import * as core from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import * as constructs from 'constructs';
export interface AppSpec {
    readonly name: string;
    readonly groups?: string[];
}
export interface AuthInfrastructureProps {
    readonly ssmParamPrefix?: string;
    readonly zoneName: string;
    /** Domains permitted as the request host during OAuth callback (e.g. subdomains served by the distribution). @default [zoneName] */
    readonly allowedDomains?: string[];
    readonly tenantId: string;
    readonly clientId: string;
    readonly oauth2CallbackRoleName: string;
    readonly appSpec: AppSpec;
    readonly cookieDomain?: string;
    readonly securityAlertsTopicArn?: string;
    readonly sessionRevocationTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    readonly hmacSecretRotationSchedule?: core.Duration;
    readonly auditLogRetentionDays?: number;
    readonly auditArchiveRetentionDays?: number;
    readonly auditLogBucketName?: string;
    readonly auditLogDatabaseName?: string;
    /** ARN of an existing OIDC provider to reuse (skips creating a new one). Use when the same tenant already has a provider in this account. */
    readonly existingOidcProviderArn?: string;
    readonly removalPolicy?: core.RemovalPolicy;
    /** URL for the post-auth identity hook. @default undefined */
    readonly postAuthHookUrl?: string;
    /** Timeout in seconds for the post-auth hook. @default 3 */
    readonly postAuthHookTimeout?: number;
    /** Fail closed if hook is unavailable. @default true */
    readonly postAuthHookFailClosed?: boolean;
    /** Enable refresh token storage. @default false */
    readonly enableRefresh?: boolean;
}
export declare class AuthInfrastructure extends constructs.Construct {
    readonly configSecretArn: string;
    readonly kmsKeyArn: string;
    readonly authTableArn: string;
    readonly kvsArn: string;
    readonly tenantId: string;
    readonly clientId: string;
    readonly oauth2CallbackRoleName: string;
    readonly oidcProvider: iam.IOpenIdConnectProvider;
    constructor(scope: constructs.Construct, id: string, props: AuthInfrastructureProps);
}