/**
 * Cloudflare KV Resume Token Store
 *
 * Durable resume-token store backed by a Cloudflare Workers KV namespace, so a
 * resume token minted at consent time survives cold starts, process restarts,
 * and multi-instance deployments (the failure mode the in-memory store causes —
 * the user gets re-prompted because the token vanished). Mirrors the
 * delegation-verifier-kv.ts adapter shape.
 *
 * Key structure:
 * - `resume:{token}` — JSON-encoded {@link StoredResumeToken}
 *
 * Tokens are minted with CSPRNG entropy (see generateResumeToken in
 * @kya-os/mcp-i-core), never time+Math.random.
 */
import { type ResumeTokenStore } from "@kya-os/mcp-i-core";
/**
 * Minimal Cloudflare KV surface needed by the store. `put` accepts the standard
 * KV `{ expirationTtl }` (seconds) so the namespace also evicts expired tokens
 * natively; logical expiry via `expiresAt` is enforced regardless.
 */
export interface ResumeTokenKVNamespace {
    get(key: string): Promise<string | null>;
    put(key: string, value: string, options?: {
        expirationTtl?: number;
    }): Promise<void>;
    delete(key: string): Promise<void>;
}
export declare class CloudflareKVResumeTokenStore implements ResumeTokenStore {
    private kv;
    private ttlMs;
    constructor(kv: ResumeTokenKVNamespace, ttlMs?: number);
    private key;
    private read;
    create(agentDid: string, scopes: string[], metadata?: Record<string, unknown>): Promise<string>;
    get(token: string): Promise<{
        agentDid: string;
        scopes: string[];
        createdAt: number;
        expiresAt: number;
        metadata?: Record<string, unknown>;
    } | null>;
    fulfill(token: string): Promise<void>;
}