/** A file offered for upload. */
export interface FileUpload {
    /** File name, whose extension is checked. */
    name: string;
    /** MIME type, checked against `allowedMimeTypes`. */
    mimeType?: string;
    /** Size in bytes. Measured from `content` when omitted. */
    sizeBytes?: number;
    /** The contents. Text contents are scanned for forbidden patterns. */
    content?: string | Buffer;
}
/** Options for scanning uploads. */
export interface UploadScannerOptions {
    /** Largest file allowed, in bytes. No limit by default. */
    maxBytes?: number;
    /** MIME types allowed. Any type by default. */
    allowedMimeTypes?: string[];
    /** Extensions refused. Defaults to executables and scripts such as `.exe`, `.ps1`, and `.js`. */
    blockedExtensions?: string[];
    /** Scans text contents for forbidden patterns. Defaults to true. */
    scanTextContent?: boolean;
    /**
     * Patterns refused in text contents. Defaults to private keys, cloud and GitHub tokens, and
     * instruction-override phrases.
     */
    forbiddenPatterns?: RegExp[];
}
/** One problem found in an upload. */
export interface UploadScanFinding {
    /** The file it was found in. */
    fileName: string;
    /** How serious it is. `high` and `critical` findings fail the scan. */
    severity: 'low' | 'medium' | 'high' | 'critical';
    /** What was found. */
    message: string;
    /** The matched text, for a forbidden pattern. */
    value?: string;
}
/** The outcome of scanning uploads. */
export interface UploadScanResult {
    /** True when nothing `high` or `critical` was found. */
    ok: boolean;
    /** Every finding. */
    findings: UploadScanFinding[];
}
/**
 * Checks uploads for size, extension, MIME type, and forbidden content before they reach a model or
 * a store.
 */
export declare class UploadScanner {
    private options;
    constructor(options?: UploadScannerOptions);
    /** Scans a set of files. */
    scan(files: FileUpload[]): UploadScanResult;
}
/** Scans a set of files with a one-off scanner. */
export declare function scanUploads(files: FileUpload[], options?: UploadScannerOptions): UploadScanResult;