@rubytech/create-maxy-code 0.1.477 → 0.1.479

package/payload/platform/plugins/cloudflare/mcp/__tests__/schema-exposed-dirs.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect } from 'vitest'
+import { resolveExposedDirs } from '../../bin/schema-exposed-dirs.mjs'
+
+const ALLOWED = ['projects', 'contacts', 'documents', 'output', 'uploads', 'quotes', 'sites']
+
+function schema(opts: { allowed?: string[]; ontology?: string; pluginOwned?: string } = {}): string {
+  const allowed = opts.allowed ?? ALLOWED
+  return [
+    '# Account schema',
+    '',
+    '```allowed-top-level',
+    ...allowed,
+    '```',
+    '',
+    opts.pluginOwned ?? '',
+    '',
+    opts.ontology ?? '',
+    '',
+  ].join('\n')
+}
+
+// The generator writes this region with an ASCII hyphen separator
+// (account-schema-owned-dirs.py:294).
+const ONTOLOGY = [
+  '<!-- ontology-buckets:start -->',
+  '## Domain entity buckets (from the graph ontology)',
+  '',
+  '- `quotes/` - one folder per Quotation record.',
+  '<!-- ontology-buckets:end -->',
+].join('\n')
+
+// The plugin-owned region uses an EM DASH (account-schema-owned-dirs.py:281).
+const PLUGIN_OWNED = [
+  '<!-- plugin-owned-dirs:start -->',
+  '## Plugin-owned top-level workspaces',
+  '',
+  '- `sites/` — Owned by the cloudflare plugin.',
+  '<!-- plugin-owned-dirs:end -->',
+].join('\n')
+
+describe('resolveExposedDirs', () => {
+  it('exposes ontology buckets plus output', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }))
+    expect(r.exposed).toEqual(['output', 'quotes'])
+    expect(r.schemaPresent).toBe(true)
+  })
+
+  it('exposes output alone when there is no ontology region', () => {
+    expect(resolveExposedDirs(schema()).exposed).toEqual(['output'])
+  })
+
+  it('drops a bucket that is absent from the allowed block', () => {
+    const r = resolveExposedDirs(schema({ allowed: ['output', 'documents'], ontology: ONTOLOGY }))
+    expect(r.exposed).toEqual(['output'])
+  })
+
+  // The contract that fails silently if got wrong: an em dash in the ontology
+  // region must NOT parse, because the generator never writes one there.
+  it('does not parse an em-dash separator as a domain bucket', () => {
+    const emDash = ONTOLOGY.replace('- one folder per', '— one folder per')
+    expect(resolveExposedDirs(schema({ ontology: emDash })).domainBuckets).toEqual([])
+  })
+
+  it('never exposes operator-data or upload buckets', () => {
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY }))
+    for (const d of ['documents', 'contacts', 'projects', 'uploads']) {
+      expect(r.exposed).not.toContain(d)
+    }
+  })
+
+  it('reports a plugin-owned collision and keeps the dir out of exposed', () => {
+    const collide = ONTOLOGY.replace('`quotes/`', '`sites/`').replace('Quotation', 'Site')
+    const r = resolveExposedDirs(schema({ ontology: collide, pluginOwned: PLUGIN_OWNED }))
+    expect(r.collisions).toEqual(['sites'])
+    expect(r.exposed).toEqual(['output'])
+  })
+
+  it('fails closed on a missing schema', () => {
+    const r = resolveExposedDirs(null)
+    expect(r.schemaPresent).toBe(false)
+    expect(r.exposed).toEqual([])
+  })
+
+  it('fails closed when the allowed block is absent', () => {
+    const r = resolveExposedDirs('# no fence here')
+    expect(r.exposed).toEqual([])
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -105,3 +105,42 @@ describe('template layout matches what the deploy publishes', () => {
     ])
   })
 })
+
+describe('device binding', () => {
+  it('declares the install origin as a var placeholder', () => {
+    const text = wrangler()
+    expect(text).toMatch(/\[vars\]/)
+    expect(text).toMatch(/PORTAL_INSTALL_ORIGIN\s*=\s*"__PORTAL_INSTALL_ORIGIN__"/)
+  })
+
+  // The secret must never be ASSIGNED in wrangler.toml: that file is committed
+  // to the account's assembled tree, and the deploy publishes the directory it
+  // is handed, so a secret there is a secret in a repo and one deploy from
+  // being served. Naming it in a comment is the opposite — that comment is what
+  // stops someone adding the assignment later — so the rule is on assignment,
+  // not on the word.
+  it('never assigns the fetch secret in wrangler.toml', () => {
+    const assignments = wrangler()
+      .split('\n')
+      .filter((l) => !l.trim().startsWith('#'))
+      .join('\n')
+    expect(assignments).not.toMatch(/PORTAL_FETCH_SECRET\s*=/)
+  })
+
+  it('SKILL.md tells the assembler how to set both, and to publish the index', () => {
+    const skill = readFileSync(join(SKILL, 'SKILL.md'), 'utf8')
+    expect(skill).toContain('PORTAL_FETCH_SECRET')
+    expect(skill).toContain('PORTAL_INSTALL_ORIGIN')
+    expect(skill).toContain('portal-index-push.mjs')
+    // Enrolment gained a required flag; the documented command must carry it or
+    // every enrolment the skill prescribes fails.
+    expect(skill).toContain('--account')
+  })
+
+  it('schema.sql declares the directory table the portal reads', () => {
+    const text = schema()
+    expect(text).toMatch(/CREATE TABLE IF NOT EXISTS directory/)
+    expect(text).toMatch(/UNIQUE \(accountId, relPath\)/)
+    expect(text).toMatch(/accountId\s+TEXT NOT NULL DEFAULT ''/)
+  })
+})

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -48,7 +48,7 @@ For each person:
 
 ```bash
 node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
-  | npx wrangler d1 execute <portalDbName> --remote --file=-
+  --account <accountId> | npx wrangler d1 execute <portalDbName> --remote --file=-
 ```
 
 The script mints the passcode and prints it **once to stderr**, so it reaches the operator's terminal
@@ -60,6 +60,12 @@ the isolation gate would reject, so a bad name fails here rather than after the
 The statement is an upsert on `ownerId`, which is what makes rotation a re-run rather than a
 constraint error.
 
+`--account` binds the person to the sub-account whose deliverable folders they may read, and it is
+required. A person with no account resolves to an empty folder list, which is indistinguishable from
+a sub-account that genuinely has nothing to share, so the script refuses rather than mint a row that
+fails silently later. Anyone enrolled before this existed has no account bound and sees nothing; run
+enrolment again for them, which the upsert makes a re-run rather than a migration.
+
 **A passcode is never stored in plaintext** — not in `data-portal.json`, not in a log line, nowhere
 on the device. The operator conveys it to the person out of band. Rotating a passcode is a re-run of
 the script for that person; there is no separate editor.
@@ -110,6 +116,67 @@ anything if the stylesheet or a value is not what it expects, and leaves the tem
 place for a brand that declares no palette — which is the case a hand-edit turns into an empty
 declaration nobody sees until the page loads.
 
+## Bind the portal to the device
+
+The portal shows the sub-account's deliverable folders as well as what the client uploaded. The
+folder names and sizes live in D1, so the tree renders whether or not the device is up; the bytes do
+not, so opening a file has to reach the install. That needs two things the template cannot know.
+
+Fill `__PORTAL_INSTALL_ORIGIN__` in `wrangler.toml` with the install's public origin
+(`https://<tunnel-hostname>`), then mint one secret and set it on both ends:
+
+```bash
+SECRET="$(node -e 'console.log([...crypto.getRandomValues(new Uint8Array(32))].map(b=>b.toString(16).padStart(2,"0")).join(""))')"
+mkdir -p <accountDir>/secrets
+( umask 077; printf 'PORTAL_FETCH_SECRET=%s\n' "$SECRET" >> <accountDir>/secrets/data-portal.env )
+printf '%s' "$SECRET" | npx wrangler pages secret put PORTAL_FETCH_SECRET --project-name <project>
+```
+
+The device reads `<accountDir>/secrets/data-portal.env` per request, so the secret is **per account**
+rather than one value for the whole install. That is what makes the account binding inside the
+signature mean anything: a shared key would let any portal sign for any other account on the same
+install. Rotating it is a re-run of both lines, with no restart.
+
+The secret never travels. The portal signs one account, one file path and a five-minute expiry with
+it, and the install verifies that signature. It is a Pages **secret**, never a `[vars]` entry: the
+assembled tree is published as-is, so a secret in `wrangler.toml` is one deploy from being served.
+
+The signature is not the security boundary. The install re-derives which folders are exposed from the
+account's own `SCHEMA.md` on every request, so a correctly signed link for `documents/` is refused
+anyway. That check is what contains a stale index or a compromised project, and it is why both exist.
+
+## Publish the folder index
+
+The device publishes file metadata — names, sizes, times, never bytes:
+
+```bash
+node platform/plugins/cloudflare/bin/portal-index-push.mjs \
+  --account-dir <accountDir> --account <accountId> --db <portalDbName>
+```
+
+Which folders it publishes is not configured here and is not a list in the code. It is derived from
+that account's own `accounts/<accountId>/SCHEMA.md`: the buckets named in its
+`<!-- ontology-buckets -->` region, plus `output`, intersected with its `allowed-top-level` block. A
+brand with a different vertical publishes different folders with no change to this skill. Operator
+data (`documents/`, `contacts/`, `projects/`), the client's own `uploads/`, plugin workspaces and
+everything platform-internal are in neither source and are never published.
+
+An account with no `SCHEMA.md` publishes nothing at all. That is deliberate and it is the opposite of
+what the write-path guard does — the guard fails open so an unseeded account is not write-blocked,
+while a surface facing a client must fail closed.
+
+The heartbeat runs this hourly for every account carrying a `data-portal.json`. Run it once by hand
+after assembly so the client has something to see on their first sign-in, and check the output names
+the folders you expect:
+
+```
+[portal-index] op=resolve account=<id> schemaPresent=true allowed=22 domainBuckets=quotes exposed=output,quotes
+[portal-index] op=verify account=<id> rowsAfter=41 expected=41
+```
+
+`exposed=none` on an account that has deliverables means the schema was missing or its ontology
+region was absent — not that the walk found nothing.
+
 ## Deploy through site-deploy
 
 `storage-pages-deploy` refuses a project with no owner on record, so record the ownership first. In

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -18,12 +18,19 @@
 -- has the column, this file will NOT remove it — IF NOT EXISTS is a no-op on an
 -- existing table — and enrolment's INSERT will fail on `iterations NOT NULL`.
 -- Drop the column by hand in that case; do not add it back here.
+--
+-- `accountId` binds a person to the sub-account whose deliverable folders they
+-- may read. It carries a DEFAULT so this file stays a no-op on a table that
+-- predates it — but an existing table will NOT gain the column, and a person
+-- whose row has the empty default sees an empty folder list. Re-enrol those
+-- people; the upsert on ownerId makes that a re-run, not a migration.
 CREATE TABLE IF NOT EXISTS people (
   ownerId    TEXT PRIMARY KEY,
   name       TEXT NOT NULL,
   salt       TEXT NOT NULL,
   hash       TEXT NOT NULL,
-  createdAt  TEXT NOT NULL
+  createdAt  TEXT NOT NULL,
+  accountId  TEXT NOT NULL DEFAULT ''
 );
 
 -- `pcCheck` is a short digest of the person's passcode hash at mint time, and
@@ -71,3 +78,25 @@ CREATE TABLE IF NOT EXISTS auth_attempts (
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS auth_attempts_scope_window ON auth_attempts (scope, windowStart);
+
+-- One row per file the device has published to this portal. Metadata only: the
+-- bytes stay on the device and are fetched on demand through a short-lived
+-- signed link, which is what lets the folder tree render while the device is
+-- offline.
+--
+-- Written by a full replace per account (delete-all, then insert the current
+-- walk), which is why there is no tombstone column: a file deleted or renamed on
+-- the device simply stops being inserted on the next cycle. The UNIQUE key is
+-- what makes that replace safe to retry — a double insert of the same path
+-- fails loudly instead of silently doubling the row.
+CREATE TABLE IF NOT EXISTS directory (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  accountId  TEXT NOT NULL,
+  relPath    TEXT NOT NULL,
+  sizeBytes  INTEGER NOT NULL,
+  modifiedAt TEXT NOT NULL,
+  indexedAt  TEXT NOT NULL,
+  UNIQUE (accountId, relPath)
+);
+
+CREATE INDEX IF NOT EXISTS directory_account ON directory (accountId);

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/portal-sign.mjs

@@ -0,0 +1,87 @@
+// Signed links for device-held files.
+//
+// The portal holds the account's folder INDEX but not its bytes, so a download
+// has to reach the install. It does that with a link the install can verify
+// rather than a shared secret in a header: the secret never travels, and each
+// grant covers one file for five minutes.
+//
+// The signature proves the request came from the portal. It is NOT the security
+// boundary — the install re-derives the account's exposed folder set on every
+// request, so a validly-signed link for a non-exposed path is still refused.
+// Keep both checks; neither is redundant.
+//
+// Web Crypto only. Cloudflare Workers and Node 22 both provide it, so the
+// install can verify with an identical algorithm without this module crossing
+// the plugin boundary into platform/ui.
+
+/** Five minutes. Long enough for a click to become a download, short enough
+ *  that a leaked link is worthless by the time it is found in a log. */
+export const SIGNED_TTL_MS = 300_000
+
+/** @param {string} accountId @param {string} relPath @param {number} expiresAtMs */
+function message(accountId, relPath, expiresAtMs) {
+  // Newline-separated so no field can absorb another: an accountId ending in a
+  // path fragment cannot forge a different (accountId, relPath) pair.
+  return `${accountId}\n${relPath}\n${expiresAtMs}`
+}
+
+/** @param {string} secret */
+async function keyFor(secret) {
+  return crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+}
+
+/**
+ * @param {string} secret @param {string} accountId @param {string} relPath
+ * @param {number} expiresAtMs @returns {Promise<string>} lowercase hex
+ */
+export async function signPath(secret, accountId, relPath, expiresAtMs) {
+  const key = await keyFor(secret)
+  const mac = await crypto.subtle.sign(
+    'HMAC',
+    key,
+    new TextEncoder().encode(message(accountId, relPath, expiresAtMs)),
+  )
+  return [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/** Length-independent, value-constant comparison. A `===` on the hex would leak
+ *  the matching prefix length through timing.
+ *  @param {string} a @param {string} b */
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  return diff === 0
+}
+
+/**
+ * @param {string} secret @param {string} accountId @param {string} relPath
+ * @param {number} expiresAtMs @param {string} signature @param {number} nowMs
+ * @returns {Promise<boolean>}
+ */
+export async function verifyPath(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
+  if (!secret || !signature) return false
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false
+  const expected = await signPath(secret, accountId, relPath, expiresAtMs)
+  return constantTimeEqual(expected, signature)
+}
+
+/**
+ * @param {string} origin @param {string} secret @param {string} accountId
+ * @param {string} relPath @param {number} expiresAtMs @returns {Promise<string>}
+ */
+export async function buildSignedUrl(origin, secret, accountId, relPath, expiresAtMs) {
+  const sig = await signPath(secret, accountId, relPath, expiresAtMs)
+  const url = new URL('/api/portal/fetch', origin)
+  url.searchParams.set('accountId', accountId)
+  url.searchParams.set('path', relPath)
+  url.searchParams.set('exp', String(expiresAtMs))
+  url.searchParams.set('sig', sig)
+  return url.toString()
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/session.ts

@@ -54,11 +54,11 @@ export async function resolveSession(
   db: D1Database,
   sessionId: string,
   nowMs: number,
-): Promise<{ ownerId: string } | null> {
+): Promise<{ ownerId: string; accountId: string } | null> {
   if (!sessionId) return null
   const row = await db
     .prepare(
-      `SELECT s.ownerId AS ownerId
+      `SELECT s.ownerId AS ownerId, p.accountId AS accountId
          FROM sessions s
          JOIN people p ON p.ownerId = s.ownerId
         WHERE s.sessionId = ?
@@ -66,8 +66,12 @@ export async function resolveSession(
           AND s.pcCheck = substr(p.hash, 1, 16)`,
     )
     .bind(sessionId, nowMs)
-    .first<{ ownerId: string }>()
-  return row && typeof row.ownerId === 'string' ? { ownerId: row.ownerId } : null
+    .first<{ ownerId: string; accountId: string }>()
+  if (!row || typeof row.ownerId !== 'string') return null
+  // A `people` row predating the accountId column resolves it as absent. Treat
+  // that as "no folders", never as "all folders" — the empty string reaches the
+  // listing, which returns nothing rather than falling back to some default.
+  return { ownerId: row.ownerId, accountId: typeof row.accountId === 'string' ? row.accountId : '' }
 }
 
 export function readSessionCookie(header: string | null): string | null {

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/types.ts

@@ -34,6 +34,16 @@ export interface R2Bucket {
 export interface PortalEnv {
   DB: D1Database
   BUCKET: R2Bucket
+  /**
+   * Shared with the install; signs download links for device-held files. A
+   * Pages SECRET, never a var in wrangler.toml, and never sent to the client.
+   * Optional because a portal assembled before this existed still serves
+   * uploads — its indexed downloads report device-offline instead of minting an
+   * unverifiable link.
+   */
+  PORTAL_FETCH_SECRET?: string
+  /** The install's public origin, e.g. `https://<tunnel-hostname>`. */
+  PORTAL_INSTALL_ORIGIN?: string
 }
 
 export type Logger = (line: string) => void

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -2,6 +2,7 @@ import type { Handler, Logger, PortalEnv, R2ObjectBody } from './_lib/types'
 import { readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
 import { authorizeKey } from './_lib/authorize'
+import { buildSignedUrl, SIGNED_TTL_MS } from './_lib/portal-sign.mjs'
 
 interface DownloadResult extends Handler {
   body?: R2ObjectBody | null
@@ -33,6 +34,93 @@ export async function processDownload(
   return { status: 200, payload: { ok: true }, body: obj }
 }
 
+type HeadFetch = (url: string, init: { method: string }) => Promise<{ ok: boolean; status: number }>
+
+interface IndexedDownloadResult extends Handler {
+  url?: string
+}
+
+/**
+ * Hand back a short-lived signed link to a file the DEVICE holds.
+ *
+ * The index is consulted first, so a path the device never published costs no
+ * network call — and `documents/` is never in the index by construction, which
+ * is why a client cannot name their way into it from here.
+ *
+ * The device is probed before the link is minted. Without that, an offline
+ * device produces an opaque browser failure and the client cannot tell it from
+ * a missing file. The gap between probe and fetch is real but small, and losing
+ * it degrades to exactly the opaque failure this avoids the rest of the time.
+ *
+ * The secret never appears in the link or the log: only the signature derived
+ * from it does.
+ */
+export async function processIndexedDownload(
+  sessionId: string,
+  relPath: string,
+  env: PortalEnv,
+  log: Logger,
+  nowMs: number,
+  fetchFn: HeadFetch,
+): Promise<IndexedDownloadResult> {
+  const session = await resolveSession(env.DB, sessionId, nowMs)
+  if (!session) {
+    log('[data-portal] op=fetch-through owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+  if (!session.accountId) {
+    log(`[data-portal] op=fetch-through owner=${q(session.ownerId)} result=no-account`)
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+
+  const row = await env.DB.prepare('SELECT relPath FROM directory WHERE accountId = ? AND relPath = ?')
+    .bind(session.accountId, relPath)
+    .first<{ relPath: string }>()
+  if (!row) {
+    log(
+      `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} result=absent`,
+    )
+    return { status: 404, payload: { ok: false, error: 'not found' } }
+  }
+
+  const secret = env.PORTAL_FETCH_SECRET
+  const origin = env.PORTAL_INSTALL_ORIGIN
+  if (!secret || !origin) {
+    // Assembled without the device binding. Reported as offline rather than as
+    // a server error: from the client's side the file genuinely is unreachable,
+    // and the operator's signal is this line, not a 500.
+    log(`[data-portal] op=fetch-through owner=${q(session.ownerId)} result=unconfigured`)
+    return { status: 503, payload: { ok: false, error: 'device-offline' } }
+  }
+
+  const expiresAt = nowMs + SIGNED_TTL_MS
+  const url = await buildSignedUrl(origin, secret, session.accountId, relPath, expiresAt)
+
+  const started = Date.now()
+  try {
+    const head = await fetchFn(url, { method: 'HEAD' })
+    if (!head.ok) {
+      log(
+        `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} ` +
+          `status=${head.status} ms=${Date.now() - started} result=device-error`,
+      )
+      return { status: 503, payload: { ok: false, error: 'device-offline' } }
+    }
+  } catch (err) {
+    log(
+      `[data-portal] op=fetch-through-failed owner=${q(session.ownerId)} path=${q(relPath)} ` +
+        `err=${q(err instanceof Error ? err.message : String(err))} result=device-offline`,
+    )
+    return { status: 503, payload: { ok: false, error: 'device-offline' } }
+  }
+
+  log(
+    `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} ` +
+      `status=200 ms=${Date.now() - started} result=ok`,
+  )
+  return { status: 200, payload: { ok: true, url }, url }
+}
+
 interface PagesContext {
   request: Request
   env: PortalEnv
@@ -40,7 +128,25 @@ interface PagesContext {
 
 export async function onRequestGet(context: PagesContext): Promise<Response> {
   const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
-  const key = new URL(context.request.url).searchParams.get('key') ?? ''
+  const params = new URL(context.request.url).searchParams
+
+  // `path` names a device-held file from the published index; `key` names an
+  // R2 object the client uploaded. Two stores, two resolutions — the R2 path
+  // below is untouched.
+  const indexedPath = params.get('path')
+  if (indexedPath) {
+    const { status, payload } = await processIndexedDownload(
+      sessionId,
+      indexedPath,
+      context.env,
+      (line) => console.log(line),
+      Date.now(),
+      fetch as unknown as HeadFetch,
+    )
+    return Response.json(payload, { status })
+  }
+
+  const key = params.get('key') ?? ''
   const { status, payload, body } = await processDownload(
     sessionId,
     key,

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -2,11 +2,72 @@ import type { Handler, Logger, PortalEnv } from './_lib/types'
 import { readSessionCookie, resolveSession } from './_lib/session'
 import { q } from './_lib/log'
 
+interface DirRow {
+  relPath: string
+  sizeBytes: number
+  modifiedAt: string
+}
+
+export interface DirEntry {
+  name: string
+  kind: 'file' | 'directory'
+  relPath: string
+  sizeBytes: number | null
+  modifiedAt: string | null
+}
+
+/**
+ * Collapse the flat `directory` rows into one level of listing under `prefix`.
+ *
+ * Folders are synthesised from path segments rather than stored, so the device
+ * publishes files alone and an empty folder simply does not exist. The prefix
+ * matches on a whole segment (`quotes/`, not `quotes`), so a partial name can
+ * never reach a sibling folder's contents.
+ */
+export function entriesUnder(rows: DirRow[], prefix: string): DirEntry[] {
+  const base = prefix ? `${prefix}/` : ''
+  const dirs = new Map<string, DirEntry>()
+  const files: DirEntry[] = []
+  for (const row of rows) {
+    if (base && !row.relPath.startsWith(base)) continue
+    const rest = row.relPath.slice(base.length)
+    if (!rest) continue
+    const slash = rest.indexOf('/')
+    if (slash === -1) {
+      files.push({
+        name: rest,
+        kind: 'file',
+        relPath: row.relPath,
+        sizeBytes: row.sizeBytes,
+        modifiedAt: row.modifiedAt,
+      })
+    } else {
+      const name = rest.slice(0, slash)
+      if (!dirs.has(name)) {
+        dirs.set(name, {
+          name,
+          kind: 'directory',
+          relPath: `${base}${name}`,
+          sizeBytes: null,
+          modifiedAt: null,
+        })
+      }
+    }
+  }
+  const dirList = [...dirs.values()].sort((a, b) => a.name.localeCompare(b.name))
+  // Newest first within the file group: the primary use is seeing what changed.
+  files.sort(
+    (a, b) => (b.modifiedAt ?? '').localeCompare(a.modifiedAt ?? '') || a.name.localeCompare(b.name),
+  )
+  return [...dirList, ...files]
+}
+
 export async function processFiles(
   sessionId: string,
   env: PortalEnv,
   log: Logger,
   nowMs: number,
+  prefix = '',
 ): Promise<Handler> {
   const session = await resolveSession(env.DB, sessionId, nowMs)
   if (!session) {
@@ -20,8 +81,25 @@ export async function processFiles(
     .bind(session.ownerId)
     .all<Record<string, unknown>>()
   const files = rows.results ?? []
-  log(`[data-portal] op=list owner=${q(session.ownerId)} result=ok files=${files.length}`)
-  return { status: 200, payload: { ok: true, files } }
+
+  // The account's published folder index, scoped by accountId. No account bound
+  // means no folders: an enrolment predating that column lands here, and the
+  // empty `account=` field in the log line is what says so.
+  let entries: DirEntry[] = []
+  if (session.accountId) {
+    const dir = await env.DB.prepare(
+      'SELECT relPath, sizeBytes, modifiedAt FROM directory WHERE accountId = ?',
+    )
+      .bind(session.accountId)
+      .all<DirRow>()
+    entries = entriesUnder(dir.results ?? [], prefix)
+  }
+
+  log(
+    `[data-portal] op=list owner=${q(session.ownerId)} account=${q(session.accountId)} ` +
+      `prefix=${q(prefix)} files=${files.length} entries=${entries.length} result=ok`,
+  )
+  return { status: 200, payload: { ok: true, files, entries } }
 }
 
 interface PagesContext {
@@ -31,11 +109,13 @@ interface PagesContext {
 
 export async function onRequestGet(context: PagesContext): Promise<Response> {
   const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  const prefix = new URL(context.request.url).searchParams.get('prefix') ?? ''
   const { status, payload } = await processFiles(
     sessionId,
     context.env,
     (line) => console.log(line),
     Date.now(),
+    prefix,
   )
   return Response.json(payload, { status })
 }

package/payload/platform/plugins/cloudflare/skills/data-portal/template/index.html

@@ -35,6 +35,15 @@
           <button class="dp-btn" type="submit">Upload</button>
         </form>
         <ul id="dp-files" class="dp-files"></ul>
+
+        <!-- Files we have prepared for you, published from the device. Hidden
+             until there is something in it, so an account with no deliverables
+             shows the upload list alone rather than an empty second heading. -->
+        <section id="dp-shared" class="dp-shared" hidden>
+          <h2 class="dp-subtitle">Shared with you</h2>
+          <nav id="dp-crumbs" class="dp-crumbs" aria-label="Folder path"></nav>
+          <ul id="dp-entries" class="dp-files"></ul>
+        </section>
       </section>
     </main>
     <script src="/portal.js"></script>