/**
 * License Pack Loader — SDK consumer of PR-D (pack distribution endpoint).
 *
 * Responsibilities:
 *   1. Parse pack_codes from the install JWT (decoded once at runtime boot).
 *   2. Consult the monthly-verify cache (MonthlyVerifyCache) to determine
 *      which packs are licensed — skip the fetch entirely for unlicensed packs
 *      to avoid a wasteful 403 round-trip.
 *   3. Fetch each pack via GET /api/v1/packs/:packId@latest with the Install
 *      Pack Code as Bearer, using a 1-hour TTL in-process cache.
 *   4. On 403 (license_not_active): log UNLICENSED_PACK_REFUSED locally +
 *      emit to gov-server audit chain (best-effort). Never throw.
 *   5. Load fetched pack rules into the runtime governance engine.
 *
 * Architectural invariants honoured:
 *   Invariant 2  (advisory, never authoritative): every fetch fails-soft.
 *                No throws on transient errors.
 *   Invariant 3  (graceful degradation): if cache is cold AND license-server
 *                is unreachable, agents continue running with Company Pack only.
 *   Invariant 10 (push-receive-only): SDK PULLS pack content.
 *                We never push into customer infrastructure.
 *
 * Integration gap closed: PR-D endpoint exists + tested but had no SDK caller.
 * This module is that caller.
 *
 * @connexum/ai-governance  Task #32 — SDK consumer PR-D
 */
import type { CompliancePack } from '../packs/index.js';
/**
 * A single entry in the install JWT pack_codes claim (PR-W-3+4 shape).
 * The `code` field is the Install Pack Code:
 *   Format: lic_<packId>_<orgId>_<year>:<agentPassportId>
 */
export interface InstallPackCodeEntry {
    packId: string;
    code: string;
    agentId: string;
}
/**
 * Result of loading a single pack. Discriminated by `status`.
 */
export type PackLoadResult = {
    status: 'loaded';
    packId: string;
    pack: CompliancePack;
} | {
    status: 'skipped_unlicensed';
    packId: string;
} | {
    status: 'fetch_error';
    packId: string;
    error: string;
} | {
    status: 'cached';
    packId: string;
    pack: CompliancePack;
};
/**
 * Summary returned from loadPacksFromJwt().
 */
export interface PackLoadSummary {
    results: PackLoadResult[];
    /** Packs that were loaded (status === 'loaded' | 'cached'). */
    loaded: CompliancePack[];
}
/**
 * Interface the MonthlyVerifyScheduler exposes for the pack loader to
 * pre-check licensed packs before hitting the network.
 */
export interface MonthlyVerifyCache {
    /**
     * Return the cached list of licensed pack IDs, or null when the cache
     * is cold (verify-monthly not yet called this month).
     */
    getLicensedPacks(): string[] | null;
}
/**
 * Dependency injection interface — allows tests to stub the HTTP layer and
 * the audit-chain emitter without touching module-level singletons.
 */
export interface PackLoaderDeps {
    /**
     * Fetch pack content from the license server.
     *
     * Production implementation: fetch(url, { headers: { Authorization: ... } })
     * Tests: inject a stub that returns canned responses.
     *
     * @returns Resolved response (status + JSON body).
     */
    fetchPack: (packId: string, code: string, licenseServerUrl: string) => Promise<{
        status: number;
        body: unknown;
    }>;
    /**
     * Emit an UNLICENSED_PACK_REFUSED audit entry to the governance server
     * (best-effort, must never throw or reject — swallow errors internally).
     */
    emitUnlicensedPackRefused: (opts: {
        packId: string;
        agentId: string;
        orgId: string;
        code: string;
    }) => Promise<void>;
}
interface CacheEntry {
    pack: CompliancePack;
    /** Expiry time as epoch ms. */
    expiresAt: number;
}
/** 1-hour TTL — lets pack updates propagate within the hour. */
export declare const PACK_CACHE_TTL_MS: number;
/**
 * Per-process pack content cache keyed by `{packId}:{code}`.
 * Exported for test inspection/resetting.
 */
export declare const _packCache: Map<string, CacheEntry>;
/**
 * Reset the pack cache. Call between tests to avoid cross-test pollution.
 */
export declare function __resetPackCacheForTest(): void;
/**
 * Production fetchPack implementation using globalThis.fetch (Node 18+ built-in).
 * Timeout: 10 seconds. Never throws — returns a structured error result instead.
 */
export declare function defaultFetchPack(packId: string, code: string, licenseServerUrl: string): Promise<{
    status: number;
    body: unknown;
}>;
/**
 * Production emitUnlicensedPackRefused implementation.
 * Pushes to the gov-server audit chain with a 500ms timeout.
 * Errors are swallowed (best-effort per Invariant 2).
 */
export declare function makeDefaultEmitUnlicensedPackRefused(opts: {
    govServerUrl: string;
    internalAuditToken: string;
}): PackLoaderDeps['emitUnlicensedPackRefused'];
export interface PackLoaderOptions {
    /** URL of the license server (e.g. https://license.my-cc.io). */
    licenseServerUrl: string;
    /**
     * Org ID of the tenant — used for unlicensed-pack audit entries.
     * Extracted from the installed service token's `org` claim.
     */
    orgId: string;
    /**
     * Monthly verify cache — consulted BEFORE making any network call.
     * If null, all packs with a valid code are attempted (cold-start path
     * before verify-monthly has run for the first time).
     */
    monthlyVerifyCache: MonthlyVerifyCache | null;
    /** Injected dependencies. Defaults to production implementations. */
    deps?: Partial<PackLoaderDeps>;
}
/**
 * LicensePackLoader — loads compliance packs at runtime boot using the
 * install JWT pack_codes claim.
 *
 * Usage (called once at CLI init after the install JWT is decoded):
 *
 * ```ts
 * const loader = new LicensePackLoader({
 *   licenseServerUrl: 'https://license.my-cc.io',
 *   orgId: 'acme-corp',
 *   monthlyVerifyCache: scheduler,
 * });
 * const { loaded } = await loader.loadPacksFromJwt(packCodes);
 * // loaded: CompliancePack[] — wire into governance runtime
 * ```
 */
export declare class LicensePackLoader {
    private readonly licenseServerUrl;
    private readonly orgId;
    private readonly monthlyVerifyCache;
    private readonly deps;
    constructor(options: PackLoaderOptions);
    /**
     * Parse, validate, and load each pack from the install JWT pack_codes array.
     *
     * Flow per code entry:
     *   1. Check monthly-verify cache — skip if packId not in licensedPacks.
     *   2. Check in-process TTL cache — return cached pack if fresh.
     *   3. Fetch from license server (PR-D endpoint).
     *   4. On 200: cache + return loaded pack.
     *   5. On 403: log UNLICENSED_PACK_REFUSED (best-effort audit) + skip.
     *   6. On any other error: log + skip (Invariant 2: fails-soft).
     *
     * @param packCodes - Array decoded from the install JWT `pack_codes` claim.
     * @returns PackLoadSummary with results per entry + array of loaded packs.
     */
    loadPacksFromJwt(packCodes: InstallPackCodeEntry[]): Promise<PackLoadSummary>;
    /**
     * Load a single pack entry. Never throws.
     */
    private _loadSingle;
}
export {};
//# sourceMappingURL=license-pack-loader.d.ts.map