/**
 * SSO Flow Detector (GAP-009)
 *
 * Detects Single Sign-On (SSO) flows during browsing operations:
 * - OAuth 2.0/OIDC flows (Google, GitHub, Microsoft, etc.)
 * - SAML 2.0 flows (enterprise SSO)
 * - Social login buttons and redirects
 *
 * The detector identifies the identity provider (IdP) involved in the SSO flow,
 * enabling cross-domain session correlation and reuse.
 */
/**
 * Known identity provider information
 */
export interface IdentityProvider {
    id: string;
    name: string;
    type: 'oauth' | 'saml' | 'oidc';
    domains: string[];
    authEndpoints: RegExp[];
}
/**
 * Detected SSO flow information
 */
export interface SSOFlowInfo {
    /** Unique identifier for this SSO flow */
    flowId: string;
    /** The identity provider detected */
    provider: IdentityProvider;
    /** Type of SSO flow */
    flowType: 'oauth_authorize' | 'oauth_callback' | 'saml_request' | 'saml_response' | 'social_button';
    /** The original domain that initiated the SSO flow */
    initiatingDomain: string;
    /** The IdP domain handling authentication */
    idpDomain: string;
    /** The target domain after successful auth (redirect_uri for OAuth) */
    targetDomain?: string;
    /** OAuth-specific: client_id if detected */
    clientId?: string;
    /** OAuth-specific: scopes requested */
    scopes?: string[];
    /** SAML-specific: assertion consumer service URL */
    acsUrl?: string;
    /** When this flow was detected */
    detectedAt: number;
    /** URL that triggered detection */
    triggerUrl: string;
}
/**
 * Domain relationship learned from SSO flows
 */
export interface DomainSSORelationship {
    /** The relying party domain (site using SSO) */
    domain: string;
    /** The identity provider used */
    providerId: string;
    /** OAuth client ID for this domain (if applicable) */
    clientId?: string;
    /** Confidence in this relationship (0-1) */
    confidence: number;
    /** Number of times this relationship was observed */
    observationCount: number;
    /** Last time this relationship was observed */
    lastObserved: number;
    /** First time this relationship was observed */
    firstObserved: number;
}
/**
 * Options for SSO flow detection
 */
export interface SSODetectorOptions {
    /** Enable detection from URL analysis */
    detectFromUrls?: boolean;
    /** Enable detection from page content (social login buttons) */
    detectFromContent?: boolean;
    /** Enable detection from network requests */
    detectFromNetwork?: boolean;
}
/**
 * Well-known identity providers with their auth patterns
 */
export declare const KNOWN_PROVIDERS: IdentityProvider[];
export declare class SSOFlowDetector {
    private providers;
    private activeFlows;
    private options;
    constructor(options?: SSODetectorOptions);
    /**
     * Detect SSO flow from a URL (navigation or redirect)
     */
    detectFromUrl(url: string, initiatingDomain?: string): SSOFlowInfo | null;
    /**
     * Detect OAuth flow from URL
     */
    private detectOAuthFromUrl;
    /**
     * Check if URL looks like a generic OAuth endpoint
     */
    private isGenericOAuthUrl;
    /**
     * Detect SAML flow from URL
     */
    private detectSAMLFromUrl;
    /**
     * Detect social login buttons from page HTML content
     */
    detectFromContent(html: string, currentDomain: string): SSOFlowInfo[];
    /**
     * Get the identity provider for a domain
     */
    getProviderForDomain(domain: string): IdentityProvider | null;
    /**
     * Register a custom identity provider
     */
    registerProvider(provider: IdentityProvider): void;
    /**
     * Get all active SSO flows
     */
    getActiveFlows(): SSOFlowInfo[];
    /**
     * Get a specific flow by ID
     */
    getFlow(flowId: string): SSOFlowInfo | undefined;
    /**
     * Clear completed/stale flows older than the given threshold
     */
    cleanupFlows(maxAgeMs?: number): number;
    private generateFlowId;
    private extractDomain;
    private createSAMLProvider;
}
//# sourceMappingURL=sso-flow-detector.d.ts.map