import { type EmployeeActivationGrant, type OrganizationEmployeeLifecycleRecord } from 'gdc-common-utils-ts';
import type { RouteContext } from './individual-onboarding.js';
import type { SubmitAndPollResult } from './orchestration/client-port.js';
import type { OrganizationLicenseOrderConfirmInput } from './organization-license-order.js';
import type { ServerProfileEnrollmentInput, ServerProfileRecord } from './server-profile-session.js';
import type { LicenseListRuntimeSearchInput, OrganizationEmployeeCreationInput, OrganizationEmployeeLicenseInvitationInput, OrganizationEmployeeSearchInput } from './resource-operations.js';
/**
 * Input for atomic interactive provisioning. Every current employee create is
 * seat-required. Supplying `licenseOrder` authorizes the SDK to close a
 * GW-issued Offer before retrying creation and issuing the activation
 * credential. A future batch import requires a separate explicit operation.
 */
export type OrganizationEmployeeProvisioningInput = Readonly<{
    creation: OrganizationEmployeeCreationInput;
    invitation: OrganizationEmployeeLicenseInvitationInput;
    licenseOrder?: Omit<OrganizationLicenseOrderConfirmInput, 'offerId'>;
}>;
/** Results required by a portal to persist routing and display the credential once. */
export type OrganizationEmployeeProvisioningResult = Readonly<{
    employee: SubmitAndPollResult;
    license: SubmitAndPollResult;
    licenseOrder?: SubmitAndPollResult;
    activationCode: string;
    /** Effective installation allowance returned by the reserved GW seat. */
    maxDevices?: number;
}>;
/** Shared dependencies for the create plus seat issuance workflow. */
export type OrganizationEmployeeProvisioningDeps = Readonly<{
    createEmployee(routeContext: RouteContext, input: OrganizationEmployeeCreationInput): Promise<SubmitAndPollResult>;
    issueLicense(routeContext: RouteContext, input: OrganizationEmployeeLicenseInvitationInput): Promise<SubmitAndPollResult>;
    confirmLicenseOrder?(routeContext: RouteContext, input: OrganizationLicenseOrderConfirmInput): Promise<SubmitAndPollResult>;
}>;
/**
 * Creates the employee, closing Offer/Order first when the strict request has
 * no available seat, then reserves that seat through `License/_issue` and
 * returns the exact GW activation credential.
 */
export declare function provisionOrganizationEmployeeWithDeps(routeContext: RouteContext, input: OrganizationEmployeeProvisioningInput, deps: OrganizationEmployeeProvisioningDeps): Promise<OrganizationEmployeeProvisioningResult>;
/** Reads the technical employee id that must own the subsequently issued seat. */
export declare function readEmployeeResourceId(value: unknown): string | undefined;
/**
 * Reads the concrete PractitionerRole assignment created inside an Employee
 * receipt. This UUID, not the employee DID or contact, becomes the
 * professional profile attester reference.
 */
export declare function readEmployeeProfessionalAssignmentIdentifier(value: unknown): string | undefined;
/** Reads the effective positive installation allowance returned by `License/_issue`. */
export declare function readEmployeeLicenseMaxDevices(value: unknown): number | undefined;
/**
 * Reads the pending seat Offer from an employee-create response.
 *
 * Portal BFFs use this boundary when payment is asynchronous: persist the
 * server-owned creation intent, redirect to hosted Checkout, then submit the
 * paid reference in Order before retrying employee creation and License/_issue.
 */
export declare function readEmployeeLicenseOfferId(value: unknown): string | undefined;
/**
 * Rejects failed outer HTTP responses and failed entries hidden inside a
 * successful async poll envelope before a caller starts the next mutation.
 */
export declare function assertSuccessfulEmployeeOperation(operation: string, result: SubmitAndPollResult): void;
/** Shared dependencies for combining employee and license directory searches. */
export type OrganizationEmployeeLifecycleQueryDeps = Readonly<{
    searchEmployees(routeContext: RouteContext, input: OrganizationEmployeeSearchInput): Promise<SubmitAndPollResult>;
    listLicenses(routeContext: RouteContext, input?: LicenseListRuntimeSearchInput): Promise<SubmitAndPollResult>;
}>;
/** Lists employees and their installation allowance through one typed projection. */
export declare function listOrganizationEmployeeLifecycleWithDeps(routeContext: RouteContext, deps: OrganizationEmployeeLifecycleQueryDeps): Promise<OrganizationEmployeeLifecycleRecord[]>;
/** Input used to persist routing metadata for one issued employee credential. */
export type EmployeeActivationGrantInput = Readonly<{
    email: string;
    employeeDid: string;
    employeeRoleCode: string;
    providerDid: string;
    routeContext: RouteContext;
    createdAt: Date;
    expiresAt: Date;
}>;
/** Builds the product-neutral routing grant stored under a credential digest. */
export declare function createEmployeeActivationGrant(input: EmployeeActivationGrantInput): EmployeeActivationGrant;
/** Verifies that a stored routing grant belongs to the authenticated email. */
export declare function employeeActivationGrantMatchesEmail(grant: EmployeeActivationGrant, email: string): boolean;
/**
 * Stable profile id derived from account, employee, provider and portal
 * installation identities. The portal installation id only separates local
 * profiles; it is not a cryptographic DCR key identifier.
 */
export declare function buildOrganizationEmployeeProfileId(input: Readonly<{
    ownerId: string;
    employeeDid: string;
    providerDid: string;
    clientInstanceId: string;
}>): string;
/** Enrolls a previously invited employee without organization discovery. */
export declare function enrollInvitedOrganizationEmployeeWithDeps(input: Readonly<{
    ownerId: string;
    idToken: string;
    activationCode: string;
    pin: string;
    grant: EmployeeActivationGrant;
    dcrRedirectUris: string[];
    dcrClientName: string;
    clientInstanceId: string;
}>, deps: Readonly<{
    enroll(enrollment: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
}>): Promise<ServerProfileRecord>;