huaweicloud-devkit 1.0.2-dev.8 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-iam/references/quick-ref.md

@@ -1,56 +1,56 @@
-# IAM Quick Reference
-
-## Common Operations
-
-```bash
-hcloud IAM KeystoneListProjects                  # list projects
-hcloud IAM KeystoneListUsers                     # list users
-hcloud IAM KeystoneListGroups                    # list groups
-hcloud IAM ListCustomPolicies                    # list custom policies
-hcloud IAM ListAgencies                          # list agencies
-hcloud IAM KeystoneListAuthDomains               # list domains
-hcloud IAM KeystoneShowUser                      # show user detail
-```
-
-## Credential Management
-
-```bash
-hcloud IAM KeystoneListAccessKeys --user_id=<id> # list AK/SK for user
-hcloud IAM CreateLoginToken                      # create login token
-hcloud IAM GetAccountSummary                     # account summary
-```
-
-## Security Best Practices
-
-1. **NEVER create IAM users** — use IAM Identity Center or temporary STS tokens
-2. **NEVER create long-term AK/SK** — use temporary credentials
-3. **Least privilege by default** — start empty, add only needed actions
-4. **Scope resources** — no `*` wildcards on Resource
-5. **Use condition keys** — `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime`
-6. **Rotate AK/SK every 90 days** — or use agency delegation
-
-## IAM vs AWS Comparison
-
-| AWS | Huawei Cloud |
-|-----|-------------|
-| `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
-| AWS Managed Policy | System Policy (系统策略) |
-| Customer Managed | Custom Policy (自定义策略) |
-| Resource-Based Policy | Project-Level Policy (项目级策略) |
-| IAM Role | Agency (委托) |
-
-> Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
-
-## Confused Deputy Protection
-
-```json
-{
-  "Effect": "Allow",
-  "Action": ["ecs:*"],
-  "Resource": ["*"],
-  "Condition": {
-    "StringEquals": {"g:SourceAccount": "<account-id>"},
-    "StringLike": {"g:SourceUrn": "urn:fss:*"}
-  }
-}
-```
+# IAM Quick Reference
+
+## Common Operations
+
+```bash
+hcloud IAM KeystoneListProjects                  # list projects
+hcloud IAM KeystoneListUsers                     # list users
+hcloud IAM KeystoneListGroups                    # list groups
+hcloud IAM ListCustomPolicies                    # list custom policies
+hcloud IAM ListAgencies                          # list agencies
+hcloud IAM KeystoneListAuthDomains               # list domains
+hcloud IAM KeystoneShowUser                      # show user detail
+```
+
+## Credential Management
+
+```bash
+hcloud IAM KeystoneListAccessKeys --user_id=<id> # list AK/SK for user
+hcloud IAM CreateLoginToken                      # create login token
+hcloud IAM GetAccountSummary                     # account summary
+```
+
+## Security Best Practices
+
+1. **NEVER create IAM users** — use IAM Identity Center or temporary STS tokens
+2. **NEVER create long-term AK/SK** — use temporary credentials
+3. **Least privilege by default** — start empty, add only needed actions
+4. **Scope resources** — no `*` wildcards on Resource
+5. **Use condition keys** — `g:RequestedRegion`, `g:ResourceTag`, `g:CurrentTime`
+6. **Rotate AK/SK every 90 days** — or use agency delegation
+
+## IAM vs AWS Comparison
+
+| AWS | Huawei Cloud |
+|-----|-------------|
+| `iam:ListUsers` | `iam:users:list` (lowercase + colon) |
+| AWS Managed Policy | System Policy (系统策略) |
+| Customer Managed | Custom Policy (自定义策略) |
+| Resource-Based Policy | Project-Level Policy (项目级策略) |
+| IAM Role | Agency (委托) |
+
+> Huawei Cloud IAM action naming: `<service>:<resource>:<action>`. Always verify at https://support.huaweicloud.com/usermanual-iam/iam_01_0001.html
+
+## Confused Deputy Protection
+
+```json
+{
+  "Effect": "Allow",
+  "Action": ["ecs:*"],
+  "Resource": ["*"],
+  "Condition": {
+    "StringEquals": {"g:SourceAccount": "<account-id>"},
+    "StringLike": {"g:SourceUrn": "urn:fss:*"}
+  }
+}
+```

package/plugins/huaweicloud-core/skills/huawei-modelarts/SKILL.md

@@ -1,65 +1,65 @@
----
-name: huawei-modelarts
-description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
-version: 1
----
-
-# Huawei Cloud ModelArts
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud ModelArts <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for ModelArts. Covers training jobs, model deployment, notebook instances, and OBS integration.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
-| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
-| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
-| Model deployment needs quota | Online services may require service quota approval in new accounts |
-| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
-
-## Prerequisites
-
-- Training data must be stored in an OBS bucket (see `huawei-obs`)
-- Output path for trained models must be an OBS path
-- Notebook instances need a VPC/subnet (see `huawei-vpc`)
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List models | `ListModels --cli-region=<r> --project_id=<p>` |
-| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
-| List services | `ListServices --cli-region=<r> --project_id=<p>` |
-| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
-| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
-| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
-
-Discover operation parameters with `--help` before executing any write operation.
-
-## Service Types
-
-| Type | Purpose |
-|------|---------|
-| Training Job | Train models on GPU/CPU resources |
-| Model | Register trained models for deployment |
-| Service (Online) | Deploy models as REST API endpoints |
-| Notebook | JupyterLab environments for development |
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| OBS path not found | Verify OBS bucket exists and path is correct |
-| Training job fails | Check training data format, resource quotas, and logs in console |
-
-## Cross-Skill References
-
-- **OBS storage**: See `huawei-obs` for bucket and training data management
-- **VPC/Subnet**: See `huawei-vpc` for notebook network configuration
+---
+name: huawei-modelarts
+description: "Use when training, deploying, or managing AI/ML models on Huawei Cloud ModelArts. Covers training jobs, model registry, online services, notebook instances. Triggers: ModelArts, model training, AI, machine learning, deep learning, notebook, inference, deployment. NOT for: general AI/ML concepts, non-Huawei platforms."
+version: 1
+---
+
+# Huawei Cloud ModelArts
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud ModelArts <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for ModelArts. Covers training jobs, model deployment, notebook instances, and OBS integration.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| OBS bucket required | All training data, model outputs, and notebook storage use OBS. Create bucket first |
+| Training charges by duration | Pay-per-minute GPU/CPU billing. Stop unused notebooks and services |
+| Notebook auto-stop needed | Default no auto-stop — can run indefinitely and incur charges |
+| Model deployment needs quota | Online services may require service quota approval in new accounts |
+| Training job output must be OBS | Local output not supported. Ensure `--output_path` is a valid OBS path |
+
+## Prerequisites
+
+- Training data must be stored in an OBS bucket (see `huawei-obs`)
+- Output path for trained models must be an OBS path
+- Notebook instances need a VPC/subnet (see `huawei-vpc`)
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List models | `ListModels --cli-region=<r> --project_id=<p>` |
+| List training jobs | `ListTrainJobs --cli-region=<r> --project_id=<p>` |
+| List services | `ListServices --cli-region=<r> --project_id=<p>` |
+| List notebooks | `ListNotebooks --cli-region=<r> --project_id=<p>` |
+| Create model | `CreateModel --cli-region=<r> --project_id=<p>` |
+| Create notebook | `CreateNotebook --cli-region=<r> --project_id=<p>` |
+
+Discover operation parameters with `--help` before executing any write operation.
+
+## Service Types
+
+| Type | Purpose |
+|------|---------|
+| Training Job | Train models on GPU/CPU resources |
+| Model | Register trained models for deployment |
+| Service (Online) | Deploy models as REST API endpoints |
+| Notebook | JupyterLab environments for development |
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| OBS path not found | Verify OBS bucket exists and path is correct |
+| Training job fails | Check training data format, resource quotas, and logs in console |
+
+## Cross-Skill References
+
+- **OBS storage**: See `huawei-obs` for bucket and training data management
+- **VPC/Subnet**: See `huawei-vpc` for notebook network configuration

package/plugins/huaweicloud-core/skills/huawei-obs/SKILL.md

@@ -1,127 +1,133 @@
----
-name: huawei-obs
-description: "Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr)."
-version: 1
----
-
-# Huawei Cloud OBS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-## Critical: OBS Command Syntax
-
-KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:
-
-```bash
-hcloud OBS help           # NOT --help
-hcloud OBS help <command> # e.g. hcloud OBS help mb
-```
-
-| Wrong (API-style) | Correct (obsutil-style) |
-|-------------------|-------------------------|
-| `OBS CreateBucket` | `OBS mb obs://<bucket>` |
-| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |
-| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |
-
-## Overview
-
-Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/object lifecycle, access control, static website hosting, and presigned URLs.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
-| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
-| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
-| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
-| Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
-| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |
-| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
-| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
-
-## OBS Credential Setup (Required Before First Use)
-
-KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.
-
-**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
-
-**CLI fallback** (if MCP tools unavailable):
-
-```bash
-hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
-```
-
-> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
-
-## Common Workflows
-
-| Task | Command |
-|------|---------|
-| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |
-| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |
-| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |
-| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |
-| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |
-| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |
-| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |
-| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |
-| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
-| Set CORS | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>` |
-| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |
-| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |
-| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |
-
-## Static Website Deployment Workflow
-
-See `references/static-website.md` for the full end-to-end workflow:
-Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
-
-> KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
-
-## Single-File Quick Share
-
-See `references/single-file-share.md` for the full workflow to host one file and get a shareable link in seconds:
-
-- **Private, time-limited**: `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` (max 7 days)
-- **Public, permanent**: `hcloud OBS cp <file> obs://<bucket>/<key> -f` + `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`, then share `https://<bucket>.obs.<region>.myhuaweicloud.com/<key>`
-
-## Storage Classes
-
-| Class | Use Case | Min Storage | Retrieval Fee |
-|-------|----------|-------------|---------------|
-| STANDARD | Frequently accessed | None | No |
-| STANDARD_IA | Infrequent access | 30 days | Yes |
-| ARCHIVE | Long-term archive | 90 days | Yes (hours) |
-
-## Troubleshooting
-
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
-| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
-| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
-| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
-| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
-| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |
-
-## Security Considerations
-
-- MUST block public access by default
-- MUST use HTTPS-only for buckets
-- SHOULD enable access logging for audit
-- SHOULD rotate presigned URL expiry (max 7 days)
-- MUST NOT store AK/SK in bucket policies
-
-## Cross-Skill References
-
-- **EIP**: See `huawei-vpc` for public network access
-- **DEW**: See `huawei-dew` for secret management
-
-## References
-
-- OBS Docs: https://support.huaweicloud.com/obs/
-- Static website: references/static-website.md
-- Single-file share: references/single-file-share.md
-- Lifecycle: references/bucket-lifecycle.md
-- Replication: references/replication.md
+---
+name: huawei-obs
+description: "Use when creating, configuring, or managing OBS buckets and objects on Huawei Cloud. Covers bucket creation, lifecycle policies, versioning, static website hosting, CORS, access control (IAM/bucket policy/ACL), cross-region replication, event notifications, and presigned URLs. Triggers on: OBS, bucket, object storage, lifecycle, versioning, static website, CORS, presigned, replication. NOT for: EVS block storage (use huawei-ecs), SFS file storage, CBR backup (use huawei-cbr)."
+version: 1
+---
+
+# Huawei Cloud OBS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+## Routing Guard: Deploy vs Store
+
+- If the developer's goal is to **deploy, host, or preview a web app / static website** (temporary hosting, quick preview), do NOT default to OBS. Present deployment-target options with the sandbox first: ① huawei-sandbox (recommended), ② OBS static hosting, ③ ECS, ④ CCE. Ask: "建议优先部署到沙箱（临时运行环境，可预览访问），也可选 OBS 静态托管/ECS/CCE，你想部署到哪里？"
+- Proceed with OBS only when the developer selects OBS, explicitly asks for OBS, or the intent is long-term static hosting / CDN / file storage.
+- OBS is a storage service; it is not a general web-hosting default.
+
+## Critical: OBS Command Syntax
+
+KooCLI OBS uses **obsutil-style** commands, NOT API-style operations. Always run `hcloud OBS help` (no `--`) before constructing commands:
+
+```bash
+hcloud OBS help           # NOT --help
+hcloud OBS help <command> # e.g. hcloud OBS help mb
+```
+
+| Wrong (API-style) | Correct (obsutil-style) |
+|-------------------|-------------------------|
+| `OBS CreateBucket` | `OBS mb obs://<bucket>` |
+| `OBS PutObject` | `OBS cp <file> obs://<bucket>/` |
+| `OBS DeleteBucket` | `OBS rm obs://<bucket> -r` |
+
+## Overview
+
+Domain expertise for Huawei Cloud Object Storage Service (OBS). Covers bucket/object lifecycle, access control, static website hosting, and presigned URLs.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Bucket name is global | All users share bucket namespace. Always use a unique name: `{prefix}-{timestamp}` (e.g. `mybucket-20260810155048`) |
+| Three-layer permissions | IAM > Bucket Policy > ACL. Most restrictive wins |
+| Versioning is irreversible | Once enabled, cannot be disabled, only suspended |
+| OBS uses AK/SK directly | NOT IAM tokens. Auth errors mean check AK/SK validity |
+| Static website via CLI missing | KooCLI OBS lacks website config. Use REST API or console |
+| **OBS needs separate cred config** | `hcloud configure` is NOT enough for OBS. Before any OBS operation, call `huaweicloud_setup_obs_config` to sync credentials from hcloud profile. |
+| **obsutil interactive prompts** | `cp`/`rm` without `-f` causes "Please input (y/n)" → Agent hangs (TIMEOUT). Always use `-f` for non-interactive. |
+| **Directory upload adds prefix** | `cp <dir>/ obs://<bucket>/ -r` puts files under `bucket/<dir>/...`. Use `-flat` for root-level files (static sites). Preview with `-dryRun` first. |
+
+## OBS Credential Setup (Required Before First Use)
+
+KooCLI OBS uses a separate config file (`~/.obsutilconfig`), NOT `~/.hcloud/config.json`. All OBS commands fail with credential errors until this is configured.
+
+**In-session bootstrap (recommended)**: Call `huaweicloud_setup_obs_config` — it syncs AK/SK from the active hcloud profile automatically. No manual key entry needed. Run this once per session before any OBS command.
+
+**CLI fallback** (if MCP tools unavailable):
+
+```bash
+hcloud OBS config -e=<endpoint> -i=<AK> -k=<SK> -t=token
+```
+
+> `huaweicloud_setup_obs_config` should be called at the start of every OBS task — never assume credentials are pre-configured from a previous session.
+
+## Common Workflows
+
+| Task | Command |
+|------|---------|
+| Create bucket | `hcloud OBS mb obs://<bucket> -location=<region>` |
+| List buckets/objects | `hcloud OBS ls [obs://<bucket>]` |
+| Upload file | `hcloud OBS cp <file> obs://<bucket>/<key>` |
+| Upload directory (recursive) | `hcloud OBS cp <dir>/ obs://<bucket>/ -r -f -flat` |
+| Download object | `hcloud OBS cp obs://<bucket>/<key> <local-path>` |
+| Set bucket ACL | `hcloud OBS chattri obs://<bucket> -acl=public-read` |
+| Set object ACL | `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read` | Bucket ACL does NOT cascade — anonymous reads need both |
+| Set lifecycle | `hcloud OBS lifecycle obs://<bucket> -method=put -localfile=<json>` |
+| Set bucket policy | `hcloud OBS bucketpolicy obs://<bucket> -method=put -localfile=<json>` |
+| Set CORS | `hcloud OBS cors obs://<bucket> -method=put -localfile=<json>` |
+| Delete bucket | `hcloud OBS rm obs://<bucket> -r` (must be empty) |
+| Presigned URL | `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` |
+| Object metadata | `hcloud OBS stat obs://<bucket>/<key>` |
+
+## Static Website Deployment Workflow
+
+See `references/static-website.md` for the full end-to-end workflow:
+Build → Create bucket → Upload → Set bucket ACL → Set object ACL → Configure website (REST API/console)
+
+> KooCLI OBS does NOT support `SetBucketWebsite`. Configure static website hosting via REST API (`PUT /?website`) or the Huawei Cloud console.
+
+## Single-File Quick Share
+
+See `references/single-file-share.md` for the full workflow to host one file and get a shareable link in seconds:
+
+- **Private, time-limited**: `hcloud OBS sign obs://<bucket>/<key> -e=<seconds>` (max 7 days)
+- **Public, permanent**: `hcloud OBS cp <file> obs://<bucket>/<key> -f` + `hcloud OBS chattri obs://<bucket>/<key> -acl=public-read`, then share `https://<bucket>.obs.<region>.myhuaweicloud.com/<key>`
+
+## Storage Classes
+
+| Class | Use Case | Min Storage | Retrieval Fee |
+|-------|----------|-------------|---------------|
+| STANDARD | Frequently accessed | None | No |
+| STANDARD_IA | Infrequent access | 30 days | Yes |
+| ARCHIVE | Long-term archive | 90 days | Yes (hours) |
+
+## Troubleshooting
+
+| Error | Root Cause -> Fix |
+|-------|------------------|
+| AccessDenied on bucket | IAM/bucket policy/ACL conflict -> Check all three layers |
+| BucketAlreadyExists | Name taken globally -> Generate unique name with timestamp suffix: `{prefix}-{yyyymmddHHMMSS}` |
+| NoSuchKey | Object doesn't exist or wrong region -> Verify key and region |
+| InvalidAccessKeyId | OBS uses AK/SK directly -> Verify AK/SK validity, OBS endpoint, OBS permissions |
+| EntityTooLarge | Single PUT limit 5GB -> Use multipart upload |
+| OBS --help fails | KooCLI OBS uses `help` not `--help` -> Run `hcloud OBS help` |
+
+## Security Considerations
+
+- MUST block public access by default
+- MUST use HTTPS-only for buckets
+- SHOULD enable access logging for audit
+- SHOULD rotate presigned URL expiry (max 7 days)
+- MUST NOT store AK/SK in bucket policies
+
+## Cross-Skill References
+
+- **EIP**: See `huawei-vpc` for public network access
+- **DEW**: See `huawei-dew` for secret management
+
+## References
+
+- OBS Docs: https://support.huaweicloud.com/obs/
+- Static website: references/static-website.md
+- Single-file share: references/single-file-share.md
+- Lifecycle: references/bucket-lifecycle.md
+- Replication: references/replication.md

package/plugins/huaweicloud-core/skills/huawei-obs/references/bucket-create.md

@@ -1,49 +1,49 @@
-# OBS Bucket Creation Reference
-
-From Huawei Cloud marketplace best practices.
-
-## Naming Rules
-
-| Rule | Detail |
-|------|--------|
-| Length | 3-63 characters |
-| Characters | Lowercase letters, numbers, `-`, `.` |
-| No IP format | Cannot be IP address pattern |
-| No leading/trailing `-` or `.` | Start and end must be alphanumeric |
-| No `..` | Adjacent dots forbidden |
-| No `-.` or `.-` | Adjacent dot-hyphen combos forbidden |
-
-## Create Bucket
-
-```bash
-hcloud OBS mb obs://<bucket> [-acl=xxx] [-location=<r>] [-sc=xxx]
-```
-
-| Option | Values | Default |
-|--------|--------|---------|
-| `-acl` | private, public-read, public-read-write | private |
-| `-location` | cn-south-1, cn-north-4, ... | config default |
-| `-sc` | standard, warm, cold, deep-archive | standard |
-
-## Quick Verify
-
-```bash
-hcloud OBS ls
-hcloud OBS stat obs://<bucket>
-```
-
-## Storage Class Guide
-
-| Class | Access Frequency | Min Storage | Retrieval Cost |
-|-------|-----------------|-------------|----------------|
-| standard | Frequent | None | No |
-| warm | Infrequent | 30 days | Yes |
-| cold | Rare | 90 days | Yes |
-| deep-archive | Archive | 180 days | Yes |
-
-## Critical Rules
-
-- Bucket name is globally unique — test with `hcloud OBS stat` before creating
-- Region is immutable after creation
-- ACL does NOT cascade to objects — set both bucket-level and object-level access
-- OBS uses separate credentials (`~/.obsutilconfig`, configure via `hcloud OBS config -i`)
+# OBS Bucket Creation Reference
+
+From Huawei Cloud marketplace best practices.
+
+## Naming Rules
+
+| Rule | Detail |
+|------|--------|
+| Length | 3-63 characters |
+| Characters | Lowercase letters, numbers, `-`, `.` |
+| No IP format | Cannot be IP address pattern |
+| No leading/trailing `-` or `.` | Start and end must be alphanumeric |
+| No `..` | Adjacent dots forbidden |
+| No `-.` or `.-` | Adjacent dot-hyphen combos forbidden |
+
+## Create Bucket
+
+```bash
+hcloud OBS mb obs://<bucket> [-acl=xxx] [-location=<r>] [-sc=xxx]
+```
+
+| Option | Values | Default |
+|--------|--------|---------|
+| `-acl` | private, public-read, public-read-write | private |
+| `-location` | cn-south-1, cn-north-4, ... | config default |
+| `-sc` | standard, warm, cold, deep-archive | standard |
+
+## Quick Verify
+
+```bash
+hcloud OBS ls
+hcloud OBS stat obs://<bucket>
+```
+
+## Storage Class Guide
+
+| Class | Access Frequency | Min Storage | Retrieval Cost |
+|-------|-----------------|-------------|----------------|
+| standard | Frequent | None | No |
+| warm | Infrequent | 30 days | Yes |
+| cold | Rare | 90 days | Yes |
+| deep-archive | Archive | 180 days | Yes |
+
+## Critical Rules
+
+- Bucket name is globally unique — test with `hcloud OBS stat` before creating
+- Region is immutable after creation
+- ACL does NOT cascade to objects — set both bucket-level and object-level access
+- OBS uses separate credentials (`~/.obsutilconfig`, configure via `hcloud OBS config -i`)