/**
 * SubscriptionGate -- S-03
 *
 * Runtime subscription enforcement. Wired into GovernanceRuntime boot.
 * Resolves the VendorCode from env (CXNI_VENDOR_CODE) or .governance.json,
 * exchanges it for an Entitlement Token, and enforces fail-closed policy.
 *
 * Failure modes:
 *   SUBSCRIPTION_NOT_CONFIGURED  -- no vendor code found
 *   SUBSCRIPTION_INACTIVE        -- vendor code is revoked
 *   SUBSCRIPTION_GRACE           -- payment failed, within grace window (proceed + warn)
 *
 * Pack floors (strictest-wins):
 *   HIPAA / HITECH: grace window = 24h
 *   PCI DSS:        grace window = 24h
 *   SOC 2:          grace window = 48h
 *   Default:        grace window = 72h
 *
 * @connexum/ai-governance S-03
 */
import type { EntitlementStatus } from './entitlement-client.js';
export declare class SubscriptionNotConfiguredError extends Error {
    constructor();
}
export declare class SubscriptionInactiveError extends Error {
    readonly subscriptionStatus: EntitlementStatus;
    constructor(status: EntitlementStatus, detail?: string);
}
/** Grace window floor in ms per pack type */
export declare const GRACE_WINDOWS_MS: Record<string, number>;
/**
 * Return the strictest (shortest) grace window for the given active pack IDs.
 * Strictest-wins: the shortest window determines the deadline.
 */
export declare function resolveGraceWindowMs(activePackIds: string[]): number;
export interface SubscriptionGateConfig {
    /** URL of the license server (e.g. https://license.my-cc.io) */
    licenseServerUrl: string;
    /** Active compliance pack IDs (for grace window resolution) */
    activePackIds?: string[];
    /**
     * Path to .governance.json for fallback vendor code lookup.
     * Defaults to .governance.json in the working directory.
     */
    governanceConfigPath?: string;
    /**
     * Revalidation interval ms. Defaults to 24h.
     * The gate calls revalidate() on this schedule.
     */
    revalidateIntervalMs?: number;
    /**
     * Callback invoked when subscription enters grace or is revoked after
     * a background revalidation. Used for dashboard banners and audit events.
     */
    onStatusChange?: (previous: EntitlementStatus, current: EntitlementStatus, graceUntil?: string) => void;
    /**
     * Audit event emitter for subscription.grace.warning events.
     * Called once per day when in grace mode.
     */
    emitAuditEvent?: (eventType: string, data: Record<string, unknown>) => void;
}
export declare class SubscriptionGate {
    private readonly cfg;
    private client?;
    private currentStatus?;
    private revalidateTimer?;
    private lastGraceWarnDate?;
    constructor(config: SubscriptionGateConfig);
    /**
     * Boot gate: resolve vendor code, exchange for token, enforce policy.
     *
     * Throws SubscriptionNotConfiguredError or SubscriptionInactiveError
     * on hard failures. Logs a warning and returns 'grace' for grace mode.
     */
    boot(): Promise<EntitlementStatus>;
    /**
     * Stop background revalidation timer (clean shutdown).
     */
    stop(): void;
    /**
     * Force an immediate revalidation check.
     */
    revalidateNow(): Promise<EntitlementStatus>;
    /**
     * Return the current cached subscription status.
     * Returns undefined if boot() has not been called.
     */
    getStatus(): EntitlementStatus | undefined;
    private _resolveVendorCode;
    private _startRevalidation;
    private _emitGraceWarning;
}
/**
 * One-shot gate check (no background revalidation). Used for hook scripts
 * and CLI pre-flight. Returns the status or throws.
 */
export declare function checkSubscriptionGate(licenseServerUrl: string, activePackIds?: string[]): Promise<EntitlementStatus>;
export declare function signOfflineGraceAcknowledgement(vendorCode: string, acknowledgedAt: string, secret: string): string;
//# sourceMappingURL=subscription-gate.d.ts.map