import { aws_cloudfront as cloudfront, aws_secretsmanager as secretsmanager, aws_kms as kms } from 'aws-cdk-lib';
import * as constructs from 'constructs';
export interface AuthSecretManagerProps {
    readonly domainName: string;
    readonly tableName: string;
    readonly tableRegion: string;
    readonly azureTenantId: string;
    readonly azureClientId: string;
    readonly stsAudience: string;
    readonly cookieDomain?: string;
    /** Domains permitted as the request host during OAuth callback. @default [domainName] */
    readonly allowedDomains?: string[];
    readonly securityAlertsTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    /** URL for the post-auth identity hook. Called after token exchange to resolve app-specific claims. @default undefined (no hook) */
    readonly postAuthHookUrl?: string;
    /** Timeout in seconds for the post-auth hook call. @default 3 */
    readonly postAuthHookTimeout?: number;
    /** Whether to deny auth if the hook fails or is unavailable. @default true */
    readonly postAuthHookFailClosed?: boolean;
    /** Whether to store refresh tokens for silent session renewal. @default false */
    readonly enableRefresh?: boolean;
}
export declare class AuthSecretManager extends constructs.Construct {
    readonly kmsKey: kms.Key;
    readonly configSecret: secretsmanager.Secret;
    readonly kvs: cloudfront.KeyValueStore;
    constructor(scope: constructs.Construct, id: string, props: AuthSecretManagerProps);
}