import { type NodeOrganizationDidBindingInput, type NodeLegalOrganizationVerificationTransactionInput, type NodeRuntimeClient, type PollOptions, type SubmitAndPollResult, type SubmitPayload } from './client-port.js';
import type { RouteContext } from '../individual-onboarding.js';
import type { HostRouteContext, HostedTenantLifecycleInput } from '../host-onboarding.js';
import type { EmployeeDeviceActivationResult, EmployeeDeviceActivationRequestInput, EmployeeDeviceRevocationInput } from '../device-activation.js';
import type { SmartTokenExchangeResult, SmartTokenRequestInput } from '../smart-token.js';
import type { OrganizationLicenseOrderConfirmInput } from '../organization-license-order.js';
import type { NodeCapability } from '../session.js';
import type { LicenseListRuntimeSearchInput, LicenseOfferRuntimeSearchInput, LicenseOrderRuntimeSearchInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseAddInput, OrganizationEmployeeLicenseOfferInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeLifecycleInput, OrganizationEmployeeSearchInput } from '../resource-operations.js';
import type { OrganizationEmployeeProvisioningInput, OrganizationEmployeeProvisioningResult } from '../organization-employee-lifecycle.js';
import type { OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts/models/organization-employee-lifecycle';
/**
 * Organization-controller oriented facade over a `NodeRuntimeClient`.
 *
 * Use this class when the caller already knows it is acting as an organization
 * controller/admin and wants the smallest API surface for that role.
 */
export declare class OrganizationControllerSdk {
    private readonly client;
    private readonly capabilities?;
    /**
     * @param client Runtime client implementation used to submit and poll GW flows.
     */
    constructor(client: NodeRuntimeClient, capabilities?: readonly NodeCapability[] | undefined);
    /**
     * Starts the host-side legal-organization verification transaction that GW
     * CORE forwards to ICA `_verify`.
     *
     * This is intentionally distinct from the older host `_activate` step:
     * - `_transaction` carries signed evidence and controller business binding
     * - `_transaction` is complete on its own for the new flow
     * - `_activate` remains only for the legacy ICA `_verify` compatibility path
     */
    submitLegalOrganizationVerificationTransaction(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Starts the host-side existing-tenant legal-organization reissue flow that
     * refreshes verification and reissues one controller activation code.
     */
    submitLegalOrganizationCredentialReissuance(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * @deprecated Use `submitLegalOrganizationCredentialReissuance`.
     * The old name mirrors the transport route rather than the credential
     * reissuance business operation.
     */
    submitLegalOrganizationIssue(hostCtx: HostRouteContext, input: NodeLegalOrganizationVerificationTransactionInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Binds the current tenant organization DID document to one public alias
     * view.
     *
     * Contract:
     * - the tenant path identifies the organization
     * - `organization.url`, when present, provides the public aliases/domains to
     *   bind
     * - `controller.sameAs` is optional corroborating identity evidence
     */
    submitOrganizationDidBinding(ctx: RouteContext, input: NodeOrganizationDidBindingInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Creates an employee/professional under the current organization tenant.
     */
    createOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeCreationInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /** Creates the employee and issues its reusable multi-installation credential. */
    provisionOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeProvisioningInput): Promise<OrganizationEmployeeProvisioningResult>;
    /** Reserves the employee seat and returns its bounded multi-device activation credential. */
    issueOrganizationEmployeeLicense(ctx: RouteContext, input: OrganizationEmployeeLicenseInvitationInput): Promise<SubmitAndPollResult>;
    /**
     * Disables an employee using the current GW CORE lifecycle contract.
     */
    disableOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Preferred public alias for employee disable.
     */
    disableEmployee(ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Searches employees/professionals under the current organization tenant.
     */
    searchOrganizationEmployees(ctx: RouteContext, input: OrganizationEmployeeSearchInput): Promise<SubmitAndPollResult>;
    /** Lists employees with typed license and device lifecycle state. */
    listOrganizationEmployeeLifecycle(ctx: RouteContext): Promise<OrganizationEmployeeLifecycleRecord[]>;
    /**
     * Searches organization-owned license seats using semantic license filters.
     */
    searchLicenses(ctx: RouteContext, input: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /**
     * Lists organization-owned license seats with optional filters.
     */
    listLicenses(ctx: RouteContext, input?: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /** @deprecated Professional seats use Employee Offer and confirmed Order. */
    addFreeEmployeeLicenses(ctx: RouteContext, input: OrganizationEmployeeLicenseAddInput): Promise<SubmitAndPollResult>;
    /** Requests an Offer for additional employee seats before invitations. */
    requestEmployeeLicenseOffer(ctx: RouteContext, input: OrganizationEmployeeLicenseOfferInput): Promise<SubmitAndPollResult>;
    /**
     * Searches commercial license offers known for the current organization.
     */
    searchLicenseOffers(ctx: RouteContext, input: LicenseOfferRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /**
     * Lists commercial license offers known for the current organization.
     */
    listLicenseOffers(ctx: RouteContext, input?: LicenseOfferRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /**
     * Searches commercial license orders/payment records known for the current
     * organization.
     */
    searchLicenseOrders(ctx: RouteContext, input: LicenseOrderRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /**
     * Lists commercial license orders/payment records known for the current
     * organization.
     */
    listLicenseOrders(ctx: RouteContext, input?: LicenseOrderRuntimeSearchInput): Promise<SubmitAndPollResult>;
    /**
     * Confirms an already paid organization-side license order so GW CORE can
     * activate additional tenant seats.
     *
     * The commercial/payment step happens outside GW CORE. This method models
     * the follow-up confirmation that should materialize new seats from the
     * accepted order.
     *
     * Security/routing contract:
     * - the request is routed through the host `Order/_batch` endpoint
     * - the signed `iss` is still the exact controller DID registered by DCR for
     *   `ctx.tenantId`; its `kid`/`skid` keys belong to that tenant, not the host
     * - the configured runtime transport profile applies unchanged, including
     *   DIDComm encryption in protected staging/production runtimes
     */
    confirmOrganizationLicenseOrder(ctx: RouteContext, input: OrganizationLicenseOrderConfirmInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Purges an already inactive employee and frees the associated license seat.
     */
    purgeOrganizationEmployee(ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Preferred public alias for employee purge.
     */
    purgeEmployee(ctx: RouteContext, input: OrganizationEmployeeLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Disables the hosted tenant itself through the host registry once no active
     * employees or individual/member descendants remain.
     */
    disableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /** Re-enables the same suspended tenant and immutable legal identifier. */
    enableTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Purges the hosted tenant through the host registry after tenant disable and
     * descendant purges have both completed.
     */
    purgeTenant(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /** Returns host-confirmed tenant state and descendant counters. */
    getTenantLifecycleStatus(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /** Explicitly disables individuals before tenant disable. Employees use their dedicated lifecycle. */
    disableTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
        descendantKind: 'individuals';
    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /** Explicitly purges individuals before tenant purge. Employees use their dedicated lifecycle. */
    purgeTenantDescendants(hostCtx: HostRouteContext, input: HostedTenantLifecycleInput & {
        descendantKind: 'individuals';
    }, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
    /**
     * Activates the employee device from a previously issued activation request.
     */
    activateEmployeeDeviceWithActivationRequest(input: EmployeeDeviceActivationRequestInput): Promise<EmployeeDeviceActivationResult>;
    /** Revokes one selected installation while preserving the employee and seat. */
    revokeEmployeeDevice(ctx: RouteContext, input: EmployeeDeviceRevocationInput): Promise<SubmitAndPollResult>;
    /**
     * Requests a SMART token for the current organization-scoped actor.
     *
     * The actor identity should normally be passed as `actorDid`, while route
     * details should come from the client default context unless legacy
     * compatibility requires overriding them on the call.
     */
    requestSmartToken(input: SmartTokenRequestInput): Promise<SmartTokenExchangeResult>;
    /**
     * Low-level escape hatch for direct submit/poll flows.
     */
    submitAndPoll(submitPath: string, pollPath: string, payload: SubmitPayload, pollOptions?: PollOptions): Promise<SubmitAndPollResult>;
}