import { D as DPoPNonceStore } from '../types-CuViAwD5.js';
import 'hono';

/** Minimal D1Database subset used by d1Store (avoids @cloudflare/workers-types dependency). */
interface D1DatabaseLike {
    prepare(sql: string): D1PreparedStatementLike;
}
interface D1PreparedStatementLike {
    bind(...params: unknown[]): D1PreparedStatementLike;
    run(): Promise<{
        success: boolean;
        meta: {
            changes: number;
        };
    }>;
    first(): Promise<Record<string, unknown> | null>;
}
interface D1StoreOptions {
    /** Cloudflare D1 database binding. */
    database: D1DatabaseLike;
    /** Table name (default: "dpop_jti"). Must match /^[A-Za-z_][A-Za-z0-9_]*$/. */
    tableName?: string;
}
/**
 * Cloudflare D1-backed replay cache. Uses `INSERT OR IGNORE` on a `jti` PRIMARY KEY for
 * an atomic insert-if-absent: D1 reports `meta.changes === 1` for fresh inserts, `0` for
 * collisions. Strong consistency from the SQLite primary makes this safe across
 * concurrent Worker invocations.
 *
 * Note: `INSERT OR IGNORE` does not honor TTL — an expired-but-not-yet-purged row will
 * still block re-acquisition of the same jti. Operators should call `purge()` periodically
 * (cron trigger or scheduled handler) to delete rows whose `expires_at < now`.
 *
 * The schema is created on demand via `CREATE TABLE IF NOT EXISTS` once per instance.
 */
declare function d1Store(options: D1StoreOptions): DPoPNonceStore;

export { type D1DatabaseLike, type D1PreparedStatementLike, type D1StoreOptions, d1Store };