export type AttestationType = "oidc_id_token" | "saml_assertion" | "aws_signed_identity" | "azure_managed_identity" | "x509_cert" | "github_oidc" | "spiffe_svid" | "custom";
export interface ExternalIdentityReference {
    /** Canonical IdP identifier. Free-form but stable per `attestation_type`. */
    issuer: string;
    /** Subject identifier within the external IdP. */
    external_id: string;
    attestation_type: AttestationType;
    /**
     * Original attestation token / signed assertion as base64url. Verifiable
     * by relying parties out-of-band against the IdP's published keys.
     */
    attestation_proof: string;
    /** When the external system attested this identity. ISO 8601 UTC. */
    attested_at: string;
    /** Optional JWKS / metadata endpoint for relying-party verification. */
    jwks_uri?: string;
    /**
     * SHA-256 hex of the IdP's public key (or cert) at attestation time.
     * Lets relying parties detect IdP key rotation without contacting the IdP.
     */
    issuer_key_fingerprint?: string;
}
//# sourceMappingURL=external-identity-reference.d.ts.map