/** Contains the text that replaces sensitive token data. */
export declare const MASK_STRING = "**";
/** Contains the maximum number of visible payload characters. */
export declare const MAX_VISIBLE_PAYLOAD_LENGTH = 15;
/** Identifies a token format that has no signature. */
export declare const NO_SIGNATURE = -1;
/** Describes the sensitive part of a recognized token format. */
export declare class TokenVersion {
    /** Contains the prefix. */ readonly prefix: string;
    /** Contains the delimiter. */ readonly delimiter: string;
    /** Contains the signature position. */ readonly signaturePosition: number;
    /** Contains the token parts count. */ readonly tokenPartsCount: number;
    /** Creates a new token version. */
    constructor(
    /** Contains the prefix. */ prefix: string, 
    /** Contains the delimiter. */ delimiter: string, 
    /** Contains the signature position. */ signaturePosition: number, 
    /** Contains the token parts count. */ tokenPartsCount: number);
}
/** Contains the supported access-token formats. */
export declare const ACCESS_TOKEN_VERSIONS: Record<string, TokenVersion>;
/** Contains the supported credential formats. */
export declare const CREDENTIALS_VERSIONS: Record<string, TokenVersion>;
/** Defines the token version extractor API. */
export interface TokenVersionExtractor {
    /** Extracts the token format. */
    extract(token: string): [TokenVersion, boolean];
}
export declare class DefaultTokenVersionExtractor implements TokenVersionExtractor {
    private readonly versions;
    /** Creates a new default token version extractor. */
    constructor(versions: Record<string, TokenVersion>);
    /** Extracts the token format. */
    extract(token: string): [TokenVersion, boolean];
}
/**
 * Produces a diagnostic token representation with sensitive data partly
 * masked.
 *
 * Sanitizing reduces accidental disclosure in logs, but it is not an
 * encryption or access-control boundary. A recognized short `v0` payload can
 * remain visible. Avoid logging tokens when possible.
 *
 * @example
 * ```ts
 * import { TokenSanitizer } from '@nebius/js-sdk/runtime/token_sanitizer';
 *
 * const safe = TokenSanitizer.accessTokenSanitizer().sanitize(accessToken);
 * logger.debug('received token', { token: safe });
 * ```
 */
export declare class TokenSanitizer {
    private readonly extractor;
    /** Creates a new token sanitizer. */
    constructor(extractor: TokenVersionExtractor);
    /** Creates a sanitizer for supported access-token formats. */
    static accessTokenSanitizer(): TokenSanitizer;
    /** Creates a sanitizer for supported credential formats. */
    static credentialsSanitizer(): TokenSanitizer;
    /**
     * Masks the signature or a long payload for a recognized token format.
     *
     * A short no-signature payload can remain unchanged. Unknown formats keep at
     * most the first 15 characters. Empty inputs return an empty string.
     */
    sanitize(token: string | undefined | null): string;
    /** Returns whether the sanitizer supports the token format. */
    isSupported(token: string | undefined | null): boolean;
}
/**
 * Shortens a token format that has no signature.
 *
 * When the payload after `prefix` has 15 characters or fewer, this function
 * returns the complete token and leaves the payload visible.
 */
export declare function sanitizeNoSignature(token: string, prefix: string): string;
/**
 * Shortens a token with an unknown format.
 *
 * Tokens with 15 characters or fewer remain fully visible before the mask
 * marker. Do not use this function as an access-control boundary.
 */
export declare function sanitizeUnrecognized(token: string): string;
//# sourceMappingURL=token_sanitizer.d.ts.map