@crewhaus/tool-objectstore 0.7.0 → 0.8.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+CrewHaus Factory
+Copyright 2026 Max Meier
+
+This product includes software developed by Max Meier
+(operating as StudioMax — https://studiomax.io) and contributors.
+
+The CrewHaus name and logo are trademarks of Max Meier. See
+https://github.com/crewhaus/factory/blob/main/TRADEMARK.md for the
+use-of-marks policy.

package/README.md

@@ -21,12 +21,29 @@ That claim is not left to the reader. The test suite greps this package's own
 source for `node:http`, `node:net`, `node:fs`, a `fetch` call and the rest, so
 an edit that adds one fails a test rather than a review.
 
-It holds no credential either. The access key and secret arrive as arguments
-from whatever the caller uses for secrets, the secret is consumed by the
-signing-key derivation, and it appears in no result, no error and no stack
-trace — asserted on both the success and the failure path. The access key ID
-*is* in the URL: SigV4 puts it in `X-Amz-Credential` by construction, which is
-how the store knows which key to check against. That one is public by design.
+It holds no credential either, and never takes one as an argument. The
+operator names a credential profile in the spec — the environment variables
+that hold the access key id, the secret and, for temporary credentials, the
+session token — and a call picks the profile by name:
+
+```yaml
+tool_config:
+  objectstore:
+    credentials:
+      r2:
+        access_key_id_env: R2_ACCESS_KEY_ID
+        secret_access_key_env: R2_SECRET_ACCESS_KEY
+        # session_token_env: AWS_SESSION_TOKEN   # STS only
+```
+
+Before 0.7.1 the secret and the session token were tool arguments, so they sat
+in the model's context, the transcript and the session log. The secret is
+consumed by the signing-key derivation and appears in no result, no error and
+no stack trace — asserted on both the success and the failure path. The access
+key ID *is* in the URL: SigV4 puts it in `X-Amz-Credential` by construction,
+which is how the store knows which key to check against. That one is public by
+design. A session token rides in the URL too (`X-Amz-Security-Token`), and the
+result says so.
 
 ## Three things that fail hours later
 
@@ -169,11 +186,12 @@ the two carrying `!` `'` `(` `)` `*`.
   "contentType": "application/pdf",
   "metadata": { "run-id": "r-4412" },
   "expiresInSeconds": 900,
-  "accessKeyId": "…",
-  "secretAccessKey": "…"
+  "credentials": "r2"
 }
 ```
 
+`credentials` may be left out when the operator configured exactly one profile.
+
 `signedAt` pins the signing instant, so a URL can be reproduced exactly when
 somebody asks why theirs stopped working. `includeCanonical` returns the
 canonical request and string-to-sign, which is what you diff against the

package/dist/index.d.ts

@@ -4,6 +4,28 @@ export { _setClock, type Clock } from "./lib/clock";
 export { PresignError };
 export { canonicalQuery, encodePath, encodeRfc3986, type QueryParam, } from "./lib/encode";
 export { ALGORITHM, UNSIGNED_PAYLOAD, type Header, amzTimestamps, canonicalRequest, credentialScope, presign, sign, signedHeaderList, signingKey, stringToSign, } from "./lib/sigv4";
+/** One operator-configured credential: the variables that hold each part. */
+export type CredentialProfile = {
+    readonly accessKeyIdEnv: string;
+    readonly secretAccessKeyEnv: string;
+    readonly sessionTokenEnv?: string;
+};
+/** Where the profiles live in a spec, for messages. */
+export declare const CREDENTIALS_CONFIG_KEY = "tool_config.objectstore.credentials";
+/**
+ * Boot seam: the `tool_config.objectstore` (or `objectPresign`) block. Its
+ * `credentials` are the ONLY credentials ObjectPresign signs with.
+ *
+ * ```yaml
+ * tool_config:
+ *   objectstore:
+ *     credentials:
+ *       r2:
+ *         access_key_id_env: R2_ACCESS_KEY_ID
+ *         secret_access_key_env: R2_SECRET_ACCESS_KEY
+ * ```
+ */
+export declare function registerObjectStoreConfig(config: unknown): void;
 export declare const objectPresign: RegisteredTool;
 /** Every tool this package registers, in the order a catalog should list them. */
 export declare const OBJECTSTORE_TOOLS: ReadonlyArray<RegisteredTool>;

package/dist/index.js

@@ -12,12 +12,19 @@
  * is why it declares no `ioCapability` — the test suite asserts it, over the
  * package's own source, so the claim cannot rot.
  *
- * It holds no credential either. The access key and secret arrive as
- * arguments from whatever the caller uses for secrets, the secret is consumed
- * by the signing-key derivation, and it is referenced in no result, no error
- * and no log line. (The access key ID does appear in the URL: SigV4 puts it
- * in `X-Amz-Credential` by construction, which is how the store knows which
- * key to verify against. That is public by design; the secret is not.)
+ * It holds no credential either, and never takes one as an argument. The
+ * operator names a credential PROFILE in `tool_config.objectstore.credentials`
+ * — the environment variables holding the access key id, the secret and (for
+ * STS) the session token — and a call picks a profile by name. 0.7.0 took the
+ * secret and the session token as tool arguments, which put them in the
+ * model's context, the transcript, every later provider request and the
+ * session event log, while this header and the schema said the secret was
+ * "not logged" (flag-truth-5#8). The secret is consumed by the signing-key
+ * derivation and referenced in no result and no error. (The access key ID
+ * does appear in the URL: SigV4 puts it in `X-Amz-Credential` by
+ * construction, which is how the store knows which key to verify against.
+ * That is public by design; the secret is not. A session token rides in the
+ * URL too, as `X-Amz-Security-Token`: SigV4 has nowhere else for it.)
  *
  * Three things are easy to get wrong here and all three fail late:
  *
@@ -30,6 +37,7 @@
  *      Host header and the path, so the style is an argument, never a guess.
  */
 import { buildTool } from "@crewhaus/tool-builder";
+import { isEnvName, looksLikePastedSecret, resolveCredentialEnv } from "@crewhaus/tool-safety/env";
 import { z } from "zod";
 import { nowMs, parseInstant } from "./lib/clock";
 import { OPERATIONS, checkHeaderValue, checkOperationFields, metadataHeaders, responseOverrides, } from "./lib/request";
@@ -64,6 +72,131 @@ function checkCredential(name, value) {
         throw new PresignError(`${name} contains whitespace or a control character`);
     }
 }
+/** Where the profiles live in a spec, for messages. */
+export const CREDENTIALS_CONFIG_KEY = "tool_config.objectstore.credentials";
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+/** The profiles from the boot block; none until one is registered. */
+let registeredProfiles = new Map();
+/** One field of a profile, in either spelling, as a variable name, never echoing a pasted value. */
+function envField(block, snake, camel, where, required) {
+    const a = block[snake];
+    const b = block[camel];
+    if (a !== undefined && b !== undefined) {
+        throw new PresignError(`${where} sets both ${snake} and ${camel}; keep one`);
+    }
+    const value = a ?? b;
+    if (value === undefined) {
+        if (required) {
+            throw new PresignError(`${where}.${snake} is required: the NAME of the environment variable that holds it`);
+        }
+        return undefined;
+    }
+    if (typeof value !== "string" || !isEnvName(value) || looksLikePastedSecret(value)) {
+        const pasted = typeof value === "string" && looksLikePastedSecret(value);
+        throw new PresignError(`${where}.${snake} must be the NAME of an environment variable${pasted ? "; it looks like the credential itself, which has not been echoed back — treat it as exposed" : ""}`);
+    }
+    return value;
+}
+/** The credential profiles a `tool_config` block declares. Throws on a malformed one. */
+function profilesOf(config, where) {
+    if (config === undefined || config === null)
+        return new Map();
+    if (typeof config !== "object" || Array.isArray(config)) {
+        throw new PresignError(`${where} must be a mapping with a credentials block`);
+    }
+    const credentials = config["credentials"];
+    if (credentials === undefined)
+        return new Map();
+    if (typeof credentials !== "object" || credentials === null || Array.isArray(credentials)) {
+        throw new PresignError(`${where}.credentials must map a profile name to { access_key_id_env, secret_access_key_env, session_token_env? }`);
+    }
+    const out = new Map();
+    for (const [name, raw] of Object.entries(credentials)) {
+        if (!PROFILE_NAME.test(name)) {
+            throw new PresignError(`${where}.credentials has a profile name that is not letters, digits, ".", "_" or "-" (at most 64)`);
+        }
+        const at = `${where}.credentials.${name}`;
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+            throw new PresignError(`${at} must be a mapping of environment variable names`);
+        }
+        const block = raw;
+        const known = new Set([
+            "access_key_id_env",
+            "accessKeyIdEnv",
+            "secret_access_key_env",
+            "secretAccessKeyEnv",
+            "session_token_env",
+            "sessionTokenEnv",
+        ]);
+        const unknown = Object.keys(block).filter((k) => !known.has(k));
+        if (unknown.length > 0) {
+            throw new PresignError(`${at} holds ${unknown.map((k) => JSON.stringify(k)).join(", ")}; a profile names environment variables only (access_key_id_env, secret_access_key_env, session_token_env) — never the credentials themselves`);
+        }
+        const sessionTokenEnv = envField(block, "session_token_env", "sessionTokenEnv", at, false);
+        out.set(name, {
+            accessKeyIdEnv: envField(block, "access_key_id_env", "accessKeyIdEnv", at, true),
+            secretAccessKeyEnv: envField(block, "secret_access_key_env", "secretAccessKeyEnv", at, true),
+            ...(sessionTokenEnv === undefined ? {} : { sessionTokenEnv }),
+        });
+    }
+    return out;
+}
+/**
+ * Boot seam: the `tool_config.objectstore` (or `objectPresign`) block. Its
+ * `credentials` are the ONLY credentials ObjectPresign signs with.
+ *
+ * ```yaml
+ * tool_config:
+ *   objectstore:
+ *     credentials:
+ *       r2:
+ *         access_key_id_env: R2_ACCESS_KEY_ID
+ *         secret_access_key_env: R2_SECRET_ACCESS_KEY
+ * ```
+ */
+export function registerObjectStoreConfig(config) {
+    registeredProfiles = profilesOf(config, "tool_config.objectstore");
+}
+/**
+ * The credentials one call signs with: the profile it named (or the only one),
+ * each part read from the variable the operator named — never from the call.
+ * A model-pool candidate's own block replaces the boot block for its calls.
+ */
+function resolveCredentials(requested, ctx) {
+    const profiles = typeof ctx?.toolConfig === "object" && ctx.toolConfig !== null
+        ? profilesOf(ctx.toolConfig, "the tool_config block for ObjectPresign")
+        : registeredProfiles;
+    const names = [...profiles.keys()].sort();
+    if (names.length === 0) {
+        throw new PresignError(`no credential profile is configured. An operator adds one in ${CREDENTIALS_CONFIG_KEY}, naming the environment variables that hold the access key id, the secret and (for STS) the session token; credentials are never tool arguments`);
+    }
+    const name = requested ?? (names.length === 1 ? names[0] : undefined);
+    if (name === undefined) {
+        throw new PresignError(`pass credentials: the profile to sign with, one of ${names.map((n) => JSON.stringify(n)).join(", ")}`);
+    }
+    const profile = profiles.get(name);
+    if (profile === undefined) {
+        throw new PresignError(`there is no credential profile ${JSON.stringify(name)} in ${CREDENTIALS_CONFIG_KEY}; the profiles are ${names.map((n) => JSON.stringify(n)).join(", ")}`);
+    }
+    const read = (env, what, field) => {
+        const found = resolveCredentialEnv(env, {
+            allowed: [env],
+            purpose: `the ${JSON.stringify(name)} profile's ${what}`,
+            configKey: `${CREDENTIALS_CONFIG_KEY}.${name}.${field}`,
+        });
+        if (!found.ok)
+            throw new PresignError(found.reason);
+        return found.value;
+    };
+    return {
+        profile: name,
+        accessKeyId: read(profile.accessKeyIdEnv, "access key id", "access_key_id_env"),
+        secretAccessKey: read(profile.secretAccessKeyEnv, "secret access key", "secret_access_key_env"),
+        ...(profile.sessionTokenEnv === undefined
+            ? {}
+            : { sessionToken: read(profile.sessionTokenEnv, "session token", "session_token_env") }),
+    };
+}
 const inputSchema = z
     .object({
     operation: z
@@ -84,18 +217,12 @@ const inputSchema = z
         .describe("the region in the credential scope, e.g. us-east-1, or auto for R2"),
     bucket: z.string().min(1).max(255),
     key: z.string().min(1).max(2048).describe("the object key, without a leading slash"),
-    accessKeyId: z.string().min(1).max(256),
-    secretAccessKey: z
+    credentials: z
         .string()
         .min(1)
-        .max(256)
-        .describe("used to derive the signing key and nothing else; it is not returned, logged or stored"),
-    sessionToken: z
-        .string()
-        .min(1)
-        .max(8192)
+        .max(64)
         .optional()
-        .describe("for temporary credentials (STS); signed into the URL as X-Amz-Security-Token"),
+        .describe(`the operator's credential profile to sign with, by name (${CREDENTIALS_CONFIG_KEY}); optional when exactly one is configured. The access key id, secret and session token are read from the environment variables the profile names — they are never arguments`),
     expiresInSeconds: z
         .number()
         .int()
@@ -139,13 +266,13 @@ const inputSchema = z
     .strict();
 export const objectPresign = buildTool({
     name: "ObjectPresign",
-    description: "Mint a time-limited URL that downloads or uploads one object in an S3-compatible store (AWS S3, Cloudflare R2, MinIO, anything that speaks SigV4). Use it to move a file without the bytes passing through this harness and without handing anyone a long-lived key: the URL grants one operation on one object until it expires, and nothing else. It is pure computation — HMAC-SHA256 over strings, no SDK, no network, no credential kept — so it works offline and the same inputs always produce the same URL. For an upload that pins a content type or metadata, the exact headers come back alongside the URL and MUST be sent byte-identically, or the store answers 403 long after this call succeeded. The addressing style (virtual-hosted or path) is required rather than inferred, because the two sign different requests. The secret key is used to derive the signing key and appears in no output.",
+    description: "Mint a time-limited URL that downloads or uploads one object in an S3-compatible store (AWS S3, Cloudflare R2, MinIO, anything that speaks SigV4). Use it to move a file without the bytes passing through this harness and without handing anyone a long-lived key: the URL grants one operation on one object until it expires, and nothing else. It is pure computation (HMAC-SHA256, no SDK, no network, no credential kept), so it works offline and the same inputs give the same URL. For an upload that pins a content type or metadata, the exact headers come back with the URL and MUST be sent byte-identically, or the store answers 403 long after this call succeeded. The addressing style (virtual-hosted or path) is required, never inferred. Credentials are never arguments: the call names one of the operator's credential profiles (tool_config.objectstore.credentials), whose environment variables hold the keys, and the secret key appears in no output.",
     inputSchema,
     readOnly: true,
     concurrencySafe: true,
     // No scope or ioCapability: this reaches nothing. The package's own test
     // suite greps its source to keep that true.
-    execute: async (input) => {
+    execute: async (input, ctx) => {
         const operation = input.operation;
         const overrides = {
             responseContentType: input.responseContentType,
@@ -158,10 +285,11 @@ export const objectPresign = buildTool({
             metadata: input.metadata,
             overrides,
         });
-        checkCredential("accessKeyId", input.accessKeyId);
-        checkCredential("secretAccessKey", input.secretAccessKey);
-        if (input.sessionToken !== undefined)
-            checkCredential("sessionToken", input.sessionToken);
+        const creds = resolveCredentials(input.credentials, ctx);
+        checkCredential("the access key id", creds.accessKeyId);
+        checkCredential("the secret access key", creds.secretAccessKey);
+        if (creds.sessionToken !== undefined)
+            checkCredential("the session token", creds.sessionToken);
         if (!/^[a-z0-9][a-z0-9-]*$/.test(input.region)) {
             throw new PresignError(`region "${input.region}" is not a region name — the credential scope is case-sensitive and matched literally, so "US-East-1" signs cleanly and then fails. Regions are lowercase letters, digits and hyphens (us-east-1, eu-central-1, or auto for R2)`);
         }
@@ -195,16 +323,16 @@ export const objectPresign = buildTool({
             canonicalUri: target.canonicalUri,
             region: input.region,
             service: SERVICE,
-            accessKeyId: input.accessKeyId,
-            secretAccessKey: input.secretAccessKey,
-            sessionToken: input.sessionToken,
+            accessKeyId: creds.accessKeyId,
+            secretAccessKey: creds.secretAccessKey,
+            sessionToken: creds.sessionToken,
             epochMs,
             expiresInSeconds,
             query: responseOverrides(overrides),
             headers,
         });
         const warnings = [...target.warnings];
-        if (input.sessionToken !== undefined) {
+        if (creds.sessionToken !== undefined) {
             warnings.push("signed with temporary credentials: the URL also stops working when the session token expires, which is often sooner than expiresAt.");
         }
         if (expiresInSeconds > LONG_LIVED_SECONDS) {
@@ -237,7 +365,8 @@ export const objectPresign = buildTool({
             expiresAt: new Date(epochMs + expiresInSeconds * 1000).toISOString(),
             expiresInSeconds,
             curl,
-            credentials: input.sessionToken === undefined
+            credentialProfile: creds.profile,
+            credentials: creds.sessionToken === undefined
                 ? "the access key id is inside the URL because SigV4 puts it there; the secret key was used to derive the signing key and appears nowhere in this result"
                 : // The session token is in the URL too, and saying only that the
                     // secret is absent reads as a full account of what is in here.

package/dist/lib/store.js

@@ -78,23 +78,33 @@ function isLoopbackHost(hostname) {
  * Redacting at the point of echo rather than relying on check order, because
  * check order is exactly what the next edit changes. The host and the path
  * survive, which is all the message needs to identify what was refused.
+ *
+ * The userinfo cannot be found by splitting at the first `/`, `?` or `#`: a
+ * password may contain any of them (about half of AWS secret keys contain a
+ * `/`), and the WHATWG parser ends the authority there, so
+ * `https://KEY:SEC/RET@host` is "not a URL" and `https://KEY:1234/RET@host`
+ * even parses, with the rest of the secret as its path. So everything up to
+ * the LAST `@` is the userinfo. When a `?` or `#` comes before that `@`, the
+ * `@` may be inside a password or inside a query value, and nothing after the
+ * scheme can be told apart from the secret, so all of it is redacted: an
+ * over-redacted refusal costs nothing.
  */
 function quoteEndpoint(raw) {
     const trimmed = raw.trim();
     const scheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(trimmed);
     const prefix = scheme === null ? "" : scheme[0];
     const rest = trimmed.slice(prefix.length);
-    const cut = rest.search(/[/?#]/);
-    const authority = cut === -1 ? rest : rest.slice(0, cut);
-    const at = authority.lastIndexOf("@");
-    const shown = at === -1 ? authority : `<redacted>@${authority.slice(at + 1)}`;
-    if (cut === -1)
-        return `${prefix}${shown}`;
-    const tail = rest.slice(cut);
-    const mark = tail.search(/[?#]/);
-    const path = mark === -1 ? tail : tail.slice(0, mark);
-    const suffix = mark === -1 ? "" : `${tail[mark]}<redacted>`;
-    return `${prefix}${shown}${path}${suffix}`;
+    const at = rest.lastIndexOf("@");
+    if (at === -1)
+        return `${prefix}${redactQuery(rest)}`;
+    if (/[?#]/.test(rest.slice(0, at)))
+        return `${prefix}<redacted>`;
+    return `${prefix}<redacted>@${redactQuery(rest.slice(at + 1))}`;
+}
+/** Keep `text` up to its first `?` or `#`, and redact the rest. */
+function redactQuery(text) {
+    const mark = text.search(/[?#]/);
+    return mark === -1 ? text : `${text.slice(0, mark)}${text[mark]}<redacted>`;
 }
 /**
  * Parse the store's base URL into the pieces the signature needs.
@@ -119,7 +129,7 @@ export function parseEndpoint(raw) {
         throw new PresignError(`endpoint "${quoteEndpoint(raw)}" uses ${url.protocol} — an object-store endpoint is http or https`);
     }
     if (url.username !== "" || url.password !== "") {
-        throw new PresignError("endpoint carries a username or password — SigV4 credentials go in accessKeyId/secretAccessKey, and a credential in the URL would be signed into the result");
+        throw new PresignError("endpoint carries a username or password — a credential in the URL would be signed into the result. Credentials never go in the endpoint or in any argument: the operator names the environment variables that hold them in a tool_config.objectstore.credentials profile, and the call passes that profile's name as `credentials`");
     }
     if (url.search !== "" || url.hash !== "") {
         throw new PresignError(`endpoint "${quoteEndpoint(raw)}" carries a query string or fragment; pass the origin only`);
@@ -129,7 +139,9 @@ export function parseEndpoint(raw) {
         // and it is refused rather than guessed at: the prefix belongs in the
         // canonical URI ahead of the bucket, and whether THIS gateway wants it
         // signed is a fact about the gateway that nothing here can check.
-        throw new PresignError(`endpoint "${quoteEndpoint(raw)}" has a path ("${url.pathname}") — this tool signs a path built from the bucket and key, so a prefix on the endpoint would be signed twice or not at all. Pass the origin only`);
+        // The path is shown only through quoteEndpoint: the parsed pathname can
+        // hold the tail of a password (`https://KEY:1234/SECRET@host`).
+        throw new PresignError(`endpoint "${quoteEndpoint(raw)}" has a path — this tool signs a path built from the bucket and key, so a prefix on the endpoint would be signed twice or not at all. Pass the origin only`);
     }
     if (url.hostname === "")
         throw new PresignError(`endpoint "${quoteEndpoint(raw)}" has no host`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-objectstore",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "Deterministic object-store URL signing: SigV4 presigned GET and PUT, computed offline",
   "main": "dist/index.js",
@@ -8,20 +8,23 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.7.0",
-    "@crewhaus/tool-builder": "0.7.0",
-    "@crewhaus/tool-catalog": "0.7.0",
-    "@crewhaus/tool-encode": "0.7.0",
+    "@crewhaus/errors": "0.8.0",
+    "@crewhaus/tool-builder": "0.8.0",
+    "@crewhaus/tool-catalog": "0.8.0",
+    "@crewhaus/tool-encode": "0.8.0",
+    "@crewhaus/tool-safety": "0.8.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
+    "@crewhaus/tool-categories": "workspace:*",
     "@crewhaus/tool-executor": "workspace:*"
   },
   "license": "Apache-2.0",
@@ -42,5 +45,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }