/**
 * Sign an RS256 JWT for Google's OAuth 2.0 service-account flow using only
 * Node's `node:crypto` stdlib — no third-party crypto dependency.
 *
 * Claims:
 *   iss   = service-account client_email
 *   scope = https://www.googleapis.com/auth/firebase.messaging
 *   aud   = https://oauth2.googleapis.com/token
 *   iat   = now (seconds since epoch)
 *   exp   = now + 3600
 */
export declare function createSignedJwt(clientEmail: string, privateKey: string): string;
/**
 * Stateless service-account → access-token exchange.
 * Because the wrapper holds no state, this function takes no cache argument
 * and produces no cache state — it signs a fresh JWT and exchanges it at
 * Google's OAuth2 endpoint every call. Consumer-facing memoization is wired
 * through `FcmConfig.tokenCache` on the connector itself.
 *
 * Returns absolute `expiresInSeconds` from Google's response (typically 3599).
 * The caller is responsible for converting to epoch-ms before storing in a
 * `TokenCacheHook` (key = `'fcm:' + projectId`).
 */
export declare function getAccessToken(clientEmail: string, privateKey: string, fetchImpl?: typeof fetch): Promise<{
    accessToken: string;
    expiresInSeconds: number;
}>;