@rubytech/create-maxy-code 0.1.479 → 0.1.481

package/payload/platform/lib/storage-broker/dist/cf-exec.js

@@ -7,9 +7,19 @@ exports.makeCfExec = makeCfExec;
 exports.makeHouseCfExec = makeHouseCfExec;
 exports.makeHousePagesExec = makeHousePagesExec;
 const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const house_credential_js_1 = require("./house-credential.js");
 const house_scoped_token_js_1 = require("./house-scoped-token.js");
+// The filenames `wrangler pages deploy` discovers as its own configuration
+// (wrangler 4.112.0). Task 1782 — the upload walk has a fixed ignore list with
+// no config hook, so a config sitting in the deployed tree is served publicly at
+// /wrangler.toml, disclosing the D1 database id and R2 bucket name, both of
+// which embed the account id. All three names are dropped rather than only the
+// .toml the data-portal template ships, so a tree that later gains a .json
+// config cannot quietly start republishing it.
+const WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
 // An object key carries `/` as a real path separator (the data portal's
 // per-person prefixes), so it is encoded segment-wise rather than whole:
 // separators stay separators, and spaces and specials are escaped. This
@@ -267,35 +277,65 @@ function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
             }
         },
         async pagesDeploy(dir, project, branch) {
-            // wrangler is the only supported Pages upload path (it hashes the tree and
-            // uploads only what is missing); the API has no single-call equivalent.
-            const args = ["wrangler", "pages", "deploy", dir, "--project-name", project];
-            if (branch !== undefined)
-                args.push("--branch", branch);
-            // Pin the working directory to the tree being published. Left to
-            // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
-            // directory (its nearest package.json/node_modules root), which the
-            // platform marks immutable — so the scratch mkdir returns EPERM and the
-            // deploy never reaches the upload. `dir` is the realpath-confined deploy
-            // directory the route resolved, it is writable, and it already holds this
-            // site's own wrangler.toml.
-            const { stdout } = await run("npx", args, env, { cwd: dir });
-            // The deployment URL is what the caller relays, so parse it strictly.
-            // Strip ANSI first: wrangler colours its output when it thinks it has a
-            // terminal, and a colour reset adjacent to the URL would otherwise be
-            // swallowed by the host character class and returned as part of it.
-            const plain = stdout.replace(/\[[0-9;]*m/g, "");
-            // Take the LAST match, not the first: wrangler prints the deployment URL
-            // on its closing line, and any earlier .pages.dev mention (an alias or a
-            // progress line) would otherwise win and hand back the wrong address.
-            const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
-            const url = urls?.[urls.length - 1];
-            // wrangler exits 0 on some partial paths, so a url-less success is an
-            // anomaly to surface with its output, never a silent "deployed".
-            if (!url) {
-                throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+            // Task 1782 — publish a directory the broker composes, not whatever the
+            // account's tree happens to hold. wrangler takes the upload directory from
+            // the positional argument and finds its configuration by walking up from
+            // the working directory, which are two independent inputs; pointing them
+            // at different places is what removes the config from the published assets
+            // while leaving the D1 and R2 bindings it declares fully in force.
+            // Measured on the house account 2026-07-20: a brand-new project deployed
+            // with the config outside the upload received the same bindings and the
+            // same config hash as the control that uploaded it.
+            const staged = await (0, promises_1.mkdtemp)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "maxy-pages-upload-"));
+            const excluded = [];
+            try {
+                await (0, promises_1.cp)(dir, staged, {
+                    recursive: true,
+                    // Only a config at the root of the tree is wrangler's own. A nested
+                    // file of the same name is site content and stays published.
+                    filter: (src) => {
+                        const rel = (0, node_path_1.relative)(dir, src);
+                        if (!WRANGLER_CONFIG_NAMES.includes(rel))
+                            return true;
+                        excluded.push(rel);
+                        return false;
+                    },
+                });
+                // wrangler is the only supported Pages upload path (it hashes the tree and
+                // uploads only what is missing); the API has no single-call equivalent.
+                const args = ["wrangler", "pages", "deploy", staged, "--project-name", project];
+                if (branch !== undefined)
+                    args.push("--branch", branch);
+                // Pin the working directory to the tree being published. Left to
+                // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
+                // directory (its nearest package.json/node_modules root), which the
+                // platform marks immutable — so the scratch mkdir returns EPERM and the
+                // deploy never reaches the upload. `dir` is the realpath-confined deploy
+                // directory the route resolved, and it is writable. Since 1782 it is also
+                // the only place wrangler can still find this site's config, which no
+                // longer travels with the assets.
+                const { stdout } = await run("npx", args, env, { cwd: dir });
+                // The deployment URL is what the caller relays, so parse it strictly.
+                // Strip ANSI first: wrangler colours its output when it thinks it has a
+                // terminal, and a colour reset adjacent to the URL would otherwise be
+                // swallowed by the host character class and returned as part of it.
+                const plain = stdout.replace(/\[[0-9;]*m/g, "");
+                // Take the LAST match, not the first: wrangler prints the deployment URL
+                // on its closing line, and any earlier .pages.dev mention (an alias or a
+                // progress line) would otherwise win and hand back the wrong address.
+                const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
+                const url = urls?.[urls.length - 1];
+                // wrangler exits 0 on some partial paths, so a url-less success is an
+                // anomaly to surface with its output, never a silent "deployed".
+                if (!url) {
+                    throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+                }
+                return { url, excluded: excluded.sort() };
+            }
+            finally {
+                // A failed deploy must not strand a second copy of the site on disk.
+                await (0, promises_1.rm)(staged, { recursive: true, force: true });
             }
-            return { url };
         },
         // --- R2 objects (Task 1691) -------------------------------------------
         //

package/payload/platform/lib/storage-broker/dist/cf-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AA+MjF,gCA6SC;AASD,0CAUC;AAaD,gDAUC;AApiBD,2DAA8C;AAC9C,yCAAiC;AAEjC,+DAA4D;AAC5D,mEAAkE;AAyDlE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,qBAAqB;AACrB,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/D,OAAO,iDAAiD,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,YAAY,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/I,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;AAE7E,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,0CAA0C;AAC1C,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAW,EACX,IAAqF,EACrF,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAiC,CAAC;IACxE,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,gDAAgD;AAChD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,6CAA6C;AAC7C,KAAK,SAAS,CAAC,CAAC,aAAa,CAC3B,OAAgB,EAChB,IAAqB,EACrB,MAAc,EACd,MAAe;IAEf,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;IAChI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;QACF,MAAM,IAAI,GAAG,MAGZ,CAAC;QACF,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,CAAC;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QACtC,4EAA4E;QAC5E,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,SAAS,KAAK,KAAK;YAAE,OAAO;QAChC,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,oFAAoF,IAAI,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,EACD,WAAW,CACZ,CAAC;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,GAAI,MAAyC,CAAC,MAAM,EAAE,IAAI,CAAC;YACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YAC1F,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,OAAO,EACP,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC1B,yEAAyE;gBACzE,qEAAqE;gBACrE,oEAAoE;gBACpE,wEAAwE;gBACxE,2CAA2C;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,KAAK,CAAC,gBAAgB;YACpB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,iBAAiB,CAAC;YAC9F,MAAM,QAAQ,GAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,OAAO,EACP,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,oBAAoB,CACrB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,QAAQ,CAAC;gBAC3B,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,EAAE,CACpF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;YAC7C,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,iBAAiB,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;aACpE,EACD,sBAAsB,CACvB,CAAC;YACF,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,yBAAyB;YACzB,MAAM,OAAO,GAAI,MAAyC,CAAC,MAAM,EAAE,IAAI,CAAC;YACxE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YACpC,2EAA2E;YAC3E,wEAAwE;YACxE,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxD,iEAAiE;YACjE,yEAAyE;YACzE,oEAAoE;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,4BAA4B;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,sEAAsE;YACtE,wEAAwE;YACxE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACjD,yEAAyE;YACzE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpC,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,4DAA4D,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QAED,yEAAyE;QACzE,EAAE;QACF,mDAAmD;QACnD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,EAAE;QACF,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,EAAE;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,iEAAiE;QACjE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,mFAAmF;QACnF,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,oCAAoC;YACpC,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG;YAC5B,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,oCAAoC;YACpC,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,sDAAsD;YACtD,mFAAmF;YACnF,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBAC5C,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG;YAC3B,yEAAyE;YACzE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;gBAChE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI;YACjC,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAC9E,eAAe,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG;YAC9B,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAC3E,kBAAkB,CACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,yDAAyD;AAClD,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"cf-exec.js","sourceRoot":"","sources":["../src/cf-exec.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,iFAAiF;AACjF,iFAAiF;;AAgOjF,gCAyUC;AASD,0CAUC;AAaD,gDAUC;AAjlBD,2DAA8C;AAC9C,+CAAmD;AACnD,qCAAiC;AACjC,yCAA2C;AAE3C,+DAA4D;AAC5D,mEAAkE;AA+DlE,2EAA2E;AAC3E,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,+CAA+C;AAC/C,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAEnF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,qBAAqB;AACrB,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/D,OAAO,iDAAiD,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,YAAY,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/I,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,oDAAoD;AACpD,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAC,CAAC;AAE7E,MAAM,UAAU,GAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACnE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,0CAA0C;AAC1C,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAW,EACX,IAAqF,EACrF,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAiC,CAAC;IACxE,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,gDAAgD;AAChD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,6CAA6C;AAC7C,KAAK,SAAS,CAAC,CAAC,aAAa,CAC3B,OAAgB,EAChB,IAAqB,EACrB,MAAc,EACd,MAAe;IAEf,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,eAAe,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;IAChI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;QACF,MAAM,IAAI,GAAG,MAGZ,CAAC;QACF,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,CAAC;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QACtC,4EAA4E;QAC5E,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,SAAS,KAAK,KAAK;YAAE,OAAO;QAChC,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,oFAAoF,IAAI,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,0EAA0E;QAC1E,6EAA6E;QAC7E,kEAAkE;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CACxB,IAAqB,EACrB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,GAAG,GAAG;QACV,GAAG,OAAO,CAAC,GAAG;QACd,oBAAoB,EAAE,IAAI,CAAC,QAAQ;QACnC,qBAAqB,EAAE,IAAI,CAAC,SAAS;KACZ,CAAC;IAE5B,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAqC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,cAAc,CAAC;YAC1F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,EACD,WAAW,CACZ,CAAC;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,GAAI,MAAyC,CAAC,MAAM,EAAE,IAAI,CAAC;YACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,KAAK,EACL,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAC3E,GAAG,CACJ,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,aAAa,CAAC;YAC1F,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,OAAO,EACP,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,gBAAgB,CACjB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC1B,yEAAyE;gBACzE,qEAAqE;gBACrE,oEAAoE;gBACpE,wEAAwE;gBACxE,2CAA2C;gBAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,EAAE,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,KAAK,CAAC,gBAAgB;YACpB,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,iBAAiB,CAAC;YAC9F,MAAM,QAAQ,GAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,MAA0B,CAAC;YAC/B,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,OAAO,EACP,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACxE,oBAAoB,CACrB,CAAC;gBACF,MAAM,IAAI,GAAG,MAGZ,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,OAAO,QAAQ,CAAC;gBAC3B,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,EAAE,CACpF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB;YAC7C,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,GAAG,GAAG,iDAAiD,IAAI,CAAC,SAAS,iBAAiB,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACtC,OAAO,EACP,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;aACpE,EACD,sBAAsB,CACvB,CAAC;YACF,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,yBAAyB;YACzB,MAAM,OAAO,GAAI,MAAyC,CAAC,MAAM,EAAE,IAAI,CAAC;YACxE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YACpC,wEAAwE;YACxE,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,2EAA2E;YAC3E,mEAAmE;YACnE,yEAAyE;YACzE,wEAAwE;YACxE,oDAAoD;YACpD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAA,aAAE,EAAC,GAAG,EAAE,MAAM,EAAE;oBACpB,SAAS,EAAE,IAAI;oBACf,oEAAoE;oBACpE,6DAA6D;oBAC7D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;wBACd,MAAM,GAAG,GAAG,IAAA,oBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBAC/B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAAE,OAAO,IAAI,CAAC;wBACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACnB,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF,CAAC,CAAC;gBACH,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBAChF,IAAI,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACxD,iEAAiE;gBACjE,yEAAyE;gBACzE,oEAAoE;gBACpE,wEAAwE;gBACxE,yEAAyE;gBACzE,0EAA0E;gBAC1E,sEAAsE;gBACtE,kCAAkC;gBAClC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7D,sEAAsE;gBACtE,wEAAwE;gBACxE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACjD,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpC,sEAAsE;gBACtE,iEAAiE;gBACjE,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CAAC,4DAA4D,MAAM,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,CAAC;oBAAS,CAAC;gBACT,qEAAqE;gBACrE,MAAM,IAAA,aAAE,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,EAAE;QACF,mDAAmD;QACnD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,EAAE;QACF,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,EAAE;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,iEAAiE;QACjE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE;QACF,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,mFAAmF;QACnF,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,oCAAoC;YACpC,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG;YAC5B,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,oCAAoC;YACpC,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,sDAAsD;YACtD,mFAAmF;YACnF,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBAC5C,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG;YAC3B,yEAAyE;YACzE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;gBAChE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI;YACjC,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAC9E,eAAe,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG;YAC9B,MAAM,SAAS,CACb,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAC3E,kBAAkB,CACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,yDAAyD;AAClD,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,MAAa,UAAU,EACvB,UAAmB,YAAY;IAE/B,MAAM,IAAI,GAAG,IAAA,yCAAmB,EAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,IAAA,+CAAuB,EAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -1,8 +1,17 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync } from "node:fs";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  appendFileSync,
+  existsSync,
+  readdirSync,
+  readFileSync,
+  symlinkSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
 import { makeCfExec, makeHouseCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
 
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
@@ -685,40 +694,208 @@ function projectPage(names: string[], cursor?: string) {
   });
 }
 
+// A real site tree on disk. pagesDeploy copies the tree before uploading it, so
+// these tests cannot hand it a path that does not exist.
+function siteTree(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), "pages-site-"));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(dir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return dir;
+}
+
+const PORTAL = {
+  "index.html": "<!doctype html>",
+  "portal.js": "export {}",
+  "functions/api/files.js": "export {}",
+  "wrangler.toml": 'name = "kit-data"\ndatabase_id = "secret-looking"\n',
+};
+
+/** Snapshots the uploaded directory's contents at call time, because
+ *  pagesDeploy deletes the staging tree before it returns. */
+function snapshottingRun(stdout: string) {
+  const calls: Array<{
+    args: string[];
+    cwd?: string;
+    uploadDir: string;
+    uploaded: string[];
+  }> = [];
+  const run: RunFn = async (_cmd, args, _env, opts) => {
+    const uploadDir = args[3];
+    const uploaded: string[] = [];
+    const walk = (d: string, prefix: string) => {
+      for (const entry of readdirSync(d, { withFileTypes: true })) {
+        if (entry.isDirectory()) walk(join(d, entry.name), `${prefix}${entry.name}/`);
+        else uploaded.push(`${prefix}${entry.name}`);
+      }
+    };
+    walk(uploadDir, "");
+    calls.push({ args, cwd: opts?.cwd, uploadDir, uploaded: uploaded.sort() });
+    return { stdout };
+  };
+  return { run, calls };
+}
+
+const DEPLOYED = "✨ Deployment complete! Take a peek over at https://abc123.glsmithandsons.pages.dev\n";
+
 test("pagesDeploy shells npx wrangler (never bare) and returns the deployment url", async () => {
-  const { run, calls } = recordingRun(
-    "Uploading... (2/2)\n✨ Deployment complete! Take a peek over at https://abc123.glsmithandsons.pages.dev\n",
-  );
+  const dir = siteTree(PORTAL);
+  const { run, calls } = recordingRun(`Uploading... (2/2)\n${DEPLOYED}`);
   const cf = makeCfExec(cred, run);
-  const { url } = await cf.pagesDeploy("/acct/sites/gls", "glsmithandsons", "main");
+  const { url } = await cf.pagesDeploy(dir, "glsmithandsons", "main");
   assert.equal(url, "https://abc123.glsmithandsons.pages.dev");
   assert.equal(calls[0].cmd, "npx");
-  assert.deepEqual(calls[0].args, [
-    "wrangler", "pages", "deploy", "/acct/sites/gls",
+  assert.deepEqual(calls[0].args.slice(0, 3), ["wrangler", "pages", "deploy"]);
+  assert.deepEqual(calls[0].args.slice(4), [
     "--project-name", "glsmithandsons", "--branch", "main",
   ]);
   assert.equal(calls[0].env.CLOUDFLARE_API_TOKEN, "cfat_x");
 });
 
 test("pagesDeploy omits --branch when no branch is given", async () => {
-  const { run, calls } = recordingRun("✨ Deployment complete! Take a peek over at https://x.y.pages.dev\n");
+  const dir = siteTree(PORTAL);
+  const { run, calls } = recordingRun(DEPLOYED);
   const cf = makeCfExec(cred, run);
-  await cf.pagesDeploy("/acct/sites/gls", "glsmithandsons");
-  assert.deepEqual(calls[0].args, [
-    "wrangler", "pages", "deploy", "/acct/sites/gls", "--project-name", "glsmithandsons",
-  ]);
+  await cf.pagesDeploy(dir, "glsmithandsons");
+  assert.deepEqual(calls[0].args.slice(4), ["--project-name", "glsmithandsons"]);
 });
 
 test("pagesDeploy throws with the body when wrangler prints no deployment url", async () => {
+  const dir = siteTree(PORTAL);
   const { run } = recordingRun("Uploading... (0/0)\nsomething went sideways\n");
   const cf = makeCfExec(cred, run);
   await assert.rejects(
-    () => cf.pagesDeploy("/acct/sites/gls", "glsmithandsons"),
+    () => cf.pagesDeploy(dir, "glsmithandsons"),
     /something went sideways/,
     "a url-less wrangler run must surface its output, never report a silent success",
   );
 });
 
+// --- Task 1782: the uploaded set is the broker's, not whatever the tree holds ---
+
+test("pagesDeploy uploads a staged copy with the wrangler config left out", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data", "main");
+  assert.notEqual(
+    calls[0].uploadDir,
+    dir,
+    "the directory handed to wrangler must not be the tree that holds the config",
+  );
+  assert.deepEqual(
+    calls[0].uploaded,
+    ["functions/api/files.js", "index.html", "portal.js"],
+    "every site file is published and the config is not",
+  );
+  assert.deepEqual(excluded, ["wrangler.toml"]);
+});
+
+test("pagesDeploy still runs wrangler in the tree that holds the config", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data", "main");
+  // wrangler finds its config by walking up from the working directory, so the
+  // cwd is what keeps the D1 and R2 bindings applying once the file itself has
+  // left the upload. It is also still the writable scratch anchor Task 1770
+  // pinned it for.
+  assert.equal(calls[0].cwd, dir);
+});
+
+test("pagesDeploy excludes every config filename wrangler itself discovers", async () => {
+  const dir = siteTree({
+    "index.html": "<!doctype html>",
+    "wrangler.toml": "x",
+    "wrangler.json": "{}",
+    "wrangler.jsonc": "{}",
+  });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data");
+  assert.deepEqual(calls[0].uploaded, ["index.html"]);
+  assert.deepEqual(excluded, ["wrangler.json", "wrangler.jsonc", "wrangler.toml"]);
+});
+
+test("pagesDeploy keeps a nested file that merely shares the config's name", async () => {
+  const dir = siteTree({
+    "index.html": "<!doctype html>",
+    "wrangler.toml": "x",
+    "docs/wrangler.toml": "an example the site publishes on purpose",
+  });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "kit-data");
+  assert.deepEqual(calls[0].uploaded, ["docs/wrangler.toml", "index.html"]);
+  assert.deepEqual(excluded, ["wrangler.toml"], "only the config wrangler reads is dropped");
+});
+
+test("pagesDeploy reports nothing excluded for a tree that carries no config", async () => {
+  const dir = siteTree({ "index.html": "<!doctype html>" });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "glsmithandsons");
+  assert.deepEqual(calls[0].uploaded, ["index.html"]);
+  assert.deepEqual(excluded, []);
+});
+
+test("pagesDeploy publishes what a symlink pointed at, including one leaving the tree", async () => {
+  // wrangler's own upload walk stats each entry, so deploying in place published
+  // the link's target. Copying links verbatim would strand an escaping one.
+  // A relative link escaping the tree is the shape that would dangle if the copy
+  // reproduced it verbatim somewhere else on disk. It does not: node's fs.cp
+  // rewrites every symlink to its resolved absolute target, so the staged link
+  // still points at the real file and wrangler's stat-following walk publishes
+  // it exactly as an in-place deploy did. This pins that behaviour rather than
+  // trusting it — the whole change rests on the staged tree being what wrangler
+  // would have uploaded.
+  const base = mkdtempSync(join(tmpdir(), "pages-base-"));
+  mkdirSync(join(base, "shared"));
+  writeFileSync(join(base, "shared", "shared.css"), "body{}");
+  const dir = join(base, "site");
+  mkdirSync(dir);
+  writeFileSync(join(dir, "index.html"), "<!doctype html>");
+  writeFileSync(join(dir, "wrangler.toml"), "x");
+  symlinkSync(join("..", "shared", "shared.css"), join(dir, "theme.css"));
+  // Read during the run: the staging tree is gone by the time pagesDeploy returns.
+  let staged = "";
+  const run: RunFn = async (_cmd, args) => {
+    staged = readFileSync(join(args[3], "theme.css"), "utf8");
+    return { stdout: DEPLOYED };
+  };
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data");
+  assert.equal(
+    staged,
+    "body{}",
+    "the staged copy carries the target's bytes, not a link that resolves to nothing",
+  );
+});
+
+test("pagesDeploy removes the staging tree on the success path", async () => {
+  const dir = siteTree(PORTAL);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "kit-data");
+  assert.equal(existsSync(calls[0].uploadDir), false);
+  assert.equal(existsSync(join(dir, "wrangler.toml")), true, "the real tree is untouched");
+});
+
+test("pagesDeploy removes the staging tree when wrangler fails", async () => {
+  const dir = siteTree(PORTAL);
+  let uploadDir = "";
+  const run: RunFn = async (_cmd, args) => {
+    uploadDir = args[3];
+    throw new Error("wrangler exploded");
+  };
+  const cf = makeCfExec(cred, run);
+  await assert.rejects(() => cf.pagesDeploy(dir, "kit-data"), /wrangler exploded/);
+  assert.notEqual(uploadDir, "");
+  assert.equal(existsSync(uploadDir), false, "a failed deploy must not strand a copy of the site");
+});
+
 test("pagesProjectList follows the pagination cursor to exhaustion via the API, never wrangler", async () => {
   const { fetchFn, calls } = sequenceFetch([
     { ok: true, status: 200, body: projectPage(["glsmithandsons"], "c1") },
@@ -804,14 +981,15 @@ test("pagesDeploy pins wrangler's working directory to the deploy dir", async ()
   const { run, calls } = recordingRun(
     "\u2728 Deployment complete! Take a peek over at https://abc.kit-data.pages.dev\n",
   );
+  const dir = siteTree(PORTAL);
   const cf = makeCfExec(cred, run);
-  await cf.pagesDeploy("/acct/sites/kit-data", "kit-data", "main");
+  await cf.pagesDeploy(dir, "kit-data", "main");
   // Unpinned, wrangler resolves .wrangler/tmp against a directory it infers --
   // on a real install that is the immutable server tree, where the mkdir is
   // EPERM and every deploy dies before uploading.
   assert.equal(
     calls[0].cwd,
-    "/acct/sites/kit-data",
+    dir,
     "wrangler must run in the deploy dir so its scratch dir lands beside the tree it uploads",
   );
 });

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -3,7 +3,9 @@
 // wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
 
 import { execFile } from "node:child_process";
-import { join } from "node:path";
+import { cp, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
 import type { HouseCredential } from "./house-credential.js";
 import { readHouseCredential } from "./house-credential.js";
 import { resolveHouseScopedToken } from "./house-scoped-token.js";
@@ -60,9 +62,24 @@ export interface CfExec {
   r2ObjectDelete(bucket: string, key: string): Promise<void>;
   pagesProjectList(): Promise<{ name: string }[]>;
   pagesProjectCreate(name: string, productionBranch: string): Promise<void>;
-  pagesDeploy(dir: string, project: string, branch?: string): Promise<{ url: string }>;
+  /** `excluded` names the files dropped from the upload set, so the caller can
+   *  log what was published rather than assert it (Task 1782). */
+  pagesDeploy(
+    dir: string,
+    project: string,
+    branch?: string,
+  ): Promise<{ url: string; excluded: string[] }>;
 }
 
+// The filenames `wrangler pages deploy` discovers as its own configuration
+// (wrangler 4.112.0). Task 1782 — the upload walk has a fixed ignore list with
+// no config hook, so a config sitting in the deployed tree is served publicly at
+// /wrangler.toml, disclosing the D1 database id and R2 bucket name, both of
+// which embed the account id. All three names are dropped rather than only the
+// .toml the data-portal template ships, so a tree that later gains a .json
+// config cannot quietly start republishing it.
+const WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
+
 // An object key carries `/` as a real path separator (the data portal's
 // per-person prefixes), so it is encoded segment-wise rather than whole:
 // separators stay separators, and spaces and specials are escaped. This
@@ -381,34 +398,62 @@ export function makeCfExec(
       }
     },
     async pagesDeploy(dir, project, branch) {
-      // wrangler is the only supported Pages upload path (it hashes the tree and
-      // uploads only what is missing); the API has no single-call equivalent.
-      const args = ["wrangler", "pages", "deploy", dir, "--project-name", project];
-      if (branch !== undefined) args.push("--branch", branch);
-      // Pin the working directory to the tree being published. Left to
-      // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
-      // directory (its nearest package.json/node_modules root), which the
-      // platform marks immutable — so the scratch mkdir returns EPERM and the
-      // deploy never reaches the upload. `dir` is the realpath-confined deploy
-      // directory the route resolved, it is writable, and it already holds this
-      // site's own wrangler.toml.
-      const { stdout } = await run("npx", args, env, { cwd: dir });
-      // The deployment URL is what the caller relays, so parse it strictly.
-      // Strip ANSI first: wrangler colours its output when it thinks it has a
-      // terminal, and a colour reset adjacent to the URL would otherwise be
-      // swallowed by the host character class and returned as part of it.
-      const plain = stdout.replace(/\[[0-9;]*m/g, "");
-      // Take the LAST match, not the first: wrangler prints the deployment URL
-      // on its closing line, and any earlier .pages.dev mention (an alias or a
-      // progress line) would otherwise win and hand back the wrong address.
-      const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
-      const url = urls?.[urls.length - 1];
-      // wrangler exits 0 on some partial paths, so a url-less success is an
-      // anomaly to surface with its output, never a silent "deployed".
-      if (!url) {
-        throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+      // Task 1782 — publish a directory the broker composes, not whatever the
+      // account's tree happens to hold. wrangler takes the upload directory from
+      // the positional argument and finds its configuration by walking up from
+      // the working directory, which are two independent inputs; pointing them
+      // at different places is what removes the config from the published assets
+      // while leaving the D1 and R2 bindings it declares fully in force.
+      // Measured on the house account 2026-07-20: a brand-new project deployed
+      // with the config outside the upload received the same bindings and the
+      // same config hash as the control that uploaded it.
+      const staged = await mkdtemp(join(tmpdir(), "maxy-pages-upload-"));
+      const excluded: string[] = [];
+      try {
+        await cp(dir, staged, {
+          recursive: true,
+          // Only a config at the root of the tree is wrangler's own. A nested
+          // file of the same name is site content and stays published.
+          filter: (src) => {
+            const rel = relative(dir, src);
+            if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
+            excluded.push(rel);
+            return false;
+          },
+        });
+        // wrangler is the only supported Pages upload path (it hashes the tree and
+        // uploads only what is missing); the API has no single-call equivalent.
+        const args = ["wrangler", "pages", "deploy", staged, "--project-name", project];
+        if (branch !== undefined) args.push("--branch", branch);
+        // Pin the working directory to the tree being published. Left to
+        // inference, wrangler anchors `.wrangler/tmp` at the install's `server/`
+        // directory (its nearest package.json/node_modules root), which the
+        // platform marks immutable — so the scratch mkdir returns EPERM and the
+        // deploy never reaches the upload. `dir` is the realpath-confined deploy
+        // directory the route resolved, and it is writable. Since 1782 it is also
+        // the only place wrangler can still find this site's config, which no
+        // longer travels with the assets.
+        const { stdout } = await run("npx", args, env, { cwd: dir });
+        // The deployment URL is what the caller relays, so parse it strictly.
+        // Strip ANSI first: wrangler colours its output when it thinks it has a
+        // terminal, and a colour reset adjacent to the URL would otherwise be
+        // swallowed by the host character class and returned as part of it.
+        const plain = stdout.replace(/\[[0-9;]*m/g, "");
+        // Take the LAST match, not the first: wrangler prints the deployment URL
+        // on its closing line, and any earlier .pages.dev mention (an alias or a
+        // progress line) would otherwise win and hand back the wrong address.
+        const urls = plain.match(/https:\/\/[A-Za-z0-9._-]+\.pages\.dev/g);
+        const url = urls?.[urls.length - 1];
+        // wrangler exits 0 on some partial paths, so a url-less success is an
+        // anomaly to surface with its output, never a silent "deployed".
+        if (!url) {
+          throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
+        }
+        return { url, excluded: excluded.sort() };
+      } finally {
+        // A failed deploy must not strand a second copy of the site on disk.
+        await rm(staged, { recursive: true, force: true });
       }
-      return { url };
     },
 
     // --- R2 objects (Task 1691) -------------------------------------------

package/payload/platform/plugins/cloudflare/skills/calendar-site/SKILL.md

@@ -56,7 +56,7 @@ The booking-specific schema ships with the template: `schema.sql` creates both t
 
 ## Deploy through site-deploy
 
-Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged — including its multi-tenant branch: "admin-run" means a `role:"admin"` session, which on a multi-tenant install is **not** the same thing as the house. A client account's admin session is denied the `pages` scope (`reason=not-house`) and publishes with `storage-pages-deploy` instead.
+Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged — including its multi-tenant branch: "admin-run" means a `role:"admin"` session, which on a multi-tenant install is **not** the same thing as the house. A client account's admin session is denied the `pages` scope (`reason=not-house`) and publishes with `storage-pages-deploy` instead. For a booking page on a brand-new project, that client session first creates and claims the project with `storage-pages-create` and then publishes with `storage-pages-deploy`; the create is what gives the new project an owner, without which the first deploy fails at `reason=unregistered`.
 
 ## Done-gate
 

package/payload/platform/plugins/cloudflare/skills/site-deploy/SKILL.md

@@ -33,7 +33,7 @@ There is never a `sites/<brand>/` versus `output/<brand>-site/` pair, a `.bak` c
 
 ## Auth: reuse the per-scope token, never mint ad hoc
 
-> **Client accounts on a multi-tenant install do not use this section.** Post-1631 their secrets carry no master and `cf-token.sh` denies them the `pages` scope (`reason=not-house`). They publish with `storage-pages-deploy`, which deploys house-side against a project the house has recorded to them (`storage-pages-adopt`). A `not-house` denial here is that boundary working, not a token fault — do not try to mint around it. Everything below is the **house/single-tenant** path.
+> **Client accounts on a multi-tenant install do not use this section.** Post-1631 their secrets carry no master and `cf-token.sh` denies them the `pages` scope (`reason=not-house`). They publish with `storage-pages-deploy`, which deploys house-side against a project they own. For a **brand-new** project they first create and claim it with `storage-pages-create`, then deploy to it; a first `storage-pages-deploy` against a project with no owner on record fails at `reason=unregistered`, so the create comes first. `storage-pages-adopt` remains house admin only, for a project that **already exists on Cloudflare** that the client did not create. A `not-house` denial here is that boundary working, not a token fault, so do not try to mint around it. Everything below is the **house/single-tenant** path.
 
 Resolve the Pages-and-D1 token with the deterministic helper **before** any token `curl`, never a hand-built one: