/**
 * Certificate-to-User Mapping
 *
 * Maps X.509 certificate attributes to user identities using
 * various strategies (UPN, SAN, Subject DN, etc.).
 *
 * Features:
 * - Multiple mapping strategies
 * - Rule-based mapping with priority
 * - DoD EDIPI extraction
 * - Custom attribute mapping
 * - Tenant assignment
 *
 * @packageDocumentation
 */
import { type ParsedCertificate, type MappedUserIdentity, type CertificateMappingRule, CertificateMappingStrategy, PIVErrorCode } from './types.js';
/**
 * Certificate mapping error
 */
export declare class CertificateMappingError extends Error {
    readonly code: PIVErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code?: PIVErrorCode, details?: Record<string, unknown>);
}
/**
 * No matching rule error
 */
export declare class NoMatchingRuleError extends CertificateMappingError {
    constructor(certificate: ParsedCertificate);
}
/**
 * Attribute not found error
 */
export declare class AttributeNotFoundError extends CertificateMappingError {
    constructor(attribute: string, strategy: CertificateMappingStrategy);
}
/**
 * Certificate to user identity mapper
 */
export declare class CertificateMapper {
    private rules;
    private customMappers;
    constructor(rules?: CertificateMappingRule[]);
    /**
     * Map a certificate to a user identity
     */
    mapCertificate(certificate: ParsedCertificate): MappedUserIdentity;
    /**
     * Check if a rule matches the certificate
     */
    private ruleMatches;
    /**
     * Apply a mapping rule to extract user identity
     */
    private applyRule;
    /**
     * Try default mapping strategies
     */
    private tryDefaultStrategies;
    /**
     * Map by User Principal Name (UPN) in SAN
     */
    private mapByUPN;
    /**
     * Map by Subject Alternative Name (SAN)
     */
    private mapBySAN;
    /**
     * Map by email address
     */
    private mapByEmail;
    /**
     * Map by Subject Distinguished Name attribute
     */
    private mapBySubjectDN;
    /**
     * Map by certificate serial number and issuer
     */
    private mapBySerialIssuer;
    /**
     * Extract EDIPI (DoD Electronic Data Interchange Personal Identifier) from certificate
     */
    private extractEDIPI;
    /**
     * Extract a generic attribute from certificate
     */
    private extractAttribute;
    /**
     * Add a mapping rule
     */
    addRule(rule: CertificateMappingRule): void;
    /**
     * Remove a mapping rule
     */
    removeRule(name: string): boolean;
    /**
     * Get all rules
     */
    getRules(): CertificateMappingRule[];
    /**
     * Register a custom mapper function
     */
    registerCustomMapper(name: string, mapper: (cert: ParsedCertificate) => MappedUserIdentity | undefined): void;
    /**
     * Unregister a custom mapper
     */
    unregisterCustomMapper(name: string): boolean;
}
/**
 * Default DoD CAC mapping rule
 */
export declare const DOD_CAC_RULE: CertificateMappingRule;
/**
 * Default PIV mapping rule
 */
export declare const PIV_RULE: CertificateMappingRule;
/**
 * Fallback email mapping rule
 */
export declare const EMAIL_FALLBACK_RULE: CertificateMappingRule;
/**
 * Fallback CN mapping rule
 */
export declare const CN_FALLBACK_RULE: CertificateMappingRule;
/**
 * Default mapping rules
 */
export declare const DEFAULT_MAPPING_RULES: CertificateMappingRule[];
/**
 * Get the default certificate mapper
 */
export declare function getCertificateMapper(rules?: CertificateMappingRule[]): CertificateMapper;
/**
 * Create a new certificate mapper
 */
export declare function createCertificateMapper(rules?: CertificateMappingRule[]): CertificateMapper;
/**
 * Reset the default mapper (for testing)
 */
export declare function resetCertificateMapper(): void;
//# sourceMappingURL=certificate-mapper.d.ts.map