import { Buffer } from "node:buffer";
import SftpClient from "ssh2-sftp-client";
import type { Adapter } from "../index.js";
import { FilesError } from "../internal/errors.js";
export interface SftpAdapterOptions {
    /** SFTP host. Falls back to `SFTP_HOST`. */
    host?: string;
    /** Port. Falls back to `SFTP_PORT`, then `22`. */
    port?: number;
    /** Username. Falls back to `SFTP_USERNAME`. */
    username?: string;
    /**
     * Password authentication. Falls back to `SFTP_PASSWORD`. When both this and
     * `privateKey` are set, ssh2 tries the key first, then the password.
     */
    password?: string;
    /** Private key (PEM) for key-based auth. Falls back to `SFTP_PRIVATE_KEY`. */
    privateKey?: string | Buffer;
    /** Passphrase for an encrypted `privateKey`. Falls back to `SFTP_PASSPHRASE`. */
    passphrase?: string;
    /**
     * Remote base directory. Virtual keys resolve under it; keys that escape it
     * (e.g. `../etc/passwd`) throw `Provider`. An absolute root (`/uploads`)
     * yields absolute paths; the default (`"."`) keeps paths relative to the
     * connection's login directory — the common chroot/home case.
     */
    root?: string;
    /**
     * Origin used to build URLs from `url()`. When set, `url(key)` returns
     * `${publicBaseUrl}/${key}` — useful when an HTTP server fronts the same
     * tree. When unset, `url()` throws: SFTP serves no HTTP and has no signing
     * primitive.
     */
    publicBaseUrl?: string;
    /** Connection-ready timeout in milliseconds, passed through to ssh2. */
    readyTimeout?: number;
    /**
     * Extra ssh2 connect options merged into the resolved config (e.g.
     * `hostVerifier`, `algorithms`, `agent`). Wins over the discrete fields.
     */
    connectOptions?: SftpClient.ConnectOptions;
    /**
     * Pre-connected `ssh2-sftp-client` instance. When passed, the adapter reuses
     * it for every call and never opens or closes a connection — the caller owns
     * the socket lifecycle. This is the high-throughput path: connect once and
     * inject, rather than paying a handshake per operation.
     */
    client?: SftpClient;
}
export type SftpRaw = SftpClient | {
    connect: () => Promise<SftpClient>;
};
export type SftpAdapter = Adapter<SftpRaw> & {
    readonly root: string;
};
export declare const mapSftpError: (err: unknown) => FilesError;
export declare const sftp: (opts?: SftpAdapterOptions) => SftpAdapter;
//# sourceMappingURL=index.d.ts.map