/**
 * Zoe Server — Server-side Session Management
 *
 * Wraps a PersistenceBackend for server-specific needs:
 *  - TTL-based session expiration
 *  - Per-API-key concurrency limits
 *  - Periodic cleanup of stale sessions
 *
 * Raw storage is delegated to a PersistenceBackend (default: file-based).
 * Server metadata (apiKeyHash, lastActivityAt) lives in memory and in
 * the `metadata` field of SessionData.
 */
import type { ProviderType, Message, SessionData, PersistenceBackend } from "../../core/types.js";
export interface ServerSessionManagerOptions {
    /** Session TTL in milliseconds (default: 24 hours) */
    sessionTTL?: number;
    /** Inactivity timeout in milliseconds (default: 30 minutes) */
    inactivityTimeout?: number;
    /** Max concurrent sessions per API key (default: 5) */
    maxSessionsPerKey?: number;
    /** Cleanup interval in milliseconds (default: 5 minutes) */
    cleanupInterval?: number;
    /** Directory for file-based session storage (ignored when `backend` is set) */
    sessionDir?: string;
    /** Custom persistence backend (overrides sessionDir) */
    backend?: PersistenceBackend;
}
export declare function hashKey(key: string): string;
export declare class ServerSessionManager {
    private sessions;
    private sessionTTL;
    private inactivityTimeout;
    private maxSessionsPerKey;
    private cleanupInterval;
    private backend;
    private cleanupTimer;
    constructor(options?: ServerSessionManagerOptions);
    /**
     * Start the periodic cleanup timer.
     */
    startCleanup(): void;
    /**
     * Stop the periodic cleanup timer.
     */
    stopCleanup(): void;
    /**
     * Create a new session. Enforces per-API-key session limits.
     * Returns the new SessionData or throws if the limit is exceeded.
     * Awaits persistence — callers should await to ensure backend errors propagate.
     */
    createSession(apiKey: string, provider?: ProviderType, model?: string): Promise<SessionData>;
    /**
     * Get a session by its ID, verifying ownership via API key hash.
     * Returns null if the session does not exist, has expired, or is not owned
     * by the provided API key.
     */
    getSession(id: string, apiKeyHash: string): Promise<SessionData | null>;
    /**
     * Add a message to an existing session.
     * Updates the last-activity timestamp.
     */
    addMessage(sessionId: string, message: Message): void;
    /**
     * Delete a session by ID.
     */
    deleteSession(id: string): void;
    /**
     * Get all active (non-expired) sessions.
     */
    getActiveSessions(): SessionData[];
    /**
     * Remove expired sessions from memory and backend.
     */
    cleanup(): void;
    private getSessionsByKey;
    private isExpired;
    private persistSession;
    private persistSessionAsync;
    private loadSessionFromBackend;
    private verifyOwnership;
}