/**
 * Session Management Analyzer (Issue #111, Challenge #12)
 * Detects session management vulnerabilities from mcp-vulnerable-testbed
 *
 * Extracted from SecurityResponseAnalyzer.ts for modularity (Issue #179)
 */
import { CompatibilityCallToolResult } from "@modelcontextprotocol/sdk/types.js";
/**
 * Result of session management vulnerability analysis (Issue #111, Challenge #12)
 * Detects 5 session management CWEs from mcp-vulnerable-testbed:
 * - CWE-384: Session Fixation (accepts external session ID, no regeneration)
 * - CWE-330: Predictable Tokens (session_{user}_{timestamp}_{counter})
 * - CWE-613: No Session Timeout (expires_at: null, timeout_checked: false)
 * - CWE-200: ID Exposure in URL (session_url contains session_id=)
 */
export interface SessionManagementResult {
    detected: boolean;
    vulnerabilityType: "SESSION_FIXATION" | "PREDICTABLE_TOKEN" | "NO_TIMEOUT" | "ID_IN_URL" | "NO_REGENERATION" | "UNKNOWN";
    cweIds: string[];
    evidence?: string;
}
/**
 * Analyzes responses for session management vulnerabilities
 *
 * Detects 5 CWEs from mcp-vulnerable-testbed:
 * - CWE-384: Session Fixation (accepts external session ID, no regeneration)
 * - CWE-330: Predictable Tokens (session_{user}_{timestamp}_{counter})
 * - CWE-613: No Session Timeout (expires_at: null, timeout_checked: false)
 * - CWE-200: ID Exposure in URL (session_url contains session_id=)
 */
export declare class SessionManagementAnalyzer {
    private safeDetector;
    /**
     * Safe patterns (hardened server)
     */
    private static readonly SAFE_PATTERNS;
    /**
     * CWE-384: Session Fixation patterns
     */
    private static readonly FIXATION_PATTERNS;
    /**
     * CWE-330: Predictable Token patterns
     */
    private static readonly PREDICTABLE_PATTERNS;
    /**
     * CWE-613: No Session Timeout patterns
     */
    private static readonly NO_TIMEOUT_PATTERNS;
    /**
     * CWE-200: Session ID in URL patterns
     */
    private static readonly ID_IN_URL_PATTERNS;
    constructor();
    /**
     * Analyze response for session management vulnerabilities (Issue #111, Challenge #12)
     *
     * @param response The tool response to analyze
     * @returns Analysis result with session management detection status
     */
    analyze(response: CompatibilityCallToolResult): SessionManagementResult;
}
//# sourceMappingURL=SessionManagementAnalyzer.d.ts.map