@rubytech/create-maxy-code 0.1.444 → 0.1.445

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -0,0 +1,73 @@
+// The only place the account-wide Cloudflare credential is used to touch
+// Cloudflare. Every method injects the house token into the child env and shells
+// wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
+
+import { execFile } from "node:child_process";
+import type { HouseCredential } from "./house-credential.js";
+
+export type RunFn = (
+  cmd: string,
+  args: string[],
+  env: Record<string, string>,
+) => Promise<{ stdout: string }>;
+
+export interface CfExec {
+  d1List(): Promise<{ name: string; uuid: string }[]>;
+  d1Create(name: string): Promise<{ uuid: string }>;
+  d1Query(name: string, sql: string): Promise<unknown>;
+  r2List(): Promise<{ name: string }[]>;
+  r2Create(name: string): Promise<void>;
+}
+
+const defaultRun: RunFn = (cmd, args, env) =>
+  new Promise((resolve, reject) => {
+    execFile(cmd, args, { env }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+        return;
+      }
+      resolve({ stdout: stdout.toString() });
+    });
+  });
+
+function parseJson(raw: string, context: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
+  }
+}
+
+export function makeCfExec(cred: HouseCredential, run: RunFn = defaultRun): CfExec {
+  const env = {
+    ...process.env,
+    CLOUDFLARE_API_TOKEN: cred.apiToken,
+    CLOUDFLARE_ACCOUNT_ID: cred.accountId,
+  } as Record<string, string>;
+
+  return {
+    async d1List() {
+      const { stdout } = await run("wrangler", ["d1", "list", "--json"], env);
+      return parseJson(stdout, "d1 list") as { name: string; uuid: string }[];
+    },
+    async d1Create(name) {
+      const { stdout } = await run("wrangler", ["d1", "create", name, "--json"], env);
+      return parseJson(stdout, "d1 create") as { uuid: string };
+    },
+    async d1Query(name, sql) {
+      const { stdout } = await run(
+        "wrangler",
+        ["d1", "execute", name, "--remote", "--json", "--command", sql],
+        env,
+      );
+      return parseJson(stdout, "d1 execute");
+    },
+    async r2List() {
+      const { stdout } = await run("wrangler", ["r2", "bucket", "list", "--json"], env);
+      return parseJson(stdout, "r2 bucket list") as { name: string }[];
+    },
+    async r2Create(name) {
+      await run("wrangler", ["r2", "bucket", "create", name], env);
+    },
+  };
+}

package/payload/platform/lib/storage-broker/src/house-credential.ts

@@ -0,0 +1,32 @@
+// Reads the single account-wide Cloudflare credential from the house-only
+// config directory. This file is the one place the account-wide capability
+// lives; sub-account spawns never source it. Parses KEY=value lines without
+// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface HouseCredential {
+  apiToken: string;
+  accountId: string;
+}
+
+export function readHouseCredential(platformRoot: string): HouseCredential {
+  const path = join(platformRoot, "config", "cloudflare-house.env");
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    throw new Error(`storage-broker: house credential not found at ${path}`);
+  }
+  const env: Record<string, string> = {};
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m) env[m[1]] = m[2].trim();
+  }
+  const apiToken = env.CLOUDFLARE_API_TOKEN;
+  const accountId = env.CLOUDFLARE_ACCOUNT_ID;
+  if (!apiToken) throw new Error(`storage-broker: CLOUDFLARE_API_TOKEN missing in ${path}`);
+  if (!accountId) throw new Error(`storage-broker: CLOUDFLARE_ACCOUNT_ID missing in ${path}`);
+  return { apiToken, accountId };
+}

package/payload/platform/lib/storage-broker/src/index.ts

@@ -0,0 +1,14 @@
+// storage-broker: the per-account Cloudflare D1/R2 isolation core.
+//
+// The lib is pure and dependency-free at runtime: it opens no Neo4j connection
+// and shells no process on its own. Consumers inject a SessionLike (the ui
+// route uses neo4j-store's getSession; the remediation entry opens its own
+// driver) and, for cf-exec, a RunFn. That keeps every unit testable in
+// isolation and the isolation logic auditable in one place.
+
+export * from "./authorize.js";
+export * from "./registry.js";
+export * from "./house-credential.js";
+export * from "./cf-exec.js";
+export * from "./audit.js";
+export * from "./remediate.js";

package/payload/platform/lib/storage-broker/src/registry.ts

@@ -0,0 +1,85 @@
+// The ownership registry: which account owns which Cloudflare storage resource.
+//
+// Written with raw cypher MERGE stamped with system provenance, mirroring the
+// house-level seedAccountGraphRoot path in the admin plugin. It deliberately
+// does NOT go through graph-write's writeNodeWithEdges: that primitive's
+// accountId floor rejects a write whose props.accountId differs from the
+// writer process's ACCOUNT_ID, and the broker runs house-level, writing nodes
+// owned by many different sub-accounts. The owning accountId here is always the
+// trusted header value the service resolved, never an agent argument.
+
+// A minimal shape of a neo4j-driver Session, so this lib carries no runtime or
+// type dependency on neo4j-driver (mirrors the SeedSessionLike pattern used in
+// platform/plugins/admin/mcp/src/tools/account-lifecycle.ts).
+// Uses PromiseLike (not Promise) and get(): any so that a real neo4j-driver
+// Session — whose run() returns a Result (a PromiseLike, and whose records are
+// driver Records) — is structurally assignable under both v5 and v6 without a
+// cast at the call site.
+export interface SessionLike {
+  run(
+    cypher: string,
+    params?: Record<string, unknown>,
+  ): PromiseLike<{ records: Array<{ get(key: string): any }> }>;
+}
+
+export type ResourceKind = "d1" | "r2";
+
+export interface StorageResource {
+  accountId: string;
+  kind: ResourceKind;
+  name: string;
+  cfResourceId: string;
+}
+
+export async function registerResource(
+  session: SessionLike,
+  r: StorageResource,
+): Promise<void> {
+  // MERGE on (kind, name) — the ownership key. On a shared Cloudflare account a
+  // storage name maps to exactly one owner, so the write key must match the
+  // resolveOwner lookup key; keying on accountId too would let two accounts hold
+  // a node for the same name and make ownership ambiguous. accountId is set only
+  // ON CREATE and never overwritten ON MATCH, so a register can never silently
+  // reassign an existing resource to a different account.
+  await session.run(
+    `MERGE (r:StorageResource {kind: $kind, name: $name})
+       ON CREATE SET r.accountId = $accountId,
+                     r.createdByAgent = 'system',
+                     r.createdBySource = 'storage-broker',
+                     r.cfResourceId = $cfResourceId
+       ON MATCH SET  r.cfResourceId = $cfResourceId`,
+    { accountId: r.accountId, kind: r.kind, name: r.name, cfResourceId: r.cfResourceId },
+  );
+}
+
+export async function resolveOwner(
+  session: SessionLike,
+  kind: ResourceKind,
+  name: string,
+): Promise<string | null> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {kind: $kind, name: $name})
+       RETURN r.accountId AS accountId LIMIT 1`,
+    { kind, name },
+  );
+  return res.records.length ? (res.records[0].get("accountId") as string) : null;
+}
+
+export async function listResources(
+  session: SessionLike,
+  accountId: string,
+  kind: ResourceKind,
+): Promise<StorageResource[]> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {accountId: $accountId, kind: $kind})
+       RETURN r.name AS name, r.cfResourceId AS cfResourceId
+       ORDER BY r.name`,
+    { accountId, kind },
+  );
+  return res.records.map((rec) => ({
+    accountId,
+    kind,
+    name: rec.get("name") as string,
+    cfResourceId: rec.get("cfResourceId") as string,
+  }));
+}

package/payload/platform/lib/storage-broker/src/remediate.ts

@@ -0,0 +1,31 @@
+// The testable core of the operator-run remediation. The mapping from existing
+// resource name to owning account is operator-authored, and validation fails
+// closed on any resource absent from it: ownership is a recorded fact, never a
+// name-prefix guess. Token stripping removes every account-wide credential from
+// a sub-account secrets file while preserving everything else verbatim.
+
+export interface MappingResult {
+  ok: boolean;
+  missing: string[];
+}
+
+// Account-wide credentials stripped from a sub-account's cloudflare.env.
+// CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
+// credential, and does not grant access on its own.
+const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+
+export function validateMapping(
+  enumerated: string[],
+  mapping: Record<string, string>,
+): MappingResult {
+  const missing = enumerated.filter((name) => !(name in mapping));
+  return { ok: missing.length === 0, missing };
+}
+
+export function stripAccountWideTokens(contents: string): string {
+  const kept = contents.split("\n").filter((line) => {
+    const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+    return !(key && STRIP_KEYS.includes(key));
+  });
+  return kept.join("\n");
+}

package/payload/platform/lib/storage-broker/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
+    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -134,6 +134,11 @@
       "source": "./slides",
       "version": "0.1.0"
     },
+    {
+      "name": "storage-broker",
+      "source": "./storage-broker",
+      "version": "0.1.0"
+    },
     {
       "name": "substack-import",
       "source": "./substack-import",

package/payload/platform/plugins/admin/hooks/lib/maxy-mcp-plugins.txt

@@ -13,6 +13,7 @@ outlook
 quickbooks
 replicate
 scheduling
+storage-broker
 telegram
 url-get
 whatsapp

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -40,7 +40,8 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 |---|---|
 | [manual-setup.md](references/manual-setup.md) | Tunnel runbook — Steps 0–7 with isolated `cloudflared` command blocks. The agent reads the relevant step before issuing each command. |
 | [api.md](references/api.md) | Cloudflare API library — canonical docs URL + curated endpoint map (DNS, zones, tunnels, token list/create/verify/revoke), the advanced master-token creation walkthrough, the account-scoped secrets-file storage convention, the agent's reuse-a-stable-per-scope-token discipline, and the standing reconcile pass that revokes strays. |
-| [d1-data-capture.md](references/d1-data-capture.md) | Form → Pages Function → D1 store → read/sweep. The Pages-Edit **and** D1-Edit token-scope requirement, `wrangler d1 create`/`execute --remote`, the `swept` column. |
+| [d1-data-capture.md](references/d1-data-capture.md) | Form → Pages Function → D1 store → read/sweep. The Pages-Edit **and** D1-Edit token-scope requirement, `wrangler d1 create`/`execute --remote`, the `swept` column, plus the establishment discipline: `<accountId>-<purpose>` naming, one store per purpose, and the canonical `acceptances` schema. |
+| [r2-object-storage.md](references/r2-object-storage.md) | R2 buckets under the same establishment discipline as D1: `<accountId>-<purpose>` naming via `cf-store-name.sh`, one bucket per purpose, `wrangler r2 bucket create`, and the store-provision breadcrumb. |
 | [hosting-sites.md](references/hosting-sites.md) | Deploy a static or Next.js site to Cloudflare Pages via `wrangler pages deploy`. |
 | [web-analytics.md](references/web-analytics.md) | Why a registered site reports 0 visitors — the RUM API is blocked (no permission group), registered ≠ collecting, edge auto-injection is impossible for a Pages-only custom domain, and the beacon must be injected into the site HTML, rebuilt, and redeployed. Outcome: beacon present in live HTML. |
 | [dashboard-guide.md](references/dashboard-guide.md) | Click-paths for operations the operator prefers to do by hand — sign in, switch accounts, add a site, edit an apex CNAME, verify nameservers, delete a tunnel, manage CNAME records, author an Access policy. |
@@ -53,6 +54,8 @@ The agent loads these references on demand via `plugin-read` as the conversation
 | Helper | Purpose |
 |---|---|
 | [bin/cf-token.sh](bin/cf-token.sh) | Deterministic per-scope token resolver. `bash bin/cf-token.sh <scope> <secrets-file>` (scope: `pages`, `d1`, `dns`, `access`) reads the master's `cfat_`/`cfut_` prefix, routes verify/`permission_groups`/mint to the matching endpoint family, reuses a persisted token or mints once if absent (no expiry), verifies through the transient post-mint window, persists to the secrets file, and prints only the secrets key name on stdout (never a token value). It removes the endpoint-routing decision from the agent, which is what the false-negative `Invalid API Token` / `9109` failures turned on. curl + jq only; exit-code gated. |
+| [bin/cf-store-name.sh](bin/cf-store-name.sh) | Deterministic storage-name resolver. `bash bin/cf-store-name.sh <accountId> <purpose>` prints the canonical `<accountId>-<purpose>` name (nothing else) for a D1 database or R2 bucket, so a store's name identifies its owner and purpose. Lowercases and validates each segment to `[a-z0-9-]`; fails closed on empty or invalid input. No network, no secrets. |
+| [bin/cf-schema-check.sh](bin/cf-schema-check.sh) | Canonical acceptance-schema gate. Feed it the stored DDL (`wrangler d1 execute --json --command "SELECT sql FROM sqlite_master WHERE sql IS NOT NULL" \| jq -r '.[0].results[].sql'`); exit 0 iff the store carries the one canonical `acceptances` shape (`doc_ref`, `doc_type`, `party`, `signer_name`, `accepted_at`, `swept`; no stray `dual_acceptances` table; `signer_name` not a bare `name`), exit 1 with the first drift named on stderr. Exit-code gated. |
 
 ### Success contract
 

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-schema-check.test.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Regression test for cf-schema-check.sh - the canonical acceptance-schema
+# validator. Input on stdin is the DDL text a `SELECT sql FROM sqlite_master`
+# returns; exit 0 iff the store matches the one canonical `acceptances` shape,
+# non-zero on any drift. No network, no D1.
+#
+# Covers:
+#   1. canonical shape -> exit 0
+#   2. canonical shape + an unrelated leads table -> exit 0 (extra tables fine)
+#   3. bare `name` instead of signer_name -> exit 1, stderr names signer drift
+#   4. missing swept column -> exit 1, stderr names swept
+#   5. a stray dual_acceptances table -> exit 1, stderr names it
+#   6. no acceptances table (only leads) -> exit 1, stderr "no acceptances table"
+set -u
+
+HELPER="$(cd "$(dirname "$0")/.." && pwd)/cf-schema-check.sh"
+[ -x "$HELPER" ] || { echo "FAIL: $HELPER not executable" >&2; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+# Canonical acceptance DDL (the authority declared in d1-data-capture.md).
+CANON='CREATE TABLE IF NOT EXISTS acceptances (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_ref TEXT NOT NULL,
+  doc_type TEXT NOT NULL,
+  party TEXT,
+  signer_name TEXT,
+  accepted_at TEXT NOT NULL DEFAULT (datetime('"'"'now'"'"')),
+  swept INTEGER NOT NULL DEFAULT 0
+);'
+
+LEADS='CREATE TABLE leads (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL,
+  swept INTEGER NOT NULL DEFAULT 0
+);'
+
+# Run helper with stdin=$1. Sets ERR/RC.
+run() {
+  local ef; ef=$(mktemp)
+  printf '%s\n' "$1" | bash "$HELPER" 2>"$ef" >/dev/null
+  RC=$?
+  ERR=$(cat "$ef"); rm -f "$ef"
+}
+
+# 1. canonical -> 0
+run "$CANON"
+[ "$RC" -eq 0 ] && ok "canonical shape accepted (exit=$RC)" || bad "canonical rejected (exit=$RC err='$ERR')"
+
+# 2. canonical + leads -> 0
+run "$CANON
+$LEADS"
+[ "$RC" -eq 0 ] && ok "canonical plus unrelated table accepted" || bad "extra table rejected (exit=$RC err='$ERR')"
+
+# 3. bare name drift -> 1, mentions signer
+DRIFT_NAME='CREATE TABLE acceptances (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_ref TEXT NOT NULL,
+  doc_type TEXT NOT NULL,
+  party TEXT,
+  name TEXT,
+  accepted_at TEXT NOT NULL,
+  swept INTEGER NOT NULL DEFAULT 0
+);'
+run "$DRIFT_NAME"
+{ [ "$RC" -ne 0 ] && printf '%s' "$ERR" | grep -qi "signer"; } \
+  && ok "bare name rejected, signer drift named (exit=$RC)" \
+  || bad "bare name drift (exit=$RC err='$ERR')"
+
+# 4. missing swept -> 1, mentions swept
+DRIFT_SWEPT='CREATE TABLE acceptances (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_ref TEXT NOT NULL,
+  doc_type TEXT NOT NULL,
+  party TEXT,
+  signer_name TEXT,
+  accepted_at TEXT NOT NULL
+);'
+run "$DRIFT_SWEPT"
+{ [ "$RC" -ne 0 ] && printf '%s' "$ERR" | grep -qi "swept"; } \
+  && ok "missing swept rejected, swept named (exit=$RC)" \
+  || bad "missing swept (exit=$RC err='$ERR')"
+
+# 4b. acceptances missing swept, but a sibling leads table HAS swept -> still
+#     exit 1. Column checks must be scoped to the acceptances table, not bleed
+#     across the whole dump.
+DRIFT_SWEPT_BLEED='CREATE TABLE acceptances (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_ref TEXT NOT NULL,
+  doc_type TEXT NOT NULL,
+  party TEXT,
+  signer_name TEXT,
+  accepted_at TEXT NOT NULL
+);
+CREATE TABLE leads (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  email TEXT NOT NULL,
+  swept INTEGER NOT NULL DEFAULT 0
+);'
+run "$DRIFT_SWEPT_BLEED"
+{ [ "$RC" -ne 0 ] && printf '%s' "$ERR" | grep -qi "swept"; } \
+  && ok "missing swept not masked by sibling table (exit=$RC)" \
+  || bad "swept bleed across tables (exit=$RC err='$ERR')"
+
+# 5. dual_acceptances stray -> 1, mentions it
+DUAL="$CANON
+CREATE TABLE dual_acceptances (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_ref TEXT NOT NULL,
+  party TEXT,
+  signer_name TEXT
+);"
+run "$DUAL"
+{ [ "$RC" -ne 0 ] && printf '%s' "$ERR" | grep -qi "dual_acceptances"; } \
+  && ok "stray dual_acceptances rejected and named (exit=$RC)" \
+  || bad "dual_acceptances stray (exit=$RC err='$ERR')"
+
+# 6. no acceptances table -> 1, mentions it
+run "$LEADS"
+{ [ "$RC" -ne 0 ] && printf '%s' "$ERR" | grep -qi "no acceptances"; } \
+  && ok "missing acceptances table rejected and named (exit=$RC)" \
+  || bad "no acceptances table (exit=$RC err='$ERR')"
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-store-name.test.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Regression test for cf-store-name.sh - the canonical <accountId>-<purpose>
+# store-name helper. Pure string computation: no curl, no secrets, no network.
+#
+# Covers:
+#   1. valid input -> <accountId>-<purpose> on stdout, exit 0
+#   2. deterministic: identical inputs -> byte-identical output
+#   3. mixed-case input is lowercased
+#   4. a hyphenated purpose is preserved
+#   5. empty accountId fails closed (exit 1)
+#   6. empty purpose fails closed (exit 1)
+#   7. an invalid character in a segment fails closed (exit 1)
+#   8. no missing-arg or invalid case leaks a partial name to stdout
+set -u
+
+HELPER="$(cd "$(dirname "$0")/.." && pwd)/cf-store-name.sh"
+[ -x "$HELPER" ] || { echo "FAIL: $HELPER not executable" >&2; exit 1; }
+
+PASS=0; FAIL=0
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+# Run the helper. $1 name, then the helper argv is "$2".."$n" up to a trailing
+# expected-exit sentinel passed via EXP. Sets OUT/ERR/RC.
+run() {
+  local name="$1"; shift
+  local of ef
+  of=$(mktemp); ef=$(mktemp)
+  bash "$HELPER" "$@" >"$of" 2>"$ef"
+  RC=$?
+  OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+}
+
+# 1. valid -> name, exit 0
+run "valid" acc123 acceptances
+{ [ "$RC" -eq 0 ] && [ "$OUT" = "acc123-acceptances" ]; } \
+  && ok "valid input yields acc123-acceptances (exit=$RC)" \
+  || bad "valid input (exit=$RC out='$OUT')"
+
+# 2. deterministic
+run "det1" acc123 acceptances; d1="$OUT"
+run "det2" acc123 acceptances; d2="$OUT"
+[ "$d1" = "$d2" ] && ok "deterministic identical output" || bad "non-deterministic ('$d1' vs '$d2')"
+
+# 3. lowercases
+run "case" Acc123 Acceptances
+{ [ "$RC" -eq 0 ] && [ "$OUT" = "acc123-acceptances" ]; } \
+  && ok "mixed case lowercased" || bad "case (exit=$RC out='$OUT')"
+
+# 4. hyphenated purpose preserved
+run "hyphen" acc123 quote-signing
+{ [ "$RC" -eq 0 ] && [ "$OUT" = "acc123-quote-signing" ]; } \
+  && ok "hyphenated purpose preserved" || bad "hyphen (exit=$RC out='$OUT')"
+
+# 5. empty accountId fails closed
+run "empty-acct" "" acceptances
+{ [ "$RC" -ne 0 ] && [ -z "$OUT" ]; } \
+  && ok "empty accountId fails closed (exit=$RC)" || bad "empty accountId (exit=$RC out='$OUT')"
+
+# 6. empty purpose fails closed
+run "empty-purpose" acc123 ""
+{ [ "$RC" -ne 0 ] && [ -z "$OUT" ]; } \
+  && ok "empty purpose fails closed (exit=$RC)" || bad "empty purpose (exit=$RC out='$OUT')"
+
+# 7. invalid char fails closed
+run "invalid" acc123 "accept!ances"
+{ [ "$RC" -ne 0 ] && [ -z "$OUT" ]; } \
+  && ok "invalid char fails closed (exit=$RC)" || bad "invalid char (exit=$RC out='$OUT')"
+
+# 8. missing second arg fails closed, no partial name
+run "missing-arg" acc123
+{ [ "$RC" -ne 0 ] && [ -z "$OUT" ]; } \
+  && ok "missing purpose arg fails closed (exit=$RC)" || bad "missing arg (exit=$RC out='$OUT')"
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-schema-check.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# cf-schema-check.sh - canonical acceptance-schema validator.
+#
+# The document-acceptance store (e-sign / works-agreement / quote-signing
+# watchers) has ONE canonical shape, declared in
+# references/d1-data-capture.md § The canonical acceptance store. This helper is
+# the exit-code gate that confirms a live store follows it, so a watcher can
+# rely on reading one known shape instead of three drifted ones.
+#
+# Input:  stdin = the DDL text `wrangler d1 execute <db> --remote --command
+#         "SELECT sql FROM sqlite_master;"` returns (the SQLite-stored CREATE
+#         statements). This is machine-generated DDL, not prose, so token
+#         inspection is a deterministic pre-flight.
+# Output: stdout = nothing on success. stderr = a [cf-schema-check] line naming
+#         the first failing check.
+# Exit:   0 iff the input matches the canonical acceptance shape; 1 on any drift.
+set -u
+
+fail() { echo "[cf-schema-check] drift: $*" >&2; exit 1; }
+
+ddl="$(cat)"
+has() { printf '%s' "$ddl" | grep -Eiq "$1"; }
+
+# 1. An `acceptances` table must exist. \bacceptances\b does not match inside
+#    `dual_acceptances` (the underscore suppresses the word boundary), so this
+#    is specific to the canonical table.
+has 'create table[^;(]*\bacceptances\b' || fail "no acceptances table in the store"
+
+# 2. No `dual_acceptances` table. Its presence is the two-signer sprawl the
+#    canonical `party` column replaces. Checked against the whole dump.
+has '\bdual_acceptances\b' && fail "stray dual_acceptances table (use the party column, not a second table)"
+
+# Isolate the `acceptances` CREATE statement so column checks are scoped to it,
+# not bled across sibling tables (a leads table's `swept` must not satisfy the
+# acceptances requirement). Print from the acceptances CREATE line to its `);`.
+acc="$(printf '%s\n' "$ddl" | awk '
+  { l = tolower($0) }
+  l ~ /create table/ && l ~ /acceptances/ && l !~ /dual_acceptances/ { f = 1 }
+  f { print }
+  f && /\);/ { exit }
+')"
+hasin() { printf '%s' "$acc" | grep -Eiq "$1"; }
+
+# 3. The signer column is `signer_name`, never a bare `name`. \bname\b does not
+#    match inside `signer_name`, so a standalone `name` token with no
+#    `signer_name` present is the drift signature.
+if ! hasin '\bsigner_name\b'; then
+  if hasin '\bname\b'; then
+    fail "signer column is bare 'name', expected 'signer_name'"
+  fi
+  fail "missing required column: signer_name"
+fi
+
+# 4. Every canonical column present in the acceptances table. signer_name is
+#    already confirmed above.
+for col in doc_ref doc_type party accepted_at swept; do
+  hasin "\\b${col}\\b" || fail "missing required column: ${col}"
+done
+
+exit 0

package/payload/platform/plugins/cloudflare/bin/cf-store-name.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# cf-store-name.sh - deterministic Cloudflare storage-name resolver.
+#
+# Owns the one naming decision the plugin previously left to the agent: a D1
+# database or R2 bucket is named <accountId>-<purpose>, so a store's name
+# identifies its owner and purpose (references/d1-data-capture.md § Establishing
+# a store, references/r2-object-storage.md). Same inputs always yield the same
+# name; that determinism is what lets "does a store for this purpose already
+# exist?" be a lookup rather than a guess.
+#
+# Usage: cf-store-name.sh <accountId> <purpose>
+# Output: stdout = the canonical <accountId>-<purpose> name (nothing else).
+# Exit:   0 when both segments are valid; non-zero (fail closed) otherwise.
+#
+# Pure string computation: no network, no secrets, no side effects. It does NOT
+# create the store or decide create-vs-reuse; that decision and its
+# op=storage-provision breadcrumb live at the create call site, because this
+# helper cannot know whether the store already exists.
+set -u
+
+die() { echo "[cf-store-name] error: $*" >&2; exit 1; }
+
+account="${1:-}"; purpose="${2:-}"
+[ -n "$account" ] || die "accountId required; usage: cf-store-name.sh <accountId> <purpose>"
+[ -n "$purpose" ] || die "purpose required; usage: cf-store-name.sh <accountId> <purpose>"
+
+# Lowercase each segment (D1/R2 names are lowercase), then validate. An invalid
+# character is an error, not a silent fixup - a name that does not round-trip to
+# what the caller asked for would defeat the "name identifies owner+purpose"
+# contract.
+account="$(printf '%s' "$account" | tr '[:upper:]' '[:lower:]')"
+purpose="$(printf '%s' "$purpose" | tr '[:upper:]' '[:lower:]')"
+
+case "$account" in *[!a-z0-9-]*) die "accountId '$account' has a character outside [a-z0-9-]";; esac
+case "$purpose" in *[!a-z0-9-]*) die "purpose '$purpose' has a character outside [a-z0-9-]";; esac
+
+printf '%s-%s\n' "$account" "$purpose"

package/payload/platform/plugins/cloudflare/bin/remediate-storage-isolation.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# remediate-storage-isolation.sh — one-shot, operator-run remediation of an
+# existing multi-tenant install (Task 1631). Registers every existing D1
+# database and R2 bucket to its owning account, relocates the master token into
+# the house-only config file, and strips every account-wide token from every
+# sub-account secrets file.
+#
+# The mapping file is operator-authored JSON: { "<resource-name>": "<accountId>" }.
+# The node core fails closed on any enumerated resource the operator did not map;
+# ownership is never guessed. This wrapper is a faithful relay: it gates on the
+# mapping file existing and on the node exit code, and never echoes a token.
+#
+# Usage: PLATFORM_ROOT=~/<brand>-code/platform \
+#        NEO4J_URI=... NEO4J_PASSWORD=... \
+#        remediate-storage-isolation.sh <mapping-file.json>
+set -u
+
+log() { echo "[remediate] $*" >&2; }
+die() { log "error: $*"; exit 1; }
+
+MAPPING="${1:-}"
+[ -n "$MAPPING" ] || die "usage: remediate-storage-isolation.sh <mapping-file.json>"
+[ -r "$MAPPING" ] || die "mapping file not readable: '${MAPPING}'"
+[ -n "${PLATFORM_ROOT:-}" ] || die "PLATFORM_ROOT not set"
+
+ENTRY="${PLATFORM_ROOT}/lib/storage-broker/dist/bin/remediate-run.js"
+[ -f "$ENTRY" ] || die "remediation entry not built: '${ENTRY}' (run the platform build first)"
+
+log "op=remediate mapping=$(basename "$MAPPING") start"
+node "$ENTRY" "$MAPPING"
+rc=$?
+if [ "$rc" -ne 0 ]; then
+  log "op=remediate result=failed code=${rc} (no partial write on a fail-closed abort)"
+  exit "$rc"
+fi
+log "op=remediate result=ok"