import { aws_cloudfront as cloudfront, aws_secretsmanager as secretsmanager, aws_kms as kms } from 'aws-cdk-lib';
import * as constructs from 'constructs';
export interface AuthSecretManagerProps {
    readonly domainName: string;
    readonly tableName: string;
    readonly tableRegion: string;
    readonly azureTenantId: string;
    readonly azureClientId: string;
    readonly stsAudience: string;
    readonly cookieDomain?: string;
    /** Domains permitted as the request host during OAuth callback. @default [domainName] */
    readonly allowedDomains?: string[];
    readonly securityAlertsTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    /** URL for the post-auth identity hook. Called after token exchange to resolve app-specific claims. @default undefined (no hook) */
    readonly postAuthHookUrl?: string;
    /** Timeout in seconds for the post-auth hook call. @default 3 */
    readonly postAuthHookTimeout?: number;
    /** Whether to deny auth if the hook fails or is unavailable. @default true */
    readonly postAuthHookFailClosed?: boolean;
    /**
     * SigV4-sign the post-auth hook request (service `lambda`) with the edge
     * role's credentials, so the hook may be an IAM-gated Lambda Function URL
     * rather than a public endpoint. Use this when the hook mints authority.
     * @default false
     */
    readonly postAuthHookSigv4?: boolean;
    /** Region to SigV4-sign the post-auth hook for. @default the web-identity key region / ambient */
    readonly postAuthHookRegion?: string;
    /** Whether to store refresh tokens for silent session renewal. @default false */
    readonly enableRefresh?: boolean;
    /**
     * Ceiling (bytes) on the assembled HMAC session token. When set, written into
     * the config secret as `scope_token_max_bytes`; the mint refuses an
     * over-budget token rather than truncating. Omitted from the secret when
     * unset, so the mint's built-in 7168-byte default applies and the secret
     * template is byte-for-byte unchanged for existing consumers.
     */
    readonly scopeTokenMaxBytes?: number;
    /**
     * Enable the RS256 **web-identity token** half of the two-token model. When
     * true, an asymmetric KMS signing key (RSA_2048, SIGN_VERIFY) is created and
     * the mint ALSO issues a horton-signed RS256 JWT — alongside the HMAC session
     * cookie — carrying the same principal-tags brand claim, for
     * `sts:AssumeRoleWithWebIdentity`. The private key never leaves KMS
     * (`kms:Sign`); the public half is served at {@link jwksPath}. Default OFF, so
     * existing consumers synthesise no new key and mint no second token.
     * @default false
     */
    readonly enableWebIdentityToken?: boolean;
    /**
     * Issuer (`iss`) and audience (`aud`) stamped on the RS256 web-identity token,
     * and the `url` of the IAM OIDC provider that trusts it. Required when
     * {@link enableWebIdentityToken} is true. Typically the JWKS-hosting origin,
     * e.g. `https://admin.example.com`.
     */
    readonly webIdentityIssuer?: string;
}
export declare class AuthSecretManager extends constructs.Construct {
    readonly kmsKey: kms.Key;
    readonly configSecret: secretsmanager.Secret;
    readonly kvs: cloudfront.KeyValueStore;
    /**
     * Asymmetric (RSA_2048 SIGN_VERIFY) KMS key the mint uses to sign the RS256
     * web-identity token. Only created when `enableWebIdentityToken` is true;
     * undefined otherwise.
     */
    readonly webIdentityKey?: kms.Key;
    constructor(scope: constructs.Construct, id: string, props: AuthSecretManagerProps);
}