Azure

Everything under Quiote\Storage\Azure.

Classes

Class	Description
AzureBlobClient	Minimal Azure Blob Storage REST client, deliberately not built on the official microsoft/azure-storage-blob SDK (Microsoft stopped actively developing it; a hand-rolled client against the documented REST API has proven more maintainable in production).
AzureBlobContainerClient	AzureBlobClient bound to one container, so it satisfies ListableObjectStoreClientInterface like the S3 and GCS clients do.
AzureBlobSessionFactory	session slot factory for AzureBlobSessionPersistence.
AzureBlobSessionPersistence	SessionPersistenceInterface storing one JSON blob per session id (named <sid>.json) in a single Azure Blob container.
AzureCliTokenProvider	Reuses whatever identity a developer already authenticated with az login, by shelling out to az account get-access-token.
AzureCredentialFactory	Builds the AzureCredential a config auth value asks for, so quioteframework/session-azure and quioteframework/filesystem-azure share one place that knows how to turn shared_key / workload_identity / cli / chain into an instance rather than each re-implementing the same branch.
AzureMonitorQueryClient	Minimal Azure Monitor Query REST client: one KQL query against one Log Analytics workspace, nothing else.
AzureStorageException	A failure talking to Azure storage.
AzureTableClient	Minimal Azure Table Storage REST client using the Table service’s “Shared Key Lite” authentication scheme — a cheaper option than Blob Storage for small key/value-shaped session payloads (no per-account container needed; entities are addressed by table + partition/row key).
AzureTableSessionFactory	session slot factory for AzureTableSessionPersistence.
AzureTableSessionPersistence	SessionPersistenceInterface storing one entity per session id in a single Azure Table Storage table — cheaper than AzureBlobSessionPersistence for small key/value-shaped session payloads, with no per-account container to manage.
AzureTokenProviderFactory	Builds a bare AzureTokenProvider for whichever auth a config value asks for, scoped to an arbitrary AAD resource — not only storage.
BearerCredential	Azure AD authentication: every request carries Authorization: Bearer {token}, the token itself coming from an AzureTokenProvider (workload identity, the Azure CLI, or a chain of both).
ChainedTokenProvider	Tries each provider in order and answers the first token obtained, the way the official Azure SDKs’ DefaultAzureCredential chains workload identity, then the CLI, then further sources.
ProcOpenAzureCliProcessRunner	Default AzureCliProcessRunner: runs the command directly via proc_open()’s array form, never through a shell, so there is nothing for the fixed, argument-free az invocation to inject into.
SharedKeyCredential	Shared Key authentication: signs every request with an HMAC-SHA256 over the storage account key, the way AzureBlobClient always used to before AzureCredential existed.
WorkloadIdentityTokenProvider	Exchanges the projected service account token AKS’s workload identity webhook mounts into the pod for a Storage-scoped Azure AD access token, via the OAuth2 JWT-bearer client-assertion flow.

Interfaces

Interface	Description
AzureCliProcessRunner	Runs one command and returns its standard output, so AzureCliTokenProvider can be exercised in tests without actually shelling out to az.
AzureCredential	Produces the Authorization header value for one AzureBlobClient request.
AzureMonitorQueryClientInterface	A single KQL query against one Log Analytics workspace.
AzureTokenProvider	Produces an Azure AD access token for whichever resource its implementation was built for, caching and refreshing it however fits the source (a token exchange, a CLI call, a chain of both).