/**
 * Offline Ed25519 license keys — entitlement without a user database or a
 * callback. The vendor signs a tiny claims payload with a private key; the CLI
 * (or a Pro feature path) verifies it against a PINNED public key. No server,
 * no license API, no phone-home: the Merchant of Record (Polar / Lemon Squeezy)
 * holds the customer record and delivers the signed string as the "license
 * key"; this module is the verifier.
 *
 * Token format (compact, copy-pasteable):
 *   nvlic1.<base64url(canonical-json payload)>.<base64url(ed25519 sig)>
 * The signature is over the payload SEGMENT bytes (the base64url string), so
 * verification never re-serializes — it checks the exact bytes that were signed.
 *
 * On-brand: a verification company gating its own Pro tier by a verifiable,
 * offline-checkable signature rather than a trust-the-server license call.
 */
import { type KeyObject } from "node:crypto";
export declare const LICENSE_PREFIX: "nvlic1";
/** The claims a license asserts. Keep it small — it's pasted by hand. */
export interface LicenseClaims {
    /** Who the license is for (email / customer id from the MoR). */
    sub: string;
    /** Entitlement tier. */
    tier: "pro" | "team" | "enterprise";
    /** Unlocked features (free-form; checked by the Pro path). */
    features: string[];
    /** Issued-at (ISO date). Informational. */
    iat: string;
    /** Optional expiry (ISO date). Absent = perpetual. */
    exp?: string;
}
export interface LicenseReport {
    valid: boolean;
    /** The verified claims, when valid. */
    license: LicenseClaims | null;
    /** First failing reason, or null when valid. */
    reason: string | null;
}
/** Generate an Ed25519 vendor keypair. Keep the private key secret; ship the public. */
export declare function generateLicenseKeypair(): {
    publicKey: KeyObject;
    privateKey: KeyObject;
};
/** Export a public key to the base64url raw form the verifier pins. */
export declare function exportLicensePublicKey(publicKey: KeyObject): string;
/** Sign a license token with the vendor private key. */
export declare function signLicense(claims: LicenseClaims, privateKey: KeyObject): string;
/** Load an Ed25519 private key from PEM (PKCS#8). */
export declare function licensePrivateKeyFromPem(pem: string): KeyObject;
/**
 * Verify a license token offline against the pinned vendor public key
 * (base64url raw Ed25519). Checks format + signature + expiry. Never throws.
 *
 * @param now optional ISO timestamp for expiry checks (defaults to absent =
 *   skip expiry; pass an explicit time to enforce it deterministically).
 */
export declare function verifyLicense(token: string, vendorPublicKeyB64url: string, now?: string): LicenseReport;
/** Convenience: does a verified license grant a given feature (or tier-implied)? */
export declare function licenseGrants(report: LicenseReport, feature: string): boolean;