/**
 * JWT License Issuer -- Server-side license creation for @connexum/ai-governance.
 *
 * Creates RS256-signed JWT license tokens with proper claims for each tier.
 * Used by the license server, NOT shipped to end users.
 *
 * @connexum/ai-governance
 */
import type { LicenseTier, LicenseClaims } from './jwt-validator';
export interface IssuerConfig {
    /** RSA private key (PEM format) for signing JWTs */
    privateKey: string;
    /** Key ID matching the private key */
    kid: string;
    /** Default license duration in days (default: 365) */
    defaultDurationDays?: number;
    /** Default offline grace period in days (default: 7) */
    defaultGracePeriodDays?: number;
}
export interface IssueLicenseRequest {
    /** Organization identifier */
    org: string;
    /** License tier */
    tier: LicenseTier;
    /** Override max agents (defaults to tier limit) */
    maxAgents?: number;
    /** Override max packs (defaults to tier limit) */
    maxPacks?: number;
    /** Additional features beyond tier defaults */
    additionalFeatures?: string[];
    /** License duration in days (overrides default) */
    durationDays?: number;
    /** Offline grace period in days (overrides default) */
    offlineGracePeriodDays?: number;
}
export interface IssuedLicense {
    /** The signed JWT token */
    token: string;
    /** Decoded claims */
    claims: LicenseClaims;
    /** When the license expires */
    expiresAt: string;
}
export declare class JwtIssuer {
    private config;
    constructor(config: IssuerConfig);
    /**
     * Issue a new license JWT.
     */
    issue(request: IssueLicenseRequest): IssuedLicense;
    /**
     * Sign claims into a JWT.
     */
    private sign;
    /**
     * Generate an RSA-2048 key pair for license signing.
     * Returns { publicKey, privateKey } in PEM format.
     */
    static generateKeyPair(): {
        publicKey: string;
        privateKey: string;
    };
}
//# sourceMappingURL=jwt-issuer.d.ts.map