export interface StoredDemoLicense {
    /** The demo license JWT (Bearer credential for /api/v1/demo/*). */
    jwt: string;
    /** Unix epoch seconds when the JWT expires (from its `exp` claim). */
    expiresAtEpochSec?: number;
    /** License id from the JWT payload (when present). */
    licenseId?: string;
    /** ISO-8601 when this license was minted/stored. */
    mintedAt?: string;
}
/**
 * `true` if the license is at/past expiry (within a small skew). A license
 * with no known expiry is treated as usable — the gateway is the final
 * arbiter and will 401 a truly-dead token.
 */
export declare function isDemoLicenseExpired(lic: {
    expiresAtEpochSec?: number;
}, nowSec?: number): boolean;
/**
 * Read the persisted demo license. Returns `null` when the file is missing
 * (the common case) or holds no usable JWT. Throws only on a genuinely
 * malformed/unreadable file so a broken machine fails loudly.
 */
export declare function readDemoLicense(): Promise<StoredDemoLicense | null>;
/** Persist a demo license with restrictive permissions. Returns the path written. */
export declare function writeDemoLicense(lic: {
    jwt: string;
    expiresAtEpochSec?: number;
    licenseId?: string;
}): Promise<string>;
/** Delete the persisted demo license. Returns `true` if a file was removed. */
export declare function clearDemoLicense(): Promise<boolean>;
/** Exposed for diagnostics / status messages. */
export declare function getDemoLicensePath(): string;