export interface IWebPushKeyRing {
    currentKeyId: string;
    keys: ReadonlyMap<string, Buffer>;
}
export interface IWebPushEncryptedEnvelope {
    version: 1;
    algorithm: 'aes-256-gcm';
    keyId: string;
    nonce: string;
    ciphertext: string;
    tag: string;
}
export interface IWebPushAadContext {
    gatewayClientId: string;
    appInstanceId: string;
    bindingId: string;
    documentType: string;
    documentId: string;
}
export type TWebPushHmacDomain = 'credential' | 'idempotency-key' | 'request' | 'endpoint' | 'topic';
export declare function parseWebPushKeyRing(rawValueArg: unknown, labelArg: string): IWebPushKeyRing;
export declare function assertDistinctWebPushKeyRings(encryptionRingArg: IWebPushKeyRing, hmacRingArg: IWebPushKeyRing): void;
export declare function buildWebPushAad(contextArg: IWebPushAadContext): Buffer;
export declare function canonicalJson(valueArg: unknown): string;
export declare class WebPushCrypto {
    private readonly encryptionRing;
    private readonly hmacRing;
    constructor(encryptionRing: IWebPushKeyRing, hmacRing: IWebPushKeyRing);
    get currentEncryptionKeyId(): string;
    get currentHmacKeyId(): string;
    encryptJson(valueArg: unknown, aadContextArg: IWebPushAadContext): IWebPushEncryptedEnvelope;
    decryptJson<T>(envelopeArg: IWebPushEncryptedEnvelope, aadContextArg: IWebPushAadContext): T;
    hmac(domainArg: TWebPushHmacDomain, valueArg: string, keyIdArg?: string): {
        keyId: string;
        digest: string;
    };
    verifyHmac(domainArg: TWebPushHmacDomain, valueArg: string, keyIdArg: string, expectedDigestArg: string): boolean;
}