export declare const DEFAULT_MAX_PACKAGE_BYTES: number;
export declare const HARD_MAX_PACKAGE_BYTES: number;
export declare const MAX_ARCHIVE_ENTRY_BYTES: number;
export declare const MAX_ARCHIVE_TOTAL_BYTES: number;
export declare const MAX_ARCHIVE_ENTRIES = 100000;
export declare function isSafePackageId(value: string): boolean;
export declare function isSafePackageVersion(value: string): boolean;
export declare function isAllowedPackageTarballUrl(value: string): boolean;
export declare function isSafePackageArchivePath(value: string): boolean;
export declare function isSafePackageArchiveEntry(entryPath: string, entryType: string | undefined, entrySize: number | undefined): boolean;
export declare function resolvePackageSizeLimit(value?: number): number | null;
/**
 * Package identifiers and Canonicals can be tenant-specific in enterprise
 * deployments. Keep them out of logs while retaining a stable correlation
 * key that is useful during incident analysis.
 */
export declare function packageReferenceMetadata(packageId: string, version?: string): {
    packageRef: string;
};
export declare function packageTargetMetadata(value: string): {
    targetRef: string;
};
/**
 * Never forward arbitrary exception text or stacks from registry responses,
 * archive parsers, or filesystem operations. Those values may contain URLs,
 * local paths, credentials, or attacker-controlled archive metadata.
 */
export declare function packageErrorMetadata(error: unknown): {
    kind: 'abort' | 'filesystem' | 'network' | 'syntax' | 'unknown';
    code?: string;
};
//# sourceMappingURL=package-artifact-policy.d.ts.map