import type { JWK } from 'gdc-common-utils-ts/models/jwk';
import type { ActorKind } from 'gdc-common-utils-ts/models/actor-session';
import { type RelatedPersonListSelection } from 'gdc-common-utils-ts/utils/related-person-list';
import { type CompositionAttesterMode } from 'gdc-common-utils-ts/models/interoperable-claims/composition-claims';
import type { LegalOrganizationVerificationTransactionInput } from 'gdc-common-utils-ts/utils/legal-organization-verification-transaction';
import { type ClinicalCreatorBindingInput } from 'gdc-common-utils-ts/utils/fhir-ips-creator-identity';
import { type AppInfo, type ConfidentialStorageProfile, type PollOptions, type SubmitAndPollResult, type ClinicalCreatorBinding, type ClinicalCreatorIpsExport, type ClinicalSourceAuthorSelection } from 'gdc-sdk-core-ts';
import { OrganizationControllerSdk } from './orchestration/organization-controller-sdk.js';
import { IndividualControllerSdk } from './orchestration/individual-controller-sdk.js';
import { IndividualMemberSdk } from './orchestration/individual-member-sdk.js';
import { ProfessionalSdk } from './orchestration/professional-sdk.js';
import { DigitalTwinSdk } from './orchestration/digital-twin-sdk.js';
import type { SmartTokenExchangeResult } from './smart-token.js';
import type { DigitalTwinSearchInput, DigitalTwinSearchResult } from './digital-twin.js';
import type { AuthorizedIndividualSubject, AuthorizedSubjectVerifiedContact } from './authorized-subject-directory.js';
import type { IndividualOrganizationOrderResult, RouteContext } from './individual-onboarding.js';
import type { IndividualOrganizationRegistrationResult } from './individual-start.js';
import type { HostRouteContext } from './host-onboarding.js';
import type { SecureDidcommTransportAdapter } from 'gdc-sdk-core-ts';
import { type PinProtectedProfileSecret, type ProfileProtectionOptions, type ServerProfileSealer } from './server-profile-protection.js';
export type { ServerProfileSealer } from './server-profile-protection.js';
export type ServerActorMode = 'self' | 'controller' | 'member';
/** FHIR attester assignment bound to one authenticated server profile. */
export type ServerProfileAttester = Readonly<{
    mode: CompositionAttesterMode;
    party: Readonly<{
        reference: string;
    }>;
}>;
/**
 * Builds the canonical `urn:uuid` attester reference from a real
 * RelatedPerson/PractitionerRole assignment returned by GW.
 */
export declare function buildProfileAttester(input: Readonly<{
    assignmentIdentifier: string;
    mode: CompositionAttesterMode;
}>): ServerProfileAttester;
/**
 * Selects a real active contact/member from a RelatedPerson search response
 * and turns its governed identifier into the personal profile attester.
 */
export declare function buildRelatedPersonProfileAttester(relatedPersonSearchResponseBody: unknown, selection: RelatedPersonListSelection): ServerProfileAttester;
/** Durable public metadata plus PIN-and-host protected private material. */
export type ServerProfileRecord = Readonly<{
    profileId: string;
    /** Stable key-derivation identity. Defaults to profileId for legacy records. */
    walletKeyDerivationId?: string;
    ownerId: string;
    actorKind: ActorKind;
    actorMode: ServerActorMode;
    actorDid: string;
    profileDid: string;
    providerDid: string;
    routeContext: RouteContext;
    allowedSubjectDids: string[];
    clientId: string;
    /** Stable non-secret id of the browser/app installation registered by DCR. */
    clientInstanceId?: string;
    /**
     * Authorized attester assignment retained for legacy profile/session
     * compatibility. Every new document still carries its own explicit
     * `Composition.attester` value.
     */
    attester?: ServerProfileAttester;
    /** Stable FHIR creator/permission identity; channel and device values are aliases only. */
    clinicalCreatorBinding?: ClinicalCreatorBinding;
    deviceDid: string;
    publicJwks: Record<string, unknown>[];
    /** Public recipient key for local confidential storage; not a DCR communication key. */
    storagePublicJwk?: Record<string, unknown>;
    /** Server-owned policy; browser input is never authoritative for this value. */
    confidentialStorageProfile?: ConfidentialStorageProfile;
    protectedWalletSeed: PinProtectedProfileSecret;
    /** Present only when this actor kind requires an independent signed role/relationship VP. */
    protectedVpToken?: PinProtectedProfileSecret;
    failedUnlocks: number;
    lockedUntil?: string;
    createdAt: string;
    updatedAt: string;
}>;
export type ServerProfileSessionRecord = Readonly<{
    sessionId: string;
    ownerId: string;
    profileId: string;
    /** Present only after the unlocked personal actor selects one authorized subject. */
    subjectDid?: string;
    scopes: string[];
    /** Exact directory results accepted for this unlocked actor session. */
    authorizedSubjectDids?: string[];
    /** Exact relationship projection returned by the encrypted directory. */
    authorizedSubjects?: ServerAuthorizedSubjectGrant[];
    /** Relationship used for the currently selected subject. */
    actorMode?: ServerActorMode;
    /** Subject-specific RelatedPerson assignment; never copied between cards. */
    attester?: ServerProfileAttester;
    sealedUnlockedWalletSeed: string;
    sealedUnlockedVpToken?: string;
    /** Present only after subject selection completes SMART authorization. */
    sealedAccessToken?: string;
    expiresAt: string;
}>;
/** Persistence port; implementations must isolate environment and tenant data. */
export type ServerProfileStore = Readonly<{
    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
    getProfile(profileId: string): Promise<ServerProfileRecord | undefined>;
    putProfile(profile: ServerProfileRecord): Promise<void>;
    getSession(sessionId: string): Promise<ServerProfileSessionRecord | undefined>;
    putSession(session: ServerProfileSessionRecord): Promise<void>;
    deleteSession(sessionId: string): Promise<void>;
    /** Required by key rotation so no session can retain the superseded seed. */
    deleteSessionsForProfile?(profileId: string): Promise<void>;
}>;
export type ServerEmployeeProfileOtpRotationInput = Readonly<{
    ownerId: string;
    profileId: string;
    idToken: string;
    newPin: string;
    redirectUris: string[];
    clientName: string;
}>;
export type ServerEmployeeProfileOtpRotationResult = ServerProfileRecord;
export type ServerProfilePinReplacementInput = Readonly<{
    ownerId: string;
    profileId: string;
    /** Server-authorized seed obtained from a passkey, active wallet session or recovery envelope. */
    authorizedWalletSeed: string;
    /** Required when the durable profile still carries a separately protected legacy VP. */
    authorizedVpToken?: string;
    newPin: string;
}>;
export type ServerProfileEnrollmentInput = Readonly<{
    /** Stable confidential id of the authenticated portal account that owns and lists this profile. */
    ownerId: string;
    /** Stable local id of this wallet/profile record. This is not the DCR `client_id`. */
    profileId: string;
    /** SDK capability family being enrolled, for example an organization controller or employee. */
    actorKind: ActorKind;
    /** Authorization semantics already granted to the profile; never take this from an untrusted UI field. */
    actorMode: ServerActorMode;
    /** Exact role/controller DID used by the actor proof, including the VP issuer when a VP is supplied. */
    actorDid: string;
    /** DID represented by the managed wallet. It may equal `actorDid`, as in a controller enrollment. */
    profileDid: string;
    /** Organization/provider DID whose configured route and policies this profile will use. */
    providerDid: string;
    /** Server-owned tenant, jurisdiction and sector routing context. */
    routeContext: RouteContext;
    /** Server-derived subject authorization boundary; never accept arbitrary browser-selected DIDs here. */
    allowedSubjectDids: string[];
    /**
     * Unlock secret for the locally protected wallet seed. It is neither sent
     * to GW nor persisted by the SDK. The integrating product decides whether
     * it is user-entered or a separately stored, high-entropy per-profile BFF
     * secret; it must never be logged or reused as one shared deployment PIN.
     */
    pin: string;
    /**
     * Signed OIDC `id_token` used by GW to bind the activation code to an
     * authenticated account/email. Its issuer, audience, signature `kid` and
     * public JWKS must be trusted by GW. A controller VP cannot replace it.
     */
    idToken: string;
    /** One-time code returned by the completed organization flow or employee `License/_issue`. */
    activationCode: string;
    /**
     * Principal controller identifier projected by the SDK from
     * `Organization.owner.identifier.value` and the matching automatic
     * `RelatedPerson.identifier`. Individual-controller callers pass this
     * identifier; the SDK constructs protected document-attester metadata.
     */
    controllerRelatedPersonIdentifier?: string;
    /**
     * Optional explicit installation identity. Normally omit it so the SDK
     * derives the identity from the wallet key it creates for this profile.
     */
    clientInstanceId?: string;
    /**
     * Server-selected RelatedPerson/PractitionerRole assignment for this
     * profile. It is persisted locally and is not sent as document authorship.
     */
    attester?: ServerProfileAttester;
    /**
     * Server-authorized stable creator identity imported from FHIR or generated
     * locally. Enrollment adds the operational actor DID and registered DCR
     * client/key aliases; it never derives UUIDs from those aliases.
     */
    clinicalCreatorBinding?: ClinicalCreatorBindingInput;
    /**
     * Signed actor/controller VP protected for later SMART operations. Required
     * for organization/professional/member actors. Individual-controller
     * profiles omit it: their account `id_token`, DCR device binding and
     * provider-side relationship policy are evaluated independently.
     */
    vpToken?: string;
    /**
     * High-level employee/professional proof source. When supplied, the SDK
     * builds and signs the VP with the managed DCR wallet after registration;
     * callers do not compose JWT/JWK material.
     */
    professionalProof?: Readonly<{
        role: string;
        email?: string;
        sameAs?: string | readonly string[];
        telephone?: string;
        credentialMaterial?: string;
    }>;
    /** Redirect URIs owned by this portal/app installation. */
    redirectUris?: string[];
    /** Human-readable portal/app name. */
    clientName?: string;
    /** @deprecated Use `redirectUris`; OpenID metadata is authored internally. */
    dcrRedirectUris?: string[];
    /** @deprecated Use `clientName`; OpenID metadata is authored internally. */
    dcrClientName?: string;
    /**
     * Optional server-only recovery seed. It must be 32 bytes encoded as
     * base64url and must never be accepted from an untrusted browser payload.
     */
    walletSeed?: string;
    /** Stable identity used to reproduce the same keys independently of profile storage IDs. */
    walletKeyDerivationId?: string;
}>;
export type ServerProfileEnrollmentPublicKey = Readonly<{
    ownerScope: string;
    purpose: string;
    use: string;
    alg: string;
    kid: string;
    publicJwk: Record<string, unknown>;
}>;
/** Server-only existing-tenant reissue performed with deterministic bootstrap keys. */
export type ServerProfileOrganizationIssueInput = Readonly<{
    walletSeed: string;
    walletKeyDerivationId: string;
    bearerToken: string;
    providerDid: string;
    routeContext: RouteContext;
    hostContext: HostRouteContext;
    verificationInput: LegalOrganizationVerificationTransactionInput;
    pollOptions?: PollOptions;
}>;
export type ServerOrganizationControllerVpInput = Readonly<{
    /** Same protected seed that committed the controller public key to ICA. */
    walletSeed: string;
    /** Stable application-owned derivation id reused after every restart. */
    walletKeyDerivationId: string;
    /** Terminal ICA/GW verification body containing the issued organization, representative and controller VCs. */
    verificationResponseBody: unknown;
    /** Exact organization tenant identifier represented by the controller proof. */
    tenantId: string;
    /** Exact audience required by the receiving GW/host policy. */
    audience: string;
    /** Optional stable sameAs selector when the response contains several controller credentials. */
    controllerSameAs?: string;
}>;
/** One explicit unlock request; scopes and subject remain session-bound. */
export type ServerProfileUnlockInput = Readonly<{
    ownerId: string;
    profileId: string;
    subjectDid: string;
    scopes: string[];
    pin: string;
    idToken: string;
}>;
/** Unlocks one personal actor wallet before choosing any individual card. */
export type ServerActorProfileUnlockInput = Readonly<{
    ownerId: string;
    profileId: string;
    pin: string;
}>;
/** Refreshes the actor's exact GW directory through the unlocked DCR wallet. */
export type ServerAuthorizedSubjectDirectoryInput = Readonly<{
    ownerId: string;
    sessionId: string;
    idToken: string;
    verifiedContact: AuthorizedSubjectVerifiedContact;
}>;
/** Selects one server-confirmed subject and exchanges only its SMART scopes. */
export type ServerAuthorizedSubjectSelectionInput = Readonly<{
    ownerId: string;
    sessionId: string;
    subjectDid: string;
    scopes: string[];
    idToken: string;
}>;
/** Server-owned relationship projection for one directory subject. */
export type ServerAuthorizedSubjectGrant = Readonly<{
    subjectDid: string;
    /** Canonical private subject used for SMART when the directory exposes a public card alias. */
    transportSubjectDid?: string;
    actorMode: ServerActorMode;
    attester?: ServerProfileAttester;
}>;
/** Wallet material available after PIN unlock but before subject selection. */
export type ResolvedServerActorProfileSession = Readonly<{
    sessionId: string;
    profile: ServerProfileRecord;
    authorizedSubjectDids: string[];
    secureTransportAdapter: SecureDidcommTransportAdapter;
    confidentialStorageAdapter: Readonly<{
        protect(document: Readonly<{
            id?: string;
            content: unknown;
        }>): Promise<unknown>;
        unprotect(document: Readonly<{
            id?: string;
            jwe: string;
        }>): Promise<unknown>;
    }>;
}>;
/** Material available only during an authenticated, unexpired server session. */
export type ResolvedServerProfileSession = Readonly<{
    sessionId: string;
    profile: ServerProfileRecord;
    subjectDid: string;
    scopes: string[];
    accessToken: string;
    /** Relationship authorization selected for this subject, not for the wallet. */
    actorMode: ServerActorMode;
    /** Attester selected for this subject relationship and current session. */
    attester?: ServerProfileAttester;
    secureTransportAdapter: SecureDidcommTransportAdapter;
    /** Storage adapter available only while the PIN-unlocked session is alive. */
    confidentialStorageAdapter: Readonly<{
        protect(document: Readonly<{
            id?: string;
            content: unknown;
        }>): Promise<unknown>;
        unprotect(document: Readonly<{
            id?: string;
            jwe: string;
        }>): Promise<unknown>;
    }>;
}>;
/**
 * Server-only authorization material used to reopen one registered controller.
 *
 * A product may let this manager open the PIN-protected seed directly, or may
 * pass the same seed after its own passkey/session policy has authorized and
 * unsealed it. `authorizedWalletSeed` must never cross a browser/API boundary.
 */
export type ServerOrganizationControllerOpenInput = Readonly<{
    ownerId: string;
    profileId: string;
    /** Fresh signed OIDC id_token used as the HTTP bearer for this operation. */
    idToken: string;
    /** User-entered or product-managed profile PIN; mutually exclusive with authorizedWalletSeed. */
    pin?: string;
    /** Already-authorized server-only 32-byte base64url seed; mutually exclusive with pin. */
    authorizedWalletSeed?: string;
}>;
/** High-level controller facade plus its immutable durable profile metadata. */
export type OpenedServerOrganizationController = Readonly<{
    profile: ServerProfileRecord;
    sdk: OrganizationControllerSdk;
}>;
/** Opens the individual-controller facade from an authenticated SMART session. */
export type ServerIndividualControllerOpenInput = Readonly<{
    ownerId: string;
    sessionId: string;
}>;
/** Session-bound individual-controller facade and its durable profile. */
export type OpenedServerIndividualController = Readonly<{
    session: ResolvedServerProfileSession;
    profile: ServerProfileRecord;
    sdk: IndividualControllerSdk;
    /** Returns the protected RelatedPerson URI for FHIR document attestation. */
    getAttesterUriForDocs(): string;
    /** Returns the selected relationship to place explicitly on this document. */
    getDocumentAttester(): ServerProfileAttester;
}>;
/** Session-bound individual-member facade using the same personal actor wallet. */
export type OpenedServerIndividualMember = Readonly<{
    session: ResolvedServerProfileSession;
    profile: ServerProfileRecord;
    sdk: IndividualMemberSdk;
    getAttesterUriForDocs(): string;
}>;
/** One-time self-controller enrollment. It never opens a working session. */
export type ServerSelfIndividualControllerEnrollmentInput = Readonly<{
    ownerId: string;
    profileId: string;
    registration: Pick<IndividualOrganizationRegistrationResult, 'identity'>;
    order: Pick<IndividualOrganizationOrderResult, 'activationCode' | 'controllerRelatedPersonIdentifier'>;
    routeContext: RouteContext;
    pin: string;
    idToken: string;
    redirectUris: string[];
    clientName: string;
}>;
/**
 * One-time enrollment when the controller and represented subject are
 * different identities. Demographics and alternateName belong to registration
 * evidence and are deliberately not accepted by this operation.
 */
export type ServerIndividualControllerEnrollmentInput = Readonly<{
    ownerId: string;
    profileId: string;
    /** Stable controller/member DID that owns the wallet and DCR client. */
    controllerActorDid: string;
    /**
     * Authorized subject alias used by the product, when different from the
     * hosted subject DID returned by registration (for example, an animal card).
     */
    subjectDid?: string;
    registration: Pick<IndividualOrganizationRegistrationResult, 'identity'>;
    order: Pick<IndividualOrganizationOrderResult, 'activationCode' | 'controllerRelatedPersonIdentifier'>;
    routeContext: RouteContext;
    pin: string;
    idToken: string;
    redirectUris: string[];
    clientName: string;
}>;
/** Server-owned role evidence used to sign a fresh professional VP. */
export type ServerProfessionalProofInput = Readonly<{
    role: string;
    email?: string;
    sameAs?: string | readonly string[];
    telephone?: string;
    credentialMaterial?: string;
}>;
/** Reopens one enrolled employee/professional profile behind the BFF boundary. */
export type ServerProfessionalOpenInput = Readonly<{
    ownerId: string;
    profileId: string;
    /** Fresh signed OIDC id_token proving the authenticated account/email. */
    idToken: string;
    /** Role evidence signed by the managed DCR wallet, independently of idToken. */
    professionalProof: ServerProfessionalProofInput;
    /** Manager-owned PIN path; mutually exclusive with authorizedWalletSeed. */
    pin?: string;
    /** Server-only seed already authorized by a product passkey/session policy. */
    authorizedWalletSeed?: string;
    /** Provider tenant selected by a server-authorized inter-tenant workflow. */
    target?: Readonly<{
        providerDid: string;
        routeContext: RouteContext;
    }>;
    /** Verified access credentials appended to the managed professional VP. */
    accessCredentials?: ReadonlyArray<object>;
}>;
/** Business authorization requested from SMART; OpenID/JWT fields stay SDK-owned. */
export type ServerProfessionalSmartTokenInput = Readonly<{
    subjectDid?: string;
    purpose?: string;
    scopes: string[];
    acrValues?: string;
    requestBodyClaims?: Record<string, unknown>;
    tokenCacheKey?: string;
    timeoutSeconds?: number;
    intervalSeconds?: number;
}>;
/** Role-scoped professional facades with managed SMART proof methods. */
export type OpenedServerProfessional = Readonly<{
    profile: ServerProfileRecord;
    sdk: ProfessionalSdk;
    digitalTwin: DigitalTwinSdk;
    requestSmartToken(input: ServerProfessionalSmartTokenInput): Promise<SmartTokenExchangeResult>;
    requestDigitalTwinSmartToken(input: ServerProfessionalSmartTokenInput): Promise<SmartTokenExchangeResult>;
    searchDigitalTwins(input: Omit<DigitalTwinSearchInput, 'accessToken'>): Promise<DigitalTwinSearchResult>;
}>;
export type ServerProfileSessionManagerOptions = Readonly<{
    store: ServerProfileStore;
    sealer: ServerProfileSealer;
    gatewayBaseUrl: string;
    resolveRecipientJwk: (recipientDid: string) => Promise<JWK>;
    /** Stable identity of the portal/application, shared by all of its user wallets. */
    appInfo?: AppInfo;
    fetchImpl?: typeof fetch;
    sessionTtlSeconds?: number;
    maxFailedUnlocks?: number;
    lockSeconds?: number;
    profileProtection?: ProfileProtectionOptions;
    /** Product/tenant policy applied to enrollment and upgraded on next PIN unlock. */
    requiredConfidentialStorageProfile?: ConfidentialStorageProfile;
    now?: () => Date;
}>;
/**
 * Coordinates device registration, two-factor profile protection and SMART sessions.
 *
 * Persisted seeds require both the PIN-derived key and the host KEK. After a
 * successful unlock, a short-lived host-sealed seed is copied into the server
 * session so subsequent requests do not need to resend the PIN. Expiring or
 * locking the session removes that temporary bypass.
 */
export declare class ServerProfileSessionManager {
    private readonly options;
    constructor(options: ServerProfileSessionManagerOptions);
    /**
     * Enrolls a controller for a different represented subject. The SDK consumes
     * the automatic GW RESPRSN assignment and does not ask the caller to build an
     * attester. This operation does not accept or update subject demographics.
     */
    enrollIndividualController(input: ServerIndividualControllerEnrollmentInput): Promise<ServerProfileRecord>;
    /**
     * Resolves the canonical IPS author/attester projection from one owned
     * profile without exposing its protected wallet material to the portal.
     */
    exportClinicalCreatorIps(input: Readonly<{
        ownerId: string;
        profileId: string;
        /**
         * Closed personal-content origin. `Owner` means the individual originated
         * or dictated it; `Creator` means the registered member/controller did.
         * This never changes the authenticated sender or permits a free-form
         * author reference. Professional content remains organization-authored.
         */
        sourceAuthor?: ClinicalSourceAuthorSelection;
    }>): Promise<ClinicalCreatorIpsExport>;
    /**
     * Enrolls the controller of a self-managed individual from SDK-owned
     * registration and Order projections. The caller never parses claims or
     * constructs FHIR attester metadata, and this operation does not open the
     * resulting profile.
     */
    enrollSelfIndividualController(input: ServerSelfIndividualControllerEnrollmentInput): Promise<ServerProfileRecord>;
    enroll(input: ServerProfileEnrollmentInput): Promise<ServerProfileRecord>;
    /**
     * Rotates an employee wallet after a fresh OTP-authenticated GW recovery.
     * The old PIN and seed are never opened: DCR replaces the installation with
     * newly generated keys, all old BFF sessions are removed, and the new wallet
     * is opened once with the new PIN.
     */
    rotateEmployeeProfileWithOtp(input: ServerEmployeeProfileOtpRotationInput): Promise<ServerEmployeeProfileOtpRotationResult>;
    /**
     * Derives only the public enrollment descriptors for a server-governed
     * recovery seed. This is intended for pre-DCR controller binding requests;
     * no private material or seed is returned.
     */
    prepareEnrollmentPublicKeys(input: Readonly<{
        walletSeed: string;
        walletKeyDerivationId: string;
    }>): Promise<ServerProfileEnrollmentPublicKey[]>;
    /**
     * Builds and signs the canonical controller VP directly from ICA-issued
     * credentials. The caller never assembles a VP/JWS or exports a private key.
     *
     * This proof is independent from the signed OIDC id_token: the VP proves
     * organization/controller authority, while id_token proves control of the
     * verified login identifier used by Token/_exchange and DCR.
     */
    buildOrganizationControllerVpFromIcaProof(input: ServerOrganizationControllerVpInput): Promise<string>;
    /**
     * Reissues an existing organization controller activation through protected
     * DIDComm transport before a durable profile exists. The deterministic seed
     * remains server-only and the caller receives only the normal GW response.
     */
    submitLegalOrganizationCredentialReissuanceWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
    /** @deprecated Use `submitLegalOrganizationCredentialReissuanceWithBootstrapWallet`. */
    submitLegalOrganizationIssueWithBootstrapWallet(input: ServerProfileOrganizationIssueInput): Promise<SubmitAndPollResult>;
    listProfiles(ownerId: string): Promise<ServerProfileRecord[]>;
    /**
     * Rewraps the exact registered wallet under a new PIN after a separate
     * server-authorized recovery factor has released its secrets. No GW call or
     * DCR occurs because proof-of-possession and every public key remain intact.
     */
    replaceProfilePinFromAuthorizedSecrets(input: ServerProfilePinReplacementInput): Promise<ServerProfileRecord>;
    unlock(input: ServerProfileUnlockInput): Promise<ResolvedServerProfileSession>;
    /**
     * Unlocks one personal actor wallet without selecting a card or requesting a
     * subject SMART token. The returned opaque session can refresh the encrypted
     * authorized-subject directory and then select any exact returned subject.
     */
    unlockActorProfile(input: ServerActorProfileUnlockInput): Promise<ResolvedServerActorProfileSession>;
    /**
     * Uses the already-unlocked registered wallet for the encrypted directory
     * request, then replaces the session/profile subject list with exact GW
     * results. The verified contact must come from the signed OpenID token.
     */
    refreshAuthorizedSubjects(input: ServerAuthorizedSubjectDirectoryInput): Promise<Readonly<{
        session: ResolvedServerActorProfileSession;
        subjects: AuthorizedIndividualSubject[];
    }>>;
    /**
     * Exchanges SMART authorization for one subject returned by the encrypted
     * directory. It reuses the same unlocked seed, profile, DCR client and
     * opaque session; this operation deliberately accepts no PIN.
     */
    selectAuthorizedSubject(input: ServerAuthorizedSubjectSelectionInput): Promise<ResolvedServerProfileSession>;
    /** Resolves an unlocked actor wallet whether or not a card is selected. */
    resolveActorSession(ownerId: string, sessionId: string): Promise<ResolvedServerActorProfileSession>;
    /**
     * Renews the short SMART bearer while retaining the already-open server
     * wallet session. The caller must supply a fresh authenticated account
     * token; neither the PIN nor wallet keys return to the browser.
     */
    refreshSession(ownerId: string, sessionId: string, idToken: string): Promise<ResolvedServerProfileSession>;
    resolveSession(ownerId: string, sessionId: string): Promise<ResolvedServerProfileSession>;
    /**
     * Opens a registered individual controller from an already unlocked SMART
     * session. The session owns subject scope, access token and wallet transport;
     * callers never reconstruct the HTTP client or expose those values to a
     * browser.
     */
    openIndividualController(input: ServerIndividualControllerOpenInput): Promise<OpenedServerIndividualController>;
    /** Opens an accepted caregiver/member relationship after exact subject selection. */
    openIndividualMember(input: ServerIndividualControllerOpenInput): Promise<OpenedServerIndividualMember>;
    /**
     * Opens the high-level organization-controller API without exposing wallet,
     * DIDComm, DCR or HTTP-client plumbing to the integrating BFF.
     *
     * The durable profile remains authoritative for actor DID, provider DID,
     * route and DCR client id. The reconstructed keys must match the public keys
     * registered for that profile before any gateway request can be sent.
     */
    openOrganizationController(input: ServerOrganizationControllerOpenInput): Promise<OpenedServerOrganizationController>;
    /**
     * Opens one registered organization employee/professional without exposing
     * wallet reconstruction, private_key_jwt, VP or transport plumbing.
     *
     * The product authorizes the PIN/passkey/session and supplies business role
     * evidence. The SDK revalidates the registered key set, signs a fresh role
     * VP independently from the OIDC account proof, derives the SMART endpoint
     * from the durable profile route and owns the client assertion.
     */
    openProfessional(input: ServerProfessionalOpenInput): Promise<OpenedServerProfessional>;
    lock(ownerId: string, sessionId: string): Promise<void>;
    private createClient;
    private createRegisteredProfileClient;
    private createWallet;
    private resolveWalletState;
    /**
     * Upgrade legacy profiles deterministically after successful PIN unlock.
     * The protected seed already owns the storage pair, so migration neither
     * exports a private key nor calls KMS/GW. Only its public JWK and policy label
     * are added to the durable profile record.
     */
    private ensureRequiredStorageProfile;
    private requireOwnedProfile;
    private requireSubject;
    private now;
}
/**
 * Exports the stable FHIR IPS source author and attester attached to a server
 * profile. The returned protected binding lets high-level helpers use the
 * stable legal organization URN plus PractitionerRole for professionals. For
 * individual members/controllers, `Owner` selects the individual as author and
 * `Creator` selects the registered RelatedPerson; that RelatedPerson remains
 * the attester. DIDComm sender and signing keys remain transport/audit evidence
 * and never become FHIR provenance.
 */
export declare function exportServerProfileClinicalCreatorIps(profile: ServerProfileRecord, options?: Readonly<{
    sourceAuthor?: ClinicalSourceAuthorSelection;
}>): ClinicalCreatorIpsExport;