}
+
+/** A bundle is malformed: bad manifest, unknown format version, missing file. */
+export declare class BundleError extends BundleError_base {
+}
+
+declare const BundleError_base: Schema.TaggedErrorClass<BundleError, "BundleError", {
+    readonly _tag: Schema.tag<"BundleError">;
+} & {
+    reason: typeof Schema.String;
+    path: Schema.optional<typeof Schema.String>;
+}>;
+
+/** The portable meaning of a DSL column type. */
+export declare type CanonicalCategory = 'string' | 'integer' | 'float' | 'boolean' | 'datetime' | 'date' | 'json' | 'binary' | 'reference' | 'vector' | 'enum' | 'array' | 'interval' | 'raw';
+
+/** Map a DSL `ColumnType` (as a string) to its canonical category. Unknown
+ *  types (a bundle from a newer framework) fall back to 'string' passthrough. */
+export declare const canonicalType: (type: string) => CanonicalCategory;
+
+/**
+ * Lint a bundle's column types against a target dialect. Same-dialect import is
+ * always clean (returns []). Otherwise returns every column whose type won't
+ * port — `block` severity must be resolved (fix the schema or --force);
+ * `warn` imports with a representational caveat.
+ */
+export declare const checkPortability: (tables: ReadonlyArray<{
+    readonly name: string;
+    readonly columnTypes: Readonly<Record<string, string>>;
+}>, sourceDialect: string, targetDialect: string) => ReadonlyArray<PortabilityIssue>;
+
+/**
+ * Compare the bundle's recorded fingerprint against the target snapshot's
+ * fingerprint (computed the SAME way the export did). Returns the verdict + a
+ * diff when drifted. Pure — no I/O; the caller introspects the target.
+ */
+export declare const checkSchemaDrift: (bundleFingerprint: string, target: SchemaSnapshot, bundleSchema?: SchemaSnapshot) => DriftCheck;
+
+/** table → column → classification (built from the DECLARED schema snapshot). */
+export declare type Classification = Readonly<Record<string, Readonly<Record<string, ColumnClassification>>>>;
+
+/** Derive the classification map from a declared schema snapshot. */
+export declare const classificationFromSnapshot: (snapshot: {
+    readonly tables: ReadonlyArray<{
+        readonly name: string;
+        readonly columns: ReadonlyArray<{
+            readonly name: string;
+            readonly type: string;
+            readonly sensitive?: {
+                readonly class: string;
+            };
+            readonly safe?: boolean;
+        }>;
+    }>;
+}) => Classification;
+
+/** A row line failed to parse / encode. Carries the table + line for triage. */
+export declare class CodecError extends CodecError_base {
+}
+
+declare const CodecError_base: Schema.TaggedErrorClass<CodecError, "CodecError", {
+    readonly _tag: Schema.tag<"CodecError">;
+} & {
+    table: typeof Schema.String;
+    reason: typeof Schema.String;
+}>;
+
+export declare interface ColumnClassification {
+    readonly sensitive?: {
+        readonly class: string;
+    };
+    readonly safe?: boolean;
+    readonly columnType?: string;
+}
+
+/** column name → logical type. Values are the {@link ColumnType} union; typed
+ *  loosely as string so a manifest from a newer source (unknown type) still
+ *  decodes (unknown types fall through as scalar passthrough). */
+export declare type ColumnTypes = Readonly<Record<string, ColumnType | string>>;
+
+export declare type Compression = 'zstd' | 'gzip' | 'none';
+
+/** A compression / decompression step failed. INTERNAL — the pipelines fold a
+ *  real (de)compression failure into `BundleError` (its `path` locates the
+ *  file); this tag is the defensive standalone form and never crosses the wire. */
+export declare class CompressionError extends CompressionError_base<{
+    readonly reason: string;
+}> {
+}
+
+declare const CompressionError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "CompressionError";
+} & Readonly<A>;
+
+/** File-name suffix for a codec — appended after `.ndjson`. */
+export declare const compressionExt: (c: Compression) => string;
+
+/**
+ * Compute the id set to export per table: the seed rows, every row reached by
+ * following foreign keys to their PARENTS (transitively, to a fixpoint), and —
+ * when {@link SubsetSpec.children} is set — every row that REFERENCES the
+ * exported set (each restricted to the rows whose FK points INTO the set, then
+ * re-folded through the parent closure so nothing dangles).
+ *
+ * Pinned tables (see {@link SubsetSpec.pinned}) never appear in the returned map
+ * — their membership stays the seed predicate — but their member ids ARE tracked
+ * internally so the child pass can scope rows that reference the pinned rows.
+ */
+export declare const computeSubsetIds: (store: DataStore, snapshot: SchemaSnapshot, spec: SubsetSpec) => Effect.Effect<Map<string, Set<unknown>>, TableStreamError>;
+
+/** A cross-dialect import was refused because the source bundle uses column
+ *  types that don't port cleanly to the target dialect. Lists every blocking
+ *  incompatibility so the operator can decide (or pass --force). */
+export declare class CrossDialectError extends CrossDialectError_base {
+}
+
+declare const CrossDialectError_base: Schema.TaggedErrorClass<CrossDialectError, "CrossDialectError", {
+    readonly _tag: Schema.tag<"CrossDialectError">;
+} & {
+    sourceDialect: typeof Schema.String;
+    targetDialect: typeof Schema.String;
+    blocking: Schema.Array$<typeof Schema.String>;
+}>;
+
+/** Rows that could not be written even after the importer's deferred-FK
+ *  resolution (plain retry once every table landed, then FK-shedding + patch).
+ *  Each entry names the table, the primary-key value, and the store's own
+ *  reason — a genuinely dangling reference (the parent row is in neither the
+ *  bundle nor the target) or a NOT NULL FK cycle the dialect can't defer. */
+export declare class DanglingReferenceError extends DanglingReferenceError_base {
+}
+
+declare const DanglingReferenceError_base: Schema.TaggedErrorClass<DanglingReferenceError, "DanglingReferenceError", {
+    readonly _tag: Schema.tag<"DanglingReferenceError">;
+} & {
+    /** The stuck rows (capped — see {@link totalCount}). */
+    rows: Schema.Array$<Schema.Struct<{
+        table: typeof Schema.String;
+        id: typeof Schema.String;
+        reason: typeof Schema.String;
+    }>>;
+    /** Total number of stuck rows (may exceed `rows.length`). */
+    totalCount: typeof Schema.Number;
+}>;
+
+export declare const DATA_DIR = "data";
+
+export declare interface DataTransferProfile {
+    readonly scope?: ExportScope;
+    readonly subset?: SubsetSpec;
+    readonly masking?: MaskingPolicy;
+    readonly consistency?: 'live' | 'snapshot';
+    readonly compression?: Compression;
+    readonly assets?: boolean;
+}
+
+export declare const decodeManifest: (u: unknown, overrideOptions?: ParseOptions) => {
+    readonly source: {
+        readonly dialect: string;
+        readonly schemaFingerprint: string;
+    };
+    readonly createdAt: string;
+    readonly scope: {
+        readonly kind: "tables" | "all" | "tenant";
+        readonly tenantId?: string | undefined;
+        readonly tables?: readonly string[] | undefined;
+    };
+    readonly tables: readonly {
+        readonly name: string;
+        readonly primaryKey: string;
+        readonly file: string;
+        readonly rowCount: number;
+        readonly checksum: string;
+        readonly columnTypes: {
+            readonly [x: string]: string;
+        };
+    }[];
+    readonly formatVersion: number;
+    readonly consistency: "live" | "snapshot";
+    readonly compression: "zstd" | "gzip" | "none";
+    readonly assets: {
+        readonly index?: string | undefined;
+        readonly count: number;
+        readonly totalBytes: number;
+    };
+    readonly masking?: {
+        readonly policyId?: string | undefined;
+        readonly transformed: readonly string[];
+    } | undefined;
+};
+
+/** Decode a JSON object back into a row with faithful JS types. */
+export declare const decodeRow: (obj: Record<string, unknown>, columnTypes: ColumnTypes) => Row;
+
+/** Decode one value for a column of logical type `type`. */
+export declare const decodeValue: (value: unknown, type: string | undefined) => unknown;
+
+/** Decrypt a stream produced by {@link encryptStream}. Fails loudly on a wrong
+ *  passphrase, a tampered byte, or a truncated stream (no authenticated final
+ *  frame). */
+export declare function decryptStream(source: AsyncIterable<Uint8Array>, passphrase: string): AsyncGenerator<Uint8Array>;
+
+/** Built-in class → action defaults. A minimal policy just needs a `seed`. */
+export declare const DEFAULT_CLASS_ACTIONS: Readonly<Record<string, MaskAction>>;
+
+/** Identity helper for authoring a profile with full type-checking + inference. */
+export declare const defineDataProfile: (profile: DataTransferProfile) => DataTransferProfile;
+
+/**
+ * Diff two snapshots into a small list of observable differences. Reports, in a
+ * stable order: tables only in the target, tables only in the bundle, and for
+ * shared tables the columns added / dropped / type-changed. Capped so a wildly
+ * divergent pair still yields an actionable (not enormous) message.
+ */
+export declare const diffSnapshots: (bundle: SchemaSnapshot, target: SchemaSnapshot) => ReadonlyArray<string>;
+
+/** A {@link BlobSink} that writes blobs to the LOCAL dir as `assets/<sha>` files
+ *  + an `assets/index.ndjson` (key→sha→size→contentType) — reproduces a
+ *  materialised, re-importable bundle directory (for `voltro data unpack`). */
+export declare const dirBlobSink: (dir: string) => BlobSink;
+
+export declare interface DriftCheck {
+    readonly drifted: boolean;
+    readonly bundleFingerprint: string;
+    readonly targetFingerprint: string;
+    /** Empty when not drifted; a capped, human-readable summary otherwise. */
+    readonly diff: ReadonlyArray<string>;
+}
+
+export declare const emptyLedger: () => Ledger;
+
+export declare const encodeManifest: (a: {
+    readonly source: {
+        readonly dialect: string;
+        readonly schemaFingerprint: string;
+    };
+    readonly createdAt: string;
+    readonly scope: {
+        readonly kind: "tables" | "all" | "tenant";
+        readonly tenantId?: string | undefined;
+        readonly tables?: readonly string[] | undefined;
+    };
+    readonly tables: readonly {
+        readonly name: string;
+        readonly primaryKey: string;
+        readonly file: string;
+        readonly rowCount: number;
+        readonly checksum: string;
+        readonly columnTypes: {
+            readonly [x: string]: string;
+        };
+    }[];
+    readonly formatVersion: number;
+    readonly consistency: "live" | "snapshot";
+    readonly compression: "zstd" | "gzip" | "none";
+    readonly assets: {
+        readonly index?: string | undefined;
+        readonly count: number;
+        readonly totalBytes: number;
+    };
+    readonly masking?: {
+        readonly policyId?: string | undefined;
+        readonly transformed: readonly string[];
+    } | undefined;
+}, overrideOptions?: ParseOptions) => string;
+
+/** Encode a whole row to a JSON-safe object. */
+export declare const encodeRow: (row: Row, columnTypes: ColumnTypes) => Record<string, unknown>;
+
+/** Encode one value for a column of logical type `type`. */
+export declare const encodeValue: (value: unknown, type: string | undefined) => unknown;
+
+/** Encrypt a byte stream with a passphrase. Yields the header then framed,
+ *  authenticated chunks; the final frame is flagged so truncation is detected. */
+export declare function encryptStream(source: AsyncIterable<Uint8Array>, passphrase: string): AsyncGenerator<Uint8Array>;
+
+/** Every error the export pipeline can surface. */
+export declare type ExportError = BundleError | TableStreamError | MaskingError | ScopeError;
+
+export declare interface ExportOptions {
+    /** Source store — pass the RAW dialect store for a faithful physical read
+     *  (no tenant/soft-delete scoping); scope filtering is applied explicitly. */
+    readonly store: DataStore;
+    /** Live schema of the source (from `introspectSchema`). Drives table set,
+     *  column types, FK order, and the fingerprint stamped in the manifest. */
+    readonly snapshot: SchemaSnapshot;
+    /** Source dialect id (`postgres` | `mysql` | …) — recorded for import. */
+    readonly dialect: string;
+    /** Bundle output directory (created if absent). */
+    readonly outDir: string;
+    /** What to export. Default `{ kind: 'all' }`. */
+    readonly scope?: ExportScope;
+    /** Names of the tenant-scoped tables, from the schema registry's `tenant()`
+     *  mixin metadata. Authoritative for the tenant scope when provided — a
+     *  table can carry a `tenantId` column WITHOUT being tenant-scoped (e.g. a
+     *  global `users` table whose `tenantId` is the active-org pointer). Omitted
+     *  → any table with a `tenantId` column counts (documented heuristic). */
+    readonly tenantTables?: ReadonlyArray<string>;
+    /** Referentially-correct subset: seed predicates per table + FK-parent
+     *  closure. When set, it REPLACES `scope` (only the seeded tables + their
+     *  parent closure are exported, filtered to the closure's id sets). */
+    readonly subset?: SubsetSpec;
+    /** Codec preference; resolved to zstd/gzip by availability. */
+    readonly compression?: Compression;
+    /** Consistency mode stamped in the manifest — `'live'` reads rows as the
+     *  keyset stream progresses; `'snapshot'` marks a snapshot-isolated source. */
+    readonly consistency?: 'live' | 'snapshot';
+    /** Rows per keyset page. Default 1000. */
+    readonly chunkSize?: number;
+    /** Optional asset source (blobs). Omit to export data only. */
+    readonly assets?: AssetSource;
+    /** ISO stamp for the manifest. Defaults to now; injectable for tests. */
+    readonly createdAt?: string;
+    /** Per-page retry attempts on transient read failures. Default 5. */
+    readonly retryTimes?: number;
+    /** Masking policy — when set, PII columns are pseudonymised/anonymised at the
+     *  SOURCE before any row is written. Fail-closed: an unclassified column
+     *  refuses the export (unless the policy's `onUnclassified` opts out). */
+    readonly masking?: MaskingPolicy;
+    /** Column classification (from the DECLARED schema — `.sensitive()`/`.safe()`).
+     *  Defaults to deriving it from `snapshot`; pass the declared snapshot's
+     *  classification explicitly when `snapshot` is the introspected one. */
+    readonly classification?: Classification;
+    /** Per-table progress sink for long jobs (the CLI wires it to a renderer).
+     *  Fires a `start` then a `done` event per table — off the per-row hot path.
+     *  Independent of the always-on `Effect.withSpan` + metrics per table. */
+    readonly onProgress?: OnProgress;
+}
+
+/** Export scope — what was selected. `all` = every table; `tenant` = the rows
+ *  of one tenant (+ its FK closure); `tables` = an explicit set. */
+export declare const ExportScope: Schema.Struct<{
+    kind: Schema.Literal<["all", "tenant", "tables"]>;
+    tenantId: Schema.optional<typeof Schema.String>;
+    tables: Schema.optional<Schema.Array$<typeof Schema.String>>;
+}>;
+
+export declare type ExportScope = Schema.Schema.Type<typeof ExportScope>;
+
+/** Bump when the on-disk shape changes incompatibly. An importer refuses a
+ *  bundle whose `formatVersion` it doesn't understand rather than guessing. */
+export declare const FORMAT_VERSION = 1;
+
+/** Format one issue for a CLI / error message. */
+export declare const formatIssue: (i: PortabilityIssue) => string;
+
+/** True when this Node build exposes the native zstd streams (Node ≥ 22.15). */
+export declare const hasZstd: () => boolean;
+
+export declare type ImportError = BundleError | CodecError | IntegrityError | CrossDialectError | ImportModeError | DanglingReferenceError | SchemaDriftError | StorageError;
+
+/**
+ * How rows are written:
+ *   `upsert`  — INSERT-or-UPDATE by primary key (default; idempotent re-import).
+ *   `append`  — INSERT only; on a PK conflict `onConflict` decides skip vs fail.
+ *   `replace` — TRUNCATE the target tables (reverse-FK) then INSERT: the target
+ *               ends up EXACTLY the bundle. Refused for a partial bundle.
+ */
+export declare type ImportMode = 'upsert' | 'append' | 'replace';
+
+/** An import was refused because the requested write-mode is unsafe for this
+ *  bundle — e.g. `replace` (which truncates) against a PARTIAL bundle (a subset
+ *  or tenant/table scope), which would delete rows the bundle never carried. */
+export declare class ImportModeError extends ImportModeError_base {
+}
+
+declare const ImportModeError_base: Schema.TaggedErrorClass<ImportModeError, "ImportModeError", {
+    readonly _tag: Schema.tag<"ImportModeError">;
+} & {
+    mode: typeof Schema.String;
+    reason: typeof Schema.String;
+}>;
+
+export declare interface ImportOptions {
+    /** Target store to write into. */
+    readonly store: DataStore;
+    /** Bundle directory produced by `runExport`. */
+    readonly bundleDir: string;
+    /** Write semantics. Default `upsert`. */
+    readonly mode?: ImportMode;
+    /** For `append`: `skip` existing PKs (default) or `fail` on the first conflict. */
+    readonly onConflict?: OnConflict;
+    /** Optional asset sink (blobs). Omit to import data only. */
+    readonly assets?: AssetSink;
+    /** Import-side resume journal. Defaults to `<bundleDir>/.import.ledger.json`. */
+    readonly ledgerPath?: string;
+    /** Verify each table's checksum + row count against the manifest. Default
+     *  true — turning it off trades safety for a little speed. */
+    readonly verify?: boolean;
+    /** The target dialect. When set and it differs from the bundle's source
+     *  dialect, a cross-dialect portability lint runs first; blocking
+     *  incompatibilities refuse the import (unless {@link allowIncompatible}). */
+    readonly targetDialect?: string;
+    /** Import despite blocking cross-dialect incompatibilities (the operator has
+     *  accepted the risk). Warnings never block regardless. */
+    readonly allowIncompatible?: boolean;
+    /**
+     * Run the whole table phase (truncate + load) in ONE transaction, so a LIVE
+     * target sees the import all-or-nothing — MVCC readers see the old data until
+     * commit, the new data after, never a partial state. The live-safe way to
+     * `replace`. Trade-offs: one long-held write transaction (writes to those
+     * tables block for the load; readers are unaffected on MVCC dialects), and
+     * resume is not per-table (a crash rolls the whole thing back → re-run).
+     */
+    readonly atomic?: boolean;
+    /** The streaming import path (`unpackBundle` with a storage {@link AssetSink})
+     *  restores blobs to dest storage AS the archive streams in — before the table
+     *  phase — so the manifest's asset phase must be skipped here (the blobs are
+     *  already landed + integrity-checked; re-reading them from a temp dir that
+     *  doesn't exist would fail). Set by the streaming importer, not by users. */
+    readonly assetsAlreadyRestored?: boolean;
+    /** The TARGET app's live schema (from `introspectSchema`). When set, a
+     *  fingerprint pre-flight compares it — the SAME way the export computed the
+     *  bundle's fingerprint — against `manifest.source.schemaFingerprint`. On a
+     *  mismatch the import is REFUSED with a {@link SchemaDriftError} naming the
+     *  drift, before any row is written (unless {@link force}). Omit to skip the
+     *  pre-flight (the bundle then imports against whatever the target is). */
+    readonly targetSnapshot?: SchemaSnapshot;
+    /** Import despite schema drift: downgrade the {@link SchemaDriftError} to a
+     *  loud warning (via {@link onWarn}) and proceed. The operator has accepted
+     *  that the target shape differs from the bundle's source. */
+    readonly force?: boolean;
+    /** Sink for non-fatal warnings (the library emits no logs of its own). The
+     *  CLI wires this to its logger so `--force` drift downgrades are still loud. */
+    readonly onWarn?: (message: string) => void;
+    /** Per-table progress sink for long jobs (the CLI wires it to a renderer).
+     *  Fires a `start` (with the manifest's row count as `total`) then a `done`
+     *  event per table — off the per-row hot path. Independent of the always-on
+     *  `Effect.withSpan` + metrics per table. */
+    readonly onProgress?: OnProgress;
+}
+
+/** An integrity check failed — a table's content checksum or row count did not
+ *  match the manifest, or an asset's bytes did not hash to its recorded id. */
+export declare class IntegrityError extends IntegrityError_base {
+}
+
+declare const IntegrityError_base: Schema.TaggedErrorClass<IntegrityError, "IntegrityError", {
+    readonly _tag: Schema.tag<"IntegrityError">;
+} & {
+    what: typeof Schema.String;
+    expected: typeof Schema.String;
+    actual: typeof Schema.String;
+}>;
+
+export declare interface LeakWarning {
+    readonly table: string;
+    readonly column: string;
+    readonly pattern: string;
+    readonly sample: string;
+}
+
+export declare interface Ledger {
+    /** table name → completion record (present ⇒ fully written/imported). */
+    tables: Record<string, {
+        readonly rowCount: number;
+        readonly checksum: string;
+    }>;
+    /** sha256 → true for every asset that fully landed. */
+    assets: Record<string, true>;
+    /** `replace`-mode import only: set once the target tables have been
+     *  truncated, so a resumed run doesn't re-truncate the rows it just loaded. */
+    truncated?: boolean;
+}
+
+export declare const LEDGER_FILE = ".ledger.json";
+
+export declare interface LiveGuardResult {
+    readonly refuse: boolean;
+    readonly message?: string;
+}
+
+/** A Duplex that COMPRESSES bytes written to it (identity for `none`). */
+export declare const makeCompressor: (c: Compression) => Duplex;
+
+/** A Duplex that DECOMPRESSES bytes written to it (identity for `none`). */
+export declare const makeDecompressor: (c: Compression) => Duplex;
+
+export declare const Manifest: Schema.Struct<{
+    formatVersion: typeof Schema.Number;
+    /** ISO-8601 stamp of when the export started. */
+    createdAt: typeof Schema.String;
+    source: Schema.Struct<{
+        dialect: typeof Schema.String;
+        schemaFingerprint: typeof Schema.String;
+    }>;
+    scope: Schema.Struct<{
+        kind: Schema.Literal<["all", "tenant", "tables"]>;
+        tenantId: Schema.optional<typeof Schema.String>;
+        tables: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>;
+    consistency: Schema.Literal<["live", "snapshot"]>;
+    compression: Schema.Literal<["zstd", "gzip", "none"]>;
+    tables: Schema.Array$<Schema.Struct<{
+        name: typeof Schema.String;
+        /** Bundle-relative path, e.g. `data/users.ndjson.zst`. */
+        file: typeof Schema.String;
+        rowCount: typeof Schema.Number;
+        /** sha256 hex of the uncompressed NDJSON bytes. */
+        checksum: typeof Schema.String;
+        /** column name → logical column type (the `ColumnType` union, as a string). */
+        columnTypes: Schema.Record$<typeof Schema.String, typeof Schema.String>;
+        /** The unique column keyset-streamed on export (usually `id`). */
+        primaryKey: typeof Schema.String;
+    }>>;
+    assets: Schema.Struct<{
+        count: typeof Schema.Number;
+        totalBytes: typeof Schema.Number;
+        /** Bundle-relative path of the asset index (`assets/index.ndjson`), when any
+         *  assets were exported. Each line is an {@link AssetEntry}. */
+        index: Schema.optional<typeof Schema.String>;
+    }>;
+    /** Masking audit — present when the export applied a masking policy. Lists
+     *  every `table.column` that was transformed (not copied verbatim), so a
+     *  reviewer can see exactly what was pseudonymised. */
+    masking: Schema.optional<Schema.Struct<{
+        policyId: Schema.optional<typeof Schema.String>;
+        transformed: Schema.Array$<typeof Schema.String>;
+    }>>;
+}>;
+
+export declare type Manifest = Schema.Schema.Type<typeof Manifest>;
+
+/** File names inside a bundle directory. */
+export declare const MANIFEST_FILE = "manifest.json";
+
+/** What to do with a column's value. */
+export declare type MaskAction = 'keep' | 'null' | 'redact' | 'hash' | 'dateShift' | 'error' | {
+    readonly fake: string;
+} | {
+    readonly custom: (input: MaskInput) => unknown;
+};
+
+/** A masking export was refused because one or more exported columns are
+ *  neither `.sensitive()` nor `.safe()` (fail-closed). Lists them so the author
+ *  can classify each — a new column can never silently leak to a lower env. */
+export declare class MaskingError extends MaskingError_base {
+}
+
+declare const MaskingError_base: Schema.TaggedErrorClass<MaskingError, "MaskingError", {
+    readonly _tag: Schema.tag<"MaskingError">;
+} & {
+    unclassified: Schema.Array$<typeof Schema.String>;
+}>;
+
+export declare interface MaskingPlan {
+    /** `table.column` → resolved action (excludes columns that resolve to error). */
+    readonly actions: Readonly<Record<string, MaskAction>>;
+    /** Columns that resolved to `error` — export must refuse (or reclassify). */
+    readonly unclassified: ReadonlyArray<string>;
+}
+
+export declare interface MaskingPolicy {
+    /** Recorded in the bundle audit. */
+    readonly id?: string;
+    /** Secret salt keying every deterministic transform. Keep it stable to keep
+     *  dev data stable; rotate/discard it to make the pseudonymisation
+     *  irreversible (anonymisation). REQUIRED — masking without a seed is a bug. */
+    readonly seed: string;
+    /** Action per sensitivity class (overrides the built-in default for a class). */
+    readonly classes?: Readonly<Record<string, MaskAction>>;
+    /** Per-column override, keyed `table.column` (wins over class). */
+    readonly columns?: Readonly<Record<string, MaskAction>>;
+    /** A column that is neither `.sensitive()` nor `.safe()` nor overridden.
+     *  Default `'error'` (fail-closed): the export refuses until it's classified. */
+    readonly onUnclassified?: 'error' | 'keep' | 'null';
+    /** What a `.safe()` column gets. Default `'keep'`. */
+    readonly onSafe?: 'keep' | 'null';
+}
+
+export declare interface MaskingPreview {
+    readonly tables: ReadonlyArray<{
+        readonly table: string;
+        readonly samples: ReadonlyArray<MaskingSample>;
+    }>;
+    readonly leaks: ReadonlyArray<LeakWarning>;
+    /** Columns that WOULD block a real export (fail-closed). Empty = safe to run. */
+    readonly unclassified: ReadonlyArray<string>;
+}
+
+export declare interface MaskingPreviewOptions {
+    readonly store: DataStore;
+    readonly snapshot: SchemaSnapshot;
+    readonly masking: MaskingPolicy;
+    readonly classification?: Classification;
+    readonly scope?: ExportScope;
+    /** Tenant-scoped table names (mixin metadata) — same contract as
+     *  `ExportOptions.tenantTables`; only relevant for a tenant scope. */
+    readonly tenantTables?: ReadonlyArray<string>;
+    /** Rows sampled per table (default 20). */
+    readonly sampleSize?: number;
+}
+
+export declare interface MaskingSample {
+    readonly column: string;
+    readonly action: string;
+    readonly before: unknown;
+    readonly after: unknown;
+}
+
+export declare interface MaskInput {
+    readonly value: unknown;
+    readonly table: string;
+    readonly column: string;
+    readonly columnType?: string;
+    readonly seed: string;
+}
+
+/** Apply a resolved plan to one row. */
+export declare const maskRow: (row: Row, table: string, actions: Readonly<Record<string, MaskAction>>, seed: string, columnTypes?: Readonly<Record<string, string>>) => Row;
+
+export declare interface NativeConn {
+    /** Full connection URL (preferred for postgres — the tool consumes it
+     *  directly). Parsed to flags for mysql. */
+    readonly url?: string;
+    readonly host?: string;
+    readonly port?: number;
+    readonly username?: string;
+    readonly password?: string;
+    readonly database?: string;
+    /** sqlite database file path. */
+    readonly filename?: string;
+}
+
+/** One executable step: spawn a tool (optionally piping a file to stdin, or its
+ *  stdout to a file), or a pure file copy (sqlite). */
+export declare type NativeStep = {
+    readonly kind: 'spawn';
+    readonly tool: string;
+    readonly args: ReadonlyArray<string>;
+    readonly env: Readonly<Record<string, string>>;
+    readonly stdoutFile?: string;
+    readonly stdinFile?: string;
+} | {
+    readonly kind: 'copy';
+    readonly from: string;
+    readonly to: string;
+};
+
+/** A native backup/restore tool failed — missing binary, non-zero exit, or an
+ *  unsupported dialect. `stderr` carries the tool's own diagnostics. INTERNAL —
+ *  only the local `voltro backup|restore` path raises it; never on a pipeline
+ *  error channel, so it never crosses the rpc wire. */
+export declare class NativeToolError extends NativeToolError_base<{
+    readonly tool: string;
+    readonly reason: string;
+    readonly stderr?: string;
+}> {
+}
+
+declare const NativeToolError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "NativeToolError";
+} & Readonly<A>;
+
+/** NDJSON byte stream → row stream (split into lines, JSON-parse, typed-decode).
+ *  A malformed line fails the stream with a {@link CodecError} naming the table
+ *  rather than a bare SyntaxError. */
+export declare const ndjsonToRows: <E, R>(bytes: Stream.Stream<Uint8Array, E, R>, table: string, columnTypes: ColumnTypes) => Stream.Stream<Row, E | CodecError, R>;
+
+export declare type OnConflict = 'skip' | 'fail';
+
+/** The caller's progress sink. Plain sync fn — never fails the job. */
+export declare type OnProgress = (event: ProgressEvent) => void;
+
+/**
+ * Pack a bundle into a framed byte stream. `dir` supplies the small files
+ * (tables / manifest / README); `blobs`, when given, streams every content-blob
+ * in single-pass (nothing buffered) with a per-blob sha footer.
+ */
+export declare function packBundle(opts: {
+    dir: string;
+    blobs?: BlobSource;
+}): AsyncGenerator<Uint8Array>;
+
+/**
+ * Read a FEW small plain files out of a bundle stream and STOP — without
+ * materialising the data or blobs. Returns the requested files' bytes (those
+ * present before the first blob). `README.md` sits near the front, so peeking it
+ * decrypts/reads only the first chunk(s) — cheap even on a 200 GB bundle. Used by
+ * `voltro data inspect`.
+ */
+export declare const peekBundle: (source: AsyncIterable<Uint8Array>, names: readonly string[]) => Promise<Map<string, Buffer>>;
+
+/**
+ * Resolve the effective codec. `undefined`/`'zstd'` → zstd when available, else
+ * gzip. `'gzip'` / `'none'` are honoured as-is. Callers record the RESULT in
+ * the manifest — never re-derive on import.
+ */
+export declare const pickCompression: (pref?: Compression) => Compression;
+
+/**
+ * Resolve every column's action ahead of streaming. `unclassified` lists the
+ * columns that hit `onUnclassified: 'error'` — the exporter refuses when it's
+ * non-empty, so a masking export can never silently copy an unreviewed column.
+ */
+export declare const planMasking: (tables: ReadonlyArray<{
+    readonly name: string;
+    readonly columns: ReadonlyArray<{
+        readonly name: string;
+        readonly type?: string;
+    }>;
+}>, classification: Classification, policy: MaskingPolicy) => MaskingPlan;
+
+export declare interface PortabilityIssue {
+    readonly table: string;
+    readonly column: string;
+    readonly type: string;
+    readonly severity: 'block' | 'warn';
+    readonly reason: string;
+}
+
+export declare const previewMasking: (opts: MaskingPreviewOptions) => Effect.Effect<MaskingPreview, TableStreamError | ScopeError>;
+
+/**
+ * One progress tick, emitted per table at its phase boundaries. `rowsDone`
+ * grows monotonically WITHIN a table's lifetime for a given phase: a `start`
+ * carries `rowsDone: 0`, the matching `done` carries the final count. `total`
+ * is the table's row count when known (import knows it up front from the
+ * manifest; a live export does not until the table drains) — `undefined` when
+ * it can't be known ahead of time.
+ */
+export declare interface ProgressEvent {
+    readonly phase: ProgressPhase;
+    /** Table being processed. */
+    readonly table: string;
+    /** 0-based index of this table in the ordered set. */
+    readonly index: number;
+    /** How many tables in total (for "7 / 23"). */
+    readonly tableCount: number;
+    /** `start` when the table begins, `done` when it finishes (or was resumed —
+     *  a ledger-skipped table emits a single `done` with its recorded count). */
+    readonly event: 'start' | 'done';
+    /** Rows processed so far for THIS table. 0 on `start`; final count on `done`. */
+    readonly rowsDone: number;
+    /** The table's total row count when known ahead of time (import: from the
+     *  manifest; skipped/resumed export: the ledger count), else `undefined`. */
+    readonly total?: number;
+}
+
+/** Which pipeline the event belongs to. */
+export declare type ProgressPhase = 'export' | 'import';
+
+/** Read the ledger at `path`, or an empty one when it is absent / unreadable
+ *  (a missing ledger just means "nothing done yet" — never a hard failure). */
+export declare const readLedger: (path: string) => Effect.Effect<Ledger>;
+
+/** Resolve the action for one column (column override → class → safe → unclassified). */
+export declare const resolveAction: (table: string, column: string, cls: ColumnClassification | undefined, policy: MaskingPolicy) => MaskAction;
+
+export declare interface ResolvedScope {
+    /** The unordered set of tables to export (the pipeline topo-sorts them). */
+    readonly tables: ReadonlyArray<string>;
+    /** Row filter for a table, or undefined for "all rows". */
+    readonly predicateFor: (table: string) => Predicate | undefined;
+}
+
+export declare const resolveScope: (scope: ExportScope, snapshot: SchemaSnapshot, deps: ResolveScopeDeps) => Effect.Effect<ResolvedScope, ScopeError | TableStreamError>;
+
+export declare interface ResolveScopeDeps {
+    /** Source store — the tenant scope reads the tenant's rows to compute which
+     *  untenanted parent rows they reference (row-level subsetting). */
+    readonly store: DataStore;
+    /** Names of the tenant-scoped tables, from the schema registry's `tenant()`
+     *  mixin metadata. Authoritative when provided; omitted → the `tenantId`
+     *  column-name heuristic (documented above). */
+    readonly tenantTables?: ReadonlyArray<string>;
+}
+
+/**
+ * Restore one CAS asset to the sink under `key`, re-hashing the bytes as they
+ * stream through and refusing (IntegrityError) if they don't match the expected
+ * sha — so a corrupted bundle can never silently re-upload bad bytes.
+ */
+export declare const restoreAssetFromCas: (sink: AssetSink, assetsDir: string, entry: {
+    readonly key: string;
+    readonly sha256: string;
+    readonly size: number;
+    readonly contentType: string;
+}) => Effect.Effect<void, BundleError | IntegrityError | StorageError>;
+
+/** Build the restore step for a dialect reading `inFile`. */
+export declare const restoreCommand: (dialect: string, conn: NativeConn, inFile: string) => NativeStep;
+
+/** Row stream → NDJSON byte stream (each row → typed-encoded JSON + `\n`). The
+ *  source stream's error + requirement channels pass straight through. */
+export declare const rowsToNdjson: <E, R>(rows: Stream.Stream<Row, E, R>, columnTypes: ColumnTypes) => Stream.Stream<Uint8Array, E, R>;
+
+export declare const runExport: (opts: ExportOptions) => Effect.Effect<Manifest, ExportError>;
+
+export declare const runImport: (opts: ImportOptions) => Effect.Effect<Manifest, ImportError>;
+
+/** Execute a {@link NativeStep} — spawn the tool (wiring stdin/stdout files) or
+ *  copy the file. Maps a missing binary / non-zero exit to {@link NativeToolError}. */
+export declare const runNativeStep: (step: NativeStep) => Effect.Effect<void, NativeToolError>;
+
+/**
+ * Scan the KEPT columns of some sample rows for values that LOOK like PII — a
+ * cheap tripwire for a misclassified column (`.safe()` on something that isn't,
+ * or an unmasked unclassified column under a fail-open policy). Reports at most
+ * one warning per column. Does NOT scan transformed columns (they're already
+ * fake). Best-effort, never blocks — it surfaces suspicion for a human.
+ */
+export declare const scanForLeaks: (rows: ReadonlyArray<Row>, table: string, actions: Readonly<Record<string, MaskAction>>) => ReadonlyArray<LeakWarning>;
+
+/** An import was refused because the TARGET app's live schema has drifted from
+ *  the schema the bundle was exported against (their fingerprints differ). The
+ *  bundle's typed codec + FK order assume the source shape; importing into a
+ *  drifted target fails mid-load with raw DB errors after rows may have landed.
+ *  Fail-closed: refuse before the table phase. `--force` (CLI) / `force: true`
+ *  (programmatic) downgrades this to a loud warning and proceeds. `diff` names
+ *  the observable schema differences (missing/extra tables, per-table column
+ *  changes) so the operator can see exactly what moved. */
+export declare class SchemaDriftError extends SchemaDriftError_base {
+}
+
+declare const SchemaDriftError_base: Schema.TaggedErrorClass<SchemaDriftError, "SchemaDriftError", {
+    readonly _tag: Schema.tag<"SchemaDriftError">;
+} & {
+    /** The fingerprint stamped in the bundle manifest (the source schema). */
+    bundleFingerprint: typeof Schema.String;
+    /** The target app's current schema fingerprint. */
+    targetFingerprint: typeof Schema.String;
+    /** Human-readable summary of the drift (capped), or a note that the shape
+     *  differs but the specific diff was not enumerated. */
+    diff: Schema.Array$<typeof Schema.String>;
+}>;
+
+/** An export scope could not be resolved safely — e.g. `{ kind: 'tenant' }`
+ *  without a `tenantId`. Fail-closed: a scoping ambiguity refuses the export
+ *  instead of silently widening to more rows than the operator asked for. */
+export declare class ScopeError extends ScopeError_base {
+}
+
+declare const ScopeError_base: Schema.TaggedErrorClass<ScopeError, "ScopeError", {
+    readonly _tag: Schema.tag<"ScopeError">;
+} & {
+    reason: typeof Schema.String;
+}>;
+
+/** Build an {@link AssetSink} over a storage provider. */
+export declare const storageAssetSink: (provider: StorageProvider) => AssetSink;
+
+/** Build an {@link AssetSource} over a storage provider — `list` is supplied by
+ *  the caller (typically streaming the `_voltro_storage_refs` table), `open`
+ *  uses the provider's streaming read (buffered fallback for non-streaming
+ *  backends). */
+export declare const storageAssetSource: (provider: StorageProvider, list: () => Stream.Stream<AssetInfo, unknown>) => AssetSource;
+
+/** Stream blobs TO object storage. `has` powers resume (skip existing keys);
+ *  `write` streams the archive's blob content straight into the provider. */
+export declare const storageBlobSink: (provider: StorageProvider) => BlobSink;
+
+/** Stream blobs FROM object storage. `list` enumerates metadata (typically the
+ *  storage refs table); `open` streams each blob's bytes via the provider. */
+export declare const storageBlobSource: (provider: StorageProvider, list: () => Stream.Stream<AssetInfo, unknown>) => BlobSource;
+
+/** A {@link BlobSource} over a provider whose blob list comes from the app's
+ *  `_voltro_storage_refs` table — the standard export source for a running
+ *  instance (CLI file export and the prod export endpoint both use it). */
+export declare const storageRefsBlobSource: (provider: StorageProvider, store: DataStore) => BlobSource;
+
+export declare interface SubsetSpec {
+    /** Seed rows per table. `table → predicate` (a `null`/absent predicate seeds
+     *  every row of that table). Only these tables + their FK-parent closure are
+     *  exported. */
+    readonly seeds: Readonly<Record<string, Predicate | undefined>>;
+    /** Safety bound on closure depth (default 12). */
+    readonly maxDepth?: number;
+    /**
+     * Tables whose seed predicate is FINAL — the closure never widens them. A
+     * reference INTO a pinned table is not followed (the target row is either
+     * already covered by that table's own seed predicate, or deliberately out of
+     * scope), and pinned tables collect no id sets in the RETURNED map (their
+     * rows stay predicate-selected). The tenant scope pins every tenant-scoped
+     * table so a closure walk can never pull another tenant's rows into the
+     * bundle. NB: even a pinned table's ids are tracked internally so the child
+     * pass can scope rows that reference the pinned (tenant) rows.
+     */
+    readonly pinned?: ReadonlyArray<string>;
+    /**
+     * Child-closure: after the parent closure settles, also include rows that
+     * REFERENCE the exported set — each restricted to the ids that actually point
+     * INTO the set (never the whole child table). The child rows' OWN parents are
+     * then folded back through the parent closure, so the result stays
+     * referentially complete (fail-closed: a child pulled in never dangles). Off
+     * by default — a parents-only subset is the cheaper common case.
+     *
+     * The walk is anchored on `roots` (a set of "tenant-tight" tables). A child
+     * row is pulled ONLY when at least one of its FKs points into a root row —
+     * OR into a row of a table ALREADY established as tight in this walk (a child
+     * pulled in earlier). This is the safety valve for the tenant case: `roots`
+     * is the tenant-scoped tables, so a comment on the tenant's project comes
+     * along, but a row that references ONLY a SHARED parent (a global `users`
+     * another tenant also references) is NOT pulled — that would be a
+     * cross-tenant leak. `roots: []` (or omitting the whole option) disables the
+     * child pass. `true` is the escape hatch: anchor on every already-selected
+     * table (org-slice takeout — no tenant boundary to respect).
+     */
+    readonly children?: {
+        readonly roots: ReadonlyArray<string>;
+    } | true;
+}
+
+/** Turn computed id sets into a {@link ResolvedScope} the exporter consumes. */
+export declare const subsetToScope: (selected: Map<string, Set<unknown>>, snapshot: SchemaSnapshot) => ResolvedScope;
+
+export declare const tableDone: (ledger: Ledger, name: string) => boolean;
+
+/** Per-table entry. `columnTypes` maps every exported column to its logical
+ *  {@link ColumnType} (as a string) so the importer decodes values without
+ *  re-introspecting the source. `checksum` is the sha256 of the UNCOMPRESSED
+ *  NDJSON payload — verified during import. */
+export declare const TableEntry: Schema.Struct<{
+    name: typeof Schema.String;
+    /** Bundle-relative path, e.g. `data/users.ndjson.zst`. */
+    file: typeof Schema.String;
+    rowCount: typeof Schema.Number;
+    /** sha256 hex of the uncompressed NDJSON bytes. */
+    checksum: typeof Schema.String;
+    /** column name → logical column type (the `ColumnType` union, as a string). */
+    columnTypes: Schema.Record$<typeof Schema.String, typeof Schema.String>;
+    /** The unique column keyset-streamed on export (usually `id`). */
+    primaryKey: typeof Schema.String;
+}>;
+
+export declare type TableEntry = Schema.Schema.Type<typeof TableEntry>;
+
+/**
+ * Order `tables` (a subset of the snapshot) so every table comes after the
+ * tables it references. Only FKs WITHIN the selected set constrain the order —
+ * a reference to an unselected table is ignored (the caller scoped it out on
+ * purpose). A cyclic dependency is broken at the edge that would close the
+ * cycle (deterministic for a given snapshot + input order); the importer's
+ * deferred-FK resolution covers the rows that land before their parents.
+ */
+export declare const topoSortTables: (tables: ReadonlyArray<string>, snapshot: SchemaSnapshot) => ReadonlyArray<string>;
+
+/**
+ * Unpack a framed byte stream. Plain files are written under `dir` (traversal
+ * guarded); blob entries are streamed to `blobs` (dest storage) — never to local
+ * disk — with the trailing sha verified as they pass through. A blob whose key
+ * already exists at the sink is skipped (resume).
+ */
+export declare const unpackBundle: (source: AsyncIterable<Uint8Array>, opts: {
+    dir: string;
+    blobs: BlobSink;
+}) => Promise<void>;
+
+/** Convenience: unpack a bundle fully to a local directory (plain files as-is,
+ *  blob entries materialised under `assets/`). For data-only bundles and
+ *  `voltro data unpack`; the streaming import path passes a storage {@link BlobSink}
+ *  to {@link unpackBundle} instead so blobs never touch local disk. */
+export declare const unpackBundleToDir: (source: AsyncIterable<Uint8Array>, dir: string) => Promise<void>;
+
+/**
+ * Stream one asset into the CAS dir, returning its sha256 + size. Hashes while
+ * writing to a temp file, then renames to `assets/<sha>` — or drops the temp if
+ * that hash is already present (dedup). The rename is atomic, so a concurrent
+ * reader never sees a half-written asset.
+ */
+export declare const writeAssetToCas: (stored: StoredStream, assetsDir: string) => Effect.Effect<{
+    readonly sha256: string;
+    readonly size: number;
+    readonly contentType: string;
+}, BundleError>;
+
+/** Persist the ledger atomically (temp + rename) so a crash mid-write never
+ *  corrupts the journal itself. */
+export declare const writeLedger: (path: string, ledger: Ledger) => Effect.Effect<void, BundleError>;
+
+export { }