/**
 * Durable, TTL-bounded store for short-lived OAuth handshake state
 * (delegated-flow ``pendingSessions`` + issued ``authCodes``).
 *
 * The delegated OAuth round-trip spans two independent HTTP requests
 * (``/authorize`` -> upstream consent -> ``/callback`` -> ``/token``). On a
 * serverless/container deploy (CF single-DO + ``sleepAfter``) the container can
 * cold-start or be a different instance between those requests, so an
 * in-process ``Map`` loses the state and ``/callback`` returns "Invalid state".
 * Backing the state with a shared durable KV survives the restart.
 *
 * A ``SessionKv`` (get/put/delete of opaque strings) is injected in deploy mode
 * (e.g. the container's ``kv.internal`` backend); when omitted the store falls
 * back to a process-local ``Map`` (stdio / single-process, where one request
 * context handles the whole flow).
 */
export interface SessionKv {
    get(key: string): Promise<string | null>;
    put(key: string, value: string): Promise<void>;
    delete(key: string): Promise<void>;
}
/** A Buffer-based blob backend, matching mcp-core's ``CredentialBackend`` / ``CfKvBackend``. */
export interface BufferKvBackend {
    get(key: string): Promise<Buffer | null>;
    put(key: string, blob: Buffer): Promise<void>;
    delete(key: string): Promise<void>;
}
/**
 * Adapt a Buffer-based blob backend (e.g. ``CfKvBackend`` over the container's
 * ``kv.internal`` handler) to the string ``SessionKv`` interface. Keys are
 * namespaced (default prefix, or a caller-supplied one) so the short-lived
 * OAuth handshake state can share a KV with the server's other data
 * (credential vaults, etc.) without colliding.
 *
 * A CF Container's ``kv.internal`` outbound handler commonly allowlists keys
 * by app-scoped prefix (e.g. only ``<plugin>/*`` may pass) as a security
 * boundary against writing outside the app's own KV namespace. Callers
 * deployed behind such a handler MUST pass a prefix matching that allowlist
 * (e.g. ``"<plugin>/delegated-oauth:"``) -- the default global prefix will be
 * rejected (403) by a namespace-restricted handler.
 */
export declare function wrapKvBackendAsSessionKv(backend: BufferKvBackend, keyPrefix?: string): SessionKv;
export interface SessionStore<T> {
    get(key: string): Promise<T | undefined>;
    set(key: string, value: T): Promise<void>;
    delete(key: string): Promise<void>;
}
export declare function createSessionStore<T>(kv: SessionKv | undefined, ttlSeconds: number): SessionStore<T>;
//# sourceMappingURL=session-store.d.ts.map