@rubytech/create-maxy-code 0.1.449 → 0.1.450

package/dist/__tests__/preserve-house-cloudflare.test.js

@@ -0,0 +1,59 @@
+// Task 1664 — acceptance for the installer preserving the storage-broker house
+// credential (platform/config/cloudflare-house.env) across an upgrade. The
+// upgrade path wipes platform/ and re-copies the payload; without a
+// save-before-wipe / restore-after-deploy round trip the credential is lost on
+// every upgrade. Filesystem fixtures under a tmp dir; no installer side effects.
+// Runs under `node --test dist/__tests__/*`.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { backupHouseCloudflare, restoreHouseCloudflare } from "../preserve-house-cloudflare.js";
+function makeDirs() {
+    const root = mkdtempSync(join(tmpdir(), "house-1664-"));
+    const installDir = join(root, "install");
+    const persistentDir = join(root, "persist");
+    const configDir = join(installDir, "platform/config");
+    mkdirSync(configDir, { recursive: true });
+    mkdirSync(persistentDir, { recursive: true });
+    return { root, installDir, persistentDir, configDir };
+}
+// Reproduce the upgrade sequence the installer runs: back up the live config,
+// wipe platform/ (rm the whole config dir), re-create the payload's config dir,
+// then restore.
+function simulateUpgrade(installDir, persistentDir) {
+    backupHouseCloudflare(installDir, persistentDir);
+    rmSync(join(installDir, "platform"), { recursive: true, force: true });
+    mkdirSync(join(installDir, "platform/config"), { recursive: true });
+    restoreHouseCloudflare(installDir, persistentDir);
+}
+test("an existing house credential survives an upgrade byte-identical", () => {
+    const { root, installDir, persistentDir, configDir } = makeDirs();
+    try {
+        const live = join(configDir, "cloudflare-house.env");
+        const contents = "CLOUDFLARE_API_TOKEN=abc123\nCLOUDFLARE_ACCOUNT_ID=deadbeef\n";
+        writeFileSync(live, contents);
+        assert.equal(backupHouseCloudflare(installDir, persistentDir), true, "backup reports a file was saved");
+        simulateUpgrade(installDir, persistentDir);
+        const after = join(installDir, "platform/config", "cloudflare-house.env");
+        assert.ok(existsSync(after), "house credential is present after the upgrade");
+        assert.equal(readFileSync(after, "utf-8"), contents, "house credential is byte-identical after the upgrade");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("a fresh install with no house credential creates nothing", () => {
+    const { root, installDir, persistentDir } = makeDirs();
+    try {
+        assert.equal(backupHouseCloudflare(installDir, persistentDir), false, "backup reports nothing to save");
+        simulateUpgrade(installDir, persistentDir);
+        assert.equal(restoreHouseCloudflare(installDir, persistentDir), false, "restore reports nothing to restore");
+        assert.ok(!existsSync(join(installDir, "platform/config", "cloudflare-house.env")), "no house credential file is fabricated on a fresh install");
+        assert.ok(!existsSync(join(persistentDir, "cloudflare-house.env")), "no persistent house credential file is fabricated on a fresh install");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/index.js

@@ -11,6 +11,7 @@ import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig,
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
 import { removeClientAdminsKey } from "./converge-client-admins.js";
+import { backupHouseCloudflare, restoreHouseCloudflare } from "./preserve-house-cloudflare.js";
 import { resolveNeo4jPidfileScrub } from "./neo4j-pidfile-scrub.js";
 import { runInitLogging } from "./init-logging.js";
 import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
@@ -2513,6 +2514,13 @@ function deployPayload() {
         cpSync(liveEmailCredFile, persistentEmailCredFile);
         console.log("  Saved email credentials to persistent store.");
     }
+    // Task 1664 — the storage-broker house credential (cloudflare-house.env) is a
+    // live-only file under platform/config with no persistent source, same as the
+    // email credentials above. Save it before the wipe so the upgrade does not
+    // delete the token the 1631 remediation established.
+    if (backupHouseCloudflare(INSTALL_DIR, persistentDir)) {
+        console.log("  Saved Cloudflare house credential to persistent store.");
+    }
     // Wipe deployment directories to prevent stale files.
     // data/ is NOT wiped — it contains user data (accounts, uploads) that must survive.
     for (const dir of ["platform", "server", "maxy", "premium-plugins", "docs", ".claude"]) {
@@ -2544,6 +2552,12 @@ function deployPayload() {
         chmodSync(join(configDir, "email-credentials.json"), 0o600);
         console.log("  Restored email credentials.");
     }
+    // Task 1664 — restore the storage-broker house credential after deploy so it
+    // is byte-identical to the pre-upgrade file. The named log line lets the
+    // operator confirm the credential survived rather than inferring it.
+    if (restoreHouseCloudflare(INSTALL_DIR, persistentDir)) {
+        console.log("  Restored Cloudflare house credential (cloudflare-house.env preserved).");
+    }
     // users.json is read directly from persistentDir by both
     // platform/ui/app/lib/paths.ts (USERS_FILE = MAXY_DIR/users.json) and the
     // admin MCP plugin (USERS_FILE = CONFIG_DIR/users.json). No copy into the

package/dist/preserve-house-cloudflare.js

@@ -0,0 +1,37 @@
+// Task 1664 — the storage-broker house credential lives only at
+// platform/config/cloudflare-house.env (Task 1631), inside the installer's
+// platform/ wipe zone, with no persistent source of truth. Like
+// email-credentials.json it must be saved before the wipe and restored after
+// the payload deploy, or every upgrade deletes it and the broker (plus the
+// calendar reconcile/publish scripts) fails with "house credential not found"
+// until an operator re-mints the token by hand. The persistent copy lives in
+// the brand's persistent config dir so even a full reinstall restores it.
+import { existsSync, cpSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+const HOUSE_CRED_FILE = "cloudflare-house.env";
+/**
+ * Copy the live house credential (if any) into the persistent store before the
+ * platform/ wipe. Returns true when a file was saved, false when none existed
+ * (fresh install — nothing to preserve).
+ */
+export function backupHouseCloudflare(installDir, persistentDir) {
+    const live = join(installDir, "platform/config", HOUSE_CRED_FILE);
+    if (!existsSync(live))
+        return false;
+    cpSync(live, join(persistentDir, HOUSE_CRED_FILE));
+    return true;
+}
+/**
+ * Restore the house credential from the persistent store after the payload
+ * deploy, chmod 600 (it is an account-wide token). Returns true when a file was
+ * restored, false when none was ever saved.
+ */
+export function restoreHouseCloudflare(installDir, persistentDir) {
+    const saved = join(persistentDir, HOUSE_CRED_FILE);
+    if (!existsSync(saved))
+        return false;
+    const dest = join(installDir, "platform/config", HOUSE_CRED_FILE);
+    cpSync(saved, dest);
+    chmodSync(dest, 0o600);
+    return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.449",
+  "version": "0.1.450",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/storage-broker/dist/__tests__/cf-exec.test.js

@@ -15,6 +15,19 @@ function recordingRun(stdout) {
     };
     return { run, calls };
 }
+// r2List hits the Cloudflare R2 API, not wrangler, so it needs a fetch seam.
+// A run that throws proves r2List never shells wrangler.
+const throwingRun = async () => {
+    throw new Error("r2List must not shell wrangler");
+};
+function recordingFetch(response) {
+    const calls = [];
+    const fetchFn = async (url, init) => {
+        calls.push({ url, init });
+        return { ok: response.ok, status: response.status, text: async () => response.body };
+    };
+    return { fetchFn, calls };
+}
 (0, node_test_1.default)("d1List parses --json output and injects the house token", async () => {
     const { run, calls } = recordingRun(JSON.stringify([{ name: "gls-leads", uuid: "u1" }]));
     const cf = (0, cf_exec_js_1.makeCfExec)(cred, run);
@@ -45,6 +58,55 @@ function recordingRun(stdout) {
     strict_1.default.equal(calls[0].cmd, "npx");
     strict_1.default.deepEqual(calls[0].args, ["wrangler", "r2", "bucket", "create", "gls-assets"]);
 });
+(0, node_test_1.default)("r2List returns the account's buckets from the R2 API with the house token", async () => {
+    const { fetchFn, calls } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: JSON.stringify({
+            success: true,
+            errors: [],
+            messages: [],
+            result: {
+                buckets: [
+                    { name: "gls-assets", creation_date: "2026-01-01T00:00:00Z" },
+                    { name: "gls-docs", creation_date: "2026-01-02T00:00:00Z" },
+                ],
+            },
+        }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    strict_1.default.deepEqual(await cf.r2List(), [{ name: "gls-assets" }, { name: "gls-docs" }]);
+    strict_1.default.equal(calls[0].url, "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets");
+    strict_1.default.equal(calls[0].init.method, "GET");
+    strict_1.default.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+(0, node_test_1.default)("r2List returns [] for an account with no buckets", async () => {
+    const { fetchFn } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: JSON.stringify({ success: true, errors: [], messages: [], result: { buckets: [] } }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    strict_1.default.deepEqual(await cf.r2List(), []);
+});
+(0, node_test_1.default)("r2List throws with the API error body on a non-2xx response", async () => {
+    const { fetchFn } = recordingFetch({
+        ok: false,
+        status: 403,
+        body: JSON.stringify({ success: false, errors: [{ code: 10000, message: "Authentication error" }] }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await strict_1.default.rejects(() => cf.r2List(), /403[\s\S]*Authentication error/);
+});
+(0, node_test_1.default)("r2List throws on a 200 whose body is not a success envelope, retaining the body", async () => {
+    const { fetchFn } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: JSON.stringify({ unexpected: "shape" }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await strict_1.default.rejects(() => cf.r2List(), /unexpected/);
+});
 (0, node_test_1.default)("non-JSON output throws with the raw body", async () => {
     const { run } = recordingRun("not json");
     const cf = (0, cf_exec_js_1.makeCfExec)(cred, run);

package/payload/platform/lib/storage-broker/dist/__tests__/cf-exec.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.test.js","sourceRoot":"","sources":["../../src/__tests__/cf-exec.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,8CAAuD;AAEvD,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAExD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAwE,EAAE,CAAC;IACtF,MAAM,GAAG,GAAU,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,IAAA,mBAAI,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU;KACxF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cf-exec.test.js","sourceRoot":"","sources":["../../src/__tests__/cf-exec.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,8CAAqE;AAErE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAExD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAwE,EAAE,CAAC;IACtF,MAAM,GAAG,GAAU,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,WAAW,GAAU,KAAK,IAAI,EAAE;IACpC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuD;IAC7E,MAAM,KAAK,GAAsF,EAAE,CAAC;IACpG,MAAM,OAAO,GAAY,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,IAAA,mBAAI,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU;KACxF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChC,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC;QACxC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE;gBACN,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE;oBAC7D,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,sBAAsB,EAAE;iBAC5D;aACF;SACF,CAAC;KACH,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACpF,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,gEAAgE,CAAC,CAAC;IAC7F,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;KACrG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts

@@ -2,6 +2,14 @@ import type { HouseCredential } from "./house-credential.js";
 export type RunFn = (cmd: string, args: string[], env: Record<string, string>) => Promise<{
     stdout: string;
 }>;
+export type FetchFn = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
 export interface CfExec {
     d1List(): Promise<{
         name: string;
@@ -16,5 +24,5 @@ export interface CfExec {
     }[]>;
     r2Create(name: string): Promise<void>;
 }
-export declare function makeCfExec(cred: HouseCredential, run?: RunFn): CfExec;
+export declare function makeCfExec(cred: HouseCredential, run?: RunFn, fetchFn?: FetchFn): CfExec;
 //# sourceMappingURL=cf-exec.d.ts.map

package/payload/platform/lib/storage-broker/dist/cf-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjC,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAqBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,GAAE,KAAkB,GAAG,MAAM,CAmCjF"}
+{"version":3,"file":"cf-exec.d.ts","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,KAAK,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAKjC,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtD,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,MAAM,WAAW,MAAM;IACrB,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAuBD,wBAAgB,UAAU,CACxB,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,KAAkB,EACvB,OAAO,GAAE,OAAsB,GAC9B,MAAM,CAyDR"}

package/payload/platform/lib/storage-broker/dist/cf-exec.js

@@ -5,6 +5,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeCfExec = makeCfExec;
 const node_child_process_1 = require("node:child_process");
+const defaultFetch = (url, init) => fetch(url, init);
 const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
     (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
         if (err) {
@@ -22,7 +23,7 @@ function parseJson(raw, context) {
         throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
     }
 }
-function makeCfExec(cred, run = defaultRun) {
+function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
     const env = {
         ...process.env,
         CLOUDFLARE_API_TOKEN: cred.apiToken,
@@ -45,8 +46,26 @@ function makeCfExec(cred, run = defaultRun) {
             return parseJson(stdout, "d1 execute");
         },
         async r2List() {
-            const { stdout } = await run("npx", ["wrangler", "r2", "bucket", "list", "--json"], env);
-            return parseJson(stdout, "r2 bucket list");
+            // `wrangler r2 bucket list` has no --json flag and emits human prose, so
+            // it can neither be parsed nor honour the "never grep a CLI's prose"
+            // doctrine. The R2 API returns the bucket set as JSON directly.
+            const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+            const res = await fetchFn(url, {
+                method: "GET",
+                headers: { Authorization: `Bearer ${cred.apiToken}` },
+            });
+            const body = await res.text();
+            if (!res.ok) {
+                throw new Error(`storage-broker: r2 bucket list failed: ${res.status}\n${body}`);
+            }
+            const parsed = parseJson(body, "r2 bucket list");
+            // Require an explicit success envelope. A 2xx whose body is not a
+            // well-formed `success:true` response is an anomaly to surface with its
+            // body, never a silent empty bucket set.
+            if (parsed.success !== true) {
+                throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
+            }
+            return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
         },
         async r2Create(name) {
             await run("npx", ["wrangler", "r2", "bucket", "create", name], env);

package/payload/platform/lib/storage-broker/dist/cf-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAsCjF,gCAmCC;AAvED,2DAA8C;AAiB9C,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CAAC,IAAqB,EAAE,MAAa,UAAU;IACvE,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAqB,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAuB,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAgDjF,gCA6DC;AA3GD,2DAA8C;AAyB9C,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAqB,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAI9C,CAAC;YACF,kEAAkE;YAClE,wEAAwE;YACxE,yCAAyC;YACzC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { makeCfExec, type RunFn } from "../cf-exec.js";
+import { makeCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
 
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
 
@@ -13,6 +13,21 @@ function recordingRun(stdout: string) {
   return { run, calls };
 }
 
+// r2List hits the Cloudflare R2 API, not wrangler, so it needs a fetch seam.
+// A run that throws proves r2List never shells wrangler.
+const throwingRun: RunFn = async () => {
+  throw new Error("r2List must not shell wrangler");
+};
+
+function recordingFetch(response: { ok: boolean; status: number; body: string }) {
+  const calls: Array<{ url: string; init: { method: string; headers: Record<string, string> } }> = [];
+  const fetchFn: FetchFn = async (url, init) => {
+    calls.push({ url, init });
+    return { ok: response.ok, status: response.status, text: async () => response.body };
+  };
+  return { fetchFn, calls };
+}
+
 test("d1List parses --json output and injects the house token", async () => {
   const { run, calls } = recordingRun(JSON.stringify([{ name: "gls-leads", uuid: "u1" }]));
   const cf = makeCfExec(cred, run);
@@ -47,6 +62,59 @@ test("r2Create shells wrangler r2 bucket create", async () => {
   assert.deepEqual(calls[0].args, ["wrangler", "r2", "bucket", "create", "gls-assets"]);
 });
 
+test("r2List returns the account's buckets from the R2 API with the house token", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({
+      success: true,
+      errors: [],
+      messages: [],
+      result: {
+        buckets: [
+          { name: "gls-assets", creation_date: "2026-01-01T00:00:00Z" },
+          { name: "gls-docs", creation_date: "2026-01-02T00:00:00Z" },
+        ],
+      },
+    }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [{ name: "gls-assets" }, { name: "gls-docs" }]);
+  assert.equal(calls[0].url, "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets");
+  assert.equal(calls[0].init.method, "GET");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2List returns [] for an account with no buckets", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ success: true, errors: [], messages: [], result: { buckets: [] } }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), []);
+});
+
+test("r2List throws with the API error body on a non-2xx response", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: false,
+    status: 403,
+    body: JSON.stringify({ success: false, errors: [{ code: 10000, message: "Authentication error" }] }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /403[\s\S]*Authentication error/);
+});
+
+test("r2List throws on a 200 whose body is not a success envelope, retaining the body", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ unexpected: "shape" }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /unexpected/);
+});
+
 test("non-JSON output throws with the raw body", async () => {
   const { run } = recordingRun("not json");
   const cf = makeCfExec(cred, run);

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -11,6 +11,14 @@ export type RunFn = (
   env: Record<string, string>,
 ) => Promise<{ stdout: string }>;
 
+// The HTTP seam for the Cloudflare API. Injectable so r2List is unit-testable
+// without a network. Minimal subset of the global fetch: r2List reads the body
+// once via text() and branches on ok/status.
+export type FetchFn = (
+  url: string,
+  init: { method: string; headers: Record<string, string> },
+) => Promise<{ ok: boolean; status: number; text(): Promise<string> }>;
+
 export interface CfExec {
   d1List(): Promise<{ name: string; uuid: string }[]>;
   d1Create(name: string): Promise<{ uuid: string }>;
@@ -19,6 +27,8 @@ export interface CfExec {
   r2Create(name: string): Promise<void>;
 }
 
+const defaultFetch: FetchFn = (url, init) => fetch(url, init);
+
 const defaultRun: RunFn = (cmd, args, env) =>
   new Promise((resolve, reject) => {
     execFile(cmd, args, { env }, (err, stdout, stderr) => {
@@ -38,7 +48,11 @@ function parseJson(raw: string, context: string): unknown {
   }
 }
 
-export function makeCfExec(cred: HouseCredential, run: RunFn = defaultRun): CfExec {
+export function makeCfExec(
+  cred: HouseCredential,
+  run: RunFn = defaultRun,
+  fetchFn: FetchFn = defaultFetch,
+): CfExec {
   const env = {
     ...process.env,
     CLOUDFLARE_API_TOKEN: cred.apiToken,
@@ -66,8 +80,30 @@ export function makeCfExec(cred: HouseCredential, run: RunFn = defaultRun): CfEx
       return parseJson(stdout, "d1 execute");
     },
     async r2List() {
-      const { stdout } = await run("npx", ["wrangler", "r2", "bucket", "list", "--json"], env);
-      return parseJson(stdout, "r2 bucket list") as { name: string }[];
+      // `wrangler r2 bucket list` has no --json flag and emits human prose, so
+      // it can neither be parsed nor honour the "never grep a CLI's prose"
+      // doctrine. The R2 API returns the bucket set as JSON directly.
+      const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+      const res = await fetchFn(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${cred.apiToken}` },
+      });
+      const body = await res.text();
+      if (!res.ok) {
+        throw new Error(`storage-broker: r2 bucket list failed: ${res.status}\n${body}`);
+      }
+      const parsed = parseJson(body, "r2 bucket list") as {
+        success?: boolean;
+        errors?: unknown;
+        result?: { buckets?: { name: string }[] };
+      };
+      // Require an explicit success envelope. A 2xx whose body is not a
+      // well-formed `success:true` response is an anomaly to surface with its
+      // body, never a silent empty bucket set.
+      if (parsed.success !== true) {
+        throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
+      }
+      return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
     },
     async r2Create(name) {
       await run("npx", ["wrangler", "r2", "bucket", "create", name], env);

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -286,5 +286,72 @@ grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted despite no exact group m
 echo "$ERR" | grep -qF "no permission group named 'DNS Write'" && ok "die names the missing exact group" || bad "die message not named: $ERR"
 teardown
 
+# 13. house-env fallback (multi-tenant): the per-account file has NO master
+#     (stripped by the 1631 remediation) but the house env carries it. cf-token
+#     must resolve/mint/persist against the HOUSE env, report src=house, and
+#     leave the stripped per-account file untouched. PLATFORM_ROOT locates the
+#     house env at $ROOT/config/cloudflare-house.env.
+setup "cfat_master_abc"
+# Strip the master from the per-account file (post-remediation state): keep only
+# the non-credential account-id line.
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+HOUSE_ENV="$HOUSE_DIR/cloudflare-house.env"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_ENV" )
+of=$(mktemp); ef=$(mktemp)
+PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -eq 0 ] && ok "house fallback resolves (exit=0)" || { bad "house fallback (exit=$RC)"; echo "  stderr: $ERR" >&2; }
+[ "$OUT" = "CF_PAGES_D1_TOKEN" ] && ok "house fallback stdout is canonical key" || bad "house out='$OUT'"
+grep -q "^CF_PAGES_D1_TOKEN=" "$HOUSE_ENV" && ok "minted token persisted to HOUSE env" || bad "not persisted to house env"
+grep -q "^CF_PAGES_D1_TOKEN=" "$SECRETS" && bad "token wrongly written to stripped per-account file" || ok "stripped per-account file untouched"
+grep -q "^CLOUDFLARE_API_TOKEN=" "$SECRETS" && bad "master reappeared in per-account file" || ok "no master in per-account file"
+echo "$ERR" | grep -q "src=house" && ok "lifeline reports src=house" || bad "no src=house in lifeline: $ERR"
+no_leak "house fallback"
+teardown
+
+# 14. single-tenant unchanged: the per-account file still carries the master, so
+#     NO fallback happens even with a house env present. src=account, and the
+#     token persists to the per-account file exactly as before.
+setup "cfat_master_abc"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_HOUSE_should_not_be_used" "acc123" > "$HOUSE_DIR/cloudflare-house.env" )
+of=$(mktemp); ef=$(mktemp)
+PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -eq 0 ] && ok "single-tenant resolves (exit=0)" || bad "single-tenant (exit=$RC): $ERR"
+grep -q "^CF_PAGES_D1_TOKEN=" "$SECRETS" && ok "single-tenant persists to per-account file" || bad "not persisted to per-account file"
+grep -q "^CF_PAGES_D1_TOKEN=" "$HOUSE_DIR/cloudflare-house.env" && bad "single-tenant wrongly wrote to house env" || ok "house env untouched in single-tenant"
+echo "$ERR" | grep -q "src=account" && ok "lifeline reports src=account" || bad "no src=account in lifeline: $ERR"
+teardown
+
+# 15. fail-closed: stripped per-account file and NO house env reachable (no
+#     PLATFORM_ROOT, no CF_HOUSE_ENV) -> non-zero, no mint, and a message that
+#     names the missing credential source. This is the sub-account posture: a
+#     sub-account spawn carries no PLATFORM_ROOT, so it can never self-resolve.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+of=$(mktemp); ef=$(mktemp)
+env -u PLATFORM_ROOT -u MAXY_PLATFORM_ROOT -u CF_HOUSE_ENV \
+  CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -ne 0 ] && ok "no-master no-house fails closed (exit=$RC)" || bad "did not fail closed (exit=$RC)"
+grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted despite no credential source" || ok "no mint without a credential source"
+echo "$ERR" | grep -qi "no cloudflare master" && ok "die names missing master source" || bad "die message not named: $ERR"
+teardown
+
+# 16. explicit CF_HOUSE_ENV override wins over PLATFORM_ROOT derivation.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+OVERRIDE="$SANDBOX/acme-code/override-house.env"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$OVERRIDE" )
+of=$(mktemp); ef=$(mktemp)
+CF_HOUSE_ENV="$OVERRIDE" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -eq 0 ] && ok "CF_HOUSE_ENV override resolves (exit=0)" || bad "override (exit=$RC): $ERR"
+grep -q "^CF_PAGES_D1_TOKEN=" "$OVERRIDE" && ok "override env received the minted token" || bad "override not persisted"
+echo "$ERR" | grep -q "src=house" && ok "override reports src=house" || bad "override src: $ERR"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -23,6 +23,33 @@ scope="${1:-}"; secrets="${2:-}"
 case "$scope" in pages|d1|dns|access) ;; *) die "unknown scope '${scope}'; use pages|d1|dns|access";; esac
 [ -n "$secrets" ] && [ -r "$secrets" ] || die "secrets file not readable: '${secrets}'"
 
+# House-credential fallback (Task 1662). After the 1631 storage-isolation
+# remediation, a sub-account's cloudflare.env carries NO account-wide master; the
+# sole master lives house-only at ${PLATFORM_ROOT}/config/cloudflare-house.env.
+# The admin-run scopes (pages/dns/access) still mint from that master. When the
+# passed file has no master and the house env is reachable AND carries one,
+# resolve/mint/persist against the house env instead. src records which source
+# was used, surfaced on every lifeline so an operator can see hosting is on the
+# isolated path, not a stray per-account token. Single-tenant installs keep the
+# master in the per-account file, so no fallback fires and behaviour is unchanged.
+# The house env is locatable only from an admin/specialist spawn (PLATFORM_ROOT is
+# stamped there, never on a plain sub-account spawn), so this grants a sub-account
+# no self-hosting capability.
+file_has_master() { grep -Eq '^[[:space:]]*CLOUDFLARE_API_TOKEN=.+' "$1" 2>/dev/null; }
+src=account
+if ! file_has_master "$secrets"; then
+  house="${CF_HOUSE_ENV:-}"
+  if [ -z "$house" ] && [ -n "${PLATFORM_ROOT:-}" ]; then
+    house="${PLATFORM_ROOT}/config/cloudflare-house.env"
+  fi
+  if [ -n "$house" ] && [ -r "$house" ] && file_has_master "$house"; then
+    secrets="$house"; src=house
+  else
+    echo "[cf-token] op=resolve scope=${scope} master=none action=resolve result=error code=0 src=account" >&2
+    die "no Cloudflare master token: '${secrets}' carries none and no house credential is reachable (set CF_HOUSE_ENV or PLATFORM_ROOT)"
+  fi
+fi
+
 # Load credentials (api.md load-credentials pre-flight). :? aborts if unset/empty,
 # so a credential-unloaded call can never reach the API.
 set -a; . "$secrets"; set +a
@@ -66,7 +93,7 @@ if [ -z "$existing" ] && [ -n "$legacy" ]; then
   existing="$(read_key "$legacy")"; [ -n "$existing" ] && used_key="$legacy"
 fi
 if [ -n "$existing" ]; then
-  echo "[cf-token] op=resolve scope=${scope} master=$(prefix_tag) action=reuse result=active code=0" >&2
+  echo "[cf-token] op=resolve scope=${scope} master=$(prefix_tag) action=reuse result=active code=0 src=${src}" >&2
   printf '%s\n' "$used_key"; exit 0
 fi
 
@@ -74,7 +101,7 @@ fi
 case "$CLOUDFLARE_API_TOKEN" in
   cfat_*) base="$API/accounts/$ACC"; mtag=cfat;;
   cfut_*) base="$API/user"; mtag=cfut;;
-  *) echo "[cf-token] op=resolve scope=${scope} master=other action=mint result=error code=0" >&2
+  *) echo "[cf-token] op=resolve scope=${scope} master=other action=mint result=error code=0 src=${src}" >&2
      die "unrecognised master token prefix (not cfat_/cfut_); refusing to guess an endpoint";;
 esac
 
@@ -95,7 +122,7 @@ api_get() { curl -sS -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" "$1"; }
 pg_json="$(api_get "${base}/tokens/permission_groups")"
 echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
   code=$(echo "$pg_json" | jq -r '.errors[0].code // "?"')
-  echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=${code}" >&2
+  echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=${code} src=${src}" >&2
   die "permission_groups failed at ${base}/tokens/permission_groups code=${code}"
 }
 
@@ -126,7 +153,7 @@ verify_token() { # $1 token -> echoes "active" or the failing code; retries tran
 
 finish() { # $1 token value -> persist under canonical key, report, exit 0
   ( umask 077; printf '%s=%s\n' "$key" "$1" >> "$secrets" )
-  echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=active code=0" >&2
+  echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=active code=0 src=${src}" >&2
   printf '%s\n' "$key"; exit 0
 }
 
@@ -136,7 +163,7 @@ if [ "$scope" = "access" ]; then
   # Try each candidate, mint+verify, then a functional read; keep the one that works.
   candidates="$(collect_ids "$regexes")"
   [ -n "$candidates" ] || {
-    echo "[cf-token] op=resolve scope=access master=${mtag} action=mint result=error code=0" >&2
+    echo "[cf-token] op=resolve scope=access master=${mtag} action=mint result=error code=0 src=${src}" >&2
     die "no permission group matched /${regexes}/"; }
   for cid in $candidates; do
     tok=$(mint_with "$(jq -cn --arg id "$cid" '[{id:$id}]')")
@@ -147,7 +174,7 @@ if [ "$scope" = "access" ]; then
     [ "$fn" = "true" ] && finish "$tok"
     # else poison id - try the next candidate
   done
-  echo "[cf-token] op=resolve scope=access master=${mtag} action=mint result=error code=10000" >&2
+  echo "[cf-token] op=resolve scope=access master=${mtag} action=mint result=error code=10000 src=${src}" >&2
   die "every Access permission-group candidate returned 10000 on a functional read (poison id)"
 else
   pg_array='[]'
@@ -156,18 +183,18 @@ else
     id=$(collect_exact "$nm" | head -1)
     [ -n "$id" ] || {
       IFS=$OLDIFS
-      echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0" >&2
+      echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0 src=${src}" >&2
       die "no permission group named '${nm}'"; }
     pg_array=$(echo "$pg_array" | jq -c --arg id "$id" '. + [{id:$id}]')
   done
   IFS=$OLDIFS
   tok=$(mint_with "$pg_array")
   [ -n "$tok" ] || {
-    echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0" >&2
+    echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0 src=${src}" >&2
     die "mint returned no token value at ${base}/tokens"; }
   st=$(verify_token "$tok")
   [ "$st" = "active" ] || {
-    echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=${st}" >&2
+    echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=${st} src=${src}" >&2
     die "verify failed code=${st} at ${base}/tokens/verify"; }
   finish "$tok"
 fi

package/payload/platform/plugins/cloudflare/references/api.md

@@ -53,7 +53,7 @@ chmod 600 "${SECRETS_DIR}/cloudflare.env"
 
 ### Multi-tenant installs — the master lives house-only
 
-The account-scoped storage above is correct for a single-tenant install (one Cloudflare account, one client). On a **multi-client install** (many client sub-accounts sharing one Cloudflare account, for example SiteDesk), an account-wide token in a sub-account's `cloudflare.env` lets that sub-account reach every other client's D1 and R2. There, the master lives house-only at `${PLATFORM_ROOT}/config/cloudflare-house.env` (a location no sub-account spawn sources), per-account `cloudflare.env` files carry no account-wide token, and a sub-account reaches D1/R2 only through the storage broker, which scopes every operation to the caller's account. See [`../../../../.docs/cloudflare-storage-isolation.md`](../../../../.docs/cloudflare-storage-isolation.md). The per-scope DNS/Pages/Access minting below is unchanged and remains admin-run.
+The account-scoped storage above is correct for a single-tenant install (one Cloudflare account, one client). On a **multi-client install** (many client sub-accounts sharing one Cloudflare account, for example SiteDesk), an account-wide token in a sub-account's `cloudflare.env` lets that sub-account reach every other client's D1 and R2. There, the master lives house-only at `${PLATFORM_ROOT}/config/cloudflare-house.env` (a location no sub-account spawn sources), per-account `cloudflare.env` files carry no account-wide token, and a sub-account reaches D1/R2 only through the storage broker, which scopes every operation to the caller's account. See [`../../../../.docs/cloudflare-storage-isolation.md`](../../../../.docs/cloudflare-storage-isolation.md). The per-scope DNS/Pages/Access minting below stays admin-run, and its mint-or-reuse mechanism is unchanged; the one difference on a multi-tenant install is the source file. Because the per-account `cloudflare.env` no longer carries the master, `cf-token.sh` falls back to the house credential (`${PLATFORM_ROOT}/config/cloudflare-house.env`) for these scopes, mints and persists the scope token there, and reports `src=house` on its `[cf-token]` lifeline. That fallback is reachable only from an admin/specialist spawn (which alone carries `PLATFORM_ROOT`), so a sub-account still cannot self-resolve a hosting token.
 
 Load the master for a mint call:
 

package/payload/platform/plugins/cloudflare/skills/cloudflare/SKILL.md

@@ -29,7 +29,7 @@ This is the entry point for every Cloudflare task on the install. Pick the opera
 
 Neither the master token nor any per-scope token is ever written into a project tree, committed, or echoed into chat — the per-scope tokens persist only in the account-scoped secrets file, never in a deployable project tree.
 
-On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel, DNS, and Pages operations stay admin-run and unchanged. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
+On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel operations are per-brand isolated and unchanged. The admin-run scopes (Pages, DNS, Access) stay admin/house-run: because the per-account secrets file no longer carries the master, `cf-token.sh` resolves and mints those scope tokens against the house credential (`config/cloudflare-house.env`) and persists them there, surfacing `src=house` on its `[cf-token]` lifeline. Hosting a client site to Pages is therefore an admin/house action, never a sub-account one, consistent with the isolation posture. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
 
 ### Resolve the per-scope token before any `wrangler` / API call (binding)
 

package/payload/platform/plugins/web-designer/bin/resolve-cf.sh

@@ -9,6 +9,13 @@
 #               standalone-> CLOUDFLARE_API_TOKEN (read from the environment)
 #               NOTE: token-key in-repo is not a pure read — cf-token.sh mints the
 #               scope token once if absent and persists it to the secrets file.
+#               On a multi-tenant install (post-1631 storage isolation) the
+#               per-account secrets file carries no account-wide master; cf-token.sh
+#               then resolves Pages against the house credential
+#               (${PLATFORM_ROOT}/config/cloudflare-house.env) and persists the
+#               minted token there. This resolver hands cf-token.sh the per-account
+#               file unchanged; the house fallback is internal to cf-token.sh, so
+#               hosting is house-run without this seam knowing the edition.
 #   site-root : the root that holds pages/<project>/. Consumers append the single
 #               `pages/<project>` segment, matching the <accountDir>/pages/<project>/
 #               convention, so this prints the PARENT of pages, never pages itself.

package/payload/server/{chunk-B57PVHEX.js → chunk-MUHCRGUF.js}

@@ -68,6 +68,7 @@ function readHouseCredential(platformRoot) {
 
 // ../lib/storage-broker/src/cf-exec.ts
 import { execFile } from "child_process";
+var defaultFetch = (url, init) => fetch(url, init);
 var defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
   execFile(cmd, args, { env }, (err, stdout, stderr) => {
     if (err) {
@@ -85,7 +86,7 @@ function parseJson(raw, context) {
     throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
   }
 }
-function makeCfExec(cred, run = defaultRun) {
+function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
   const env = {
     ...process.env,
     CLOUDFLARE_API_TOKEN: cred.apiToken,
@@ -109,8 +110,21 @@ function makeCfExec(cred, run = defaultRun) {
       return parseJson(stdout, "d1 execute");
     },
     async r2List() {
-      const { stdout } = await run("npx", ["wrangler", "r2", "bucket", "list", "--json"], env);
-      return parseJson(stdout, "r2 bucket list");
+      const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+      const res = await fetchFn(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${cred.apiToken}` }
+      });
+      const body = await res.text();
+      if (!res.ok) {
+        throw new Error(`storage-broker: r2 bucket list failed: ${res.status}
+${body}`);
+      }
+      const parsed = parseJson(body, "r2 bucket list");
+      if (parsed.success !== true) {
+        throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
+      }
+      return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
     },
     async r2Create(name) {
       await run("npx", ["wrangler", "r2", "bucket", "create", name], env);

package/payload/server/server.js

@@ -118,7 +118,7 @@ import {
   readHouseCredential,
   registerResource,
   resolveOwner
-} from "./chunk-B57PVHEX.js";
+} from "./chunk-MUHCRGUF.js";
 import {
   __commonJS,
   __toESM
@@ -8679,7 +8679,7 @@ app3.post("/r2/create", async (c) => {
 });
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-V6RKHCLM.js");
+  const { reconcileStorage } = await import("./src-OYNQ3ISB.js");
   const session = getSession();
   try {
     const cf = makeCfExec(readHouseCredential(root));

package/payload/server/{src-V6RKHCLM.js → src-OYNQ3ISB.js}

@@ -9,7 +9,7 @@ import {
   resolveOwner,
   stripAccountWideTokens,
   validateMapping
-} from "./chunk-B57PVHEX.js";
+} from "./chunk-MUHCRGUF.js";
 import "./chunk-PFF6I7KP.js";
 export {
   authorizeAccess,