import { type SessionStorageConfig, type SessionStore, type StoredSession, type TransportProtocol, type TransportSession, type TransportState } from '@frontmcp/auth';
import { type EncryptedBlob } from '@frontmcp/utils';
/**
 * In-memory session store implementation
 */
export declare class InMemorySessionStore implements SessionStore {
    private readonly sessions;
    get(sessionId: string): Promise<StoredSession | null>;
    set(sessionId: string, session: StoredSession, ttlMs?: number): Promise<void>;
    delete(sessionId: string): Promise<void>;
    exists(sessionId: string): Promise<boolean>;
    allocId(): string;
    /**
     * Clean up expired sessions
     */
    cleanup(): number;
    /**
     * Get count of active sessions
     */
    get size(): number;
}
/**
 * Transport Session Manager
 *
 * Manages transport sessions independent of authorization.
 * Supports both stateless (JWT-encrypted) and stateful (store-backed) modes.
 *
 * Key concepts:
 * - Authorization = User identity + permissions (1 per user token)
 * - TransportSession = Protocol-specific connection (N per authorization)
 * - One authorization can have multiple transport sessions (e.g., multiple browser tabs)
 */
export declare class TransportSessionManager {
    private readonly store;
    private readonly mode;
    private readonly encryptionKey;
    constructor(config: SessionStorageConfig & {
        encryptionSecret?: string;
    });
    /**
     * Create a new transport session for an authorization
     *
     * @param authorizationId - The authorization this session belongs to
     * @param protocol - Transport protocol (sse, streamable-http, etc.)
     * @param options - Additional session options
     * @returns The created transport session
     */
    createSession(authorizationId: string, protocol: TransportProtocol, options?: {
        expiresAt?: number;
        fingerprint?: string;
        transportState?: TransportState;
        tokens?: Record<string, EncryptedBlob>;
    }): Promise<TransportSession>;
    /**
     * Get an existing session by ID
     *
     * @param sessionId - The session ID (encrypted JWT or UUID)
     * @returns The session if found and valid, null otherwise
     */
    getSession(sessionId: string): Promise<TransportSession | null>;
    /**
     * Get stored session with tokens (for orchestrated mode)
     */
    getStoredSession(sessionId: string): Promise<StoredSession | null>;
    /**
     * Update session state
     */
    updateSession(sessionId: string, updates: {
        transportState?: TransportState;
        expiresAt?: number;
    }): Promise<boolean>;
    /**
     * Delete a session
     */
    deleteSession(sessionId: string): Promise<boolean>;
    /**
     * Encode a session as an encrypted JWT for the Mcp-Session-Id header
     *
     * @param session - The transport session to encode
     * @param _additionalState - (deprecated) Reserved for backwards compatibility
     * @returns Encrypted session JWT
     */
    encodeSessionJwt(session: TransportSession, _additionalState?: unknown): string;
    /**
     * Decode an encrypted session JWT
     *
     * @param jwt - The encrypted session JWT
     * @returns Decoded session or null if invalid
     *
     * Note: In stateless mode, the session.id is the JWT token itself (not the decoded sid).
     * This ensures consistency with createSession() which sets session.id = encodeSessionJwt().
     */
    private decryptSessionJwt;
    /**
     * Check if a session exists and is valid
     */
    sessionExists(sessionId: string): Promise<boolean>;
    /**
     * Get the storage mode
     */
    get storageMode(): 'stateless' | 'stateful';
}
//# sourceMappingURL=transport-session.manager.d.ts.map