export type EntitlementFetch = (url: string, init: {
    method: string;
    headers: Record<string, string>;
    body: string;
}) => Promise<{
    status: number;
    ok: boolean;
}>;
export interface EntitlementDeps {
    /** Defaults to process.env.HOOKWARDEN_TOKEN. */
    token?: string | undefined;
    /** Defaults to process.env.HOOKWARDEN_API_URL || https://hookwarden.dev. */
    apiBase?: string | undefined;
    /** Defaults to a thin wrapper over global fetch. */
    fetch?: EntitlementFetch;
}
export type DenyReason = "missing_token" | "denied" | "unreachable";
export type EntitlementResult = {
    allowed: true;
} | {
    allowed: false;
    reason: DenyReason;
};
/**
 * Resolve whether `--verify-secrets` is entitled. Token-only; fail-closed on
 * every error path. NEVER transmits a secret.
 */
export declare function checkVerifyEntitlement(deps?: EntitlementDeps): Promise<EntitlementResult>;
/**
 * User-facing copy for a denied / mis-configured `--verify-secrets`. Names the
 * env var + the dashboard mint flow + the paid-tier nature (user-readable per
 * MEMORY feedback_cli_output_user_readable). Returned as a string so the caller
 * writes it to the right stream.
 */
export declare function upsellMessage(reason: DenyReason): string;
//# sourceMappingURL=entitlement.d.ts.map