/**
 * LicenseManager — pure validation logic for OpenLife Business license keys.
 *
 * Open-core boundary: this file ships in the PUBLIC repo and only ever
 * *verifies* licenses. It holds the Ed25519 PUBLIC key (safe to expose). The
 * matching PRIVATE key — the one that can *issue/sign* tokens — lives only in
 * the private `openlife-enterprise` license server and is never committed here.
 * Because forging a token requires the private key, publishing this code does
 * not enable piracy.
 *
 * Two artifacts (the short key the user types is NOT the signed token):
 *   1. Key ID      — `TIER-XXXX-XXXX-XXXX-XXXX`, human-friendly, pasted by the
 *                    user. Prefix selects the tier (PRO / TEAM / ENT).
 *   2. Signed token — `{ payload, signature }`, fetched once from the license
 *                    server during `activate`, then cached and re-verified
 *                    OFFLINE on every `status`. The `expiresAt` field is what
 *                    keeps the key "em dia": it must be refreshed online while
 *                    the subscription is active, and revoking the subscription
 *                    stops the refresh so the cached token eventually expires.
 *
 * No I/O here — persistence lives in LicenseStore, CLI wiring in LicenseCommand.
 */
export type Tier = 'community' | 'pro' | 'team' | 'enterprise';
export interface LicensePayload {
    keyId: string;
    tier: Tier;
    customerId: string;
    /** Explicit feature grants. When present, override the tier default map. */
    features?: string[];
    issuedAt: string;
    expiresAt: string;
}
export interface SignedLicense {
    payload: LicensePayload;
    /** base64 Ed25519 signature over the canonical JSON of `payload`. */
    signature: string;
}
export interface VerifyResult {
    valid: boolean;
    reason?: string;
}
export interface ParsedKeyId {
    tier: Exclude<Tier, 'community'>;
    raw: string;
}
/**
 * Tier → feature entitlements.
 *
 * ⚠️ PRODUCT DECISION (yours, Rafael): this map is the contract for what each
 * paid tier unlocks. The values here are feature *names* the private repo's
 * paid code checks via `Entitlements.requireFeature(...)`. Nothing in the
 * open-source core is gated by this — Community ([]) stays fully functional.
 *
 * Higher tiers are cumulative (team includes pro, enterprise includes team).
 * Edit freely as the product takes shape.
 */
export declare const TIER_FEATURES: Record<Tier, string[]>;
export declare class LicenseManager {
    private readonly publicKey;
    constructor(publicKeyPem?: string);
    /** Validate a pasted key-id and extract its tier. Returns null if malformed. */
    parseKeyId(keyId: string): ParsedKeyId | null;
    /**
     * Deterministic JSON serialization for signing/verifying. Keys are sorted so
     * the signer (private repo) and verifier (here) hash identical bytes.
     */
    static canonicalize(payload: LicensePayload): string;
    /** Verify the Ed25519 signature over the token payload. */
    verifyToken(token: SignedLicense): VerifyResult;
    /** True when the token has not yet expired (the "em dia" check). */
    isCurrent(token: SignedLicense, now?: Date): boolean;
    /** Resolve the feature set for a token: explicit grants win, else tier map. */
    entitlements(token: SignedLicense): string[];
}
