import { Transform } from "node:stream";
/**
 * Caps for decompression-bomb protection. These apply per-archive so a single
 * pathological upload cannot exhaust disk or file handles.
 */
export declare const MAX_ARCHIVE_EXTRACTED_BYTES: number;
export declare const MAX_ARCHIVE_ENTRIES = 5000;
/**
 * Directory names whose contents are skipped during archive extraction. These
 * are dependency / VCS / build directories that LLM tooling almost never needs
 * to inspect and that routinely push archives past MAX_ARCHIVE_ENTRIES — most
 * notably `node_modules`, which can contain tens of thousands of files.
 */
export declare const EXTRACT_SKIP_DIRECTORY_NAMES: ReadonlySet<string>;
/**
 * Returns true when any path segment of `entryPath` is in the skip set. The
 * check uses POSIX-style `/` separators because both yauzl and tar emit
 * forward-slash entry names regardless of host platform.
 */
export declare function shouldSkipArchiveEntry(entryPath: string): boolean;
export declare class ArchiveLimitExceededError extends Error {
    constructor(message: string);
}
/**
 * Normalizes an untrusted filename for use as a single path segment under a
 * controlled extraction root. The output is guaranteed to never be `"."` or
 * `".."`, both of which would otherwise let a crafted upload (e.g. `"....gz"`
 * collapsed by `getGunzipOutputName`) escape the destination directory.
 */
export declare function sanitizeFileName(fileName: string): string;
/**
 * Throws if `targetPath` does not resolve inside `rootDir`. This is the
 * zip-slip / tar-slip / gzip-slip guard. Callers must invoke this on every
 * path derived from untrusted archive metadata before writing to disk.
 */
export declare function assertPathWithinRoot(rootDir: string, targetPath: string): void;
/**
 * Strips the `.gz`/`.gzip` suffix from a filename for use as the gunzip output
 * name. Falls back to `<name>.out` when no recognizable suffix is present.
 */
export declare function getGunzipOutputName(fileName: string): string;
/**
 * Creates a Transform stream that emits an `ArchiveLimitExceededError` once
 * the accumulated byte count crosses `maxBytes`. Used to bound pipelines whose
 * output would otherwise be unbounded (gzip decompression, signed-URL
 * downloads).
 */
export declare function createByteCapTransform(maxBytes: number, errorMessage: string): Transform;
export declare function extractZipArchive(params: {
    archivePath: string;
    destinationDir: string;
}): Promise<number>;
export declare function extractTgzArchive(params: {
    archivePath: string;
    destinationDir: string;
}): Promise<number>;
export declare function extractGzipArchive(params: {
    archivePath: string;
    destinationDir: string;
    fileName: string;
}): Promise<{
    extractedCount: number;
    outputPath: string;
}>;
//# sourceMappingURL=archive-extractors.d.ts.map