/**
 * push/vapid.ts
 *
 * VAPID (RFC 8292) key custody and request signing for browser push.
 *
 * KEY CUSTODY, the load-bearing rule of this file:
 *  - The daemon generates one P-256 keypair on first need.
 *  - The WHOLE keypair (including the private component) is persisted only
 *    through the SecretsManager, exactly like any other credential, into the
 *    secure store, or the plaintext secrets file, per the active secret policy.
 *    It is NEVER written into the config, so it can never ride out in the
 *    secret-free config snapshot.
 *  - The private key is used only here, to sign the short-lived VAPID JWT that
 *    authorizes one delivery. It is never logged and never returned by any read
 *    verb.
 *  - Only the PUBLIC key leaves the daemon: `getPublicKey()` feeds the
 *    `push.vapid.get` verb and the `k=` parameter of the Authorization header.
 */
/** The narrow slice of SecretsManager this module needs, get/set one secret. */
export interface VapidSecretStore {
    get(key: string): Promise<string | null>;
    set(key: string, value: string): Promise<void>;
}
export interface VapidManagerOptions {
    /**
     * The `sub` claim of the VAPID JWT, a `mailto:` or `https:` contact the push
     * service can reach. Defaults to {@link DEFAULT_VAPID_SUBJECT} when unset.
     */
    readonly subject?: string | undefined;
}
/** The secret key under which the keypair is stored (a secrets-store key, not a config key). */
export declare const VAPID_SECRET_KEY = "push.vapid.keypair";
export { DEFAULT_VAPID_SUBJECT, VAPID_SUBJECT_HINT, isValidVapidSubject } from './vapid-subject.js';
export declare class VapidManager {
    private readonly store;
    private readonly subject;
    private inflight;
    constructor(store: VapidSecretStore, options?: VapidManagerOptions);
    /** The `sub` claim every JWT this manager signs will carry. */
    getSubject(): string;
    /** The public application-server key clients subscribe with. Generates on first call. */
    getPublicKey(): Promise<string>;
    /**
     * Build the `Authorization: vapid ...` header value for one delivery to
     * `endpoint`. The JWT's audience is the endpoint's origin (RFC 8292).
     */
    buildAuthorizationHeader(endpoint: string): Promise<string>;
    private signJwt;
    /**
     * Load the keypair from the secrets store, or generate and persist one on
     * first use. Concurrent callers share a single in-flight generation so two
     * simultaneous first-time deliveries cannot mint two keypairs.
     */
    private ensureKeypair;
    private loadOrGenerate;
}
//# sourceMappingURL=vapid.d.ts.map