import type { ServiceMetadata } from '../../lib/resolver.ts';
import type { NamespaceValidator } from './lib/validators.js';
import type { KeetaAnchorMetadataServerConfig } from '../../lib/anchor-metadata-server.js';
import type { KeetaNet } from '../../client/index.js';
import type { FullStorageBackend, QuotaConfig, PathPolicy } from './common.ts';
import type * as KeetaAnchorHTTPServer from '../../lib/http-server/index.js';
import { KeetaAnchorMetadataServer } from '../../lib/anchor-metadata-server.js';
type Account = InstanceType<typeof KeetaNet.lib.Account>;
/**
 * Configuration for the Storage Anchor
 *
 * The Storage Anchor provides encrypted object storage with the following operations:
 *
 * PUT (Create/Update):
 *   1. Client creates EncryptedContainer with data, shares with anchor for public objects
 *   2. Client signs request (path, visibility, tags) and sends to server
 *   3. Server reserves quota, validates, stores object, commits reservation
 *
 * GET (Retrieve):
 *   1. Client signs request (path) and sends to server
 *   2. Server verifies access, returns EncryptedContainer
 *   3. Client decrypts with their private key
 *
 * DELETE:
 *   1. Client signs request (path) and sends to server
 *   2. Server verifies ownership, removes object
 *
 * SEARCH:
 *   1. Client signs request with criteria (tags, prefix, etc.)
 *   2. Server returns matching metadata (scoped to user's namespace)
 *
 * PUBLIC ACCESS (Pre-signed URLs):
 *   1. Client generates pre-signed URL with expiry, signed by owner
 *   2. Anyone can fetch via URL (no auth headers)
 *   3. Server verifies signature, expiry, and visibility
 *   4. Server decrypts and returns plaintext content
 *
 *
 *   +-------------------+            +---------------------+             +------------------+
 *   |       Client      |            |  Storage Anchor     |             |  Storage Backend |
 *   +-------------------+            +---------------------+             +------------------+
 *         |                                   |                                  |
 *   (PUT) Create EncryptedContainer           |                                  |
 *         | Sign(path, visibility, tags)      |                                  |
 *         |---------------------------------->|                                  |
 *         |                                   | reserveUpload() ---------------->|
 *         |                                   | validate, put() ---------------->|
 *         |                                   | commitUpload() ----------------->|
 *         |<--------------------------------- | { ok: true, object: metadata }   |
 *         |                                   |                                  |
 *   (GET) Sign(path) ------------------------>|                                  |
 *         |                                   | get() -------------------------->|
 *         |<--------------------------------- | EncryptedContainer (binary)      |
 *         | Decrypt with private key          |                                  |
 *         |                                   |                                  |
 *   (PUBLIC) Generate pre-signed URL          |                                  |
 *         | URL with expires, signature       |                                  |
 *   (Anyone) Fetch URL ---------------------->|                                  |
 *         |                                   | verify signature, expiry         |
 *         |                                   | get(), decrypt ----------------->|
 *         |<--------------------------------- | Plaintext content                |
 */
export interface KeetaAnchorStorageServerConfig extends KeetaAnchorMetadataServerConfig {
    /**
     * The data to use for the index page (optional)
     */
    homepage?: string | (() => Promise<string> | string);
    /**
     * The storage backend to use for storing documents.
     * Must implement full capabilities: CRUD, search, and quota management.
     */
    backend: FullStorageBackend;
    /**
     * The anchor's account for decrypting objects.
     */
    anchorAccount: Account;
    /**
     * Quota configuration for storage limits.
     * Partial values are merged with defaults.
     */
    quotas?: Partial<QuotaConfig>;
    /**
     * Namespace validators for special paths
     */
    validators?: NamespaceValidator[];
    /**
     * Default TTL in seconds for pre-signed URLs (default: 3600)
     */
    signedUrlDefaultTTL?: number;
    /**
     * CORS origin for public endpoints (default: false).
     * - '*' allows all origins
     * - specific origin string restricts to that origin
     * - false (default) disables CORS headers on public responses
     */
    publicCORSOrigin?: string | false;
    /**
     * CORS origin for authenticated object endpoints (default: '*').
     * - '*' allows all origins
     * - specific origin string restricts to that origin
     */
    authenticatedCORSOrigin?: string;
    /**
     * Path policies for parsing, validating, and access control of storage paths.
     * Each policy handles a specific path pattern. First matching policy wins.
     */
    pathPolicies: PathPolicy<unknown>[];
    /**
     * Tag validation configuration.
     */
    tagValidation?: {
        /** Maximum number of tags per object (default: 10) */
        maxTags?: number;
        /** Maximum length of each tag (default: 50) */
        maxTagLength?: number;
        /** Pattern for valid tag characters (default: /^[a-zA-Z0-9_-]+$/) */
        pattern?: RegExp;
    };
}
export declare class KeetaNetStorageAnchorHTTPServer extends KeetaAnchorMetadataServer<NonNullable<ServiceMetadata['services']['storage']>[string], KeetaAnchorStorageServerConfig> {
    readonly homepage: NonNullable<KeetaAnchorStorageServerConfig['homepage']>;
    readonly backend: FullStorageBackend;
    readonly anchorAccount: Account;
    readonly quotas: QuotaConfig;
    readonly validators: NamespaceValidator[];
    readonly signedUrlDefaultTTL: number;
    readonly publicCorsOrigin: string | false;
    readonly authenticatedCorsOrigin: string;
    readonly pathPolicies: PathPolicy<unknown>[];
    readonly tagValidation: Required<NonNullable<KeetaAnchorStorageServerConfig['tagValidation']>>;
    constructor(config: KeetaAnchorStorageServerConfig);
    protected initRoutes(_ignoreConfig: KeetaAnchorStorageServerConfig): Promise<KeetaAnchorHTTPServer.Routes>;
    protected buildServiceMetadata(): Promise<NonNullable<ServiceMetadata['services']['storage']>[string]>;
}
export {};
//# sourceMappingURL=server.d.ts.map