/**
 * SessionTracker - Tracks per-session state for behavioral detection operators.
 *
 * Enables multi-turn injection detection, call frequency tracking,
 * and pattern repetition counting. All state is internal; public methods
 * return copies to preserve immutability.
 *
 * @module agent-threat-rules/session-tracker
 */
import type { AgentEvent } from './types.js';
/** Snapshot of session state returned to callers (immutable copy) */
export interface SessionStateSnapshot {
    readonly sessionId: string;
    readonly eventCount: number;
    readonly oldestEventTimestamp: number | undefined;
    readonly newestEventTimestamp: number | undefined;
    /** Event history for sequence detection (immutable copies) */
    readonly events: readonly Readonly<AgentEvent>[];
}
export declare class SessionTracker {
    private readonly sessions;
    /**
     * Record an agent event for the given session.
     * Extracts tool name and patterns from event fields/content.
     */
    recordEvent(sessionId: string, event: AgentEvent, patterns?: readonly string[]): void;
    /**
     * Get the number of calls to a specific tool within a time window.
     */
    getCallFrequency(sessionId: string, toolName: string, windowMs: number): number;
    /**
     * Get the number of times a pattern has been observed within a time window.
     */
    getPatternFrequency(sessionId: string, pattern: string, windowMs: number): number;
    /**
     * Get total event count for a session, optionally within a time window.
     */
    getEventCount(sessionId: string, windowMs?: number): number;
    /**
     * Get an immutable snapshot of session state. Returns undefined if session does not exist.
     */
    getSessionSnapshot(sessionId: string): SessionStateSnapshot | undefined;
    /**
     * Evict sessions that have been inactive longer than maxAgeMs.
     * Returns the number of sessions evicted.
     */
    cleanup(maxAgeMs: number): number;
    /** Get the number of tracked sessions */
    getSessionCount(): number;
    /**
     * Ensure we don't exceed the maximum session count.
     * Evicts the oldest session if at capacity.
     */
    private ensureCapacity;
    private getOrCreateSession;
    private extractToolName;
}
//# sourceMappingURL=session-tracker.d.ts.map