/**
 * @fileoverview Simple in-memory session store for MCP HTTP transport.
 * Implements session management as per MCP Spec 2025-06-18.
 * @see {@link https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management | MCP Session Management}
 * @module src/mcp-server/transports/http/sessionStore
 */
/** Eagerly creates the session event counter so the series exists from startup. */
export declare function initSessionMetrics(): void;
/**
 * Identity information for binding sessions to authenticated users.
 * Used to prevent session hijacking across tenants/clients.
 */
export interface SessionIdentity {
    /** Client ID from JWT 'cid'/'client_id' claim */
    clientId?: string;
    /** Subject from JWT 'sub' claim */
    subject?: string;
    /** Tenant ID from JWT 'tid' claim */
    tenantId?: string;
}
/**
 * Represents a stateful MCP session with identity binding.
 * Sessions are bound to the authenticated identity to prevent hijacking.
 */
interface Session {
    clientId?: string;
    createdAt: Date;
    id: string;
    /** Whether identity fields have been bound (atomic snapshot on first write). */
    identityBound: boolean;
    lastAccessedAt: Date;
    subject?: string;
    tenantId?: string;
}
export declare class SessionStore {
    private sessions;
    private staleTimeout;
    private maxSessions;
    private cleanupInterval;
    constructor(staleTimeoutMs: number, maxSessions?: number);
    /**
     * Stops the cleanup interval and clears all sessions.
     * Call this during transport shutdown to prevent resource leaks.
     */
    destroy(): void;
    /**
     * Creates or retrieves a session with optional identity binding.
     * If identity is provided, binds the session to prevent cross-tenant/client hijacking.
     *
     * @param sessionId - The session identifier
     * @param identity - Optional identity info (tenantId, clientId, subject)
     * @returns The session object
     * @throws {McpError} If session ID format is invalid
     */
    getOrCreate(sessionId: string, identity?: SessionIdentity): Session;
    /**
     * Validates a session with identity binding checks.
     * Prevents session hijacking by verifying the session belongs to the requesting identity.
     *
     * Security checks:
     * 1. Session existence
     * 2. Staleness timeout
     * 3. Tenant ID match (if session has tenantId)
     * 4. Client ID match (if session has clientId)
     * 5. Subject match (if session has subject)
     *
     * @param sessionId - The session identifier
     * @param identity - The identity to validate against (from auth)
     * @returns True if session is valid and matches identity
     */
    isValidForIdentity(sessionId: string, identity?: SessionIdentity): boolean;
    /**
     * Terminates a session.
     * @param sessionId - The session identifier
     */
    terminate(sessionId: string): void;
    /**
     * Cleans up stale sessions that haven't been accessed recently.
     */
    private cleanupStaleSessions;
    /**
     * Gets the current number of active sessions.
     * @returns The number of sessions
     */
    getSessionCount(): number;
}
export {};
//# sourceMappingURL=sessionStore.d.ts.map