/**
 * Pluggable credential backends.
 *
 * A backend stores and retrieves OPAQUE ciphertext blobs keyed by a string.
 * Encryption and key derivation live in PerPluginStore; backends never see
 * plaintext. This seam lets MCP servers run serverless (e.g. Cloudflare Workers
 * KV) while stdio/VM deployments keep the on-disk layout via LocalFsBackend.
 */
/** Stores opaque ciphertext blobs keyed by a string. */
export interface CredentialBackend {
    get(key: string): Promise<Buffer | null>;
    put(key: string, blob: Buffer): Promise<void>;
    delete(key: string): Promise<void>;
}
/** Map-backed backend, primarily for tests. */
export declare class InMemoryBackend implements CredentialBackend {
    private store;
    get(key: string): Promise<Buffer | null>;
    put(key: string, blob: Buffer): Promise<void>;
    delete(key: string): Promise<void>;
}
/** Stores blobs on local disk, preserving the per-plugin layout. */
export declare class LocalFsBackend implements CredentialBackend {
    get(key: string): Promise<Buffer | null>;
    put(key: string, blob: Buffer): Promise<void>;
    delete(key: string): Promise<void>;
}
/** Minimal injectable HTTP client returning status + body. */
export interface Http {
    request(method: string, url: string, data?: Buffer, headers?: Record<string, string>): Promise<{
        status: number;
        body: Buffer;
    }>;
}
/**
 * Stores blobs in a Cloudflare Workers KV namespace over HTTP.
 *
 * Error contract: 200 -> data, 404 -> absent (null for get, no-op for delete).
 * Every other HTTP status, plus transport errors from the HTTP client, raises --
 * failures are loud, never silently returned as data. Error messages carry the
 * status only; never the token or the response body.
 */
export declare class CfKvBackend implements CredentialBackend {
    private readonly baseUrl;
    private readonly token?;
    private readonly http;
    constructor(baseUrl: string, token?: string, http?: Http);
    private url;
    private headers;
    get(key: string): Promise<Buffer | null>;
    put(key: string, blob: Buffer): Promise<void>;
    delete(key: string): Promise<void>;
}
/** Select a credential backend from the MCP_STORAGE_BACKEND env var. */
export declare function backendFromEnv(): CredentialBackend;
//# sourceMappingURL=backends.d.ts.map