/**
 * @module
 * Push subscription endpoint safety and hook redaction helpers.
 *
 * Full push endpoints embed long-lived delivery tokens. Never put the raw URL
 * in logs or hook context — use {@link redactPushEndpoint} instead.
 */
/**
 * Built-in hosts for major browser push services.
 * Custom hosts can be added via {@link WebPushConfig.allowedEndpointHosts}.
 */
export declare const DEFAULT_PUSH_ENDPOINT_HOSTS: readonly string[];
/**
 * Validate a push subscription endpoint before server-side fetch.
 *
 * Rejects non-HTTPS schemes, IP literals (including link-local / private),
 * and hostnames outside the allowlist — mitigates SSRF when subscriptions
 * come from untrusted clients.
 *
 * @param endpoint - Raw subscription endpoint URL.
 * @param extraHosts - Additional exact hostnames to allow.
 * @throws Error when the endpoint is unsafe.
 */
export declare function assertSafePushEndpoint(endpoint: string, extraHosts?: readonly string[]): void;
/**
 * Redact a push endpoint for hook/observability context.
 * Returns `origin/#<8-byte-hash>` so logs never store the delivery token path.
 */
export declare function redactPushEndpoint(endpoint: string): Promise<string>;
/**
 * Redact an FCM device token for hook/observability context.
 * Returns `fcm:#<8-byte-hash>` so logs never store the raw registration token.
 */
export declare function redactFcmToken(token: string): Promise<string>;