import type { AuthType, AuthConfig, AuthConfigJwt, AuthConfigCognito, AuthConfigCustom } from '../../../lib/runtime-web/types';
/**
 * Validation error for authorization configuration.
 *
 * Thrown when auth configuration is invalid at CDK synth time.
 * Provides detailed error messages with route context and actionable guidance.
 *
 * @example
 * ```typescript
 * throw new AuthConfigValidationError(
 *   '/api/users',
 *   'jwt',
 *   'JWT authorizer requires an issuer URL',
 *   'Provide the issuer property with your identity provider URL'
 * );
 * ```
 */
export declare class AuthConfigValidationError extends Error {
    /**
     * The route path where the validation error occurred.
     */
    readonly routePath: string;
    /**
     * The auth type that failed validation.
     */
    readonly authType: string;
    /**
     * Actionable guidance on how to fix the configuration.
     */
    readonly guidance: string;
    constructor(routePath: string, authType: string, message: string, guidance: string);
}
/**
 * Normalize AuthType string or AuthConfig object to AuthConfig.
 *
 * Converts string convenience mode to full AuthConfig object.
 * Passes through AuthConfig objects unchanged.
 *
 * @param auth - AuthType string or AuthConfig object
 * @returns Normalized AuthConfig or undefined
 *
 * @example
 * ```typescript
 * normalizeAuthConfig('none')     // { type: 'none' }
 * normalizeAuthConfig('jwt')      // { type: 'jwt' } (will fail validation later)
 * normalizeAuthConfig({ type: 'jwt', issuer: '...' }) // unchanged
 * normalizeAuthConfig(undefined)  // undefined
 * ```
 */
export declare function normalizeAuthConfig(auth: AuthType | AuthConfig | undefined): AuthConfig | undefined;
/**
 * Validate JWT auth configuration.
 *
 * Ensures JWT configuration has required issuer property.
 * Throws AuthConfigValidationError if validation fails.
 *
 * @param config - JWT auth configuration to validate
 * @param routePath - Route path for error context
 * @throws AuthConfigValidationError if issuer is missing
 *
 * @example
 * ```typescript
 * validateJwtConfig({ type: 'jwt', issuer: 'https://auth.example.com' }, '/api/users');
 * // OK
 *
 * validateJwtConfig({ type: 'jwt' }, '/api/users');
 * // Throws: JWT authorizer requires an issuer URL
 * ```
 */
export declare function validateJwtConfig(config: AuthConfigJwt, routePath: string): void;
/**
 * Validate Cognito auth configuration.
 *
 * Ensures Cognito configuration has either:
 * - Explicit issuer URL, OR
 * - userPoolId AND region (to derive issuer)
 *
 * Throws AuthConfigValidationError if validation fails.
 *
 * @param config - Cognito auth configuration to validate
 * @param routePath - Route path for error context
 * @throws AuthConfigValidationError if required fields are missing
 *
 * @example
 * ```typescript
 * // Valid: explicit issuer
 * validateCognitoConfig({
 *   type: 'cognito',
 *   issuer: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx'
 * }, '/api/users');
 *
 * // Valid: userPoolId + region
 * validateCognitoConfig({
 *   type: 'cognito',
 *   userPoolId: 'us-east-1_xxxxx',
 *   region: 'us-east-1'
 * }, '/api/users');
 *
 * // Invalid: missing required fields
 * validateCognitoConfig({ type: 'cognito' }, '/api/users');
 * // Throws error
 * ```
 */
export declare function validateCognitoConfig(config: AuthConfigCognito, routePath: string): void;
/**
 * Validate custom Lambda auth configuration.
 *
 * Ensures custom authorizer configuration has required authorizerLambda property.
 * Throws AuthConfigValidationError if validation fails.
 *
 * @param config - Custom auth configuration to validate
 * @param routePath - Route path for error context
 * @throws AuthConfigValidationError if authorizerLambda is missing
 *
 * @example
 * ```typescript
 * validateCustomConfig({
 *   type: 'custom',
 *   authorizerLambda: myLambdaFunction
 * }, '/api/admin');
 * // OK
 *
 * validateCustomConfig({ type: 'custom' }, '/api/admin');
 * // Throws: Custom authorizer requires an authorizerLambda function
 * ```
 */
export declare function validateCustomConfig(config: AuthConfigCustom, routePath: string): void;
/**
 * Derive Cognito issuer URL from userPoolId and region.
 *
 * Constructs the standard Cognito issuer URL format:
 * `https://cognito-idp.{region}.amazonaws.com/{userPoolId}`
 *
 * @param userPoolId - Cognito User Pool ID
 * @param region - AWS region
 * @returns Derived issuer URL
 *
 * @example
 * ```typescript
 * deriveCognitoIssuer('us-east-1_xxxxx', 'us-east-1');
 * // Returns: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx'
 * ```
 */
export declare function deriveCognitoIssuer(userPoolId: string, region: string): string;
/**
 * Validate auth configuration based on type.
 *
 * Dispatches to type-specific validation functions based on the auth type.
 * Handles string AuthType by normalizing first.
 *
 * @param auth - Auth configuration to validate (string or object)
 * @param routePath - Route path for error context
 * @throws AuthConfigValidationError if validation fails
 *
 * @example
 * ```typescript
 * // Valid configurations
 * validateAuthConfig('none', '/api/health');
 * validateAuthConfig({ type: 'jwt', issuer: 'https://...' }, '/api/users');
 *
 * // Invalid configurations throw errors
 * validateAuthConfig('jwt', '/api/users');
 * // Throws: Auth type "jwt" requires full configuration object
 * ```
 */
export declare function validateAuthConfig(auth: AuthType | AuthConfig | undefined, routePath: string): void;
