import { Construct } from 'constructs';
import * as bicep from '../deploy';
import * as graph from '../resources/graph';
/**
 * Well-known OIDC audience values for common providers
 */
export declare enum OidcAudience {
    /** AWS Security Token Service */
    AWS_STS = "sts.amazonaws.com",
    /** Azure AD Token Exchange for Workload Identity Federation */
    AZURE_AD_TOKEN_EXCHANGE = "api://AzureADTokenExchange",
    /** Microsoft Graph API */
    MICROSOFT_GRAPH = "https://graph.microsoft.com",
    /** Kubernetes default service account */
    KUBERNETES = "https://kubernetes.default.svc"
}
/**
 * Configuration for external identity trusted to request tokens
 */
export interface TrustedTokenRequesterConfig {
    /** OIDC issuer URL that Azure AD trusts */
    readonly issuer: string;
    /** Subject (sub) claim identifying the trusted workload */
    readonly sub: string;
    /** Audience (aud) values for token validation - use OidcAudience enum or custom strings */
    readonly aud: string[];
}
/**
 * Properties for Azure AD application with federated credentials.
 */
export interface AzureAdApplicationFederatedProps {
    /** Name of the Azure AD application */
    readonly appName: string;
    /** Redirect URIs for OAuth callbacks */
    readonly redirectUris: string[];
    /** Supported account types for sign-in (defaults to single tenant) */
    readonly signInAudience?: graph.SignInAudience;
    /** Azure resource group name */
    readonly resourceGroupName: string;
    /** Azure AD groups to create */
    readonly groups?: string[];
    /** Azure federated credentials for deployment */
    readonly deploymentCredentials: bicep.AzureFederatedCredentials;
    /** External identity trusted to request tokens */
    readonly trustedTokenRequester: TrustedTokenRequesterConfig;
    /** Enable AWS session tag mapping via Custom Claims Provider (requires groups to be defined) */
    readonly enableAwsSessionTagMapping?: boolean;
}
export declare class AzureAdApplicationFederated extends Construct {
    /** All deployment outputs */
    readonly outputs: Record<string, string>;
    /** Trusted token requester configuration */
    readonly trustedTokenRequester: TrustedTokenRequesterConfig;
    constructor(scope: Construct, id: string, props: AzureAdApplicationFederatedProps);
    private buildResources;
    private buildCustomClaimsProvider;
    private sanitizeIdentifier;
}