import * as core from 'aws-cdk-lib';
import * as constructs from 'constructs';
/**
 * Props for {@link CognitoSessionBackend}. Generic — no project specifics baked
 * in. Pool identifiers are passed in (from {@link CognitoCustomerPool} or any
 * externally-managed pool), so this construct is agnostic to how the pool was
 * created.
 */
export interface CognitoSessionBackendProps {
    /** SSM prefix to publish identifiers under. @default `/auth/${domainName}` */
    readonly ssmParamPrefix?: string;
    /** Canonical domain — used for the config-secret name and default resource names. */
    readonly domainName: string;
    /**
     * Config-secret name (the secret the edge Lambdas fetch by name). Override to
     * decouple the name from {@link domainName}, e.g. to avoid a physical-name
     * collision when replacing an existing auth construct in the same stack.
     * @default `cloudfront-auth-config-${domainName}`
     */
    readonly configSecretName?: string;
    /** Cognito user pool id. */
    readonly userPoolId: string;
    /** Cognito app client id embedded in the config secret. */
    readonly clientId: string;
    /** Hosted-UI Cognito domain URL. */
    readonly cognitoDomain: string;
    /** Region of the Cognito pool. @default this stack's region */
    readonly cognitoRegion?: string;
    /** Region the auth table lives in. @default this stack's region */
    readonly tableRegion?: string;
    /** Auth-security DynamoDB table name. @default `auth-security-${domainName}` */
    readonly tableName?: string;
    /** Audit log S3 bucket name. @default derived from {@link domainName}. */
    readonly auditBucketName?: string;
    /** Audit log Glue database name. @default derived from {@link domainName}. */
    readonly auditDatabaseName?: string;
    readonly securityAlertsTopicArn?: string;
    readonly sessionRevocationTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    readonly hmacSecretRotationSchedule?: core.Duration;
    readonly auditLogRetentionDays?: number;
    readonly auditArchiveRetentionDays?: number;
    readonly removalPolicy?: core.RemovalPolicy;
}
/**
 * The session substrate for the custom-UI / hosted-UI Cognito auth flows:
 * the HMAC KMS signing key, the auth-security DynamoDB table
 * (`STATE#`/`SESSION#`/`REFRESH#`), the CloudFront KeyValueStore (holds
 * `jwt.secret` and the `revoked:` denylist), the config secret consumed by the
 * edge Lambdas, secret rotation + session-revocation wiring, and the audit-log
 * archive. Publishes all identifiers under an SSM prefix for the edge/CDN
 * construct to read.
 *
 * Generic and reusable: it takes Cognito pool identifiers as props and knows
 * nothing about any specific project.
 */
export declare class CognitoSessionBackend extends constructs.Construct {
    readonly configSecretArn: string;
    readonly kmsKeyArn: string;
    readonly authTableArn: string;
    readonly kvsArn: string;
    readonly ssmParamPrefix: string;
    constructor(scope: constructs.Construct, id: string, props: CognitoSessionBackendProps);
}