import { ChannelAdapter } from './index.js';

type WebPushSubscription = {
    endpoint: string;
    keys: {
        p256dh: string;
        auth: string;
    };
};
type WebPushVapidKeys = {
    subject: string;
    publicKey: string;
    privateKey: string;
};
type EncryptKeyMaterial = {
    payload: string | Uint8Array;
    clientP256dh: string;
    clientAuth: string;
    salt: Uint8Array;
    asKeyPair: CryptoKeyPair;
};
type WebPushEncryptResult = {
    body: Uint8Array;
    salt: Uint8Array;
    serverPublicKey: Uint8Array;
};
type WebPushCryptoIntermediates = {
    ecdhSecret: Uint8Array;
    prkKey: Uint8Array;
    ikm: Uint8Array;
    prk: Uint8Array;
    cek: Uint8Array;
    nonce: Uint8Array;
};
declare function importUncompressedP256PublicKey(b64: string): Promise<CryptoKey>;
declare function deriveEcdhSecret(privateKey: CryptoKey, peerPublicKey: CryptoKey): Promise<Uint8Array>;
declare function computeWebPushIntermediates(opts: {
    ecdhSecret: Uint8Array;
    authSecret: Uint8Array;
    salt: Uint8Array;
    uaPublic: Uint8Array;
    asPublic: Uint8Array;
}): Promise<WebPushCryptoIntermediates>;
/**
 * Deterministic RFC 8291 aes128gcm encryption core — inject fixed salt + AS key pair for KAT.
 */
declare function encryptWebPushPayloadWithKeyMaterial(opts: EncryptKeyMaterial): Promise<WebPushEncryptResult>;
/** Production path — random salt + ephemeral AS ECDH key pair. */
declare function encryptWebPushPayload(opts: {
    payload: string | Uint8Array;
    clientP256dh: string;
    clientAuth: string;
}): Promise<WebPushEncryptResult>;
declare function createVapidJwt(vapid: WebPushVapidKeys, audience: string, expSeconds: number): Promise<string>;
/** Build RFC 8291 AS key pair from fixed scalar + uncompressed public (KAT / tests). */
declare function importRfc8291AsKeyPair(privateScalarB64: string, publicUncompressedB64: string): Promise<CryptoKeyPair>;
type WebPushChannelOpts = {
    vapid: WebPushVapidKeys;
    ttl?: number;
    fetch?: typeof fetch;
};
declare function createWebPushChannel(opts: WebPushChannelOpts): ChannelAdapter;
/** Verify a VAPID JWT offline (ES256). */
declare function verifyVapidJwt(jwt: string, vapidPublicKey: string, expectedAud: string): Promise<boolean>;

export { type EncryptKeyMaterial, type WebPushChannelOpts, type WebPushCryptoIntermediates, type WebPushEncryptResult, type WebPushSubscription, type WebPushVapidKeys, computeWebPushIntermediates, createVapidJwt, createWebPushChannel, deriveEcdhSecret, encryptWebPushPayload, encryptWebPushPayloadWithKeyMaterial, importRfc8291AsKeyPair, importUncompressedP256PublicKey, verifyVapidJwt };