import { S3Client, GetObjectCommand, HeadObjectCommand, } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
const PRESIGN_TTL_SECONDS = 15 * 60;
/**
 * Thin wrapper around the AWS SDK for S3-compatible Hetzner Object
 * Storage. Holds the bucket so call sites only pass keys.
 *
 * The presigned URL has a 15-min validity. We deliberately do not
 * persist the URL anywhere — it is minted on every read so a leaked
 * URL has at most 15 minutes of authority, and re-listing always
 * re-verifies env ownership.
 */
export class S3Helper {
    client;
    bucket;
    constructor(config) {
        this.bucket = config.bucket;
        this.client = new S3Client({
            endpoint: config.endpoint,
            region: config.region,
            credentials: {
                accessKeyId: config.accessKeyId,
                secretAccessKey: config.secretAccessKey,
            },
            forcePathStyle: true,
        });
    }
    async presignDownload(key) {
        const cmd = new GetObjectCommand({ Bucket: this.bucket, Key: key });
        return getSignedUrl(this.client, cmd, { expiresIn: PRESIGN_TTL_SECONDS });
    }
    async headSize(key) {
        try {
            const res = (await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key })));
            return res.ContentLength ?? null;
        }
        catch {
            return null;
        }
    }
}
