import { HttpError } from './errors.js';
export declare const malformed: (message?: string) => HttpError;
/** Headers of one part, as the parser hands them to {@link MultipartHandlers.onPartStart}. */
export interface PartHeaders {
    /** The form field name (`Content-Disposition: form-data; name=…`). */
    name: string;
    /** Present (possibly empty) only for a file part; raw and UNSANITISED. */
    filename?: string;
    /** The part's declared media type essence, lower-cased, parameters dropped. */
    contentType?: string;
    /**
     * The part's own `Content-Length`, when it sent a valid one. RFC 7578 does
     * not require it and no browser sends it, so it is usually absent — treat it
     * as a hint, never as the number of bytes that will actually arrive.
     */
    contentLength?: number;
}
export interface MultipartHandlers {
    onPartStart(part: PartHeaders): void;
    onPartData(chunk: Buffer): void;
    onPartEnd(): void;
}
export declare class MultipartParser {
    private readonly handlers;
    private readonly maxHeaderBytes;
    private state;
    private readonly delimiter;
    private carry;
    private header;
    private padding;
    constructor(boundary: string, handlers: MultipartHandlers, maxHeaderBytes?: number);
    /** True once the closing delimiter (`--boundary--`) has been seen. */
    get complete(): boolean;
    write(chunk: Buffer): void;
    /** Call when the source ends; throws unless the closing delimiter was seen. */
    end(): void;
}
/** A header value's leading token (lower-cased) and its `;`-separated parameters. */
export interface ParsedHeaderValue {
    value: string;
    params: Map<string, string>;
}
/**
 * Parses `type; a=b; c="d \"e\""` (RFC 9110 parameters, quoted-strings with
 * backslash escapes, unless `backslashEscapes` is false). Throws on a repeated parameter — two `boundary=` or two
 * `filename=` values are an ambiguity an attacker picks the reading of — and
 * on anything that does not tokenise cleanly.
 */
export declare function parseHeaderValue(input: string, backslashEscapes?: boolean): ParsedHeaderValue;
/**
 * Validates a request `Content-Type` for a multipart upload and returns its
 * boundary. 415 when the media type is not `multipart/form-data`; 400 when the
 * boundary is missing, repeated, or outside RFC 2046's grammar (1–70 `bchars`,
 * not ending in a space).
 */
export declare function multipartBoundary(contentType: string | undefined): string;
/**
 * Reduces a client-supplied filename to a safe display basename: never a path.
 * Directories are stripped on both `/` and `\` (so `../../x` and `C:\x` become
 * `x`), a drive prefix is dropped, control/NUL and invisible bidi characters
 * are removed, trailing dots/spaces are trimmed, and the result is capped at
 * 255 UTF-8 bytes with the extension kept. Returns `'file'` when nothing
 * usable is left. Still only a label — never use it as a storage key.
 */
export declare function sanitizeFilename(raw: string): string;