@licensr/sdk 0.1.0

package/dist/index.d.cts

@@ -0,0 +1,309 @@
+/**
+ * Request/response shapes for the Licensr public license API.
+ *
+ * Mirrors ``contract/openapi.json`` (generated from the FastAPI backend —
+ * see ``backend/services/models/license.py``). Keep in sync manually:
+ * there is no codegen step, so any field added to the backend's response
+ * models should be mirrored here.
+ */
+type ActivationType = 'seat' | 'domain';
+type LicenseStatus = 'active' | 'inactive' | 'expired';
+type Entitlement = 'full' | 'limited' | 'none';
+interface ValidateRequest {
+    licenseKey: string;
+}
+interface ValidateResponse {
+    valid: boolean;
+    status: LicenseStatus;
+    planId: string | null;
+    planName: string | null;
+    activationMode: ActivationType | null;
+    maxSeats: number | null;
+    maxDomains: number | null;
+    seatsInUse: number | null;
+    expiresAt: string | null;
+    /** `full` when valid, `none` when cut off, `limited` alongside `fallback: true`. */
+    entitlement: Entitlement;
+    /** `true` only when an *expired* license is on a perpetual-fallback plan. */
+    fallback: boolean;
+    featureFlags: Record<string, unknown> | null;
+}
+interface ActivateRequest {
+    licenseKey: string;
+    activationType: ActivationType;
+    /** Stable per-install identifier: HWID for `seat`, hostname for `domain`. */
+    identifier: string;
+    /** Cosmetic, shown in admin/customer portals (e.g. "My MacBook Pro"). */
+    label?: string | null;
+}
+interface ActivateResponse {
+    activationId: string;
+    activationType: ActivationType;
+    identifier: string;
+    featureFlags: Record<string, unknown> | null;
+}
+interface DeactivateRequest {
+    licenseKey: string;
+    activationId: string;
+}
+interface DeactivateResponse {
+    deactivated: boolean;
+}
+interface ActivationListItem {
+    activationId: string;
+    activationType: ActivationType;
+    identifier: string;
+    label: string | null;
+    firstSeenAt: string;
+    lastSeenAt: string;
+}
+interface ActivationsRequest {
+    licenseKey: string;
+}
+interface ActivationsResponse {
+    licenseId: string;
+    activations: ActivationListItem[];
+}
+interface TokenResponse {
+    /** EdDSA-signed JWT — verify with {@link verifyOfflineToken} or `jose` directly. */
+    token: string;
+    algorithm: string;
+    kid: string;
+    issuedAt: string;
+    expiresAt: string;
+    jwksUrl: string;
+}
+/** Claims embedded in the offline token (`token`); mirrors {@link ValidateResponse}. */
+interface OfflineTokenClaims {
+    sub: string;
+    iss: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    plugin_slug: string;
+    plan_id: string | null;
+    status: LicenseStatus;
+    valid: boolean;
+    entitlement: Entitlement;
+    fallback: boolean;
+    activation_mode: ActivationType | null;
+    max_seats: number | null;
+    max_domains: number | null;
+    license_expires_at: number | null;
+    feature_flags: Record<string, unknown> | null;
+}
+interface CheckoutRequest {
+    planId: string;
+    customerEmail: string;
+    successUrl?: string | null;
+    cancelUrl?: string | null;
+}
+interface CheckoutResponse {
+    checkoutUrl: string;
+}
+/** Every documented `detail.error` code from the license API — see contract/conformance.yaml. */
+type LicensrErrorCode = 'missing_plugin_api_key' | 'invalid_plugin_api_key' | 'origin_not_allowed' | 'origin_not_activated' | 'plugin_mismatch' | 'license_inactive' | 'license_not_valid' | 'license_not_found' | 'activation_not_found' | 'activation_mode_mismatch' | 'activation_cap_exceeded' | 'jwks_path_deprecated' | 'rate_limit_exceeded' | 'insufficient_scope' | (string & {});
+interface ErrorBody {
+    error: LicensrErrorCode;
+    message?: string | null;
+}
+
+/** Lifecycle events emitted by {@link import('./client.js').LicensrClient}. */
+interface LicensrEventMap {
+    validated: ValidateResponse;
+    activated: ActivateResponse;
+    deactivated: DeactivateResponse;
+    tokenIssued: TokenResponse;
+    /** Fired on every retried request, before the retry delay. */
+    retry: {
+        method: string;
+        attempt: number;
+        delayMs: number;
+    };
+    /** Fired whenever a client method throws, right before the error propagates. */
+    error: {
+        method: string;
+        error: unknown;
+    };
+}
+type Listener<T> = (payload: T) => void;
+/**
+ * Minimal, dependency-free typed event emitter for {@link LicensrEventMap}
+ * — no Node `EventEmitter` import so the SDK stays usable unmodified in
+ * browsers.
+ */
+declare class LicensrEventEmitter {
+    private readonly listeners;
+    /** Returns an unsubscribe function. */
+    on<K extends keyof LicensrEventMap>(event: K, listener: Listener<LicensrEventMap[K]>): () => void;
+    off<K extends keyof LicensrEventMap>(event: K, listener: Listener<LicensrEventMap[K]>): void;
+    emit<K extends keyof LicensrEventMap>(event: K, payload: LicensrEventMap[K]): void;
+}
+
+/** SDKs already compute a stable per-machine HWID for activation — send it
+ * here for free so the server buckets rate limits per *installation*
+ * rather than per API key (see backend/services/rate_limit_key.py). */
+declare const DEVICE_ID_HEADER = "X-Licensr-Device-Id";
+interface RetryOptions {
+    /** Extra attempts after the first, on network errors / 429 / 5xx. Default 2. */
+    maxRetries?: number;
+    /** Base delay for exponential backoff with full jitter. Default 300ms. */
+    baseDelayMs?: number;
+    /** Ceiling for the backoff delay. Default 5000ms. */
+    maxDelayMs?: number;
+}
+interface HttpClientConfig {
+    baseUrl: string;
+    apiKey: string;
+    /**
+     * Explicitly set the `Origin` header. Real browsers control this header
+     * themselves — the fetch spec forbids scripts from overriding it, and
+     * that's fine, since the browser already sends the caller's true origin.
+     * This option exists for non-browser runtimes (Node, Electron main
+     * process) that want the domain-origin guard (see docs/sdks) to see a
+     * specific origin. Native/desktop plugins should instead set the
+     * plugin's client type to "native" in the admin UI and leave this unset.
+     */
+    origin?: string;
+    /** Stable per-install identifier — see {@link DEVICE_ID_HEADER}. */
+    deviceId?: string;
+    /** Defaults to `globalThis.fetch`. Override for testing or non-standard runtimes. */
+    fetchImpl?: typeof fetch;
+    /** Per-request timeout. Unset by default (no timeout). */
+    timeoutMs?: number;
+    retry?: RetryOptions;
+}
+
+interface LicensrClientConfig {
+    /** Plugin API key (`pk_live_...` / `pk_test_...`) — see docs/plugin-integration.md. */
+    apiKey: string;
+    /** The plugin this key belongs to (matches the slug in the admin dashboard). */
+    pluginSlug: string;
+    /** Defaults to `https://api.licensr.app`. Override for self-hosted/staging. */
+    baseUrl?: string;
+    /** See {@link HttpClientConfig.origin}. */
+    origin?: string;
+    /** Stable per-install identifier, e.g. the same HWID used for `activate()`. Buckets rate limits per installation instead of per key. */
+    deviceId?: string;
+    /** Defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    retry?: RetryOptions;
+}
+/**
+ * Thin client for the Licensr public license API
+ * (`/v1/license/*`, `/v1/billing/checkout`).
+ *
+ * ```ts
+ * const client = new LicensrClient({apiKey: 'pk_live_...', pluginSlug: 'my-plugin'});
+ * const result = await client.validate({licenseKey});
+ * if (result.valid) { ... }
+ * ```
+ *
+ * Subscribe to lifecycle events via `client.events`:
+ *
+ * ```ts
+ * client.events.on('error', ({method, error}) => log(method, error));
+ * ```
+ */
+declare class LicensrClient {
+    readonly events: LicensrEventEmitter;
+    private readonly http;
+    private readonly pluginSlug;
+    constructor(config: LicensrClientConfig);
+    /** Check whether a license is valid for this plugin, without minting an offline token. */
+    validate(req: ValidateRequest): Promise<ValidateResponse>;
+    /**
+     * Run the same check as {@link validate}, and on success mint a
+     * short-lived EdDSA-signed offline token. Verify it with
+     * {@link import('./offline.js').verifyOfflineToken} — no network call
+     * needed after the first successful fetch of the plugin's JWKS.
+     */
+    token(req: ValidateRequest): Promise<TokenResponse>;
+    /** Activate a seat (per-machine HWID) or domain for a license. */
+    activate(req: ActivateRequest): Promise<ActivateResponse>;
+    /** Release a previously created activation, freeing its seat/domain slot. */
+    deactivate(req: DeactivateRequest): Promise<DeactivateResponse>;
+    /** List every current activation for a license (seats/domains in use). */
+    activations(req: {
+        licenseKey: string;
+    }): Promise<ActivationsResponse>;
+    /** Start a hosted checkout session for a plan; redirect the user to the returned URL. */
+    checkout(req: CheckoutRequest): Promise<CheckoutResponse>;
+    private onRetry;
+    private run;
+    private emitResult;
+}
+
+/**
+ * The API responded with a non-2xx status and a parsed `detail.error` body.
+ *
+ * `code` is one of the documented error codes in `contract/conformance.yaml`
+ * (e.g. `license_inactive`, `origin_not_allowed`, `rate_limit_exceeded`).
+ * Branch on `code`, not on `message` — the message is for humans and may
+ * change without notice.
+ */
+declare class LicensrApiError extends Error {
+    readonly status: number;
+    readonly code: LicensrErrorCode;
+    /** Present on 429 responses when the server sends `Retry-After`. */
+    readonly retryAfterSeconds: number | null;
+    constructor(status: number, code: LicensrErrorCode, message: string, retryAfterSeconds?: number | null);
+}
+/** The request never got a response — network failure, timeout, or abort. */
+declare class LicensrNetworkError extends Error {
+    readonly cause: unknown;
+    constructor(message: string, cause: unknown);
+}
+/** An offline token failed EdDSA verification, was malformed, or has expired. */
+declare class LicensrTokenVerificationError extends Error {
+    constructor(message: string);
+}
+
+interface VerifyOfflineTokenOptions {
+    /** Override the fetch used for the JWKS lookup — mainly for testing. */
+    fetchImpl?: typeof fetch;
+    /** Reject if the token's `iat`/`nbf` are further in the future than this many seconds (clock skew tolerance). Default 60. */
+    clockToleranceSeconds?: number;
+}
+/** Drop cached JWKS lookups — call after rotating a plugin's signing key in tests, or to force a fresh fetch. */
+declare function clearJwksCache(): void;
+/**
+ * Verify an offline license token (from {@link import('./client.js').LicensrClient.token})
+ * fully offline: no network call beyond fetching (and caching) the plugin's
+ * public JWKS. Throws {@link LicensrTokenVerificationError} on a bad
+ * signature, wrong algorithm, or an expired/not-yet-valid token.
+ *
+ * Tokens carry no revocation signal — this only proves the token was
+ * genuinely issued by Licensr and hasn't expired, not that the license is
+ * still active right now. Re-validate online (`validate()`/`token()`)
+ * before the token's `expiresAt`.
+ */
+declare function verifyOfflineToken(token: string, jwksUrl: string, options?: VerifyOfflineTokenOptions): Promise<OfflineTokenClaims>;
+interface CachedOfflineToken {
+    token: string;
+    claims: OfflineTokenClaims;
+    /** `Date.now()` at the time this entry was cached. */
+    cachedAtMs: number;
+}
+/**
+ * Pluggable persistence for the last-known-good offline token per license,
+ * so an app can boot fully offline (no network at all) before its first
+ * successful `/token` call in a given session. The default
+ * {@link InMemoryOfflineTokenStore} does not persist across process
+ * restarts — provide your own (backed by `localStorage`, a config file,
+ * OS keychain, etc.) for that.
+ */
+interface OfflineTokenStore {
+    get(licenseKey: string): CachedOfflineToken | null | Promise<CachedOfflineToken | null>;
+    set(licenseKey: string, entry: CachedOfflineToken): void | Promise<void>;
+    clear(licenseKey: string): void | Promise<void>;
+}
+declare class InMemoryOfflineTokenStore implements OfflineTokenStore {
+    private readonly entries;
+    get(licenseKey: string): CachedOfflineToken | null;
+    set(licenseKey: string, entry: CachedOfflineToken): void;
+    clear(licenseKey: string): void;
+}
+
+export { type ActivateRequest, type ActivateResponse, type ActivationListItem, type ActivationType, type ActivationsRequest, type ActivationsResponse, type CachedOfflineToken, type CheckoutRequest, type CheckoutResponse, DEVICE_ID_HEADER, type DeactivateRequest, type DeactivateResponse, type Entitlement, type ErrorBody, type HttpClientConfig, InMemoryOfflineTokenStore, type LicenseStatus, LicensrApiError, LicensrClient, type LicensrClientConfig, type LicensrErrorCode, LicensrEventEmitter, type LicensrEventMap, LicensrNetworkError, LicensrTokenVerificationError, type OfflineTokenClaims, type OfflineTokenStore, type RetryOptions, type TokenResponse, type ValidateRequest, type ValidateResponse, type VerifyOfflineTokenOptions, clearJwksCache, verifyOfflineToken };

package/dist/index.d.ts

@@ -0,0 +1,309 @@
+/**
+ * Request/response shapes for the Licensr public license API.
+ *
+ * Mirrors ``contract/openapi.json`` (generated from the FastAPI backend —
+ * see ``backend/services/models/license.py``). Keep in sync manually:
+ * there is no codegen step, so any field added to the backend's response
+ * models should be mirrored here.
+ */
+type ActivationType = 'seat' | 'domain';
+type LicenseStatus = 'active' | 'inactive' | 'expired';
+type Entitlement = 'full' | 'limited' | 'none';
+interface ValidateRequest {
+    licenseKey: string;
+}
+interface ValidateResponse {
+    valid: boolean;
+    status: LicenseStatus;
+    planId: string | null;
+    planName: string | null;
+    activationMode: ActivationType | null;
+    maxSeats: number | null;
+    maxDomains: number | null;
+    seatsInUse: number | null;
+    expiresAt: string | null;
+    /** `full` when valid, `none` when cut off, `limited` alongside `fallback: true`. */
+    entitlement: Entitlement;
+    /** `true` only when an *expired* license is on a perpetual-fallback plan. */
+    fallback: boolean;
+    featureFlags: Record<string, unknown> | null;
+}
+interface ActivateRequest {
+    licenseKey: string;
+    activationType: ActivationType;
+    /** Stable per-install identifier: HWID for `seat`, hostname for `domain`. */
+    identifier: string;
+    /** Cosmetic, shown in admin/customer portals (e.g. "My MacBook Pro"). */
+    label?: string | null;
+}
+interface ActivateResponse {
+    activationId: string;
+    activationType: ActivationType;
+    identifier: string;
+    featureFlags: Record<string, unknown> | null;
+}
+interface DeactivateRequest {
+    licenseKey: string;
+    activationId: string;
+}
+interface DeactivateResponse {
+    deactivated: boolean;
+}
+interface ActivationListItem {
+    activationId: string;
+    activationType: ActivationType;
+    identifier: string;
+    label: string | null;
+    firstSeenAt: string;
+    lastSeenAt: string;
+}
+interface ActivationsRequest {
+    licenseKey: string;
+}
+interface ActivationsResponse {
+    licenseId: string;
+    activations: ActivationListItem[];
+}
+interface TokenResponse {
+    /** EdDSA-signed JWT — verify with {@link verifyOfflineToken} or `jose` directly. */
+    token: string;
+    algorithm: string;
+    kid: string;
+    issuedAt: string;
+    expiresAt: string;
+    jwksUrl: string;
+}
+/** Claims embedded in the offline token (`token`); mirrors {@link ValidateResponse}. */
+interface OfflineTokenClaims {
+    sub: string;
+    iss: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    plugin_slug: string;
+    plan_id: string | null;
+    status: LicenseStatus;
+    valid: boolean;
+    entitlement: Entitlement;
+    fallback: boolean;
+    activation_mode: ActivationType | null;
+    max_seats: number | null;
+    max_domains: number | null;
+    license_expires_at: number | null;
+    feature_flags: Record<string, unknown> | null;
+}
+interface CheckoutRequest {
+    planId: string;
+    customerEmail: string;
+    successUrl?: string | null;
+    cancelUrl?: string | null;
+}
+interface CheckoutResponse {
+    checkoutUrl: string;
+}
+/** Every documented `detail.error` code from the license API — see contract/conformance.yaml. */
+type LicensrErrorCode = 'missing_plugin_api_key' | 'invalid_plugin_api_key' | 'origin_not_allowed' | 'origin_not_activated' | 'plugin_mismatch' | 'license_inactive' | 'license_not_valid' | 'license_not_found' | 'activation_not_found' | 'activation_mode_mismatch' | 'activation_cap_exceeded' | 'jwks_path_deprecated' | 'rate_limit_exceeded' | 'insufficient_scope' | (string & {});
+interface ErrorBody {
+    error: LicensrErrorCode;
+    message?: string | null;
+}
+
+/** Lifecycle events emitted by {@link import('./client.js').LicensrClient}. */
+interface LicensrEventMap {
+    validated: ValidateResponse;
+    activated: ActivateResponse;
+    deactivated: DeactivateResponse;
+    tokenIssued: TokenResponse;
+    /** Fired on every retried request, before the retry delay. */
+    retry: {
+        method: string;
+        attempt: number;
+        delayMs: number;
+    };
+    /** Fired whenever a client method throws, right before the error propagates. */
+    error: {
+        method: string;
+        error: unknown;
+    };
+}
+type Listener<T> = (payload: T) => void;
+/**
+ * Minimal, dependency-free typed event emitter for {@link LicensrEventMap}
+ * — no Node `EventEmitter` import so the SDK stays usable unmodified in
+ * browsers.
+ */
+declare class LicensrEventEmitter {
+    private readonly listeners;
+    /** Returns an unsubscribe function. */
+    on<K extends keyof LicensrEventMap>(event: K, listener: Listener<LicensrEventMap[K]>): () => void;
+    off<K extends keyof LicensrEventMap>(event: K, listener: Listener<LicensrEventMap[K]>): void;
+    emit<K extends keyof LicensrEventMap>(event: K, payload: LicensrEventMap[K]): void;
+}
+
+/** SDKs already compute a stable per-machine HWID for activation — send it
+ * here for free so the server buckets rate limits per *installation*
+ * rather than per API key (see backend/services/rate_limit_key.py). */
+declare const DEVICE_ID_HEADER = "X-Licensr-Device-Id";
+interface RetryOptions {
+    /** Extra attempts after the first, on network errors / 429 / 5xx. Default 2. */
+    maxRetries?: number;
+    /** Base delay for exponential backoff with full jitter. Default 300ms. */
+    baseDelayMs?: number;
+    /** Ceiling for the backoff delay. Default 5000ms. */
+    maxDelayMs?: number;
+}
+interface HttpClientConfig {
+    baseUrl: string;
+    apiKey: string;
+    /**
+     * Explicitly set the `Origin` header. Real browsers control this header
+     * themselves — the fetch spec forbids scripts from overriding it, and
+     * that's fine, since the browser already sends the caller's true origin.
+     * This option exists for non-browser runtimes (Node, Electron main
+     * process) that want the domain-origin guard (see docs/sdks) to see a
+     * specific origin. Native/desktop plugins should instead set the
+     * plugin's client type to "native" in the admin UI and leave this unset.
+     */
+    origin?: string;
+    /** Stable per-install identifier — see {@link DEVICE_ID_HEADER}. */
+    deviceId?: string;
+    /** Defaults to `globalThis.fetch`. Override for testing or non-standard runtimes. */
+    fetchImpl?: typeof fetch;
+    /** Per-request timeout. Unset by default (no timeout). */
+    timeoutMs?: number;
+    retry?: RetryOptions;
+}
+
+interface LicensrClientConfig {
+    /** Plugin API key (`pk_live_...` / `pk_test_...`) — see docs/plugin-integration.md. */
+    apiKey: string;
+    /** The plugin this key belongs to (matches the slug in the admin dashboard). */
+    pluginSlug: string;
+    /** Defaults to `https://api.licensr.app`. Override for self-hosted/staging. */
+    baseUrl?: string;
+    /** See {@link HttpClientConfig.origin}. */
+    origin?: string;
+    /** Stable per-install identifier, e.g. the same HWID used for `activate()`. Buckets rate limits per installation instead of per key. */
+    deviceId?: string;
+    /** Defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    retry?: RetryOptions;
+}
+/**
+ * Thin client for the Licensr public license API
+ * (`/v1/license/*`, `/v1/billing/checkout`).
+ *
+ * ```ts
+ * const client = new LicensrClient({apiKey: 'pk_live_...', pluginSlug: 'my-plugin'});
+ * const result = await client.validate({licenseKey});
+ * if (result.valid) { ... }
+ * ```
+ *
+ * Subscribe to lifecycle events via `client.events`:
+ *
+ * ```ts
+ * client.events.on('error', ({method, error}) => log(method, error));
+ * ```
+ */
+declare class LicensrClient {
+    readonly events: LicensrEventEmitter;
+    private readonly http;
+    private readonly pluginSlug;
+    constructor(config: LicensrClientConfig);
+    /** Check whether a license is valid for this plugin, without minting an offline token. */
+    validate(req: ValidateRequest): Promise<ValidateResponse>;
+    /**
+     * Run the same check as {@link validate}, and on success mint a
+     * short-lived EdDSA-signed offline token. Verify it with
+     * {@link import('./offline.js').verifyOfflineToken} — no network call
+     * needed after the first successful fetch of the plugin's JWKS.
+     */
+    token(req: ValidateRequest): Promise<TokenResponse>;
+    /** Activate a seat (per-machine HWID) or domain for a license. */
+    activate(req: ActivateRequest): Promise<ActivateResponse>;
+    /** Release a previously created activation, freeing its seat/domain slot. */
+    deactivate(req: DeactivateRequest): Promise<DeactivateResponse>;
+    /** List every current activation for a license (seats/domains in use). */
+    activations(req: {
+        licenseKey: string;
+    }): Promise<ActivationsResponse>;
+    /** Start a hosted checkout session for a plan; redirect the user to the returned URL. */
+    checkout(req: CheckoutRequest): Promise<CheckoutResponse>;
+    private onRetry;
+    private run;
+    private emitResult;
+}
+
+/**
+ * The API responded with a non-2xx status and a parsed `detail.error` body.
+ *
+ * `code` is one of the documented error codes in `contract/conformance.yaml`
+ * (e.g. `license_inactive`, `origin_not_allowed`, `rate_limit_exceeded`).
+ * Branch on `code`, not on `message` — the message is for humans and may
+ * change without notice.
+ */
+declare class LicensrApiError extends Error {
+    readonly status: number;
+    readonly code: LicensrErrorCode;
+    /** Present on 429 responses when the server sends `Retry-After`. */
+    readonly retryAfterSeconds: number | null;
+    constructor(status: number, code: LicensrErrorCode, message: string, retryAfterSeconds?: number | null);
+}
+/** The request never got a response — network failure, timeout, or abort. */
+declare class LicensrNetworkError extends Error {
+    readonly cause: unknown;
+    constructor(message: string, cause: unknown);
+}
+/** An offline token failed EdDSA verification, was malformed, or has expired. */
+declare class LicensrTokenVerificationError extends Error {
+    constructor(message: string);
+}
+
+interface VerifyOfflineTokenOptions {
+    /** Override the fetch used for the JWKS lookup — mainly for testing. */
+    fetchImpl?: typeof fetch;
+    /** Reject if the token's `iat`/`nbf` are further in the future than this many seconds (clock skew tolerance). Default 60. */
+    clockToleranceSeconds?: number;
+}
+/** Drop cached JWKS lookups — call after rotating a plugin's signing key in tests, or to force a fresh fetch. */
+declare function clearJwksCache(): void;
+/**
+ * Verify an offline license token (from {@link import('./client.js').LicensrClient.token})
+ * fully offline: no network call beyond fetching (and caching) the plugin's
+ * public JWKS. Throws {@link LicensrTokenVerificationError} on a bad
+ * signature, wrong algorithm, or an expired/not-yet-valid token.
+ *
+ * Tokens carry no revocation signal — this only proves the token was
+ * genuinely issued by Licensr and hasn't expired, not that the license is
+ * still active right now. Re-validate online (`validate()`/`token()`)
+ * before the token's `expiresAt`.
+ */
+declare function verifyOfflineToken(token: string, jwksUrl: string, options?: VerifyOfflineTokenOptions): Promise<OfflineTokenClaims>;
+interface CachedOfflineToken {
+    token: string;
+    claims: OfflineTokenClaims;
+    /** `Date.now()` at the time this entry was cached. */
+    cachedAtMs: number;
+}
+/**
+ * Pluggable persistence for the last-known-good offline token per license,
+ * so an app can boot fully offline (no network at all) before its first
+ * successful `/token` call in a given session. The default
+ * {@link InMemoryOfflineTokenStore} does not persist across process
+ * restarts — provide your own (backed by `localStorage`, a config file,
+ * OS keychain, etc.) for that.
+ */
+interface OfflineTokenStore {
+    get(licenseKey: string): CachedOfflineToken | null | Promise<CachedOfflineToken | null>;
+    set(licenseKey: string, entry: CachedOfflineToken): void | Promise<void>;
+    clear(licenseKey: string): void | Promise<void>;
+}
+declare class InMemoryOfflineTokenStore implements OfflineTokenStore {
+    private readonly entries;
+    get(licenseKey: string): CachedOfflineToken | null;
+    set(licenseKey: string, entry: CachedOfflineToken): void;
+    clear(licenseKey: string): void;
+}
+
+export { type ActivateRequest, type ActivateResponse, type ActivationListItem, type ActivationType, type ActivationsRequest, type ActivationsResponse, type CachedOfflineToken, type CheckoutRequest, type CheckoutResponse, DEVICE_ID_HEADER, type DeactivateRequest, type DeactivateResponse, type Entitlement, type ErrorBody, type HttpClientConfig, InMemoryOfflineTokenStore, type LicenseStatus, LicensrApiError, LicensrClient, type LicensrClientConfig, type LicensrErrorCode, LicensrEventEmitter, type LicensrEventMap, LicensrNetworkError, LicensrTokenVerificationError, type OfflineTokenClaims, type OfflineTokenStore, type RetryOptions, type TokenResponse, type ValidateRequest, type ValidateResponse, type VerifyOfflineTokenOptions, clearJwksCache, verifyOfflineToken };