/**
 * Per-session visibility state recording explicit tool reveals and hides.
 */
export interface SessionVisibilityState {
    sessionId: string;
    enabledTools: Set<string>;
    disabledTools: Set<string>;
    lastActive: number;
}
export interface SessionVisibilityStoreOptions {
    /**
     * Time-to-live for inactive sessions in minutes (default: 60).
     */
    ttlMinutes?: number;
    /**
     * Maximum concurrent sessions held in memory before oldest inactive is evicted (default: 10,000).
     */
    maxSessions?: number;
    /**
     * Background sweep interval in seconds (default: 300).
     */
    sweepIntervalSeconds?: number;
    /**
     * Called when a new revocation is refused because the cap is full.
     */
    logger?: {
        warn(message: string, meta?: unknown): void;
    };
}
/**
 * Manages per-session dynamic visibility state for MCP tools with memory bounds,
 * TTL expiry, and LRU pruning.
 */
export declare class SessionVisibilityStore {
    private readonly sessions;
    /**
     * Explicit revokes survive LRU eviction of the session record so disableTools
     * does not fail open while the entry is still inside its TTL. The same TTL
     * sweeps them; they are also capped at maxSessions.
     */
    private readonly revocations;
    /**
     * Denies that follow a verified subject across session ids.
     * Anonymous callers have no entry here. A full map refuses a new subject
     * rather than dropping a live deny.
     */
    private readonly subjectDenies;
    private readonly ttlMs;
    private readonly maxSessions;
    private readonly sweepTimer;
    private logger?;
    constructor(options?: SessionVisibilityStoreOptions);
    setLogger(logger: {
        warn(message: string, meta?: unknown): void;
    }): void;
    /**
     * Retrieves active session state or initializes a new entry.
     * Updates lastActive timestamp and maintains Map insertion order for LRU.
     */
    getOrCreateSession(sessionId: string): SessionVisibilityState;
    /**
     * Retrieves active session state without creating one if absent.
     * Updates lastActive timestamp and LRU order if found.
     */
    getSession(sessionId: string): SessionVisibilityState | undefined;
    /**
     * Explicitly enables (reveals) tools for a given session.
     */
    enableTools(sessionId: string, toolNames: string[]): void;
    /**
     * Explicitly disables (hides) tools for a given session.
     * Throws when a new session cannot be recorded without dropping another live deny.
     */
    disableTools(sessionId: string, toolNames: string[]): void;
    /**
     * Returns whether a tool is explicitly enabled for a session.
     */
    hasEnabled(sessionId: string, toolName: string): boolean;
    /**
     * Returns whether a tool is explicitly disabled for a session.
     */
    hasDisabled(sessionId: string, toolName: string): boolean;
    /**
     * Hides tools for a verified subject. The deny survives a new session id.
     * Throws when a new subject cannot be recorded without dropping another live deny.
     */
    disableSubject(subject: string, toolNames: string[]): void;
    /**
     * Lifts a subject-scoped deny and the same names on every session key for
     * that subject, so a grant on a later session restores the earlier one.
     */
    enableSubject(subject: string, toolNames: string[]): void;
    hasSubjectDisabled(subject: string, toolName: string): boolean;
    hasSubjectDenies(subject: string): boolean;
    /**
     * True when this session still has at least one unexpired revocation.
     * Used after the session record itself has been evicted.
     */
    hasRevocations(sessionId: string): boolean;
    /**
     * Clears visibility state for a session.
     */
    clearSession(sessionId: string): void;
    /**
     * Total number of tracked sessions currently in memory.
     */
    get activeSessionCount(): number;
    /**
     * Sweeps and purges sessions and revocations that have exceeded the TTL limit.
     */
    cleanupExpired(): void;
    /**
     * Evicts the least-recently used session entry.
     * Revocations are left in place until their own TTL.
     */
    private evictOldest;
    private liveRevocation;
    private touchRevocation;
    private liveSubjectDeny;
    private touchSubjectDeny;
    /**
     * Sweeps expired subject denies. A new subject is refused when the map is still
     * at the cap, so a live deny is never dropped to make room.
     */
    private makeSubjectRoom;
    private makeRevocationRoom;
    /**
     * Cleans up timers and drops all session records.
     */
    destroy(): void;
}
//# sourceMappingURL=session-store.d.ts.map