import { Construct } from 'constructs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
/**
 * Properties for VpcAgentConstruct
 *
 * @see Requirements 18.3
 */
export interface VpcAgentConstructProps {
    /**
     * Application name for resource naming.
     */
    readonly appName: string;
    /**
     * Deployment stage.
     */
    readonly stage: 'dev' | 'staging' | 'prod';
    /**
     * VPC where the agent will be deployed.
     */
    readonly vpc: ec2.IVpc;
    /**
     * Subnets for the Lambda function.
     * Should be private subnets with access to VPC resources.
     */
    readonly subnets?: ec2.SubnetSelection;
    /**
     * Security groups for the Lambda function.
     * If not provided, a default security group will be created.
     */
    readonly securityGroups?: ec2.ISecurityGroup[];
    /**
     * Allowed target hosts (whitelist).
     * Only these hosts can be accessed through the VPC Agent.
     *
     * @example ['rds.internal.example.com', 'redis.internal.example.com']
     */
    readonly allowedHosts: string[];
    /**
     * Allowed ports for proxying.
     * @default [3306, 5432, 6379] (MySQL, PostgreSQL, Redis)
     */
    readonly allowedPorts?: number[];
    /**
     * Request timeout in milliseconds.
     * @default 30000
     */
    readonly timeoutMs?: number;
    /**
     * Memory size for the Lambda function in MB.
     * @default 256
     */
    readonly memorySize?: number;
}
/**
 * VpcAgentConstruct - CDK construct for deploying VPC Agent Lambda.
 *
 * Creates a Lambda function with Function URL that acts as a proxy
 * for accessing private VPC resources (RDS, Redis, etc.) from
 * developer machines without direct VPN access.
 *
 * **Architecture**:
 * - Lambda deployed in VPC private subnets
 * - Function URL provides public HTTPS endpoint
 * - Validates target host against whitelist
 * - Proxies HTTP/TCP requests to private resources
 *
 * **Security**:
 * - IAM authentication required for Function URL
 * - Host whitelist prevents unrestricted VPC access
 * - Port whitelist limits accessible services
 * - Security groups control network access
 *
 * **Requirements**: 18.3, 10.1, 10.2, 10.3, 10.5, 10.6
 *
 * @example
 * ```typescript
 * const vpcAgent = new VpcAgentConstruct(this, 'VpcAgent', {
 *   appName: 'my-app',
 *   stage: 'dev',
 *   vpc,
 *   allowedHosts: ['rds.internal', 'redis.internal'],
 *   allowedPorts: [3306, 6379],
 * });
 *
 * // Use vpcAgent.functionUrl in Local CLI configuration
 * ```
 */
export declare class VpcAgentConstruct extends Construct {
    /**
     * The VPC Agent Lambda function.
     */
    readonly agentFunction: lambda.Function;
    /**
     * The Function URL for the VPC Agent.
     */
    readonly functionUrl: lambda.FunctionUrl;
    /**
     * Security group for the VPC Agent.
     */
    readonly securityGroup: ec2.ISecurityGroup;
    constructor(scope: Construct, id: string, props: VpcAgentConstructProps);
    /**
     * Create security group for VPC Agent.
     *
     * @param vpc - VPC
     * @param appName - Application name
     * @param stage - Deployment stage
     * @returns Security group
     * @private
     */
    private createSecurityGroup;
    /**
     * Create VPC Agent Lambda function.
     *
     * @param appName - Application name
     * @param stage - Deployment stage
     * @param vpc - VPC
     * @param subnets - Subnet selection
     * @param securityGroups - Security groups
     * @param allowedHosts - Allowed hosts
     * @param allowedPorts - Allowed ports
     * @param timeoutMs - Request timeout
     * @param memorySize - Memory size
     * @returns Lambda function
     * @private
     */
    private createAgentFunction;
    /**
     * Create VPC Agent Lambda code.
     *
     * @returns Lambda Code asset
     * @private
     */
    private createAgentCode;
    /**
     * Create CloudFormation outputs.
     *
     * @param appName - Application name
     * @param stage - Deployment stage
     * @private
     */
    private createOutputs;
    /**
     * Grant invoke permissions to a principal.
     *
     * @param grantee - IAM principal to grant permissions to
     */
    grantInvoke(grantee: iam.IGrantable): iam.Grant;
    /**
     * Grant Function URL invoke permissions to a principal.
     *
     * @param grantee - IAM principal to grant permissions to
     */
    grantInvokeUrl(grantee: iam.IGrantable): iam.Grant;
    /**
     * Add ingress rule to security group for a specific port.
     *
     * @param port - Port number
     * @param peer - Security group or IP range
     * @param description - Rule description
     */
    allowIngressFrom(port: number, peer: ec2.IPeer, description?: string): void;
}
