@fileway/azure 0.0.0-stage → 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Azubuike Golden
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,81 @@
-# Temporary Holding Version
+# @fileway/azure
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm version](https://img.shields.io/npm/v/@fileway/azure?style=flat-square)](https://www.npmjs.com/package/@fileway/azure)
+[![bundle size](https://img.shields.io/bundlephobia/minzip/@fileway/azure?style=flat-square)](https://bundlephobia.com/package/@fileway/azure)
+
+**Azure Blob Storage driver for [Fileway](https://github.com/Goldenhub/fileway).**
+
+Implemented with `fetch` and Web Crypto (Shared Key and SAS signing): no Azure SDK required, so it runs on Node.js, Bun, Deno, and edge runtimes.
+
+```bash
+npm install @fileway/azure
+```
+
+## Usage
+
+```ts
+import { FilewayClient } from "@fileway/core";
+import { AzureDriver } from "@fileway/azure";
+
+const driver = new AzureDriver({
+  container: "uploads",
+  accountName: "mystorageaccount",
+  accountKey: process.env.AZURE_STORAGE_KEY,
+});
+
+const client = new FilewayClient({ driver });
+
+const result = await client.upload(stream, {
+  filename: "photo.jpg",
+  metadata: { userId: "42" }, // stored as x-ms-meta-*
+});
+// result.meta.container, result.meta.etag
+```
+
+Or pass a connection string from the Azure portal:
+
+```ts
+new AzureDriver({ container: "uploads", connectionString: process.env.AZURE_STORAGE_CONNECTION_STRING });
+```
+
+## Config
+
+| Option             | Type     | Description |
+| ------------------ | -------- | ----------- |
+| `container`        | `string` | Container name (required) |
+| `accountName`      | `string` | Storage account name |
+| `accountKey`       | `string` | Account key (Shared Key auth; also needed for presigned URLs) |
+| `sasToken`         | `string` | A SAS token, used instead of an account key |
+| `connectionString` | `string` | Connection string; explicit options override its values. `UseDevelopmentStorage=true` targets Azurite |
+| `endpoint`         | `string` | Blob service endpoint (default `https://<account>.blob.core.windows.net`) |
+| `baseUrl`          | `string` | Public base URL for `getUrl` (e.g. a CDN) |
+| `blockSize`        | `number` | Block size in bytes (default `8 MiB`, range `1 MiB` to `4000 MiB`) |
+| `maxSizeBytes`     | `number` | Reject larger uploads with a `size-exceeded` error |
+
+## Upload strategy
+
+The stream is read one block at a time, so memory stays bounded by `blockSize` whatever the file size:
+
+- **Fits in one block**: a single `Put Blob`.
+- **Larger, or unknown size**: `Put Block` for each block, then `Put Block List` to commit them. Blocks staged by a failed or cancelled upload are never visible and Azure discards them after 7 days.
+
+If the stream ends before or after a declared `size`, nothing is committed and the upload throws a validation error.
+
+## Metadata
+
+Azure metadata names must be valid identifiers (letters, digits and underscores, not starting with a digit), so keys like `user-id` throw a validation error. Use `userId` or `user_id`.
+
+## Upload status
+
+`pathFor`, `head` and `isPending` are implemented, so `client.getUploadStatus()` reports `complete`, `pending` (blocks staged, not committed) or `missing`, and lost upload responses are recovered without uploading twice.
+
+## Azurite
+
+```ts
+new AzureDriver({ container: "uploads", connectionString: "UseDevelopmentStorage=true" });
+```
+
+## Resources
+
+- [Documentation](https://www.usefileway.dev/docs/drivers/azure)
+- [License: MIT](https://github.com/Goldenhub/fileway/blob/main/LICENSE)

package/dist/index.cjs

@@ -0,0 +1,573 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AzureDriver: () => AzureDriver
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@fileway/core");
+
+// src/sharedkey.ts
+var SERVICE_VERSION = "2023-11-03";
+var encoder = new TextEncoder();
+var keyCache = /* @__PURE__ */ new Map();
+function importKey(accountKey) {
+  let key = keyCache.get(accountKey);
+  if (!key) {
+    key = globalThis.crypto.subtle.importKey(
+      "raw",
+      base64ToBytes(accountKey),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    keyCache.set(accountKey, key);
+  }
+  return key;
+}
+async function hmacBase64(accountKey, message) {
+  const key = await importKey(accountKey);
+  const sig = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return bytesToBase64(new Uint8Array(sig));
+}
+function buildStringToSign(method, url, accountName, headers, contentLength) {
+  const lower = {};
+  for (const [k, v] of Object.entries(headers)) lower[k.toLowerCase()] = v;
+  const h = (name) => lower[name] ?? "";
+  const canonicalHeaders = Object.keys(lower).filter((k) => k.startsWith("x-ms-")).sort().map((k) => `${k}:${(lower[k] ?? "").replace(/\s+/g, " ").trim()}
+`).join("");
+  const params = /* @__PURE__ */ new Map();
+  for (const [k, v] of url.searchParams) {
+    const name = k.toLowerCase();
+    params.set(name, [...params.get(name) ?? [], v]);
+  }
+  const canonicalQuery = [...params.keys()].sort().map((k) => `
+${k}:${(params.get(k) ?? []).sort().join(",")}`).join("");
+  const canonicalResource = `/${accountName}${url.pathname}${canonicalQuery}`;
+  return [
+    method.toUpperCase(),
+    h("content-encoding"),
+    h("content-language"),
+    contentLength ? String(contentLength) : "",
+    h("content-md5"),
+    h("content-type"),
+    h("date"),
+    h("if-modified-since"),
+    h("if-match"),
+    h("if-none-match"),
+    h("if-unmodified-since"),
+    h("range"),
+    canonicalHeaders + canonicalResource
+  ].join("\n");
+}
+async function signRequest(method, url, accountName, accountKey, headers, contentLength, now = /* @__PURE__ */ new Date()) {
+  const signed = {
+    ...headers,
+    "x-ms-date": now.toUTCString(),
+    "x-ms-version": SERVICE_VERSION
+  };
+  const stringToSign = buildStringToSign(method, url, accountName, signed, contentLength);
+  const signature = await hmacBase64(accountKey, stringToSign);
+  return { ...signed, authorization: `SharedKey ${accountName}:${signature}` };
+}
+async function blobReadSas(accountName, accountKey, container, blobName, expiry) {
+  const se = expiry.toISOString().replace(/\.\d{3}Z$/, "Z");
+  const fields = {
+    sp: "r",
+    st: "",
+    se,
+    resource: `/blob/${accountName}/${container}/${blobName}`,
+    si: "",
+    sip: "",
+    spr: "",
+    sv: SERVICE_VERSION,
+    sr: "b",
+    snapshot: "",
+    ses: "",
+    rscc: "",
+    rscd: "",
+    rsce: "",
+    rscl: "",
+    rsct: ""
+  };
+  const signature = await hmacBase64(accountKey, Object.values(fields).join("\n"));
+  const query = new URLSearchParams({ sv: SERVICE_VERSION, se, sr: "b", sp: "r", sig: signature });
+  return query.toString();
+}
+function base64ToBytes(value) {
+  const binary = atob(value);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+// src/internal.ts
+var DEV_ACCOUNT = "devstoreaccount1";
+var DEV_KEY = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
+var DEV_ENDPOINT = "http://127.0.0.1:10000/devstoreaccount1";
+function parseConnectionString(value) {
+  const parts = {};
+  for (const segment of value.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq > 0) parts[segment.slice(0, eq).trim()] = segment.slice(eq + 1).trim();
+  }
+  if (parts.UseDevelopmentStorage === "true") {
+    return { accountName: DEV_ACCOUNT, accountKey: DEV_KEY, endpoint: DEV_ENDPOINT };
+  }
+  const accountName = parts.AccountName;
+  const endpoint = parts.BlobEndpoint ?? (accountName ? `${parts.DefaultEndpointsProtocol ?? "https"}://${accountName}.blob.${parts.EndpointSuffix ?? "core.windows.net"}` : void 0);
+  return {
+    ...accountName ? { accountName } : {},
+    ...parts.AccountKey ? { accountKey: parts.AccountKey } : {},
+    ...parts.SharedAccessSignature ? { sasToken: parts.SharedAccessSignature } : {},
+    ...endpoint ? { endpoint } : {}
+  };
+}
+function classifyAzureError(status, code) {
+  switch (code) {
+    case "ContainerNotFound":
+    case "ContainerBeingDeleted":
+      return "bucket-not-found";
+    case "BlobNotFound":
+    case "CannotVerifyCopySource":
+    case "ResourceNotFound":
+      return "not-found";
+    case "AuthenticationFailed":
+    case "AuthorizationFailure":
+    case "AuthorizationPermissionMismatch":
+    case "AuthorizationResourceTypeMismatch":
+    case "NoAuthenticationInformation":
+    case "InvalidAuthenticationInfo":
+      return "auth-failed";
+    case "RequestBodyTooLarge":
+    case "BlockCountExceedsLimit":
+      return "size-exceeded";
+    case "BlobAlreadyExists":
+      return "conflict";
+    case "ServerBusy":
+    case "TooManyRequests":
+      return "rate-limited";
+  }
+  if (status === 429) return "rate-limited";
+  if (status === 401 || status === 403) return "auth-failed";
+  if (status === 404) return "not-found";
+  if (status === 413) return "size-exceeded";
+  return "provider-error";
+}
+
+// src/index.ts
+var randomUUID = () => globalThis.crypto.randomUUID();
+var PROVIDER = "azure";
+var DEFAULT_BLOCK_SIZE = 8 * 1024 * 1024;
+var MIN_BLOCK_SIZE = 1024 * 1024;
+var MAX_BLOCK_SIZE = 4e3 * 1024 * 1024;
+var MAX_BLOCKS = 5e4;
+var PRESIGN_DEFAULT_EXPIRY = 3600;
+var PRESIGN_MIN_EXPIRY = 1;
+var PRESIGN_MAX_EXPIRY = 604800;
+var TOKEN_KEY = "fileway_upload_token";
+var TOKEN_HEADER = `x-ms-meta-${TOKEN_KEY}`;
+var METADATA_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var AzureDriver = class {
+  name = "azure";
+  container;
+  auth;
+  endpoint;
+  baseUrl;
+  blockSize;
+  maxSizeBytes;
+  constructor(config) {
+    const fromString = config.connectionString ? parseConnectionString(config.connectionString) : {};
+    const accountName = config.accountName ?? fromString.accountName;
+    const accountKey = config.accountKey ?? fromString.accountKey;
+    const sasToken = config.sasToken ?? fromString.sasToken;
+    const endpoint = config.endpoint ?? fromString.endpoint;
+    if (!config.container) {
+      throw new import_core.StorageError("config", "AzureDriver requires a container", { provider: PROVIDER });
+    }
+    const name = accountName ?? (endpoint ? accountFromEndpoint(endpoint) : void 0);
+    if (!name) {
+      throw new import_core.StorageError("config", "AzureDriver requires accountName (or a connection string or endpoint)", { provider: PROVIDER });
+    }
+    if (!accountKey && !sasToken) {
+      throw new import_core.StorageError("config", "AzureDriver requires accountKey, sasToken or a connection string with credentials", { provider: PROVIDER });
+    }
+    this.container = config.container;
+    this.auth = {
+      accountName: name,
+      ...accountKey ? { accountKey } : {},
+      ...sasToken ? { sasToken: sasToken.replace(/^\?/, "") } : {}
+    };
+    this.endpoint = (endpoint ?? `https://${name}.blob.core.windows.net`).replace(/\/+$/, "");
+    this.baseUrl = (config.baseUrl ?? `${this.endpoint}/${config.container}`).replace(/\/+$/, "");
+    this.blockSize = Math.min(Math.max(config.blockSize ?? DEFAULT_BLOCK_SIZE, MIN_BLOCK_SIZE), MAX_BLOCK_SIZE);
+    this.maxSizeBytes = config.maxSizeBytes;
+  }
+  async upload(stream, options, context) {
+    (0, import_core.validateUploadOptions)(options);
+    for (const key of Object.keys(options.metadata ?? {})) {
+      if (!METADATA_NAME.test(key)) {
+        throw new import_core.ValidationError(
+          `Azure metadata keys must be letters, digits and underscores, not starting with a digit (got "${key}")`
+        );
+      }
+    }
+    if (this.maxSizeBytes !== void 0 && options.size !== void 0 && options.size > this.maxSizeBytes) {
+      throw new import_core.StorageError("size-exceeded", `file size ${options.size} exceeds maxSizeBytes ${this.maxSizeBytes}`, { provider: PROVIDER });
+    }
+    const id = options.id ?? randomUUID();
+    const path = this.pathFor({ ...options, id });
+    const contentType = options.mimeType ?? "application/octet-stream";
+    const metaHeaders = {
+      ...Object.fromEntries(Object.entries(options.metadata ?? {}).map(([k, v]) => [`x-ms-meta-${k}`, v])),
+      ...context?.uploadToken ? { [TOKEN_HEADER]: context.uploadToken } : {}
+    };
+    const signal = options.signal;
+    const reader = stream.getReader();
+    let aborted = signal?.aborted ?? false;
+    const onAbort = () => {
+      aborted = true;
+      reader.cancel().catch(() => {
+      });
+    };
+    if (signal && !aborted) signal.addEventListener("abort", onAbort, { once: true });
+    const ensureNotAborted = () => {
+      if (aborted) throw (0, import_core.abortError)("upload aborted");
+    };
+    let buffer = [];
+    let bufferedLen = 0;
+    let totalBytes = 0;
+    const blockIds = [];
+    const putBlock = async (bytes) => {
+      if (blockIds.length >= MAX_BLOCKS) {
+        throw new import_core.StorageError("size-exceeded", `upload exceeds ${MAX_BLOCKS} blocks; raise blockSize`, { provider: PROVIDER });
+      }
+      const blockId = bytesToBase64(new TextEncoder().encode(`fileway-${String(blockIds.length).padStart(6, "0")}`));
+      const res = await this.request("PUT", path, {
+        query: { comp: "block", blockid: blockId },
+        body: bytes,
+        ...signal ? { signal } : {}
+      });
+      if (!res.ok) throw await azureError(`Azure put block ${blockIds.length + 1} failed`, res);
+      blockIds.push(blockId);
+    };
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        ensureNotAborted();
+        if (done) break;
+        totalBytes += value.byteLength;
+        if (this.maxSizeBytes !== void 0 && totalBytes > this.maxSizeBytes) {
+          await reader.cancel().catch(() => {
+          });
+          throw new import_core.StorageError("size-exceeded", `upload exceeds maxSizeBytes ${this.maxSizeBytes}`, { provider: PROVIDER });
+        }
+        buffer.push(value);
+        bufferedLen += value.byteLength;
+        while (bufferedLen >= this.blockSize) {
+          const merged = concatBytes(buffer, bufferedLen);
+          await putBlock(merged.subarray(0, this.blockSize));
+          const rest = merged.subarray(this.blockSize);
+          buffer = rest.byteLength > 0 ? [rest] : [];
+          bufferedLen = rest.byteLength;
+        }
+      }
+      if (options.size !== void 0 && totalBytes !== options.size) {
+        throw new import_core.ValidationError(`stream delivered ${totalBytes} bytes, expected ${options.size}`);
+      }
+      let res;
+      if (blockIds.length === 0) {
+        res = await this.request("PUT", path, {
+          headers: { "x-ms-blob-type": "BlockBlob", "content-type": contentType, ...metaHeaders },
+          body: concatBytes(buffer, bufferedLen),
+          ...signal ? { signal } : {}
+        });
+        if (!res.ok) throw await azureError("Azure upload failed", res);
+      } else {
+        if (bufferedLen > 0) await putBlock(concatBytes(buffer, bufferedLen));
+        ensureNotAborted();
+        const xml = `<?xml version="1.0" encoding="utf-8"?><BlockList>${blockIds.map((b) => `<Latest>${b}</Latest>`).join("")}</BlockList>`;
+        res = await this.request("PUT", path, {
+          query: { comp: "blocklist" },
+          headers: { "content-type": "application/xml", "x-ms-blob-content-type": contentType, ...metaHeaders },
+          body: new TextEncoder().encode(xml),
+          ...signal ? { signal } : {}
+        });
+        if (!res.ok) throw await azureError("Azure put block list failed", res);
+      }
+      const etag = res.headers.get("etag") ?? void 0;
+      return {
+        id,
+        url: `${this.baseUrl}/${(0, import_core.urlEncodePath)(path)}`,
+        path,
+        size: totalBytes,
+        meta: { container: this.container, ...etag ? { etag } : {} }
+      };
+    } catch (err) {
+      reader.cancel().catch(() => {
+      });
+      throw err;
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+    }
+  }
+  /** Deletes the blob; a missing blob is not an error. */
+  async delete(path, options) {
+    const res = await this.request("DELETE", path, withSignal(options));
+    if (res.status === 404 && errorCode(res) !== "ContainerNotFound") return;
+    if (!res.ok) throw await azureError("Azure delete failed", res);
+  }
+  async getUrl(path, _options) {
+    return `${this.baseUrl}/${(0, import_core.urlEncodePath)(path)}`;
+  }
+  /** Streams the blob. `options.signal` also cancels reading the body. */
+  async get(path, options) {
+    const res = await this.request("GET", path, withSignal(options));
+    if (!res.ok) throw await azureError("Azure get failed", res);
+    if (!res.body) {
+      throw new import_core.StorageError("provider-error", "Azure get returned no response body", { provider: PROVIDER });
+    }
+    return res.body;
+  }
+  /**
+   * A read-only service SAS URL for `path`, valid for `expiresIn` seconds
+   * (integer in 1..604800, default 3600). Needs an account key.
+   */
+  async getPresignedUrl(path, options) {
+    const expiresIn = options?.expiresIn ?? PRESIGN_DEFAULT_EXPIRY;
+    if (!Number.isInteger(expiresIn) || expiresIn < PRESIGN_MIN_EXPIRY || expiresIn > PRESIGN_MAX_EXPIRY) {
+      throw new import_core.ValidationError(
+        `expiresIn must be an integer between ${PRESIGN_MIN_EXPIRY} and ${PRESIGN_MAX_EXPIRY} seconds`
+      );
+    }
+    const { accountName, accountKey } = this.auth;
+    if (!accountKey) {
+      throw new import_core.StorageError("config", "AzureDriver needs accountKey to create presigned URLs", { provider: PROVIDER });
+    }
+    const sas = await blobReadSas(accountName, accountKey, this.container, path, new Date(Date.now() + expiresIn * 1e3));
+    return `${this.blobUrl(path)}?${sas}`;
+  }
+  /** The blob name an upload with `options.id` is stored under: `<path>/<id>.<ext>`. */
+  pathFor(options) {
+    const ext = options.filename.includes(".") ? options.filename.split(".").pop() : "";
+    const filename = ext ? `${options.id}.${ext}` : options.id;
+    return options.path ? `${options.path}/${filename}` : filename;
+  }
+  /** The blob at `path` (a `HEAD` request), or `null` if it does not exist. */
+  async head(path, options) {
+    const res = await this.request("HEAD", path, withSignal(options));
+    if (res.status === 404 && errorCode(res) !== "ContainerNotFound") return null;
+    if (!res.ok) throw await azureError("Azure head failed", res);
+    const etag = res.headers.get("etag") ?? void 0;
+    const token = res.headers.get(TOKEN_HEADER) ?? void 0;
+    const modified = res.headers.get("last-modified");
+    const contentType = res.headers.get("content-type") ?? void 0;
+    const name = path.split("/").pop() ?? path;
+    return {
+      id: name.includes(".") ? name.slice(0, name.lastIndexOf(".")) : name,
+      url: `${this.baseUrl}/${(0, import_core.urlEncodePath)(path)}`,
+      path,
+      size: Number(res.headers.get("content-length") ?? 0),
+      meta: { container: this.container, ...etag ? { etag } : {} },
+      ...token ? { uploadToken: token } : {},
+      ...modified ? { lastModified: new Date(modified) } : {},
+      ...contentType ? { contentType } : {}
+    };
+  }
+  /** Whether blocks have been staged for `path` but not yet committed. */
+  async isPending(path, options) {
+    const res = await this.request("GET", path, {
+      query: { comp: "blocklist", blocklisttype: "uncommitted" },
+      ...withSignal(options)
+    });
+    if (res.status === 404 && errorCode(res) !== "ContainerNotFound") return false;
+    const body = await res.text().catch(() => "");
+    if (!res.ok) throw azureErrorFrom("Azure get block list failed", res, body);
+    const uncommitted = body.match(/<UncommittedBlocks>(.*?)<\/UncommittedBlocks>/s)?.[1] ?? "";
+    return uncommitted.includes("<Block>");
+  }
+  /** One page of the blobs under `options.prefix` (List Blobs). */
+  async list(options) {
+    const res = await this.request("GET", "", {
+      query: {
+        restype: "container",
+        comp: "list",
+        prefix: options?.prefix ?? "",
+        maxresults: String(options?.limit ?? 100),
+        ...options?.recursive ? {} : { delimiter: "/" },
+        ...options?.cursor !== void 0 ? { marker: (0, import_core.decodeCursor)(options.cursor) } : {}
+      },
+      ...withSignal(options)
+    });
+    const body = await res.text().catch(() => "");
+    if (!res.ok) throw azureErrorFrom("Azure list failed", res, body);
+    const objects = xmlBlocks(body, "Blob").map((blob) => {
+      const modified = xmlValue(blob, "Last-Modified");
+      const etag = xmlValue(blob, "Etag");
+      const type = xmlValue(blob, "Content-Type");
+      return {
+        path: unescapeXml(xmlValue(blob, "Name") ?? ""),
+        size: Number(xmlValue(blob, "Content-Length") ?? 0),
+        ...modified ? { lastModified: new Date(modified) } : {},
+        ...etag ? { etag } : {},
+        ...type ? { contentType: unescapeXml(type) } : {}
+      };
+    });
+    const folders = xmlBlocks(body, "BlobPrefix").map((p) => unescapeXml(xmlValue(p, "Name") ?? ""));
+    const next = xmlValue(body, "NextMarker");
+    return { objects, folders, ...next ? { cursor: (0, import_core.encodeCursor)(next) } : {} };
+  }
+  /**
+   * Copies a blob in this container (Copy Blob), waiting for it to finish when
+   * the service copies in the background. With `overwrite: false` the copy is
+   * made only if `to` does not exist (`If-None-Match: *`), atomically.
+   */
+  async copy(from, to, options) {
+    const source = new URL(this.blobUrl(from));
+    if (this.auth.sasToken && !this.auth.accountKey) {
+      for (const [k, v] of new URLSearchParams(this.auth.sasToken)) source.searchParams.set(k, v);
+    }
+    const res = await this.request("PUT", to, {
+      headers: { "x-ms-copy-source": source.href, ...options?.overwrite ? {} : { "if-none-match": "*" } },
+      ...withSignal(options)
+    });
+    if (!res.ok) throw await azureError("Azure copy failed", res);
+    let status = res.headers.get("x-ms-copy-status");
+    for (let wait = 200; status === "pending"; wait = Math.min(wait * 2, 2e3)) {
+      await delay(wait, options?.signal);
+      const head = await this.request("HEAD", to, withSignal(options));
+      if (!head.ok) throw await azureError("Azure copy status check failed", head);
+      status = head.headers.get("x-ms-copy-status");
+      if (status === "failed" || status === "aborted") {
+        throw new import_core.StorageError(
+          "provider-error",
+          `Azure copy ${status}: ${head.headers.get("x-ms-copy-status-description") ?? "no details"}`,
+          { provider: PROVIDER }
+        );
+      }
+    }
+  }
+  /** Copies, then deletes the source. Blob Storage has no rename. */
+  async move(from, to, options) {
+    await this.copy(from, to, options);
+    await this.delete(from, options);
+  }
+  blobUrl(path) {
+    return `${this.endpoint}/${this.container}/${path.split("/").map(encodeURIComponent).join("/")}`;
+  }
+  /** A signed (Shared Key) or SAS-authorized request to one blob. */
+  async request(method, path, init = {}) {
+    const url = new URL(path === "" ? `${this.endpoint}/${this.container}` : this.blobUrl(path));
+    for (const [k, v] of Object.entries(init.query ?? {})) url.searchParams.set(k, v);
+    let headers;
+    const { accountName, accountKey, sasToken } = this.auth;
+    if (accountKey) {
+      headers = await signRequest(method, url, accountName, accountKey, init.headers ?? {}, init.body?.byteLength);
+    } else {
+      for (const [k, v] of new URLSearchParams(sasToken)) url.searchParams.set(k, v);
+      headers = {
+        ...init.headers,
+        "x-ms-date": (/* @__PURE__ */ new Date()).toUTCString(),
+        "x-ms-version": SERVICE_VERSION
+      };
+    }
+    return fetchWithAbort(url, {
+      method,
+      headers,
+      ...init.body ? { body: init.body } : {},
+      signal: init.signal ?? null
+    });
+  }
+};
+function xmlBlocks(xml, tag) {
+  return [...xml.matchAll(new RegExp(`<${tag}>(.*?)</${tag}>`, "gs"))].map((m) => m[1] ?? "");
+}
+function xmlValue(xml, tag) {
+  return xml.match(new RegExp(`<${tag}>(.*?)</${tag}>`, "s"))?.[1] || void 0;
+}
+function unescapeXml(value) {
+  return value.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n))).replace(/&#x([0-9a-f]+);/gi, (_, n) => String.fromCodePoint(parseInt(n, 16))).replace(/&amp;/g, "&");
+}
+function delay(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject((0, import_core.abortError)("copy aborted"));
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject((0, import_core.abortError)("copy aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function withSignal(options) {
+  return options?.signal ? { signal: options.signal } : {};
+}
+function accountFromEndpoint(endpoint) {
+  const url = new URL(endpoint);
+  const fromHost = url.hostname.match(/^([a-z0-9]+)\.blob\./)?.[1];
+  return fromHost ?? (url.pathname.split("/").filter(Boolean)[0] || void 0);
+}
+async function fetchWithAbort(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch (err) {
+    if ((0, import_core.isAbortError)(err)) throw err;
+    const cause = err instanceof Error ? err : new Error(String(err));
+    throw new import_core.StorageError("network", `${PROVIDER} network error: ${cause.message}`, { provider: PROVIDER, cause });
+  }
+}
+function errorCode(res, body) {
+  return res.headers.get("x-ms-error-code") ?? body?.match(/<Code>(.*?)<\/Code>/s)?.[1];
+}
+function azureErrorFrom(prefix, res, body) {
+  const code = errorCode(res, body);
+  return new import_core.StorageError(
+    classifyAzureError(res.status, code),
+    `${prefix}: ${res.status} ${res.statusText}${code ? ` (${code})` : ""}`,
+    { statusCode: res.status, provider: PROVIDER }
+  );
+}
+async function azureError(prefix, res) {
+  const body = await res.text().catch(() => "");
+  return azureErrorFrom(prefix, res, body);
+}
+function concatBytes(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AzureDriver
+});
+//# sourceMappingURL=index.cjs.map