@try-works/dsh-righthand 0.1.6 → 0.1.7

package/README.md

@@ -28,6 +28,7 @@ dsh --profile <profile> --patch ./cordis.patch.yml
 | `rh_task_create` / `rh_task_list` / `rh_task_next` / `rh_task_update` / `rh_task_delete` | tasks | `ctx.storageDomain` (typed `righthand_tasks` domain; state machine open → done/failed) |
 | `rh_text_summarise` / `rh_text_extract` / `rh_text_classify` / `rh_text_translate` | text | `ctx.llm` (one model call per verb) |
 | `rh_weather_forecast` / `rh_weather_air` | weather | Open-Meteo (keyless), every request through the SSRF-guarded fetcher |
+| `rh_files_put` / `rh_files_get` / `rh_files_list` / `rh_files_share` / `rh_files_delete` | files | Cloudflare R2 (S3-compatible, SigV4-signed; credentials from `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY`, bucket from settings) |
 | `rh_credential_describe` / `rh_credential_set` / `rh_credential_unset` | secrets | `ctx.credentials` (values never echoed) |
 | `rh_settings_get` / `rh_settings_set` | secrets | `ctx.settings` (namespace `righthand`) |
 | `rh_run` | exec | `ctx.subprocess` (collect mode, bounded output) |
@@ -67,6 +68,7 @@ Namespace "righthand" (registered by the secrets family):
 | `accountId` | "" | Cloudflare account id used by righthand Cloudflare tools |
 | `defaultScriptPrefix` | "rh-" | default name prefix for generated workers/scripts |
 | `defaultZone` | "" | default Cloudflare zone |
+| `defaultR2Bucket` | "" | default R2 bucket for `rh_files_*` |
 
 `rh_settings_get` returns the resolved values; `rh_settings_set` merges a
 partial patch (persisted by the harness settings provider).
@@ -84,6 +86,7 @@ canonical example of the current DSH-native form (tool-to-tool via
 |---|---|
 | `blueprint/daily-digest` | Collect sources, summarize, send on a schedule — extractive locally, LLM synthesis as escalation |
 | `blueprint/data-adapter` | Wrap one keyless public API as a tool family: guarded fetch, normalize, one tool per query. Worked example ships in the plugin: `rh_weather_*` |
+| (phase 5) `rh_files_*` on R2 | The first family on an actual Cloudflare primitive: S3-compatible API, SigV4 signing pinned to the AWS test vector, credentials from the credential provider |
 | `blueprint/research-radar` | Multi-source research over a rolling window (Reddit, X, YouTube, HN, Polymarket, web): score, dedupe, synthesize with citations |
 | `blueprint/web-scraper` | Fetch a page, extract title/headings/links/text, make it searchable — static HTML first, render/vision as escalation |
 | `blueprint/vision-worker` | Cloudflare Worker exposing kimi-k2.6 vision: route image requests for text-only models, return a versioned `VisionEnvelope` |

package/lib/files-tools.d.ts

@@ -0,0 +1,55 @@
+/**
+ * files-tools — rh_files_* over Cloudflare R2 (the user's own account).
+ * The first family on an actual Cloudflare primitive. S3-compatible API,
+ * signed with SigV4 (src/sigv4.ts, pinned to the AWS test vector).
+ *
+ * Credentials resolve at call time from the credential provider
+ * (R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY); accountId and bucket come
+ * from the righthand settings namespace. The client is a pure factory so
+ * tests drive it with a stubbed fetch.
+ * @module dsh-righthand/files-tools
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "righthand-files";
+export declare const inject: string[];
+export declare const R2_ACCESS_KEY_REF = "R2_ACCESS_KEY_ID";
+export declare const R2_SECRET_KEY_REF = "R2_SECRET_ACCESS_KEY";
+export interface FilesConfig {
+    /** Bucket name; defaults to the righthand settings defaultR2Bucket. */
+    bucket?: string;
+}
+export interface R2Options {
+    accountId: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    bucket: string;
+    fetchImpl?: typeof fetch;
+    now?: () => Date;
+}
+export interface ListEntry {
+    key: string;
+    size: number;
+    lastModified: string;
+}
+/**
+ * The R2 client factory. Pure over its options; every call signs fresh.
+ */
+export declare function createR2Client(opts: R2Options): {
+    put(key: string, content: string, contentType?: string): Promise<{
+        key: string;
+        size: number;
+    }>;
+    get(key: string): Promise<{
+        found: boolean;
+        content: string;
+        contentType: string;
+    }>;
+    list(prefix?: string, maxKeys?: number): Promise<ListEntry[]>;
+    share(key: string, expiresSeconds: number): string;
+    delete(key: string): Promise<{
+        key: string;
+        existed: boolean;
+    }>;
+};
+export declare function apply(ctx: Context, config?: FilesConfig): void;
+//# sourceMappingURL=files-tools.d.ts.map

package/lib/files-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-tools.d.ts","sourceRoot":"","sources":["../src/files-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,eAAO,MAAM,IAAI,oBAAoB,CAAA;AACrC,eAAO,MAAM,MAAM,UAAuC,CAAA;AAE1D,eAAO,MAAM,iBAAiB,qBAAqB,CAAA;AACnD,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CACjB;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CACrB;AAmBD;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS;aAsB3B,MAAM,WAAW,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;aAMtF,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;kBAOrE,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;eAmBxD,MAAM,kBAAkB,MAAM,GAAG,MAAM;gBAWhC,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;EAOxE;AAGD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,WAAgB,GAAG,IAAI,CAkJlE"}

package/lib/files-tools.js

@@ -0,0 +1,259 @@
+/**
+ * files-tools — rh_files_* over Cloudflare R2 (the user's own account).
+ * The first family on an actual Cloudflare primitive. S3-compatible API,
+ * signed with SigV4 (src/sigv4.ts, pinned to the AWS test vector).
+ *
+ * Credentials resolve at call time from the credential provider
+ * (R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY); accountId and bucket come
+ * from the righthand settings namespace. The client is a pure factory so
+ * tests drive it with a stubbed fetch.
+ * @module dsh-righthand/files-tools
+ */
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import { settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { signRequest, presignGet } from "./sigv4.js";
+export const name = 'righthand-files';
+export const inject = ['tools', 'credentials', 'settings'];
+export const R2_ACCESS_KEY_REF = 'R2_ACCESS_KEY_ID';
+export const R2_SECRET_KEY_REF = 'R2_SECRET_ACCESS_KEY';
+function amzDate(d) {
+    return d.toISOString().replace(/[:-]|\.\d{3}/g, '');
+}
+/** Minimal ListObjectsV2 XML parse: Key / Size / LastModified triples. */
+function parseListXml(xml) {
+    const out = [];
+    const contents = xml.split('<Contents>').slice(1);
+    for (const block of contents) {
+        const grab = (tag) => {
+            const a = block.indexOf('<' + tag + '>');
+            const b = block.indexOf('</' + tag + '>');
+            return a < 0 || b < 0 ? '' : block.slice(a + tag.length + 2, b);
+        };
+        const key = grab('Key');
+        if (key === '')
+            continue;
+        out.push({ key, size: Number(grab('Size') ?? 0), lastModified: grab('LastModified') });
+    }
+    return out;
+}
+/**
+ * The R2 client factory. Pure over its options; every call signs fresh.
+ */
+export function createR2Client(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const now = opts.now ?? (() => new Date());
+    const base = 'https://' + opts.accountId + '.r2.cloudflarestorage.com/' + opts.bucket;
+    async function request(method, key, payload, extraHeaders = {}) {
+        const url = base + '/' + key;
+        const parsed = new URL(url);
+        const signed = signRequest({
+            method,
+            url,
+            headers: { host: parsed.host, ...extraHeaders },
+            payload,
+            accessKeyId: opts.accessKeyId,
+            secretAccessKey: opts.secretAccessKey,
+            region: 'auto',
+            amzDate: amzDate(now()),
+        });
+        return fetchImpl(url, { method, headers: signed.headers, body: payload === '' ? undefined : payload });
+    }
+    return {
+        async put(key, content, contentType) {
+            const res = await request('PUT', key, content, contentType ? { 'content-type': contentType } : {});
+            if (!res.ok)
+                throw new Error('R2 PUT failed: HTTP ' + res.status);
+            return { key, size: Buffer.byteLength(content) };
+        },
+        async get(key) {
+            const res = await request('GET', key, '');
+            if (res.status === 404)
+                return { found: false, content: '', contentType: '' };
+            if (!res.ok)
+                throw new Error('R2 GET failed: HTTP ' + res.status);
+            return { found: true, content: await res.text(), contentType: res.headers.get('content-type') ?? '' };
+        },
+        async list(prefix, maxKeys) {
+            const q = '?list-type=2' + (prefix ? '&prefix=' + encodeURIComponent(prefix) : '') + (maxKeys ? '&max-keys=' + maxKeys : '');
+            const url = base + '/' + q;
+            const parsed = new URL(url);
+            const signed = signRequest({
+                method: 'GET',
+                url,
+                headers: { host: parsed.host },
+                payload: '',
+                accessKeyId: opts.accessKeyId,
+                secretAccessKey: opts.secretAccessKey,
+                region: 'auto',
+                amzDate: amzDate(now()),
+            });
+            const res = await fetchImpl(url, { method: 'GET', headers: signed.headers });
+            if (!res.ok)
+                throw new Error('R2 list failed: HTTP ' + res.status);
+            return parseListXml(await res.text());
+        },
+        share(key, expiresSeconds) {
+            return presignGet({
+                url: base + '/' + key,
+                accessKeyId: opts.accessKeyId,
+                secretAccessKey: opts.secretAccessKey,
+                region: 'auto',
+                amzDate: amzDate(now()),
+                expiresSeconds,
+            });
+        },
+        async delete(key) {
+            const res = await request('DELETE', key, '');
+            if (res.status === 404)
+                return { key, existed: false };
+            if (!res.ok)
+                throw new Error('R2 DELETE failed: HTTP ' + res.status);
+            return { key, existed: true };
+        },
+    };
+}
+export function apply(ctx, config = {}) {
+    const ns = settingsNamespace('righthand');
+    /** Resolve accountId + credentials + bucket at call time. */
+    async function client() {
+        const settings = ctx.settings.get(ns);
+        const accountId = settings?.accountId ?? '';
+        if (accountId === '')
+            throw new Error('righthand accountId is not set (rh_settings_set { accountId })');
+        const bucket = config.bucket ?? settings?.defaultR2Bucket ?? '';
+        if (bucket === '')
+            throw new Error('R2 bucket is not set (plugin config bucket or settings defaultR2Bucket)');
+        const access = await ctx.credentials.resolve(credentialRef(R2_ACCESS_KEY_REF));
+        const secret = await ctx.credentials.resolve(credentialRef(R2_SECRET_KEY_REF));
+        if (access === undefined || secret === undefined) {
+            throw new Error('R2 credentials are not set (rh_credential_set R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY)');
+        }
+        return createR2Client({ accountId, accessKeyId: access.value, secretAccessKey: secret.value, bucket });
+    }
+    ctx.tools.register(defineTool({
+        name: 'rh_files_put',
+        description: 'Store a file in the R2 bucket and return its key. Content is text (reports, CSV, transcripts, code); content type defaults to text/plain.',
+        parameters: {
+            key: { type: 'string', required: true, description: 'Object key, e.g. reports/2026-08-30.csv.' },
+            content: { type: 'string', required: true, description: 'The full text content to store.' },
+            contentType: { type: 'string', description: 'Content type, e.g. text/csv. Defaults to text/plain.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    key: { type: 'string', required: true },
+                    size: { type: 'integer', required: true },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: 'stored ' + value.key + ' (' + value.size + ' bytes)' }],
+        },
+        async execute(args) {
+            const c = await client();
+            return c.put(args.key, args.content, args.contentType);
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'rh_files_get',
+        description: 'Read a stored file back by its key. found: false means the key is absent, not an error.',
+        parameters: {
+            key: { type: 'string', required: true, description: 'The object key to read.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    found: { type: 'boolean', required: true },
+                    key: { type: 'string', required: true },
+                    content: { type: 'string' },
+                    contentType: { type: 'string' },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: value.found && typeof value.content === 'string' ? value.content : '(absent)' }],
+        },
+        async execute(args) {
+            const c = await client();
+            const out = await c.get(args.key);
+            return {
+                key: args.key,
+                found: out.found,
+                ...out.found ? { content: out.content, contentType: out.contentType } : {},
+            };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'rh_files_list',
+        description: 'List objects in the bucket, optionally by key prefix. Newest first is not guaranteed by S3; entries carry lastModified.',
+        parameters: {
+            prefix: { type: 'string', description: 'Only keys starting with this, e.g. reports/.' },
+            maxKeys: { type: 'integer', description: 'Max entries (default 100).' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    entries: { type: 'array', required: true, items: { type: 'json' } },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: value.entries.length + ' objects' }],
+        },
+        async execute(args) {
+            const c = await client();
+            const entries = await c.list(args.prefix, args.maxKeys);
+            return { entries: entries };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'rh_files_share',
+        description: 'Get a presigned download URL for a key, valid for the given minutes (default 60, max 10080). Anyone with the URL can read the object for that window.',
+        parameters: {
+            key: { type: 'string', required: true, description: 'The object key to share.' },
+            minutes: { type: 'integer', description: 'Validity in minutes (default 60, max 10080 = 7 days).' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    key: { type: 'string', required: true },
+                    url: { type: 'string', required: true },
+                    expiresAt: { type: 'string', required: true },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: value.url }],
+        },
+        async execute(args) {
+            const minutes = Math.min(Math.max(args.minutes ?? 60, 1), 10080);
+            const c = await client();
+            const url = c.share(args.key, minutes * 60);
+            return { key: args.key, url, expiresAt: new Date(Date.now() + minutes * 60000).toISOString() };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'rh_files_delete',
+        description: 'Delete an object by key. Returns whether it existed.',
+        parameters: {
+            key: { type: 'string', required: true, description: 'The object key to delete.' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    key: { type: 'string', required: true },
+                    existed: { type: 'boolean', required: true },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: 'deleted ' + value.key + ': ' + value.existed }],
+        },
+        async execute(args) {
+            const c = await client();
+            return c.delete(args.key);
+        },
+    }));
+}
+//# sourceMappingURL=files-tools.js.map

package/lib/files-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-tools.js","sourceRoot":"","sources":["../src/files-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAA;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAgBvD,SAAS,OAAO,CAAC,CAAO;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AACrD,CAAC;AAQD,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;YACnC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;YACxC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,GAAG,KAAK,EAAE;YAAE,SAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,CAAC,SAAS,GAAG,4BAA4B,GAAG,IAAI,CAAC,MAAM,CAAA;IAErF,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe,EAAE,eAAuC,EAAE;QAC5G,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAA;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM;YACN,GAAG;YACH,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE;YAC/C,OAAO;YACP,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACxB,CAAC,CAAA;QACF,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACxG,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAClG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACjE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAA;QAClD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAW;YACnB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;YAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAA;QACvG,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAe,EAAE,OAAgB;YAC1C,MAAM,CAAC,GAAG,cAAc,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC5H,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,CAAA;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,MAAM,GAAG,WAAW,CAAC;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG;gBACH,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC9B,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aACxB,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YAClE,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,GAAW,EAAE,cAAsB;YACvC,OAAO,UAAU,CAAC;gBAChB,GAAG,EAAE,IAAI,GAAG,GAAG,GAAG,GAAG;gBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;gBACvB,cAAc;aACf,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YACtD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;YACpE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC/B,CAAC;KACF,CAAA;AACH,CAAC;AAGD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAsB,EAAE;IAC1D,MAAM,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAEzC,6DAA6D;IAC7D,KAAK,UAAU,MAAM;QACnB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAiE,CAAA;QACrG,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAA;QAC3C,IAAI,SAAS,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACvG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAA;QAC/D,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;QAC7G,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC9E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;QAC3G,CAAC;QACD,OAAO,cAAc,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxG,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,2IAA2I;QACxJ,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE;YAChG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAC3F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;SACrG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;SAC1G;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAA;YACxB,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,yFAAyF;QACtG,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;SAChF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC1C,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;SAClI;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAA;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjC,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;aAC3E,CAAA;QACH,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,yHAAyH;QACtI,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;YACvF,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE;SACxE;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;iBACpE;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;SACtF;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAA;YACxB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YACvD,OAAO,EAAE,OAAO,EAAE,OAAgB,EAAE,CAAA;QACtC,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,uJAAuJ;QACpK,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE;YAChF,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,uDAAuD,EAAE;SACnG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;SAC9D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAChE,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAA;YACxB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,EAAE,CAAC,CAAA;YAC3C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;QAChG,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,sDAAsD;QACnE,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;SAClF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;SAClG;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAA;YACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}

package/lib/index.d.ts

@@ -17,6 +17,7 @@
  * - task-tools:      rh_task_create/list/next/update/delete over ctx.storageDomain
  * - text-tools:      rh_text_summarise/extract/classify/translate over ctx.llm
  * - weather-tools:   rh_weather_forecast/air over Open-Meteo (keyless, SSRF-guarded)
+ * - files-tools:     rh_files_put/get/list/share/delete over Cloudflare R2
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
  * - skills:          the packaged dsh-righthand skill (ctx.skills)
@@ -31,6 +32,7 @@ import * as guardTools from './guard-tools.ts';
 import * as taskTools from './task-tools.ts';
 import * as textTools from './text-tools.ts';
 import * as weatherTools from './weather-tools.ts';
+import * as filesTools from './files-tools.ts';
 import * as righthandSkills from './skills.ts';
 import type { GuardRule } from './guard-tools.ts';
 export declare const name = "dsh-righthand";
@@ -48,11 +50,14 @@ export interface RighthandConfig {
  * instead of failing the whole plugin.
  */
 export declare function apply(ctx: Context, config?: RighthandConfig): void;
-export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, guardTools, righthandSkills };
+export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, filesTools, guardTools, righthandSkills };
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts';
 export type { GuardRule } from './guard-tools.ts';
 export { guardFactsFor } from './guard-tools.ts';
 export type { GuardFacts } from './guard-tools.ts';
 export { isBlockedIP, guardedFetch, normalizeForecast, normalizeAir } from './weather-tools.ts';
+export { createR2Client, R2_ACCESS_KEY_REF, R2_SECRET_KEY_REF } from './files-tools.ts';
+export { signRequest, presignGet } from './sigv4.ts';
+export type { R2Options, ListEntry } from './files-tools.ts';
 export type { WeatherConfig, ForecastOut, AirOut } from './weather-tools.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAStE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC/G,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC/F,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAUtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3H,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACpD,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA"}

package/lib/index.js

@@ -17,6 +17,7 @@
  * - task-tools:      rh_task_create/list/next/update/delete over ctx.storageDomain
  * - text-tools:      rh_text_summarise/extract/classify/translate over ctx.llm
  * - weather-tools:   rh_weather_forecast/air over Open-Meteo (keyless, SSRF-guarded)
+ * - files-tools:     rh_files_put/get/list/share/delete over Cloudflare R2
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
  * - skills:          the packaged dsh-righthand skill (ctx.skills)
@@ -30,6 +31,7 @@ import * as guardTools from "./guard-tools.js";
 import * as taskTools from "./task-tools.js";
 import * as textTools from "./text-tools.js";
 import * as weatherTools from "./weather-tools.js";
+import * as filesTools from "./files-tools.js";
 import * as righthandSkills from "./skills.js";
 export const name = 'dsh-righthand';
 /** The combined plugin needs no services itself; each child waits on its own. */
@@ -47,12 +49,15 @@ export function apply(ctx, config = {}) {
     ctx.plugin(taskTools);
     ctx.plugin(textTools);
     ctx.plugin(weatherTools);
+    ctx.plugin(filesTools);
     ctx.plugin(guardTools, { rules: config.rules ?? [] });
     ctx.plugin(righthandSkills);
 }
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, guardTools, righthandSkills };
+export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, filesTools, guardTools, righthandSkills };
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from "./skills.js";
 export { guardFactsFor } from "./guard-tools.js";
 export { isBlockedIP, guardedFetch, normalizeForecast, normalizeAir } from "./weather-tools.js";
+export { createR2Client, R2_ACCESS_KEY_REF, R2_SECRET_KEY_REF } from "./files-tools.js";
+export { signRequest, presignGet } from "./sigv4.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC/G,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3H,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC/F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA"}

package/lib/secrets-tools.d.ts

@@ -20,10 +20,12 @@ export declare const righthandSettingsSchema: z<Schemastery.ObjectS<{
     accountId: z<string, string>;
     defaultScriptPrefix: z<string, string>;
     defaultZone: z<string, string>;
+    defaultR2Bucket: z<string, string>;
 }>, Schemastery.ObjectT<{
     accountId: z<string, string>;
     defaultScriptPrefix: z<string, string>;
     defaultZone: z<string, string>;
+    defaultR2Bucket: z<string, string>;
 }>>;
 /** Register the settings namespace + the secret/credential tools. */
 export declare function apply(ctx: Context): void;

package/lib/secrets-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-tools.d.ts","sourceRoot":"","sources":["../src/secrets-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,eAAO,MAAM,IAAI,sBAAsB,CAAA;AACvC,eAAO,MAAM,MAAM,UAAuC,CAAA;AAE1D,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,uBAAuB;;;;;;;;GAIlC,CAAA;AAEF,qEAAqE;AACrE,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkHxC"}
+{"version":3,"file":"secrets-tools.d.ts","sourceRoot":"","sources":["../src/secrets-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,eAAO,MAAM,IAAI,sBAAsB,CAAA;AACvC,eAAO,MAAM,MAAM,UAAuC,CAAA;AAE1D,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,uBAAuB;;;;;;;;;;GAKlC,CAAA;AAEF,qEAAqE;AACrE,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkHxC"}

package/lib/secrets-tools.js

@@ -16,6 +16,7 @@ export const righthandSettingsSchema = z.object({
     accountId: z.string().default(''),
     defaultScriptPrefix: z.string().default('rh-'),
     defaultZone: z.string().default(''),
+    defaultR2Bucket: z.string().default(''),
 });
 /** Register the settings namespace + the secret/credential tools. */
 export function apply(ctx) {
@@ -104,7 +105,7 @@ export function apply(ctx) {
         },
         async execute() {
             const v = scope.get();
-            return { accountId: v.accountId, defaultScriptPrefix: v.defaultScriptPrefix, defaultZone: v.defaultZone };
+            return { accountId: v.accountId, defaultScriptPrefix: v.defaultScriptPrefix, defaultZone: v.defaultZone, defaultR2Bucket: v.defaultR2Bucket };
         },
     }));
     ctx.tools.register(defineTool({

package/lib/secrets-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-tools.js","sourceRoot":"","sources":["../src/secrets-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AACvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;AAS1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACpC,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACzC,0EAA0E;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAA;IAEhE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,kLAAkL;QAC/L,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE;SACzG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,gBAAgB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;SACtL;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAChD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC7I,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,8IAA8I;QAC3J,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2DAA2D,EAAE;YACjH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;SAC/F;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC5C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;SACxG;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAClF,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACxC,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,4CAA4C;QACzD,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE;SACxF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;SACtF;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACzC,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0KAA0K;QACvL,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACnF;QACD,KAAK,CAAC,OAAO;YACX,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;YACrB,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3G,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,2GAA2G;QACxH,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE;SAC3I;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C;aACF;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SAC3D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmC,CAAC,CAAA;YAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}
+{"version":3,"file":"secrets-tools.js","sourceRoot":"","sources":["../src/secrets-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAA;AACvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;AAS1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACxC,CAAC,CAAA;AAEF,qEAAqE;AACrE,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,MAAM,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACzC,0EAA0E;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAA;IAEhE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,kLAAkL;QAC/L,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE;SACzG;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC9C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,gBAAgB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;SACtL;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YAChD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC7I,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,8IAA8I;QAC3J,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2DAA2D,EAAE;YACjH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE;SAC/F;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC5C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;SACxG;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAClF,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACxC,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,4CAA4C;QACzD,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE;SACxF;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACvC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C;aACF;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;SACtF;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACzC,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0KAA0K;QACvL,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACnF;QACD,KAAK,CAAC,OAAO;YACX,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;YACrB,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAA;QAC/I,CAAC;KACF,CAAC,CAAC,CAAA;IAEH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,2GAA2G;QACxH,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE;SAC3I;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC7C;aACF;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SAC3D;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmC,CAAC,CAAA;YAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAC1B,CAAC;KACF,CAAC,CAAC,CAAA;AACL,CAAC"}

package/lib/sigv4.d.ts

@@ -0,0 +1,37 @@
+/**
+ * sigv4 — AWS Signature Version 4 for Cloudflare R2 (S3-compatible API).
+ * Dependency-free: node:crypto only. Exported pure so tests pin it against
+ * the AWS published test vector.
+ * @module dsh-righthand/sigv4
+ */
+export interface SignRequestInput {
+    method: string;
+    /** Full URL, e.g. https://<account>.r2.cloudflarestorage.com/<bucket>/<key> */
+    url: string;
+    /** Headers to sign (lowercase names), e.g. host, content-type. */
+    headers: Record<string, string>;
+    /** Exact payload bytes; '' for GET/DELETE without a body. */
+    payload: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** R2 uses region 'auto'. */
+    region: string;
+    /** yyyyMMdd'T'HHmmss'Z' — injectable for tests. */
+    amzDate: string;
+}
+export interface SignedRequest {
+    headers: Record<string, string>;
+}
+/**
+ * Sign one S3 request. Returns the headers to send, including host,
+ * x-amz-content-sha256, x-amz-date and Authorization.
+ */
+export declare function signRequest(input: SignRequestInput): SignedRequest;
+/**
+ * Presign a GET for query-string auth: a shareable URL valid for
+ * expiresSeconds (S3 max 7 days).
+ */
+export declare function presignGet(input: Omit<SignRequestInput, 'method' | 'headers' | 'payload'> & {
+    expiresSeconds: number;
+}): string;
+//# sourceMappingURL=sigv4.d.ts.map

package/lib/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../src/sigv4.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuBH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAA;IACX,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,aAAa,CAgClE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CA6B/H"}

package/lib/sigv4.js

@@ -0,0 +1,94 @@
+/**
+ * sigv4 — AWS Signature Version 4 for Cloudflare R2 (S3-compatible API).
+ * Dependency-free: node:crypto only. Exported pure so tests pin it against
+ * the AWS published test vector.
+ * @module dsh-righthand/sigv4
+ */
+import { createHmac, createHash } from 'node:crypto';
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data).digest();
+}
+function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/** URI-encode one path segment the S3 way. */
+function uriEncode(segment) {
+    return encodeURIComponent(segment).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+}
+/** Canonical URI: slashes preserved, each segment encoded. */
+function canonicalPath(pathname) {
+    if (pathname === '' || pathname === '/')
+        return '/';
+    return pathname.split('/').map(uriEncode).join('/');
+}
+/**
+ * Sign one S3 request. Returns the headers to send, including host,
+ * x-amz-content-sha256, x-amz-date and Authorization.
+ */
+export function signRequest(input) {
+    const parsed = new URL(input.url);
+    const date = input.amzDate.slice(0, 8);
+    const scope = date + '/' + input.region + '/s3/aws4_request';
+    const payloadHash = sha256Hex(input.payload);
+    const headers = {
+        ...input.headers,
+        'x-amz-content-sha256': payloadHash,
+        'x-amz-date': input.amzDate,
+    };
+    const names = Object.keys(headers).sort();
+    const canonicalHeaders = names.map(n => n + ':' + headers[n].trim() + String.fromCharCode(10)).join('');
+    const signedHeaders = names.join(';');
+    const canonicalRequest = [
+        input.method,
+        canonicalPath(parsed.pathname),
+        parsed.searchParams.toString(),
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join(String.fromCharCode(10));
+    const stringToSign = ['AWS4-HMAC-SHA256', input.amzDate, scope, sha256Hex(canonicalRequest)].join(String.fromCharCode(10));
+    const kDate = hmac('AWS4' + input.secretAccessKey, date);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, 's3');
+    const kSigning = hmac(kService, 'aws4_request');
+    const signature = hmac(kSigning, stringToSign).toString('hex');
+    const authorization = 'AWS4-HMAC-SHA256 Credential=' + input.accessKeyId + '/' + scope
+        + ', SignedHeaders=' + signedHeaders
+        + ', Signature=' + signature;
+    return { headers: { ...headers, authorization } };
+}
+/**
+ * Presign a GET for query-string auth: a shareable URL valid for
+ * expiresSeconds (S3 max 7 days).
+ */
+export function presignGet(input) {
+    const parsed = new URL(input.url);
+    const date = input.amzDate.slice(0, 8);
+    const scope = date + '/' + input.region + '/s3/aws4_request';
+    const credential = input.accessKeyId + '/' + scope;
+    const query = {
+        'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
+        'X-Amz-Credential': credential,
+        'X-Amz-Date': input.amzDate,
+        'X-Amz-Expires': String(input.expiresSeconds),
+        'X-Amz-SignedHeaders': 'host',
+    };
+    const canonicalQuery = Object.keys(query).sort().map(k => uriEncode(k) + '=' + uriEncode(query[k])).join('&');
+    const canonicalRequest = [
+        'GET',
+        canonicalPath(parsed.pathname),
+        canonicalQuery,
+        'host:' + parsed.host + String.fromCharCode(10),
+        'host',
+        'UNSIGNED-PAYLOAD',
+    ].join(String.fromCharCode(10));
+    const stringToSign = ['AWS4-HMAC-SHA256', input.amzDate, scope, sha256Hex(canonicalRequest)].join(String.fromCharCode(10));
+    const kDate = hmac('AWS4' + input.secretAccessKey, date);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, 's3');
+    const kSigning = hmac(kService, 'aws4_request');
+    const signature = hmac(kSigning, stringToSign).toString('hex');
+    parsed.search = canonicalQuery + '&X-Amz-Signature=' + signature;
+    return parsed.toString();
+}
+//# sourceMappingURL=sigv4.js.map

package/lib/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../src/sigv4.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEpD,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC;AAED,8CAA8C;AAC9C,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACrD,CAAC;AAsBD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAE5C,MAAM,OAAO,GAA2B;QACtC,GAAG,KAAK,CAAC,OAAO;QAChB,sBAAsB,EAAE,WAAW;QACnC,YAAY,EAAE,KAAK,CAAC,OAAO;KAC5B,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvG,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,gBAAgB,GAAG;QACvB,KAAK,CAAC,MAAM;QACZ,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9B,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/B,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9D,MAAM,aAAa,GAAG,8BAA8B,GAAG,KAAK,CAAC,WAAW,GAAG,GAAG,GAAG,KAAK;UAClF,kBAAkB,GAAG,aAAa;UAClC,cAAc,GAAG,SAAS,CAAA;IAC9B,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,EAAE,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAA4F;IACrH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAA;IAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,GAAG,GAAG,GAAG,KAAK,CAAA;IAClD,MAAM,KAAK,GAA2B;QACpC,iBAAiB,EAAE,kBAAkB;QACrC,kBAAkB,EAAE,UAAU;QAC9B,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QAC7C,qBAAqB,EAAE,MAAM;KAC9B,CAAA;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7G,MAAM,gBAAgB,GAAG;QACvB,KAAK;QACL,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B,cAAc;QACd,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM;QACN,kBAAkB;KACnB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/B,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9D,MAAM,CAAC,MAAM,GAAG,cAAc,GAAG,mBAAmB,GAAG,SAAS,CAAA;IAChE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;AAC1B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-righthand",
   "description": "DeepSeek Harness plugin: DSH-native righthand tools — durable KV store, credential/settings management, governed exec, and a tool guard",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/skills/dsh-righthand/SKILL.md

@@ -18,6 +18,7 @@ The righthand toolkit: DSH-native tools over the harness's own services. Use thi
 | exec | `rh_run` / `rh_run_bg` | `ctx.subprocess` + `ctx.jobs` | Running one command (argv array, no shell interpretation). `rh_run` collects bounded output; `rh_run_bg` starts an owner-scoped background job and returns its id. |
 | text | `rh_text_summarise` / `rh_text_extract` / `rh_text_classify` / `rh_text_translate` | `ctx.llm` (one model call per verb) | Language work: shorten, turn into JSON matching a schema, sort into your labels with confidence, or translate preserving formatting. |
 | weather | `rh_weather_forecast` / `rh_weather_air` | Open-Meteo (keyless) via the SSRF-guarded fetcher | Current conditions + 3-day min/max, or PM2.5/PM10/AQI, for a lat/lon. Keyless only — anything needing an API token is out of scope. |
+| files | `rh_files_put` / `rh_files_get` / `rh_files_list` / `rh_files_share` / `rh_files_delete` | Cloudflare R2 (the user's own account) | Store/read/list/share/delete objects in an R2 bucket. `rh_files_share` returns a presigned download URL valid for N minutes (default 60, max 7 days) — anyone with the URL can read it for that window. |
 | guard | (policy, not a tool) | `ctx.tools` `tools/pre-execute` | Configured via plugin config `rules`; gates tools by name prefix with `allow` / `deny` / `ask` modes. |
 
 ## Store semantics
@@ -26,6 +27,13 @@ The righthand toolkit: DSH-native tools over the harness's own services. Use thi
 - `rh_store_get` returns `{ found, key, value?, updatedAt? }` — `found: false` means the key is absent, not an error.
 - Writes are durable (backend flush before commit) and serialized on one write chain; values must be JSON-serializable.
 
+## Files semantics
+
+- Cloudflare R2, the user's own account: accountId from settings, credentials `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` from the credential provider, bucket from settings `defaultR2Bucket` (or plugin config).
+- Every request is SigV4-signed (region `auto`); the signer is pinned to the AWS published test vector.
+- Content is text (`text/plain` default, override with `contentType`); `rh_files_get` returns `found: false` for absent keys, not an error.
+- `rh_files_share` presigns a GET — treat the URL as a secret for its validity window.
+
 ## Weather semantics
 
 - Keyless only: Open-Meteo, no token. Every request goes through `guardedFetch` — public destinations only (loopback/private/link-local/multicast refused), every redirect hop revalidated, size and time capped.
@@ -59,6 +67,7 @@ The righthand toolkit: DSH-native tools over the harness's own services. Use thi
 | `accountId` | `""` | Cloudflare account id used by righthand Cloudflare tools |
 | `defaultScriptPrefix` | `"rh-"` | default name prefix for generated workers/scripts |
 | `defaultZone` | `""` | default Cloudflare zone |
+| `defaultR2Bucket` | `""` | default R2 bucket for `rh_files_*` |
 
 ## Guard policy
 
@@ -68,5 +77,5 @@ Rules come from the plugin config (`rules: [{ toolPrefix, mode, ask?, destructiv
 
 ## Service availability
 
-- **web profile**: all twenty-two tools register (`storageDomain` is provided by the web app rows).
+- **web profile**: all twenty-seven tools register (`storageDomain` is provided by the web app rows).
 - **other profiles** (e.g. headless): the store and task families stay dormant; the other seven tools still register. The plugin never fails the boot.

package/src/files-tools.ts

@@ -0,0 +1,294 @@
+/**
+ * files-tools — rh_files_* over Cloudflare R2 (the user's own account).
+ * The first family on an actual Cloudflare primitive. S3-compatible API,
+ * signed with SigV4 (src/sigv4.ts, pinned to the AWS test vector).
+ *
+ * Credentials resolve at call time from the credential provider
+ * (R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY); accountId and bucket come
+ * from the righthand settings namespace. The client is a pure factory so
+ * tests drive it with a stubbed fetch.
+ * @module dsh-righthand/files-tools
+ */
+
+import type { Context } from '@deepseek-ai/cordis'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import { credentialRef } from '@deepseek-ai/dsh-credentials'
+import { settingsNamespace } from '@deepseek-ai/dsh-settings'
+import { signRequest, presignGet } from './sigv4.ts'
+
+export const name = 'righthand-files'
+export const inject = ['tools', 'credentials', 'settings']
+
+export const R2_ACCESS_KEY_REF = 'R2_ACCESS_KEY_ID'
+export const R2_SECRET_KEY_REF = 'R2_SECRET_ACCESS_KEY'
+
+export interface FilesConfig {
+  /** Bucket name; defaults to the righthand settings defaultR2Bucket. */
+  bucket?: string
+}
+
+export interface R2Options {
+  accountId: string
+  accessKeyId: string
+  secretAccessKey: string
+  bucket: string
+  fetchImpl?: typeof fetch
+  now?: () => Date
+}
+
+function amzDate(d: Date): string {
+  return d.toISOString().replace(/[:-]|\.\d{3}/g, '')
+}
+
+export interface ListEntry {
+  key: string
+  size: number
+  lastModified: string
+}
+
+/** Minimal ListObjectsV2 XML parse: Key / Size / LastModified triples. */
+function parseListXml(xml: string): ListEntry[] {
+  const out: ListEntry[] = []
+  const contents = xml.split('<Contents>').slice(1)
+  for (const block of contents) {
+    const grab = (tag: string): string => {
+      const a = block.indexOf('<' + tag + '>')
+      const b = block.indexOf('</' + tag + '>')
+      return a < 0 || b < 0 ? '' : block.slice(a + tag.length + 2, b)
+    }
+    const key = grab('Key')
+    if (key === '') continue
+    out.push({ key, size: Number(grab('Size') ?? 0), lastModified: grab('LastModified') })
+  }
+  return out
+}
+
+/**
+ * The R2 client factory. Pure over its options; every call signs fresh.
+ */
+export function createR2Client(opts: R2Options) {
+  const fetchImpl = opts.fetchImpl ?? fetch
+  const now = opts.now ?? (() => new Date())
+  const base = 'https://' + opts.accountId + '.r2.cloudflarestorage.com/' + opts.bucket
+
+  async function request(method: string, key: string, payload: string, extraHeaders: Record<string, string> = {}): Promise<Response> {
+    const url = base + '/' + key
+    const parsed = new URL(url)
+    const signed = signRequest({
+      method,
+      url,
+      headers: { host: parsed.host, ...extraHeaders },
+      payload,
+      accessKeyId: opts.accessKeyId,
+      secretAccessKey: opts.secretAccessKey,
+      region: 'auto',
+      amzDate: amzDate(now()),
+    })
+    return fetchImpl(url, { method, headers: signed.headers, body: payload === '' ? undefined : payload })
+  }
+
+  return {
+    async put(key: string, content: string, contentType?: string): Promise<{ key: string; size: number }> {
+      const res = await request('PUT', key, content, contentType ? { 'content-type': contentType } : {})
+      if (!res.ok) throw new Error('R2 PUT failed: HTTP ' + res.status)
+      return { key, size: Buffer.byteLength(content) }
+    },
+
+    async get(key: string): Promise<{ found: boolean; content: string; contentType: string }> {
+      const res = await request('GET', key, '')
+      if (res.status === 404) return { found: false, content: '', contentType: '' }
+      if (!res.ok) throw new Error('R2 GET failed: HTTP ' + res.status)
+      return { found: true, content: await res.text(), contentType: res.headers.get('content-type') ?? '' }
+    },
+
+    async list(prefix?: string, maxKeys?: number): Promise<ListEntry[]> {
+      const q = '?list-type=2' + (prefix ? '&prefix=' + encodeURIComponent(prefix) : '') + (maxKeys ? '&max-keys=' + maxKeys : '')
+      const url = base + '/' + q
+      const parsed = new URL(url)
+      const signed = signRequest({
+        method: 'GET',
+        url,
+        headers: { host: parsed.host },
+        payload: '',
+        accessKeyId: opts.accessKeyId,
+        secretAccessKey: opts.secretAccessKey,
+        region: 'auto',
+        amzDate: amzDate(now()),
+      })
+      const res = await fetchImpl(url, { method: 'GET', headers: signed.headers })
+      if (!res.ok) throw new Error('R2 list failed: HTTP ' + res.status)
+      return parseListXml(await res.text())
+    },
+
+    share(key: string, expiresSeconds: number): string {
+      return presignGet({
+        url: base + '/' + key,
+        accessKeyId: opts.accessKeyId,
+        secretAccessKey: opts.secretAccessKey,
+        region: 'auto',
+        amzDate: amzDate(now()),
+        expiresSeconds,
+      })
+    },
+
+    async delete(key: string): Promise<{ key: string; existed: boolean }> {
+      const res = await request('DELETE', key, '')
+      if (res.status === 404) return { key, existed: false }
+      if (!res.ok) throw new Error('R2 DELETE failed: HTTP ' + res.status)
+      return { key, existed: true }
+    },
+  }
+}
+
+
+export function apply(ctx: Context, config: FilesConfig = {}): void {
+  const ns = settingsNamespace('righthand')
+
+  /** Resolve accountId + credentials + bucket at call time. */
+  async function client(): Promise<ReturnType<typeof createR2Client>> {
+    const settings = ctx.settings.get(ns) as { accountId?: string; defaultR2Bucket?: string } | undefined
+    const accountId = settings?.accountId ?? ''
+    if (accountId === '') throw new Error('righthand accountId is not set (rh_settings_set { accountId })')
+    const bucket = config.bucket ?? settings?.defaultR2Bucket ?? ''
+    if (bucket === '') throw new Error('R2 bucket is not set (plugin config bucket or settings defaultR2Bucket)')
+    const access = await ctx.credentials.resolve(credentialRef(R2_ACCESS_KEY_REF))
+    const secret = await ctx.credentials.resolve(credentialRef(R2_SECRET_KEY_REF))
+    if (access === undefined || secret === undefined) {
+      throw new Error('R2 credentials are not set (rh_credential_set R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY)')
+    }
+    return createR2Client({ accountId, accessKeyId: access.value, secretAccessKey: secret.value, bucket })
+  }
+
+  ctx.tools.register(defineTool({
+    name: 'rh_files_put',
+    description: 'Store a file in the R2 bucket and return its key. Content is text (reports, CSV, transcripts, code); content type defaults to text/plain.',
+    parameters: {
+      key: { type: 'string', required: true, description: 'Object key, e.g. reports/2026-08-30.csv.' },
+      content: { type: 'string', required: true, description: 'The full text content to store.' },
+      contentType: { type: 'string', description: 'Content type, e.g. text/csv. Defaults to text/plain.' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          key: { type: 'string', required: true },
+          size: { type: 'integer', required: true },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: 'stored ' + value.key + ' (' + value.size + ' bytes)' }],
+    },
+    async execute(args) {
+      const c = await client()
+      return c.put(args.key, args.content, args.contentType)
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'rh_files_get',
+    description: 'Read a stored file back by its key. found: false means the key is absent, not an error.',
+    parameters: {
+      key: { type: 'string', required: true, description: 'The object key to read.' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          found: { type: 'boolean', required: true },
+          key: { type: 'string', required: true },
+          content: { type: 'string' },
+          contentType: { type: 'string' },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: value.found && typeof value.content === 'string' ? value.content : '(absent)' }],
+    },
+    async execute(args) {
+      const c = await client()
+      const out = await c.get(args.key)
+      return {
+        key: args.key,
+        found: out.found,
+        ...out.found ? { content: out.content, contentType: out.contentType } : {},
+      }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'rh_files_list',
+    description: 'List objects in the bucket, optionally by key prefix. Newest first is not guaranteed by S3; entries carry lastModified.',
+    parameters: {
+      prefix: { type: 'string', description: 'Only keys starting with this, e.g. reports/.' },
+      maxKeys: { type: 'integer', description: 'Max entries (default 100).' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          entries: { type: 'array', required: true, items: { type: 'json' } },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: value.entries.length + ' objects' }],
+    },
+    async execute(args) {
+      const c = await client()
+      const entries = await c.list(args.prefix, args.maxKeys)
+      return { entries: entries as any[] }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'rh_files_share',
+    description: 'Get a presigned download URL for a key, valid for the given minutes (default 60, max 10080). Anyone with the URL can read the object for that window.',
+    parameters: {
+      key: { type: 'string', required: true, description: 'The object key to share.' },
+      minutes: { type: 'integer', description: 'Validity in minutes (default 60, max 10080 = 7 days).' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          key: { type: 'string', required: true },
+          url: { type: 'string', required: true },
+          expiresAt: { type: 'string', required: true },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: value.url }],
+    },
+    async execute(args) {
+      const minutes = Math.min(Math.max(args.minutes ?? 60, 1), 10080)
+      const c = await client()
+      const url = c.share(args.key, minutes * 60)
+      return { key: args.key, url, expiresAt: new Date(Date.now() + minutes * 60000).toISOString() }
+    },
+  }))
+
+  ctx.tools.register(defineTool({
+    name: 'rh_files_delete',
+    description: 'Delete an object by key. Returns whether it existed.',
+    parameters: {
+      key: { type: 'string', required: true, description: 'The object key to delete.' },
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          key: { type: 'string', required: true },
+          existed: { type: 'boolean', required: true },
+        },
+      },
+      render: (_args, value) => [{ type: 'text', text: 'deleted ' + value.key + ': ' + value.existed }],
+    },
+    async execute(args) {
+      const c = await client()
+      return c.delete(args.key)
+    },
+  }))
+}
+
+
+
+

package/src/index.ts

@@ -17,6 +17,7 @@
  * - task-tools:      rh_task_create/list/next/update/delete over ctx.storageDomain
  * - text-tools:      rh_text_summarise/extract/classify/translate over ctx.llm
  * - weather-tools:   rh_weather_forecast/air over Open-Meteo (keyless, SSRF-guarded)
+ * - files-tools:     rh_files_put/get/list/share/delete over Cloudflare R2
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
  * - skills:          the packaged dsh-righthand skill (ctx.skills)
@@ -32,6 +33,7 @@ import * as guardTools from './guard-tools.ts'
 import * as taskTools from './task-tools.ts'
 import * as textTools from './text-tools.ts'
 import * as weatherTools from './weather-tools.ts'
+import * as filesTools from './files-tools.ts'
 import * as righthandSkills from './skills.ts'
 import type { GuardRule } from './guard-tools.ts'
 
@@ -59,16 +61,20 @@ export function apply(ctx: Context, config: RighthandConfig = {}): void {
   ctx.plugin(taskTools)
   ctx.plugin(textTools)
   ctx.plugin(weatherTools)
+  ctx.plugin(filesTools)
   ctx.plugin(guardTools, { rules: config.rules ?? [] })
   ctx.plugin(righthandSkills)
 }
 
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, guardTools, righthandSkills }
+export { storeTools, secretsTools, execTools, taskTools, textTools, weatherTools, filesTools, guardTools, righthandSkills }
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts'
 export type { GuardRule } from './guard-tools.ts'
 export { guardFactsFor } from './guard-tools.ts'
 export type { GuardFacts } from './guard-tools.ts'
 export { isBlockedIP, guardedFetch, normalizeForecast, normalizeAir } from './weather-tools.ts'
+export { createR2Client, R2_ACCESS_KEY_REF, R2_SECRET_KEY_REF } from './files-tools.ts'
+export { signRequest, presignGet } from './sigv4.ts'
+export type { R2Options, ListEntry } from './files-tools.ts'
 export type { WeatherConfig, ForecastOut, AirOut } from './weather-tools.ts'
 

package/src/secrets-tools.ts

@@ -27,6 +27,7 @@ export const righthandSettingsSchema = z.object({
   accountId: z.string().default(''),
   defaultScriptPrefix: z.string().default('rh-'),
   defaultZone: z.string().default(''),
+  defaultR2Bucket: z.string().default(''),
 })
 
 /** Register the settings namespace + the secret/credential tools. */
@@ -119,7 +120,7 @@ export function apply(ctx: Context): void {
     },
     async execute() {
       const v = scope.get()
-      return { accountId: v.accountId, defaultScriptPrefix: v.defaultScriptPrefix, defaultZone: v.defaultZone }
+      return { accountId: v.accountId, defaultScriptPrefix: v.defaultScriptPrefix, defaultZone: v.defaultZone, defaultR2Bucket: v.defaultR2Bucket }
     },
   }))
 

package/src/sigv4.ts

@@ -0,0 +1,122 @@
+/**
+ * sigv4 — AWS Signature Version 4 for Cloudflare R2 (S3-compatible API).
+ * Dependency-free: node:crypto only. Exported pure so tests pin it against
+ * the AWS published test vector.
+ * @module dsh-righthand/sigv4
+ */
+
+import { createHmac, createHash } from 'node:crypto'
+
+function hmac(key: Buffer | string, data: string): Buffer {
+  return createHmac('sha256', key).update(data).digest()
+}
+
+function sha256Hex(data: string): string {
+  return createHash('sha256').update(data).digest('hex')
+}
+
+/** URI-encode one path segment the S3 way. */
+function uriEncode(segment: string): string {
+  return encodeURIComponent(segment).replace(/[!'()*]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase())
+}
+
+/** Canonical URI: slashes preserved, each segment encoded. */
+function canonicalPath(pathname: string): string {
+  if (pathname === '' || pathname === '/') return '/'
+  return pathname.split('/').map(uriEncode).join('/')
+}
+
+export interface SignRequestInput {
+  method: string
+  /** Full URL, e.g. https://<account>.r2.cloudflarestorage.com/<bucket>/<key> */
+  url: string
+  /** Headers to sign (lowercase names), e.g. host, content-type. */
+  headers: Record<string, string>
+  /** Exact payload bytes; '' for GET/DELETE without a body. */
+  payload: string
+  accessKeyId: string
+  secretAccessKey: string
+  /** R2 uses region 'auto'. */
+  region: string
+  /** yyyyMMdd'T'HHmmss'Z' — injectable for tests. */
+  amzDate: string
+}
+
+export interface SignedRequest {
+  headers: Record<string, string>
+}
+
+/**
+ * Sign one S3 request. Returns the headers to send, including host,
+ * x-amz-content-sha256, x-amz-date and Authorization.
+ */
+export function signRequest(input: SignRequestInput): SignedRequest {
+  const parsed = new URL(input.url)
+  const date = input.amzDate.slice(0, 8)
+  const scope = date + '/' + input.region + '/s3/aws4_request'
+  const payloadHash = sha256Hex(input.payload)
+
+  const headers: Record<string, string> = {
+    ...input.headers,
+    'x-amz-content-sha256': payloadHash,
+    'x-amz-date': input.amzDate,
+  }
+  const names = Object.keys(headers).sort()
+  const canonicalHeaders = names.map(n => n + ':' + headers[n].trim() + String.fromCharCode(10)).join('')
+  const signedHeaders = names.join(';')
+  const canonicalRequest = [
+    input.method,
+    canonicalPath(parsed.pathname),
+    parsed.searchParams.toString(),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join(String.fromCharCode(10))
+  const stringToSign = ['AWS4-HMAC-SHA256', input.amzDate, scope, sha256Hex(canonicalRequest)].join(String.fromCharCode(10))
+  const kDate = hmac('AWS4' + input.secretAccessKey, date)
+  const kRegion = hmac(kDate, input.region)
+  const kService = hmac(kRegion, 's3')
+  const kSigning = hmac(kService, 'aws4_request')
+  const signature = hmac(kSigning, stringToSign).toString('hex')
+  const authorization = 'AWS4-HMAC-SHA256 Credential=' + input.accessKeyId + '/' + scope
+    + ', SignedHeaders=' + signedHeaders
+    + ', Signature=' + signature
+  return { headers: { ...headers, authorization } }
+}
+
+/**
+ * Presign a GET for query-string auth: a shareable URL valid for
+ * expiresSeconds (S3 max 7 days).
+ */
+export function presignGet(input: Omit<SignRequestInput, 'method' | 'headers' | 'payload'> & { expiresSeconds: number }): string {
+  const parsed = new URL(input.url)
+  const date = input.amzDate.slice(0, 8)
+  const scope = date + '/' + input.region + '/s3/aws4_request'
+  const credential = input.accessKeyId + '/' + scope
+  const query: Record<string, string> = {
+    'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
+    'X-Amz-Credential': credential,
+    'X-Amz-Date': input.amzDate,
+    'X-Amz-Expires': String(input.expiresSeconds),
+    'X-Amz-SignedHeaders': 'host',
+  }
+  const canonicalQuery = Object.keys(query).sort().map(k => uriEncode(k) + '=' + uriEncode(query[k])).join('&')
+  const canonicalRequest = [
+    'GET',
+    canonicalPath(parsed.pathname),
+    canonicalQuery,
+    'host:' + parsed.host + String.fromCharCode(10),
+    'host',
+    'UNSIGNED-PAYLOAD',
+  ].join(String.fromCharCode(10))
+  const stringToSign = ['AWS4-HMAC-SHA256', input.amzDate, scope, sha256Hex(canonicalRequest)].join(String.fromCharCode(10))
+  const kDate = hmac('AWS4' + input.secretAccessKey, date)
+  const kRegion = hmac(kDate, input.region)
+  const kService = hmac(kRegion, 's3')
+  const kSigning = hmac(kService, 'aws4_request')
+  const signature = hmac(kSigning, stringToSign).toString('hex')
+  parsed.search = canonicalQuery + '&X-Amz-Signature=' + signature
+  return parsed.toString()
+}
+
+