import type { ProxyDataAdapter } from "../adapter";
/**
 * Minimal structural view of a Cloudflare KV namespace's read surface. Declared
 * locally so `@authhero/proxy` stays free of a hard `@cloudflare/workers-types`
 * dependency — a real `KVNamespace` binding is structurally assignable to this.
 */
export interface KvNamespaceReader {
    get<T = unknown>(key: string, type: "json"): Promise<T | null>;
}
/**
 * Minimal structural view of a Cloudflare KV namespace's write surface, consumed
 * by the control-plane publisher. A real `KVNamespace` is assignable to this.
 */
export interface KvNamespaceWriter {
    put(key: string, value: string): Promise<void>;
    delete(key: string): Promise<void>;
}
export declare const DEFAULT_KV_HOST_KEY_PREFIX = "authhero-proxy-host:";
/**
 * Build the KV key for a host. Shared by the proxy reader
 * (`createKvProxyAdapter`) and the control-plane publisher so both agree on the
 * exact key format. Hosts are lowercased for case-insensitive lookups.
 */
export declare function buildKvHostKey(keyPrefix: string, host: string): string;
export interface KvProxyAdapterOptions {
    kv: KvNamespaceReader;
    keyPrefix?: string;
    timeoutMs?: number;
}
/**
 * Build a `ProxyDataAdapter` that resolves hosts from a Cloudflare KV namespace.
 * The control plane publishes the full `ResolvedHost` blob per host into KV; the
 * proxy reads it with a single, unauthenticated, edge-local `KV.get` — faster
 * and more reliable on cold reads than the two-hop HTTP control-plane adapter.
 *
 * Intended to sit in the `upstream` seam of `createCacheAdapterHostCache` as the
 * durable-edge layer. A null from KV means "not found"; callers can keep the
 * HTTP adapter as a miss / `stale-if-error` fallback during cutover.
 */
export declare function createKvProxyAdapter(options: KvProxyAdapterOptions): ProxyDataAdapter;