/**
 * Authentication Manager for NotebookLM
 *
 * Handles:
 * - Interactive login (headful browser for setup)
 * - Auto-login with credentials (email/password from ENV)
 * - Browser state persistence (cookies + localStorage + sessionStorage)
 * - Cookie expiry validation
 * - State expiry checks (7-day file age)
 * - Hard reset for clean start
 *
 * Based on the Python implementation from auth.py
 */
/// <reference types="node" resolution-mode="require"/>
import type { BrowserContext, Page } from "patchright";
import type { ProgressCallback } from "../types.js";
export declare class AuthManager {
    private stateFilePath;
    private sessionFilePath;
    private authLockPath;
    constructor();
    /**
     * Save entire browser state (cookies + localStorage)
     * Uses post-quantum encrypted storage for sensitive auth data
     * Uses file locking to prevent race conditions with concurrent sessions
     */
    saveBrowserState(context: BrowserContext, page?: Page): Promise<boolean>;
    /**
     * Check if saved browser state exists (encrypted or unencrypted)
     */
    hasSavedState(): Promise<boolean>;
    /**
     * Get path to saved browser state (checks encrypted versions too)
     */
    getStatePath(): string | null;
    /**
     * Get valid state path (checks expiry)
     */
    getValidStatePath(): Promise<string | null>;
    /**
     * Load sessionStorage from file (decrypts if encrypted)
     */
    loadSessionStorage(): Promise<Record<string, string> | null>;
    /**
     * Validate if saved state is still valid
     */
    validateState(context: BrowserContext): Promise<boolean>;
    /**
     * Validate if critical authentication cookies are still valid
     */
    validateCookiesExpiry(context: BrowserContext): Promise<boolean>;
    /**
     * Race-condition-aware auth validation with automatic retry.
     *
     * In concurrent deployments each session runs its own isolated Chrome profile
     * cloned from the shared base. When Google refreshes OAuth tokens for session A,
     * the cookies held by sessions B/C become invalid even though the credentials
     * themselves are fine. This method distinguishes that scenario from genuine
     * cookie expiry and self-heals by reloading fresh cookies from state.json.pqenc.
     *
     * Decision logic per attempt:
     *   1. Cookies valid → return true immediately (fast path).
     *   2. .auth-in-progress lock is held OR state.json.pqenc was written within
     *      the last 2 minutes → race condition. Wait random jitter, reload cookies,
     *      re-validate, and repeat up to maxRetries times.
     *   3. Neither signal present → genuine expiry. Break early, return false so
     *      the caller can prompt for setup_auth.
     */
    validateWithRetry(context: BrowserContext, maxRetries?: number): Promise<boolean>;
    /**
     * Get the mtime of the auth state file (tries .pqenc, .enc, plain in order).
     * Returns null if no state file found.
     */
    private getStateFileMtimeMs;
    /**
     * Touch the state file to reset the 7-day expiry clock.
     * Called after successful auth validation so sessions that use the
     * existing credentials don't cause the file to silently expire.
     */
    private touchStateFile;
    /**
     * Reload fresh cookies from state.json.pqenc into the browser context.
     * Uses addCookies() which overwrites existing cookies with the same key,
     * replacing stale tokens with the latest ones saved by another session.
     */
    private reloadCookiesFromState;
    /**
     * Check if the saved state file is too old (>7 days)
     * Checks encrypted versions (.pqenc, .enc) as well as unencrypted
     */
    isStateExpired(): Promise<boolean>;
    /**
     * Perform interactive login
     * User will see a browser window and login manually
     *
     * SIMPLE & RELIABLE: Just wait for URL to change to notebooklm.google.com
     */
    performLogin(page: Page, sendProgress?: ProgressCallback, signal?: AbortSignal): Promise<boolean>;
    /**
     * Attempt to authenticate using configured credentials
     */
    loginWithCredentials(context: BrowserContext, page: Page, email: string, password: string): Promise<boolean>;
    /**
     * Wait for Google to redirect to NotebookLM after successful login (SIMPLE & RELIABLE)
     *
     * Just checks if URL changes to notebooklm.google.com - no complex UI element searching!
     * Matches the simplified approach used in performLogin().
     */
    private waitForRedirectAfterLogin;
    /**
     * Wait for NotebookLM to load (SIMPLE & RELIABLE)
     *
     * Just checks if URL starts with notebooklm.google.com - no complex UI element searching!
     * Matches the simplified approach used in performLogin().
     */
    private waitForNotebook;
    /**
     * Handle possible account chooser
     */
    private handleAccountChooser;
    /**
     * Fill email identifier field with human-like typing
     */
    private fillIdentifier;
    /**
     * Fill password field with human-like typing
     */
    private fillPassword;
    /**
     * Click text element
     */
    private clickText;
    /**
     * Load authentication state from a specific file path (decrypts if encrypted)
     * Uses file locking to prevent race conditions with concurrent sessions
     */
    loadAuthState(context: BrowserContext, statePath: string): Promise<boolean>;
    /**
     * Perform interactive setup (for setup_auth tool)
     * Opens a PERSISTENT browser for manual login
     *
     * CRITICAL: Uses the SAME persistent context as runtime!
     * This ensures cookies are automatically saved to the Chrome profile.
     *
     * Benefits over temporary browser:
     * - Session cookies persist correctly (Playwright bug workaround)
     * - Same fingerprint as runtime
     * - No need for addCookies() workarounds
     * - Automatic cookie persistence via Chrome profile
     *
     * @param sendProgress Optional progress callback
     * @param overrideHeadless Optional override for headless mode (true = visible, false = headless)
     *                         If not provided, defaults to true (visible) for setup
     */
    performSetup(sendProgress?: ProgressCallback, overrideHeadless?: boolean): Promise<boolean>;
    /**
     * Clear ALL authentication data for account switching
     *
     * CRITICAL: This deletes EVERYTHING to ensure only ONE account is active:
     * - All state files (encrypted .pqenc, .enc, and unencrypted .json)
     * - sessionStorage files
     * - Chrome profile directory (browser fingerprint, cache, etc.)
     * - Post-quantum key pairs
     *
     * Use this BEFORE authenticating a new account!
     */
    clearAllAuthData(): Promise<void>;
    /**
     * Clear all saved authentication state (including encrypted versions)
     */
    clearState(): Promise<boolean>;
    /**
     * HARD RESET: Completely delete ALL authentication state
     */
    hardResetState(): Promise<boolean>;
}