buckyos 0.7.148 → 0.7.149

package/cli/dist/cli.mjs

@@ -2498,7 +2498,7 @@ function replPrompt(config) {
   return `buckyos[${profile}|${zone}|${identity}]> `;
 }
 const EMPTY_INPUT$3 = { type: "object", properties: {}, additionalProperties: false };
-const OBJECT_OUTPUT$d = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$e = { type: "object", additionalProperties: true };
 function createAuthModule() {
   return {
     name: "auth",
@@ -2508,7 +2508,7 @@ function createAuthModule() {
         verb: "whoami",
         summary: "Show the effective principal and application identity",
         inputSchema: EMPTY_INPUT$3,
-        outputSchema: OBJECT_OUTPUT$d,
+        outputSchema: OBJECT_OUTPUT$e,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2526,7 +2526,7 @@ function createAuthModule() {
         verb: "session-status",
         summary: "Show the in-memory session state without exposing credentials",
         inputSchema: EMPTY_INPUT$3,
-        outputSchema: OBJECT_OUTPUT$d,
+        outputSchema: OBJECT_OUTPUT$e,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2547,7 +2547,7 @@ const EMPTY_INPUT$2 = {
   properties: {},
   additionalProperties: false
 };
-const OBJECT_OUTPUT$c = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$d = { type: "object", additionalProperties: true };
 function createCoreModules(registry) {
   return [createCommandModule(registry), createConfigModule(), createCompletionModule(registry)];
 }
@@ -2560,7 +2560,7 @@ function createCommandModule(registry) {
         verb: "list",
         summary: "List registered modules and commands",
         inputSchema: EMPTY_INPUT$2,
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2593,7 +2593,7 @@ function createCommandModule(registry) {
           required: ["target_module", "target_verb"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2615,7 +2615,7 @@ function createConfigModule() {
         verb: "list",
         summary: "List the global configuration and available profiles",
         inputSchema: EMPTY_INPUT$2,
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2646,7 +2646,7 @@ function createConfigModule() {
           },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -2692,7 +2692,7 @@ function createConfigModule() {
           required: ["key", "value"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -2732,7 +2732,7 @@ function createConfigModule() {
           required: ["profile_name"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -2764,7 +2764,7 @@ function createConfigModule() {
           properties: { effective: { type: "boolean" } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$c,
+        outputSchema: OBJECT_OUTPUT$d,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -3006,7 +3006,7 @@ async function buckyosInfo(ctx) {
   );
 }
 const SERVICE_NAME = "system_config";
-const OBJECT_OUTPUT$b = { type: "object", additionalProperties: false };
+const OBJECT_OUTPUT$c = { type: "object", additionalProperties: false };
 const KEY_INPUT = {
   type: "object",
   properties: { key: { type: "string", minLength: 1 } },
@@ -3024,7 +3024,7 @@ function createSystemConfigModule() {
         positionals: [{ name: "key", description: "System-config key" }],
         inputSchema: KEY_INPUT,
         outputSchema: {
-          ...OBJECT_OUTPUT$b,
+          ...OBJECT_OUTPUT$c,
           properties: {
             key: { type: "string" },
             value: { type: "string" },
@@ -3067,7 +3067,7 @@ function createSystemConfigModule() {
           additionalProperties: false
         },
         outputSchema: {
-          ...OBJECT_OUTPUT$b,
+          ...OBJECT_OUTPUT$c,
           properties: {
             key: { type: "string" },
             items: { type: "array", items: { type: "string" } }
@@ -3121,7 +3121,7 @@ function setCommand() {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$b,
+      ...OBJECT_OUTPUT$c,
       properties: { key: { type: "string" }, updated: { type: "boolean" } },
       required: ["key", "updated"]
     },
@@ -3160,7 +3160,7 @@ function setFileCommand() {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$b,
+      ...OBJECT_OUTPUT$c,
       properties: { key: { type: "string" }, updated: { type: "boolean" } },
       required: ["key", "updated"]
     },
@@ -3197,7 +3197,7 @@ function mutationCommand(options) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$b,
+      ...OBJECT_OUTPUT$c,
       properties: {
         key: { type: "string" },
         [options.resultProperty]: { type: "boolean" }
@@ -4261,6 +4261,74 @@ function validatePermissions(value, label) {
     return raw;
   });
 }
+const BUCKET_POLICIES = ["documents", "app_data", "collected", "ambient", "temp", "cache"];
+function validateBuckets(config, label) {
+  if (config.storage_quota_mib !== void 0) {
+    expectUint(config.storage_quota_mib, `${label}.storage_quota_mib`, Number.MAX_SAFE_INTEGER);
+  }
+  let needsAppPool = false;
+  for (const [name, raw] of Object.entries(expectObject$3(config.buckets ?? {}, `${label}.buckets`))) {
+    const at = `${label}.buckets.${name}`;
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(name) || name === "." || name === "..") {
+      throw invalid("schema", `${at} is not a valid bucket name`);
+    }
+    const bucket = expectObject$3(raw, at);
+    assertKnownFields(
+      bucket,
+      ["kind", "data_policy", "scope", "versioning", "quota_mib", "max_objects", "default_ttl_days", "lifecycle"],
+      at
+    );
+    if (!["data", "object"].includes(String(bucket.kind)))
+      throw invalid("schema", `${at}.kind is data or object`);
+    const policy2 = String(bucket.data_policy);
+    if (!BUCKET_POLICIES.includes(policy2))
+      throw invalid("schema", `${at}.data_policy is invalid`);
+    if (bucket.scope !== void 0 && !["user", "zone"].includes(String(bucket.scope))) {
+      throw invalid("schema", `${at}.scope is user or zone`);
+    }
+    optionalBoolean(bucket.versioning, `${at}.versioning`);
+    const userOwned = policy2 === "documents" || policy2 === "collected";
+    if (bucket.quota_mib !== void 0) {
+      expectUint(bucket.quota_mib, `${at}.quota_mib`, Number.MAX_SAFE_INTEGER);
+      if (userOwned)
+        throw invalid("schema", `${at}: a ${policy2} bucket uses the user's quota`);
+    }
+    if (bucket.max_objects !== void 0)
+      expectUint(bucket.max_objects, `${at}.max_objects`, Number.MAX_SAFE_INTEGER);
+    if (bucket.versioning === true && !["documents", "app_data", "collected"].includes(policy2)) {
+      throw invalid("schema", `${at}: a ${policy2} bucket cannot be versioned`);
+    }
+    if (bucket.default_ttl_days !== void 0) {
+      expectUint(bucket.default_ttl_days, `${at}.default_ttl_days`, 4294967295);
+      if (!["ambient", "temp", "cache"].includes(policy2)) {
+        throw invalid("schema", `${at}: a ${policy2} bucket cannot declare default_ttl_days`);
+      }
+    }
+    if (policy2 === "temp") {
+      const days = bucket.default_ttl_days;
+      if (typeof days !== "number" || days < 1 || days > 30) {
+        throw invalid("schema", `${at}: a temp bucket declares default_ttl_days 1..30`);
+      }
+    }
+    if (bucket.lifecycle !== void 0) {
+      if (!Array.isArray(bucket.lifecycle))
+        throw invalid("schema", `${at}.lifecycle must be an array`);
+      for (const [index, rule] of bucket.lifecycle.entries()) {
+        const kind = String(expectObject$3(rule, `${at}.lifecycle[${index}]`).rule);
+        if (!["expire", "noncurrent_expire", "expired_delete_marker"].includes(kind)) {
+          throw invalid("schema", `${at}.lifecycle[${index}].rule is invalid`);
+        }
+        if (policy2 === "temp" || userOwned && kind !== "noncurrent_expire") {
+          throw invalid("schema", `${at}: a ${policy2} bucket does not accept the ${kind} rule`);
+        }
+      }
+    }
+    needsAppPool ||= policy2 === "app_data" || policy2 === "temp";
+  }
+  if (needsAppPool && config.storage_quota_mib === void 0) {
+    throw invalid("schema", `${label}.storage_quota_mib is required when app_data or temp buckets are declared`);
+  }
+}
 function validateServiceConfigTips(value, label) {
   const config = expectObject$3(value, label);
   for (const field of [
@@ -4375,6 +4443,7 @@ function validateServiceConfigTips(value, label) {
     }
     optionalString$3(database.connection, `${label}.rdb_instances.${name}.connection`);
   }
+  validateBuckets(config, label);
   if (config.instance_volume !== void 0) {
     const volume = expectObject$3(config.instance_volume, `${label}.instance_volume`);
     assertKnownFields(
@@ -5105,7 +5174,7 @@ function validateContentHandlers(value, permissions) {
   }
   return value;
 }
-const PACKAGE_VERSION = "0.7.148";
+const PACKAGE_VERSION = "0.7.149";
 const TOOL_VERSION = PACKAGE_VERSION;
 const SDK_VERSION = PACKAGE_VERSION;
 const PROTOCOL_VERSION = "1";
@@ -5122,7 +5191,7 @@ const VERSION$1 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 const SHA256_ID = /^sha256:[0-9a-f]{64}$/;
 const OBJECT_ID = /^(?:appdoc|pkg):[0-9a-f]{64}$/;
 const SAFE_GENERATED_FILE = /^[A-Za-z0-9._-]+$/;
-const OBJECT_OUTPUT$a = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$b = { type: "object", additionalProperties: true };
 const APP_KINDS = ["static-web", "script", "docker", "agent-skills"];
 const PATH_KINDS = {
   "static-web": { key: "web", category: "web", selectorType: "static" },
@@ -5165,7 +5234,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -5212,7 +5281,7 @@ function createPikgModule(dependencies = {}) {
           },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5237,7 +5306,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5258,7 +5327,7 @@ function createPikgModule(dependencies = {}) {
           properties: { dist_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -5278,7 +5347,7 @@ function createPikgModule(dependencies = {}) {
           required: ["pikg_path"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -5299,7 +5368,7 @@ function createPikgModule(dependencies = {}) {
           properties: { meta_dir: { type: "string", minLength: 1 } },
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$a,
+        outputSchema: OBJECT_OUTPUT$b,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "destructive" },
         asyncMode: "sync",
@@ -6562,7 +6631,7 @@ const CONTROL_PANEL_SERVICE = "control-panel";
 const PLAN_SCHEMA_VERSION = 4;
 const STAGING_RELEASE_TIMEOUT_MS = 5e3;
 const ZIP_LOCAL_MAGIC = [80, 75, 3, 4];
-const OBJECT_OUTPUT$9 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$a = { type: "object", additionalProperties: true };
 const INSTALL_POLICIES = [
   "strict-public",
   "normal",
@@ -6574,7 +6643,7 @@ function createAppModule(dependencies = {}) {
   const commands = [
     fetchCommand(dependencies),
     listCommand$2(),
-    getCommand$2(),
+    getCommand$3(),
     installCommand(dependencies),
     upgradeCommand(dependencies),
     uninstallCommand(dependencies),
@@ -6613,7 +6682,7 @@ function cancelCommand$1() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -6648,7 +6717,7 @@ function fetchCommand(dependencies) {
       target: { type: "object", additionalProperties: true },
       install_params: { type: "object", additionalProperties: true }
     }),
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6665,7 +6734,7 @@ function listCommand$2() {
     verb: "list",
     summary: "List visible installed Apps",
     inputSchema: emptyInputSchema(),
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6674,7 +6743,7 @@ function listCommand$2() {
     handler: async (ctx) => await callControl(ctx, "apps.list", {})
   };
 }
-function getCommand$2() {
+function getCommand$3() {
   return selectorCommand({
     verb: "get",
     summary: "Get installation and runtime details for one App",
@@ -6723,7 +6792,7 @@ function installCommand(dependencies) {
       no_wait: { type: "boolean" },
       policy: { type: "string", enum: [...INSTALL_POLICIES] }
     }),
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -6767,7 +6836,7 @@ function upgradeCommand(dependencies) {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -6896,7 +6965,7 @@ function statusCommand$1() {
       properties: { app_name: { type: "string", minLength: 1 } },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -6967,7 +7036,7 @@ function publishCommand() {
       required: ["local_dir", "app_doc"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -7484,7 +7553,7 @@ async function stagePikg(ctx, snapshot, purpose) {
     throw new ToolError("AUTH_REQUIRED", "authenticated session is required", 3);
   const token = (await session.ensureValid()).token;
   const proxy = ndm_proxy.createNdmProxyClient({
-    endpoint: gatewayOrigin$1(ctx.connection.endpoint),
+    endpoint: gatewayOrigin$2(ctx.connection.endpoint),
     sessionToken: token,
     fetcher: (request, init) => fetch(normalizeNdmRequestUrl(request), { ...init, signal: ctx.signal })
   });
@@ -8021,7 +8090,7 @@ function validatePikgSnapshot(bytes) {
     throw new UsageError("INVALID_PIKG", "PIKG magic mismatch: expected a ZIP container");
   }
 }
-function gatewayOrigin$1(endpoint) {
+function gatewayOrigin$2(endpoint) {
   const url = new URL(endpoint);
   const marker = url.pathname.indexOf("/kapi");
   url.pathname = marker >= 0 ? url.pathname.slice(0, marker) || "/" : "/";
@@ -8093,7 +8162,7 @@ function selectorCommand(options) {
       required: ["app_name"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$9,
+    outputSchema: OBJECT_OUTPUT$a,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: options.access },
     asyncMode: options.asyncMode,
@@ -8257,7 +8326,7 @@ function toHex(bytes) {
   return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 const CONTROL_PANEL$3 = "control-panel";
-const OBJECT_OUTPUT$8 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$9 = { type: "object", additionalProperties: true };
 function createDiagnosticModule(dependencies = {}) {
   return {
     name: "diagnostic",
@@ -8296,7 +8365,7 @@ function collectCommand() {
       required: ["services"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "privileged" },
     asyncMode: "task",
@@ -8350,7 +8419,7 @@ function exportCommand$1(dependencies) {
       required: ["bundle_id", "path"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$8,
+    outputSchema: OBJECT_OUTPUT$9,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "privileged" },
     asyncMode: "sync",
@@ -8392,7 +8461,7 @@ function compact$2(value) {
   return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
 }
 const CONTROL_PANEL$2 = "control-panel";
-const OBJECT_OUTPUT$7 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$8 = { type: "object", additionalProperties: true };
 const LOG_LEVELS = ["error", "warning", "info", "debug", "trace"];
 function createLogModule(dependencies = {}) {
   return {
@@ -8413,7 +8482,7 @@ function servicesCommand() {
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     outputSchema: {
       type: "object",
-      properties: { services: { type: "array", items: OBJECT_OUTPUT$7 } },
+      properties: { services: { type: "array", items: OBJECT_OUTPUT$8 } },
       required: ["services"],
       additionalProperties: false
     },
@@ -8486,7 +8555,7 @@ function tailCommand(dependencies) {
       }
     ],
     inputSchema: filterSchema({ from: { type: "string", enum: ["start", "end"] } }),
-    outputSchema: OBJECT_OUTPUT$7,
+    outputSchema: OBJECT_OUTPUT$8,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "stream",
@@ -8542,7 +8611,7 @@ function exportCommand(dependencies) {
       ...filterSchema({ path: { type: "string", minLength: 1 } }),
       required: ["path"]
     },
-    outputSchema: OBJECT_OUTPUT$7,
+    outputSchema: OBJECT_OUTPUT$8,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -8694,12 +8763,12 @@ function abortableSleep(milliseconds, signal) {
 }
 const TASK_MANAGER = "task-manager";
 const CONTROL_PANEL$1 = "control-panel";
-const OBJECT_OUTPUT$6 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$7 = { type: "object", additionalProperties: true };
 function createTaskModule() {
   return {
     name: "task",
     summary: "Inspect, wait for, cancel, and retry durable Tasks",
-    commands: [listCommand$1(), getCommand$1(), waitCommand(), cancelCommand(), retryCommand()]
+    commands: [listCommand$1(), getCommand$2(), waitCommand(), cancelCommand(), retryCommand()]
   };
 }
 function listCommand$1() {
@@ -8768,7 +8837,7 @@ function listCommand$1() {
     }
   };
 }
-function getCommand$1() {
+function getCommand$2() {
   return {
     verb: "get",
     summary: "Get one Task snapshot and its direct children",
@@ -8797,7 +8866,7 @@ function getCommand$1() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -8838,7 +8907,7 @@ function waitCommand() {
     summary: "Stream changes until a Task becomes terminal",
     positionals: [{ name: "task_id", description: "Opaque Task ID", required: true }],
     inputSchema: taskIdSchema(),
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "stream",
@@ -8889,7 +8958,7 @@ function cancelCommand() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -8932,7 +9001,7 @@ function retryCommand() {
       required: ["task_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$6,
+    outputSchema: OBJECT_OUTPUT$7,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -9006,7 +9075,7 @@ function invalidResponse$1(label) {
   throw new ToolError("INVALID_SERVICE_RESPONSE", `${label} is invalid`, EXIT_INTERNAL);
 }
 const sdk = provisionSdk;
-const OBJECT_OUTPUT$5 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$6 = { type: "object", additionalProperties: true };
 const ROOT_OPTION = {
   name: "root",
   description: "Installed BuckyOS root on this machine (BUCKYOS_ROOT); read by status/check, written by activate",
@@ -9090,7 +9159,7 @@ function statusCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$5,
+      ...OBJECT_OUTPUT$6,
       properties: {
         root: { type: "string" },
         state: {
@@ -9128,7 +9197,7 @@ function checkCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$5,
+      ...OBJECT_OUTPUT$6,
       properties: {
         ready: { type: "boolean" },
         root: { type: "string" },
@@ -9176,7 +9245,7 @@ function activateCommand(deps) {
       additionalProperties: false
     },
     outputSchema: {
-      ...OBJECT_OUTPUT$5,
+      ...OBJECT_OUTPUT$6,
       properties: {
         root: { type: "string" },
         state: { type: "string", enum: ["configured"] },
@@ -9458,7 +9527,7 @@ function inputFingerprint(input) {
   hash.update(new TextEncoder().encode(JSON.stringify(material)));
   return hash.digestHex();
 }
-const OBJECT_OUTPUT$4 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$5 = { type: "object", additionalProperties: true };
 const SKILL_KINDS = ["cmd", "goal"];
 const SKILLS_SUB_PKG = "agent_skills";
 const SKILL_DIRS = ["cmd_skills", "goal_skills", "tools"];
@@ -9495,7 +9564,7 @@ function createSkillModule() {
           required: ["agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$4,
+        outputSchema: OBJECT_OUTPUT$5,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9534,7 +9603,7 @@ function createSkillModule() {
           required: ["pikg_path", "agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$4,
+        outputSchema: OBJECT_OUTPUT$5,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "write" },
         asyncMode: "sync",
@@ -9561,7 +9630,7 @@ function createSkillModule() {
           required: ["name", "agent_id"],
           additionalProperties: false
         },
-        outputSchema: OBJECT_OUTPUT$4,
+        outputSchema: OBJECT_OUTPUT$5,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "destructive" },
         asyncMode: "sync",
@@ -9682,7 +9751,7 @@ function base64(bytes) {
   return btoa(binary);
 }
 const CONTROL_PANEL = "control-panel";
-const OBJECT_OUTPUT$3 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$4 = { type: "object", additionalProperties: true };
 const AGENT_POSITIONAL = {
   name: "agent_id",
   description: "Agent ID as `agent list` prints it (raw host name, e.g. jarvis.example.zone)"
@@ -9706,7 +9775,7 @@ function createAgentModule() {
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
         outputSchema: {
           type: "object",
-          properties: { agents: { type: "array", items: OBJECT_OUTPUT$3 } },
+          properties: { agents: { type: "array", items: OBJECT_OUTPUT$4 } },
           required: ["agents"],
           additionalProperties: false
         },
@@ -9732,7 +9801,7 @@ function createAgentModule() {
         summary: "Get one Agent: profile, settings, install state, template, and runtime",
         positionals: [AGENT_POSITIONAL],
         inputSchema: AGENT_INPUT,
-        outputSchema: OBJECT_OUTPUT$3,
+        outputSchema: OBJECT_OUTPUT$4,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9745,7 +9814,7 @@ function createAgentModule() {
         summary: "Get the public profile (display name, bio, avatar) of an Agent",
         positionals: [AGENT_POSITIONAL],
         inputSchema: AGENT_INPUT,
-        outputSchema: OBJECT_OUTPUT$3,
+        outputSchema: OBJECT_OUTPUT$4,
         resultSchemaVersion: 1,
         access: { mode: "fixed", level: "read" },
         asyncMode: "sync",
@@ -9786,8 +9855,8 @@ function createAgentModule() {
           type: "object",
           properties: {
             agent_id: { type: "string" },
-            before: OBJECT_OUTPUT$3,
-            profile: OBJECT_OUTPUT$3
+            before: OBJECT_OUTPUT$4,
+            profile: OBJECT_OUTPUT$4
           },
           required: ["agent_id", "before", "profile"],
           additionalProperties: false
@@ -9832,7 +9901,7 @@ async function callAgent(ctx, method, params) {
   }
 }
 const AICC = "aicc";
-const OBJECT_OUTPUT$2 = { type: "object", additionalProperties: true };
+const OBJECT_OUTPUT$3 = { type: "object", additionalProperties: true };
 const EMPTY_INPUT = { type: "object", properties: {}, additionalProperties: false };
 const RANGES = ["last1d", "last7d", "last30d"];
 const GROUPS = [
@@ -9880,7 +9949,7 @@ function quotaCommand() {
       properties: { app: { type: "string", minLength: 1 } },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$2,
+    outputSchema: OBJECT_OUTPUT$3,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9898,7 +9967,7 @@ function readCommand$1(options) {
     summary: options.summary,
     description: options.description,
     inputSchema: EMPTY_INPUT,
-    outputSchema: OBJECT_OUTPUT$2,
+    outputSchema: OBJECT_OUTPUT$3,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9950,7 +10019,7 @@ function usageCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$2,
+    outputSchema: OBJECT_OUTPUT$3,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -9995,8 +10064,8 @@ function timeRange(input) {
   }
   return { kind: "explicit", start_time_ms: since, end_time_ms: until ?? Date.now() };
 }
-const OBJECT_OUTPUT$1 = { type: "object", additionalProperties: true };
-const DAY_MS = 864e5;
+const OBJECT_OUTPUT$2 = { type: "object", additionalProperties: true };
+const DAY_MS$1 = 864e5;
 const EXPIRES_HELP = "1d, 7d (default), 30d, none, or an RFC 3339 time";
 function createShareModule() {
   return {
@@ -10005,7 +10074,7 @@ function createShareModule() {
     commands: [
       createCommand(),
       listCommand(),
-      getCommand(),
+      getCommand$1(),
       updateCommand(),
       stopCommand(),
       statsCommand()
@@ -10017,7 +10086,7 @@ async function openNfsp(ctx) {
   if (!session)
     throw new ToolError("AUTH_REQUIRED", "authenticated session is required", 3);
   const token = (await session.ensureValid()).token;
-  const base = gatewayOrigin(ctx.connection.endpoint);
+  const base = gatewayOrigin$1(ctx.connection.endpoint);
   let seq = 0;
   const post = async (method, body) => {
     const response = await fetch(`${base}/nfs/v1/${method}`, {
@@ -10048,7 +10117,7 @@ async function openNfsp(ctx) {
     call: (method, args, write = false) => post(method, { session: sessionId, args: { ...args, source_hint: "cli" }, ...write ? { seq: ++seq } : {} })
   };
 }
-function gatewayOrigin(endpoint) {
+function gatewayOrigin$1(endpoint) {
   const url = new URL(endpoint);
   const marker = url.pathname.indexOf("/kapi");
   url.pathname = marker >= 0 ? url.pathname.slice(0, marker) || "/" : "/";
@@ -10064,7 +10133,7 @@ function parseExpires(value) {
     return null;
   const days = text2.match(/^(\d+)d$/);
   if (days)
-    return Math.floor((Date.now() + Number(days[1]) * DAY_MS) / 1e3);
+    return Math.floor((Date.now() + Number(days[1]) * DAY_MS$1) / 1e3);
   const at = parseTimestamp(value, "expires");
   if (at === void 0)
     return void 0;
@@ -10106,7 +10175,7 @@ function createCommand() {
       required: ["path"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "either",
@@ -10175,7 +10244,7 @@ function listCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10196,7 +10265,7 @@ function listCommand() {
     }
   };
 }
-function getCommand() {
+function getCommand$1() {
   return {
     verb: "get",
     summary: "Show one share: link, policy, snapshot, delivery, statistics and history",
@@ -10207,7 +10276,7 @@ function getCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10244,7 +10313,7 @@ function updateCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "write" },
     asyncMode: "sync",
@@ -10288,7 +10357,7 @@ function stopCommand() {
       required: ["share_id"],
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "destructive" },
     asyncMode: "sync",
@@ -10320,7 +10389,7 @@ function statsCommand() {
       },
       additionalProperties: false
     },
-    outputSchema: OBJECT_OUTPUT$1,
+    outputSchema: OBJECT_OUTPUT$2,
     resultSchemaVersion: 1,
     access: { mode: "fixed", level: "read" },
     asyncMode: "sync",
@@ -10339,6 +10408,396 @@ function statsCommand() {
     }
   };
 }
+const OBJECT_OUTPUT$1 = { type: "object", additionalProperties: true };
+const SERVICE$1 = "nfs-server";
+const MAX_PUT_BYTES = 32 * 1024 * 1024;
+const DAY_MS = 864e5;
+const BUCKET_ERROR_CODES = [
+  "bucket_not_found",
+  "no_such_key",
+  "invalid_key",
+  "invalid_argument",
+  "precondition_failed",
+  "permission_denied",
+  "quota_exceeded",
+  "object_too_large",
+  "content_not_available",
+  "content_evicted",
+  "origin_unavailable",
+  "kind_mismatch",
+  "policy_violation",
+  "origin_required",
+  "not_held",
+  "token_invalid",
+  "conflict",
+  "store_error",
+  "db_error",
+  "internal_error"
+];
+function createBucketModule() {
+  return {
+    name: "bucket",
+    summary: "Read and write application object buckets (key -> object, retained by the Zone)",
+    commands: [lsCommand(), statCommand(), putCommand(), getCommand(), rmCommand(), linkCommand(), s3KeysCommand(), s3KeyCreateCommand(), s3KeyRevokeCommand()]
+  };
+}
+function parseBucketTarget(value, keyRequired) {
+  const path = value.startsWith("obj://bucket/") ? value.slice("obj://bucket/".length) : value;
+  const parts = path.split("/");
+  if (parts.length < 4 || !["user", "zone"].includes(parts[0]) || parts.slice(0, 4).some((p) => !p)) {
+    throw new UsageError("INVALID_ARGUMENT", `'${value}' is not obj://bucket/<scope>/<appid>/<owner>/<name>[/<key>]`);
+  }
+  const key = parts.slice(4).join("/");
+  if (keyRequired && !key)
+    throw new UsageError("INVALID_ARGUMENT", `'${value}' names no key`);
+  return { bucketId: parts.slice(0, 4).join("/"), key };
+}
+async function call$1(ctx, method, params) {
+  try {
+    return await callService(ctx, SERVICE$1, method, params);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = BUCKET_ERROR_CODES.find((c) => message.includes(`${c}: `));
+    if (code)
+      throw new ToolError(`BUCKET_${code.toUpperCase()}`, message);
+    throw error;
+  }
+}
+function gatewayOrigin(endpoint) {
+  const url = new URL(endpoint);
+  const marker = url.pathname.indexOf("/kapi");
+  url.pathname = marker >= 0 ? url.pathname.slice(0, marker) || "/" : "/";
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function objectUrl(ctx, target, query = {}) {
+  const qs = new URLSearchParams(query).toString();
+  const key = target.key.split("/").map(encodeURIComponent).join("/");
+  return `${gatewayOrigin(ctx.connection.endpoint)}/bucket/v1/${target.bucketId}/${key}${qs ? `?${qs}` : ""}`;
+}
+async function bearer(ctx) {
+  if (!ctx.session)
+    throw new ToolError("AUTH_REQUIRED", "authenticated session is required", 3);
+  return { Authorization: `Bearer ${(await ctx.session.ensureValid()).token}` };
+}
+async function failure(response) {
+  let body = {};
+  try {
+    body = await response.json();
+  } catch {
+    throw new ToolError("INVALID_SERVICE_RESPONSE", `bucket data plane answered HTTP ${response.status}`, EXIT_INTERNAL);
+  }
+  throw new ToolError(`BUCKET_${String(body.error ?? response.status).toUpperCase()}`, String(body.message ?? `HTTP ${response.status}`));
+}
+const TARGET = { name: "target", description: "obj://bucket/<scope>/<appid>/<owner>/<name>[/<key>]", required: true };
+function lsCommand() {
+  return {
+    verb: "ls",
+    summary: "List your buckets, or the keys of one bucket",
+    positionals: [{ ...TARGET, required: false }],
+    options: [
+      { name: "delimiter", description: "Fold keys at this delimiter (e.g. /)", type: "string" },
+      { name: "start-after", property: "start_after", description: "Continue after this key", type: "string" },
+      { name: "limit", description: "Page size, at most 1000", type: "integer" },
+      { name: "appid", description: "Only buckets of this app (no target)", type: "string" }
+    ],
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", minLength: 1 },
+        delimiter: { type: "string", minLength: 1 },
+        start_after: { type: "string", minLength: 1 },
+        limit: { type: "integer", minimum: 1 },
+        appid: { type: "string", minLength: 1 }
+      },
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "read" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket ls", "buckyos bucket ls obj://bucket/user/photos/alice/library/2026/ --delimiter /"],
+    handler: async (ctx, input) => {
+      const raw = inputString(input, "target");
+      if (!raw)
+        return { buckets: await call$1(ctx, "bucket.list", { appid: inputString(input, "appid") }) };
+      const target = parseBucketTarget(raw, false);
+      return await call$1(ctx, "bucket.list_objects", {
+        bucket_id: target.bucketId,
+        prefix: target.key,
+        delimiter: inputString(input, "delimiter"),
+        start_after: inputString(input, "start_after"),
+        limit: input.limit
+      });
+    }
+  };
+}
+function statCommand() {
+  return {
+    verb: "stat",
+    summary: "Show a bucket (usage, quota) or a key (binding and where its content is)",
+    positionals: [TARGET],
+    options: [{ name: "version", description: "A specific version of the key", type: "integer" }],
+    inputSchema: {
+      type: "object",
+      properties: { target: { type: "string", minLength: 1 }, version: { type: "integer", minimum: 1 } },
+      required: ["target"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "read" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket stat obj://bucket/user/photos/alice/library", "buckyos bucket stat obj://bucket/user/photos/alice/library/a.jpg"],
+    handler: async (ctx, input) => {
+      const target = parseBucketTarget(requiredInputString(input, "target"), false);
+      if (!target.key) {
+        const [bucket, quota] = await Promise.all([
+          call$1(ctx, "bucket.stat", { bucket_id: target.bucketId }),
+          call$1(ctx, "bucket.get_quota", { bucket_id: target.bucketId })
+        ]);
+        return { bucket, quota };
+      }
+      return await call$1(ctx, "bucket.head", { bucket_id: target.bucketId, key: target.key, version: input.version });
+    }
+  };
+}
+function putCommand() {
+  return {
+    verb: "put",
+    summary: "Store a local file (up to 32 MiB) under a key; success means the Zone retains it",
+    positionals: [TARGET, { name: "file", description: "Local file to upload", required: true }],
+    options: [
+      { name: "content-type", property: "content_type", description: "Content-Type of the object", type: "string" },
+      { name: "if-absent", property: "if_absent", description: "Fail if the key already exists", type: "boolean" },
+      { name: "expires", description: "Unbind after: 1d, 7d, or an RFC 3339 time (temp/cache/app_data buckets)", type: "string" }
+    ],
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", minLength: 1 },
+        file: { type: "string", minLength: 1 },
+        content_type: { type: "string", minLength: 1 },
+        if_absent: { type: "boolean" },
+        expires: { type: "string", minLength: 1 }
+      },
+      required: ["target", "file"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    networkAccess: true,
+    examples: ["buckyos bucket put obj://bucket/user/photos/alice/library/2026/a.jpg ./a.jpg --content-type image/jpeg"],
+    handler: async (ctx, input) => {
+      const target = parseBucketTarget(requiredInputString(input, "target"), true);
+      const bytes = await getHost().readFile(requiredInputString(input, "file"));
+      if (bytes.byteLength > MAX_PUT_BYTES) {
+        throw new UsageError("FILE_TOO_LARGE", "files over 32 MiB go through the SDK upload (ndm.startUpload with bind)");
+      }
+      const headers = { ...await bearer(ctx) };
+      const contentType = inputString(input, "content_type");
+      if (contentType)
+        headers["Content-Type"] = contentType;
+      if (input.if_absent === true)
+        headers["If-None-Match"] = "*";
+      const expires = inputString(input, "expires");
+      if (expires) {
+        const days = expires.match(/^(\d+)d$/);
+        const at = days ? Date.now() + Number(days[1]) * DAY_MS : parseTimestamp(expires, "expires");
+        if (at !== void 0)
+          headers["x-bucky-expires-at"] = String(at);
+      }
+      const response = await fetch(objectUrl(ctx, target), { method: "PUT", headers, body: new Blob([bytes]), signal: ctx.signal });
+      if (!response.ok)
+        await failure(response);
+      return await response.json();
+    }
+  };
+}
+function getCommand() {
+  return {
+    verb: "get",
+    summary: "Download a key to a local file",
+    positionals: [TARGET, { name: "output", description: "Local file to write", required: true }],
+    options: [{ name: "version", description: "A specific version of the key", type: "integer" }],
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", minLength: 1 },
+        output: { type: "string", minLength: 1 },
+        version: { type: "integer", minimum: 1 }
+      },
+      required: ["target", "output"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "read" },
+    asyncMode: "sync",
+    requiresSession: true,
+    networkAccess: true,
+    examples: ["buckyos bucket get obj://bucket/user/photos/alice/library/2026/a.jpg ./a.jpg"],
+    handler: async (ctx, input) => {
+      const target = parseBucketTarget(requiredInputString(input, "target"), true);
+      const query = input.version !== void 0 ? { version: String(input.version) } : {};
+      const response = await fetch(objectUrl(ctx, target, query), { headers: await bearer(ctx), signal: ctx.signal });
+      if (!response.ok)
+        await failure(response);
+      const bytes = new Uint8Array(await response.arrayBuffer());
+      const output = requiredInputString(input, "output");
+      await getHost().writeFile(output, bytes);
+      return {
+        output,
+        size: bytes.byteLength,
+        obj_id: response.headers.get("x-bucky-obj-id"),
+        version: Number(response.headers.get("x-bucky-version")),
+        content_type: response.headers.get("content-type")
+      };
+    }
+  };
+}
+function rmCommand() {
+  return {
+    verb: "rm",
+    summary: "Unbind a key (the bucket stops retaining its content)",
+    positionals: [TARGET],
+    options: [{ name: "version", description: "Remove only this version", type: "integer" }],
+    inputSchema: {
+      type: "object",
+      properties: { target: { type: "string", minLength: 1 }, version: { type: "integer", minimum: 1 } },
+      required: ["target"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket rm obj://bucket/user/photos/alice/library/2026/a.jpg"],
+    handler: async (ctx, input) => {
+      const target = parseBucketTarget(requiredInputString(input, "target"), true);
+      return await call$1(ctx, "bucket.delete", { bucket_id: target.bucketId, key: target.key, version: input.version });
+    }
+  };
+}
+function linkCommand() {
+  return {
+    verb: "link",
+    summary: "Create a revocable read link to one key (up to 7 days, no Zone account needed)",
+    positionals: [TARGET],
+    options: [
+      { name: "expires", description: "1d (default) to 7d, or an RFC 3339 time", type: "string" },
+      { name: "max-uses", property: "max_uses", description: "Stop after this many reads", type: "integer" }
+    ],
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", minLength: 1 },
+        expires: { type: "string", minLength: 1 },
+        max_uses: { type: "integer", minimum: 1 }
+      },
+      required: ["target"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket link obj://bucket/user/photos/alice/library/2026/a.jpg --expires 3d"],
+    handler: async (ctx, input) => {
+      const target = parseBucketTarget(requiredInputString(input, "target"), true);
+      const text2 = inputString(input, "expires") ?? "1d";
+      const days = text2.match(/^(\d+)d$/);
+      const expiresAt = days ? Date.now() + Number(days[1]) * DAY_MS : parseTimestamp(text2, "expires");
+      if (expiresAt === void 0)
+        throw new UsageError("INVALID_ARGUMENT", "expires is required");
+      const issued = await call$1(ctx, "bucket.create_access_token", {
+        bucket_id: target.bucketId,
+        key: target.key,
+        actions: ["read"],
+        expires_at: expiresAt,
+        max_uses: input.max_uses
+      });
+      return { ...issued, url: `${gatewayOrigin(ctx.connection.endpoint)}${String(issued.path)}` };
+    }
+  };
+}
+function s3KeysCommand() {
+  return {
+    verb: "s3-keys",
+    summary: "List your S3 access keys (secrets are shown only when created)",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "read" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket s3-keys"],
+    handler: async (ctx) => ({ keys: await call$1(ctx, "bucket.list_s3_keys", {}) })
+  };
+}
+function s3KeyCreateCommand() {
+  return {
+    verb: "s3-key-create",
+    summary: "Issue an S3 access key for one of your apps (endpoint https://<zone>/s3 or https://s3.<zone>)",
+    options: [
+      { name: "app", description: "App id whose buckets the key reaches", type: "string" },
+      { name: "prefix", description: "Only keys under this prefix", type: "string" },
+      { name: "expires", description: "Expiry: 30d, or an RFC 3339 time (default: none)", type: "string" }
+    ],
+    inputSchema: {
+      type: "object",
+      properties: { app: { type: "string", minLength: 1 }, prefix: { type: "string", minLength: 1 }, expires: { type: "string", minLength: 1 } },
+      required: ["app"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket s3-key-create --app photos.app.bns.did --expires 30d"],
+    handler: async (ctx, input) => {
+      const text2 = inputString(input, "expires");
+      const days = text2?.match(/^(\d+)d$/);
+      const expiresAt = !text2 ? void 0 : days ? Date.now() + Number(days[1]) * DAY_MS : parseTimestamp(text2, "expires");
+      const prefix = inputString(input, "prefix");
+      const key = await call$1(ctx, "bucket.create_s3_key", {
+        appid: requiredInputString(input, "app"),
+        scope: prefix ? { prefix } : void 0,
+        expires_at: expiresAt
+      });
+      return { ...key, endpoint: `${gatewayOrigin(ctx.connection.endpoint)}/s3`, region: "us-east-1", path_style: true };
+    }
+  };
+}
+function s3KeyRevokeCommand() {
+  return {
+    verb: "s3-key-revoke",
+    summary: "Revoke an S3 access key (its presigned URLs stop working too)",
+    positionals: [{ name: "access_key_id", description: "Access key id (BK…)", required: true }],
+    inputSchema: {
+      type: "object",
+      properties: { access_key_id: { type: "string", minLength: 1 } },
+      required: ["access_key_id"],
+      additionalProperties: false
+    },
+    outputSchema: OBJECT_OUTPUT$1,
+    resultSchemaVersion: 1,
+    access: { mode: "fixed", level: "write" },
+    asyncMode: "sync",
+    requiresSession: true,
+    examples: ["buckyos bucket s3-key-revoke BKABCDEFGHIJKLMNOPQR"],
+    handler: async (ctx, input) => await call$1(ctx, "bucket.revoke_s3_key", { access_key_id: requiredInputString(input, "access_key_id") })
+  };
+}
 const text = { type: "string", minLength: 1 };
 const object = { type: "object", additionalProperties: true };
 const targetProperties = {
@@ -11125,6 +11584,7 @@ function createRegistry(pikgDependencies, appDependencies, logDependencies, diag
   registry.register(createAgentModule());
   registry.register(createAiModule());
   registry.register(createShareModule());
+  registry.register(createBucketModule());
   registry.register(createExecutorModule());
   registry.register(createAiwsModule());
   return registry;