@rubytech/create-maxy-code 0.1.444 → 0.1.446

package/payload/platform/lib/storage-broker/dist/__tests__/remediate-run.test.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const remediate_run_js_1 = require("../bin/remediate-run.js");
+function fixture() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "sb-remediate-"));
+    const accountsDir = (0, node_path_1.join)(root, "data", "accounts");
+    for (const acc of ["acc-a", "acc-b"]) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(accountsDir, acc, "secrets"), { recursive: true });
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(accountsDir, acc, "secrets", "cloudflare.env"), `CLOUDFLARE_ACCOUNT_ID=shared\nCLOUDFLARE_API_TOKEN=cfat_master\nCF_PAGES_D1_TOKEN=cfat_pd\nCF_DNS_TOKEN=keep\n`);
+    }
+    return { root, accountsDir, configPath: (0, node_path_1.join)(root, "config", "cloudflare-house.env") };
+}
+function baseDeps(f, registered) {
+    return {
+        cfD1: async () => [{ name: "gls-leads", cfResourceId: "u1" }],
+        cfR2: async () => [],
+        mapping: { "gls-leads": "acc-a" },
+        register: async (r) => { registered.push(r); },
+        accountsDir: f.accountsDir,
+        master: { apiToken: "cfat_master", accountId: "shared" },
+        configPath: f.configPath,
+    };
+}
+(0, node_test_1.default)("fails closed on an unmapped resource and writes nothing", async () => {
+    const f = fixture();
+    const registered = [];
+    const deps = { ...baseDeps(f, registered), cfD1: async () => [
+            { name: "gls-leads", cfResourceId: "u1" },
+            { name: "beagle-investors", cfResourceId: "u2" },
+        ] };
+    try {
+        await strict_1.default.rejects(() => (0, remediate_run_js_1.runRemediation)(deps), /unmapped resources: beagle-investors/);
+        strict_1.default.equal(registered.length, 0, "no resource registered on abort");
+        strict_1.default.equal((0, node_fs_1.existsSync)(f.configPath), false, "no house config written on abort");
+        const secrets = (0, node_fs_1.readFileSync)((0, node_path_1.join)(f.accountsDir, "acc-a", "secrets", "cloudflare.env"), "utf8");
+        strict_1.default.match(secrets, /CLOUDFLARE_API_TOKEN=cfat_master/, "secrets untouched on abort");
+    }
+    finally {
+        (0, node_fs_1.rmSync)(f.root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)("registers, relocates the master, and strips every account-wide token", async () => {
+    const f = fixture();
+    const registered = [];
+    try {
+        const result = await (0, remediate_run_js_1.runRemediation)(baseDeps(f, registered));
+        strict_1.default.equal(result.registered, 1);
+        strict_1.default.deepEqual(registered, [
+            { accountId: "acc-a", kind: "d1", name: "gls-leads", cfResourceId: "u1" },
+        ]);
+        // House config now holds the master.
+        const house = (0, node_fs_1.readFileSync)(f.configPath, "utf8");
+        strict_1.default.match(house, /CLOUDFLARE_API_TOKEN=cfat_master/);
+        strict_1.default.match(house, /CLOUDFLARE_ACCOUNT_ID=shared/);
+        // Both sub-account secrets are stripped of account-wide tokens, scoped kept.
+        for (const acc of ["acc-a", "acc-b"]) {
+            const s = (0, node_fs_1.readFileSync)((0, node_path_1.join)(f.accountsDir, acc, "secrets", "cloudflare.env"), "utf8");
+            strict_1.default.doesNotMatch(s, /CLOUDFLARE_API_TOKEN=/);
+            strict_1.default.doesNotMatch(s, /CF_PAGES_D1_TOKEN=/);
+            strict_1.default.match(s, /CF_DNS_TOKEN=keep/);
+            strict_1.default.match(s, /CLOUDFLARE_ACCOUNT_ID=shared/);
+        }
+        strict_1.default.equal(result.strippedFiles.length, 2);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(f.root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=remediate-run.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/remediate-run.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate-run.test.js","sourceRoot":"","sources":["../../src/__tests__/remediate-run.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAkG;AAClG,yCAAiC;AACjC,qCAAiC;AACjC,8DAA+E;AAG/E,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACrC,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,EACnD,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,CAA6B,EAAE,UAA6B;IAC5E,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC7D,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACpB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACjC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC3D,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE;YACzC,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,EAAE;SACjD,EAAE,CAAC;IACJ,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAA,iCAAc,EAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACzF,gBAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACtE,gBAAM,CAAC,KAAK,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;QAChG,gBAAM,CAAC,KAAK,CAAC,OAAO,EAAE,kCAAkC,EAAE,4BAA4B,CAAC,CAAC;IAC1F,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAc,EAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnC,gBAAM,CAAC,SAAS,CAAC,UAAU,EAAE;YAC3B,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE;SAC1E,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,gBAAM,CAAC,KAAK,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;QACxD,gBAAM,CAAC,KAAK,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QAEpD,6EAA6E;QAC7E,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;YACtF,gBAAM,CAAC,YAAY,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAChD,gBAAM,CAAC,YAAY,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC7C,gBAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACrC,gBAAM,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=remediate.test.d.ts.map

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/remediate.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const remediate_js_1 = require("../remediate.js");
+(0, node_test_1.default)("fails closed on an unmapped resource", () => {
+    const r = (0, remediate_js_1.validateMapping)(["gls-leads", "beagle-investors"], { "gls-leads": "acc-a" });
+    strict_1.default.deepEqual(r, { ok: false, missing: ["beagle-investors"] });
+});
+(0, node_test_1.default)("passes when every resource is mapped", () => {
+    strict_1.default.deepEqual((0, remediate_js_1.validateMapping)(["gls-leads"], { "gls-leads": "acc-a" }), {
+        ok: true,
+        missing: [],
+    });
+});
+(0, node_test_1.default)("strips only account-wide token lines, keeps the account id and scoped tokens", () => {
+    const before = "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
+    strict_1.default.equal((0, remediate_js_1.stripAccountWideTokens)(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
+});
+//# sourceMappingURL=remediate.test.js.map

package/payload/platform/lib/storage-broker/dist/__tests__/remediate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate.test.js","sourceRoot":"","sources":["../../src/__tests__/remediate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,kDAA0E;AAE1E,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,CAAC,GAAG,IAAA,8BAAe,EAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,gBAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,gBAAM,CAAC,SAAS,CAAC,IAAA,8BAAe,EAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE;QACzE,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,MAAM,GACV,kGAAkG,CAAC;IACrG,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAsB,EAAC,MAAM,CAAC,EAAE,gDAAgD,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/audit.d.ts

@@ -0,0 +1,19 @@
+export type StrayKind = "unattributed-d1" | "unattributed-r2" | "account-wide-token";
+export interface Stray {
+    kind: StrayKind;
+    detail: string;
+}
+export interface AuditDeps {
+    cfD1(): Promise<string[]>;
+    cfR2(): Promise<string[]>;
+    registeredNames(kind: "d1" | "r2"): Promise<string[]>;
+    accountSecretsFiles(): Promise<Array<{
+        accountId: string;
+        path: string;
+        contents: string;
+    }>>;
+}
+export declare function reconcileStorage(deps: AuditDeps): Promise<{
+    strays: Stray[];
+}>;
+//# sourceMappingURL=audit.d.ts.map

package/payload/platform/lib/storage-broker/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAErF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC9F;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CAAC,CA8BpF"}

package/payload/platform/lib/storage-broker/dist/audit.js

@@ -0,0 +1,41 @@
+"use strict";
+// The standing audit: an independent periodic reconcile, not a per-action log,
+// because the failure mode is a no-event blind spot. A mis-registered resource
+// or a stray account-wide token leaks nothing until an agent happens to touch
+// it. This reconciles what Cloudflare has against what the registry records and
+// against what the per-account secrets files still carry.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileStorage = reconcileStorage;
+// Keys that must never remain in a sub-account's cloudflare.env after
+// remediation. Each is an account-wide capability.
+const ACCOUNT_WIDE_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+async function reconcileStorage(deps) {
+    const strays = [];
+    const [cfD1, cfR2, regD1, regR2, secretsFiles] = await Promise.all([
+        deps.cfD1(),
+        deps.cfR2(),
+        deps.registeredNames("d1"),
+        deps.registeredNames("r2"),
+        deps.accountSecretsFiles(),
+    ]);
+    const regD1Set = new Set(regD1);
+    for (const name of cfD1) {
+        if (!regD1Set.has(name))
+            strays.push({ kind: "unattributed-d1", detail: name });
+    }
+    const regR2Set = new Set(regR2);
+    for (const name of cfR2) {
+        if (!regR2Set.has(name))
+            strays.push({ kind: "unattributed-r2", detail: name });
+    }
+    for (const file of secretsFiles) {
+        for (const line of file.contents.split("\n")) {
+            const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+            if (key && ACCOUNT_WIDE_KEYS.includes(key)) {
+                strays.push({ kind: "account-wide-token", detail: `${file.accountId}:${key}` });
+            }
+        }
+    }
+    return { strays };
+}
+//# sourceMappingURL=audit.js.map

package/payload/platform/lib/storage-broker/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,0DAA0D;;AAoB1D,4CA8BC;AAzCD,sEAAsE;AACtE,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AASnF,KAAK,UAAU,gBAAgB,CAAC,IAAe;IACpD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,mBAAmB,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}

package/payload/platform/lib/storage-broker/dist/authorize.d.ts

@@ -0,0 +1,11 @@
+export type StorageAction = "list" | "read" | "write";
+export interface AccessDecision {
+    allow: boolean;
+    reason: string;
+}
+export declare function authorizeAccess(params: {
+    caller: string;
+    owner: string | null;
+    action: StorageAction;
+}): AccessDecision;
+//# sourceMappingURL=authorize.d.ts.map

package/payload/platform/lib/storage-broker/dist/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;CACvB,GAAG,cAAc,CAKjB"}

package/payload/platform/lib/storage-broker/dist/authorize.js

@@ -0,0 +1,17 @@
+"use strict";
+// The pure ownership decision at the centre of the storage broker. No I/O:
+// given who is calling and who owns a resource, decide allow or deny. The
+// caller identity is always the trusted header value the service resolved,
+// never an agent-supplied argument.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeAccess = authorizeAccess;
+function authorizeAccess(params) {
+    if (!params.caller)
+        return { allow: false, reason: "no-caller" };
+    if (params.owner === null)
+        return { allow: false, reason: "unregistered" };
+    if (params.owner !== params.caller)
+        return { allow: false, reason: "cross-account" };
+    return { allow: true, reason: "owner" };
+}
+//# sourceMappingURL=authorize.js.map

package/payload/platform/lib/storage-broker/dist/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":";AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,oCAAoC;;AASpC,0CASC;AATD,SAAgB,eAAe,CAAC,MAI/B;IACC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.d.ts

@@ -0,0 +1,25 @@
+import { type StorageResource } from "../registry.js";
+export interface RemediationDeps {
+    cfD1(): Promise<Array<{
+        name: string;
+        cfResourceId: string;
+    }>>;
+    cfR2(): Promise<Array<{
+        name: string;
+        cfResourceId: string;
+    }>>;
+    mapping: Record<string, string>;
+    register(r: StorageResource): Promise<void>;
+    accountsDir: string;
+    master: {
+        apiToken: string;
+        accountId: string;
+    };
+    configPath: string;
+}
+export interface RemediationResult {
+    registered: number;
+    strippedFiles: string[];
+}
+export declare function runRemediation(deps: RemediationDeps): Promise<RemediationResult>;
+//# sourceMappingURL=remediate-run.d.ts.map

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate-run.d.ts","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":"AAaA,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIxE,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2CtF"}

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.js

@@ -0,0 +1,131 @@
+"use strict";
+// Operator-run remediation of an existing multi-tenant install. Registers every
+// existing D1 database and R2 bucket to its owning account, relocates the master
+// token into the house-only config file, and strips every account-wide token
+// from every sub-account secrets file. Fails closed on any enumerated resource
+// the operator did not map: ownership is never guessed.
+//
+// runRemediation is the testable core (all effects injected or against a given
+// directory). main() wires the real deps and is the on-device entry the shell
+// wrapper calls.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRemediation = runRemediation;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const remediate_js_1 = require("../remediate.js");
+const registry_js_1 = require("../registry.js");
+const house_credential_js_1 = require("../house-credential.js");
+const cf_exec_js_1 = require("../cf-exec.js");
+async function runRemediation(deps) {
+    const d1 = await deps.cfD1();
+    const r2 = await deps.cfR2();
+    const enumerated = [...d1.map((x) => x.name), ...r2.map((x) => x.name)];
+    // Fail closed BEFORE any write: an enumerated resource with no mapped owner
+    // aborts the whole run, leaving the install untouched.
+    const validation = (0, remediate_js_1.validateMapping)(enumerated, deps.mapping);
+    if (!validation.ok) {
+        throw new Error(`storage-broker remediation: unmapped resources: ${validation.missing.join(", ")}`);
+    }
+    for (const x of d1) {
+        await deps.register({ accountId: deps.mapping[x.name], kind: "d1", name: x.name, cfResourceId: x.cfResourceId });
+    }
+    for (const x of r2) {
+        await deps.register({ accountId: deps.mapping[x.name], kind: "r2", name: x.name, cfResourceId: x.cfResourceId });
+    }
+    // Relocate the master into the house-only config file (read before stripping).
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(deps.configPath), { recursive: true });
+    (0, node_fs_1.writeFileSync)(deps.configPath, `CLOUDFLARE_API_TOKEN=${deps.master.apiToken}\nCLOUDFLARE_ACCOUNT_ID=${deps.master.accountId}\n`, { mode: 0o600 });
+    // Strip every account-wide token from every sub-account secrets file.
+    const strippedFiles = [];
+    if ((0, node_fs_1.existsSync)(deps.accountsDir)) {
+        for (const accountId of (0, node_fs_1.readdirSync)(deps.accountsDir)) {
+            const p = (0, node_path_1.join)(deps.accountsDir, accountId, "secrets", "cloudflare.env");
+            if (!(0, node_fs_1.existsSync)(p))
+                continue;
+            const before = (0, node_fs_1.readFileSync)(p, "utf8");
+            const after = (0, remediate_js_1.stripAccountWideTokens)(before);
+            if (after !== before) {
+                (0, node_fs_1.writeFileSync)(p, after, { mode: 0o600 });
+                strippedFiles.push(p);
+            }
+        }
+    }
+    return { registered: d1.length + r2.length, strippedFiles };
+}
+// --- on-device CLI (untested glue) ----------------------------------------
+function findMasterFromAccounts(accountsDir) {
+    if (!(0, node_fs_1.existsSync)(accountsDir))
+        return null;
+    for (const accountId of (0, node_fs_1.readdirSync)(accountsDir)) {
+        const p = (0, node_path_1.join)(accountsDir, accountId, "secrets", "cloudflare.env");
+        if (!(0, node_fs_1.existsSync)(p))
+            continue;
+        const env = {};
+        for (const line of (0, node_fs_1.readFileSync)(p, "utf8").split("\n")) {
+            const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+            if (m)
+                env[m[1]] = m[2].trim();
+        }
+        if (env.CLOUDFLARE_API_TOKEN && env.CLOUDFLARE_ACCOUNT_ID) {
+            return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID };
+        }
+    }
+    return null;
+}
+async function main() {
+    const mappingFile = process.argv[2];
+    if (!mappingFile || !(0, node_fs_1.existsSync)(mappingFile)) {
+        console.error(`[remediate] error: mapping file not found: ${mappingFile ?? "(none)"}`);
+        process.exit(2);
+    }
+    const platformRoot = process.env.PLATFORM_ROOT;
+    if (!platformRoot) {
+        console.error("[remediate] error: PLATFORM_ROOT not set");
+        process.exit(2);
+    }
+    const accountsDir = (0, node_path_1.resolve)(platformRoot, "..", "data", "accounts");
+    const configPath = (0, node_path_1.join)(platformRoot, "config", "cloudflare-house.env");
+    const mapping = JSON.parse((0, node_fs_1.readFileSync)(mappingFile, "utf8"));
+    // The master is wherever it lives today: the house file if already relocated,
+    // else the first sub-account secrets file that still carries it.
+    let master;
+    try {
+        master = (0, house_credential_js_1.readHouseCredential)(platformRoot);
+    }
+    catch {
+        const found = findMasterFromAccounts(accountsDir);
+        if (!found) {
+            console.error("[remediate] error: no Cloudflare master token found in house config or account secrets");
+            process.exit(2);
+            return;
+        }
+        master = found;
+    }
+    const cf = (0, cf_exec_js_1.makeCfExec)(master);
+    const neo4j = (await import("neo4j-driver"));
+    const driver = neo4j.default.driver(process.env.NEO4J_URI, neo4j.default.auth.basic(process.env.NEO4J_USER ?? "neo4j", process.env.NEO4J_PASSWORD ?? ""));
+    const session = driver.session();
+    try {
+        const result = await runRemediation({
+            cfD1: async () => (await cf.d1List()).map((d) => ({ name: d.name, cfResourceId: d.uuid })),
+            cfR2: async () => (await cf.r2List()).map((b) => ({ name: b.name, cfResourceId: b.name })),
+            mapping,
+            register: (r) => (0, registry_js_1.registerResource)(session, r),
+            accountsDir,
+            master,
+            configPath,
+        });
+        console.error(`[remediate] done registered=${result.registered} stripped=${result.strippedFiles.length}`);
+    }
+    finally {
+        await session.close();
+        await driver.close();
+    }
+}
+if (require.main === module) {
+    main().catch((err) => {
+        console.error(`[remediate] error: ${err.message}`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=remediate-run.js.map

package/payload/platform/lib/storage-broker/dist/bin/remediate-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate-run.js","sourceRoot":"","sources":["../../src/bin/remediate-run.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,iBAAiB;;AAwBjB,wCA2CC;AAjED,qCAA0F;AAC1F,yCAAmD;AACnD,kDAA0E;AAC1E,gDAAwE;AACxE,gEAA6D;AAC7D,8CAA2C;AAiBpC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,+EAA+E;IAC/E,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAA,uBAAa,EACX,IAAI,CAAC,UAAU,EACf,wBAAwB,IAAI,CAAC,MAAM,CAAC,QAAQ,2BAA2B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAChG,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,sEAAsE;IACtE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACzE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,IAAA,qCAAsB,EAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,IAAA,uBAAa,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAE7E,SAAS,sBAAsB,CAAC,WAAmB;IACjD,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,IAAA,qBAAW,EAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,oBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,8CAA8C,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,WAAW,EAAE,MAAM,CAAC,CAA2B,CAAC;IAExF,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAQ,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CACjC,OAAO,CAAC,GAAG,CAAC,SAAS,EACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAC9F,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,OAAO;YACP,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,WAAW;YACX,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts

@@ -0,0 +1,20 @@
+import type { HouseCredential } from "./house-credential.js";
+export type RunFn = (cmd: string, args: string[], env: Record<string, string>) => Promise<{
+    stdout: string;
+}>;
+export interface CfExec {
+    d1List(): Promise<{
+        name: string;
+        uuid: string;
+    }[]>;
+    d1Create(name: string): Promise<{
+        uuid: string;
+    }>;
+    d1Query(name: string, sql: string): Promise<unknown>;
+    r2List(): Promise<{
+        name: string;
+    }[]>;
+    r2Create(name: string): Promise<void>;
+}
+export declare function makeCfExec(cred: HouseCredential, run?: RunFn): CfExec;
+//# sourceMappingURL=cf-exec.d.ts.map

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjC,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAqBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,GAAE,KAAkB,GAAG,MAAM,CAgCjF"}

package/payload/platform/lib/storage-broker/dist/cf-exec.js

@@ -0,0 +1,53 @@
+"use strict";
+// The only place the account-wide Cloudflare credential is used to touch
+// Cloudflare. Every method injects the house token into the child env and shells
+// wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeCfExec = makeCfExec;
+const node_child_process_1 = require("node:child_process");
+const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+    (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
+        if (err) {
+            reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+            return;
+        }
+        resolve({ stdout: stdout.toString() });
+    });
+});
+function parseJson(raw, context) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
+    }
+}
+function makeCfExec(cred, run = defaultRun) {
+    const env = {
+        ...process.env,
+        CLOUDFLARE_API_TOKEN: cred.apiToken,
+        CLOUDFLARE_ACCOUNT_ID: cred.accountId,
+    };
+    return {
+        async d1List() {
+            const { stdout } = await run("wrangler", ["d1", "list", "--json"], env);
+            return parseJson(stdout, "d1 list");
+        },
+        async d1Create(name) {
+            const { stdout } = await run("wrangler", ["d1", "create", name, "--json"], env);
+            return parseJson(stdout, "d1 create");
+        },
+        async d1Query(name, sql) {
+            const { stdout } = await run("wrangler", ["d1", "execute", name, "--remote", "--json", "--command", sql], env);
+            return parseJson(stdout, "d1 execute");
+        },
+        async r2List() {
+            const { stdout } = await run("wrangler", ["r2", "bucket", "list", "--json"], env);
+            return parseJson(stdout, "r2 bucket list");
+        },
+        async r2Create(name) {
+            await run("wrangler", ["r2", "bucket", "create", name], env);
+        },
+    };
+}
+//# sourceMappingURL=cf-exec.js.map

package/payload/platform/lib/storage-broker/dist/cf-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAsCjF,gCAgCC;AApED,2DAA8C;AAiB9C,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CAAC,IAAqB,EAAE,MAAa,UAAU;IACvE,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAqB,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,UAAU,EACV,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC/D,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAClF,OAAO,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAuB,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/payload/platform/lib/storage-broker/dist/house-credential.d.ts

@@ -0,0 +1,6 @@
+export interface HouseCredential {
+    apiToken: string;
+    accountId: string;
+}
+export declare function readHouseCredential(platformRoot: string): HouseCredential;
+//# sourceMappingURL=house-credential.d.ts.map

package/payload/platform/lib/storage-broker/dist/house-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"house-credential.d.ts","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,CAkBzE"}

package/payload/platform/lib/storage-broker/dist/house-credential.js

@@ -0,0 +1,33 @@
+"use strict";
+// Reads the single account-wide Cloudflare credential from the house-only
+// config directory. This file is the one place the account-wide capability
+// lives; sub-account spawns never source it. Parses KEY=value lines without
+// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readHouseCredential = readHouseCredential;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+function readHouseCredential(platformRoot) {
+    const path = (0, node_path_1.join)(platformRoot, "config", "cloudflare-house.env");
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(path, "utf8");
+    }
+    catch {
+        throw new Error(`storage-broker: house credential not found at ${path}`);
+    }
+    const env = {};
+    for (const line of raw.split("\n")) {
+        const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+        if (m)
+            env[m[1]] = m[2].trim();
+    }
+    const apiToken = env.CLOUDFLARE_API_TOKEN;
+    const accountId = env.CLOUDFLARE_ACCOUNT_ID;
+    if (!apiToken)
+        throw new Error(`storage-broker: CLOUDFLARE_API_TOKEN missing in ${path}`);
+    if (!accountId)
+        throw new Error(`storage-broker: CLOUDFLARE_ACCOUNT_ID missing in ${path}`);
+    return { apiToken, accountId };
+}
+//# sourceMappingURL=house-credential.js.map

package/payload/platform/lib/storage-broker/dist/house-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"house-credential.js","sourceRoot":"","sources":["../src/house-credential.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;;AAU9E,kDAkBC;AA1BD,qCAAuC;AACvC,yCAAiC;AAOjC,SAAgB,mBAAmB,CAAC,YAAoB;IACtD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./authorize.js";
+export * from "./registry.js";
+export * from "./house-credential.js";
+export * from "./cf-exec.js";
+export * from "./audit.js";
+export * from "./remediate.js";
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/storage-broker/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.js

@@ -0,0 +1,30 @@
+"use strict";
+// storage-broker: the per-account Cloudflare D1/R2 isolation core.
+//
+// The lib is pure and dependency-free at runtime: it opens no Neo4j connection
+// and shells no process on its own. Consumers inject a SessionLike (the ui
+// route uses neo4j-store's getSession; the remediation entry opens its own
+// driver) and, for cf-exec, a RunFn. That keeps every unit testable in
+// isolation and the isolation logic auditable in one place.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authorize.js"), exports);
+__exportStar(require("./registry.js"), exports);
+__exportStar(require("./house-credential.js"), exports);
+__exportStar(require("./cf-exec.js"), exports);
+__exportStar(require("./audit.js"), exports);
+__exportStar(require("./remediate.js"), exports);
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/storage-broker/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,6CAA2B;AAC3B,iDAA+B"}

package/payload/platform/lib/storage-broker/dist/registry.d.ts

@@ -0,0 +1,18 @@
+export interface SessionLike {
+    run(cypher: string, params?: Record<string, unknown>): PromiseLike<{
+        records: Array<{
+            get(key: string): any;
+        }>;
+    }>;
+}
+export type ResourceKind = "d1" | "r2";
+export interface StorageResource {
+    accountId: string;
+    kind: ResourceKind;
+    name: string;
+    cfResourceId: string;
+}
+export declare function registerResource(session: SessionLike, r: StorageResource): Promise<void>;
+export declare function resolveOwner(session: SessionLike, kind: ResourceKind, name: string): Promise<string | null>;
+export declare function listResources(session: SessionLike, accountId: string, kind: ResourceKind): Promise<StorageResource[]>;
+//# sourceMappingURL=registry.d.ts.map

package/payload/platform/lib/storage-broker/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,WAAW;IAC1B,GAAG,CACD,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,WAAW,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,CAAC,EAAE,eAAe,GACjB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,EAAE,CAAC,CAa5B"}