/**
 * Sanitise a raw email filename for filesystem safety:
 *   - replace path separators and null bytes with "_"
 *   - strip leading "." and ".." segments
 *   - drop ASCII control characters
 *   - truncate to FILENAME_MAX_CHARS (the sha256 prefix carries uniqueness;
 *     the filename is for human readability only)
 *
 * Returns "unnamed" if the result is empty after sanitisation.
 */
export declare function sanitiseFilename(raw: string): string;
export interface ArchiveResult {
    sha256: string;
    archivePath: string;
}
/**
 * Write attachment bytes to {accountDir}/archive/email/<uidValidity>-<uid>/<sha256>-<filename>
 * at 0o600 perms. Returns the sha256 and archive path on success, null on
 * filesystem failure (which logs a warning and lets the caller proceed with
 * archivePath=null).
 *
 * Idempotent: re-running with the same bytes at the same target path is a
 * no-op (write is skipped if the file already exists).
 */
export declare function archiveAttachment(accountDir: string, uidValidity: number, uid: number, rawFilename: string, bytes: Buffer): ArchiveResult | null;
/**
 * Compute the sha256 of bytes without writing to disk. Used for the
 * synthetic-id path when bytes are present but archive failed, so the
 * :DigitalDocument node can still carry a content-addressed attachmentId.
 */
export declare function sha256OfBytes(bytes: Buffer): string;
/**
 * Compute a synthetic attachmentId for an attachment whose bytes were not
 * downloaded (oversize or fetch-error). The id is content-free but stable
 * for the same (uidValidity, uid, partKey, filename, size) tuple, so
 * re-runs MERGE onto the same :DigitalDocument node.
 */
export declare function syntheticAttachmentId(uidValidity: number, uid: number, partKey: string, filename: string, sizeBytes: number): string;
//# sourceMappingURL=attachment-archive.d.ts.map