import { Buffer } from 'node:buffer';
/**
 * A fresh VAPID keypair.
 *
 * Generated per installation rather than shipped. A shared key across every
 * self-hosted instance would let any one of them send push notifications
 * claiming to be any other, and would make a single revocation break everybody.
 */
export declare function generateVapidKeys(): VapidKeys;
/**
 * The `Authorization` and `Crypto-Key` headers RFC 8292 asks for.
 *
 * The JWT is scoped to the push service's origin and expires, so a leaked one
 * is useful to one service for a limited time rather than being a permanent
 * credential for everything.
 */
export declare function buildVapidHeaders(options: {
  endpoint: string
  vapid: VapidKeys
  subject: string
  expiresInSeconds?: number
  /** Passed in so this is testable without pretending it is a particular day. */
  nowSeconds?: number
}): Record<string, string>;
/**
 * Encrypt a payload for one subscription, in the `aes128gcm` content encoding.
 *
 * The wire format is a header the receiver needs to decrypt - salt, record
 * size, and our ephemeral public key - followed by the ciphertext. The browser
 * has everything else already.
 *
 * A fresh ephemeral keypair per message, which is what makes this forward
 * secret: recovering the server's VAPID key later does not decrypt anything
 * already sent, because that key is not involved in the encryption at all.
 */
export declare function encryptPayload(subscription: WebPushSubscription, payload: string, salt?: Buffer): Buffer;
/**
 * Send one notification to one browser.
 *
 * Returns rather than throws, and says whether the endpoint is *gone*. That
 * distinction is the whole reason this returns a shape rather than a boolean:
 * a caller that cannot tell "try again later" from "this browser is never
 * coming back" either retries forever against a dead endpoint or deletes
 * somebody's subscription because their network blipped.
 */
export declare function sendWebPush(options: SendWebPushOptions): Promise<WebPushResult>;
/** A browser's subscription, exactly as `PushSubscription.toJSON()` gives it. */
export declare interface WebPushSubscription {
  endpoint: string
  keys: {
    p256dh: string
    auth: string
  }
}
export declare interface VapidKeys {
  publicKey: string
  privateKey: string
}
export declare interface WebPushResult {
  success: boolean
  status: number
  expired: boolean
  error?: string
}
export declare interface SendWebPushOptions {
  subscription: WebPushSubscription
  payload?: string
  vapid: VapidKeys
  subject: string
  ttl?: number
  urgency?: 'very-low' | 'low' | 'normal' | 'high'
  topic?: string
}