import { aws_wafv2 as wafv2 } from 'aws-cdk-lib';
import * as constructs from 'constructs';
import { Country } from './countries';
export { Country, CountryCode } from './countries';
export type CountryName = keyof typeof Country;
/**
 * Path-specific rate limit configuration.
 */
export interface PathRateLimit {
    /** URI path pattern (e.g., '/oauth2/callback', '/api/auth/*') */
    readonly path: string;
    /** Rate limit for this path (requests per 5 minutes) */
    readonly rateLimit: number;
    /** Optional name for the rule (auto-generated if not provided) */
    readonly name?: string;
}
/**
 * Properties for CloudFrontWebAcl construct.
 */
export interface CloudFrontWebAclProps {
    /** Name for the Web ACL */
    readonly name?: string;
    /** Whether to enable AWS managed rules (default: true) */
    readonly enableManagedRules?: boolean;
    /** Custom rules to add to the Web ACL */
    readonly rules?: wafv2.CfnWebACL.RuleProperty[];
    /** Rate limit for requests per 5 minutes (default: 2000) */
    readonly rateLimit?: number;
    /** Path-specific rate limits (overrides default rateLimit for matching paths) */
    readonly pathRateLimits?: PathRateLimit[];
    /** Allow requests only from these countries (all others blocked) */
    readonly allowedCountries?: CountryName[];
    /** Block requests from these countries (all others allowed) */
    readonly blockedCountries?: CountryName[];
}
/**
 * Creates a WAF WebACL in us-east-1 for use with CloudFront.
 *
 * CloudFront requires WAF WebACLs to be in us-east-1 with CLOUDFRONT scope.
 * This construct uses a custom resource to create the WebACL in us-east-1
 * regardless of the stack's region.
 *
 * Provides sensible defaults with AWS managed rules for common threats.
 *
 * @example
 * ```typescript
 * const webAcl = new CloudFrontWebAcl(this, 'WebAcl', {
 *   name: 'MyCloudFrontWebAcl',
 *   rateLimit: 10000, // Default for all paths
 *   pathRateLimits: [
 *     { path: '/oauth2/callback', rateLimit: 100 },
 *     { path: '/oauth2/authorize', rateLimit: 100 },
 *     { path: '/api/auth', rateLimit: 500 },
 *   ],
 *   allowedCountries: ['UnitedStates', 'Canada', 'UnitedKingdom'],
 * });
 *
 * new cloudfront.Distribution(this, 'Distribution', {
 *   webAclId: webAcl.webAclArn,
 *   // ...
 * });
 * ```
 */
export declare class CloudFrontWebAcl extends constructs.Construct {
    /** The WebACL ARN */
    readonly webAclArn: string;
    /** The WebACL ID */
    readonly webAclId: string;
    private readonly webAcl;
    constructor(scope: constructs.Construct, id: string, props?: CloudFrontWebAclProps);
    private buildRules;
}