import { PlatformRoleCode, IdentifierUse } from '@openhi/types';

/**
 * @see sites/www-docs/content/packages/@openhi/constructs/workflows/control-plane/seed-demo-data/events.md
 */
/**
 * Stable logical name this workflow registers with the shared
 * `WorkflowDedupTable` (TR-015). Used in both the construct grant
 * (`workflowDedupTable.grantConsumer(lambda, SEED_DEMO_DATA_CONSUMER_NAME)`)
 * and the handler's runtime `recordIfAbsent` call — keep them aligned by
 * importing this constant in both places.
 */
declare const SEED_DEMO_DATA_CONSUMER_NAME = "seed-demo-data";
/** FHIR `Identifier.system` for the demo-scenario URN scheme. */
declare const DEMO_URN_SYSTEM = "urn:openhi:demo";
/**
 * FHIR `Identifier.system` for the canonical OpenHI resource URN
 * (ADR 2026-03-12-01). The value form is
 * `urn:ohi:<tenantId>:<workspaceId>:<resourceType>:<id>`; empty
 * workspaceId means the resource has tenant-wide scope (or is itself
 * the workspace identity, in the Workspace case).
 */
declare const OPENHI_RESOURCE_URN_SYSTEM = "http://openhi.org/";
/**
 * Period stamped on every demo Membership and RoleAssignment. Fixed
 * start so re-runs produce byte-identical bodies (decision #4); no
 * end so demo memberships are open-ended.
 */
declare const DEMO_PERIOD: {
    readonly start: "2026-01-01T00:00:00Z";
};

/**
 * Placeholder Tenant id.
 *
 * The placeholder is a **system sentinel**, not a user-facing demo
 * tenant. It exists for two reasons:
 *
 *   1. `pre-token-generation.handler.ts` stamps this id into the
 *      JWT `ohi_tid` claim when a User cannot be resolved (no
 *      DynamoDB record, missing `currentTenant`/`currentWorkspace`,
 *      etc.) so the token still satisfies `openHiContextMiddleware`
 *      and downstream APIs return a deterministic 403 instead of
 *      crashing on a missing claim.
 *   2. The seed workflow re-asserts a Tenant + Workspace record at
 *      these ids so the JWT fallback dereferences to a real DynamoDB
 *      row (avoids dangling references on read paths that follow
 *      `Tenant/placeholder-tenant-id`).
 *
 * Dev users' `currentTenant`/`currentWorkspace` no longer point here
 * (issue #1301) — they point at the on-site demo tenant below. The
 * placeholder records remain seeded purely as a structural sentinel.
 */
declare const PLACEHOLDER_TENANT_ID = "placeholder-tenant-id";
/** Placeholder Workspace id. See {@link PLACEHOLDER_TENANT_ID}. */
declare const PLACEHOLDER_WORKSPACE_ID = "placeholder-workspace-id";
/**
 * Stable Tenant id for the on-site-medical UAT demo tenant
 * (issue #1301). Downstream demo-data tickets (#1302 providers,
 * #1303 facilities, #1304 patients/encounters, etc.) import this
 * constant to attach their fixture resources without re-discovering
 * the tenant.
 *
 * This is the tenant every seeded dev user lands on at sign-in
 * (`currentTenant` on the seeded User resource). UAT testers see
 * "On-Site Medical — Demo" in the Tenant Switcher on first sign-in.
 */
declare const ON_SITE_DEMO_TENANT_ID = "01KDVDNKKD34R8DX97HRR0N69J";
/**
 * Stable Workspace id under {@link ON_SITE_DEMO_TENANT_ID}. Single
 * workspace for v1 UAT; workspace topology (per business line vs
 * per jurisdiction) is deferred pending an ADR (#1301 design note).
 */
declare const ON_SITE_DEMO_WORKSPACE_ID = "01KDVDPKNJ9MZYC1PH8S4VTC7S";
/**
 * Dev-user descriptor. Every entry produces:
 *   - one Cognito user (idempotent create-then-skip),
 *   - one DynamoDB User record (id = a static ULID),
 *   - five Memberships (placeholder + on-site demo + three demo tenants),
 *   - five `tenant-admin` RoleAssignments (one per tenant the user
 *     belongs to),
 *   - one `system-admin` RoleAssignment scoped to {@link PLATFORM_SCOPE_TENANT_ID}.
 */
interface DemoDevUser {
    /** Stable DynamoDB User id. */
    readonly id: string;
    /** Email used as the Cognito `Username` and as the seed for the password algorithm. */
    readonly email: string;
    /** Given name, populated on the seeded User FHIR resource as `name[0].given[0]`. */
    readonly firstName: string;
    /** Family name, populated on the seeded User FHIR resource as `name[0].family`. */
    readonly lastName: string;
}
/**
 * Hardcoded dev-user roster. Adding a new developer is a one-line
 * change here plus a re-deploy. The list intentionally lives in-source
 * (not behind an env-var seam) so the IAM grant in
 * `seed-demo-data-lambda.ts` can enumerate per-user PKs at synth time.
 */
declare const DEV_USERS: ReadonlyArray<DemoDevUser>;
/**
 * A single workspace inside a demo tenant. The mixed tenant has two
 * workspaces (wound-care and primary-care sub-workspaces); every
 * other tenant (placeholder, on-site demo, wound-care, primary-care)
 * has exactly one.
 */
interface DemoWorkspaceSpec {
    /** Stable id (DynamoDB record id; also drives the canonical OHI URN). */
    readonly id: string;
    /** FHIR `Workspace.name`. */
    readonly name: string;
    /**
     * Role suffix used in the demo URN value (`<scenario>:<roleSuffix>`).
     * `workspace` for single-workspace tenants, `workspace-<sub>` for the
     * mixed tenant.
     */
    readonly roleSuffix: string;
}
/**
 * One demo tenant + the workspaces it owns. Re-exported via {@link
 * DEMO_TENANT_SPECS} as the canonical list; iterate that constant in
 * the handler and the IAM-grant builder so the value sets agree.
 */
interface DemoTenantSpec {
    /**
     * Scenario slug — `placeholder`, `on-site-demo`, `demo-wound-care`,
     * `demo-primary-care`, `demo-mixed`. The placeholder tenant uses
     * `placeholder`; the on-site UAT demo tenant uses `on-site-demo`
     * (#1301); the three demo tenants use `demo-*` slugs.
     */
    readonly scenario: string;
    /** Stable id (DynamoDB record id; also drives the canonical OHI URN). */
    readonly tenantId: string;
    /** FHIR `Tenant.name`. */
    readonly tenantName: string;
    /** Workspaces owned by this tenant. */
    readonly workspaces: ReadonlyArray<DemoWorkspaceSpec>;
}
/**
 * Static ULID ids for the three v1 demo-scenario tenants and their
 * workspaces. Hardcoded constants so they are byte-identical on every
 * seed run and match the ULID format the control-plane create
 * operations now produce (#1329). Referenced from {@link
 * DEMO_TENANT_SPECS} and the data-plane fixtures so the value lives in
 * exactly one place.
 */
declare const DEMO_WOUND_CARE_TENANT_ID = "01KDVDQTK67CT2EEJ9DNMYSX05";
declare const DEMO_WOUND_CARE_WORKSPACE_ID = "01KDVDRVPEDF48EAZCRSR7QSW5";
declare const DEMO_PRIMARY_CARE_TENANT_ID = "01KDVDTC89KK3422W49AXCDW3Q";
declare const DEMO_PRIMARY_CARE_WORKSPACE_ID = "01KDVDVEMA0TEFDGPX6TDRJ857";
declare const DEMO_MIXED_TENANT_ID = "01KDVDWQFMN07BY8QSVZQA5AS9";
declare const DEMO_MIXED_WORKSPACE_WOUND_CARE_ID = "01KDVDXJSHA1C3B1NY1QEZRMK2";
declare const DEMO_MIXED_WORKSPACE_PRIMARY_CARE_ID = "01KDVDYQBFSRE80N3PZQXWEB3Y";
/**
 * The placeholder tenant spec — the system-sentinel entry the
 * JWT-claim fallback resolves to. Exported so tester wiring can add a
 * tenant-level placeholder Membership without depending on
 * {@link DEMO_TENANT_SPECS} ordering.
 */
declare const PLACEHOLDER_TENANT_SPEC: DemoTenantSpec;
/**
 * The full demo-tenant graph. Five entries: the placeholder tenant
 * the JWT-claim fallback resolves to, the on-site-medical UAT demo
 * tenant every dev user lands on at sign-in (#1301), and the three
 * v1 demo scenarios (OPS-009 §"v1 scenarios"):
 *
 *   0. Placeholder tenant — dereferences the JWT-claim fallback in
 *      `pre-token-generation.handler.ts`. Carries no user-facing
 *      content; exists purely so the JWT fallback resolves to a real
 *      DynamoDB row instead of dangling.
 *   1. On-site-medical UAT demo tenant — every seeded dev user's
 *      `currentTenant`/`currentWorkspace`. Downstream demo-data
 *      tickets (providers, facilities, patients) attach to this
 *      tenant via {@link ON_SITE_DEMO_TENANT_ID}.
 *   2. Single-workspace wound-care tenant.
 *   3. Single-workspace primary-care tenant.
 *   4. Two-workspace mixed tenant — exercises the cross-workspace
 *      isolation flow that single-workspace tenants cannot.
 */
declare const DEMO_TENANT_SPECS: ReadonlyArray<DemoTenantSpec>;
/**
 * Static ULID ids for the three on-site UAT tenants (#1327) and their
 * Oklahoma + Texas workspaces. Hardcoded constants so they are
 * byte-identical on every seed run and match the ULID format the
 * control-plane create operations produce (#1329).
 */
declare const ON_SITE_WOUNDS_TENANT_ID = "01KDY03CJBF6FWQG9B8WXYXXS6";
declare const ON_SITE_WOUNDS_OKLAHOMA_WORKSPACE_ID = "01KDY03KW88CNSGKNB89M7FS2X";
declare const ON_SITE_WOUNDS_TEXAS_WORKSPACE_ID = "01KDY04FCGYXVQGS24S0NG1ETM";
declare const ON_SITE_MEDICAL_TENANT_ID = "01KDY063WE34DWA3J5260BSEME";
declare const ON_SITE_MEDICAL_OKLAHOMA_WORKSPACE_ID = "01KDY06QV8DKYJJZ7X1DP0GGDD";
declare const ON_SITE_MEDICAL_TEXAS_WORKSPACE_ID = "01KDY074RZXRZS5K9TBRCVVSX1";
declare const ON_SITE_CLINIC_TENANT_ID = "01KDY07XGSMPX7AAM6ZJN8HWS2";
declare const ON_SITE_CLINIC_OKLAHOMA_WORKSPACE_ID = "01KDY08F0J7DPTM7XZKV72QFNV";
declare const ON_SITE_CLINIC_TEXAS_WORKSPACE_ID = "01KDY0A1YYY5TT4A1SP96KTF0G";
/**
 * The three on-site UAT tenants (#1327): On-Site Wounds, On-Site
 * Medical, and On-Site Clinic, each with an Oklahoma and a Texas
 * workspace. Seeded alongside — and kept separate from — the existing
 * demo-tenant graph ({@link DEMO_TENANT_SPECS}): the demo dev-user
 * membership/role wiring does NOT apply to these tenants. The UAT
 * tester roster and its per-workspace memberships land in #1328.
 */
declare const ON_SITE_UAT_TENANT_SPECS: ReadonlyArray<DemoTenantSpec>;
/**
 * On-site UAT tester descriptor (#1328). Each tester becomes a Cognito
 * login user, a DynamoDB User (FHIR HumanName + email telecom), a
 * tenant-level plus two workspace-level Memberships in every on-site
 * UAT tenant, a tenant-level Membership in the placeholder tenant, and
 * one tenant-level RoleAssignment carrying {@link role} in each tenant
 * (on-site and placeholder).
 */
interface OnSiteTester {
    /** Stable DynamoDB User id (static ULID). */
    readonly id: string;
    /** Cognito `Username` and the email-telecom value on the User. */
    readonly email: string;
    /** FHIR `HumanName.text` (the full display name). */
    readonly displayName: string;
    /** FHIR `HumanName.given[0]`, when a given name is known. */
    readonly given?: string;
    /** FHIR `HumanName.family`, when a family name is known. */
    readonly family?: string;
    /** Platform Role held in every on-site UAT tenant. */
    readonly role: PlatformRoleCode;
}
/**
 * The on-site UAT testers (#1328). Kim, Kera, Nicole, and the seven
 * extended-roster testers (Ashton, Debbie, Kim Berkey, Fanniesha,
 * Brittany Jones, Sabrina, Stacey Cauthen) are `tenant-admin`; the
 * rest are `tenant-user`. Every tester is a member of all three
 * on-site UAT tenants (both the Oklahoma and Texas workspaces in each)
 * and of the placeholder tenant. Names are best-effort FHIR HumanNames
 * — single-name and credentialed entries carry only the parts that are
 * known.
 */
declare const ON_SITE_TESTERS: ReadonlyArray<OnSiteTester>;
/** Stable Membership id for a principal's tenant-level on-site membership. */
declare const onSiteTenantMembershipId: (userId: string, tenantId: string) => string;
/** Stable Membership id for a principal's workspace-level on-site membership. */
declare const onSiteWorkspaceMembershipId: (userId: string, workspaceId: string) => string;
/** Stable RoleAssignment id for a principal's on-site tenant role. */
declare const onSiteRoleAssignmentId: (userId: string, tenantId: string, roleCode: PlatformRoleCode) => string;
/** Stable Membership id derived from `(devUserId, tenantId)`. */
declare const demoMembershipId: (devUserId: string, tenantId: string) => string;
/**
 * Stable RoleAssignment id derived from `(devUserId, tenantId, roleCode)`.
 * Each (user, tenant, role) tuple maps to exactly one record — re-runs
 * upsert the same id.
 */
declare const demoRoleAssignmentId: (devUserId: string, tenantId: string, roleCode: PlatformRoleCode) => string;
/**
 * Demo-scenario FHIR `Identifier` entry — `urn:openhi:demo:<scenario>:<role>`.
 */
declare const demoScenarioIdentifier: (scenario: string, roleSuffix: string) => {
    system: string;
    value: string;
};
/**
 * Canonical OpenHI resource FHIR `Identifier` entry per ADR
 * 2026-03-12-01. `workspaceId` is empty for both Tenant resources and
 * Workspace resources — for a Tenant, the resource is tenant-scoped
 * with no workspace context; for a Workspace, the resource IS the
 * workspace identity rather than living inside one.
 *
 * `use` is `official` — the R4 `Identifier.use` binding is required,
 * so the URN's versioned/unversioned distinction is carried by the
 * presence of a `#<version>` fragment in the value, never by `use`.
 */
declare const openhiResourceIdentifier: (params: {
    tenantId: string;
    workspaceId: string;
    resourceType: string;
    id: string;
}) => {
    use: IdentifierUse;
    system: string;
    value: string;
};
/**
 * Roles every dev user holds in every tenant they belong to. Per scope
 * decision Q3, every dev user is `tenant-admin` in every tenant — there
 * is no per-(user, tenant) variance to drive from.
 */
declare const demoRolesForUserInTenant: (_user: DemoDevUser, _tenantId: string) => ReadonlyArray<PlatformRoleCode>;

export { type OnSiteTester as A, PLACEHOLDER_TENANT_SPEC as B, PLACEHOLDER_WORKSPACE_ID as C, DEMO_MIXED_TENANT_ID as D, demoMembershipId as E, demoRoleAssignmentId as F, demoRolesForUserInTenant as G, demoScenarioIdentifier as H, onSiteRoleAssignmentId as I, onSiteTenantMembershipId as J, onSiteWorkspaceMembershipId as K, openhiResourceIdentifier as L, ON_SITE_CLINIC_OKLAHOMA_WORKSPACE_ID as O, PLACEHOLDER_TENANT_ID as P, SEED_DEMO_DATA_CONSUMER_NAME as S, DEMO_MIXED_WORKSPACE_PRIMARY_CARE_ID as a, DEMO_MIXED_WORKSPACE_WOUND_CARE_ID as b, DEMO_PERIOD as c, DEMO_PRIMARY_CARE_TENANT_ID as d, DEMO_PRIMARY_CARE_WORKSPACE_ID as e, DEMO_TENANT_SPECS as f, DEMO_URN_SYSTEM as g, DEMO_WOUND_CARE_TENANT_ID as h, DEMO_WOUND_CARE_WORKSPACE_ID as i, DEV_USERS as j, type DemoDevUser as k, type DemoTenantSpec as l, type DemoWorkspaceSpec as m, ON_SITE_CLINIC_TENANT_ID as n, ON_SITE_CLINIC_TEXAS_WORKSPACE_ID as o, ON_SITE_DEMO_TENANT_ID as p, ON_SITE_DEMO_WORKSPACE_ID as q, ON_SITE_MEDICAL_OKLAHOMA_WORKSPACE_ID as r, ON_SITE_MEDICAL_TENANT_ID as s, ON_SITE_MEDICAL_TEXAS_WORKSPACE_ID as t, ON_SITE_TESTERS as u, ON_SITE_UAT_TENANT_SPECS as v, ON_SITE_WOUNDS_OKLAHOMA_WORKSPACE_ID as w, ON_SITE_WOUNDS_TENANT_ID as x, ON_SITE_WOUNDS_TEXAS_WORKSPACE_ID as y, OPENHI_RESOURCE_URN_SYSTEM as z };
