import { S as StorageAdapter } from '../../storage-adapter-Dv_hy7k9.mjs';

/**
 * Default StorageAdapter implementation, on Supabase Storage.
 *
 * This ships the *correct* attachment security model as the default — the one
 * the original scaffold got wrong. It is one implementation of the
 * `StorageAdapter` interface; a BYO adapter (S3/R2/GCS) is equally valid.
 *
 * The three interface rules, as implemented here:
 *
 *   1. PRIVATE AT REST — the bucket must be created as a *private* bucket in
 *      Supabase. We never call `getPublicUrl`. (If the bucket is public, that
 *      is a host-app misconfiguration; this adapter never relies on it.)
 *
 *   2. SIGNED, SHORT-LIVED READS — `upload` and `resign` return
 *      `createSignedUrl` results with a bounded TTL.
 *
 *   3. USER-NAMESPACED, UNGUESSABLE PATHS — every path is
 *      `<userId>/<conversationId>/<randomUUID>/<safeFilename>`. The adapter is
 *      bound to one verified user and derives the path itself, so an upload
 *      cannot land in another user's namespace. `resign`/`remove` refuse paths
 *      outside the bound user's prefix.
 */

interface SupabaseStorageOptions {
    /** Supabase project URL. Defaults to `process.env.NEXT_PUBLIC_SUPABASE_URL`. */
    supabaseUrl?: string;
    /**
     * Service-role key. Required — signing + private writes need it. Defaults to
     * `process.env.SUPABASE_SERVICE_ROLE_KEY`. NEVER expose this to the client;
     * this adapter only ever runs server-side (guarded by `server-only`).
     */
    serviceRoleKey?: string;
    /** Storage bucket name. Defaults to `chat-attachments`. Must be PRIVATE. */
    bucket?: string;
    /** Signed-URL TTL in seconds. Defaults to 3600 (1 hour). */
    signedUrlTtlSeconds?: number;
}
/**
 * Create a `StorageAdapterFactory` backed by Supabase Storage.
 *
 * Pass to `createChatHandler({ storage: createSupabaseStorage() })`. Requires
 * a PRIVATE `chat-attachments` bucket (or whatever `bucket` you name) and the
 * service-role key. Each adapter instance is bound to the verified `userId`
 * the handler provides per request; the Supabase client is shared.
 */
declare function createSupabaseStorage(options?: SupabaseStorageOptions): (userId: string) => StorageAdapter;

export { type SupabaseStorageOptions, createSupabaseStorage };