import { SentlyError } from "../core/errors.js";
import type { PushOptions, PushSendResult, PushTransport } from "../core/push-types.js";
import type { VerifyResult } from "../core/types.js";
/** Web Push / VAPID configuration. */
export interface WebPushConfig {
    /** Base64url-encoded uncompressed P-256 public key (65 bytes). */
    vapidPublicKey: string;
    /**
     * Base64url-encoded raw P-256 private key (32 bytes).
     * Treat as a tier-1 secret — inject from env / secrets manager only.
     */
    vapidPrivateKey: string;
    /**
     * Contact URI for the VAPID `sub` claim. Must be a `mailto:` address
     * (e.g. `mailto:you@example.com`) or an `https:` URL
     * (e.g. `https://example.com/contact`). Validated at construction.
     */
    subject: string;
    /**
     * Extra exact hostnames allowed for `subscription.endpoint` beyond the
     * built-in FCM / Mozilla / Apple / WNS allowlist. Use for private push relays.
     */
    allowedEndpointHosts?: string[];
}
/** Generated VAPID key pair in the common web-push raw format. */
export interface VapidKeys {
    /** Base64url-encoded uncompressed P-256 public key (65 bytes). */
    publicKey: string;
    /** Base64url-encoded raw P-256 private key (32 bytes) — treat as a secret. */
    privateKey: string;
}
/** Error thrown when a push service rejects the request. */
export declare class WebPushError extends SentlyError {
    readonly statusCode: number;
    readonly apiError: unknown;
    /** Creates a Web Push error with HTTP status and response body. */
    constructor(message: string, statusCode: number, apiError: unknown);
}
/**
 * Generate a VAPID key pair in the common web-push raw format
 * (base64url public + base64url private `d`).
 *
 * @example
 * ```ts
 * import { generateVapidKeys } from "sently/transports/webpush";
 *
 * const { publicKey, privateKey } = await generateVapidKeys();
 * ```
 */
export declare function generateVapidKeys(): Promise<VapidKeys>;
/**
 * Web Push transport — VAPID auth + RFC 8291 payload encryption.
 *
 * Endpoint URLs are validated against an allowlist before fetch to mitigate SSRF.
 * Redirects are not followed.
 */
export declare class WebPushTransport implements PushTransport {
    readonly provider = "webpush";
    private readonly vapidPublicKey;
    private readonly vapidPrivateKey;
    private readonly subject;
    private readonly allowedEndpointHosts;
    /** Creates a Web Push transport with VAPID credentials. */
    constructor(config: WebPushConfig);
    /** Encrypts and POSTs a notification to the subscription endpoint. */
    send(options: PushOptions): Promise<PushSendResult>;
    /** Lightweight VAPID credential shape check. */
    verify(): Promise<VerifyResult>;
}