import * as webappDeploy from "@capraconsulting/webapp-deploy-lambda";
import type * as certificatemanager from "aws-cdk-lib/aws-certificatemanager";
import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
import * as r53 from "aws-cdk-lib/aws-route53";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as constructs from "constructs";
import { type WebappSecurityHeadersProps } from "./security-headers";
export interface WebappProps {
    /**
     * ACM certificate that covers the specifeid domain names.
     *
     * This certificate must be created in the region us-east-1.
     *
     * @default - The CloudFront wildcard certificate (*.cloudfront.net) will be used.
     */
    cloudfrontCertificate?: certificatemanager.ICertificate;
    /**
     * List of domain names the CloudFront distribution should use.
     *
     * @default - Generated name (e.g., d111111abcdef8.cloudfront.net)
     */
    domainNames?: string[];
    /**
     * AWS WAF web ACL to associate with the CloudFront distribution.
     *
     * To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
     * `arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`.
     * To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a`.
     *
     * @default - No AWS Web Application Firewall web access control list (web ACL).
     */
    webAclId?: string;
    /**
     * The path to the page that will be served for users not allowed to access
     * the site when using WAF. E.g. "/4xx-errors/403-forbidden.html".
     *
     * Note that this wil catch any 403 errors from the origin(s), that might
     * cover any other behaviors is added.
     *
     * @default - No custom page for 403 errors.
     */
    webAclErrorPagePath?: string;
    /**
     *  Enable, disable or configure security headers for the web application
     * @default - a set of strict security headers are configured by default
     */
    securityHeaders?: {
        /**
         * Enable adding common security headers to CloudFront responses
         *
         * If enabled, the default behavior is to add the following headers with fairly strict defaults. Most of the headers can be customized:
         * - Content-Security-Policy
         * - Referrer-Policy
         * - Strict-Transport-Security
         * - X-Content-Type-Options
         * - X-Frame-Options
         * - X-XSS-Protection
         *
         *
         * @default true
         */
        enabled?: boolean;
        /**
         * Security headers overrides.
         *
         * Used to override certain default security header values if the webapp requires different settings than the defaults.
         *
         * NOTE: If you need to disable certain headers, you must explicitly set them to undefined
         *
         * @default - A set of strict security header values will be used
         */
        behaviorOverrides?: WebappSecurityHeadersProps;
    };
    /**
     * Cloudfront behavior overrides.
     *
     * Used to override cloudfront behavior
     *
     * NOTE: ResponseHeadersPolicy defined here will overwrite BOTH the default security headers policy and
     * any values specified in securityHeaders.behaviorOverrides.
     */
    overrideCloudFrontBehaviourOptions?: Partial<cloudfront.BehaviorOptions>;
    /**
     * Distribution props overrides.
     *
     * Used to override default (AWS or Liflig) configuration
     */
    overrideDistributionProps?: Partial<cloudfront.DistributionProps>;
}
/**
 * CloudFront for a Single-Page-Application.
 *
 * A bucket will be created and its prefix "web" is used to
 * serve files. Use the addDeployment method to automatically
 * deploy files as part the the CDK deployment.
 */
export declare class Webapp extends constructs.Construct {
    readonly distribution: cloudfront.Distribution;
    readonly webappBucket: s3.Bucket;
    readonly webappOrigin: cloudfront.IOrigin;
    constructor(scope: constructs.Construct, id: string, props: WebappProps);
    addDnsRecord(hostedZone: r53.IHostedZone, domainName: string): void;
    /**
     * Add a deployment using webapp-deploy-lambda.
     *
     * See https://github.com/capraconsulting/webapp-deploy-lambda
     * for details about how this works.
     */
    addDeployment(
    /**
     * The deployment source.
     */
    source: webappDeploy.ISource, props?: {
        /**
         * Include source maps in the deployment.
         *
         * @default false
         */
        deploySourceMaps?: boolean;
    }): void;
}