import { type IOpenIdConnectProvider, OpenIdConnectPrincipal } from "aws-cdk-lib/aws-iam";
import type { IConstruct } from "constructs";
import { type IOpenIdConnectProviderBuilder } from "./open-id-connect-provider-builder.js";
/**
 * Produces a GitHub OIDC `sub`-claim string for a `owner/repo` slug. This is
 * the trust-policy security boundary — it decides which workflows may assume
 * the role. Use the {@link Subject} constructors rather than hand-writing
 * these strings.
 */
export type SubjectFactory = (ownerRepo: string) => string;
/**
 * Type-safe constructors for GitHub Actions OIDC `sub` claims, covering the
 * standard workflow-scoping shapes.
 *
 * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-subject-claims
 *
 * @example
 * ```ts
 * githubActions.Subject.branch("main");        // repo:acme/app:ref:refs/heads/main
 * githubActions.Subject.pullRequest();         // repo:acme/app:pull_request
 * githubActions.Subject.environment("prod");   // repo:acme/app:environment:prod
 * githubActions.Subject.tag("v*");             // repo:acme/app:ref:refs/tags/v*
 * ```
 */
export declare const Subject: {
    /** A push to the named branch: `repo:<owner>/<repo>:ref:refs/heads/<name>`. */
    readonly branch: (name: string) => SubjectFactory;
    /** A push of the matching tag: `repo:<owner>/<repo>:ref:refs/tags/<pattern>`. */
    readonly tag: (pattern: string) => SubjectFactory;
    /** A pull-request run: `repo:<owner>/<repo>:pull_request`. */
    readonly pullRequest: () => SubjectFactory;
    /** A deployment to the named GitHub Environment: `repo:<owner>/<repo>:environment:<name>`. */
    readonly environment: (name: string) => SubjectFactory;
    /** An escape hatch for any other claim suffix: `repo:<owner>/<repo>:<suffix>`. */
    readonly custom: (suffix: string) => SubjectFactory;
};
/**
 * Options for {@link principal}.
 */
export interface PrincipalOptions {
    /** The repository owner (user or organisation). */
    readonly owner: string;
    /** The repository name. */
    readonly repo: string;
    /**
     * The GitHub OIDC provider the role federates with — build one with
     * {@link provider} or reference the account singleton with
     * {@link importProvider}.
     */
    readonly provider: IOpenIdConnectProvider;
    /**
     * The workflow scopes allowed to assume the role. **At least one is
     * required** — an empty list would trust every workflow in the repository's
     * account namespace. Build entries with {@link Subject}.
     *
     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_permissions_reduce_permissions.html
     */
    readonly subjects: SubjectFactory[];
    /** Override the audience (`aud`); defaults to `sts.amazonaws.com`. */
    readonly audience?: string;
}
/**
 * Builds a GitHub Actions OIDC principal for `createRoleBuilder().assumedBy(...)`.
 *
 * Encodes the GitHub issuer host and pins the audience with `StringEquals`
 * while scoping `sub` with `StringLike`, so callers cannot accidentally pick
 * the wrong operator or forget the audience guard. The subject list is the
 * security boundary and must be non-empty.
 *
 * @throws when `subjects` is empty, or `owner`/`repo` is empty or contains "/".
 */
export declare function principal(opts: PrincipalOptions): OpenIdConnectPrincipal;
/**
 * A {@link createOpenIdConnectProviderBuilder | provider builder} preset with
 * the GitHub Actions issuer URL and audience. Every value stays overridable via
 * the fluent API.
 *
 * Only one GitHub OIDC provider may exist per account — if one already exists,
 * reference it with {@link importProvider} instead of building a second.
 *
 * @example
 * ```ts
 * const { provider } = githubActions.provider().build(stack, "GithubOidcProvider");
 * ```
 */
export declare function provider(): IOpenIdConnectProviderBuilder;
/**
 * Imports the account-singleton GitHub Actions OIDC provider by its
 * conventional ARN, so callers never hand-write the ARN format.
 *
 * @example
 * ```ts
 * const provider = githubActions.importProvider(stack, "GithubOidcProvider");
 * ```
 */
export declare function importProvider(scope: IConstruct, id: string): IOpenIdConnectProvider;
//# sourceMappingURL=github-actions.d.ts.map