/**
 * Session Manager
 *
 * Caches derived cryptographic keys in memory with a configurable timeout.
 * This avoids the expensive Argon2id derivation on every operation while
 * still enforcing a session lifetime for security.
 *
 * Security notes:
 * - Cached keys are held in plain Buffers (Node.js does not support
 *   memory-locked pages from userland). They are zeroed on invalidation.
 * - Session entries are automatically evicted after the configured timeout.
 * - The manager never persists keys to disk.
 */
import type { KeyDerivationParams } from '../crypto/kdf';
/**
 * Derived key pair for a user session.
 */
export interface DerivedKeys {
    /** HKDF-derived authentication key (32 bytes) */
    authKey: Buffer;
    /** HKDF-derived encryption key (32 bytes) */
    encryptionKey: Buffer;
}
/**
 * Configuration for the SessionManager.
 */
export interface SessionManagerConfig {
    /** Session timeout in milliseconds (default: 30 minutes) */
    timeoutMs?: number;
    /** KDF parameters forwarded to Argon2id (optional overrides) */
    kdfParams?: KeyDerivationParams;
}
/**
 * SessionManager caches derived keys per userId with automatic expiry.
 *
 * @example
 * ```typescript
 * const session = new SessionManager({ timeoutMs: 15 * 60 * 1000 });
 *
 * // First call derives keys (slow — Argon2id)
 * const keys = await session.getOrDeriveKeys(userId, salt, masterPassword);
 *
 * // Subsequent calls return cached keys (fast)
 * const cached = await session.getOrDeriveKeys(userId, salt);
 * ```
 */
export declare class SessionManager {
    private cache;
    private timeoutMs;
    private kdfParams;
    constructor(config?: SessionManagerConfig);
    /**
     * Return cached keys for the given user, or derive new ones.
     *
     * If keys exist in the cache and have not expired, they are returned
     * immediately. Otherwise, `masterPassword` and `salt` are required to
     * perform a fresh Argon2id derivation.
     *
     * @param userId         - The user identifier
     * @param salt           - The salt used during key derivation
     * @param masterPassword - Required on first call or after expiry
     * @returns The derived auth + encryption key pair
     */
    getOrDeriveKeys(userId: string, salt: Buffer, masterPassword?: string): Promise<DerivedKeys>;
    /**
     * Invalidate (clear) the cached session for a user.
     *
     * Zeroes the key buffers before removing the entry.
     *
     * @param userId - The user identifier
     */
    invalidateSession(userId: string): void;
    /**
     * Invalidate all cached sessions.
     */
    invalidateAll(): void;
    /**
     * Check whether a valid (non-expired) session exists for a user.
     *
     * @param userId - The user identifier
     */
    hasSession(userId: string): boolean;
    /**
     * Return the number of active (non-expired) sessions.
     */
    get activeSessionCount(): number;
    /**
     * Return the configured timeout in milliseconds.
     */
    get sessionTimeoutMs(): number;
    private isExpired;
    private cacheKeys;
    /**
     * Zero out key buffers to minimize exposure in memory.
     */
    private zeroKeys;
}
//# sourceMappingURL=session.d.ts.map