import type { lib as KeetaNetLib } from '@keetanetwork/keetanet-client';
import type { HTTPSignedField } from '../../lib/http-server/common.js';
import type { Signable } from '../../lib/utils/signing.js';
import type { EncryptedContainer } from '../../lib/encrypted-container.js';
import { KeetaAnchorUserError, KeetaAnchorUserValidationError, KeetaAnchorCertificateRequiredError } from '../../lib/error.js';
import { Buffer } from '../../lib/utils/buffer.js';
/**
 * Type alias for a KeetaNet Account instance.
 * Used throughout the storage service for account authentication and signing.
 */
export type KeetaNetAccount = InstanceType<typeof KeetaNetLib.Account>;
/** Content type for JSON payloads */
export declare const CONTENT_TYPE_JSON = "application/json";
/** Content type for binary/octet-stream payloads */
export declare const CONTENT_TYPE_OCTET_STREAM = "application/octet-stream";
/** Default TTL for signed URLs in seconds (1 hour) */
export declare const DEFAULT_SIGNED_URL_TTL_SECONDS = 3600;
/**
 * Visibility of a storage object
 */
export type StorageObjectVisibility = 'public' | 'private';
/**
 * Metadata for a stored object
 */
export type StorageObjectMetadata = {
    /**
     * Full path (the unique ID)
     */
    path: string;
    /**
     * Owner's identifier
     */
    owner: string;
    /**
     * Plaintext tags (searchable)
     */
    tags: string[];
    /**
     * Visibility setting
     */
    visibility: StorageObjectVisibility;
    /**
     * Size in bytes
     */
    size: number;
    /**
     * ISO timestamp of creation
     */
    createdAt: string;
    /**
     * ISO timestamp of last update
     */
    updatedAt?: string;
};
/**
 * Criteria for searching storage objects.
 * Note: Content/keyword search is not supported (content is encrypted).
 */
export type SearchCriteria = {
    /**
     * Match objects with paths starting with this prefix
     * e.g., "/user/keeta1abc.../contacts/"
     */
    pathPrefix?: string;
    /**
     * Match objects that have ANY of these tags
     */
    tags?: string[];
    /**
     * Match path segment (filename portion)
     */
    name?: string;
    /**
     * Filter by owner's identifier
     */
    owner?: string;
    /**
     * Include objects in nested paths (default: false)
     */
    recursive?: boolean;
    /**
     * Filter by visibility.
     * When 'public', allows searching public objects outside caller's namespace.
     */
    visibility?: StorageObjectVisibility;
};
/**
 * Pagination options for search
 */
export type SearchPagination = {
    /**
     * Cursor for pagination (from previous response)
     */
    cursor?: string;
    /**
     * Maximum number of results to return
     */
    limit?: number;
};
/**
 * Search results with pagination
 */
export type SearchResults = {
    /**
     * Matching objects
     */
    results: StorageObjectMetadata[];
    /**
     * Cursor for next page (undefined if no more results)
     */
    nextCursor?: string;
};
/**
 * Quota configuration for the storage service
 */
export type QuotaConfig = {
    /**
     * Maximum size in bytes per object
     */
    maxObjectSize: number;
    /**
     * Maximum number of objects per user
     */
    maxObjectsPerUser: number;
    /**
     * Maximum total storage in bytes per user
     */
    maxStoragePerUser: number;
    /**
     * Maximum number of results per search request
     */
    maxSearchLimit: number;
    /**
     * Maximum TTL in seconds for signed URLs
     */
    maxSignedUrlTTL: number;
};
/**
 * Per-user quota limits.
 * Subset of QuotaConfig that can be overridden on a per-user basis.
 */
export type QuotaLimits = Pick<QuotaConfig, 'maxObjectsPerUser' | 'maxStoragePerUser' | 'maxObjectSize'>;
/**
 * Current quota status for a user.
 * Backends must provide objectCount and totalSize.
 */
export type QuotaStatus = {
    /**
     * Current number of objects
     */
    objectCount: number;
    /**
     * Current total size in bytes
     */
    totalSize: number;
    /**
     * Remaining objects allowed (optional, server computes if absent)
     */
    remainingObjects?: number;
    /**
     * Remaining storage in bytes (optional, server computes if absent)
     */
    remainingSize?: number;
};
/**
 * Client-side request to put (create/update) an object
 */
export type KeetaStorageAnchorPutClientRequest = {
    account?: KeetaNetAccount;
    path: string;
    data: string;
    tags?: string[];
    visibility?: StorageObjectVisibility;
};
/**
 * Server-side request to put an object
 */
export type KeetaStorageAnchorPutRequest = {
    account?: string;
    signed?: HTTPSignedField;
    path: string;
    data: string;
    tags?: string[];
    visibility?: StorageObjectVisibility;
};
/**
 * Configuration for a contacts client.
 * Contacts are stored in a subdirectory of the account's working directory.
 */
export type ContactsClientConfig = {
    /**
     * The account to use for the contacts client.
     */
    account: KeetaNetAccount;
    /**
     * The base path for the contacts client.
     */
    basePath: string;
};
/**
 * Configuration for an icons client.
 * The icon is stored as a single file under the base path.
 */
export type IconsClientConfig = {
    /**
     * The account to use for the icons client.
     */
    account: KeetaNetAccount;
    /**
     * The base path for the icons client (e.g., `/user/<pubkey>/`).
     */
    basePath: string;
};
/**
 * Generic response type for storage operations.
 */
export type StorageResponse<T> = ({
    ok: true;
} & T) | {
    ok: false;
    error: string;
};
export type KeetaStorageAnchorPutResponse = StorageResponse<{
    object: StorageObjectMetadata;
}>;
export declare function getKeetaStorageAnchorPutRequestSigningData(input: {
    path: string;
    visibility?: StorageObjectVisibility;
    tags?: string[];
}): Signable;
/**
 * Server-side request to update object metadata.
 * Path is derived from the URL, not the body.
 */
export type KeetaStorageAnchorUpdateMetadataRequest = {
    account?: string;
    signed?: HTTPSignedField;
    tags: string[];
    visibility: StorageObjectVisibility;
};
/**
 * Build signing data for an update-metadata request.
 * Tags are sorted with localeCompare for deterministic signatures.
 */
export declare function getKeetaStorageAnchorUpdateMetadataRequestSigningData(input: {
    path: string;
    visibility: StorageObjectVisibility;
    tags: string[];
}): Signable;
/**
 * Client-side request to get an object
 */
export type KeetaStorageAnchorGetClientRequest = {
    account?: KeetaNetAccount;
    path: string;
};
/**
 * Server-side request to get an object
 */
export type KeetaStorageAnchorGetRequest = {
    account?: string;
    signed?: HTTPSignedField;
    path: string;
};
export type KeetaStorageAnchorGetResponse = StorageResponse<{
    data: string;
    object: StorageObjectMetadata;
}>;
export declare function getKeetaStorageAnchorGetRequestSigningData(input: KeetaStorageAnchorGetRequest): Signable;
/**
 * Client-side request to delete an object
 */
export type KeetaStorageAnchorDeleteClientRequest = {
    account?: KeetaNetAccount;
    /**
     * Path to the object
     */
    path: string;
};
/**
 * Server-side request to delete an object
 */
export type KeetaStorageAnchorDeleteRequest = {
    account?: string;
    signed?: HTTPSignedField;
    /**
     * Path to the object
     */
    path: string;
};
export type KeetaStorageAnchorDeleteResponse = StorageResponse<{
    deleted: boolean;
}>;
export declare function getKeetaStorageAnchorDeleteRequestSigningData(input: KeetaStorageAnchorDeleteRequest): Signable;
/**
 * Client-side request to search objects
 */
export type KeetaStorageAnchorSearchClientRequest = {
    account?: KeetaNetAccount;
    criteria: SearchCriteria;
    pagination?: SearchPagination;
};
/**
 * Server-side request to search objects
 */
export type KeetaStorageAnchorSearchRequest = {
    account?: string;
    signed?: HTTPSignedField;
    criteria: SearchCriteria;
    pagination?: SearchPagination;
};
export type KeetaStorageAnchorSearchResponse = StorageResponse<{
    results: StorageObjectMetadata[];
    nextCursor?: string;
}>;
export declare function getKeetaStorageAnchorSearchRequestSigningData(input: KeetaStorageAnchorSearchRequest): Signable;
/**
 * Client-side request to get quota status
 */
export type KeetaStorageAnchorQuotaClientRequest = {
    account?: KeetaNetAccount;
};
/**
 * Server-side request to get quota status
 */
export type KeetaStorageAnchorQuotaRequest = {
    account?: string;
    signed?: HTTPSignedField;
};
export type KeetaStorageAnchorQuotaResponse = StorageResponse<{
    quota: QuotaStatus;
}>;
/**
 * Get signing data for quota requests.
 * The input is unused because quota requests don't need request-specific signing -
 * authentication alone is sufficient.
 *
 * The parameter was kept for API consistency with other signing functions.
 */
export declare function getKeetaStorageAnchorQuotaRequestSigningData(_ignoreInput: KeetaStorageAnchorQuotaRequest): Signable;
declare class KeetaStorageAnchorDocumentNotFoundError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorDocumentNotFoundErrorObjectTypeID;
    private static readonly KeetaStorageAnchorDocumentNotFoundErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorDocumentNotFoundError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorDocumentNotFoundError>;
}
declare class KeetaStorageAnchorAccessDeniedError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorAccessDeniedErrorObjectTypeID;
    private static readonly KeetaStorageAnchorAccessDeniedErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorAccessDeniedError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorAccessDeniedError>;
}
declare class KeetaStorageAnchorInvalidPathError extends KeetaAnchorUserValidationError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvalidPathErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvalidPathErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvalidPathError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvalidPathError>;
}
type QuotaExceededType = 'maxObjectSize' | 'maxObjectsPerUser' | 'maxStoragePerUser';
declare class KeetaStorageAnchorQuotaExceededError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorQuotaExceededErrorObjectTypeID;
    private static readonly KeetaStorageAnchorQuotaExceededErrorObjectTypeID;
    /** Which quota limit was exceeded */
    readonly quotaType: QuotaExceededType;
    /** The configured maximum for the exceeded quota */
    readonly limit: number;
    /** The current or attempted value that exceeded the limit */
    readonly current: number;
    constructor(options: {
        quotaType: QuotaExceededType;
        limit: number;
        current: number;
        message?: string;
    });
    static isInstance(input: unknown): input is KeetaStorageAnchorQuotaExceededError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorQuotaExceededError>;
}
declare class KeetaStorageAnchorPrincipalRequiredError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorPrincipalRequiredErrorObjectTypeID;
    private static readonly KeetaStorageAnchorPrincipalRequiredErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorPrincipalRequiredError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorPrincipalRequiredError>;
}
declare class KeetaStorageAnchorValidationFailedError extends KeetaAnchorUserValidationError {
    static readonly name: string;
    private readonly KeetaStorageAnchorValidationFailedErrorObjectTypeID;
    private static readonly KeetaStorageAnchorValidationFailedErrorObjectTypeID;
    constructor(message?: string);
    get statusCode(): number;
    static isInstance(input: unknown): input is KeetaStorageAnchorValidationFailedError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorValidationFailedError>;
}
declare class KeetaStorageAnchorSignatureExpiredError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorSignatureExpiredErrorObjectTypeID;
    private static readonly KeetaStorageAnchorSignatureExpiredErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorSignatureExpiredError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorSignatureExpiredError>;
}
declare class KeetaStorageAnchorSignatureInvalidError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorSignatureInvalidErrorObjectTypeID;
    private static readonly KeetaStorageAnchorSignatureInvalidErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorSignatureInvalidError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorSignatureInvalidError>;
}
declare class KeetaStorageAnchorPrivateKeyRequiredError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorPrivateKeyRequiredErrorObjectTypeID;
    private static readonly KeetaStorageAnchorPrivateKeyRequiredErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorPrivateKeyRequiredError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorPrivateKeyRequiredError>;
}
declare class KeetaStorageAnchorServiceUnavailableError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorServiceUnavailableErrorObjectTypeID;
    private static readonly KeetaStorageAnchorServiceUnavailableErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorServiceUnavailableError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorServiceUnavailableError>;
}
declare class KeetaStorageAnchorSignerRequiredError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorSignerRequiredErrorObjectTypeID;
    private static readonly KeetaStorageAnchorSignerRequiredErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorSignerRequiredError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorSignerRequiredError>;
}
declare class KeetaStorageAnchorAccountRequiredError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorAccountRequiredErrorObjectTypeID;
    private static readonly KeetaStorageAnchorAccountRequiredErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorAccountRequiredError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorAccountRequiredError>;
}
declare class KeetaStorageAnchorOperationNotSupportedError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorOperationNotSupportedErrorObjectTypeID;
    private static readonly KeetaStorageAnchorOperationNotSupportedErrorObjectTypeID;
    constructor(operation?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorOperationNotSupportedError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorOperationNotSupportedError>;
}
declare class KeetaStorageAnchorUnsupportedAuthMethodError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorUnsupportedAuthMethodErrorObjectTypeID;
    private static readonly KeetaStorageAnchorUnsupportedAuthMethodErrorObjectTypeID;
    constructor(method?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorUnsupportedAuthMethodError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorUnsupportedAuthMethodError>;
}
declare class KeetaStorageAnchorInvalidResponseError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvalidResponseErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvalidResponseErrorObjectTypeID;
    constructor(details?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvalidResponseError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvalidResponseError>;
}
declare class KeetaStorageAnchorInvalidAnchorAccountError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvalidAnchorAccountErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvalidAnchorAccountErrorObjectTypeID;
    constructor(publicKey?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvalidAnchorAccountError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvalidAnchorAccountError>;
}
declare class KeetaStorageAnchorInvariantViolationError extends KeetaAnchorUserError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvariantViolationErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvariantViolationErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvariantViolationError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvariantViolationError>;
}
declare class KeetaStorageAnchorInvalidTagError extends KeetaAnchorUserValidationError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvalidTagErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvalidTagErrorObjectTypeID;
    constructor(message?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvalidTagError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvalidTagError>;
}
declare class KeetaStorageAnchorInvalidMetadataError extends KeetaAnchorUserValidationError {
    static readonly name: string;
    private readonly KeetaStorageAnchorInvalidMetadataErrorObjectTypeID;
    private static readonly KeetaStorageAnchorInvalidMetadataErrorObjectTypeID;
    constructor(reason?: string);
    static isInstance(input: unknown): input is KeetaStorageAnchorInvalidMetadataError;
    static fromJSON(input: unknown): Promise<KeetaStorageAnchorInvalidMetadataError>;
}
export declare const Errors: {
    DocumentNotFound: typeof KeetaStorageAnchorDocumentNotFoundError;
    AccessDenied: typeof KeetaStorageAnchorAccessDeniedError;
    InvalidPath: typeof KeetaStorageAnchorInvalidPathError;
    QuotaExceeded: typeof KeetaStorageAnchorQuotaExceededError;
    AnchorPrincipalRequired: typeof KeetaStorageAnchorPrincipalRequiredError;
    ValidationFailed: typeof KeetaStorageAnchorValidationFailedError;
    SignatureExpired: typeof KeetaStorageAnchorSignatureExpiredError;
    SignatureInvalid: typeof KeetaStorageAnchorSignatureInvalidError;
    PrivateKeyRequired: typeof KeetaStorageAnchorPrivateKeyRequiredError;
    ServiceUnavailable: typeof KeetaStorageAnchorServiceUnavailableError;
    SignerRequired: typeof KeetaStorageAnchorSignerRequiredError;
    AccountRequired: typeof KeetaStorageAnchorAccountRequiredError;
    OperationNotSupported: typeof KeetaStorageAnchorOperationNotSupportedError;
    UnsupportedAuthMethod: typeof KeetaStorageAnchorUnsupportedAuthMethodError;
    InvalidResponse: typeof KeetaStorageAnchorInvalidResponseError;
    InvalidAnchorAccount: typeof KeetaStorageAnchorInvalidAnchorAccountError;
    InvariantViolation: typeof KeetaStorageAnchorInvariantViolationError;
    InvalidTag: typeof KeetaStorageAnchorInvalidTagError;
    InvalidMetadata: typeof KeetaStorageAnchorInvalidMetadataError;
    CertificateRequired: typeof KeetaAnchorCertificateRequiredError;
};
/**
 * Metadata input for put operations.
 * Provided by the client when storing an object.
 */
export type StoragePutMetadata = {
    /** Owner's identifier */
    owner: string;
    /** Tags for categorization and search */
    tags: string[];
    /** Access visibility setting */
    visibility: StorageObjectVisibility;
};
/**
 * Result of a get operation.
 * Contains both the raw encrypted data and the object metadata.
 */
export type StorageGetResult = {
    /** Raw encrypted data (EncryptedContainer) */
    data: Buffer;
    /** Object metadata */
    metadata: StorageObjectMetadata;
};
/**
 * Represents a pending upload quota reservation.
 * Used to reserve quota before an upload and track in-flight uploads.
 */
export interface UploadReservation {
    /** Unique identifier for this reservation */
    id: string;
    /** Owner's identifier */
    owner: string;
    /** Target path for the upload */
    path: string;
    /** Reserved size in bytes */
    size: number;
    /** When the reservation was created */
    createdAt: string;
    /** When the reservation expires - hint for stale cleanup */
    expiresAt: string;
}
/**
 * Core CRUD operations for storage.
 * All backends must implement these operations.
 */
export interface StorageBackend {
    /**
     * Store/update an object at the given path
     */
    put(path: string, data: Buffer, metadata: StoragePutMetadata): Promise<StorageObjectMetadata>;
    /**
     * Retrieve an object by path
     */
    get(path: string): Promise<StorageGetResult | null>;
    /**
     * Delete an object by path
     */
    delete(path: string): Promise<boolean>;
    /**
     * Update metadata for an existing object without re-uploading data.
     * @returns Updated metadata, or null if the object does not exist
     */
    updateMetadata?(path: string, metadata: Omit<StoragePutMetadata, 'owner'>): Promise<StorageObjectMetadata | null>;
}
/**
 * Search capability interface.
 * Optional for backends that don't support indexing (e.g., simple S3-only backends).
 */
export interface SearchableStorage {
    /**
     * Search for objects matching criteria
     */
    search(criteria: SearchCriteria, pagination: SearchPagination): Promise<SearchResults>;
}
/**
 * Quota management with upload reservations.
 * Handles quota tracking and reservation-based upload flow.
 */
export interface QuotaManagedStorage {
    /**
     * Get quota status for a user.
     * Includes both actual usage and pending reservations.
     */
    getQuotaStatus(owner: string): Promise<QuotaStatus>;
    /**
     * Get per-user quota limits.
     * Return null to use global defaults.
     * @param owner - Owner's identifier
     */
    getQuotaLimits?(owner: string): Promise<QuotaLimits | null>;
    /**
     * Reserve quota for an upcoming upload.
     *
     * @param owner - Owner's identifier
     * @param path - Target path for the upload
     * @param size - Size in bytes to reserve
     * @param options.ttlMs - Optional TTL in milliseconds for the reservation
     * @param options.quotaLimits - Optional quota limits to enforce (overrides backend defaults)
     *
     * @returns Reservation that must be committed or released
     *
     * @throws QuotaExceeded if reservation would exceed limits
     */
    reserveUpload(owner: string, path: string, size: number, options?: {
        ttlMs?: number;
        quotaLimits?: Pick<QuotaConfig, 'maxObjectsPerUser' | 'maxStoragePerUser'>;
    }): Promise<UploadReservation>;
    /**
     * Commit a reservation after successful upload.
     * Call after put() succeeds to finalize the quota usage.
     * @param reservationId - ID of the reservation to commit
     */
    commitUpload(reservationId: string): Promise<void>;
    /**
     * Release a reservation (upload failed or cancelled).
     * Frees the reserved quota.
     * @param reservationId - ID of the reservation to release
     */
    releaseUpload(reservationId: string): Promise<void>;
}
/**
 * Full storage backend combining all capabilities.
 * Use this type when a backend supports CRUD, search, and quota management.
 */
export type FullStorageBackend = StorageBackend & SearchableStorage & QuotaManagedStorage;
/**
 * Operations that can be performed on storage objects.
 */
export type StorageOperation = 'get' | 'put' | 'delete' | 'search' | 'metadata' | 'updateMetadata';
/**
 * Shared fields available to all policy context variants.
 */
export interface PathPolicyContextBase {
    account: KeetaNetAccount;
}
/**
 * Context for PUT operations.
 * Contains the metadata being written and the encrypted container.
 */
export interface PutPolicyContext extends PathPolicyContextBase {
    operation: 'put';
    metadata: StoragePutMetadata;
    container: EncryptedContainer;
}
/**
 * Context for metadata update operations.
 * Contains the new metadata values and the current object metadata before mutation.
 */
export interface UpdateMetadataPolicyContext extends PathPolicyContextBase {
    operation: 'updateMetadata';
    metadata: StoragePutMetadata;
    current: StorageObjectMetadata;
}
/**
 * Context for GET operations.
 */
export interface GetPolicyContext extends PathPolicyContextBase {
    operation: 'get';
}
/**
 * Context for DELETE operations.
 */
export interface DeletePolicyContext extends PathPolicyContextBase {
    operation: 'delete';
}
/**
 * Context for metadata read operations.
 */
export interface MetadataPolicyContext extends PathPolicyContextBase {
    operation: 'metadata';
}
/**
 * Discriminated union of all policy validation contexts.
 * Narrows on `operation` to access operation-specific fields.
 */
export type PathPolicyContext = PutPolicyContext | UpdateMetadataPolicyContext | GetPolicyContext | DeletePolicyContext | MetadataPolicyContext;
/**
 * Generic interface for path policies.
 * Each implementation defines its own parsed type and access control logic.
 * Storage Anchors are free to implement whatever pathname structure they wish.
 */
export interface PathPolicy<TPathInfo> {
    /**
     * Parse a path into its components.
     * @returns TPathInfo if valid, null otherwise
     */
    parse(path: string): TPathInfo | null;
    /**
     * Validate a path and return its components.
     * @throws Errors.InvalidPath if the path is invalid
     */
    validate(path: string): TPathInfo;
    /**
     * Check if a path is valid.
     */
    isValid(path: string): boolean;
    /**
     * Check if the account has access to perform the operation on the parsed path.
     * @returns true if access is allowed, false otherwise
     */
    checkAccess(account: KeetaNetAccount, parsed: TPathInfo, operation: StorageOperation): boolean;
    /**
     * Get the account authorized to sign pre-signed URLs for this path.
     * Used for public object access verification.
     *
     * @returns The account if only that account can sign (owner-restricted), or `null` if any account can sign
     */
    getAuthorizedSigner(parsed: TPathInfo): KeetaNetAccount | null;
    /**
     * Resolve the owner of a path.
     *
     * @returns The owner's identifier
     */
    getOwner(path: string): string;
    /**
     * Validate the request context for a path.
     *
     * @param parsed - The parsed path info
     * @param context - The operation-specific validation context
     * @throws Errors.InvalidMetadata if the context violates policy constraints
     */
    validateContext?(parsed: TPathInfo, context: PathPolicyContext): void;
}
/**
 * Parse the decrypted plaintext from an EncryptedContainer.
 * The payload is expected to be JSON with mimeType and base64-encoded data,
 * keeping the mimeType encrypted along with the content.
 *
 * @param plaintext - The decrypted plaintext from an EncryptedContainer
 *
 * @returns Object containing mimeType and content Buffer
 */
export declare function parseContainerPayload(plaintext: ArrayBuffer): {
    mimeType: string;
    content: Buffer;
};
export {};
//# sourceMappingURL=common.d.ts.map