import { D as DPoPNonceStore } from '../types-CuViAwD5.js';
import 'hono';

/** Minimal KVNamespace subset used by kvStore (avoids @cloudflare/workers-types dependency). */
interface KVNamespaceLike {
    get(key: string, options?: {
        type?: "text";
    }): Promise<string | null>;
    put(key: string, value: string, options?: {
        expirationTtl?: number;
    }): Promise<void>;
}
interface KVStoreOptions {
    /** Cloudflare Workers KV namespace binding. */
    namespace: KVNamespaceLike;
    /** Key prefix to namespace replay-cache entries (default: "dpop:jti:"). */
    keyPrefix?: string;
    /**
     * Optional best-effort race-detection delay in milliseconds. When > 0 the store
     * sleeps for this long after `put` and re-reads the key, returning false if the
     * value disagrees with the one it just wrote. Default 0 (disabled) — KV's
     * eventual consistency makes any value tunable but never fully reliable.
     */
    raceWindowMs?: number;
}
/**
 * Cloudflare Workers KV-backed replay cache.
 *
 * IMPORTANT: KV is eventually consistent across edge locations. Two requests routed to
 * different POPs may both observe the key as absent and both succeed in `put`, allowing
 * a brief replay window. RFC 9449 §11.1 acknowledges this: jti enforcement is at-most-once
 * but is allowed to degrade to best-effort under partition. For strict atomicity, use
 * `d1Store` (single primary) or `durableObjectStore` (single-writer per object).
 *
 * Caches expire automatically via `expirationTtl` derived from the proof's `expiresAt`,
 * so `purge()` is a no-op returning 0. The KV minimum is 60 seconds — shorter requested
 * TTLs are clamped to that floor.
 */
declare function kvStore(options: KVStoreOptions): DPoPNonceStore;

export { type KVNamespaceLike, type KVStoreOptions, kvStore };