import { ActionResponse } from '../../content/content.type';
import { PeopleActionOpts } from '../shared.types';
import { InvokeDeps } from '../_invoke';
/** `resolve_desired` — idempotent by `eventId` (repeat ⇒ NO_OP audited). */
export interface PeopleResolveDesiredParams {
    employmentRef: string;
    providerRef: string;
    employment: {
        ref: string;
        leRef: string;
        confirmedAt: string;
        startDate: string;
    };
    eventId?: string;
}
export interface PeopleResolveDesiredOutput {
    itemsCreated: string[];
    packageSize: number;
}
/** `retry_item` — from `failed` only; exhausted ⇒ `retry_exhausted` +
 *  `manual_resolution`. */
export interface PeopleRetryItemOutput {
    attempt: {
        count: number;
        max: number;
        nextRetryAt?: string | null;
        retryAfterRespected?: boolean;
    };
}
/** `resolve_manually` — `evidence_required` without evidence. The honest path. */
export interface PeopleResolveManuallyParams {
    itemRef: string;
    outcome: {
        evidence: Record<string, unknown>;
    };
}
/** `release_item` — account resource with other employment still contributing
 *  ⇒ `contributors_not_empty`. */
export interface PeopleReleaseItemParams {
    itemRef: string;
}
/** `resolve_binding` — 4-outcome rehire resolution, identity only
 *  (entitlements flow through the new employment's Joiner pipeline, PM 9.5). */
export interface PeopleResolveBindingParams {
    canonicalPersonRef: string;
    providerRef: string;
}
export type PeopleResolveBindingOutcome = 'existing_active' | 'reactivate_identity' | 'new_binding' | 'no_account';
/** `mark_deleted_verified` — eligible ≠ deleted ⇒ `verification_required`. */
export interface PeopleMarkDeletedVerifiedParams {
    bindingRef: string;
    verified: true;
    providerOperationReference?: string;
}
/** `accept_exception` (drift) — critical severity requires the emergency gate. */
export interface PeopleAcceptExceptionParams {
    findingRef: string;
    exception: {
        owner: string;
        approvedBy: string;
        effectiveFrom: string;
        expiresAt: string;
    };
    emergency: boolean;
}
export interface PeopleAcceptExceptionOutput {
    success: boolean;
    expiresAt: string;
}
/** `escalate` carries an optional target. */
export interface PeopleEscalateParams {
    escalatedTo?: string;
}
/** `build_plan` / `amend_plan` — dates belong to FEAT-004, never invented here. */
export interface PeopleBuildPlanParams {
    employmentRef: string;
    endingPlanRef: string;
    endingFacts: {
        lwd: string;
        endEffectiveAt: string;
        timezone: string;
    };
    policyRef?: string;
    policyVersion?: string;
}
export interface PeopleBuildPlanOutput {
    plan: string;
    planVersion: number;
}
/** `register_provider` (PIP-004 Track C factory action) — capability
 *  declarations may only DOWNGRADE from connector truth; the server
 *  rejects declared-lie-above-truth. */
export interface PeopleRegisterProviderParams {
    providerKey: string;
    providerType: 'entra' | 'github' | 'google_workspace' | 'm365' | 'scim_generic' | 'slack';
    capabilities?: Record<string, {
        support: string;
    }>;
    bindingPolicy?: 'account_per_employment' | 'shared_per_person';
    retryPolicy?: {
        maxAttempts?: number;
        backoffBaseSeconds?: number;
        respectRetryAfter?: boolean;
    };
    connection: {
        tenantId?: string;
        clientId?: string;
        clientSecret?: string;
        endpointBase?: string;
        installationId?: string;
        appId?: string;
        [key: string]: unknown;
    };
    resourcePolicies?: Array<Record<string, unknown>>;
    syncEnabled?: boolean;
    orgMapping?: Record<string, unknown>;
}
export interface PeopleRegisterProviderOutput {
    provider: string;
}
/** `update_provider` — edit an existing provider (PIP-004). Blank
 *  `clientSecret` keeps the stored secret (write-only rotation UX);
 *  a changed connection resets probe_state so activation re-tests. */
export interface PeopleUpdateProviderParams {
    providerKey?: string;
    providerType?: PeopleRegisterProviderParams['providerType'];
    capabilities?: Record<string, {
        support: string;
    }>;
    bindingPolicy?: PeopleRegisterProviderParams['bindingPolicy'];
    retryPolicy?: PeopleRegisterProviderParams['retryPolicy'];
    connection?: PeopleRegisterProviderParams['connection'];
}
/** `import_directory` — manual per-provider directory import (Track D). */
export interface PeopleImportDirectoryOutput {
    changeset: string;
    directoryCount: number;
    matched: number;
    candidates: number;
}
/** `configure_sync` — set sync_enabled + org mapping (Track D). Enabling
 *  re-checks the directory-read capability gate server-side. */
export interface PeopleConfigureSyncParams {
    syncEnabled: boolean;
    orgMapping?: {
        departmentField?: string;
        jobTitleField?: string;
        teamField?: string;
        orgUnitStrategy?: 'per_department' | 'flat';
        legalEntityRef?: string;
    };
}
/** `apply_import_changeset` params (Track D): per-candidate operator
 *  decisions — 'seed' creates a NEW passwordless engine user from the
 *  directory row and binds it. Unticked candidates stay candidates
 *  for the next review (never auto-created). `writeMode` picks how
 *  the import lands in the org structure: 'add' creates alongside the
 *  current units/positions; 'replace' first ends every active
 *  unit/position in the mapped legal entity, then rebuilds. */
export interface PeopleApplyChangesetParams {
    writeMode?: 'add' | 'replace';
    candidateDecisions?: Array<{
        externalAccountId: string;
        decision: 'seed';
    }>;
}
/** `apply_import_changeset` output (Track D). */
export interface PeopleApplyChangesetOutput {
    writeMode: 'add' | 'replace';
    unitTypesCreated: number;
    orgUnitsCreated: number;
    positionsCreated: number;
    endedForReplace: number;
    healedRoots: number;
    personsLinked: number;
    candidatesSeeded: number;
    usersSeeded: number;
}
export interface IdentityActions {
    /** PIP-004 Track C — validated registration (connector truth, downgrades only). */
    registerProvider(params: PeopleRegisterProviderParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** PIP-004 — edit provider (blank secret keeps the stored one). */
    updateProvider(providerUuid: string, params: PeopleUpdateProviderParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** PIP-004 Track D — manual directory import (draft changeset for review). */
    importDirectory(providerUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** PIP-004 Track D — configure sync opt-in + org mapping. */
    configureSync(providerUuid: string, params: PeopleConfigureSyncParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** PIP-004 Track D — confirm a draft changeset (the only write path). */
    applyImportChangeset(changesetUuid: string, params?: PeopleApplyChangesetParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    /** PIP-004 Track D — reject a draft changeset. */
    discardImportChangeset(changesetUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    activateProvider(providerUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    disableProvider(providerUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    discardProvider(providerUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    probe(providerUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    resolveDesired(params: PeopleResolveDesiredParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    executeItem(itemUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    activateItem(itemUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    retryItem(itemUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    resolveManually(params: PeopleResolveManuallyParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    releaseItem(params: PeopleReleaseItemParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    cancelItem(itemUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    cleanupPrepared(itemUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    resolveBinding(params: PeopleResolveBindingParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    markDeletedVerified(params: PeopleMarkDeletedVerifiedParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    acknowledge(findingUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    remediate(findingUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    acceptException(params: PeopleAcceptExceptionParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    registerIntended(findingUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    escalate(findingUuid: string, params?: PeopleEscalateParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    buildPlan(params: PeopleBuildPlanParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    amendPlan(planUuid: string, params: PeopleBuildPlanParams, opts?: PeopleActionOpts): Promise<ActionResponse>;
    cancelPlan(planUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
    completePlan(planUuid: string, opts?: PeopleActionOpts): Promise<ActionResponse>;
}
export declare function buildIdentityActions(deps: InvokeDeps): IdentityActions;
//# sourceMappingURL=actions.d.ts.map