/**
 * JWT License Validator -- Client-side license validation for @connexum/ai-governance.
 *
 * Supports two validation modes:
 * 1. **Offline**: Verify JWT locally using embedded Connexum RSA public key.
 *    Works in air-gapped environments. Checks signature, expiry, and claims.
 * 2. **Online**: POST JWT to license server for full validation including
 *    revocation checking.
 *
 * License JWTs use RS256 (RSA PKCS#1 v1.5 with SHA-256).
 *
 * Phase 3 (Key Vault):
 *   - EMBEDDED_PUBLIC_KEYS is populated from src/license/embedded-public-keys.json,
 *     which is written at SDK publish time by scripts/snapshot-vault-public-keys.mjs.
 *   - At validator boot, a background refresh is attempted against the vault public
 *     endpoint (GET /api/v1/key-vault/public/<alias>). On success the in-memory key
 *     map is updated. On failure the embedded JSON is used as fallback (Invariant 4:
 *     offline-verifiable).
 *   - Cache TTL is 24 hours. Stale cache triggers a refresh on next validation call.
 *   - The old cxgov-key-1 placeholder is DELETED. Any token signed with that dead key
 *     is rejected by the unknown-kid path.
 *
 * @connexum/ai-governance
 */
export type LicenseTier = 'free' | 'starter' | 'professional' | 'enterprise';
export interface LicenseClaims {
    /** License tier */
    tier: LicenseTier;
    /** Organization identifier */
    org: string;
    /** Maximum number of governed agents */
    maxAgents: number;
    /** Maximum compliance packs */
    maxPacks: number;
    /** Enabled feature flags */
    features: string[];
    /** Issuer (always 'my-cc.io') */
    iss: string;
    /** Audience (always '@connexum/ai-governance') */
    aud: string;
    /** Subject (org ID or license ID) */
    sub: string;
    /** Issued at (Unix timestamp) */
    iat: number;
    /** Expiry (Unix timestamp) */
    exp: number;
    /** JWT ID (unique license identifier) */
    jti: string;
    /** Key ID for public key rotation */
    kid: string;
    /** Offline grace period in days (default: 7) */
    offlineGracePeriodDays?: number;
}
export interface LicenseValidationResult {
    valid: boolean;
    claims: LicenseClaims | null;
    error?: string;
    /** Whether validation was done offline */
    offline: boolean;
    /** Timestamp of validation */
    validatedAt: string;
    /** Days until expiry (negative = expired) */
    daysUntilExpiry?: number;
}
export interface JwtValidatorConfig {
    /** License server URL for online validation */
    serverUrl?: string;
    /** Custom RSA public keys by kid (PEM format). Falls back to embedded key. */
    publicKeys?: Record<string, string>;
    /** Force offline mode (skip server validation) */
    forceOffline?: boolean;
    /** Request timeout in ms for online validation (default: 5000) */
    timeoutMs?: number;
    /**
     * Base URL of the governance-server vault for live public-key refresh.
     * Default: process.env.VAULT_PUBLIC_URL ?? 'http://localhost:4201'
     * Set to empty string to disable live refresh (pure offline mode).
     */
    vaultBaseUrl?: string;
    /**
     * Vault key alias to refresh (default: 'cxgov-key-2').
     * This is the post-cleanup alias; cxgov-key-1 (compromised) is never fetched.
     */
    vaultKeyAlias?: string;
}
/**
 * Reset the module-level public-key cache timestamp.
 * FOR TESTING ONLY — forces the next _maybeRefreshLiveKeys() call to re-fetch.
 * @internal
 */
export declare function _resetPublicKeyCacheForTest(): void;
export declare const TIER_LIMITS: Record<LicenseTier, {
    maxAgents: number;
    maxPacks: number;
    features: string[];
}>;
export declare class JwtValidator {
    private config;
    private lastOnlineValidation;
    /** Live public-key map, seeded from EMBEDDED_PUBLIC_KEYS and refreshed on vault fetch. */
    private livePublicKeys;
    constructor(config?: JwtValidatorConfig);
    /**
     * Refresh public keys from the vault if the cache is stale (>24h old).
     * Updates the in-memory livePublicKeys map on success.
     * Never throws — any network failure leaves the current map in place.
     * @internal
     */
    private _maybeRefreshLiveKeys;
    /**
     * Validate a license key or JWT token.
     *
     * - If empty or 'free', returns free tier.
     * - If a JWT, validates signature + claims offline.
     * - If online server is configured and reachable, also checks revocation.
     * - Public-key cache is refreshed from the vault if >24h stale.
     */
    validate(token: string): Promise<LicenseValidationResult>;
    /**
     * Validate a JWT offline using the embedded public key.
     */
    validateOffline(token: string): LicenseValidationResult;
    /**
     * Validate a JWT against the license server (online).
     * Checks revocation list in addition to signature/claims.
     */
    private validateOnline;
    /**
     * Check if a specific feature is enabled for the given claims.
     */
    static hasFeature(claims: LicenseClaims, feature: string): boolean;
    /**
     * Check if the license allows a specific number of agents.
     */
    static canAddAgent(claims: LicenseClaims, currentCount: number): boolean;
    /**
     * Check if the license allows a specific number of packs.
     */
    static canAddPack(claims: LicenseClaims, currentCount: number): boolean;
    /**
     * Get a free-tier claims object (for when no license is provided).
     */
    static getFreeTierClaims(): LicenseClaims;
}
//# sourceMappingURL=jwt-validator.d.ts.map