s3

type Config struct {
	// UploadBucket is the bucket clients upload to via presigned POST policies. It
	// holds untrusted, not-yet-validated bytes and should carry a lifecycle rule
	// to expire abandoned uploads.
	UploadBucket string

	// OriginBucket is the bucket the CDN serves from. Only validated bytes,
	// promoted out of the upload bucket, ever land here.
	OriginBucket string

	// Region is the AWS region of the buckets. It scopes the SigV4 credential and
	// signing key for upload POST policies and seeds the default upload endpoint.
	Region string

	// UploadEndpointURL is the base URL (scheme + host) the upload POST targets,
	// already resolved for the upload bucket — e.g. a regional endpoint
	// "https://my-bucket.s3.us-east-1.amazonaws.com" or an S3 Transfer
	// Acceleration endpoint "https://my-bucket.s3-accelerate.amazonaws.com". When
	// empty, the regional virtual-hosted-style endpoint is derived from the bucket
	// and Region. It does not affect the POST policy signature, which
	// is always scoped to the bucket's region, so pointing it at an accelerated
	// (or dualstack/custom) endpoint is safe.
	UploadEndpointURL string

	// UploadTTL is how long a presigned upload policy stays valid.
	UploadTTL time.Duration

	// DownloadTTL is how long a minted CloudFront download URL stays valid.
	DownloadTTL time.Duration

	// CDNBaseURL is the CloudFront distribution base URL (scheme + host, e.g.
	// "https://d111111abcdef8.cloudfront.net") fronting the origin bucket.
	// Download URLs are this joined with the object key, then signed.
	CDNBaseURL string

	// CloudFrontKeyID is the CloudFront public key id paired with PrivateKey.
	CloudFrontKeyID string

	// PrivateKey is the RSA private key whose public half is registered with
	// CloudFront; it signs download URLs.
	PrivateKey *rsa.PrivateKey
}

type Storage struct {
	// contains filtered or unexported fields
}