import { F as File, u as MetaStorageOptions, L as LocalMetaStorageOptions, i as BaseStorageOptions, M as MetaStorage, R as RetryConfig, d as FileInit, O as OperationOptions, f as FileQuery, l as BatchOperationResponse, e as FilePart, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-C9EdfTf1.js";
import { TokenCredential } from '@azure/core-auth';
import { BlobServiceClient } from '@azure/storage-blob';
import 'node:stream';
import 'node:timers';
import 'node:crypto';
import 'node:http';
import 'lru-cache';
declare class AzureFile extends File {
  requestId?: string;
  uri?: string;
}
interface ClientConfig {
  /**
   * Azure account key. Resolved from `AZURE_STORAGE_ACCOUNT_KEY` when omitted.
   */
  accountKey?: string;
  /**
   * Azure account name. Resolved from `AZURE_STORAGE_ACCOUNT` when omitted.
   */
  accountName?: string;
  /**
   * Azure container name.
   */
  containerName: string;
  /**
   * Microsoft Entra credential for Azure AD / Managed Identity workloads
   * (e.g. `DefaultAzureCredential` from `@azure/identity`). When supplied
   * without a shared key, SDK operations use token auth and signed URLs are
   * minted via User Delegation SAS.
   *
   * The principal must be allowed to access blob data and to call
   * `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
   * (for example via Storage Blob Data Contributor + Storage Blob Delegator).
   */
  credential?: TokenCredential;
  /**
   * Azure endpoint.
   */
  endpoint?: string;
  /**
   * Azure root path.
   */
  root?: string;
  /**
   * Pre-issued SAS token (with or without a leading `?`). Resolved from
   * `AZURE_STORAGE_SAS_TOKEN` when omitted. SAS-token adapters can use their
   * configured access but cannot mint fresh signed URLs.
   */
  sasToken?: string;
  /**
   * Controls whether a `credential`-backed adapter mints User Delegation SAS
   * URLs. Defaults to `true` when `credential` is supplied; set `false` for
   * token-authenticated SDK operations without signed-URL support.
   */
  useUserDelegationSas?: boolean;
}
interface ClientConfig {
  connectionString?: string;
  /**
   * Azure container name.
   */
  containerName: string;
  /**
   * Azure root path.
   */
  root?: string;
}
interface AzureMetaStorageOptions extends ClientConfig, MetaStorageOptions {
  client?: BlobServiceClient;
}
interface AzureStorageOptions extends BaseStorageOptions, ClientConfig {
  /**
   * Configure metafiles storage
   * @example
   * ```ts
   * Using local metafiles
   * const storage = new AzureStorage({
   *   bucket: 'upload',
   *   metaStorageConfig: { directory: '/tmp/upload-metafiles' }
   * })
   * ```
   * Using a separate bucket for metafiles
   * ```ts
   * const storage = new AzureStorage({
   *   bucket: 'upload',
   *   metaStorageConfig: { bucket: 'upload-metafiles' }
   * })
   * ```
   */
  metaStorageConfig?: AzureMetaStorageOptions | LocalMetaStorageOptions;
}
declare class AzureMetaStorage<T extends File = File> extends MetaStorage<T> {
  config: AzureMetaStorageOptions;
  private client;
  private containerClient;
  constructor(config: AzureMetaStorageOptions);
  override get(id: string): Promise<T>;
  override touch(id: string, file: T): Promise<T>;
  override delete(id: string): Promise<void>;
  override save(id: string, file: T): Promise<T>;
  list(): Promise<T[]>;
}
/**
 * Azure Blob Storage implementation.
 * @remarks
 * ## Supported Operations
 * - ✅ create, write, delete, get, list, update, copy, move
 * - ✅ Batch operations: deleteBatch (native Blob Batch API, 256/request), copyBatch + moveBatch (inherited from BaseStorage)
 * - ✅ exists: Implemented (checks metadata and Azure blob)
 * - ❌ getStream: Not implemented (use get() for file retrieval)
 * - ✅ getReadUrl / getUploadUrl: service SAS (shared key / connection string) or User Delegation SAS (Microsoft Entra credential). SAS-token adapters append the pre-issued token. Anonymous (public-container) adapters serve unsigned read URLs only — uploads are rejected.
 *
 * ## Authentication
 * Precedence: connection string, then account key + name, then Microsoft Entra `credential` (Azure AD / Managed Identity), then a pre-issued `sasToken`, then anonymous (public-container) access.
 */
declare class AzureStorage extends BaseStorage {
  static override readonly name: string;
  override checksumTypes: string[];
  override get raw(): BlobServiceClient;
  protected meta: MetaStorage;
  private client;
  private readonly containerClient;
  private readonly root;
  private readonly resolvedRetryConfig;
  private readonly signer?;
  /** Pre-issued SAS token (leading `?` stripped) when in SAS-token mode. */
  private readonly sasToken?;
  /** True only for genuine anonymous (public-container) access. */
  private readonly anonymous?;
  constructor(config: AzureStorageOptions);
  protected override getRetryConfig(): RetryConfig;
  create(config: FileInit, options?: OperationOptions): Promise<AzureFile>;
  /**
   * Deletes an upload and its metadata.
   * @param query File query containing the file ID to delete.
   * @param query.id File ID to delete.
   * @returns Promise resolving to the deleted file object with status: "deleted".
   * @throws {UploadError} If the file metadata cannot be found.
   */
  delete({ id }: FileQuery, options?: OperationOptions): Promise<AzureFile>;
  /**
   * Deletes many blobs in one round-trip using Azure's native
   * [Blob Batch API](https://learn.microsoft.com/rest/api/storageservices/blob-batch)
   * (up to 256 sub-requests per request) instead of issuing one DELETE per key.
   *
   * Sidecar metadata removal and the {@link onDelete} hook are still applied per
   * successfully-deleted id; a 404 sub-response is treated as success to match the
   * `deleteIfExists` semantics of the single-key {@link delete}. If the batch endpoint
   * is unavailable (e.g. an Azurite build without batch support) the call transparently
   * falls back to the per-key base implementation.
   * @param ids File ids/keys to delete.
   * @param options Optional per-call signal/timeout/retries.
   */
  override deleteBatch(ids: string[], options?: OperationOptions): Promise<BatchOperationResponse<AzureFile>>;
  /**
   * Moves an upload file to a new location.
   * @param name Source file name/ID.
   * @param destination Destination file name/ID.
   * @returns Promise resolving to the moved file object.
   * @throws {UploadError} If the source file cannot be found.
   */
  move(name: string, destination: string, options?: OperationOptions): Promise<AzureFile>;
  write(part: FilePart | FileQuery | AzureFile, options?: OperationOptions): Promise<AzureFile>;
  get({ id }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
  /**
   * Checks if a file exists by verifying both metadata and the actual Azure blob.
   * Returns true only if both the metadata and the blob exist.
   * @param query File query containing the file ID to check.
   * @returns Promise resolving to true if both metadata and blob exist, false otherwise.
   */
  override exists({ id }: FileQuery, options?: OperationOptions): Promise<boolean>;
  /**
   * Copies an upload file to a new location.
   * @param name Source file name/ID.
   * @param destination Destination file name/ID.
   * @returns Promise resolving to the copied file object.
   * @throws {UploadError} If the source file cannot be found.
   */
  copy(name: string, destination: string, options?: OperationOptions & {
    storageClass?: string;
  }): Promise<AzureFile>;
  override list(limit?: number, options?: OperationOptions): Promise<AzureFile[]>;
  /**
   * Returns a download URL for the blob at `key`.
   *
   * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
   * SAS. SAS-token adapters append the pre-issued token. Genuine anonymous
   * (public-container) adapters return the unsigned blob URL.
   * @param key Storage key.
   * @param options Optional expiry and response content overrides. Response
   * content overrides only apply when the adapter mints a fresh SAS; they are
   * rejected on the pre-issued `sasToken` and anonymous paths, which have no
   * signature in which to bind them.
   * @throws {UploadError} When the adapter has no way to authorise reads, or
   * when a response content override is supplied on a non-signing path.
   */
  override getReadUrl(key: string, options?: {
    expiresIn?: number;
    responseContentDisposition?: string;
    responseContentType?: string;
  }): Promise<string>;
  /**
   * Returns an upload URL (HTTP PUT, `x-ms-blob-type: BlockBlob`) for `key`.
   *
   * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
   * SAS. SAS-token adapters append the pre-issued token. Anonymous adapters
   * cannot upload. The caller must send the desired `x-ms-blob-content-type`
   * header on the PUT — a SAS cannot pin the stored content type.
   * @param key Storage key.
   * @param options Optional expiry. `contentLength` and `contentType` are
   * rejected: an Azure SAS does not bind the request `Content-Type` into the
   * signature and has no server-enforced size limit, so accepting them would
   * hand the caller a guarantee that does not hold.
   * @throws {UploadError} When the adapter cannot authorise writes, or when an
   * unenforceable `contentType`/`contentLength` override is supplied.
   */
  override getUploadUrl(key: string, options?: {
    contentLength?: number;
    contentType?: string;
    expiresIn?: number;
  }): Promise<string>;
  /**
   * Prefixes the given filePath with the storage root location (assetFolder if configured).
   * @param filePath Relative file path to prefix.
   * @returns Full path with asset folder prefix if configured, otherwise returns original path.
   */
  private getFullPath;
  private accessCheck;
}
export { AzureFile, type AzureMetaStorageOptions, AzureMetaStorage as AzureSMetaStorage, AzureStorage, type AzureStorageOptions };