import { Extension, ExtensionConfig } from '../patterns/securedCloudFront';
export interface ComposerConfig {
    readonly tenantId?: string;
    readonly cognitoDomain?: string;
    readonly clientId?: string;
    readonly redirectUri?: string;
    readonly cookieDomain?: string;
    readonly requireMfa?: boolean;
    /** Enable header stripping and injection from JWT claims. @default false */
    readonly enableHeaderInjection?: boolean;
    /** Map of header name → JWT claim key. e.g. { 'x-customer-id': 'customer_id' } */
    readonly headerInjectionClaims?: Record<string, string>;
    /** Enable refresh redirect for expired-but-valid tokens. @default false */
    readonly enableRefresh?: boolean;
    /**
     * Custom-UI mode: first-party path to redirect unauthenticated users to
     * (e.g. '/login'). When set, the shared auth-check module is used with a
     * relative redirect instead of an external IdP authorize URL.
     */
    readonly loginRedirectPath?: string;
}
/**
 * Generates a combined CloudFront Function from modular check functions
 * based on requested extensions
 */
export declare class FunctionComposer {
    private readonly modulesDir;
    constructor();
    /**
     * Generate combined function code based on requested extensions
     */
    compose(extensions: Extension[], config?: ExtensionConfig, composerConfig?: ComposerConfig): string;
    private loadModule;
    private generateHandler;
}