import { z } from 'zod';
export declare const GatewayAuthorizerTypeSchema: z.ZodEnum<{
    NONE: "NONE";
    AWS_IAM: "AWS_IAM";
    CUSTOM_JWT: "CUSTOM_JWT";
}>;
export type GatewayAuthorizerType = z.infer<typeof GatewayAuthorizerTypeSchema>;
export declare const RuntimeAuthorizerTypeSchema: z.ZodEnum<{
    AWS_IAM: "AWS_IAM";
    CUSTOM_JWT: "CUSTOM_JWT";
}>;
export type RuntimeAuthorizerType = z.infer<typeof RuntimeAuthorizerTypeSchema>;
export declare const ClaimMatchOperatorSchema: z.ZodEnum<{
    EQUALS: "EQUALS";
    CONTAINS: "CONTAINS";
    CONTAINS_ANY: "CONTAINS_ANY";
}>;
export type ClaimMatchOperator = z.infer<typeof ClaimMatchOperatorSchema>;
export declare const ClaimMatchValueSchema: z.ZodObject<{
    matchValueString: z.ZodOptional<z.ZodString>;
    matchValueStringList: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strip>;
export type ClaimMatchValue = z.infer<typeof ClaimMatchValueSchema>;
export declare const InboundTokenClaimValueTypeSchema: z.ZodEnum<{
    STRING: "STRING";
    STRING_ARRAY: "STRING_ARRAY";
}>;
export type InboundTokenClaimValueType = z.infer<typeof InboundTokenClaimValueTypeSchema>;
export declare const CustomClaimValidationSchema: z.ZodObject<{
    inboundTokenClaimName: z.ZodString;
    inboundTokenClaimValueType: z.ZodEnum<{
        STRING: "STRING";
        STRING_ARRAY: "STRING_ARRAY";
    }>;
    authorizingClaimMatchValue: z.ZodObject<{
        claimMatchOperator: z.ZodEnum<{
            EQUALS: "EQUALS";
            CONTAINS: "CONTAINS";
            CONTAINS_ANY: "CONTAINS_ANY";
        }>;
        claimMatchValue: z.ZodObject<{
            matchValueString: z.ZodOptional<z.ZodString>;
            matchValueStringList: z.ZodOptional<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>;
    }, z.core.$strip>;
}, z.core.$strict>;
export type CustomClaimValidation = z.infer<typeof CustomClaimValidationSchema>;
/**
 * Custom JWT authorizer configuration.
 * Used when authorizerType is 'CUSTOM_JWT'.
 *
 * At least one of allowedAudience, allowedClients, allowedScopes, or customClaims
 * must be provided. Only discoveryUrl is unconditionally required.
 */
export declare const CustomJwtAuthorizerConfigSchema: z.ZodObject<{
    discoveryUrl: z.ZodString;
    allowedAudience: z.ZodOptional<z.ZodArray<z.ZodString>>;
    allowedClients: z.ZodOptional<z.ZodArray<z.ZodString>>;
    allowedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
    customClaims: z.ZodOptional<z.ZodArray<z.ZodObject<{
        inboundTokenClaimName: z.ZodString;
        inboundTokenClaimValueType: z.ZodEnum<{
            STRING: "STRING";
            STRING_ARRAY: "STRING_ARRAY";
        }>;
        authorizingClaimMatchValue: z.ZodObject<{
            claimMatchOperator: z.ZodEnum<{
                EQUALS: "EQUALS";
                CONTAINS: "CONTAINS";
                CONTAINS_ANY: "CONTAINS_ANY";
            }>;
            claimMatchValue: z.ZodObject<{
                matchValueString: z.ZodOptional<z.ZodString>;
                matchValueStringList: z.ZodOptional<z.ZodArray<z.ZodString>>;
            }, z.core.$strip>;
        }, z.core.$strip>;
    }, z.core.$strict>>>;
}, z.core.$strict>;
export type CustomJwtAuthorizerConfig = z.infer<typeof CustomJwtAuthorizerConfigSchema>;
/**
 * Resource-agnostic authorizer configuration container.
 * Used by both Gateway and Runtime resources.
 */
export declare const AuthorizerConfigSchema: z.ZodObject<{
    customJwtAuthorizer: z.ZodOptional<z.ZodObject<{
        discoveryUrl: z.ZodString;
        allowedAudience: z.ZodOptional<z.ZodArray<z.ZodString>>;
        allowedClients: z.ZodOptional<z.ZodArray<z.ZodString>>;
        allowedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
        customClaims: z.ZodOptional<z.ZodArray<z.ZodObject<{
            inboundTokenClaimName: z.ZodString;
            inboundTokenClaimValueType: z.ZodEnum<{
                STRING: "STRING";
                STRING_ARRAY: "STRING_ARRAY";
            }>;
            authorizingClaimMatchValue: z.ZodObject<{
                claimMatchOperator: z.ZodEnum<{
                    EQUALS: "EQUALS";
                    CONTAINS: "CONTAINS";
                    CONTAINS_ANY: "CONTAINS_ANY";
                }>;
                claimMatchValue: z.ZodObject<{
                    matchValueString: z.ZodOptional<z.ZodString>;
                    matchValueStringList: z.ZodOptional<z.ZodArray<z.ZodString>>;
                }, z.core.$strip>;
            }, z.core.$strip>;
        }, z.core.$strict>>>;
    }, z.core.$strict>>;
}, z.core.$strip>;
export type AuthorizerConfig = z.infer<typeof AuthorizerConfigSchema>;
/** @deprecated Use AuthorizerConfigSchema. Backwards-compatible alias for Gateway. */
export declare const GatewayAuthorizerConfigSchema: z.ZodObject<{
    customJwtAuthorizer: z.ZodOptional<z.ZodObject<{
        discoveryUrl: z.ZodString;
        allowedAudience: z.ZodOptional<z.ZodArray<z.ZodString>>;
        allowedClients: z.ZodOptional<z.ZodArray<z.ZodString>>;
        allowedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
        customClaims: z.ZodOptional<z.ZodArray<z.ZodObject<{
            inboundTokenClaimName: z.ZodString;
            inboundTokenClaimValueType: z.ZodEnum<{
                STRING: "STRING";
                STRING_ARRAY: "STRING_ARRAY";
            }>;
            authorizingClaimMatchValue: z.ZodObject<{
                claimMatchOperator: z.ZodEnum<{
                    EQUALS: "EQUALS";
                    CONTAINS: "CONTAINS";
                    CONTAINS_ANY: "CONTAINS_ANY";
                }>;
                claimMatchValue: z.ZodObject<{
                    matchValueString: z.ZodOptional<z.ZodString>;
                    matchValueStringList: z.ZodOptional<z.ZodArray<z.ZodString>>;
                }, z.core.$strip>;
            }, z.core.$strip>;
        }, z.core.$strict>>>;
    }, z.core.$strict>>;
}, z.core.$strip>;
/** @deprecated Use AuthorizerConfig. Backwards-compatible alias for Gateway. */
export type GatewayAuthorizerConfig = AuthorizerConfig;
//# sourceMappingURL=auth.d.ts.map