import { Construct } from 'constructs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as apigatewayv2 from 'aws-cdk-lib/aws-apigatewayv2';
import type { AuthConfig, HttpMethod } from '../../../lib/runtime-web/types';
import { RuntimeWebStackProps } from '../../runtime-web';
import { RuntimeInfraResourceOptions, RuntimeInfraResources } from '../../interfaces';
/**
 * Properties for ApiGatewayBuilder construct
 */
export interface ApiGatewayBuilderProps {
    /**
     * Deployment stage
     */
    stage: 'dev' | 'staging' | 'prod';
    /**
     * Service name for resource naming
     */
    serviceName: string;
    /**
     * Allowed origins for CORS
     * @default ['*'] for dev/staging, specific domains for prod
     */
    allowedOrigins?: string[];
    /**
     * Custom domain configuration
     */
    domain?: {
        rootDomain: string;
        subdomain?: string;
        certificateArn?: string;
        hostedZoneId?: string;
    };
    /**
     * Default authorization for all routes.
     *
     * When specified, this authorizer will be applied to all routes
     * that don't have explicit auth configuration.
     *
     * Routes can override this by specifying their own auth config,
     * or disable auth entirely with `auth: 'none'` or `auth: { type: 'none' }`.
     *
     * @example
     * ```typescript
     * defaultAuth: {
     *   type: 'jwt',
     *   issuer: 'https://auth.example.com',
     *   audience: ['api.example.com']
     * }
     * ```
     */
    defaultAuth?: AuthConfig;
}
/**
 * ApiGatewayBuilder - CDK construct for building API Gateway from Lambda definitions.
 *
 * Creates HTTP API Gateway with routes for Lambda functions based on their
 * HttpIntegration configuration. Supports CORS, authentication, and custom domains.
 *
 * **Features**:
 * - Automatic route creation from HttpIntegration
 * - CORS configuration based on stage
 * - Authentication mapping (none, jwt, iam, cognito, custom)
 * - Custom domain support
 * - Named stages (not $default)
 *
 * **Requirements**: REQ-14
 *
 * @example
 * ```typescript
 * const builder = new ApiGatewayBuilder(this, 'ApiGatewayBuilder', {
 *   stage: 'dev',
 *   serviceName: 'my-app'
 * });
 *
 * const { api, stage } = builder.createApiGateway(lambdaFunctions, register);
 * ```
 */
export declare class ApiGatewayBuilder extends Construct implements RuntimeInfraResources {
    private readonly props;
    /**
     * Microservice registrar for DI container management
     */
    private readonly registrar;
    /**
     * Cache for authorizer instances to enable reuse across routes.
     *
     * Authorizers with equivalent configuration (same issuer, audience, Lambda ARN, etc.)
     * are cached and reused to avoid creating duplicate CDK resources.
     *
     * Cache key format:
     * - JWT: `jwt:{issuer}:{sorted audience}`
     * - IAM: `iam:{name or 'default'}`
     * - Cognito: `cognito:{issuer}:{sorted audience}`
     * - Custom: `custom:{lambdaArn}:{sorted identitySource}:{simpleResponses}`
     */
    private readonly authorizerCache;
    constructor(scope: Construct, id: string, props: ApiGatewayBuilderProps);
    /**
     * Create API Gateway with routes for all Lambda functions.
     *
     * Creates an HTTP API with routes based on the HttpIntegration configuration
     * of each Lambda definition. Only creates routes for Lambdas with HTTP config.
     *
     * @param lambdaFunctions - Map of Lambda functions by ID
     * @param props
     * @returns Object with API Gateway and stage
     *
     * @example
     * ```typescript
     * const { api, stage } = builder.createApiGateway(lambdaFunctions, {
     *   payments: {
     *     ties: [PaymentsTies],
     *     lambdas: [
     *       {
     *         id: 'charge',
     *         http: { method: 'POST', path: '/api/payments/charge' }
     *       }
     *     ]
     *   }
     * });
     * ```
     */
    createApiGateway(lambdaFunctions: Map<string, lambda.Function>, props: RuntimeWebStackProps): {
        api: apigatewayv2.HttpApi;
        stage: apigatewayv2.HttpStage;
    };
    /**
     * Create a route for a Lambda function.
     *
     * Creates an API Gateway route with Lambda integration based on the
     * HttpIntegration configuration.
     *
     * @param api - HTTP API instance
     * @param lambdaFn - Lambda function to integrate
     * @param http - HTTP integration configuration
     * @param lambdaId - Lambda ID for naming
     * @private
     */
    private createRoute;
    /**
     * Map high-level HTTP method to CDK HttpMethod.
     *
     * @param method - High-level HTTP method string
     * @returns CDK HttpMethod enum value
     */
    mapHttpMethod(method: HttpMethod): apigatewayv2.HttpMethod;
    /**
     * Create authorizer based on auth type.
     *
     * Maps high-level auth types to CDK authorizer configurations.
     * Validates configuration and creates appropriate CDK authorizer.
     * Caches authorizers for reuse across routes.
     *
     * @param auth - Authentication type or configuration
     * @param routePath - Route path for error context
     * @returns Authorizer or undefined for no auth
     * @private
     */
    private createAuthorizer;
    /**
     * Generate cache key for authorizer configuration.
     *
     * Creates a deterministic cache key based on the auth configuration
     * to enable authorizer reuse across routes with equivalent config.
     *
     * @param config - Auth configuration
     * @returns Cache key string
     * @private
     */
    private getAuthorizerCacheKey;
    /**
     * Create JWT authorizer from configuration.
     *
     * Creates an HttpJwtAuthorizer with the specified issuer and optional
     * audience and identity source configuration.
     *
     * @param config - JWT auth configuration
     * @param cacheKey - Cache key for unique naming
     * @returns JWT authorizer
     * @private
     */
    private createJwtAuthorizer;
    /**
     * Create IAM authorizer.
     *
     * Creates an HttpIamAuthorizer for AWS IAM signature validation.
     *
     * @param config - IAM auth configuration
     * @param cacheKey - Cache key for unique naming
     * @returns IAM authorizer
     * @private
     */
    private createIamAuthorizer;
    /**
     * Create Cognito authorizer (implemented as JWT authorizer).
     *
     * Derives the issuer URL from userPoolId + region if not explicitly provided,
     * then creates an HttpJwtAuthorizer with Cognito-specific configuration.
     *
     * @param config - Cognito auth configuration
     * @param cacheKey - Cache key for unique naming
     * @returns Cognito authorizer (JWT-based)
     * @private
     */
    private createCognitoAuthorizer;
    /**
     * Create custom Lambda authorizer.
     *
     * Creates an HttpLambdaAuthorizer with the specified Lambda function
     * and optional configuration for simple responses, identity source,
     * cache TTL, and payload version.
     *
     * @param config - Custom auth configuration
     * @param cacheKey - Cache key for unique naming
     * @returns Custom Lambda authorizer
     * @private
     */
    private createCustomAuthorizer;
    /**
     * Generate a unique authorizer ID from cache key.
     *
     * Creates a short, unique identifier suitable for CDK construct naming.
     *
     * @param cacheKey - Cache key to hash
     * @returns Short unique identifier
     * @private
     */
    private generateAuthorizerId;
    /**
     * Create CORS configuration for API Gateway.
     *
     * Creates CORS preflight options based on stage and allowed origins.
     *
     * @param allowedOrigins - Array of allowed origins
     * @returns CORS preflight options
     * @private
     */
    private createCorsConfig;
    /**
     * Generates a signature for the provided region by extracting the first character of each segment in the region string, delimited by hyphens.
     *
     * @param {string} region - The region string to generate the signature from. It is expected to be a hyphen-separated string.
     * @return {string} The generated region signature, formed by concatenating the first character of each valid segment. Returns an empty string if the input is invalid or empty.
     */
    private getRegionSignature;
    /**
     * Generates a resource name by concatenating service name, resource name,
     * simplified region, and stage with hyphens as separators.
     *
     * @param {Object} params - An object containing the required parameters.
     * @param {string} params.name - The name of the resource.
     * @param {string} params.serviceName - The name of the service associated with the resource.
     * @param {string} params.regionSimplified - The simplified region identifier.
     * @param {string} params.stage - The deployment stage of the resource.
     * @returns {string} The concatenated resource name.
     */
    resourceName({ name, serviceName, stage, region }: RuntimeInfraResourceOptions): string;
}
