import * as Effect from "effect/Effect";
declare const ArchiveGuardrailError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "ArchiveGuardrailError";
} & Readonly<A>;
export declare class ArchiveGuardrailError extends ArchiveGuardrailError_base<{
    readonly code: "path_traversal" | "absolute_path" | "duplicate_entry" | "symlink_entry" | "unsupported_compression" | "malformed_archive" | "decompression_limit_exceeded" | "compression_ratio_exceeded" | "entry_count_exceeded" | "forbidden_entry";
    readonly message: string;
    readonly entry?: string;
}> {
}
export declare const ZIP_LOCAL_SIGNATURE = 67324752;
export interface ZipEntry {
    readonly fileName: string;
    readonly compressedSize: number;
    readonly uncompressedSize: number;
    readonly compressionMethod: number;
    readonly externalAttributes: number;
    readonly localHeaderOffset: number;
}
export interface ArchiveGuardrailLimits {
    readonly maxEntries?: number;
    readonly maxDecompressedBytes?: number;
    readonly maxCompressionRatio?: number;
}
export declare const parseZipCentralDirectory: (buf: Uint8Array) => Effect.Effect<readonly ZipEntry[], ArchiveGuardrailError>;
/**
 * Reject archives carrying build or secret leftovers: any `node_modules` or
 * `.git` path segment, and `.env` / `.env.*` files. Kept out of
 * {@link validateArchive} on purpose — that function is the registry ingest
 * contract, and archives accepted by earlier clients must keep ingesting.
 *
 * `.env*` matches the basename exactly (`.env`) or by dotted prefix
 * (`.env.local`, `.env.production`, and also `.env.example`), so sibling names
 * like `.envrc` and `environment.md` are unaffected.
 */
export declare const checkForbiddenSourceEntries: (entries: readonly ZipEntry[]) => Effect.Effect<void, ArchiveGuardrailError>;
export declare const validateArchive: (archiveBytes: Uint8Array, limits?: ArchiveGuardrailLimits) => Effect.Effect<readonly ZipEntry[], ArchiveGuardrailError>;
export {};
//# sourceMappingURL=archive-guardrails.d.ts.map