/**
 * ES256 provider-token (JWT) generation and caching for APNs.
 *
 * APNs token-based authentication requires a short-lived ES256 JWT signed with
 * your `.p8` auth key. Apple imposes two opposing constraints:
 *
 * - A token **older than 60 minutes** is rejected (`403 ExpiredProviderToken`).
 * - Refreshing **faster than every 20 minutes** is rejected
 *   (`429 TooManyProviderTokenUpdates`).
 *
 * This provider therefore signs at most one token per ~50-minute window and
 * reuses it across every request, which is both correct and far cheaper than
 * re-signing per push.
 *
 * The ES256 signature is the JOSE-required **64-byte `r || s`** form (IEEE
 * P1363), *not* DER. We obtain it with
 * `crypto.sign('SHA256', input, { key, dsaEncoding: 'ieee-p1363' })`; using the
 * default DER encoding here would produce tokens APNs rejects.
 *
 * @packageDocumentation
 */
/** Inputs required to mint APNs provider tokens. */
export interface JwtProviderConfig {
    /** PEM contents of the `.p8` ES256 (EC P-256) private key. */
    key: string;
    /** 10-character APNs Key ID — the JWT `kid` header. */
    keyId: string;
    /** 10-character Apple Team ID — the JWT `iss` claim. */
    teamId: string;
}
/**
 * A reusable APNs provider-token source. Call {@link JwtProvider.getToken} per
 * request; it returns the cached token until it ages past the refresh window,
 * then transparently re-signs.
 */
export declare class JwtProvider {
    private readonly keyObject;
    private readonly header;
    private readonly iss;
    /** The currently cached compact JWS, or `undefined` before the first sign. */
    private cachedToken?;
    /** Epoch-ms at which {@link cachedToken} was minted. */
    private mintedAt;
    constructor(config: JwtProviderConfig);
    /**
     * Return a valid provider token, signing a fresh one only when the cached
     * token is older than ~50 minutes (and never more often than every 20).
     *
     * @param now - Override the clock (epoch-ms); for testing.
     */
    getToken(now?: number): string;
    /**
     * Force a token refresh, respecting the 20-minute minimum interval. Returns
     * the (possibly still-cached) token. Useful after a `403 ExpiredProviderToken`
     * to recover without re-creating the provider.
     */
    refresh(now?: number): string;
    /** Mint, cache, and return a new token stamped at `now`. */
    private sign;
}
//# sourceMappingURL=jwt.d.ts.map