/**
 * Card Removal Handler
 *
 * Handles smart card removal events and manages session termination
 * for PIV/CAC authentication.
 *
 * Features:
 * - Card removal detection via PKCS#11
 * - Session binding to card presence
 * - Configurable grace periods
 * - Re-authentication support
 * - Webhook notifications
 *
 * @packageDocumentation
 */
import { EventEmitter } from 'events';
import { type CardEvent, type CardSessionBinding, type CardRemovalPolicy, CardEventType, PIVErrorCode } from './types.js';
/**
 * Session state
 */
export declare enum SessionState {
    /** Session is active with card present */
    ACTIVE = "active",
    /** Card removed, within grace period */
    GRACE_PERIOD = "grace_period",
    /** Awaiting re-authentication */
    AWAITING_REAUTH = "awaiting_reauth",
    /** Session terminated */
    TERMINATED = "terminated"
}
/**
 * Card removal event
 */
export interface CardRemovalEvent extends CardEvent {
    type: CardEventType.CARD_REMOVED;
    sessionIds: string[];
    action: 'terminate' | 'grace_period' | 'await_reauth';
}
/**
 * Session termination event
 */
export interface SessionTerminationEvent {
    sessionId: string;
    userId: string;
    reason: 'card_removed' | 'grace_period_expired' | 'reauth_timeout' | 'manual';
    timestamp: Date;
}
/**
 * Card removal handler events
 */
export interface CardRemovalHandlerEvents {
    cardInserted: (event: CardEvent) => void;
    cardRemoved: (event: CardRemovalEvent) => void;
    sessionTerminated: (event: SessionTerminationEvent) => void;
    gracePeriodStarted: (sessionId: string, expiresAt: Date) => void;
    gracePeriodExpired: (sessionId: string) => void;
    reauthRequired: (sessionId: string, expiresAt: Date) => void;
    reauthTimeout: (sessionId: string) => void;
    reauthSuccess: (sessionId: string) => void;
}
/**
 * Card removal error
 */
export declare class CardRemovalError extends Error {
    readonly code: PIVErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code?: PIVErrorCode, details?: Record<string, unknown>);
}
/**
 * Session not found error
 */
export declare class SessionNotFoundError extends CardRemovalError {
    constructor(sessionId: string);
}
/**
 * Re-authentication required error
 */
export declare class ReauthenticationRequiredError extends CardRemovalError {
    constructor(sessionId: string);
}
/**
 * Card removal handler service
 */
export declare class CardRemovalHandler extends EventEmitter {
    private policy;
    private sessions;
    private readerToSessions;
    private atrToSessions;
    constructor(policy?: Partial<CardRemovalPolicy>);
    /**
     * Bind a session to a card
     */
    bindSession(binding: CardSessionBinding): void;
    /**
     * Unbind a session from card tracking
     */
    unbindSession(sessionId: string): void;
    /**
     * Handle card insertion event
     */
    handleCardInserted(event: CardEvent): void;
    /**
     * Handle card removal event
     */
    handleCardRemoved(event: CardEvent): void;
    /**
     * Process card removal for a session
     */
    private processCardRemoval;
    /**
     * Start grace period for a session
     */
    private startGracePeriod;
    /**
     * Start re-authentication flow for a session
     */
    private startReauthentication;
    /**
     * Handle successful re-authentication
     */
    private handleReauthentication;
    /**
     * Terminate a session
     */
    terminateSession(sessionId: string, reason: 'card_removed' | 'grace_period_expired' | 'reauth_timeout' | 'manual'): void;
    /**
     * Check if a session is valid (card present)
     */
    isSessionValid(sessionId: string): boolean;
    /**
     * Get session state
     */
    getSessionState(sessionId: string): SessionState | undefined;
    /**
     * Get session binding
     */
    getSessionBinding(sessionId: string): CardSessionBinding | undefined;
    /**
     * Update session activity timestamp
     */
    updateSessionActivity(sessionId: string): void;
    /**
     * Validate session and throw if invalid
     */
    validateSession(sessionId: string): void;
    /**
     * Re-authenticate session with new certificate
     */
    reauthenticateSession(sessionId: string, certificateFingerprint: string): boolean;
    /**
     * Send webhook notification for card removal
     */
    private sendWebhookNotification;
    /**
     * Get all active sessions
     */
    getActiveSessions(): CardSessionBinding[];
    /**
     * Get sessions by state
     */
    getSessionsByState(state: SessionState): CardSessionBinding[];
    /**
     * Get statistics
     */
    getStats(): {
        total: number;
        active: number;
        gracePeriod: number;
        awaitingReauth: number;
        terminated: number;
    };
    /**
     * Update policy
     */
    updatePolicy(policy: Partial<CardRemovalPolicy>): void;
    /**
     * Get current policy
     */
    getPolicy(): CardRemovalPolicy;
    /**
     * Shutdown handler (clear all timers)
     */
    shutdown(): void;
}
/**
 * Get the default card removal handler
 */
export declare function getCardRemovalHandler(policy?: Partial<CardRemovalPolicy>): CardRemovalHandler;
/**
 * Create a new card removal handler
 */
export declare function createCardRemovalHandler(policy?: Partial<CardRemovalPolicy>): CardRemovalHandler;
/**
 * Reset the default handler (for testing)
 */
export declare function resetCardRemovalHandler(): void;
//# sourceMappingURL=card-removal-handler.d.ts.map