/**
 * ATR Session Module - Built-in behavioral detection module
 *
 * Provides cross-event analysis using SessionTracker.
 * This is the reference implementation for ATR modules.
 *
 * Functions:
 * - call_frequency: Count tool calls within a time window
 * - pattern_frequency: Count pattern occurrences within a window
 * - event_count: Total events in a session within a window
 * - session_age: Time since first event in session (seconds)
 *
 * @module agent-threat-rules/modules/session
 */
import type { AgentEvent } from '../types.js';
import { SessionTracker } from '../session-tracker.js';
import type { ATRModule, ModuleCondition, ModuleResult } from './index.js';
export declare class SessionModule implements ATRModule {
    readonly name = "session";
    readonly description = "Cross-event behavioral analysis using session state tracking";
    readonly version = "0.1.0";
    readonly functions: readonly [{
        readonly name: "call_frequency";
        readonly description: "Count how many times a specific tool was called within a time window";
        readonly args: readonly [{
            readonly name: "tool_name";
            readonly type: "string";
            readonly required: true;
            readonly description: "Tool name to count";
        }, {
            readonly name: "window";
            readonly type: "string";
            readonly required: false;
            readonly description: "Time window (e.g., \"5m\", \"1h\"). Default: 5m";
        }];
    }, {
        readonly name: "pattern_frequency";
        readonly description: "Count how many times a pattern was matched within a time window";
        readonly args: readonly [{
            readonly name: "pattern";
            readonly type: "string";
            readonly required: true;
            readonly description: "Pattern string to count";
        }, {
            readonly name: "window";
            readonly type: "string";
            readonly required: false;
            readonly description: "Time window. Default: 5m";
        }];
    }, {
        readonly name: "event_count";
        readonly description: "Total number of events in the current session within a time window";
        readonly args: readonly [{
            readonly name: "window";
            readonly type: "string";
            readonly required: false;
            readonly description: "Time window. Default: 5m";
        }];
    }, {
        readonly name: "session_age";
        readonly description: "Time in seconds since the first event in this session";
        readonly args: readonly [];
    }];
    private tracker;
    constructor(tracker?: SessionTracker);
    initialize(): Promise<void>;
    evaluate(event: AgentEvent, condition: ModuleCondition): Promise<ModuleResult>;
    destroy(): Promise<void>;
}
//# sourceMappingURL=session.d.ts.map