/**
 * Session Manager - Handles session persistence (cookies, localStorage, etc.)
 *
 * Features:
 * - Atomic writes (temp file + rename) for session files to prevent corruption
 * - Optional encryption at rest using AES-256-GCM (set LLM_BROWSER_SESSION_KEY env var)
 * - Automatic migration from unencrypted to encrypted sessions
 */
import { BrowserContext } from 'playwright';
import type { SessionStore } from '../types/index.js';
/**
 * Session health status
 */
export interface SessionHealth {
    status: 'healthy' | 'expiring_soon' | 'expired' | 'stale' | 'not_found';
    domain: string;
    profile: string;
    isAuthenticated: boolean;
    expiredCookies: number;
    totalCookies: number;
    lastUsed: number;
    staleDays: number;
    expiresInMs?: number;
    message: string;
}
/**
 * Refresh callback function type
 * Return true if refresh succeeded, false otherwise
 */
export type SessionRefreshCallback = (domain: string, profile: string) => Promise<boolean>;
export declare class SessionManager {
    private sessionsDir;
    private sessions;
    private refreshCallback?;
    private crypto;
    constructor(sessionsDir?: string);
    /**
     * Register a callback for auto-refreshing expired sessions
     * The callback should perform re-authentication and save the new session
     */
    setRefreshCallback(callback: SessionRefreshCallback): void;
    initialize(): Promise<void>;
    /**
     * Save a browser session
     */
    saveSession(domain: string, context: BrowserContext, profile?: string): Promise<void>;
    /**
     * Load a saved session into a browser context
     */
    loadSession(domain: string, context: BrowserContext, profile?: string): Promise<boolean>;
    /**
     * Restore localStorage and sessionStorage to a page
     */
    restoreStorage(domain: string, page: any, profile?: string): Promise<void>;
    /**
     * Check if a session exists and is valid
     */
    hasSession(domain: string, profile?: string): boolean;
    /**
     * Get raw session data (GAP-009: for session sharing)
     */
    getSession(domain: string, profile?: string): SessionStore | undefined;
    /**
     * Save session data directly without a browser context (GAP-009: for shared sessions)
     */
    saveSessionData(session: SessionStore, profile?: string): Promise<void>;
    /**
     * List all saved sessions
     */
    listSessions(): Array<{
        domain: string;
        profile: string;
        lastUsed: number;
    }>;
    /**
     * Delete a session
     */
    deleteSession(domain: string, profile?: string): Promise<void>;
    /**
     * Check session health - detects expired, expiring soon, and stale sessions
     */
    getSessionHealth(domain: string, profile?: string): SessionHealth;
    /**
     * Check if a session is expired
     */
    isSessionExpired(domain: string, profile?: string): boolean;
    /**
     * Attempt to refresh an expired session using the registered callback
     * Returns true if refresh succeeded
     */
    refreshSession(domain: string, profile?: string): Promise<boolean>;
    /**
     * Load session with optional auto-refresh for expired sessions
     */
    loadSessionWithRefresh(domain: string, context: BrowserContext, profile?: string): Promise<{
        loaded: boolean;
        refreshed: boolean;
    }>;
    /**
     * Get health status for all sessions
     */
    getAllSessionHealth(): SessionHealth[];
    /**
     * Analyze cookies for expiration
     * Only counts expired AUTH cookies for determining session expiration
     */
    private analyzeSessionCookies;
    /**
     * Count authentication cookies
     */
    private countAuthCookies;
    /**
     * Check if a cookie is likely an authentication cookie
     */
    private isAuthCookie;
    /**
     * Check if the session is authenticated (heuristic)
     */
    private checkAuthentication;
    /**
     * Check if session encryption is enabled
     */
    isEncryptionEnabled(): boolean;
    /**
     * Get the environment variable name for encryption key
     */
    getEncryptionEnvVar(): string;
    /**
     * Persist session to disk using atomic write (temp file + rename)
     * Encrypts session data if encryption key is configured
     */
    private persistSession;
    /**
     * Load all sessions from disk
     * Decrypts session data if encrypted
     * Migrates unencrypted sessions to encrypted if encryption is enabled
     */
    private loadSessions;
    /**
     * Get all sessions in a portal group
     * Portal groups are sets of domains that share authentication (e.g., Spanish gov portals via CLAVE)
     *
     * @param portalGroup - The portal group identifier (e.g., 'spain-gov', 'portugal-gov')
     * @returns Array of sessions in the group with their health status
     */
    getPortalGroupSessions(portalGroup: string): Array<{
        session: SessionStore;
        health: SessionHealth;
        domain: string;
        profile: string;
    }>;
    /**
     * Get all unique portal groups
     * @returns Array of portal group identifiers
     */
    listPortalGroups(): string[];
    /**
     * Assign a session to a portal group
     * This establishes the relationship between domains that share authentication
     *
     * @param domain - The domain to assign
     * @param profile - The session profile
     * @param portalGroup - The portal group identifier
     * @param options - Additional options for the assignment
     */
    assignToPortalGroup(domain: string, profile: string | undefined, portalGroup: string, options?: {
        isPrimary?: boolean;
        loginSequence?: number;
        parentDomain?: string;
        parentProfile?: string;
    }): Promise<void>;
    /**
     * Get the primary session for a portal group
     * The primary session is typically the first login (e.g., the IdP login)
     *
     * @param portalGroup - The portal group identifier
     * @returns The primary session or undefined if none exists
     */
    getPrimarySession(portalGroup: string): SessionStore | undefined;
    /**
     * Check if all sessions in a portal group are healthy
     * @param portalGroup - The portal group identifier
     * @returns Summary of portal group health
     */
    getPortalGroupHealth(portalGroup: string): {
        healthy: boolean;
        totalSessions: number;
        healthySessions: number;
        expiredSessions: number;
        expiringSoonSessions: number;
        staleSessions: number;
        issues: string[];
    };
    /**
     * Get sessions that depend on a given session
     * Useful for cascading invalidation when a parent session expires
     * Uses BFS to handle cycles safely (prevents infinite loops)
     *
     * @param domain - The domain of the parent session
     * @param profile - The profile of the parent session
     * @returns Array of dependent sessions
     */
    getDependentSessions(domain: string, profile?: string): Array<{
        session: SessionStore;
        domain: string;
        profile: string;
    }>;
    /**
     * Invalidate all sessions in a portal group
     * Use when user logs out of primary portal
     *
     * @param portalGroup - The portal group identifier
     * @returns Number of sessions invalidated
     */
    invalidatePortalGroup(portalGroup: string): Promise<number>;
    /**
     * Update session verification timestamp
     * Call this after verifying a session is still valid (e.g., after successful API call)
     *
     * @param domain - The domain
     * @param profile - The session profile
     */
    markSessionVerified(domain: string, profile?: string): Promise<void>;
    /**
     * Get sessions by provider ID
     * Useful for finding all sessions authenticated via the same IdP
     *
     * @param providerId - The identity provider ID (e.g., 'google', 'clave', 'franceconnect')
     * @returns Array of sessions authenticated via this provider
     */
    getSessionsByProvider(providerId: string): Array<{
        session: SessionStore;
        domain: string;
        profile: string;
    }>;
    /**
     * Auto-assign portal group based on domain matching
     * Uses predefined domain groups (e.g., Spanish gov portals)
     *
     * @param domain - The domain to check
     * @param profile - The session profile
     * @param domainGroups - Map of portal group to domain patterns
     * @returns The assigned portal group or undefined
     */
    autoAssignPortalGroup(domain: string, profile: string | undefined, domainGroups: Record<string, string[]>): Promise<string | undefined>;
}
//# sourceMappingURL=session-manager.d.ts.map