@rubytech/create-maxy-code 0.1.490 → 0.1.492

package/payload/platform/lib/storage-broker/dist/pages-output-dir.d.ts

@@ -0,0 +1,19 @@
+export declare const WRANGLER_CONFIG_NAMES: readonly ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
+export type UploadDirSource = (typeof WRANGLER_CONFIG_NAMES)[number] | "site-root";
+export type UploadDirResolution = {
+    /** Absolute path to stage and hand wrangler as the asset root. */
+    uploadDir: string;
+    /** Which input decided it, so the caller logs the reason and not the value alone. */
+    source: UploadDirSource;
+    /** The verbatim declared value, present only when a config decided it. */
+    declared?: string;
+};
+/** Resolves the directory whose contents become the served root for `dir`.
+ *
+ *  A tree that declares nothing keeps the site root, which is what every deploy
+ *  did before Task 1917. A tree that declares an output dir gets that dir. A
+ *  tree that declares one which cannot be resolved is an error naming the path:
+ *  falling back to the site root here is exactly the defect this closes, because
+ *  the deploy then succeeds while serving the wrong root. */
+export declare function resolveUploadDir(dir: string): Promise<UploadDirResolution>;
+//# sourceMappingURL=pages-output-dir.d.ts.map

package/payload/platform/lib/storage-broker/dist/pages-output-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages-output-dir.d.ts","sourceRoot":"","sources":["../src/pages-output-dir.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,qBAAqB,+DAIxB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC;AAEnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,MAAM,EAAE,eAAe,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AA0FF;;;;;;6DAM6D;AAC7D,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4DhF"}

package/payload/platform/lib/storage-broker/dist/pages-output-dir.js

@@ -0,0 +1,185 @@
+"use strict";
+// Where a Pages deploy's assets actually start. Task 1917 — `wrangler pages
+// deploy <dir>` treats the positional argument as the asset root and overrides
+// `pages_build_output_dir`, so handing it the site root publishes a declared
+// output dir one level too deep and the served root 404s. Measured on glsmith
+// 2026-07-22: two trees with identical shape and config, one deployed by house
+// wrangler (document at the root, 200) and one by this broker (document
+// reachable only under /public/, root 404).
+//
+// Only the one key is interpreted, in any of the three config formats. This is
+// deliberately not a wrangler config parser: everything else in the file is
+// wrangler's business and stays wrangler's business.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WRANGLER_CONFIG_NAMES = void 0;
+exports.resolveUploadDir = resolveUploadDir;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+// The filenames `wrangler pages deploy` discovers as its own configuration, in
+// wrangler's own precedence order (wrangler 4.112.0, wrangler-dist/cli.js:3189
+// — json, then jsonc, then toml). The order is load-bearing twice: it decides
+// which config declares the output dir here, and Task 1782 drops all three from
+// the upload so a config is never served publicly at /wrangler.toml, where it
+// would disclose the D1 database id and R2 bucket name.
+exports.WRANGLER_CONFIG_NAMES = [
+    "wrangler.json",
+    "wrangler.jsonc",
+    "wrangler.toml",
+];
+const KEY = "pages_build_output_dir";
+/** Strips line comments and block comments that sit outside string literals.
+ *  JSON has no comments and jsonc does, so a jsonc file is de-commented before
+ *  JSON.parse. Scanning character-wise rather than by regex is what keeps a
+ *  `//` inside a value (a path like "a//b") from being eaten as a comment. */
+function stripJsonComments(text) {
+    let out = "";
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (inString) {
+            out += c;
+            if (escaped)
+                escaped = false;
+            else if (c === "\\")
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"') {
+            inString = true;
+            out += c;
+            continue;
+        }
+        if (c === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            out += "\n";
+            continue;
+        }
+        if (c === "/" && text[i + 1] === "*") {
+            i += 2;
+            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+                i++;
+            i++;
+            continue;
+        }
+        out += c;
+    }
+    return out;
+}
+/** Reads the one key from a TOML file's top level. Top level means before the
+ *  first `[section]` header: a key under `[env.preview]` is that environment's,
+ *  not the deploy's, and reading it would publish the wrong root. Nothing else
+ *  in the file is interpreted. */
+function readTomlKey(text) {
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            continue;
+        if (line.startsWith("["))
+            return undefined;
+        const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+        if (m)
+            return m[1] ?? m[2];
+    }
+    return undefined;
+}
+/** Reads the one key from a JSON or JSONC file's top level. A present key whose
+ *  value is not a string is an error rather than an ignore: the tree declared an
+ *  output dir, and publishing its parent instead is the defect this closes. */
+function readJsonKey(text, name, jsonc) {
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+    }
+    catch (err) {
+        throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error(`storage-broker: ${name} is not an object`);
+    }
+    const value = parsed[KEY];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string") {
+        throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+    }
+    return value;
+}
+/** True when `child` is not `root` or a descendant of it. */
+function escapes(root, child) {
+    const rel = (0, node_path_1.relative)(root, child);
+    return rel.startsWith("..") || (0, node_path_1.isAbsolute)(rel);
+}
+function outsideError(name, declared, resolved, root) {
+    return new Error(`storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`);
+}
+/** Resolves the directory whose contents become the served root for `dir`.
+ *
+ *  A tree that declares nothing keeps the site root, which is what every deploy
+ *  did before Task 1917. A tree that declares an output dir gets that dir. A
+ *  tree that declares one which cannot be resolved is an error naming the path:
+ *  falling back to the site root here is exactly the defect this closes, because
+ *  the deploy then succeeds while serving the wrong root. */
+async function resolveUploadDir(dir) {
+    for (const name of exports.WRANGLER_CONFIG_NAMES) {
+        let text;
+        try {
+            text = await (0, promises_1.readFile)((0, node_path_1.join)(dir, name), "utf8");
+        }
+        catch {
+            continue; // absent, or not readable as a file: the next name is wrangler's next choice
+        }
+        const declared = name === "wrangler.toml"
+            ? readTomlKey(text)
+            : readJsonKey(text, name, name === "wrangler.jsonc");
+        // A config that declares nothing leaves the site root as the asset root,
+        // which is wrangler's own behaviour for a Pages project with no output dir.
+        if (declared === undefined)
+            return { uploadDir: dir, source: "site-root" };
+        const uploadDir = (0, node_path_1.resolve)(dir, declared);
+        // Confinement, lexically first. A declared value is file content, and
+        // resolving file content into a publish path through the route that holds
+        // the account-wide Cloudflare credential is the moment it has to be
+        // bounded. This pass costs no filesystem call and rejects the plain
+        // `"../.."` before anything is touched.
+        if (escapes(dir, uploadDir))
+            throw outsideError(name, declared, uploadDir, dir);
+        // lstat, not stat: the link itself is what matters here, and stat would
+        // report a link to a directory as a directory.
+        let info;
+        try {
+            info = await (0, promises_1.lstat)(uploadDir);
+        }
+        catch {
+            throw new Error(`storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`);
+        }
+        // A link is refused wherever it points. The staging copy takes the upload
+        // directory as its source and does not dereference, so a link source fails
+        // the copy outright; and a target that can change between this check and
+        // that copy is not something to publish from a route holding the
+        // account-wide credential.
+        if (info.isSymbolicLink()) {
+            throw new Error(`storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`);
+        }
+        if (!info.isDirectory()) {
+            throw new Error(`storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`);
+        }
+        // Confinement again, on the real paths. The lexical pass above is blind to
+        // symlinks in the declared value's own parent segments: a declared "a/b"
+        // whose `a` links out of the tree stays inside by string comparison while
+        // resolving anywhere on disk, and the deploy would then publish whatever it
+        // resolves to. Both sides are resolved because the site root itself commonly
+        // arrives through a symlinked prefix (macOS /var, a linked account
+        // directory), which would otherwise read as an escape on its own.
+        const realDir = await (0, promises_1.realpath)(dir);
+        const realUpload = await (0, promises_1.realpath)(uploadDir);
+        if (escapes(realDir, realUpload))
+            throw outsideError(name, declared, realUpload, realDir);
+        return { uploadDir, source: name, declared };
+    }
+    return { uploadDir: dir, source: "site-root" };
+}
+//# sourceMappingURL=pages-output-dir.js.map

package/payload/platform/lib/storage-broker/dist/pages-output-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages-output-dir.js","sourceRoot":"","sources":["../src/pages-output-dir.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,4CAA4C;AAC5C,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,qDAAqD;;;AA2HrD,4CA4DC;AArLD,+CAA6D;AAC7D,yCAAgE;AAEhE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wDAAwD;AAC3C,QAAA,qBAAqB,GAAG;IACnC,eAAe;IACf,gBAAgB;IAChB,eAAe;CACP,CAAC;AAaX,MAAM,GAAG,GAAG,wBAAwB,CAAC;AAErC;;;8EAG8E;AAC9E,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAC/B,IAAI,CAAC,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzE,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;kCAGkC;AAClC,SAAS,WAAW,CAAC,IAAY;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,CAAC,GAAG,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;+EAE+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;IAC7D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAA,sBAAU,EAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB,EAAE,IAAY;IAClF,OAAO,IAAI,KAAK,CACd,mBAAmB,IAAI,aAAa,GAAG,KAAK,QAAQ,wBAAwB,QAAQ,2BAA2B,IAAI,EAAE,CACtH,CAAC;AACJ,CAAC;AAED;;;;;;6DAM6D;AACtD,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,KAAK,MAAM,IAAI,IAAI,6BAAqB,EAAE,CAAC;QACzC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,6EAA6E;QACzF,CAAC;QACD,MAAM,QAAQ,GACZ,IAAI,KAAK,eAAe;YACtB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;YACnB,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC;QACzD,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,sEAAsE;QACtE,0EAA0E;QAC1E,oEAAoE;QACpE,oEAAoE;QACpE,wCAAwC;QACxC,IAAI,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC;YAAE,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAChF,wEAAwE;QACxE,+CAA+C;QAC/C,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAA,gBAAK,EAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,aAAa,GAAG,KAAK,QAAQ,SAAS,SAAS,iBAAiB,CACxF,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,2BAA2B;QAC3B,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,aAAa,GAAG,KAAK,QAAQ,SAAS,SAAS,kEAAkE,CACzI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,aAAa,GAAG,KAAK,QAAQ,SAAS,SAAS,qBAAqB,CAC5F,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC;YAAE,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -993,3 +993,68 @@ test("pagesDeploy pins wrangler's working directory to the deploy dir", async ()
     "wrangler must run in the deploy dir so its scratch dir lands beside the tree it uploads",
   );
 });
+
+// --- Task 1917: the asset root is the declared output dir, not its parent ---
+
+const SIGN_TREE = {
+  "wrangler.toml": 'name = "gls-sign"\npages_build_output_dir = "public"\n',
+  "public/index.html": "<!doctype html>",
+  "public/quote-patel.pdf": "%PDF-",
+  "functions/api/sign.js": "export {}",
+};
+
+test("pagesDeploy uploads the declared output dir, so its contents sit at the served root", async () => {
+  const dir = siteTree(SIGN_TREE);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { uploadDir, uploadDirSource } = await cf.pagesDeploy(dir, "gls-sign-1848", "main");
+  assert.deepEqual(
+    calls[0].uploaded,
+    ["index.html", "quote-patel.pdf"],
+    "the declared output dir's contents are the served root, not a /public/ subtree",
+  );
+  assert.equal(uploadDir, join(dir, "public"));
+  assert.equal(uploadDirSource, "wrangler.toml");
+});
+
+test("pagesDeploy still runs wrangler in the site root when the output dir is declared", async () => {
+  const dir = siteTree(SIGN_TREE);
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await cf.pagesDeploy(dir, "gls-sign-1848", "main");
+  assert.equal(
+    calls[0].cwd,
+    dir,
+    "cwd carries the config's bindings and wrangler's functions/ lookup; it is the site root either way",
+  );
+});
+
+test("pagesDeploy reports the site root as the source when nothing is declared", async () => {
+  const dir = siteTree(PORTAL);
+  const { run } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { uploadDir, uploadDirSource } = await cf.pagesDeploy(dir, "kit-data", "main");
+  assert.equal(uploadDir, dir);
+  assert.equal(uploadDirSource, "site-root");
+});
+
+test("pagesDeploy drops a wrangler config sitting inside the declared output dir", async () => {
+  const dir = siteTree({ ...SIGN_TREE, "public/wrangler.toml": 'database_id = "secret-looking"\n' });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  const { excluded } = await cf.pagesDeploy(dir, "gls-sign-1848", "main");
+  assert.deepEqual(calls[0].uploaded, ["index.html", "quote-patel.pdf"]);
+  assert.deepEqual(excluded, ["wrangler.toml"]);
+});
+
+test("pagesDeploy refuses to deploy when the declared output dir is absent", async () => {
+  const dir = siteTree({ "wrangler.toml": 'pages_build_output_dir = "public"\n' });
+  const { run, calls } = snapshottingRun(DEPLOYED);
+  const cf = makeCfExec(cred, run);
+  await assert.rejects(
+    () => cf.pagesDeploy(dir, "gls-sign-1848", "main"),
+    new RegExp(join(dir, "public")),
+    "a declared-but-absent output dir names the path; falling back to the site root is the defect",
+  );
+  assert.equal(calls.length, 0, "no wrangler run may happen once resolution has failed");
+});

package/payload/platform/lib/storage-broker/src/__tests__/pages-output-dir.test.ts

@@ -0,0 +1,167 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveUploadDir } from "../pages-output-dir.js";
+
+/** A site tree on disk. `dirs` are created empty; `files` are written. */
+function tree(files: Record<string, string>, dirs: string[] = []): string {
+  const dir = mkdtempSync(join(tmpdir(), "pages-out-"));
+  for (const d of dirs) mkdirSync(join(dir, d), { recursive: true });
+  for (const [rel, body] of Object.entries(files)) writeFileSync(join(dir, rel), body);
+  return dir;
+}
+
+test("no wrangler config at the root resolves to the site root", async () => {
+  const dir = tree({ "index.html": "<!doctype html>" });
+  assert.deepEqual(await resolveUploadDir(dir), { uploadDir: dir, source: "site-root" });
+});
+
+test("a config declaring no output dir resolves to the site root", async () => {
+  const dir = tree({ "wrangler.toml": 'name = "kit-data"\n' });
+  assert.deepEqual(await resolveUploadDir(dir), { uploadDir: dir, source: "site-root" });
+});
+
+test("a declared toml output dir resolves to that subdirectory", async () => {
+  const dir = tree({ "wrangler.toml": 'name = "gls"\npages_build_output_dir = "public"\n' }, [
+    "public",
+  ]);
+  assert.deepEqual(await resolveUploadDir(dir), {
+    uploadDir: join(dir, "public"),
+    source: "wrangler.toml",
+    declared: "public",
+  });
+});
+
+test('a declared "." resolves to the site root and still names its config', async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "."\n' });
+  assert.deepEqual(await resolveUploadDir(dir), {
+    uploadDir: dir,
+    source: "wrangler.toml",
+    declared: ".",
+  });
+});
+
+test("a single-quoted toml value is read", async () => {
+  const dir = tree({ "wrangler.toml": "pages_build_output_dir = 'dist'\n" }, ["dist"]);
+  assert.equal((await resolveUploadDir(dir)).uploadDir, join(dir, "dist"));
+});
+
+test("a commented-out toml key is not read", async () => {
+  const dir = tree({ "wrangler.toml": '# pages_build_output_dir = "public"\n' }, ["public"]);
+  assert.equal((await resolveUploadDir(dir)).source, "site-root");
+});
+
+test("a key inside a toml section is not read as the top-level key", async () => {
+  const dir = tree({ "wrangler.toml": '[env.preview]\npages_build_output_dir = "preview-out"\n' }, [
+    "preview-out",
+  ]);
+  assert.equal((await resolveUploadDir(dir)).source, "site-root");
+});
+
+test("a json config is read", async () => {
+  const dir = tree({ "wrangler.json": '{"pages_build_output_dir":"out"}' }, ["out"]);
+  assert.deepEqual(await resolveUploadDir(dir), {
+    uploadDir: join(dir, "out"),
+    source: "wrangler.json",
+    declared: "out",
+  });
+});
+
+test("a jsonc config is read past its comments", async () => {
+  const dir = tree(
+    {
+      "wrangler.jsonc":
+        '{\n  // the served root\n  "pages_build_output_dir": "out", /* trailing */\n  "name": "x"\n}',
+    },
+    ["out"],
+  );
+  assert.deepEqual(await resolveUploadDir(dir), {
+    uploadDir: join(dir, "out"),
+    source: "wrangler.jsonc",
+    declared: "out",
+  });
+});
+
+test("a comment marker inside a jsonc string is not stripped", async () => {
+  const dir = tree({ "wrangler.jsonc": '{"pages_build_output_dir":"a//b"}' }, ["a/b"]);
+  assert.equal((await resolveUploadDir(dir)).declared, "a//b");
+});
+
+test("wrangler.json wins over wrangler.toml, matching wrangler's own precedence", async () => {
+  const dir = tree(
+    {
+      "wrangler.json": '{"pages_build_output_dir":"from-json"}',
+      "wrangler.toml": 'pages_build_output_dir = "from-toml"\n',
+    },
+    ["from-json", "from-toml"],
+  );
+  assert.equal((await resolveUploadDir(dir)).source, "wrangler.json");
+});
+
+test("an unparseable config throws naming the file, never a site-root fallback", async () => {
+  const dir = tree({ "wrangler.json": "{not json" });
+  await assert.rejects(() => resolveUploadDir(dir), /wrangler\.json/);
+});
+
+test("a declared dir that does not exist throws naming the resolved path", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "public"\n' });
+  await assert.rejects(() => resolveUploadDir(dir), new RegExp(join(dir, "public")));
+});
+
+test("a declared dir that is a file throws naming the resolved path", async () => {
+  const dir = tree({
+    "wrangler.toml": 'pages_build_output_dir = "public"\n',
+    public: "not a directory",
+  });
+  await assert.rejects(() => resolveUploadDir(dir), new RegExp(join(dir, "public")));
+});
+
+test("a declared value escaping the site root throws naming the resolved path", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "../.."\n' });
+  await assert.rejects(() => resolveUploadDir(dir), /outside/);
+});
+
+test("a non-string declared value throws naming the file", async () => {
+  const dir = tree({ "wrangler.json": '{"pages_build_output_dir":42}' });
+  await assert.rejects(() => resolveUploadDir(dir), /wrangler\.json/);
+});
+
+test("a declared dir that is a symlink out of the site root is refused, naming the path", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "public"\n' });
+  const outside = tree({ "SECRET.txt": "house credential" });
+  symlinkSync(outside, join(dir, "public"));
+  await assert.rejects(
+    () => resolveUploadDir(dir),
+    new RegExp(`symbolic link|${join(dir, "public")}`),
+    "a lexical containment check alone passes this and publishes whatever the link points at",
+  );
+});
+
+test("a declared value escaping through a symlinked parent segment throws as outside", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "link/out"\n' });
+  const outside = tree({}, ["out"]);
+  symlinkSync(outside, join(dir, "link"));
+  await assert.rejects(
+    () => resolveUploadDir(dir),
+    /outside/,
+    "the leaf is a real directory here, so only the realpath comparison catches it",
+  );
+});
+
+test("a declared dir that is a symlink is refused even when it points inside the tree", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "public"\n' }, ["real"]);
+  symlinkSync(join(dir, "real"), join(dir, "public"));
+  await assert.rejects(
+    () => resolveUploadDir(dir),
+    /symbolic link/,
+    "the staging copy cannot take a link as its source, and a link target can change between resolution and copy",
+  );
+});
+
+test("a declared dir reached through a symlinked parent that stays in the tree is accepted", async () => {
+  const dir = tree({ "wrangler.toml": 'pages_build_output_dir = "link/out"\n' }, ["real/out"]);
+  symlinkSync(join(dir, "real"), join(dir, "link"));
+  assert.equal((await resolveUploadDir(dir)).source, "wrangler.toml");
+});

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -9,6 +9,11 @@ import { join, relative } from "node:path";
 import type { HouseCredential } from "./house-credential.js";
 import { readHouseCredential } from "./house-credential.js";
 import { resolveHouseScopedToken } from "./house-scoped-token.js";
+import {
+  resolveUploadDir,
+  WRANGLER_CONFIG_NAMES,
+  type UploadDirSource,
+} from "./pages-output-dir.js";
 
 export type RunFn = (
   cmd: string,
@@ -76,22 +81,31 @@ export interface CfExec {
   pagesProjectList(): Promise<{ name: string }[]>;
   pagesProjectCreate(name: string, productionBranch: string): Promise<void>;
   /** `excluded` names the files dropped from the upload set, so the caller can
-   *  log what was published rather than assert it (Task 1782). */
+   *  log what was published rather than assert it (Task 1782). `uploadDir` and
+   *  `uploadDirSource` name the asset root that was published and what decided
+   *  it, so a root published one level too high is readable from the log
+   *  without fetching the site (Task 1917). */
   pagesDeploy(
     dir: string,
     project: string,
     branch?: string,
-  ): Promise<{ url: string; excluded: string[] }>;
+  ): Promise<{
+    url: string;
+    excluded: string[];
+    uploadDir: string;
+    uploadDirSource: UploadDirSource;
+  }>;
 }
 
-// The filenames `wrangler pages deploy` discovers as its own configuration
-// (wrangler 4.112.0). Task 1782 — the upload walk has a fixed ignore list with
-// no config hook, so a config sitting in the deployed tree is served publicly at
-// /wrangler.toml, disclosing the D1 database id and R2 bucket name, both of
-// which embed the account id. All three names are dropped rather than only the
-// .toml the data-portal template ships, so a tree that later gains a .json
-// config cannot quietly start republishing it.
-const WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
+// WRANGLER_CONFIG_NAMES lives in ./pages-output-dir.js since Task 1917. It is
+// the same list for two jobs that must not drift apart: the discovery order the
+// output-dir resolver walks, and the drop-list this file applies to the upload.
+// Task 1782 — the upload walk has a fixed ignore list with no config hook, so a
+// config sitting in the deployed tree is served publicly at /wrangler.toml,
+// disclosing the D1 database id and R2 bucket name, both of which embed the
+// account id. All three names are dropped rather than only the .toml the
+// data-portal template ships, so a tree that later gains a .json config cannot
+// quietly start republishing it.
 
 // An object key carries `/` as a real path separator (the data portal's
 // per-person prefixes), so it is encoded segment-wise rather than whole:
@@ -455,16 +469,26 @@ export function makeCfExec(
       // Measured on the house account 2026-07-20: a brand-new project deployed
       // with the config outside the upload received the same bindings and the
       // same config hash as the control that uploaded it.
+      // Task 1917 — the positional argument IS wrangler's asset root and
+      // overrides `pages_build_output_dir`, so the directory to stage is the
+      // declared output dir when the tree declares one. Resolution happens
+      // before any staging: a declared dir that cannot be resolved aborts the
+      // deploy rather than falling back to the site root and publishing one
+      // level too high, which is what left gls-sign-1848 answering only under
+      // /public/ while its root 404'd.
+      const { uploadDir, source: uploadDirSource } = await resolveUploadDir(dir);
       const staged = await mkdtemp(join(tmpdir(), "maxy-pages-upload-"));
       const excluded: string[] = [];
       try {
-        await cp(dir, staged, {
+        await cp(uploadDir, staged, {
           recursive: true,
-          // Only a config at the root of the tree is wrangler's own. A nested
-          // file of the same name is site content and stays published.
+          // Only a config at the root of what is uploaded is dropped. That root
+          // is the served root, which is the surface Task 1782 protects. A file
+          // of the same name anywhere below it is site content and stays
+          // published.
           filter: (src) => {
-            const rel = relative(dir, src);
-            if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
+            const rel = relative(uploadDir, src);
+            if (!(WRANGLER_CONFIG_NAMES as readonly string[]).includes(rel)) return true;
             excluded.push(rel);
             return false;
           },
@@ -497,7 +521,7 @@ export function makeCfExec(
         if (!url) {
           throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
         }
-        return { url, excluded: excluded.sort() };
+        return { url, excluded: excluded.sort(), uploadDir, uploadDirSource };
       } finally {
         // A failed deploy must not strand a second copy of the site on disk.
         await rm(staged, { recursive: true, force: true });