@rubytech/create-maxy-code 0.1.450 → 0.1.452

package/payload/platform/lib/storage-broker/dist/house-scoped-token.js

@@ -0,0 +1,60 @@
+"use strict";
+// Task 1670 — the house credential is a minter. Each broker/calendar consumer
+// mints (and thereafter reuses) a scoped data token from it via cf-token.sh, the
+// single Cloudflare mint/reuse state machine. This wrapper shells that script
+// against the house env file and reads back the persisted key value. The mint
+// logic itself is not duplicated here — it lives only in cf-token.sh.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHouseScopedToken = resolveHouseScopedToken;
+const node_fs_1 = require("node:fs");
+const node_child_process_1 = require("node:child_process");
+const defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+    (0, node_child_process_1.execFile)(cmd, args, { env }, (err, stdout, stderr) => {
+        if (err) {
+            reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+            return;
+        }
+        resolve({ stdout: stdout.toString() });
+    });
+});
+function readKey(path, key) {
+    for (const line of (0, node_fs_1.readFileSync)(path, "utf8").split("\n")) {
+        const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+        if (m && m[1] === key)
+            return m[2].trim();
+    }
+    return undefined;
+}
+/**
+ * Resolve a scoped data token (e.g. "storage" = D1+R2) from the house minter.
+ * Shells cf-token.sh, which mints or reuses the scope and persists the key into
+ * the house env file, echoing the key name. Reads that key back and returns its
+ * value. Throws if the key is absent after the run (never returns the minter).
+ */
+async function resolveHouseScopedToken(scope, houseEnvPath, cfTokenShPath, run = defaultRun) {
+    const preexisting = readKey(houseEnvPath, keyForScope(scope)) !== undefined;
+    const { stdout } = await run("bash", [cfTokenShPath, scope, houseEnvPath], { ...process.env });
+    const keyName = stdout.trim().split("\n").pop()?.trim() ?? "";
+    if (!keyName)
+        throw new Error(`storage-broker: cf-token.sh ${scope} returned no key name`);
+    const value = readKey(houseEnvPath, keyName);
+    if (!value) {
+        throw new Error(`storage-broker: scoped token ${keyName} absent in ${houseEnvPath} after mint`);
+    }
+    console.error(`[storage-broker] op=house-scoped-token src=house scope=${scope} action=${preexisting ? "reuse" : "mint"} result=active`);
+    return value;
+}
+// The persisted key name for each scope, mirroring cf-token.sh's scope table.
+// Used only to derive the mint/reuse action for the observability line; the
+// authoritative key is whatever cf-token.sh echoes.
+function keyForScope(scope) {
+    switch (scope) {
+        case "storage":
+            return "CF_STORAGE_TOKEN";
+        case "calendar-d1":
+            return "CF_CALENDAR_D1_TOKEN";
+        default:
+            return "";
+    }
+}
+//# sourceMappingURL=house-scoped-token.js.map

package/payload/platform/lib/storage-broker/dist/house-scoped-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"house-scoped-token.js","sourceRoot":"","sources":["../src/house-scoped-token.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;;AA+BtE,0DAsBC;AAnDD,qCAAuC;AACvC,2DAA8C;AAG9C,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC3C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,YAAoB,EACpB,aAAqB,EACrB,MAAa,UAAU;IAEvB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,MAAM,EACN,CAAC,aAAa,EAAE,KAAK,EAAE,YAAY,CAAC,EACpC,EAAE,GAAG,OAAO,CAAC,GAAG,EAA4B,CAC7C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,uBAAuB,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,cAAc,YAAY,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,KAAK,CACX,0DAA0D,KAAK,WAAW,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,gBAAgB,CACzH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,SAAS,WAAW,CAAC,KAAa;IAChC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from "./authorize.js";
 export * from "./registry.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
+export * from "./house-scoped-token.js";
 export * from "./audit.js";
 export * from "./remediate.js";
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/storage-broker/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/payload/platform/lib/storage-broker/dist/index.js

@@ -25,6 +25,7 @@ __exportStar(require("./authorize.js"), exports);
 __exportStar(require("./registry.js"), exports);
 __exportStar(require("./house-credential.js"), exports);
 __exportStar(require("./cf-exec.js"), exports);
+__exportStar(require("./house-scoped-token.js"), exports);
 __exportStar(require("./audit.js"), exports);
 __exportStar(require("./remediate.js"), exports);
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/storage-broker/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,6CAA2B;AAC3B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,0DAAwC;AACxC,6CAA2B;AAC3B,iDAA+B"}

package/payload/platform/lib/storage-broker/dist/remediate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAOD,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,aAAa,CAGf;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM/D"}
+{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAoBD,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,aAAa,CAGf;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/payload/platform/lib/storage-broker/dist/remediate.js

@@ -10,7 +10,20 @@ exports.stripAccountWideTokens = stripAccountWideTokens;
 // Account-wide credentials stripped from a sub-account's cloudflare.env.
 // CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
 // credential, and does not grant access on its own.
-const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+// Account-wide-reach tokens that must never persist in a sub-account secrets
+// file: the master and every scoped DATA token that reaches the whole shared
+// account. CF_STORAGE_TOKEN (D1+R2) and CF_CALENDAR_D1_TOKEN (D1) are house-code
+// data scopes (Task 1670) minted account-scoped, so a copy in a sub-account file
+// would let that tenant reach every other tenant's D1/R2 — strip them too. The
+// account's own zone/pages hosting tokens (CF_DNS_TOKEN, etc.) are narrow and
+// stay.
+const STRIP_KEYS = [
+    "CLOUDFLARE_API_TOKEN",
+    "CF_PAGES_D1_TOKEN",
+    "CF_PAGES_TOKEN",
+    "CF_STORAGE_TOKEN",
+    "CF_CALENDAR_D1_TOKEN",
+];
 function validateMapping(enumerated, mapping) {
     const missing = enumerated.filter((name) => !(name in mapping));
     return { ok: missing.length === 0, missing };

package/payload/platform/lib/storage-broker/dist/remediate.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediate.js","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;;AAYxE,0CAMC;AAED,wDAMC;AAnBD,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,MAAM,UAAU,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AAEnF,SAAgB,eAAe,CAC7B,UAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"remediate.js","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;;AAyBxE,0CAMC;AAED,wDAMC;AAhCD,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,6EAA6E;AAC7E,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,QAAQ;AACR,MAAM,UAAU,GAAG;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC;AAEF,SAAgB,eAAe,CAC7B,UAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -1,6 +1,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { makeCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
+import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { makeCfExec, makeHouseCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
 
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
 
@@ -13,14 +16,18 @@ function recordingRun(stdout: string) {
   return { run, calls };
 }
 
-// r2List hits the Cloudflare R2 API, not wrangler, so it needs a fetch seam.
-// A run that throws proves r2List never shells wrangler.
+// r2List and d1Create hit the Cloudflare API, not wrangler, so they need a
+// fetch seam. A run that throws proves they never shell wrangler — in
+// particular that no `--json` reaches a `wrangler d1 create` invocation.
 const throwingRun: RunFn = async () => {
-  throw new Error("r2List must not shell wrangler");
+  throw new Error("must not shell wrangler");
 };
 
 function recordingFetch(response: { ok: boolean; status: number; body: string }) {
-  const calls: Array<{ url: string; init: { method: string; headers: Record<string, string> } }> = [];
+  const calls: Array<{
+    url: string;
+    init: { method: string; headers: Record<string, string>; body?: string };
+  }> = [];
   const fetchFn: FetchFn = async (url, init) => {
     calls.push({ url, init });
     return { ok: response.ok, status: response.status, text: async () => response.body };
@@ -48,10 +55,44 @@ test("d1Query runs execute --remote with the SQL", async () => {
   ]);
 });
 
-test("d1Create parses the created uuid", async () => {
-  const { run } = recordingRun(JSON.stringify({ uuid: "new-db" }));
-  const cf = makeCfExec(cred, run);
+test("d1Create creates the database via the D1 API with the house token, never wrangler", async () => {
+  const { fetchFn, calls } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({
+      success: true,
+      errors: [],
+      messages: [],
+      result: { uuid: "new-db", name: "gls-new", created_at: "2026-01-01T00:00:00Z" },
+    }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
   assert.deepEqual(await cf.d1Create("gls-new"), { uuid: "new-db" });
+  assert.equal(calls[0].url, "https://api.cloudflare.com/client/v4/accounts/acc-h/d1/database");
+  assert.equal(calls[0].init.method, "POST");
+  assert.equal(calls[0].init.headers.Authorization, "Bearer cfat_x");
+  assert.equal(calls[0].init.headers["Content-Type"], "application/json");
+  assert.deepEqual(JSON.parse(calls[0].init.body ?? ""), { name: "gls-new" });
+});
+
+test("d1Create throws with the API error body on a non-2xx response", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: false,
+    status: 403,
+    body: JSON.stringify({ success: false, errors: [{ code: 10000, message: "Authentication error" }] }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.d1Create("gls-new"), /403[\s\S]*Authentication error/);
+});
+
+test("d1Create throws on a 200 whose body is not a success envelope, retaining the body", async () => {
+  const { fetchFn } = recordingFetch({
+    ok: true,
+    status: 200,
+    body: JSON.stringify({ unexpected: "shape" }),
+  });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.d1Create("gls-new"), /unexpected/);
 });
 
 test("r2Create shells wrangler r2 bucket create", async () => {
@@ -120,3 +161,27 @@ test("non-JSON output throws with the raw body", async () => {
   const cf = makeCfExec(cred, run);
   await assert.rejects(() => cf.d1List(), /not json/);
 });
+
+// Task 1670 — makeHouseCfExec resolves a scoped storage token from the house
+// minter via cf-token.sh and uses THAT token (never the minter) for wrangler.
+test("makeHouseCfExec runs wrangler with the scoped token, not the minter", async () => {
+  const platformRoot = mkdtempSync(join(tmpdir(), "house-cfexec-"));
+  const cfg = join(platformRoot, "config");
+  mkdirSync(cfg, { recursive: true });
+  const houseEnv = join(cfg, "cloudflare-house.env");
+  writeFileSync(houseEnv, "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc-h\n");
+
+  let sawToken = "";
+  const run: RunFn = async (_cmd, args, env) => {
+    if (args.some((a) => a.endsWith("cf-token.sh"))) {
+      appendFileSync(houseEnv, "CF_STORAGE_TOKEN=scoped_tok\n");
+      return { stdout: "CF_STORAGE_TOKEN\n" };
+    }
+    sawToken = env.CLOUDFLARE_API_TOKEN;
+    return { stdout: "[]" };
+  };
+
+  const cf = await makeHouseCfExec(platformRoot, run);
+  await cf.d1List();
+  assert.equal(sawToken, "scoped_tok", "wrangler saw the scoped token, not the minter");
+});

package/payload/platform/lib/storage-broker/src/__tests__/house-scoped-token.test.ts

@@ -0,0 +1,48 @@
+// Task 1670 — resolveHouseScopedToken shells cf-token.sh against the house env
+// file and reads back the persisted key value. The cf-token.sh invocation is
+// mocked via the injected RunFn (it appends the key and echoes the key name).
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, appendFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveHouseScopedToken } from "../house-scoped-token.js";
+import type { RunFn } from "../cf-exec.js";
+
+function houseFile(contents: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "hst-"));
+  const p = join(dir, "cloudflare-house.env");
+  writeFileSync(p, contents);
+  return p;
+}
+
+test("mints and reads back the scoped token value", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async (_cmd, args) => {
+    assert.equal(args[1], "storage", "scope passed to cf-token.sh");
+    appendFileSync(p, "CF_STORAGE_TOKEN=minted_value\n");
+    return { stdout: "CF_STORAGE_TOKEN\n" };
+  };
+  const tok = await resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run);
+  assert.equal(tok, "minted_value");
+});
+
+test("reuse: a pre-existing key resolves to its value", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=already_here\n");
+  // cf-token.sh reuse path writes nothing new, still echoes the key.
+  const run: RunFn = async () => ({ stdout: "CF_STORAGE_TOKEN\n" });
+  const tok = await resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run);
+  assert.equal(tok, "already_here");
+});
+
+test("throws when the persisted key is absent after the run", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async () => ({ stdout: "CF_STORAGE_TOKEN\n" }); // writes nothing
+  await assert.rejects(() => resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run));
+});
+
+test("throws when cf-token.sh returns no key name", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async () => ({ stdout: "\n" });
+  await assert.rejects(() => resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run));
+});

package/payload/platform/lib/storage-broker/src/__tests__/remediate.test.ts

@@ -19,3 +19,11 @@ test("strips only account-wide token lines, keeps the account id and scoped toke
     "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
   assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
 });
+
+// Task 1670 — the house-code data scopes reach the whole shared account, so a
+// stray copy in a sub-account file is a cross-tenant leak and must be stripped.
+test("strips the account-wide data scopes (storage, calendar-d1), keeps zone hosting tokens", () => {
+  const before =
+    "CLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=cfat_d1r2\nCF_CALENDAR_D1_TOKEN=cfat_d1\nCF_DNS_TOKEN=keep\n";
+  assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
+});

package/payload/platform/lib/storage-broker/src/bin/remediate-run.ts

@@ -14,6 +14,7 @@ import { validateMapping, stripAccountWideTokens } from "../remediate.js";
 import { registerResource, type StorageResource } from "../registry.js";
 import { readHouseCredential } from "../house-credential.js";
 import { makeCfExec } from "../cf-exec.js";
+import { resolveHouseScopedToken } from "../house-scoped-token.js";
 
 export interface RemediationDeps {
   cfD1(): Promise<Array<{ name: string; cfResourceId: string }>>;
@@ -77,7 +78,9 @@ export async function runRemediation(deps: RemediationDeps): Promise<Remediation
 
 // --- on-device CLI (untested glue) ----------------------------------------
 
-function findMasterFromAccounts(accountsDir: string): { apiToken: string; accountId: string } | null {
+function findMasterFromAccounts(
+  accountsDir: string,
+): { apiToken: string; accountId: string; path: string } | null {
   if (!existsSync(accountsDir)) return null;
   for (const accountId of readdirSync(accountsDir)) {
     const p = join(accountsDir, accountId, "secrets", "cloudflare.env");
@@ -88,7 +91,7 @@ function findMasterFromAccounts(accountsDir: string): { apiToken: string; accoun
       if (m) env[m[1]] = m[2].trim();
     }
     if (env.CLOUDFLARE_API_TOKEN && env.CLOUDFLARE_ACCOUNT_ID) {
-      return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID };
+      return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID, path: p };
     }
   }
   return null;
@@ -110,10 +113,13 @@ async function main(): Promise<void> {
   const mapping = JSON.parse(readFileSync(mappingFile, "utf8")) as Record<string, string>;
 
   // The master is wherever it lives today: the house file if already relocated,
-  // else the first sub-account secrets file that still carries it.
+  // else the first sub-account secrets file that still carries it. masterFile is
+  // the file cf-token.sh mints the scoped enumeration token against.
   let master: { apiToken: string; accountId: string };
+  let masterFile: string;
   try {
     master = readHouseCredential(platformRoot);
+    masterFile = configPath;
   } catch {
     const found = findMasterFromAccounts(accountsDir);
     if (!found) {
@@ -121,10 +127,16 @@ async function main(): Promise<void> {
       process.exit(2);
       return;
     }
-    master = found;
+    master = { apiToken: found.apiToken, accountId: found.accountId };
+    masterFile = found.path;
   }
 
-  const cf = makeCfExec(master);
+  // Task 1670 — the master is a minter; enumerate D1/R2 through a scoped storage
+  // token minted from it, never the minter directly. `master` (the raw minter)
+  // is still what runRemediation relocates into the house file below.
+  const cfTokenSh = join(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const scoped = await resolveHouseScopedToken("storage", masterFile, cfTokenSh);
+  const cf = makeCfExec({ apiToken: scoped, accountId: master.accountId });
   const neo4j = (await import("neo4j-driver")) as any;
   const driver = neo4j.default.driver(
     process.env.NEO4J_URI,

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -3,7 +3,10 @@
 // wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
 
 import { execFile } from "node:child_process";
+import { join } from "node:path";
 import type { HouseCredential } from "./house-credential.js";
+import { readHouseCredential } from "./house-credential.js";
+import { resolveHouseScopedToken } from "./house-scoped-token.js";
 
 export type RunFn = (
   cmd: string,
@@ -11,12 +14,13 @@ export type RunFn = (
   env: Record<string, string>,
 ) => Promise<{ stdout: string }>;
 
-// The HTTP seam for the Cloudflare API. Injectable so r2List is unit-testable
-// without a network. Minimal subset of the global fetch: r2List reads the body
-// once via text() and branches on ok/status.
+// The HTTP seam for the Cloudflare API. Injectable so r2List and d1Create are
+// unit-testable without a network. Minimal subset of the global fetch: callers
+// read the body once via text() and branch on ok/status. `body` is set for the
+// POST paths (d1Create); GET paths (r2List) omit it.
 export type FetchFn = (
   url: string,
-  init: { method: string; headers: Record<string, string> },
+  init: { method: string; headers: Record<string, string>; body?: string },
 ) => Promise<{ ok: boolean; status: number; text(): Promise<string> }>;
 
 export interface CfExec {
@@ -68,8 +72,34 @@ export function makeCfExec(
       return parseJson(stdout, "d1 list") as { name: string; uuid: string }[];
     },
     async d1Create(name) {
-      const { stdout } = await run("npx", ["wrangler", "d1", "create", name, "--json"], env);
-      return parseJson(stdout, "d1 create") as { uuid: string };
+      // `wrangler d1 create` has no --json flag (unlike `d1 list`/`d1 execute`),
+      // so shelling it with --json is always rejected. The D1 API creates the
+      // database and returns its record — incl. the uuid — as JSON directly.
+      const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/d1/database`;
+      const res = await fetchFn(url, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${cred.apiToken}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ name }),
+      });
+      const body = await res.text();
+      if (!res.ok) {
+        throw new Error(`storage-broker: d1 create failed: ${res.status}\n${body}`);
+      }
+      const parsed = parseJson(body, "d1 create") as {
+        success?: boolean;
+        errors?: unknown;
+        result?: { uuid?: string };
+      };
+      // Require an explicit success envelope with a uuid. A 2xx whose body is
+      // not a well-formed `success:true` response is an anomaly to surface with
+      // its body, never a silently uuid-less create.
+      if (parsed.success !== true || typeof parsed.result?.uuid !== "string") {
+        throw new Error(`storage-broker: d1 create API error: ${body}`);
+      }
+      return { uuid: parsed.result.uuid };
     },
     async d1Query(name, sql) {
       const { stdout } = await run(
@@ -110,3 +140,22 @@ export function makeCfExec(
     },
   };
 }
+
+// Task 1670 — build a CfExec whose token is a D1+R2 "storage" scope minted from
+// the house minter, never the minter used directly (a minter cannot run
+// wrangler d1/r2 or hit the D1/R2 API — it returns 10000). cf-token.sh
+// mints-or-reuses and persists the scope house-side; the resolved value is used
+// for both the wrangler run env and the API Bearer. The two UI-route broker
+// sites and remediate-run construct their CfExec through the house minter this
+// way instead of `makeCfExec(readHouseCredential(...))`.
+export async function makeHouseCfExec(
+  platformRoot: string,
+  run: RunFn = defaultRun,
+  fetchFn: FetchFn = defaultFetch,
+): Promise<CfExec> {
+  const cred = readHouseCredential(platformRoot);
+  const houseEnvPath = join(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
+  return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
+}

package/payload/platform/lib/storage-broker/src/house-scoped-token.ts

@@ -0,0 +1,72 @@
+// Task 1670 — the house credential is a minter. Each broker/calendar consumer
+// mints (and thereafter reuses) a scoped data token from it via cf-token.sh, the
+// single Cloudflare mint/reuse state machine. This wrapper shells that script
+// against the house env file and reads back the persisted key value. The mint
+// logic itself is not duplicated here — it lives only in cf-token.sh.
+
+import { readFileSync } from "node:fs";
+import { execFile } from "node:child_process";
+import type { RunFn } from "./cf-exec.js";
+
+const defaultRun: RunFn = (cmd, args, env) =>
+  new Promise((resolve, reject) => {
+    execFile(cmd, args, { env }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+        return;
+      }
+      resolve({ stdout: stdout.toString() });
+    });
+  });
+
+function readKey(path: string, key: string): string | undefined {
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m && m[1] === key) return m[2].trim();
+  }
+  return undefined;
+}
+
+/**
+ * Resolve a scoped data token (e.g. "storage" = D1+R2) from the house minter.
+ * Shells cf-token.sh, which mints or reuses the scope and persists the key into
+ * the house env file, echoing the key name. Reads that key back and returns its
+ * value. Throws if the key is absent after the run (never returns the minter).
+ */
+export async function resolveHouseScopedToken(
+  scope: string,
+  houseEnvPath: string,
+  cfTokenShPath: string,
+  run: RunFn = defaultRun,
+): Promise<string> {
+  const preexisting = readKey(houseEnvPath, keyForScope(scope)) !== undefined;
+  const { stdout } = await run(
+    "bash",
+    [cfTokenShPath, scope, houseEnvPath],
+    { ...process.env } as Record<string, string>,
+  );
+  const keyName = stdout.trim().split("\n").pop()?.trim() ?? "";
+  if (!keyName) throw new Error(`storage-broker: cf-token.sh ${scope} returned no key name`);
+  const value = readKey(houseEnvPath, keyName);
+  if (!value) {
+    throw new Error(`storage-broker: scoped token ${keyName} absent in ${houseEnvPath} after mint`);
+  }
+  console.error(
+    `[storage-broker] op=house-scoped-token src=house scope=${scope} action=${preexisting ? "reuse" : "mint"} result=active`,
+  );
+  return value;
+}
+
+// The persisted key name for each scope, mirroring cf-token.sh's scope table.
+// Used only to derive the mint/reuse action for the observability line; the
+// authoritative key is whatever cf-token.sh echoes.
+function keyForScope(scope: string): string {
+  switch (scope) {
+    case "storage":
+      return "CF_STORAGE_TOKEN";
+    case "calendar-d1":
+      return "CF_CALENDAR_D1_TOKEN";
+    default:
+      return "";
+  }
+}

package/payload/platform/lib/storage-broker/src/index.ts

@@ -10,5 +10,6 @@ export * from "./authorize.js";
 export * from "./registry.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
+export * from "./house-scoped-token.js";
 export * from "./audit.js";
 export * from "./remediate.js";

package/payload/platform/lib/storage-broker/src/remediate.ts

@@ -12,7 +12,20 @@ export interface MappingResult {
 // Account-wide credentials stripped from a sub-account's cloudflare.env.
 // CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
 // credential, and does not grant access on its own.
-const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+// Account-wide-reach tokens that must never persist in a sub-account secrets
+// file: the master and every scoped DATA token that reaches the whole shared
+// account. CF_STORAGE_TOKEN (D1+R2) and CF_CALENDAR_D1_TOKEN (D1) are house-code
+// data scopes (Task 1670) minted account-scoped, so a copy in a sub-account file
+// would let that tenant reach every other tenant's D1/R2 — strip them too. The
+// account's own zone/pages hosting tokens (CF_DNS_TOKEN, etc.) are narrow and
+// stay.
+const STRIP_KEYS = [
+  "CLOUDFLARE_API_TOKEN",
+  "CF_PAGES_D1_TOKEN",
+  "CF_PAGES_TOKEN",
+  "CF_STORAGE_TOKEN",
+  "CF_CALENDAR_D1_TOKEN",
+];
 
 export function validateMapping(
   enumerated: string[],

package/payload/platform/plugins/admin/PLUGIN.md

@@ -180,6 +180,7 @@ Tools are available via the `admin` MCP server.
 
 ## Hooks
 
+- `hooks/quote-render-gate.sh` — **PreToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** Makes the deterministic quote-render path the only route a client-facing quote PDF can reach a customer. Blocks (exit 2) a `browser-pdf-save` whose output path is a client-quote artefact (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) when no render receipt exists at `quoting/jobs/<jobId>/render-receipt.json` — the receipt `quote-render` writes only after its reconcile / margin-leak / link-liveness gates all pass. A hand-authored quote (the SiteDesk 2026-07-14 bypass: `Write` HTML → `browser-pdf-save`, `quote-render` never called, an internal back-test caveat naming another client folded into the free-text region) has no receipt, so the print is refused rather than delivered. **Block message:** `Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> detail=client quote PDF has no render receipt` (or `reason=bad-jobid` when the filename does not resolve to a job). Every non-quote PDF — brochures, invoices, the admin-scope internal view — and the deterministic path itself (receipt present) pass at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3`): `browser-pdf-save` is a general-purpose tool and the agent never controls this hook's stdin, so failing open opens no bypass while never bricking unrelated PDFs.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/askuserquestion-channel-carrier-gate.sh` — PreToolUse matcher=`AskUserQuestion`, registered as a **second command on the same matcher** as the investigate-gate (either exit 2 blocks; the two guard different conditions). Blocks the question (exit 2) when the session has a native channel attached, because the Claude Code channel protocol carries only the two permission methods — there is no carrier for the `AskUserQuestion` elicitation, so on an rc-spawn channel (webchat/WhatsApp/Telegram) session the harness would block the turn awaiting a selection that can never arrive and the reader renders only delivered replies, wedging the turn (live SiteDesk incident session `1a085718` 2026-07-11: `/chat` stalled on the delivered "On it…" ack with no card). **Signal:** the rc-spawn writes the channel MCP registration as a config file in `os.tmpdir()` keyed by session id (`maxy-channel-<sid>.json` / `maxy-webchat-channel-<sid>.json` / `maxy-wa-channel-<sid>.json` / `maxy-telegram-channel-<sid>.json`, `sid` sanitized `[^A-Za-z0-9_-]→_` exactly as the writers do); its presence at tool-call time is the authoritative "channel attached to this session" marker. The hook resolves the tmpdir the way Node's `os.tmpdir()` does (`${TMPDIR:-/tmp}`, trailing slash stripped). Correct in both readings of the claude.ai/code scoping question: a Pi channel process sees the tmpfile (block); a claude.ai/code process on another host never sees the Pi tmpfile (fail-open → allow, that surface can answer the card). **Block message:** `Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message.` **Log line** (stderr, one per decisive call): `[ask-channel] decision=<allow|block> sessionId=<id8> channel=<attached|none> reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>`. **Fail-open** on no envelope, blank session id, or absent channel file — nudges, never bricks the UI. The complementary standing check (`interactive-wedge` in the session manager) catches any un-carried interactive tool_use that slips past this hook.