fix(bucket-tenants): make tenant lifecycle and bucket import validation safer

readme.md

@@ -271,7 +271,7 @@ const tenants = await storage.listBucketTenants();
 - `createBucketTenant()` creates the bucket if needed and stores a scoped credential for that bucket.
 - `rotateBucketTenantCredentials()` replaces the active scoped credential for the bucket and persists the new credential.
 - `deleteBucketTenant({ bucketName, accessKeyId })` revokes one scoped credential and keeps the bucket.
-- `deleteBucketTenant({ bucketName })` revokes scoped credentials for the bucket and deletes the bucket contents recursively.
+- `deleteBucketTenant({ bucketName })` revokes scoped credentials for an existing tenant bucket and deletes that bucket's contents recursively.
 - Tenant credentials can list, read, write, and delete objects in their assigned bucket, but cannot list all buckets, access other buckets, copy from other buckets, delete buckets, or mutate bucket policies.
 - Bucket tenant APIs require `auth.enabled: true`.
 
@@ -283,7 +283,7 @@ await storage.importBucket({ bucketName: 'workapp-123-restore', source: appBacku
 ```
 
 - `exportBucket()` returns a self-contained `smartstorage.bucket.v1` JSON export with only the selected bucket's objects and object metadata.
-- `importBucket()` creates the target bucket if needed and restores the exported objects into that bucket.
+- `importBucket()` validates object payload size and MD5 before creating the target bucket if needed, then restores the exported objects into that bucket.
 - Exports do not include credentials, policies, or unrelated tenant data.
 
 ## Health and Metrics APIs
@@ -645,7 +645,7 @@ Create a bucket tenant with a generated or supplied scoped credential. Options:
 
 #### `deleteBucketTenant(options): Promise<void>`
 
-Revoke a tenant credential or delete the full tenant bucket. Options: `{ bucketName, accessKeyId? }`.
+Revoke a tenant credential or delete a bucket that still has tenant credentials. Options: `{ bucketName, accessKeyId? }`.
 
 #### `rotateBucketTenantCredentials(options): Promise<IBucketTenantDescriptor>`
 
@@ -665,7 +665,7 @@ Export one bucket's objects and metadata into a `smartstorage.bucket.v1` JSON ob
 
 #### `importBucket(options): Promise<void>`
 
-Import a `smartstorage.bucket.v1` JSON object into the target bucket. Options: `{ bucketName, source }`.
+Import a `smartstorage.bucket.v1` JSON object into the target bucket after validating object size and MD5. Options: `{ bucketName, source }`.
 
 #### `getStorageDescriptor(options?): Promise<IS3Descriptor>`
 
@@ -687,9 +687,9 @@ Read cached logical bucket and object totals from the Rust runtime without issui
 
 Get per-bucket logical object counts and total payload sizes.
 
-#### `listCredentials(): Promise<IStorageCredential[]>`
+#### `listCredentials(): Promise<IStorageCredentialMetadata[]>`
 
-Return the currently active runtime credential set.
+Return metadata for the currently active runtime credential set without `secretAccessKey` values.
 
 #### `replaceCredentials(credentials: IStorageCredential[]): Promise<void>`