@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -48,6 +48,7 @@ export interface CfExec {
   r2List(): Promise<{ name: string }[]>;
   r2Create(name: string): Promise<void>;
   r2ObjectList(bucket: string, prefix?: string): Promise<R2Object[]>;
+  r2ObjectFind(bucket: string, key: string): Promise<R2Object | null>;
   r2ObjectGet(bucket: string, key: string): Promise<Uint8Array>;
   r2ObjectPut(bucket: string, key: string, body: Uint8Array): Promise<void>;
   r2ObjectDelete(bucket: string, key: string): Promise<void>;
@@ -122,6 +123,81 @@ async function cfApiJson(
   return { parsed, body };
 }
 
+// The one pagination loop for the object listing, shared by r2ObjectList and
+// r2ObjectFind so the two cannot drift apart on cursor discipline — the same
+// reason objectUrl is shared by get/put/delete.
+//
+// 1665's rules live here and nowhere else: follow the cursor to exhaustion,
+// is_truncated is authoritative when present, a truncated page naming no cursor
+// is an anomaly to surface rather than a partial list, and a repeated cursor is
+// a cycle rather than progress. per_page is deliberately never sent — its
+// default is unconfirmed, and omitting it takes whatever page size Cloudflare
+// serves rather than guessing a value.
+//
+// It yields pages rather than returning a list, which is what lets r2ObjectFind
+// stop early: an async generator is pull-based, so a consumer that stops
+// iterating never triggers the next request.
+async function* r2ObjectPages(
+  fetchFn: FetchFn,
+  cred: HouseCredential,
+  bucket: string,
+  prefix?: string,
+): AsyncGenerator<R2Object[]> {
+  const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+  const seen = new Set<string>();
+  let cursor: string | undefined;
+  for (;;) {
+    const params = new URLSearchParams();
+    if (prefix !== undefined) params.set("prefix", prefix);
+    if (cursor !== undefined) params.set("cursor", cursor);
+    const qs = params.toString();
+    const { parsed, body } = await cfApiJson(
+      fetchFn,
+      qs ? `${base}?${qs}` : base,
+      { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+      "r2 object list",
+    );
+    const page = parsed as {
+      result?: Array<{ key: string; size: number; etag: string; last_modified: string }>;
+      result_info?: { cursor?: string | null; is_truncated?: boolean };
+    };
+    const objects: R2Object[] = [];
+    for (const o of page.result ?? []) {
+      objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+    }
+    yield objects;
+    const truncated = page.result_info?.is_truncated;
+    const next = page.result_info?.cursor;
+    // is_truncated is authoritative *when present*: a last page may still carry
+    // a cursor, and following it would issue a pointless request or trip the
+    // cycle guard below on a healthy response.
+    if (truncated === false) return;
+    // The API says there is more but names no cursor: the response is not the
+    // shape we understand. Surface it rather than stop, which would silently
+    // truncate the audit's listing — the failure this loop exists to prevent.
+    if (truncated === true && !next) {
+      throw new Error(
+        `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`,
+      );
+    }
+    // is_truncated absent: it is itself an unmeasured fact, so it must not be
+    // what decides correctness. Fall back to cursor presence — the rule r2List
+    // uses on the same envelope — so an envelope without the flag paginates
+    // rather than truncating silently.
+    if (!next) return;
+    // A cursor seen before means the API is cycling rather than advancing: it
+    // would loop forever, re-yielding the same objects each pass. Tracking every
+    // cursor (not just the last) also catches a cycle of period >= 2.
+    if (seen.has(next)) {
+      throw new Error(
+        `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`,
+      );
+    }
+    seen.add(next);
+    cursor = next;
+  }
+}
+
 export function makeCfExec(
   cred: HouseCredential,
   run: RunFn = defaultRun,
@@ -233,65 +309,62 @@ export function makeCfExec(
     // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
     // the bucket-item-scoped *permission types*, not these endpoints.
     //
-    // Doc-confirmed, never measured: no house Cloudflare credential exists on
-    // the dev machine. The design keeps the unmeasured facts unable to affect
-    // correctness — per_page is never sent, and nothing fails silently.
+    // The endpoint's existence and token class are doc-confirmed. Its behaviour
+    // was unmeasured until Task 1697, which probed the live v4 API on 2026-07-16
+    // from the laptop's own maxy-code install (no house Cloudflare credential
+    // exists on the dev Mac, which is why the tests fake the fetch seam). What
+    // that probe established, so nobody re-guesses it:
+    //
+    // - The listing is NOT in ascending UTF-8 binary order. `prefix=a/photo.jpg`
+    //   returns `a/photo.jpg.bak` before `a/photo.jpg`, so the exact key is not
+    //   the first element and `per_page=1` returns a neighbour. S3's
+    //   ListObjectsV2 ordering guarantee does not transfer to this endpoint.
+    // - HEAD is routed only for single-segment keys: any key containing "/"
+    //   returns 405 while GET on the identical URL returns 404.
+    // - A ranged GET is honoured at 2 MB and ignored at 12 B, so it cannot size
+    //   an object without an undocumented size threshold deciding correctness.
+    // - per_page is bounded 0..1000 (error 10029), and per_page=0 returns zero
+    //   objects with is_truncated:true — a loop trap. It is still never sent.
+    //
+    // The design keeps every unmeasured fact unable to affect correctness:
+    // per_page is never sent, order is never assumed, and nothing fails
+    // silently. Evidence:
+    // docs/superpowers/specs/2026-07-16-storage-broker-get-sizing-early-exit-design.md
     async r2ObjectList(bucket, prefix) {
-      // Mirrors r2List: follow the cursor to exhaustion, never send per_page.
-      // A truncated object listing reads as "those objects are absent" to the
-      // data portal's standing audit, producing false phantom rows and hiding
-      // real orphans — the same bug r2List had, one endpoint over.
-      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+      // The standing audit needs the complete set: a truncated object listing
+      // reads as "those objects are absent", producing false phantom rows and
+      // hiding real orphans — the same bug r2List had, one endpoint over. So
+      // this drains every page. r2ObjectFind is the caller that needs one
+      // record and must not pay for this.
       const objects: R2Object[] = [];
-      const seen = new Set<string>();
-      let cursor: string | undefined;
-      for (;;) {
-        const params = new URLSearchParams();
-        if (prefix !== undefined) params.set("prefix", prefix);
-        if (cursor !== undefined) params.set("cursor", cursor);
-        const qs = params.toString();
-        const { parsed, body } = await cfApiJson(
-          fetchFn,
-          qs ? `${base}?${qs}` : base,
-          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
-          "r2 object list",
-        );
-        const page = parsed as {
-          result?: Array<{ key: string; size: number; etag: string; last_modified: string }>;
-          result_info?: { cursor?: string | null; is_truncated?: boolean };
-        };
-        for (const o of page.result ?? []) {
-          objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
-        }
-        const truncated = page.result_info?.is_truncated;
-        const next = page.result_info?.cursor;
-        // is_truncated is authoritative *when present*: a last page may still
-        // carry a cursor, and following it would issue a pointless request or
-        // trip the cycle guard below on a healthy response.
-        if (truncated === false) return objects;
-        // The API says there is more but names no cursor: the response is not
-        // the shape we understand. Surface it rather than return a partial
-        // list, which is the failure this loop exists to prevent.
-        if (truncated === true && !next) {
-          throw new Error(
-            `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`,
-          );
-        }
-        // is_truncated absent: it is itself an unmeasured fact, so it must not
-        // be what decides correctness. Fall back to cursor presence — the rule
-        // r2List uses on the same envelope — so an envelope without the flag
-        // paginates rather than truncating silently.
-        if (!next) return objects;
-        // A cursor seen before means the API is cycling rather than advancing:
-        // it would loop forever, re-appending the same objects each pass.
-        if (seen.has(next)) {
-          throw new Error(
-            `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`,
-          );
-        }
-        seen.add(next);
-        cursor = next;
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, prefix)) {
+        for (const o of page) objects.push(o);
+      }
+      return objects;
+    },
+    async r2ObjectFind(bucket, key) {
+      // Task 1697 — the size source for a get. Scans each page for the exact key
+      // and returns on the first match, so it holds one page rather than every
+      // object sharing the key as a prefix, and issues no request past the page
+      // carrying the match.
+      //
+      // Exact match, not prefix: a prefix of `a/photo.jpg` also matches
+      // `a/photo.jpg.bak`, and sizing the neighbour would either reject a legal
+      // get or admit an oversized one. Exiting on the match rather than on
+      // position is what makes this independent of listing order — measured
+      // 2026-07-16 against the live v4 API, the listing is NOT in ascending
+      // UTF-8 binary order, so the exact key is not the first element and
+      // `per_page=1` returns a neighbour.
+      //
+      // An absent key still drains every page, because proving absence requires
+      // seeing them all. That residual is accepted and permanent; nothing on
+      // this endpoint sizes one object in bounded work. See
+      // docs/superpowers/specs/2026-07-16-storage-broker-get-sizing-early-exit-design.md
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, key)) {
+        const hit = page.find((o) => o.key === key);
+        if (hit) return hit;
       }
+      return null;
     },
     async r2ObjectGet(bucket, key) {
       // The one method cfApiJson cannot wrap: get returns the raw object body,

package/payload/platform/lib/storage-broker/src/index.ts

@@ -9,6 +9,7 @@
 export * from "./authorize.js";
 export * from "./object-limits.js";
 export * from "./registry.js";
+export * from "./resource-limits.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
 export * from "./house-scoped-token.js";

package/payload/platform/lib/storage-broker/src/object-limits.ts

@@ -37,12 +37,32 @@ export function base64Ceiling(bytes: number): number {
 }
 
 /**
- * Room for the put envelope's bucket, key and JSON punctuation, so a legal
- * at-cap put is not rejected by its own key. Far above any realistic bucket+key
- * length and far below the cap, so it cannot smuggle a meaningfully larger
- * object.
+ * The largest JSON body an object route's metadata envelope can legitimately
+ * carry: a bucket name, one key or prefix, and JSON punctuation. No payload term.
+ *
+ * Used twice, because it answers one question — how large can an envelope
+ * legitimately get. `/r2/object/list`, `get` and `delete` carry an envelope and
+ * nothing else, so this is their whole body limit (Task 1698). `put` carries the
+ * same envelope plus base64 object bytes, so it adds this to the base64 ceiling
+ * below, which is the allowance that keeps a legal at-cap put from being rejected
+ * by its own key.
+ *
+ * Deliberately one constant rather than two that happen to match. This is the
+ * opposite ruling to the email cap above, for the opposite reason: that pair must
+ * stay independent because the numbers track different constraints and would drift
+ * for different reasons. Here the constraint is identical, so a change to either
+ * use must move both.
+ *
+ * Sized from confirmed R2 limits rather than assumed. An object key is at most
+ * 1,024 bytes (developers.cloudflare.com/r2/platform/limits/) and a bucket name is
+ * 3-63 characters (developers.cloudflare.com/r2/buckets/create-buckets/), so a
+ * real envelope is about 1.1 KB, or roughly 6 KiB if every key byte takes a
+ * six-character \uXXXX escape. This clears that by about ten times and sits about
+ * 2,100 times below put's body limit: far above anything a real caller sends, far
+ * below anything that threatens house memory. Nothing here depends on either
+ * figure being exact.
  */
-const PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
+export const R2_OBJECT_ENVELOPE_MAX_BODY_BYTES = 64 * 1024;
 
 /**
  * The largest JSON body /r2/object/put can legitimately carry.
@@ -51,7 +71,7 @@ const PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
  * decoded-byte rule lives in the MCP, which knows the source's size exactly.
  */
 export const R2_OBJECT_PUT_MAX_BODY_BYTES =
-  base64Ceiling(R2_OBJECT_MAX_BYTES) + PUT_ENVELOPE_ALLOWANCE_BYTES;
+  base64Ceiling(R2_OBJECT_MAX_BYTES) + R2_OBJECT_ENVELOPE_MAX_BODY_BYTES;
 
 function formatMiB(bytes: number): string {
   return (bytes / 1024 / 1024).toFixed(1);

package/payload/platform/lib/storage-broker/src/resource-limits.ts

@@ -0,0 +1,105 @@
+/**
+ * The bounds on the request bodies the resource-level routes will buffer:
+ * /d1/create, /d1/query and /r2/create (Task 1702).
+ *
+ * Parallel to object-limits.ts, which bounds the object routes. Kept separate
+ * because the facts differ: an object envelope is dominated by R2's 1,024-byte
+ * object key limit, and these routes carry no key at all. Coupling them would tie
+ * a D1 database name to R2's key limit, so a revision to either would move a bound
+ * that has no reason to move.
+ *
+ * These are bounds on house memory. They do not adjudicate the last byte of a name
+ * or a statement — the same stance object-limits.ts takes, for the same reason. The
+ * house process holds the account-wide credential, so an out-of-memory kill there
+ * takes the brand server down, and on the target hardware that is a hard freeze
+ * that emits nothing.
+ *
+ * Deliberately dependency-free, like object-limits.ts: the ui route reads these
+ * through the barrel, and nothing here needs the rest of the lib.
+ */
+
+/**
+ * Cloudflare's documented maximum SQL statement length.
+ *
+ * "Maximum SQL statement length | 100,000 bytes (100 KB)"
+ * https://developers.cloudflare.com/d1/platform/limits/
+ *
+ * Recorded because it is what governs a legitimate `sql`, and because
+ * D1_QUERY_MAX_BODY_BYTES below is only knowable as safe by way of it.
+ *
+ * A second, independent bound applies to the same string on the way out, and is
+ * recorded here so nobody rediscovers it as a bug: cf-exec's d1Query shells
+ * `execFile("npx", ["wrangler", "d1", "execute", ..., "--command", sql])`, so the
+ * decoded statement travels as a single argv element. Linux caps one such element
+ * at MAX_ARG_STRLEN = 131,072 bytes and fails execve with E2BIG above it
+ * (https://man7.org/linux/man-pages/man2/execve.2.html). That is a property of the
+ * spawn path, not of D1. It does not bind first: 100,000 < 131,072, so a statement
+ * D1 would accept always fits the spawn.
+ */
+export const D1_MAX_SQL_STATEMENT_BYTES = 100_000;
+
+/**
+ * The worst-case expansion of a byte when it is serialized into a JSON string.
+ *
+ * A single ASCII control byte becomes the six characters \uXXXX. Multi-byte
+ * characters are cheaper per byte — a 3-byte UTF-8 character also becomes six
+ * characters (2x), and a non-BMP character becomes a 12-character surrogate pair
+ * for 4 bytes (3x) — so 6 is a true ceiling over bytes, reached by ASCII.
+ *
+ * This is why a body limit is not simply the statement limit: the cap bounds the
+ * wire body, and escaping moves the two apart.
+ */
+export const JSON_STRING_WORST_CASE_EXPANSION = 6;
+
+/**
+ * The largest JSON body /d1/create or /r2/create can legitimately carry: a single
+ * resource name and JSON punctuation. No payload term, and no key term.
+ *
+ * Sized on headroom rather than a tight derivation, because only one of the two
+ * names it bounds has a documented hard limit:
+ *
+ * - R2 bucket name: 3-63 characters, lowercase letters, digits and hyphens.
+ *   https://developers.cloudflare.com/r2/buckets/create-buckets/
+ * - D1 database name: no documented limit. The API reference states only
+ *   `name: string`, "D1 database name" — no maxLength, pattern or charset.
+ *   https://developers.cloudflare.com/api/resources/d1/subresources/database/
+ *   The get-started guide gives guidance, not a limit: names "should use a
+ *   combination of ASCII characters, shorter than 32 characters".
+ *
+ * So a real body is under ~100 bytes and 64 KiB clears it by roughly 650x, while
+ * sitting ~2,100x below put's body limit: far above anything a real caller sends,
+ * far below anything that threatens house memory. Nothing here depends on either
+ * figure being exact. An undocumented D1 name limit cannot plausibly approach 64
+ * KiB, and a request body is the wrong place to discover that it had.
+ *
+ * Deliberately not R2_OBJECT_ENVELOPE_MAX_BODY_BYTES, which happens to hold the
+ * same value. That constant is governed by R2's object key limit; this one is not,
+ * and the two must be free to drift. Couple what is one fact; separate what merely
+ * matches today.
+ */
+export const STORAGE_RESOURCE_NAME_MAX_BODY_BYTES = 64 * 1024;
+
+/**
+ * The largest JSON body /d1/query can legitimately carry: a database name and a
+ * SQL statement.
+ *
+ * The envelope reasoning behind the object routes' bound does not govern this. A
+ * large but entirely legal migration or batch statement is not a 1,024-byte object
+ * key, so applying that constant here would reject correct queries.
+ *
+ * The bound is on the wire body, not the decoded statement, and JSON escaping moves
+ * those apart. The largest legal statement (D1_MAX_SQL_STATEMENT_BYTES) can present
+ * a wire body of up to
+ *
+ *   JSON_STRING_WORST_CASE_EXPANSION * 100,000 + 65,536 = 665,536 bytes
+ *
+ * so capping at 100,000 would 413 a statement D1 would have accepted. 1 MiB clears
+ * the worst case by about 1.6x and sits ~133x below put's body limit.
+ *
+ * It is a flat number rather than that expression, for legibility at the call site.
+ * The arithmetic is not decoration: it is the only thing that makes 1 MiB knowable
+ * as safe, so resource-limits.test.ts asserts the relationship. If D1 ever raises
+ * its statement limit above 163,840 bytes, that test fails rather than this route
+ * quietly beginning to refuse legal SQL.
+ */
+export const D1_QUERY_MAX_BODY_BYTES = 1024 * 1024;

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:15c9a9d54bd8898a18c541ce95b9f5dc869646faad096eefc60741bb405a062d
+content-hash: sha256:c7d0d9f383f8d9ee8ed50b8869ce43477e3cb5ebf62305a39041c072e34bfeb1
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2057,7 +2057,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-list` | Mail newest-first. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. `since`/`before` (ISO date-times) narrow by receipt date. The 250-per-page figure is not a ceiling: the reply carries `nextCursor` when older mail remains — pass it back as `cursor` to page further back. Filter by sender/subject via `outlook-mail-search`. |
 | `outlook-mail-search` | Microsoft Graph `$search` (KQL) over the mailbox. Preview-only, like `outlook-mail-list`, and pages the same way via `nextCursor`/`cursor`. Put sender/subject/recipient/date filters in the query: `from:`, `to:`, `subject:`, `received>=`. Graph forbids `$search`+`$filter`, so a strict date window is on `outlook-mail-list`. |
 | `outlook-mail-fetch-body` | Complete body of one message by id (`GET /me/messages/{id}?$select=body`). HTML decoded to text, no preview cap. The full-read path — list/search return Microsoft's ~255-char preview only. Returns the envelope plus the whole body. |
-| `outlook-mail-attachment` | List or download a message's inbound attachments. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
+| `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
@@ -2073,7 +2073,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
 | `outlook-mail-send` | Send a message. No attachments → `POST /me/sendMail`; with attachments → draft, attach, send (`/me/sendMail` carries attachments inline and cannot fit a large file). to/cc/bcc arrays, subject, body, isHtml, attachments (account-dir paths, 25 MB/file). Success asserted on Graph 202; no message id on either route. Needs `Mail.Send` (+ `Mail.ReadWrite` to attach). |
 | `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model, including attachments — files are attached before the id is returned, so the draft is ready to send. Returns the draft id. Needs `Mail.ReadWrite`. |
-| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments). Attachments are additive; removal is not supported. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
+| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add and remove attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments/removeAttachments). `attachments` adds; `removeAttachments` takes files off by name or attachment id; both together replace a file in one call. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
 
 ## Observability
@@ -2148,7 +2148,7 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, removing or replacing an attachment already on a draft, ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
 
 ---
 # QuickBooks Online
@@ -2715,6 +2715,7 @@ Voice mirror is on by default for every drafting skill. To opt out for one, set
 - **Copy public figures** — voice mirror only learns from your own writing.
 - **Clone audio** — text only, no speech synthesis.
 - **Guess** — historical content stays `unknown` until you mark it. Maxy never auto-classifies your writing. (Automatic ingestion applies only to your live PTY sessions where authorship is certain.)
+- **Invent an identity** — a voice belongs to a real admin user on the account. Attribution is refused outright if it names anyone else, and nothing is written. A person's name is not an identity, so tagging someone's writing on a shared account needs their actual admin id, not their name.
 
 ## Status
 

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -32,7 +32,9 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 | Skill | Purpose |
 |---|---|
 | [cloudflare/SKILL.md](skills/cloudflare/SKILL.md) | The entry point for every Cloudflare operation. Routes each operation class to its reference, names the outcome contracts (tunnel external HTTP 200; hosting deployed URL; D1 round-trip), and states the tool-discipline + secret-redaction rules that bind the agent. |
-| [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md` and `d1-data-capture.md`. Admin-run; a content specialist hands the deploy off to it. |
+| [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, the R2 binding trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md`, `d1-data-capture.md` and `r2-object-storage.md`. Admin-run; a content specialist hands the deploy off to it. |
+| [calendar-site/SKILL.md](skills/calendar-site/SKILL.md) | Assemble and deploy one account's public booking page — a static page plus edge Functions over a D1 `bookings` table — on its own custom domain, so a submission survives the install device being offline. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
+| [data-portal/SKILL.md](skills/data-portal/SKILL.md) | Stand up one account's gated file-drop portal on its own custom domain: each enrolled person signs in with their own passcode and can upload, list, download and delete only their own files, into one R2 bucket under a per-person prefix with a D1 manifest row per upload. The bucket is created by the owning account's own session — the broker registers ownership to the creator and never reassigns it — while the admin assembles and deploys. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
 
 ### References
 

package/payload/platform/plugins/cloudflare/bin/portal-enrol.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+// Enrol one person into a data portal: mint a passcode, hash it, print the
+// passcode once, and emit the INSERT.
+//
+// This exists because "generate a high-entropy passcode" in a skill's prose is
+// not a constraint — an agent satisfies that sentence with a six-digit number.
+// The strength now lives in code (template/functions/api/_lib/passcode.mjs), and
+// this is the entry point that applies it. Hashing a passcode any other way
+// bypasses the pinned length, so enrolment runs through here.
+//
+// It deliberately stops at emitting SQL. Running `wrangler d1 execute` itself
+// would put the script's only path behind a Cloudflare credential and a network,
+// which makes it untestable; the skill pipes stdout instead.
+//
+// The stream split is load-bearing, not cosmetic. stdout is SQL and NOTHING else,
+// so it pipes straight into wrangler. The passcode goes to stderr: the operator
+// still reads it off their terminal, but no pipe can carry it into wrangler,
+// which would echo it back inside a syntax error — a plaintext passcode in a log
+// is the one thing enrolment must never produce.
+//
+// Usage:
+//   node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
+//     | npx wrangler d1 execute <db> --remote --file=-
+
+import {
+  PASSCODE_LENGTH,
+  generatePasscode,
+  hashPasscode,
+  randomSaltHex,
+} from '../skills/data-portal/template/functions/api/_lib/passcode.mjs'
+
+/** The isolation rule is that an R2 key starts with `<ownerId>/`, so an ownerId
+ * containing a separator would let one person read another's files. The gate
+ * enforces this too; enrolment refuses rather than minting a row the gate will
+ * later reject. */
+const OWNER_ID = /^[a-z0-9-]+$/
+
+/** @param {string} message */
+function die(message) {
+  console.error(`portal-enrol: ${message}`)
+  process.exit(1)
+}
+
+/** @param {string} flag @returns {string | undefined} */
+function arg(flag) {
+  const i = process.argv.indexOf(flag)
+  return i === -1 ? undefined : process.argv[i + 1]
+}
+
+const ownerId = arg('--owner')
+const name = arg('--name')
+
+if (!ownerId) die('--owner <id> is required')
+if (!name) die('--name <name> is required')
+if (!OWNER_ID.test(/** @type {string} */ (ownerId))) {
+  die(`--owner must match ${OWNER_ID.source} — the isolation gate rejects anything else`)
+}
+// A newline in the name would split the one statement stdout promises to be.
+// It is not an injection — SQLite has no escape but '' and a newline sits inside
+// the literal harmlessly — but it breaks the pipeable contract, so refuse it.
+if (/[\r\n]/.test(/** @type {string} */ (name))) die('--name cannot contain a line break')
+
+const saltBytes = new Uint8Array(16)
+crypto.getRandomValues(saltBytes)
+const saltHex = randomSaltHex(saltBytes)
+
+const passcode = generatePasscode()
+const hash = await hashPasscode(passcode, saltHex)
+
+// Doubled single quotes: the only SQL literal here not already constrained to a
+// charset is the name, which comes from an operator.
+const sqlName = /** @type {string} */ (name).replace(/'/g, "''")
+const createdAt = new Date().toISOString()
+
+// stdout: the statement, alone, pipeable.
+//
+// An upsert, not a bare INSERT, because `ownerId` is TEXT PRIMARY KEY and
+// re-running this script for an existing person IS the rotation path — the only
+// one there is. A bare INSERT dies on the UNIQUE violation inside wrangler, a
+// separate process, AFTER this script has already printed a new passcode and
+// exited 0: the operator hands out a passcode that never worked, believing the
+// leaked one is revoked, while it and its sessions keep resolving. Rotation is
+// precisely the case where a remedy that silently no-ops is worse than none.
+//
+// `createdAt` is deliberately absent from the DO UPDATE: it records when the
+// person was enrolled, and rotating a passcode is not creating a person.
+console.log(
+  `INSERT INTO people (ownerId, name, salt, hash, createdAt) VALUES ('${ownerId}', '${sqlName}', '${saltHex}', '${hash}', '${createdAt}') ON CONFLICT(ownerId) DO UPDATE SET name=excluded.name, salt=excluded.salt, hash=excluded.hash;`,
+)
+
+// stderr: everything for the human. Never stdout — see the note at the top.
+console.error(`passcode: ${passcode}`)
+console.error('')
+console.error(
+  `Give the passcode to ${name} out of band, and do not store it anywhere. It is ${PASSCODE_LENGTH} characters and it is not recoverable — re-running this rotates it, which also revokes their live sessions.`,
+)