npm - @rubytech/create-maxy-code - Versions diffs - 0.1.478 → 0.1.480 - Mend

@rubytech/create-maxy-code 0.1.478 → 0.1.480

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (252) hide show

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts CHANGED Viewed

@@ -1,8 +1,17 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync } from "node:fs";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  appendFileSync,
+  existsSync,
+  readdirSync,
+  readFileSync,
+  symlinkSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
 import { makeCfExec, makeHouseCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
@@ -685,40 +694,208 @@ function projectPage(names: string[], cursor?: string) {
   });
 }
+// A real site tree on disk. pagesDeploy copies the tree before uploading it, so
+// these tests cannot hand it a path that does not exist.
+function siteTree(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), "pages-site-"));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(dir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return dir;
+}
+const PORTAL = {
+  "index.html": "<!doctype html>",
+  "portal.js": "export {}",
+  "functions/api/files.js": "export {}",
+  "wrangler.toml": 'name = "kit-data"\ndatabase_id = "secret-looking"\n',
+};
+/** Snapshots the uploaded directory's contents at call time, because
+ *  pagesDeploy deletes the staging tree before it returns. */
+function snapshottingRun(stdout: string) {
+  const calls: Array<{
+    args: string[];
+    cwd?: string;
+    uploadDir: string;
+    uploaded: string[];
+  }> = [];
+  const run: RunFn = async (_cmd, args, _env, opts) => {
+    const uploadDir = args[3];
+    const uploaded: string[] = [];
+    const walk = (d: string, prefix: string) => {
+      for (const entry of readdirSync(d, { withFileTypes: true })) {
+        if (entry.isDirectory()) walk(join(d, entry.name), `${prefix}${entry.name}/`);
+        else uploaded.push(`${prefix}${entry.name}`);
+      }
+    };
+    walk(uploadDir, "");
+    calls.push({ args, cwd: opts?.cwd, uploadDir, uploaded: uploaded.sort() });
+    return { stdout };
+  };
+  return { run, calls };
+}
+const DEPLOYED = "✨ Deployment complete! Take a peek over at https://abc123.glsmithandsons.pages.dev\n";
 test("pagesDeploy shells npx wrangler (never bare) and returns the deployment url", async () => {
-  const { run, calls } = recordingRun(
-    "Uploading... (2/2)\n✨ Deployment complete! Take a peek over at https://abc123.glsmithandsons.pages.dev\n",
-  );
+  const dir = siteTree(PORTAL);
+  const { run, calls } = recordingRun(`Uploading... (2/2)\n${DEPLOYED}`);
   const cf = makeCfExec(cred, run);
-  const { url } = await cf.pagesDeploy("/acct/sites/gls", "glsmithandsons", "main");
+  const { url } = await cf.pagesDeploy(dir, "glsmithandsons", "main");
   assert.equal(url, "https://abc123.glsmithandsons.pages.dev");
   assert.equal(calls[0].cmd, "npx");
-  assert.deepEqual(calls[0].args, [
-    "wrangler", "pages", "deploy", "/acct/sites/gls",
+  assert.deepEqual(calls[0].args.slice(0, 3), ["wrangler", "pages", "deploy"]);
+  assert.deepEqual(calls[0].args.slice(4), [
     "--project-name", "glsmithandsons", "--branch", "main",
   ]);
   assert.equal(calls[0].env.CLOUDFLARE_API_TOKEN, "cfat_x");
 });
 test("pagesDeploy omits --branch when no branch is given", async () => {
-  const { run, calls } = recordingRun("✨ Deployment complete! Take a peek over at https://x.y.pages.dev\n");
+  const dir = siteTree(PORTAL);
+  const { run, calls } = recordingRun(DEPLOYED);
   const cf = makeCfExec(cred, run);
-  await cf.pagesDeploy("/acct/sites/gls", "glsmithandsons");
-  assert.deepEqual(calls[0].args, [
-    "wrangler", "pages", "deploy", "/acct/sites/gls", "--project-name", "glsmithandsons",
-  ]);
+  await cf.pagesDeploy(dir, "glsmithandsons");
+  assert.deepEqual(calls[0].args.slice(4), ["--project-name", "glsmithandsons"]);
 });
 test("pagesDeploy throws with the body when wrangler prints no deployment url", async () => {
+  const dir = siteTree(PORTAL);
   const { run } = recordingRun("Uploading... (0/0)\nsomething went sideways\n");
   const cf = makeCfExec(cred, run);
   await assert.rejects(
-    () => cf.pagesDeploy("/acct/sites/gls", "glsmithandsons"),
+    () => cf.pagesDeploy(dir, "glsmithandsons"),
     /something went sideways/,
     "a url-less wrangler run must surface its output, never report a silent success",
   );
 });
+// --- Task 1782: the uploaded set is the broker's, not whatever the tree holds ---
+test("pagesDeploy uploads a staged copy with the wrangler config left out", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data", "main");
+  assert.notEqual(
+    calls[0].uploadDir,
+    dir,
+    "the directory handed to wrangler must not be the tree that holds the config",
+  );
+  assert.deepEqual(
+    calls[0].uploaded,
+    ["functions/api/files.js", "index.html", "portal.js"],
+    "every site file is published and the config is not",
+  );
+  assert.deepEqual(excluded, ["wrangler.toml"]);
+});
+test("pagesDeploy still runs wrangler in the tree that holds the config", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data", "main");
+  // wrangler finds its config by walking up from the working directory, so the
+  // cwd is what keeps the D1 and R2 bindings applying once the file itself has
+  // left the upload. It is also still the writable scratch anchor Task 1770
+  // pinned it for.
+  assert.equal(calls[0].cwd, dir);
+});
+test("pagesDeploy excludes every config filename wrangler itself discovers", async () => {
+  const dir = siteTree({
+    "index.html": "<!doctype html>",
+    "wrangler.toml": "x",
+    "wrangler.json": "{}",
+    "wrangler.jsonc": "{}",
+  });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data");
+  assert.deepEqual(calls[0].uploaded, ["index.html"]);
+  assert.deepEqual(excluded, ["wrangler.json", "wrangler.jsonc", "wrangler.toml"]);
+});
+test("pagesDeploy keeps a nested file that merely shares the config's name", async () => {
+  const dir = siteTree({
+    "index.html": "<!doctype html>",
+    "wrangler.toml": "x",
+    "docs/wrangler.toml": "an example the site publishes on purpose",
+  });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data");
+  assert.deepEqual(calls[0].uploaded, ["docs/wrangler.toml", "index.html"]);
+  assert.deepEqual(excluded, ["wrangler.toml"], "only the config wrangler reads is dropped");
+});
+test("pagesDeploy reports nothing excluded for a tree that carries no config", async () => {
+  const dir = siteTree({ "index.html": "<!doctype html>" });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "glsmithandsons");
+  assert.deepEqual(calls[0].uploaded, ["index.html"]);
+  assert.deepEqual(excluded, []);
+});
+test("pagesDeploy publishes what a symlink pointed at, including one leaving the tree", async () => {
+  // wrangler's own upload walk stats each entry, so deploying in place published
+  // the link's target. Copying links verbatim would strand an escaping one.
+  // A relative link escaping the tree is the shape that would dangle if the copy
+  // reproduced it verbatim somewhere else on disk. It does not: node's fs.cp
+  // rewrites every symlink to its resolved absolute target, so the staged link
+  // still points at the real file and wrangler's stat-following walk publishes
+  // it exactly as an in-place deploy did. This pins that behaviour rather than
+  // trusting it — the whole change rests on the staged tree being what wrangler
+  // would have uploaded.
+  const base = mkdtempSync(join(tmpdir(), "pages-base-"));
+  mkdirSync(join(base, "shared"));
+  writeFileSync(join(base, "shared", "shared.css"), "body{}");
+  const dir = join(base, "site");
+  mkdirSync(dir);
+  writeFileSync(join(dir, "index.html"), "<!doctype html>");
+  writeFileSync(join(dir, "wrangler.toml"), "x");
+  symlinkSync(join("..", "shared", "shared.css"), join(dir, "theme.css"));
+  // Read during the run: the staging tree is gone by the time pagesDeploy returns.
+  let staged = "";
+  const run: RunFn = async (_cmd, args) => {
+    staged = readFileSync(join(args[3], "theme.css"), "utf8");
+    return { stdout: DEPLOYED };
+  };
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data");
+  assert.equal(
+    staged,
+    "body{}",
+    "the staged copy carries the target's bytes, not a link that resolves to nothing",
+  );
+});
+test("pagesDeploy removes the staging tree on the success path", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data");
+  assert.equal(existsSync(calls[0].uploadDir), false);
+  assert.equal(existsSync(join(dir, "wrangler.toml")), true, "the real tree is untouched");
+});
+test("pagesDeploy removes the staging tree when wrangler fails", async () => {
+  const dir = siteTree(PORTAL);
+  let uploadDir = "";
+  const run: RunFn = async (_cmd, args) => {
+    uploadDir = args[3];
+    throw new Error("wrangler exploded");
+  };
+  const cf = makeCfExec(cred, run);
+  await assert.rejects(() => cf.pagesDeploy(dir, "kit-data"), /wrangler exploded/);
+  assert.notEqual(uploadDir, "");
+  assert.equal(existsSync(uploadDir), false, "a failed deploy must not strand a copy of the site");
+});
 test("pagesProjectList follows the pagination cursor to exhaustion via the API, never wrangler", async () => {
   const { fetchFn, calls } = sequenceFetch([
     { ok: true, status: 200, body: projectPage(["glsmithandsons"], "c1") },
@@ -804,14 +981,15 @@ test("pagesDeploy pins wrangler's working directory to the deploy dir", async ()
   const { run, calls } = recordingRun(
     "\u2728 Deployment complete! Take a peek over at https://abc.kit-data.pages.dev\n",
   );
+  const dir = siteTree(PORTAL);
   const cf = makeCfExec(cred, run);
-  await cf.pagesDeploy("/acct/sites/kit-data", "kit-data", "main");
+  await cf.pagesDeploy(dir, "kit-data", "main");
   // Unpinned, wrangler resolves .wrangler/tmp against a directory it infers --
   // on a real install that is the immutable server tree, where the mkdir is
   // EPERM and every deploy dies before uploading.
   assert.equal(
     calls[0].cwd,
-    "/acct/sites/kit-data",
+    dir,
     "wrangler must run in the deploy dir so its scratch dir lands beside the tree it uploads",
   );
 });

package/payload/platform/lib/storage-broker/src/cf-exec.ts CHANGED Viewed

@@ -3,7 +3,9 @@
 // wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
 import { execFile } from "node:child_process";
-import { join } from "node:path";
+import { cp, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
 import type { HouseCredential } from "./house-credential.js";
 import { readHouseCredential } from "./house-credential.js";
 import { resolveHouseScopedToken } from "./house-scoped-token.js";
@@ -60,9 +62,24 @@ export interface CfExec {
   r2ObjectDelete(bucket: string, key: string): Promise<void>;
   pagesProjectList(): Promise<{ name: string }[]>;
   pagesProjectCreate(name: string, productionBranch: string): Promise<void>;
-  pagesDeploy(dir: string, project: string, branch?: string): Promise<{ url: string }>;
+  /** `excluded` names the files dropped from the upload set, so the caller can
+   *  log what was published rather than assert it (Task 1782). */
+  pagesDeploy(
+    dir: string,
+    project: string,
+    branch?: string,
+  ): Promise<{ url: string; excluded: string[] }>;
 }
+// The filenames `wrangler pages deploy` discovers as its own configuration
+// (wrangler 4.112.0). Task 1782 — the upload walk has a fixed ignore list with
+// no config hook, so a config sitting in the deployed tree is served publicly at
+// /wrangler.toml, disclosing the D1 database id and R2 bucket name, both of
+// which embed the account id. All three names are dropped rather than only the
+// .toml the data-portal template ships, so a tree that later gains a .json
+// config cannot quietly start republishing it.
+const WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
 // An object key carries `/` as a real path separator (the data portal's
 // per-person prefixes), so it is encoded segment-wise rather than whole:
 // separators stay separators, and spaces and specials are escaped. This
@@ -381,34 +398,62 @@ export function makeCfExec(
       }
     },
     async pagesDeploy(dir, project, branch) {
-      // wrangler is the only supported Pages upload path (it hashes the tree and
-      // uploads only what is missing); the API has no single-call equivalent.
-      const args = ["wrangler", "pages", "deploy", dir, "--project-name", project];
-      if (branch !== undefined) args.push("--branch", branch);
-      // Pin the working directory to the tree being published. Left to
-      // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
-      // directory (its nearest package.json/node_modules root), which the
-      // platform marks immutable — so the scratch mkdir returns EPERM and the
-      // deploy never reaches the upload. `dir` is the realpath-confined deploy
-      // directory the route resolved, it is writable, and it already holds this
-      // site's own wrangler.toml.
-      const { stdout } = await run("npx", args, env, { cwd: dir });
-      // The deployment URL is what the caller relays, so parse it strictly.
-      // Strip ANSI first: wrangler colours its output when it thinks it has a
-      // terminal, and a colour reset adjacent to the URL would otherwise be
-      // swallowed by the host character class and returned as part of it.
-      const plain = stdout.replace(/\[[0-9;]*m/g, "");
-      // Take the LAST match, not the first: wrangler prints the deployment URL
-      // on its closing line, and any earlier .pages.dev mention (an alias or a
-      // progress line) would otherwise win and hand back the wrong address.
-      const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
-      const url = urls?.[urls.length - 1];
-      // wrangler exits 0 on some partial paths, so a url-less success is an
-      // anomaly to surface with its output, never a silent "deployed".
-      if (!url) {
-        throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+      // Task 1782 — publish a directory the broker composes, not whatever the
+      // account's tree happens to hold. wrangler takes the upload directory from
+      // the positional argument and finds its configuration by walking up from
+      // the working directory, which are two independent inputs; pointing them
+      // at different places is what removes the config from the published assets
+      // while leaving the D1 and R2 bindings it declares fully in force.
+      // Measured on the house account 2026-07-20: a brand-new project deployed
+      // with the config outside the upload received the same bindings and the
+      // same config hash as the control that uploaded it.
+      const staged = await mkdtemp(join(tmpdir(), "maxy-pages-upload-"));
+      const excluded: string[] = [];
+      try {
+        await cp(dir, staged, {
+          recursive: true,
+          // Only a config at the root of the tree is wrangler's own. A nested
+          // file of the same name is site content and stays published.
+          filter: (src) => {
+            const rel = relative(dir, src);
+            if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
+            excluded.push(rel);
+            return false;
+          },
+        });
+        // wrangler is the only supported Pages upload path (it hashes the tree and
+        // uploads only what is missing); the API has no single-call equivalent.
+        const args = ["wrangler", "pages", "deploy", staged, "--project-name", project];
+        if (branch !== undefined) args.push("--branch", branch);
+        // Pin the working directory to the tree being published. Left to
+        // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
+        // directory (its nearest package.json/node_modules root), which the
+        // platform marks immutable — so the scratch mkdir returns EPERM and the
+        // deploy never reaches the upload. `dir` is the realpath-confined deploy
+        // directory the route resolved, and it is writable. Since 1782 it is also
+        // the only place wrangler can still find this site's config, which no
+        // longer travels with the assets.
+        const { stdout } = await run("npx", args, env, { cwd: dir });
+        // The deployment URL is what the caller relays, so parse it strictly.
+        // Strip ANSI first: wrangler colours its output when it thinks it has a
+        // terminal, and a colour reset adjacent to the URL would otherwise be
+        // swallowed by the host character class and returned as part of it.
+        const plain = stdout.replace(/\[[0-9;]*m/g, "");
+        // Take the LAST match, not the first: wrangler prints the deployment URL
+        // on its closing line, and any earlier .pages.dev mention (an alias or a
+        // progress line) would otherwise win and hand back the wrong address.
+        const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
+        const url = urls?.[urls.length - 1];
+        // wrangler exits 0 on some partial paths, so a url-less success is an
+        // anomaly to surface with its output, never a silent "deployed".
+        if (!url) {
+          throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+        }
+        return { url, excluded: excluded.sort() };
+      } finally {
+        // A failed deploy must not strand a second copy of the site on disk.
+        await rm(staged, { recursive: true, force: true });
       }
-      return { url };
     },
     // --- R2 objects (Task 1691) -------------------------------------------

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:6009a50cf8e577364b02bee6ca6a47c112f463807f891975c445989d027176f0
+content-hash: sha256:c7a28352289a7121b08a8d8f2d5bcb1e79497a6acda2e355756cf7b02051c3a5
 brand: maxy-code
 product-name: Maxy
 ---
@@ -1285,6 +1285,18 @@ The most common cause is wrong nameservers on the domain. The domain must use Cl
 - The `/data` page handles this itself: files over 95 MB are split into ~48 MB parts and sent one at a time under the cap, and the server reassembles them. No plan change or dashboard action is needed for uploads up to the 2 GB app ceiling.
 - Raising the proxied body limit is a paid-plan change made on the Cloudflare dashboard, not something the agent does.
+## The client file portal
+A portal gives named people their own passcode-protected page on a custom domain. Two things sit on it.
+**What they send you.** Anything they upload lands in the account's own storage, one area per person, and nobody sees anyone else's files.
+**What you have prepared for them.** The same page shows the account's deliverable folders — the work produced for that client. Which folders those are is not a setting to maintain: it follows the account's own filing structure, so a business whose work is organised into quotes sees quotes, and a business organised some other way sees that instead. Operator working data, the client's own uploads, and anything internal are never shown.
+Folder names and sizes are published to the portal on a schedule, so the client can browse even while the device is off. The files themselves stay on the device. Opening one checks the device is reachable and then hands the browser a link that expires after a few minutes; if the device is down the client is told exactly that, rather than getting a broken download.
+Each person is bound to one account when they are enrolled. Someone enrolled before this existed has no account bound and sees no folders until they are enrolled again.
 ## What the agent does and does not do
 **Does:** invokes `cloudflared` directly via Bash, following `plugins/cloudflare/references/manual-setup.md` step by step; quotes click-paths from the reference files verbatim; verifies external reachability with `curl -I` and surfaces the response.

package/payload/platform/plugins/cloudflare/PLUGIN.md CHANGED Viewed

@@ -34,7 +34,7 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 | [cloudflare/SKILL.md](skills/cloudflare/SKILL.md) | The entry point for every Cloudflare operation. Routes each operation class to its reference, names the outcome contracts (tunnel external HTTP 200; hosting deployed URL; D1 round-trip), and states the tool-discipline + secret-redaction rules that bind the agent. |
 | [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, the R2 binding trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md`, `d1-data-capture.md` and `r2-object-storage.md`. Admin-run; a content specialist hands the deploy off to it. |
 | [calendar-site/SKILL.md](skills/calendar-site/SKILL.md) | Assemble and deploy one account's public booking page — a static page plus edge Functions over a D1 `bookings` table — on its own custom domain, so a submission survives the install device being offline. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
-| [data-portal/SKILL.md](skills/data-portal/SKILL.md) | Stand up one account's gated file-drop portal on its own custom domain: each enrolled person signs in with their own passcode and can upload, list, download and delete only their own files, into one R2 bucket under a per-person prefix with a D1 manifest row per upload. The bucket is created by the owning account's own session — the broker registers ownership to the creator and never reassigns it — while the admin assembles and deploys. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
+| [data-portal/SKILL.md](skills/data-portal/SKILL.md) | Stand up one account's gated file-drop portal on its own custom domain: each enrolled person signs in with their own passcode and can upload, list, download and delete only their own files, into one R2 bucket under a per-person prefix with a D1 manifest row per upload. The same portal also shows that sub-account's deliverable folders, published from the device as metadata only and opened through a short-lived signed link. The bucket is created by the owning account's own session — the broker registers ownership to the creator and never reassigns it — while the admin assembles and deploys. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
 ### References
@@ -69,6 +69,31 @@ The setup-done claim only fires when `curl -I https://<hostname>` issued from ou
 - **Cloudflare account identity** — `cert.pem` from OAuth. One account per brand per device.
 - **Account binding drift** — `~/{configDir}/cloudflared/account-binding.json` is a historical drift marker. Reset by `rm -rf ~/.${BRAND}/cloudflared/` per `references/reset-guide.md` when switching accounts.
+## Data-portal folder index
+The portal shows a sub-account's deliverable folders alongside what the client uploaded. Which folders those are is never a list in the code: it is derived per account from that account's own `SCHEMA.md` — the buckets in its `<!-- ontology-buckets -->` region plus `output`, intersected with its `allowed-top-level` block. A brand on a different vertical exposes different folders with no code change. `bin/schema-exposed-dirs.mjs` is the only place that decision is made.
+`bin/portal-index-push.mjs` walks those folders and full-replaces the account's rows in the portal's D1 `directory` table each cycle. Metadata only — names, sizes, times — so listing survives the device being offline, and a deleted or renamed file converges on the next cycle without a tombstone. The scheduling heartbeat runs it hourly for every account carrying a `data-portal.json`; it is also runnable standalone, which is how it stays operable while the heartbeat spawn path is unproven on a device.
+Opening a file reaches the install: the portal probes it, then mints an `/api/portal/fetch` link signed with the account's `PORTAL_FETCH_SECRET` and valid for five minutes. The install verifies the signature **and independently re-derives the exposed folder set**, so a correctly signed link for a non-exposed path is still refused. That second check is the security boundary, not the signature.
+What to watch, on the device:
+```
+[portal-index] op=resolve account=<id> schemaPresent=<bool> allowed=<n> domainBuckets=<dirs|none> exposed=<dirs|none>
+[portal-index] op=replace account=<id> deleted=all inserted=<n>
+[portal-index] op=verify  account=<id> rowsAfter=<n> expected=<n>
+[portal-index] op=collision account=<id> dir=<dir> claimedBy=plugin-owned
+[portal-index] op=exposed-changed account=<id> added=<dirs|none> removed=<dirs|none>
+[portal-index] op=audit accounts=<n> stale=<n> never-ran=<n>
+```
+`exposed=none` where deliverables exist means the schema was missing or carried no ontology region — not that the walk found nothing. `rowsAfter` disagreeing with `expected` is a half-applied replace. An `op=collision` line explains a folder that has silently vanished from the client's view, which nothing else would report. `op=exposed-changed` fires only on a delta, so it is rare and always worth reading; a `removed=` naming a populated bucket is the client-visible regression.
+`op=audit` is the standing check, and it is the only one that speaks when the push does **not**. It runs in-process inside the heartbeat rather than as a spawn, and reads only local state, so it cannot be blinded by the same failure it is watching for. It fires hourly even when everything is healthy — an audit that goes quiet on success is indistinguishable from an audit that stopped running. `result=never-ran` on an account with a `data-portal.json` means no cycle has ever succeeded for it; `result=stale` with `ageMin` means cycles have stopped. Its input is written only after `op=verify`, so a stale entry means the push stopped succeeding rather than merely stopped logging.
+On the portal side `[data-portal] op=list` carries `account=` and `op=fetch-through` carries the outcome; on the install `[portal-fetch]` logs `op=request` then exactly one of `op=served`, `op=denied`, `op=miss`. A portal `fetch-through` with no matching install `op=request` means the request never arrived, rather than having been refused. `[portal-fetch] op=no-secret account=<id>` is an unconfigured portal, which the `op=denied reason=secret` line alone would not distinguish from a bad signature.
 ## Discipline
 The agent's permitted surfaces are: direct `cloudflared` and `wrangler` invocations via Bash following the references; Cloudflare API calls authenticated by a reused per-scope narrow token, minted once if absent and persisted to the secrets file (the master token stays in that same file, never on a command line that echoes, never in chat); the reference files; and live verification (`curl -I` for tunnels, the deployed URL for hosting, a `SELECT` for D1). Out of bounds: Playwright or Chrome DevTools driving the dashboard, browser-automating master-token creation, WebSearch-for-CF-recipes, ad-hoc `cloudflared` flag invention not in the runbook, and writing or echoing any token. When a step fails, the agent reports the exact output (secrets redacted), cites the recovery step from `references/reset-guide.md`, and stops.

package/payload/platform/plugins/cloudflare/bin/d1-http.mjs ADDED Viewed

@@ -0,0 +1,80 @@
+// D1 over the Cloudflare HTTP API, with bound parameters.
+//
+// Not `wrangler d1 execute`: that spawns a process per statement, which is the
+// CPU-burn defect Task 1805 fixed, and it takes a raw SQL string, which would
+// mean interpolating filenames into SQL. The index push writes one row per file,
+// so both matter here.
+//
+// storage-broker's cf-exec.d1Query still spawns wrangler, and the scheduling
+// plugin has its own HTTP client. Converging the three is a follow-up; this
+// client depends on neither, because the cloudflare plugin is where Cloudflare
+// access belongs and importing the scheduling plugin from here would invert that.
+const API = 'https://api.cloudflare.com/client/v4'
+/**
+ * Always carries the response body into the message. A bare status renders
+ * every failure identical and unactionable.
+ * @param {unknown} parsed @param {number} status @param {string} label
+ * @returns {never}
+ */
+function fail(parsed, status, label) {
+  const errs = /** @type {{errors?: {message?: string}[]}} */ (parsed)?.errors
+  const detail = Array.isArray(errs) && errs.length ? errs.map((e) => e?.message).join('; ') : ''
+  throw new Error(`${label} failed: HTTP ${status}${detail ? ` — ${detail}` : ''}`)
+}
+/**
+ * @param {{ accountId: string, token: string, dbName: string,
+ *           fetchFn?: (url: string, init: object) => Promise<{ ok: boolean, status: number, json: () => Promise<unknown> }> }} opts
+ */
+export function createD1Client(opts) {
+  const fetchFn = opts.fetchFn ?? /** @type {never} */ (globalThis.fetch)
+  const headers = { Authorization: `Bearer ${opts.token}`, 'Content-Type': 'application/json' }
+  /** @type {string | undefined} */ let databaseId
+  let statements = 0
+  async function resolveId() {
+    if (databaseId !== undefined) return databaseId
+    const url = `${API}/accounts/${opts.accountId}/d1/database?name=${encodeURIComponent(opts.dbName)}`
+    const res = await fetchFn(url, { method: 'GET', headers })
+    const parsed = await res.json()
+    if (!res.ok) fail(parsed, res.status, 'd1 database lookup')
+    const list = /** @type {{result?: {name?: string, uuid?: string}[]}} */ (parsed).result ?? []
+    // Exact name match, never "the first result": `?name=` is a filter whose
+    // matching rule is not documented, so taking position on trust would let a
+    // near-name run this account's statements against the wrong database.
+    const hit = list.find((d) => d.name === opts.dbName)
+    if (!hit || typeof hit.uuid !== 'string') {
+      throw new Error(`no D1 database named "${opts.dbName}" in account ${opts.accountId}`)
+    }
+    databaseId = hit.uuid
+    return databaseId
+  }
+  /** @param {string} sql @param {unknown[]} [params] */
+  async function query(sql, params = []) {
+    const id = await resolveId()
+    // Counted before the await: `statements` is what reached D1, and a
+    // statement that was issued and then errored still went. Counting successes
+    // only would report 0 both for "the lookup failed so nothing was sent" and
+    // for "one statement was sent and errored".
+    statements++
+    const res = await fetchFn(`${API}/accounts/${opts.accountId}/d1/database/${id}/query`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ sql, params }),
+    })
+    const parsed = await res.json()
+    if (!res.ok) fail(parsed, res.status, 'd1 query')
+    const first = (/** @type {{result?: {results?: unknown}[]}} */ (parsed).result ?? [])[0]
+    return /** @type {Record<string, unknown>[]} */ (first?.results ?? [])
+  }
+  return {
+    query,
+    get statements() {
+      return statements
+    },
+  }
+}

package/payload/platform/plugins/cloudflare/bin/portal-enrol.mjs CHANGED Viewed

@@ -20,7 +20,7 @@
 //
 // Usage:
 //   node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
-//     | npx wrangler d1 execute <db> --remote --file=-
+//     --account <accountId> | npx wrangler d1 execute <db> --remote --file=-
 import {
   PASSCODE_LENGTH,
@@ -60,6 +60,17 @@ if (!OWNER_ID.test(/** @type {string} */ (ownerId))) {
 // the literal harmlessly — but it breaks the pipeable contract, so refuse it.
 if (/[\r\n]/.test(/** @type {string} */ (name))) die('--name cannot contain a line break')
+// The sub-account whose deliverable folders this person may read. Required, and
+// validated to the same charset the account partition uses: a person enrolled
+// with no account resolves to an EMPTY folder list, which is indistinguishable
+// from a sub-account that simply has no deliverables. That is a failure nobody
+// diagnoses, so it fails here instead — loudly, before the row exists.
+const accountId = arg('--account')
+if (!accountId) die('--account <accountId> is required')
+if (!/^[A-Za-z0-9-]+$/.test(/** @type {string} */ (accountId))) {
+  die('--account must match ^[A-Za-z0-9-]+$ — an account id, not a path')
+}
 const saltBytes = new Uint8Array(16)
 crypto.getRandomValues(saltBytes)
 const saltHex = randomSaltHex(saltBytes)
@@ -84,8 +95,12 @@ const createdAt = new Date().toISOString()
 //
 // `createdAt` is deliberately absent from the DO UPDATE: it records when the
 // person was enrolled, and rotating a passcode is not creating a person.
+//
+// `accountId` IS in the DO UPDATE: re-enrolling someone against a different
+// sub-account has to move them, or they keep reading folders they no longer
+// belong to.
 console.log(
-  `INSERT INTO people (ownerId, name, salt, hash, createdAt) VALUES ('${ownerId}', '${sqlName}', '${saltHex}', '${hash}', '${createdAt}') ON CONFLICT(ownerId) DO UPDATE SET name=excluded.name, salt=excluded.salt, hash=excluded.hash;`,
+  `INSERT INTO people (ownerId, name, salt, hash, createdAt, accountId) VALUES ('${ownerId}', '${sqlName}', '${saltHex}', '${hash}', '${createdAt}', '${accountId}') ON CONFLICT(ownerId) DO UPDATE SET name=excluded.name, salt=excluded.salt, hash=excluded.hash, accountId=excluded.accountId;`,
 )
 // stderr: everything for the human. Never stdout — see the note at the top.