Private files on R2

For agents: Read the complete native guide and current context.get capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

Declare a logical private R2 bucket in wrangler.jsonc and access it through the native Worker binding. Buckets are separate for the selected app environment. There is no public bucket, r2.dev address or user-visible S3 credential in this native profile.

Generate immutable object keys on the server. Track ownership and completion metadata in D1, and authorize reads, lists and deletes before touching an object. A visitor-supplied filename is display metadata, not an object key or filesystem path.

Bound upload bytes and time; stream bodies instead of buffering an unbounded file. An interrupted upload must stay unresolved until exact object state is confirmed. Download private content with safe disposition and private/no-store caching. The native-notes reference demonstrates per-user attachments and cross-user denial.

Ordinary code redeploys retain the existing bucket and objects. Stopping execution does not delete files. Protected recovery has explicit object/count/size limits and can report partial or unavailable recovery; never promise completeness without its receipt.