@rubytech/create-maxy-code 0.1.477 → 0.1.479

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-directory-listing.test.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect } from 'vitest'
+import { processFiles, entriesUnder } from '../../skills/data-portal/template/functions/api/files'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+const DIRECTORY = [
+  { accountId: 'acc-a', relPath: 'output/report.pdf', sizeBytes: 10, modifiedAt: '2026-07-20T10:00:00.000Z' },
+  { accountId: 'acc-a', relPath: 'quotes/CR2969/quote.pdf', sizeBytes: 20, modifiedAt: '2026-07-20T11:00:00.000Z' },
+  { accountId: 'acc-a', relPath: 'quotes/CR2974/quote.pdf', sizeBytes: 30, modifiedAt: '2026-07-20T12:00:00.000Z' },
+  { accountId: 'acc-b', relPath: 'output/secret.pdf', sizeBytes: 40, modifiedAt: '2026-07-20T13:00:00.000Z' },
+]
+
+function makeEnv(sessions: Record<string, { ownerId: string; accountId: string }>) {
+  return {
+    DB: {
+      prepare(query: string) {
+        let bound: unknown[] = []
+        const stmt = {
+          bind(...v: unknown[]) {
+            bound = v
+            return stmt
+          },
+          async run() {
+            return { meta: { changes: 0 } }
+          },
+          async all<T>() {
+            if (/FROM directory/i.test(query)) {
+              return { results: DIRECTORY.filter((d) => d.accountId === bound[0]) as T[] }
+            }
+            return { results: [] as T[] }
+          },
+          async first<T>() {
+            if (/FROM sessions/i.test(query)) return (sessions[bound[0] as string] ?? null) as T | null
+            return null as T | null
+          },
+        }
+        return stmt
+      },
+    },
+  } as unknown as PortalEnv
+}
+
+const SESSIONS = { 'sess-a': { ownerId: 'alice', accountId: 'acc-a' } }
+type Entry = { name: string; kind: string; relPath: string; sizeBytes: number | null; modifiedAt: string | null }
+
+describe('entriesUnder', () => {
+  const rows = DIRECTORY.filter((d) => d.accountId === 'acc-a')
+
+  it('synthesises top-level folders from row paths', () => {
+    const e = entriesUnder(rows, '')
+    expect(e.map((x) => x.name)).toEqual(['output', 'quotes'])
+    expect(e.every((x) => x.kind === 'directory')).toBe(true)
+  })
+
+  it('lists folders inside a prefix', () => {
+    expect(entriesUnder(rows, 'quotes').map((x) => x.name)).toEqual(['CR2969', 'CR2974'])
+  })
+
+  it('lists files inside a leaf folder with size and time', () => {
+    expect(entriesUnder(rows, 'quotes/CR2969')).toEqual([
+      {
+        name: 'quote.pdf',
+        kind: 'file',
+        relPath: 'quotes/CR2969/quote.pdf',
+        sizeBytes: 20,
+        modifiedAt: '2026-07-20T11:00:00.000Z',
+      },
+    ])
+  })
+
+  it('puts folders before files and files newest first', () => {
+    const mixed = [
+      { relPath: 'output/old.pdf', sizeBytes: 1, modifiedAt: '2026-01-01T00:00:00.000Z' },
+      { relPath: 'output/new.pdf', sizeBytes: 1, modifiedAt: '2026-09-01T00:00:00.000Z' },
+      { relPath: 'output/sub/x.pdf', sizeBytes: 1, modifiedAt: '2026-05-01T00:00:00.000Z' },
+    ]
+    expect(entriesUnder(mixed, 'output').map((x) => x.name)).toEqual(['sub', 'new.pdf', 'old.pdf'])
+  })
+
+  // A prefix must match a whole segment: `quote` must not reach `quotes/`.
+  it('does not match a partial segment as a prefix', () => {
+    expect(entriesUnder(rows, 'quote')).toEqual([])
+  })
+})
+
+describe('processFiles directory listing', () => {
+  it('returns synthesised folders for the session account', async () => {
+    const r = await processFiles('sess-a', makeEnv(SESSIONS), () => {}, 0, '')
+    expect((r.payload.entries as Entry[]).map((e) => e.name)).toEqual(['output', 'quotes'])
+  })
+
+  it('never leaks another account rows', async () => {
+    const r = await processFiles('sess-a', makeEnv(SESSIONS), () => {}, 0, '')
+    expect(JSON.stringify(r.payload)).not.toContain('secret.pdf')
+  })
+
+  it('returns an empty entries list when the person has no account bound', async () => {
+    const env = makeEnv({ 'sess-a': { ownerId: 'alice', accountId: '' } })
+    const r = await processFiles('sess-a', env, () => {}, 0, '')
+    expect(r.status).toBe(200)
+    expect(r.payload.entries).toEqual([])
+  })
+
+  it('still denies without a session', async () => {
+    const r = await processFiles('nope', makeEnv(SESSIONS), () => {}, 0, '')
+    expect(r.status).toBe(401)
+  })
+
+  it('logs the account and the prefix', async () => {
+    const lines: string[] = []
+    await processFiles('sess-a', makeEnv(SESSIONS), (l) => lines.push(l), 0, 'quotes')
+    // Free-text log fields are quoted by `q()` — these values come off the wire.
+    expect(lines.some((l) => l.includes('account="acc-a"') && l.includes('prefix="quotes"'))).toBe(true)
+  })
+
+  it('keeps the uploads list alongside the folder entries', async () => {
+    const r = await processFiles('sess-a', makeEnv(SESSIONS), () => {}, 0, '')
+    expect(r.payload).toHaveProperty('files')
+    expect(r.payload).toHaveProperty('entries')
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-enrol.test.ts

@@ -12,7 +12,12 @@ import {
 const run = promisify(execFile)
 const SCRIPT = resolve(dirname(fileURLToPath(import.meta.url)), '../../bin/portal-enrol.mjs')
 
-const enrol = (args: string[]) => run('node', [SCRIPT, ...args])
+/** `--account` is required (it binds the person to the sub-account whose folders
+ * they may read), but it is irrelevant to the passcode behaviour most of these
+ * tests cover, so the helper supplies one unless the caller names its own. Tests
+ * that assert the requirement itself call `run` directly. */
+const enrol = (args: string[]) =>
+  run('node', [SCRIPT, ...(args.includes('--account') ? args : [...args, '--account', 'acc-1'])])
 
 /** The script's contract: stdout is SQL and nothing else, so it pipes straight
  * into `wrangler d1 execute --file=-`; the passcode goes to stderr, where the
@@ -26,7 +31,9 @@ function parse(r: { stdout: string; stderr: string }) {
 }
 
 const valuesOf = (sql: string) =>
-  /VALUES \('([^']*)', '((?:[^']|'')*)', '([0-9a-f]+)', '([0-9a-f]+)', '([^']*)'\)/.exec(sql)!
+  /VALUES \('([^']*)', '((?:[^']|'')*)', '([0-9a-f]+)', '([0-9a-f]+)', '([^']*)', '([^']*)'\)/.exec(
+    sql,
+  )!
 
 /** Apply the emitted SQL to a real SQLite database built from the template's own
  * schema.sql, the way `wrangler d1 execute` applies it to D1. A fake would model
@@ -120,13 +127,26 @@ describe('portal-enrol', () => {
   it('writes the row the schema declares, in order', async () => {
     const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
     const { sql } = parse(r)
-    expect(sql).toContain('INSERT INTO people (ownerId, name, salt, hash, createdAt)')
-    const [, owner, name, salt, hash, createdAt] = valuesOf(sql!)
+    expect(sql).toContain('INSERT INTO people (ownerId, name, salt, hash, createdAt, accountId)')
+    const [, owner, name, salt, hash, createdAt, accountId] = valuesOf(sql!)
     expect(owner).toBe('alice')
     expect(name).toBe('Alice')
     expect(salt).toMatch(/^[0-9a-f]{32}$/)
     expect(hash).toMatch(/^[0-9a-f]{64}$/)
     expect(Number.isNaN(Date.parse(createdAt))).toBe(false)
+    expect(accountId).toBe('acc-1')
+  })
+
+  it('refuses enrolment with no --account', async () => {
+    // A person with no account bound resolves to an empty folder list, which
+    // looks exactly like a sub-account that has no deliverables. Refuse here
+    // rather than mint a row that fails silently at read time.
+    await expect(run('node', [SCRIPT, '--owner', 'alice', '--name', 'Alice'])).rejects.toThrow()
+  })
+
+  it('refuses an accountId that is not an account id', async () => {
+    await expect(enrol(['--owner', 'alice', '--name', 'Alice', '--account', '../etc'])).rejects.toThrow()
+    await expect(enrol(['--owner', 'alice', '--name', 'Alice', '--account', "a'b"])).rejects.toThrow()
   })
 
   it('puts SQL and only SQL on stdout, so the documented pipe works', async () => {
@@ -195,6 +215,41 @@ describe('portal-enrol', () => {
       expect(await db.query("SELECT createdAt FROM people WHERE ownerId='alice';")).toBe(createdAt)
     })
 
+    it('binds the person to the account, and rotation keeps the binding current', async () => {
+      const db = await d1('enrol-account-')
+      await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-a'])).sql!)
+      expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice';")).toBe('acc-a')
+
+      // Re-enrolling to a different account moves the binding rather than
+      // leaving the person pointed at folders they no longer belong to.
+      await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice', '--account', 'acc-b'])).sql!)
+      expect(await db.query("SELECT accountId FROM people WHERE ownerId='alice';")).toBe('acc-b')
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('1')
+    })
+
+    it('declares a directory table keyed uniquely on account and path', async () => {
+      const db = await d1('enrol-directory-')
+      await db.exec(
+        "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt) VALUES ('a','output/x.pdf',1,'t','t');",
+      )
+      // The full-replace push relies on this: a second insert of the same path
+      // must not silently double the row.
+      await expect(
+        db.exec(
+          "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt) VALUES ('a','output/x.pdf',1,'t','t');",
+        ),
+      ).rejects.toThrow()
+      expect(await db.query('SELECT COUNT(*) FROM directory;')).toBe('1')
+    })
+
+    it('scopes directory rows by account', async () => {
+      const db = await d1('enrol-directory-scope-')
+      await db.exec(
+        "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt) VALUES ('a','output/x.pdf',1,'t','t'),('b','output/y.pdf',1,'t','t');",
+      )
+      expect(await db.query("SELECT relPath FROM directory WHERE accountId='a';")).toBe('output/x.pdf')
+    })
+
     it('stores a crafted name as data rather than executing it', async () => {
       const db = await d1('enrol-inject-')
       const r = await enrol(['--owner', 'alice', '--name', "x'); DROP TABLE people; --"])

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -0,0 +1,176 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, unlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { walkExposed, pushAccount } from '../../bin/portal-index-push.mjs'
+
+let dir: string
+
+function file(rel: string, body = 'x') {
+  const abs = join(dir, rel)
+  mkdirSync(join(abs, '..'), { recursive: true })
+  writeFileSync(abs, body)
+}
+
+const SCHEMA = [
+  '```allowed-top-level',
+  'output',
+  'quotes',
+  'documents',
+  'uploads',
+  '```',
+  '',
+  '<!-- ontology-buckets:start -->',
+  '- `quotes/` - one folder per Quotation record.',
+  '<!-- ontology-buckets:end -->',
+].join('\n')
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'portal-push-'))
+  writeFileSync(join(dir, 'SCHEMA.md'), SCHEMA)
+  file('output/report.pdf')
+  file('quotes/CR2969/quote.pdf')
+  file('quotes/CR2974/quote.pdf')
+  file('documents/private.pdf')
+  file('uploads/client-sent.pdf')
+  file('.claude/settings.json')
+  file('output/.uploads-tmp/partial.bin')
+})
+afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+function fakeClient() {
+  const calls: { sql: string; params: unknown[] }[] = []
+  const rows = new Set<string>()
+  return {
+    calls,
+    async query(sql: string, params: unknown[] = []) {
+      calls.push({ sql, params })
+      if (/DELETE FROM directory/i.test(sql)) {
+        rows.clear()
+        return []
+      }
+      if (/INSERT INTO directory/i.test(sql)) {
+        rows.add(String(params[1]))
+        return []
+      }
+      if (/SELECT COUNT/i.test(sql)) return [{ n: rows.size }]
+      return []
+    },
+  }
+}
+
+const push = (client: unknown, overrides: Record<string, unknown> = {}) =>
+  pushAccount({
+    accountDir: dir,
+    accountId: 'acc-1',
+    dbName: 'db',
+    client: client as never,
+    log: () => {},
+    nowIso: '2026-07-20T00:00:00.000Z',
+    ...overrides,
+  })
+
+describe('walkExposed', () => {
+  it('returns files only from exposed dirs, at any depth', async () => {
+    const paths = (await walkExposed(dir, ['output', 'quotes'])).map((r) => r.relPath).sort()
+    expect(paths).toEqual(['output/report.pdf', 'quotes/CR2969/quote.pdf', 'quotes/CR2974/quote.pdf'])
+  })
+
+  it('never returns operator data, uploads, dot dirs or upload temps', async () => {
+    const paths = (await walkExposed(dir, ['output', 'quotes'])).map((r) => r.relPath)
+    expect(paths.some((p) => p.startsWith('documents/'))).toBe(false)
+    expect(paths.some((p) => p.startsWith('uploads/'))).toBe(false)
+    expect(paths.some((p) => p.includes('.uploads-tmp'))).toBe(false)
+    expect(paths.some((p) => p.includes('.claude'))).toBe(false)
+  })
+
+  it('returns nothing for a dir that does not exist', async () => {
+    expect(await walkExposed(dir, ['nope'])).toEqual([])
+  })
+
+  it('carries size and an iso modified time', async () => {
+    const row = (await walkExposed(dir, ['output']))[0]
+    expect(row.sizeBytes).toBe(1)
+    expect(row.modifiedAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+  })
+})
+
+describe('pushAccount', () => {
+  it('deletes the account rows then inserts the current walk', async () => {
+    const c = fakeClient()
+    const r = await push(c)
+    expect(r.exposed).toEqual(['output', 'quotes'])
+    expect(r.rows).toBe(3)
+    expect(/DELETE FROM directory/i.test(c.calls[0].sql)).toBe(true)
+    expect(c.calls[0].params).toEqual(['acc-1'])
+    expect(c.calls.filter((x) => /INSERT INTO directory/i.test(x.sql)).length).toBe(3)
+  })
+
+  it('converges on a delete: a removed file leaves no stale row', async () => {
+    const c = fakeClient()
+    await push(c)
+    unlinkSync(join(dir, 'quotes/CR2974/quote.pdf'))
+    const second = await push(c)
+    expect(second.rows).toBe(2)
+  })
+
+  it('binds every value as a param rather than interpolating it', async () => {
+    const c = fakeClient()
+    await push(c)
+    const insert = c.calls.find((x) => /INSERT INTO directory/i.test(x.sql))!
+    expect(insert.sql).not.toContain('output/')
+    expect(insert.params[0]).toBe('acc-1')
+  })
+
+  // Fail closed, but do NOT delete: an empty publish and a missing schema must
+  // not look the same in the table.
+  it('exposes nothing and writes nothing when the schema is missing', async () => {
+    rmSync(join(dir, 'SCHEMA.md'))
+    const c = fakeClient()
+    const r = await push(c)
+    expect(r.schemaPresent).toBe(false)
+    expect(r.exposed).toEqual([])
+    expect(c.calls.length).toBe(0)
+  })
+
+  it('logs resolve, replace and verify lines', async () => {
+    const lines: string[] = []
+    const c = fakeClient()
+    await push(c, { log: (l: string) => lines.push(l) })
+    expect(lines.some((l) => l.includes('op=resolve') && l.includes('exposed=output,quotes'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=replace') && l.includes('inserted=3'))).toBe(true)
+    expect(lines.some((l) => l.includes('op=verify') && l.includes('rowsAfter=3') && l.includes('expected=3'))).toBe(true)
+  })
+
+  it('reports an exposed-set change only when it actually changes', async () => {
+    const lines: string[] = []
+    // Same set as the fixture resolves to: silent.
+    await push(fakeClient(), { log: (l: string) => lines.push(l), previousExposed: ['output', 'quotes'] })
+    expect(lines.some((l) => l.includes('op=exposed-changed'))).toBe(false)
+
+    // A bucket the client used to see is gone — the client-visible regression.
+    lines.length = 0
+    await push(fakeClient(), { log: (l: string) => lines.push(l), previousExposed: ['output', 'quotes', 'invoices'] })
+    const line = lines.find((l) => l.includes('op=exposed-changed'))!
+    expect(line).toContain('removed=invoices')
+    expect(line).toContain('added=none')
+
+    // A newly projected bucket.
+    lines.length = 0
+    await push(fakeClient(), { log: (l: string) => lines.push(l), previousExposed: ['output'] })
+    expect(lines.find((l) => l.includes('op=exposed-changed'))).toContain('added=quotes')
+  })
+
+  it('stays silent about changes on a first run, when there is no previous set', async () => {
+    const lines: string[] = []
+    await push(fakeClient(), { log: (l: string) => lines.push(l) })
+    expect(lines.some((l) => l.includes('op=exposed-changed'))).toBe(false)
+  })
+
+  it('logs schemaPresent=false so a fail-closed account is distinguishable', async () => {
+    rmSync(join(dir, 'SCHEMA.md'))
+    const lines: string[] = []
+    await push(fakeClient(), { log: (l: string) => lines.push(l) })
+    expect(lines.some((l) => l.includes('schemaPresent=false') && l.includes('exposed=none'))).toBe(true)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-state-contract.test.ts

@@ -0,0 +1,75 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, mkdirSync, rmSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { stateFilePath, readState, recordSuccess } from '../../bin/portal-index-push.mjs'
+// Test-only cross-tree import. The two modules are in different plugins and
+// never import each other in production; this file is the contract between
+// them, and it exists because the last thing that went wrong on this feature
+// was two halves that each passed their own tests and did not connect.
+import {
+  auditPortalIndex,
+  formatPortalIndexAudit,
+} from '../../../scheduling/mcp/src/lib/portal-index-audit.js'
+
+let root: string
+let platformRoot: string
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'portal-state-'))
+  platformRoot = join(root, 'platform')
+  mkdirSync(platformRoot, { recursive: true })
+  mkdirSync(join(root, 'data'), { recursive: true })
+})
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+describe('the push writes exactly what the audit reads', () => {
+  it('puts the state where the heartbeat looks for it', () => {
+    // The audit resolves <platformRoot>/../data/portal-index-state.json
+    // independently. If these two ever disagree the audit reports every healthy
+    // account as never-ran, which is a false alarm pointing at the wrong thing.
+    expect(stateFilePath(platformRoot)).toBe(join(root, 'data', 'portal-index-state.json'))
+  })
+
+  it('round-trips an entry the audit reads as healthy', () => {
+    recordSuccess(platformRoot, 'acc-a', {
+      lastPushMs: Date.now(),
+      rows: 41,
+      exposed: ['output', 'quotes'],
+    })
+
+    const onDisk = JSON.parse(readFileSync(stateFilePath(platformRoot), 'utf8'))
+    const result = auditPortalIndex(['acc-a'], onDisk, Date.now(), 3_600_000)
+
+    expect(result.neverRan).toBe(0)
+    expect(result.stale).toBe(0)
+    expect(result.accounts[0].rows).toBe(41)
+    expect(result.accounts[0].exposed).toEqual(['output', 'quotes'])
+    expect(formatPortalIndexAudit(result)).toEqual([
+      '[portal-index] op=audit accounts=1 stale=0 never-ran=0',
+    ])
+  })
+
+  it('an account the push never recorded reads as never-ran', () => {
+    recordSuccess(platformRoot, 'acc-a', { lastPushMs: Date.now(), rows: 1, exposed: ['output'] })
+    const onDisk = JSON.parse(readFileSync(stateFilePath(platformRoot), 'utf8'))
+    const result = auditPortalIndex(['acc-a', 'acc-b'], onDisk, Date.now(), 3_600_000)
+    expect(result.neverRan).toBe(1)
+    expect(formatPortalIndexAudit(result)[0]).toContain('account=acc-b')
+    expect(formatPortalIndexAudit(result)[0]).toContain('result=never-ran')
+  })
+
+  it('recording one account does not erase another', () => {
+    recordSuccess(platformRoot, 'acc-a', { lastPushMs: 1, rows: 1, exposed: ['output'] })
+    recordSuccess(platformRoot, 'acc-b', { lastPushMs: 2, rows: 2, exposed: ['quotes'] })
+    const state = readState(platformRoot)
+    expect(Object.keys(state).sort()).toEqual(['acc-a', 'acc-b'])
+  })
+
+  it('an absent state file reads as an empty object, not a throw', () => {
+    expect(readState(platformRoot)).toEqual({})
+    // …and an absent file with portals enrolled is the never-ran signal, which
+    // is the state a device sits in before the very first push.
+    expect(auditPortalIndex(['acc-a'], readState(platformRoot), Date.now(), 3_600_000).neverRan).toBe(1)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -0,0 +1,131 @@
+import { describe, it, expect } from 'vitest'
+import { processIndexedDownload } from '../../skills/data-portal/template/functions/api/download'
+import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
+
+const PATH = 'quotes/CR2969/quote.pdf'
+
+function makeEnv(
+  opts: { accountId?: string; secret?: string; origin?: string; paths?: string[] } = {},
+) {
+  const { accountId = 'acc-a', paths = [PATH] } = opts
+  return {
+    DB: {
+      prepare(query: string) {
+        let bound: unknown[] = []
+        const stmt = {
+          bind(...v: unknown[]) {
+            bound = v
+            return stmt
+          },
+          async run() {
+            return { meta: { changes: 0 } }
+          },
+          async all<T>() {
+            return { results: [] as T[] }
+          },
+          async first<T>() {
+            if (/FROM sessions/i.test(query)) {
+              return (bound[0] === 'sess-a' ? { ownerId: 'alice', accountId } : null) as T | null
+            }
+            if (/FROM directory/i.test(query)) {
+              return (paths.includes(bound[1] as string) ? { relPath: bound[1] } : null) as T | null
+            }
+            return null as T | null
+          },
+        }
+        return stmt
+      },
+    },
+    PORTAL_FETCH_SECRET: 'secret' in opts ? opts.secret : 'a-secret',
+    PORTAL_INSTALL_ORIGIN: 'origin' in opts ? opts.origin : 'https://install.example',
+  } as unknown as PortalEnv
+}
+
+const okHead = async () => ({ ok: true, status: 200 })
+const deadHead = async () => {
+  throw new Error('ECONNREFUSED')
+}
+const errHead = async () => ({ ok: false, status: 502 })
+
+describe('processIndexedDownload', () => {
+  it('returns a signed url for an indexed file when the device answers', async () => {
+    const r = await processIndexedDownload('sess-a', PATH, makeEnv(), () => {}, 1000, okHead as never)
+    expect(r.status).toBe(200)
+    const url = new URL(r.url as string)
+    expect(url.origin).toBe('https://install.example')
+    expect(url.pathname).toBe('/api/portal/fetch')
+    expect(url.searchParams.get('path')).toBe(PATH)
+    expect(url.searchParams.get('accountId')).toBe('acc-a')
+    expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
+    expect(Number(url.searchParams.get('exp'))).toBeGreaterThan(1000)
+  })
+
+  it('reports device-offline distinguishably when the probe throws', async () => {
+    const r = await processIndexedDownload('sess-a', PATH, makeEnv(), () => {}, 1000, deadHead as never)
+    expect(r.status).toBe(503)
+    expect(r.payload.error).toBe('device-offline')
+    expect(r.url).toBeUndefined()
+  })
+
+  it('reports device-offline when the probe answers non-ok', async () => {
+    const r = await processIndexedDownload('sess-a', PATH, makeEnv(), () => {}, 1000, errHead as never)
+    expect(r.status).toBe(503)
+    expect(r.payload.error).toBe('device-offline')
+  })
+
+  it('404s a path that is not in the index, without contacting the device', async () => {
+    let touched = false
+    const spy = async () => {
+      touched = true
+      return { ok: true, status: 200 }
+    }
+    const r = await processIndexedDownload(
+      'sess-a',
+      'documents/private.pdf',
+      makeEnv(),
+      () => {},
+      1000,
+      spy as never,
+    )
+    expect(r.status).toBe(404)
+    expect(touched).toBe(false)
+  })
+
+  it('401s without a session', async () => {
+    const r = await processIndexedDownload('nope', PATH, makeEnv(), () => {}, 1000, okHead as never)
+    expect(r.status).toBe(401)
+  })
+
+  it('404s when the person has no account bound', async () => {
+    const r = await processIndexedDownload(
+      'sess-a',
+      PATH,
+      makeEnv({ accountId: '' }),
+      () => {},
+      1000,
+      okHead as never,
+    )
+    expect(r.status).toBe(404)
+  })
+
+  it('never mints a link when the secret or origin is unconfigured', async () => {
+    for (const env of [makeEnv({ secret: undefined }), makeEnv({ origin: undefined })]) {
+      const r = await processIndexedDownload('sess-a', PATH, env, () => {}, 1000, okHead as never)
+      expect(r.status).toBe(503)
+      expect(r.url).toBeUndefined()
+    }
+  })
+
+  it('never puts the secret in the url or the log', async () => {
+    const lines: string[] = []
+    const r = await processIndexedDownload('sess-a', PATH, makeEnv(), (l) => lines.push(l), 1000, okHead as never)
+    expect(r.url).not.toContain('a-secret')
+    expect(lines.join('\n')).not.toContain('a-secret')
+  })
+
+  it('logs the outcome with the path', async () => {
+    const lines: string[] = []
+    await processIndexedDownload('sess-a', PATH, makeEnv(), (l) => lines.push(l), 1000, okHead as never)
+    expect(lines.some((l) => l.includes('op=fetch-through') && l.includes('result=ok'))).toBe(true)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-sign.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest'
+import {
+  SIGNED_TTL_MS,
+  signPath,
+  verifyPath,
+  buildSignedUrl,
+} from '../../skills/data-portal/template/functions/api/_lib/portal-sign.mjs'
+
+const SECRET = 'test-secret-value'
+const ACC = '098a18a3-1741-447f-9778-65470645d57d'
+const NOW = 1_800_000_000_000
+
+describe('portal-sign', () => {
+  it('round-trips a signature', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath(SECRET, ACC, 'quotes/CR2969/quote.pdf', exp)
+    expect(await verifyPath(SECRET, ACC, 'quotes/CR2969/quote.pdf', exp, sig, NOW)).toBe(true)
+  })
+
+  it('refuses an expired signature', async () => {
+    const exp = NOW - 1
+    const sig = await signPath(SECRET, ACC, 'output/a.pdf', exp)
+    expect(await verifyPath(SECRET, ACC, 'output/a.pdf', exp, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a tampered path', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath(SECRET, ACC, 'output/a.pdf', exp)
+    expect(await verifyPath(SECRET, ACC, 'documents/private.pdf', exp, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a tampered account', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath(SECRET, ACC, 'output/a.pdf', exp)
+    expect(await verifyPath(SECRET, 'other-account', 'output/a.pdf', exp, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a tampered expiry', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath(SECRET, ACC, 'output/a.pdf', exp)
+    expect(await verifyPath(SECRET, ACC, 'output/a.pdf', exp + 60_000, sig, NOW)).toBe(false)
+  })
+
+  it('refuses a signature made with a different secret', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath('other-secret', ACC, 'output/a.pdf', exp)
+    expect(await verifyPath(SECRET, ACC, 'output/a.pdf', exp, sig, NOW)).toBe(false)
+  })
+
+  // The field separator must be load-bearing: without it, an accountId that
+  // absorbs the start of a path could forge a different (account, path) pair.
+  it('does not confuse account and path across the separator', async () => {
+    const exp = NOW + SIGNED_TTL_MS
+    const sig = await signPath(SECRET, 'acc', 'a/b.pdf', exp)
+    expect(await verifyPath(SECRET, 'acc\na', '/b.pdf', exp, sig, NOW)).toBe(false)
+  })
+
+  it('builds a url carrying account, path, expiry and signature', async () => {
+    const url = new URL(
+      await buildSignedUrl('https://install.example', SECRET, ACC, 'output/a b.pdf', NOW + 1000),
+    )
+    expect(url.pathname).toBe('/api/portal/fetch')
+    expect(url.searchParams.get('accountId')).toBe(ACC)
+    expect(url.searchParams.get('path')).toBe('output/a b.pdf')
+    expect(url.searchParams.get('exp')).toBe(String(NOW + 1000))
+    expect(url.searchParams.get('sig')).toMatch(/^[0-9a-f]{64}$/)
+  })
+})