@rubytech/create-maxy-code 0.1.444 → 0.1.446

package/payload/platform/lib/storage-broker/dist/registry.js

@@ -0,0 +1,45 @@
+"use strict";
+// The ownership registry: which account owns which Cloudflare storage resource.
+//
+// Written with raw cypher MERGE stamped with system provenance, mirroring the
+// house-level seedAccountGraphRoot path in the admin plugin. It deliberately
+// does NOT go through graph-write's writeNodeWithEdges: that primitive's
+// accountId floor rejects a write whose props.accountId differs from the
+// writer process's ACCOUNT_ID, and the broker runs house-level, writing nodes
+// owned by many different sub-accounts. The owning accountId here is always the
+// trusted header value the service resolved, never an agent argument.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerResource = registerResource;
+exports.resolveOwner = resolveOwner;
+exports.listResources = listResources;
+async function registerResource(session, r) {
+    // MERGE on (kind, name) — the ownership key. On a shared Cloudflare account a
+    // storage name maps to exactly one owner, so the write key must match the
+    // resolveOwner lookup key; keying on accountId too would let two accounts hold
+    // a node for the same name and make ownership ambiguous. accountId is set only
+    // ON CREATE and never overwritten ON MATCH, so a register can never silently
+    // reassign an existing resource to a different account.
+    await session.run(`MERGE (r:StorageResource {kind: $kind, name: $name})
+       ON CREATE SET r.accountId = $accountId,
+                     r.createdByAgent = 'system',
+                     r.createdBySource = 'storage-broker',
+                     r.cfResourceId = $cfResourceId
+       ON MATCH SET  r.cfResourceId = $cfResourceId`, { accountId: r.accountId, kind: r.kind, name: r.name, cfResourceId: r.cfResourceId });
+}
+async function resolveOwner(session, kind, name) {
+    const res = await session.run(`MATCH (r:StorageResource {kind: $kind, name: $name})
+       RETURN r.accountId AS accountId LIMIT 1`, { kind, name });
+    return res.records.length ? res.records[0].get("accountId") : null;
+}
+async function listResources(session, accountId, kind) {
+    const res = await session.run(`MATCH (r:StorageResource {accountId: $accountId, kind: $kind})
+       RETURN r.name AS name, r.cfResourceId AS cfResourceId
+       ORDER BY r.name`, { accountId, kind });
+    return res.records.map((rec) => ({
+        accountId,
+        kind,
+        name: rec.get("name"),
+        cfResourceId: rec.get("cfResourceId"),
+    }));
+}
+//# sourceMappingURL=registry.js.map

package/payload/platform/lib/storage-broker/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,sEAAsE;;AAyBtE,4CAmBC;AAED,oCAWC;AAED,sCAiBC;AAnDM,KAAK,UAAU,gBAAgB,CACpC,OAAoB,EACpB,CAAkB;IAElB,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,OAAO,CAAC,GAAG,CACf;;;;;oDAKgD,EAChD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CACrF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,OAAoB,EACpB,IAAkB,EAClB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B;+CAC2C,EAC3C,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,SAAiB,EACjB,IAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B;;uBAEmB,EACnB,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,SAAS;QACT,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAW;QAC/B,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAW;KAChD,CAAC,CAAC,CAAC;AACN,CAAC"}

package/payload/platform/lib/storage-broker/dist/remediate.d.ts

@@ -0,0 +1,7 @@
+export interface MappingResult {
+    ok: boolean;
+    missing: string[];
+}
+export declare function validateMapping(enumerated: string[], mapping: Record<string, string>): MappingResult;
+export declare function stripAccountWideTokens(contents: string): string;
+//# sourceMappingURL=remediate.d.ts.map

package/payload/platform/lib/storage-broker/dist/remediate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAOD,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,aAAa,CAGf;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/payload/platform/lib/storage-broker/dist/remediate.js

@@ -0,0 +1,25 @@
+"use strict";
+// The testable core of the operator-run remediation. The mapping from existing
+// resource name to owning account is operator-authored, and validation fails
+// closed on any resource absent from it: ownership is a recorded fact, never a
+// name-prefix guess. Token stripping removes every account-wide credential from
+// a sub-account secrets file while preserving everything else verbatim.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateMapping = validateMapping;
+exports.stripAccountWideTokens = stripAccountWideTokens;
+// Account-wide credentials stripped from a sub-account's cloudflare.env.
+// CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
+// credential, and does not grant access on its own.
+const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+function validateMapping(enumerated, mapping) {
+    const missing = enumerated.filter((name) => !(name in mapping));
+    return { ok: missing.length === 0, missing };
+}
+function stripAccountWideTokens(contents) {
+    const kept = contents.split("\n").filter((line) => {
+        const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+        return !(key && STRIP_KEYS.includes(key));
+    });
+    return kept.join("\n");
+}
+//# sourceMappingURL=remediate.js.map

package/payload/platform/lib/storage-broker/dist/remediate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediate.js","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;;AAYxE,0CAMC;AAED,wDAMC;AAnBD,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,MAAM,UAAU,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AAEnF,SAAgB,eAAe,CAC7B,UAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/audit.test.ts

@@ -0,0 +1,49 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { reconcileStorage, type AuditDeps } from "../audit.js";
+
+const clean: AuditDeps = {
+  cfD1: async () => ["gls-leads"],
+  cfR2: async () => [],
+  registeredNames: async (k) => (k === "d1" ? ["gls-leads"] : []),
+  accountSecretsFiles: async () => [
+    { accountId: "acc-a", path: "/x", contents: "SOME_OTHER=1\nCLOUDFLARE_ACCOUNT_ID=acc\n" },
+  ],
+};
+
+test("clean install reports zero strays", async () => {
+  const { strays } = await reconcileStorage(clean);
+  assert.deepEqual(strays, []);
+});
+
+test("flags an unregistered D1 database", async () => {
+  const { strays } = await reconcileStorage({
+    ...clean,
+    cfD1: async () => ["gls-leads", "beagle-investors"],
+  });
+  assert.ok(strays.some((s) => s.kind === "unattributed-d1" && s.detail === "beagle-investors"));
+});
+
+test("flags a lingering account-wide token", async () => {
+  const { strays } = await reconcileStorage({
+    ...clean,
+    accountSecretsFiles: async () => [
+      { accountId: "acc-a", path: "/x", contents: "CF_PAGES_D1_TOKEN=cfat_leak\n" },
+    ],
+  });
+  assert.ok(
+    strays.some((s) => s.kind === "account-wide-token" && s.detail.includes("acc-a")),
+  );
+});
+
+test("flags a lingering master token", async () => {
+  const { strays } = await reconcileStorage({
+    ...clean,
+    accountSecretsFiles: async () => [
+      { accountId: "acc-b", path: "/y", contents: "CLOUDFLARE_API_TOKEN=cfat_master\n" },
+    ],
+  });
+  assert.ok(
+    strays.some((s) => s.kind === "account-wide-token" && s.detail === "acc-b:CLOUDFLARE_API_TOKEN"),
+  );
+});

package/payload/platform/lib/storage-broker/src/__tests__/authorize.test.ts

@@ -0,0 +1,28 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { authorizeAccess } from "../authorize.js";
+
+test("allows the owner", () => {
+  assert.deepEqual(
+    authorizeAccess({ caller: "acc-a", owner: "acc-a", action: "write" }),
+    { allow: true, reason: "owner" },
+  );
+});
+
+test("denies a different owner", () => {
+  const d = authorizeAccess({ caller: "acc-a", owner: "acc-b", action: "read" });
+  assert.equal(d.allow, false);
+  assert.equal(d.reason, "cross-account");
+});
+
+test("denies an unregistered resource (owner null)", () => {
+  const d = authorizeAccess({ caller: "acc-a", owner: null, action: "read" });
+  assert.equal(d.allow, false);
+  assert.equal(d.reason, "unregistered");
+});
+
+test("denies an empty caller", () => {
+  const d = authorizeAccess({ caller: "", owner: "acc-a", action: "read" });
+  assert.equal(d.allow, false);
+  assert.equal(d.reason, "no-caller");
+});

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -0,0 +1,52 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { makeCfExec, type RunFn } from "../cf-exec.js";
+
+const cred = { apiToken: "cfat_x", accountId: "acc-h" };
+
+function recordingRun(stdout: string) {
+  const calls: Array<{ cmd: string; args: string[]; env: Record<string, string> }> = [];
+  const run: RunFn = async (cmd, args, env) => {
+    calls.push({ cmd, args, env });
+    return { stdout };
+  };
+  return { run, calls };
+}
+
+test("d1List parses --json output and injects the house token", async () => {
+  const { run, calls } = recordingRun(JSON.stringify([{ name: "gls-leads", uuid: "u1" }]));
+  const cf = makeCfExec(cred, run);
+  assert.deepEqual(await cf.d1List(), [{ name: "gls-leads", uuid: "u1" }]);
+  assert.equal(calls[0].cmd, "wrangler");
+  assert.deepEqual(calls[0].args, ["d1", "list", "--json"]);
+  assert.equal(calls[0].env.CLOUDFLARE_API_TOKEN, "cfat_x");
+  assert.equal(calls[0].env.CLOUDFLARE_ACCOUNT_ID, "acc-h");
+});
+
+test("d1Query runs execute --remote with the SQL", async () => {
+  const { run, calls } = recordingRun(JSON.stringify([{ results: [] }]));
+  const cf = makeCfExec(cred, run);
+  await cf.d1Query("gls-leads", "SELECT 1");
+  assert.deepEqual(calls[0].args, [
+    "d1", "execute", "gls-leads", "--remote", "--json", "--command", "SELECT 1",
+  ]);
+});
+
+test("d1Create parses the created uuid", async () => {
+  const { run } = recordingRun(JSON.stringify({ uuid: "new-db" }));
+  const cf = makeCfExec(cred, run);
+  assert.deepEqual(await cf.d1Create("gls-new"), { uuid: "new-db" });
+});
+
+test("r2Create shells wrangler r2 bucket create", async () => {
+  const { run, calls } = recordingRun("");
+  const cf = makeCfExec(cred, run);
+  await cf.r2Create("gls-assets");
+  assert.deepEqual(calls[0].args, ["r2", "bucket", "create", "gls-assets"]);
+});
+
+test("non-JSON output throws with the raw body", async () => {
+  const { run } = recordingRun("not json");
+  const cf = makeCfExec(cred, run);
+  await assert.rejects(() => cf.d1List(), /not json/);
+});

package/payload/platform/lib/storage-broker/src/__tests__/house-credential.test.ts

@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { readHouseCredential } from "../house-credential.js";
+
+function houseRoot(contents: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "sb-house-"));
+  mkdirSync(join(dir, "config"));
+  writeFileSync(join(dir, "config", "cloudflare-house.env"), contents);
+  return dir;
+}
+
+test("parses master token + account id", () => {
+  const dir = houseRoot("CLOUDFLARE_API_TOKEN=cfat_abc\nCLOUDFLARE_ACCOUNT_ID=acc-house\n");
+  try {
+    assert.deepEqual(readHouseCredential(dir), { apiToken: "cfat_abc", accountId: "acc-house" });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("throws when the token key is absent", () => {
+  const dir = houseRoot("CLOUDFLARE_ACCOUNT_ID=acc-house\n");
+  try {
+    assert.throws(() => readHouseCredential(dir), /CLOUDFLARE_API_TOKEN/);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("throws when the file is absent", () => {
+  assert.throws(() => readHouseCredential("/no/such/root"), /cloudflare-house\.env/);
+});

package/payload/platform/lib/storage-broker/src/__tests__/registry.test.ts

@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { registerResource, resolveOwner, listResources, type SessionLike } from "../registry.js";
+
+function fakeSession(records: Array<{ get(key: string): unknown }>) {
+  const calls: Array<{ cypher: string; params?: Record<string, unknown> }> = [];
+  const session: SessionLike = {
+    async run(cypher, params) {
+      calls.push({ cypher, params });
+      return { records };
+    },
+  };
+  return { session, calls };
+}
+
+test("registerResource MERGEs on (kind, name) and sets accountId only on create", async () => {
+  const { session, calls } = fakeSession([]);
+  await registerResource(session, {
+    accountId: "acc-a",
+    kind: "d1",
+    name: "gls-leads",
+    cfResourceId: "db-123",
+  });
+  // Ownership key is (kind, name): a name maps to exactly one owner on the
+  // shared account, so resolveOwner's lookup key and the write key must agree.
+  assert.match(
+    calls[0].cypher,
+    /MERGE \(r:StorageResource \{kind: \$kind, name: \$name\}\)/,
+  );
+  // accountId is set ON CREATE and never overwritten ON MATCH (no silent takeover).
+  assert.match(calls[0].cypher, /ON CREATE SET r\.accountId = \$accountId/);
+  assert.doesNotMatch(calls[0].cypher, /ON MATCH SET[\s\S]*accountId/);
+  assert.match(calls[0].cypher, /r\.createdByAgent = 'system'/);
+  assert.match(calls[0].cypher, /r\.createdBySource = 'storage-broker'/);
+  assert.deepEqual(calls[0].params, {
+    accountId: "acc-a",
+    kind: "d1",
+    name: "gls-leads",
+    cfResourceId: "db-123",
+  });
+});
+
+test("resolveOwner returns the owning accountId, or null when absent", async () => {
+  const found = fakeSession([{ get: () => "acc-b" }]);
+  assert.equal(await resolveOwner(found.session, "d1", "beagle-investors"), "acc-b");
+
+  const missing = fakeSession([]);
+  assert.equal(await resolveOwner(missing.session, "d1", "no-such"), null);
+});
+
+test("listResources returns only the account's resources of a kind", async () => {
+  const { session, calls } = fakeSession([
+    { get: (k: string) => ({ name: "gls-leads", cfResourceId: "db-1" } as Record<string, unknown>)[k] },
+  ]);
+  const rows = await listResources(session, "acc-a", "d1");
+  assert.deepEqual(rows, [
+    { accountId: "acc-a", kind: "d1", name: "gls-leads", cfResourceId: "db-1" },
+  ]);
+  assert.match(
+    calls[0].cypher,
+    /MATCH \(r:StorageResource \{accountId: \$accountId, kind: \$kind\}\)/,
+  );
+  assert.deepEqual(calls[0].params, { accountId: "acc-a", kind: "d1" });
+});

package/payload/platform/lib/storage-broker/src/__tests__/remediate-run.test.ts

@@ -0,0 +1,79 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runRemediation, type RemediationDeps } from "../bin/remediate-run.js";
+import type { StorageResource } from "../registry.js";
+
+function fixture(): { root: string; accountsDir: string; configPath: string } {
+  const root = mkdtempSync(join(tmpdir(), "sb-remediate-"));
+  const accountsDir = join(root, "data", "accounts");
+  for (const acc of ["acc-a", "acc-b"]) {
+    mkdirSync(join(accountsDir, acc, "secrets"), { recursive: true });
+    writeFileSync(
+      join(accountsDir, acc, "secrets", "cloudflare.env"),
+      `CLOUDFLARE_ACCOUNT_ID=shared\nCLOUDFLARE_API_TOKEN=cfat_master\nCF_PAGES_D1_TOKEN=cfat_pd\nCF_DNS_TOKEN=keep\n`,
+    );
+  }
+  return { root, accountsDir, configPath: join(root, "config", "cloudflare-house.env") };
+}
+
+function baseDeps(f: ReturnType<typeof fixture>, registered: StorageResource[]): RemediationDeps {
+  return {
+    cfD1: async () => [{ name: "gls-leads", cfResourceId: "u1" }],
+    cfR2: async () => [],
+    mapping: { "gls-leads": "acc-a" },
+    register: async (r) => { registered.push(r); },
+    accountsDir: f.accountsDir,
+    master: { apiToken: "cfat_master", accountId: "shared" },
+    configPath: f.configPath,
+  };
+}
+
+test("fails closed on an unmapped resource and writes nothing", async () => {
+  const f = fixture();
+  const registered: StorageResource[] = [];
+  const deps = { ...baseDeps(f, registered), cfD1: async () => [
+    { name: "gls-leads", cfResourceId: "u1" },
+    { name: "beagle-investors", cfResourceId: "u2" },
+  ] };
+  try {
+    await assert.rejects(() => runRemediation(deps), /unmapped resources: beagle-investors/);
+    assert.equal(registered.length, 0, "no resource registered on abort");
+    assert.equal(existsSync(f.configPath), false, "no house config written on abort");
+    const secrets = readFileSync(join(f.accountsDir, "acc-a", "secrets", "cloudflare.env"), "utf8");
+    assert.match(secrets, /CLOUDFLARE_API_TOKEN=cfat_master/, "secrets untouched on abort");
+  } finally {
+    rmSync(f.root, { recursive: true, force: true });
+  }
+});
+
+test("registers, relocates the master, and strips every account-wide token", async () => {
+  const f = fixture();
+  const registered: StorageResource[] = [];
+  try {
+    const result = await runRemediation(baseDeps(f, registered));
+    assert.equal(result.registered, 1);
+    assert.deepEqual(registered, [
+      { accountId: "acc-a", kind: "d1", name: "gls-leads", cfResourceId: "u1" },
+    ]);
+
+    // House config now holds the master.
+    const house = readFileSync(f.configPath, "utf8");
+    assert.match(house, /CLOUDFLARE_API_TOKEN=cfat_master/);
+    assert.match(house, /CLOUDFLARE_ACCOUNT_ID=shared/);
+
+    // Both sub-account secrets are stripped of account-wide tokens, scoped kept.
+    for (const acc of ["acc-a", "acc-b"]) {
+      const s = readFileSync(join(f.accountsDir, acc, "secrets", "cloudflare.env"), "utf8");
+      assert.doesNotMatch(s, /CLOUDFLARE_API_TOKEN=/);
+      assert.doesNotMatch(s, /CF_PAGES_D1_TOKEN=/);
+      assert.match(s, /CF_DNS_TOKEN=keep/);
+      assert.match(s, /CLOUDFLARE_ACCOUNT_ID=shared/);
+    }
+    assert.equal(result.strippedFiles.length, 2);
+  } finally {
+    rmSync(f.root, { recursive: true, force: true });
+  }
+});

package/payload/platform/lib/storage-broker/src/__tests__/remediate.test.ts

@@ -0,0 +1,21 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateMapping, stripAccountWideTokens } from "../remediate.js";
+
+test("fails closed on an unmapped resource", () => {
+  const r = validateMapping(["gls-leads", "beagle-investors"], { "gls-leads": "acc-a" });
+  assert.deepEqual(r, { ok: false, missing: ["beagle-investors"] });
+});
+
+test("passes when every resource is mapped", () => {
+  assert.deepEqual(validateMapping(["gls-leads"], { "gls-leads": "acc-a" }), {
+    ok: true,
+    missing: [],
+  });
+});
+
+test("strips only account-wide token lines, keeps the account id and scoped tokens", () => {
+  const before =
+    "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
+  assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
+});

package/payload/platform/lib/storage-broker/src/audit.ts

@@ -0,0 +1,55 @@
+// The standing audit: an independent periodic reconcile, not a per-action log,
+// because the failure mode is a no-event blind spot. A mis-registered resource
+// or a stray account-wide token leaks nothing until an agent happens to touch
+// it. This reconciles what Cloudflare has against what the registry records and
+// against what the per-account secrets files still carry.
+
+export type StrayKind = "unattributed-d1" | "unattributed-r2" | "account-wide-token";
+
+export interface Stray {
+  kind: StrayKind;
+  detail: string;
+}
+
+// Keys that must never remain in a sub-account's cloudflare.env after
+// remediation. Each is an account-wide capability.
+const ACCOUNT_WIDE_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+
+export interface AuditDeps {
+  cfD1(): Promise<string[]>;
+  cfR2(): Promise<string[]>;
+  registeredNames(kind: "d1" | "r2"): Promise<string[]>;
+  accountSecretsFiles(): Promise<Array<{ accountId: string; path: string; contents: string }>>;
+}
+
+export async function reconcileStorage(deps: AuditDeps): Promise<{ strays: Stray[] }> {
+  const strays: Stray[] = [];
+
+  const [cfD1, cfR2, regD1, regR2, secretsFiles] = await Promise.all([
+    deps.cfD1(),
+    deps.cfR2(),
+    deps.registeredNames("d1"),
+    deps.registeredNames("r2"),
+    deps.accountSecretsFiles(),
+  ]);
+
+  const regD1Set = new Set(regD1);
+  for (const name of cfD1) {
+    if (!regD1Set.has(name)) strays.push({ kind: "unattributed-d1", detail: name });
+  }
+  const regR2Set = new Set(regR2);
+  for (const name of cfR2) {
+    if (!regR2Set.has(name)) strays.push({ kind: "unattributed-r2", detail: name });
+  }
+
+  for (const file of secretsFiles) {
+    for (const line of file.contents.split("\n")) {
+      const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+      if (key && ACCOUNT_WIDE_KEYS.includes(key)) {
+        strays.push({ kind: "account-wide-token", detail: `${file.accountId}:${key}` });
+      }
+    }
+  }
+
+  return { strays };
+}

package/payload/platform/lib/storage-broker/src/authorize.ts

@@ -0,0 +1,22 @@
+// The pure ownership decision at the centre of the storage broker. No I/O:
+// given who is calling and who owns a resource, decide allow or deny. The
+// caller identity is always the trusted header value the service resolved,
+// never an agent-supplied argument.
+
+export type StorageAction = "list" | "read" | "write";
+
+export interface AccessDecision {
+  allow: boolean;
+  reason: string;
+}
+
+export function authorizeAccess(params: {
+  caller: string;
+  owner: string | null;
+  action: StorageAction;
+}): AccessDecision {
+  if (!params.caller) return { allow: false, reason: "no-caller" };
+  if (params.owner === null) return { allow: false, reason: "unregistered" };
+  if (params.owner !== params.caller) return { allow: false, reason: "cross-account" };
+  return { allow: true, reason: "owner" };
+}

package/payload/platform/lib/storage-broker/src/bin/remediate-run.ts

@@ -0,0 +1,156 @@
+// Operator-run remediation of an existing multi-tenant install. Registers every
+// existing D1 database and R2 bucket to its owning account, relocates the master
+// token into the house-only config file, and strips every account-wide token
+// from every sub-account secrets file. Fails closed on any enumerated resource
+// the operator did not map: ownership is never guessed.
+//
+// runRemediation is the testable core (all effects injected or against a given
+// directory). main() wires the real deps and is the on-device entry the shell
+// wrapper calls.
+
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { validateMapping, stripAccountWideTokens } from "../remediate.js";
+import { registerResource, type StorageResource } from "../registry.js";
+import { readHouseCredential } from "../house-credential.js";
+import { makeCfExec } from "../cf-exec.js";
+
+export interface RemediationDeps {
+  cfD1(): Promise<Array<{ name: string; cfResourceId: string }>>;
+  cfR2(): Promise<Array<{ name: string; cfResourceId: string }>>;
+  mapping: Record<string, string>;
+  register(r: StorageResource): Promise<void>;
+  accountsDir: string;
+  master: { apiToken: string; accountId: string };
+  configPath: string;
+}
+
+export interface RemediationResult {
+  registered: number;
+  strippedFiles: string[];
+}
+
+export async function runRemediation(deps: RemediationDeps): Promise<RemediationResult> {
+  const d1 = await deps.cfD1();
+  const r2 = await deps.cfR2();
+  const enumerated = [...d1.map((x) => x.name), ...r2.map((x) => x.name)];
+
+  // Fail closed BEFORE any write: an enumerated resource with no mapped owner
+  // aborts the whole run, leaving the install untouched.
+  const validation = validateMapping(enumerated, deps.mapping);
+  if (!validation.ok) {
+    throw new Error(`storage-broker remediation: unmapped resources: ${validation.missing.join(", ")}`);
+  }
+
+  for (const x of d1) {
+    await deps.register({ accountId: deps.mapping[x.name], kind: "d1", name: x.name, cfResourceId: x.cfResourceId });
+  }
+  for (const x of r2) {
+    await deps.register({ accountId: deps.mapping[x.name], kind: "r2", name: x.name, cfResourceId: x.cfResourceId });
+  }
+
+  // Relocate the master into the house-only config file (read before stripping).
+  mkdirSync(dirname(deps.configPath), { recursive: true });
+  writeFileSync(
+    deps.configPath,
+    `CLOUDFLARE_API_TOKEN=${deps.master.apiToken}\nCLOUDFLARE_ACCOUNT_ID=${deps.master.accountId}\n`,
+    { mode: 0o600 },
+  );
+
+  // Strip every account-wide token from every sub-account secrets file.
+  const strippedFiles: string[] = [];
+  if (existsSync(deps.accountsDir)) {
+    for (const accountId of readdirSync(deps.accountsDir)) {
+      const p = join(deps.accountsDir, accountId, "secrets", "cloudflare.env");
+      if (!existsSync(p)) continue;
+      const before = readFileSync(p, "utf8");
+      const after = stripAccountWideTokens(before);
+      if (after !== before) {
+        writeFileSync(p, after, { mode: 0o600 });
+        strippedFiles.push(p);
+      }
+    }
+  }
+
+  return { registered: d1.length + r2.length, strippedFiles };
+}
+
+// --- on-device CLI (untested glue) ----------------------------------------
+
+function findMasterFromAccounts(accountsDir: string): { apiToken: string; accountId: string } | null {
+  if (!existsSync(accountsDir)) return null;
+  for (const accountId of readdirSync(accountsDir)) {
+    const p = join(accountsDir, accountId, "secrets", "cloudflare.env");
+    if (!existsSync(p)) continue;
+    const env: Record<string, string> = {};
+    for (const line of readFileSync(p, "utf8").split("\n")) {
+      const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+      if (m) env[m[1]] = m[2].trim();
+    }
+    if (env.CLOUDFLARE_API_TOKEN && env.CLOUDFLARE_ACCOUNT_ID) {
+      return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID };
+    }
+  }
+  return null;
+}
+
+async function main(): Promise<void> {
+  const mappingFile = process.argv[2];
+  if (!mappingFile || !existsSync(mappingFile)) {
+    console.error(`[remediate] error: mapping file not found: ${mappingFile ?? "(none)"}`);
+    process.exit(2);
+  }
+  const platformRoot = process.env.PLATFORM_ROOT;
+  if (!platformRoot) {
+    console.error("[remediate] error: PLATFORM_ROOT not set");
+    process.exit(2);
+  }
+  const accountsDir = resolve(platformRoot, "..", "data", "accounts");
+  const configPath = join(platformRoot, "config", "cloudflare-house.env");
+  const mapping = JSON.parse(readFileSync(mappingFile, "utf8")) as Record<string, string>;
+
+  // The master is wherever it lives today: the house file if already relocated,
+  // else the first sub-account secrets file that still carries it.
+  let master: { apiToken: string; accountId: string };
+  try {
+    master = readHouseCredential(platformRoot);
+  } catch {
+    const found = findMasterFromAccounts(accountsDir);
+    if (!found) {
+      console.error("[remediate] error: no Cloudflare master token found in house config or account secrets");
+      process.exit(2);
+      return;
+    }
+    master = found;
+  }
+
+  const cf = makeCfExec(master);
+  const neo4j = (await import("neo4j-driver")) as any;
+  const driver = neo4j.default.driver(
+    process.env.NEO4J_URI,
+    neo4j.default.auth.basic(process.env.NEO4J_USER ?? "neo4j", process.env.NEO4J_PASSWORD ?? ""),
+  );
+  const session = driver.session();
+  try {
+    const result = await runRemediation({
+      cfD1: async () => (await cf.d1List()).map((d) => ({ name: d.name, cfResourceId: d.uuid })),
+      cfR2: async () => (await cf.r2List()).map((b) => ({ name: b.name, cfResourceId: b.name })),
+      mapping,
+      register: (r) => registerResource(session, r),
+      accountsDir,
+      master,
+      configPath,
+    });
+    console.error(`[remediate] done registered=${result.registered} stripped=${result.strippedFiles.length}`);
+  } finally {
+    await session.close();
+    await driver.close();
+  }
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`[remediate] error: ${(err as Error).message}`);
+    process.exit(1);
+  });
+}