/**
 * EntitlementClient -- S-02
 *
 * Client-side SDK component that exchanges a VendorCode for a short-lived
 * Entitlement Token (24h JWT), caches it, and refreshes it before expiry.
 *
 * The token carries:
 *   - tier
 *   - packEntitlements
 *   - subscriptionActiveUntil
 *   - graceUntil (if in grace mode)
 *   - status ("active" | "grace" | "revoked")
 *   - iat, exp
 *
 * Signed with ENTITLEMENT_SIGNING_KEY (HMAC-SHA256, distinct from all other
 * secrets per boot-gate distinctness check).
 *
 * Usage:
 *   const client = new EntitlementClient({ vendorCode, licenseServerUrl, cache });
 *   const token = await client.getToken();   // memoized, refreshes 1h before expiry
 *   await client.refresh();                  // force round-trip
 *   const status = await client.revalidate(); // returns 'active' | 'grace' | 'revoked'
 *
 * @connexum/ai-governance S-02
 */
export type EntitlementStatus = 'active' | 'grace' | 'revoked';
export interface EntitlementToken {
    /** Raw JWT string */
    jwt: string;
    /** Decoded token payload */
    claims: EntitlementClaims;
}
export interface EntitlementClaims {
    sub: string;
    tier: string;
    packEntitlements: string[];
    subscriptionActiveUntil: string;
    graceUntil?: string;
    status: EntitlementStatus;
    iat: number;
    exp: number;
}
export interface EntitlementCache {
    get(key: string): EntitlementToken | undefined;
    set(key: string, token: EntitlementToken): void;
    delete(key: string): void;
}
export interface EntitlementClientConfig {
    vendorCode: string;
    licenseServerUrl: string;
    cache: EntitlementCache;
    /** Override default 24h token TTL (for testing) */
    tokenTtlMs?: number;
    /** Refresh the token this many ms before expiry. Default: 3600 000 (1h). */
    refreshLeadMs?: number;
    /** Machine ID for abuse detection telemetry */
    machineId?: string;
    /** SDK version string */
    sdkVersion?: string;
}
export declare class InMemoryEntitlementCache implements EntitlementCache {
    private store;
    get(key: string): EntitlementToken | undefined;
    set(key: string, token: EntitlementToken): void;
    delete(key: string): void;
}
export declare class EntitlementClient {
    private readonly cfg;
    constructor(config: EntitlementClientConfig);
    /**
     * Return a cached token, refreshing it if it will expire within
     * refreshLeadMs. On first call, fetches from the license server.
     */
    getToken(): Promise<EntitlementToken>;
    /**
     * Force a round-trip to the license server, bypassing the cache.
     * Updates the cache with the fresh token.
     */
    refresh(): Promise<EntitlementToken>;
    /**
     * Revalidate the vendor code against the license server.
     * Returns the current status without fully refreshing the cached token.
     */
    revalidate(): Promise<EntitlementStatus>;
    private _isExpiringSoon;
    private _exchange;
}
export declare class EntitlementError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
/**
 * Decode the payload of a JWT without verifying the signature.
 * Signature verification is done server-side on the exchange endpoint.
 * Client-side, we only need the claims for expiry/status checks.
 */
export declare function decodeJwtPayload(jwt: string): EntitlementClaims;
/**
 * Sign an Entitlement Token payload with HMAC-SHA256.
 * Returns a compact JWT string.
 */
export declare function signEntitlementToken(claims: Omit<EntitlementClaims, 'iat' | 'exp'> & {
    iat?: number;
    exp?: number;
}, secret: string, ttlMs?: number): string;
/**
 * Verify an Entitlement Token signature and return decoded claims.
 * Throws EntitlementError on any verification failure.
 */
export declare function verifyEntitlementToken(jwt: string, secret: string): EntitlementClaims;
//# sourceMappingURL=entitlement-client.d.ts.map