import * as blob from "@vercel/blob";
import type { Adapter } from "../index.js";
export interface VercelBlobAdapterOptions {
    /**
     * Read-write token (or client token). Passed here, it wins over every
     * other credential, OIDC included, matching `@vercel/blob`.
     *
     * Without this option the adapter falls back to
     * `process.env.BLOB_READ_WRITE_TOKEN`, but only as the last resort: with
     * a store id configured, an OIDC token found for the call is used first.
     * Environment credentials are resolved on every operation, so changes made
     * after construction are honored. On Vercel, prefer OIDC and leave this
     * unset.
     */
    token?: string;
    /**
     * Vercel OIDC token. Usually left unset: with a store id (`storeId` or
     * `BLOB_STORE_ID`) and no `token`, `@vercel/blob` looks the token up on
     * every call, the way it does when called directly. On Vercel Functions
     * the token arrives per request in the `x-vercel-oidc-token` header, not
     * in `process.env`; elsewhere it comes from `VERCEL_OIDC_TOKEN` (set
     * during Vercel builds, and written to `.env.local` by `vercel env pull`).
     * `@vercel/blob` 2.5 and later refresh an expired local token in a
     * project linked with `vercel link`.
     *
     * OIDC tokens are short-lived and auto-rotated, so they remove the risk
     * that a long-lived `BLOB_READ_WRITE_TOKEN` leaks from your codebase
     * or environment.
     *
     * Pass `oidcToken` explicitly only when you obtain the token yourself, for
     * example when your framework doesn't load `.env.local` into
     * `process.env` (Vite, etc.). A token passed here is used as given, never
     * refreshed, and needs a store id: without one the adapter throws rather
     * than falling back to the read-write token.
     */
    oidcToken?: string;
    /**
     * Blob store id, used with OIDC. Defaults to `process.env.BLOB_STORE_ID`.
     * Accepted in either `store_<id>` or `<id>` form (mirrors the SDK).
     *
     * Independently powers the `url()` fast path: when a `storeId` is known
     * (from option, env, or derived from a `vercel_blob_rw_<storeId>_…`
     * token), public URLs are synthesized without a round trip if
     * `addRandomSuffix: false`.
     */
    storeId?: string;
    /**
     * Whether blobs uploaded by this adapter are public or private.
     *
     * - `"public"` (default): blobs are uploaded with `access: "public"` and
     *   reachable via their CDN URL without authentication. `url()` returns a
     *   permanent public URL; `url(key, { expiresIn })` throws `Unsupported`.
     * - `"private"`: blobs are uploaded with `access: "private"`. They cannot
     *   be fetched by their plain URL — `download()` instead routes through
     *   `blob.get(key, { access: "private" })`, which uses whichever
     *   credentials the adapter resolved (read-write token or OIDC). `url()` mints a presigned GET URL
     *   (Vercel Signed URLs) that expires after `expiresIn` seconds.
     *
     * `signedUploadUrl()` mints a presigned PUT URL in either mode.
     *
     * The setting is fixed at construction so a single `Files` instance is
     * unambiguously one or the other. If you need both, instantiate two
     * adapters.
     */
    access?: "public" | "private";
    /**
     * Default expiry, in seconds, for the presigned URLs `url()` mints in
     * `access: "private"` mode. Defaults to 3600 (1 hour). Per-call
     * `url(key, { expiresIn })` overrides. Vercel caps signed-URL lifetime at
     * 7 days server-side. Ignored in `"public"` mode, where `url()` returns
     * the permanent CDN URL.
     */
    defaultUrlExpiresIn?: number;
    /**
     * Add a random suffix to uploaded keys (Vercel default).
     *
     * When `false`, the resulting pathname matches the key 1:1, which keeps
     * the API consistent with S3/R2 where callers expect to control the key.
     * Defaults to `false`.
     */
    addRandomSuffix?: boolean;
    /**
     * Allow overwriting existing keys on upload. Defaults to `true` so that the
     * "predictable keys" behavior (`addRandomSuffix: false`) actually works —
     * Vercel rejects same-pathname uploads otherwise.
     *
     * **Trade-off:** with the defaults, an `upload(key, ...)` call silently
     * clobbers any existing object at `key`. If keys are derived from
     * untrusted input or your callers expect "create-only" semantics, set
     * `allowOverwrite: false` and handle the resulting Conflict (Vercel
     * reports the existing blob as a bad request, which the adapter maps to
     * `Conflict`). Applies to `upload()` (including resumable/multipart
     * uploads), `copy()`, and `signedUploadUrl()`.
     */
    allowOverwrite?: boolean;
    /**
     * Timeout in milliseconds for the public-URL fetches and private
     * `blob.get` reads issued by `download()`. A hung CDN response would
     * otherwise leak a fetch that never resolves.
     *
     * Defaults to 300_000 (5 minutes). Pass `0` to disable the timeout (not
     * recommended in server contexts — a stuck request will pin a connection
     * until the runtime tears it down).
     */
    downloadTimeoutMs?: number;
}
export type VercelBlobClient = typeof blob;
export type VercelBlobAdapter = Adapter<VercelBlobClient>;
export declare const vercelBlob: (config?: VercelBlobAdapterOptions) => VercelBlobAdapter;
//# sourceMappingURL=index.d.ts.map