/**
 * Install Context — factory that wires LicensePackLoader + MonthlyVerifyScheduler
 * into a single consumer object the GovernanceRuntime can hold.
 *
 * This is the real customer-code-path consumer of the two previously-orphaned
 * modules (F-NEW-META-1 pattern — shipped in PR #1215 but never imported by
 * any production caller).
 *
 * Step 0 probe: grep -rn "LicensePackLoader\|MonthlyVerifyScheduler" src/ returned
 *   only source + index.ts + test — zero production consumers before this PR.
 * Step 0 evidence: F-NEW-META-1 pattern flagged by orchestrator audit at
 *   session-end 2026-05-21 — modules shipped but unwired.
 * Step 0 customer-path: customer instantiates GovernanceRuntime({...config, installJwt})
 *   → loader fetches packs + scheduler verifies monthly → onToolObserved triggers
 *   verify on first event of month.
 *
 * Design constraints (Architectural Invariant 2):
 *   - NEVER throw on install JWT parse failure — log + return undefined.
 *   - NEVER block runtime construction on loader/verify failures.
 *   - NEVER depend on @connexum/license-server package at runtime (wrong layer).
 *     pack_codes claim parsing is inlined narrowly here.
 *
 * @connexum/ai-governance  Task #32 wiring — install-context factory
 */
import { LicensePackLoader } from './license-pack-loader.js';
import { MonthlyVerifyScheduler } from './monthly-verify-scheduler.js';
import type { InstallPackCodeEntry } from './license-pack-loader.js';
/**
 * Minimally parse the base64url payload from a JWT string.
 * Returns the decoded JSON object, or null on any parse error.
 * Never throws.
 *
 * @internal
 */
export declare function parseJwtPayload(token: string): Record<string, unknown> | null;
/**
 * Extract and validate the `pack_codes` claim from a decoded JWT payload.
 *
 * Expected shape (PR-W-3+4 format from license-server):
 *   pack_codes: Array<{ packId: string; code: string; agentId: string }>
 *
 * Returns validated array or null when missing / malformed.
 * Never throws.
 *
 * @internal
 */
export declare function extractPackCodes(payload: Record<string, unknown>): InstallPackCodeEntry[] | null;
/**
 * Options for initInstallContext().
 */
export interface InstallContextOptions {
    /**
     * The install JWT issued by license.my-cc.io.
     * Must carry a `pack_codes` claim (array of InstallPackCodeEntry).
     * Also carries `org` claim (used as orgId for the pack loader).
     */
    installJwt: string;
    /**
     * Agent service JWT (gov-server-issued, ORG_OPERATOR role).
     * Used by MonthlyVerifyScheduler as the Bearer token for verify-monthly calls.
     * Typically the same JWT customers pass to GovernanceRuntime.
     */
    agentJwt: string;
    /**
     * Base URL of the license server.
     * Defaults to https://license.my-cc.io.
     */
    licenseServerBaseUrl?: string;
}
/**
 * The wired context returned when an install JWT is present and valid.
 */
export interface InstallContext {
    /** The pack loader configured with the scheduler as its monthly-verify cache. */
    loader: LicensePackLoader;
    /** The monthly verify scheduler. Wire to onToolObserved in the hook chain. */
    scheduler: MonthlyVerifyScheduler;
    /**
     * The pack codes extracted from the install JWT.
     * Pass to loader.loadPacksFromJwt() at boot to preload packs.
     */
    packCodes: InstallPackCodeEntry[];
    /** The org ID extracted from the install JWT `org` claim. */
    orgId: string;
}
/**
 * Parse the install JWT and wire LicensePackLoader + MonthlyVerifyScheduler.
 *
 * Returns the wired {@link InstallContext} when the JWT is valid, or `undefined`
 * when the JWT is missing, malformed, or lacks a valid `pack_codes` claim.
 *
 * Per Invariant 2 (advisory, never authoritative): this function never throws.
 * Errors are logged to stderr and the runtime continues without install context.
 *
 * @example
 * ```ts
 * const ctx = initInstallContext({
 *   installJwt: process.env.MY_CC_INSTALL_JWT!,
 *   agentJwt:   process.env.MY_CC_AGENT_JWT!,
 * });
 * if (ctx) {
 *   void ctx.loader.loadPacksFromJwt(ctx.packCodes); // fire-and-forget
 * }
 * ```
 */
export declare function initInstallContext(opts: InstallContextOptions): InstallContext | undefined;
//# sourceMappingURL=install-context.d.ts.map