/**
 * Session-token tier self-check client (SMI-6098, umbrella SMI-6085).
 *
 * SMI-1953 fixed the MCP server's live tier resolution for a personal
 * `SKILLSMITH_API_KEY`, but a user authenticated only via the standard
 * `skillsmith login` device-session (no separately-configured API key) was
 * never covered — the MCP license middleware always fell back to `community`
 * regardless of real entitlement. This client authenticates with the stored
 * device-login session (proactively refreshing via `resolveAccessToken`) and
 * calls the `license-status` edge function with the session token, mirroring
 * `inventory-client.ts` / `audit-notify-client.ts`.
 *
 * @module @skillsmith/core/sync/license-status-client
 */
/**
 * No usable device session — none stored, or a refresh attempt failed. This
 * is a real, definitive "not authenticated this way" (same class as a
 * missing/bad API key): callers should fall back to community, cached at
 * the middleware's normal definitive TTL.
 */
export declare class SessionTierAuthError extends Error {
    constructor(message?: string);
}
/**
 * A transport or server failure that is NOT a definitive tier signal —
 * network error, timeout, an HTTP 5xx/429 from `license-status`, or an
 * unparseable/unexpected response shape. Callers MUST treat this as
 * transient (retry soon / serve a stale cached value), never collapse it
 * into "community" — a real paying customer must not be downgraded for the
 * full cache TTL just because the tier check itself glitched.
 */
export declare class SessionTierTransientError extends Error {
    constructor(message: string);
}
/** Mirrors `license-status`'s `data` response shape. */
export interface SessionTierResult {
    authenticated: boolean;
    /** Raw tier string from the server; validate against the known enum at the call site. */
    tier?: string;
    rateLimit?: number;
    userId?: string;
}
/**
 * Resolve the caller's real subscription tier via the device-login session.
 *
 * `authenticated: false` in the returned result is itself a DEFINITIVE
 * signal (the server verified the JWT and found no session), distinct from
 * the thrown errors below, which mean the check couldn't be completed at
 * all.
 *
 * @throws {SessionTierAuthError} No stored session, or the proactive refresh failed.
 * @throws {SessionTierTransientError} Network error, HTTP 429/5xx, or an
 *   unparseable/unexpected response — not a definitive tier signal.
 */
export declare function resolveSessionTier(): Promise<SessionTierResult>;
//# sourceMappingURL=license-status-client.d.ts.map