import * as core from 'aws-cdk-lib';
import { aws_cognito as cognito } from 'aws-cdk-lib';
import * as constructs from 'constructs';
import { AppSpec } from './authInfrastructure';
export interface CognitoAuthInfrastructureProps {
    readonly ssmParamPrefix?: string;
    readonly zoneName: string;
    readonly appSpec: AppSpec;
    readonly cognitoDomainPrefix: string;
    readonly securityAlertsTopicArn?: string;
    readonly sessionRevocationTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    readonly hmacSecretRotationSchedule?: core.Duration;
    readonly auditLogRetentionDays?: number;
    readonly auditArchiveRetentionDays?: number;
    readonly removalPolicy?: core.RemovalPolicy;
}
/**
 * Convenience facade that composes a {@link CognitoCustomerPool} (identity
 * provider) and a {@link CognitoSessionBackend} (session substrate) with the
 * original bundled defaults. Existing consumers keep the same public API.
 *
 * New projects that need finer control (per-brand app clients, SMS MFA, advanced
 * security, identity-pool ABAC, a separately-managed session backend) should use
 * {@link CognitoCustomerPool} and {@link CognitoSessionBackend} directly.
 */
export declare class CognitoAuthInfrastructure extends constructs.Construct {
    readonly configSecretArn: string;
    readonly kmsKeyArn: string;
    readonly authTableArn: string;
    readonly kvsArn: string;
    readonly userPool: cognito.UserPool;
    readonly userPoolClient: cognito.UserPoolClient;
    readonly cognitoDomain: cognito.UserPoolDomain;
    constructor(scope: constructs.Construct, id: string, props: CognitoAuthInfrastructureProps);
}