/**
 * Best-effort login-state detection for browser profiles.
 *
 * Reads a profile's Chromium cookie store (presence only — never decrypts the
 * Keychain-encrypted values) to tell which login-gated services have a live
 * session in that profile. Powers the `agents browser start` guardrail (warn
 * when an agent opens a logged-out profile for a login-gated URL) and the
 * `agents browser profiles logins` view.
 *
 * Everything here is advisory: any failure (missing DB, locked file, unknown
 * schema) degrades to "no known session" and NEVER throws to callers — browser
 * start must not slow down or break because cookie inspection hiccuped.
 */
/** A login-gated service signature: host substrings + the auth-cookie names
 *  whose presence indicates a live session, plus optional login metadata. */
interface ServiceSignature {
    hosts: string[];
    cookies: string[];
    /**
     * Where an interactive login for this service starts, and the bundle key
     * PREFIX its credentials live under. By convention a profile's `--secrets`
     * bundle holds `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD` (see
     * `credKeysForService`). The prefix is explicit — never string-munged from the
     * service id — so e.g. `x` → `X`, `google` → `GOOGLE`.
     */
    login?: {
        loginUrl: string;
        keyPrefix: string;
    };
}
/**
 * Known login-gated services. Presence of ANY listed cookie on a matching host
 * (unexpired, or a session cookie) = logged in. Deliberately conservative: a
 * service absent from this map simply never triggers a warning — we do not
 * guess. Each cookie name here is the definitive authenticated-session token for
 * that service (e.g. LinkedIn's `li_at` is only set for a signed-in member;
 * visitor cookies like `bcookie`/`JSESSIONID` are NOT auth). Services whose
 * session is not reliably expressed as a recognizable cookie (e.g. Attio, whose
 * only same-site cookies are third-party analytics) are deliberately omitted so
 * we never emit a false "logged out" warning. Extend as needed.
 */
export declare const AUTH_SIGNATURES: Record<string, ServiceSignature>;
/**
 * The bundle keys a profile's `--secrets` bundle should hold to log into
 * `service`: `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD`. Null for services with no
 * login metadata. Feed a resolved value to the page with
 * `agents browser type <ref> --secret <bundle>/<KEY>` (never printed).
 */
export declare function credKeysForService(service: string): {
    user: string;
    pass: string;
} | null;
/** The interactive login URL for a service, or null. */
export declare function loginUrlForService(service: string): string | null;
export interface CookieRow {
    host_key: string;
    name: string;
}
/**
 * Pure core: given a profile's (already expiry-filtered) cookie rows, return the
 * services with a live session. Exported for direct unit testing without disk.
 */
export declare function detectServices(rows: CookieRow[]): string[];
/** Map a URL to a known login-gated service key, or null. */
export declare function serviceForUrl(url: string): string | null;
/** A saved-login row from Chromium `Login Data` (username plaintext; password
 *  encrypted and never read). */
export interface LoginRow {
    origin_url: string;
    username_value: string;
    signon_realm: string;
}
/**
 * Map a profile's saved logins to service → account username (identity, not
 * session). Best-effort; `{}` if `Login Data` is unreadable. The first non-empty
 * username per service wins.
 */
export declare function accountsForProfile(profileName: string): Promise<Record<string, string>>;
/**
 * For each service with a LIVE session in the profile (cookie-gated), the
 * account it is signed in as (from saved logins). Intersecting with live
 * sessions means a stale saved-login for a service you've since logged out of
 * never shows.
 */
export declare function loginsWithAccountsForProfile(profileName: string): Promise<Array<{
    service: string;
    username?: string;
}>>;
/** Services with a live session in the given profile (best-effort; [] if none
 *  detected or the cookie store is unreadable). */
export declare function loginsForProfile(profileName: string): Promise<string[]>;
/** Profile names that have a live session for the given service. */
export declare function profilesLoggedInto(service: string): Promise<string[]>;
export {};
