@rubytech/create-maxy-code 0.1.490 → 0.1.492

package/payload/platform/lib/storage-broker/src/pages-output-dir.ts

@@ -0,0 +1,194 @@
+// Where a Pages deploy's assets actually start. Task 1917 — `wrangler pages
+// deploy <dir>` treats the positional argument as the asset root and overrides
+// `pages_build_output_dir`, so handing it the site root publishes a declared
+// output dir one level too deep and the served root 404s. Measured on glsmith
+// 2026-07-22: two trees with identical shape and config, one deployed by house
+// wrangler (document at the root, 200) and one by this broker (document
+// reachable only under /public/, root 404).
+//
+// Only the one key is interpreted, in any of the three config formats. This is
+// deliberately not a wrangler config parser: everything else in the file is
+// wrangler's business and stays wrangler's business.
+
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+
+// The filenames `wrangler pages deploy` discovers as its own configuration, in
+// wrangler's own precedence order (wrangler 4.112.0, wrangler-dist/cli.js:3189
+// — json, then jsonc, then toml). The order is load-bearing twice: it decides
+// which config declares the output dir here, and Task 1782 drops all three from
+// the upload so a config is never served publicly at /wrangler.toml, where it
+// would disclose the D1 database id and R2 bucket name.
+export const WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml",
+] as const;
+
+export type UploadDirSource = (typeof WRANGLER_CONFIG_NAMES)[number] | "site-root";
+
+export type UploadDirResolution = {
+  /** Absolute path to stage and hand wrangler as the asset root. */
+  uploadDir: string;
+  /** Which input decided it, so the caller logs the reason and not the value alone. */
+  source: UploadDirSource;
+  /** The verbatim declared value, present only when a config decided it. */
+  declared?: string;
+};
+
+const KEY = "pages_build_output_dir";
+
+/** Strips line comments and block comments that sit outside string literals.
+ *  JSON has no comments and jsonc does, so a jsonc file is de-commented before
+ *  JSON.parse. Scanning character-wise rather than by regex is what keeps a
+ *  `//` inside a value (a path like "a//b") from being eaten as a comment. */
+function stripJsonComments(text: string): string {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+
+/** Reads the one key from a TOML file's top level. Top level means before the
+ *  first `[section]` header: a key under `[env.preview]` is that environment's,
+ *  not the deploy's, and reading it would publish the wrong root. Nothing else
+ *  in the file is interpreted. */
+function readTomlKey(text: string): string | undefined {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return undefined;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return undefined;
+}
+
+/** Reads the one key from a JSON or JSONC file's top level. A present key whose
+ *  value is not a string is an error rather than an ignore: the tree declared an
+ *  output dir, and publishing its parent instead is the defect this closes. */
+function readJsonKey(text: string, name: string, jsonc: boolean): string | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = (parsed as Record<string, unknown>)[KEY];
+  if (value === undefined) return undefined;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+
+/** True when `child` is not `root` or a descendant of it. */
+function escapes(root: string, child: string): boolean {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+
+function outsideError(name: string, declared: string, resolved: string, root: string): Error {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`,
+  );
+}
+
+/** Resolves the directory whose contents become the served root for `dir`.
+ *
+ *  A tree that declares nothing keeps the site root, which is what every deploy
+ *  did before Task 1917. A tree that declares an output dir gets that dir. A
+ *  tree that declares one which cannot be resolved is an error naming the path:
+ *  falling back to the site root here is exactly the defect this closes, because
+ *  the deploy then succeeds while serving the wrong root. */
+export async function resolveUploadDir(dir: string): Promise<UploadDirResolution> {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text: string;
+    try {
+      text = await readFile(join(dir, name), "utf8");
+    } catch {
+      continue; // absent, or not readable as a file: the next name is wrangler's next choice
+    }
+    const declared =
+      name === "wrangler.toml"
+        ? readTomlKey(text)
+        : readJsonKey(text, name, name === "wrangler.jsonc");
+    // A config that declares nothing leaves the site root as the asset root,
+    // which is wrangler's own behaviour for a Pages project with no output dir.
+    if (declared === undefined) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    // Confinement, lexically first. A declared value is file content, and
+    // resolving file content into a publish path through the route that holds
+    // the account-wide Cloudflare credential is the moment it has to be
+    // bounded. This pass costs no filesystem call and rejects the plain
+    // `"../.."` before anything is touched.
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    // lstat, not stat: the link itself is what matters here, and stat would
+    // report a link to a directory as a directory.
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`,
+      );
+    }
+    // A link is refused wherever it points. The staging copy takes the upload
+    // directory as its source and does not dereference, so a link source fails
+    // the copy outright; and a target that can change between this check and
+    // that copy is not something to publish from a route holding the
+    // account-wide credential.
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`,
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`,
+      );
+    }
+    // Confinement again, on the real paths. The lexical pass above is blind to
+    // symlinks in the declared value's own parent segments: a declared "a/b"
+    // whose `a` links out of the tree stays inside by string comparison while
+    // resolving anywhere on disk, and the deploy would then publish whatever it
+    // resolves to. Both sides are resolved because the site root itself commonly
+    // arrives through a symlinked prefix (macOS /var, a linked account
+    // directory), which would otherwise read as an escape on its own.
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}

package/payload/platform/plugins/business-assistant/skills/e-sign/SKILL.md

@@ -22,6 +22,10 @@ Auth for every `wrangler`/API call is the **reused per-scope narrow token** of `
 
 ---
 
+> **Client accounts on a multi-tenant install — every Cloudflare call in this skill runs through the storage broker.** A client sub-account is issued no Cloudflare credential: after the 1631 storage isolation its `secrets/cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope with `reason=not-house`. That denial is the boundary working, not a broken token, and it is never worked around by minting, by sourcing the house env, or by asking anyone for a token. Read every `cf-token.sh` and `wrangler d1 execute` line below as the **house / single-tenant** path; each one names its client substitute beside it. The map is one-to-one — `storage-d1-create` for a new database, `storage-d1-query` for every SQL statement, `storage-pages-create` to claim a brand-new Pages project, `storage-pages-deploy` to publish it. `storage-d1-query` runs `wrangler d1 execute <name> --remote --json` house-side, so every SQL statement in this skill transfers verbatim and the result is always JSON. The one exception is § 1a Access gating, which needs an Access-scoped token the broker does not offer: a client account that needs a gated document asks the house to apply the gate.
+>
+> **Never ask a client, a signer, or any client contact to create or send a Cloudflare token.** Provisioning a master is an operator action on the house account. A credential request sent to the person you are building the document for is a failure of this skill, not a remediation for one.
+
 ## 0. Pre-flight — block on each prerequisite
 
 Do **not** deploy until all three pass. Each failure has one exact remediation; stop and give it.
@@ -31,7 +35,13 @@ Do **not** deploy until all three pass. Each failure has one exact remediation;
 
    Dispatch (§ 6) sends through `email-send`; without a configured inbox the acceptance is captured but never delivered.
 
-2. **The Cloudflare master token must exist.** With `SECRETS_DIR` per `api.md` (`~/<brand>-code/data/accounts/<accountId>/secrets`):
+2. **The Cloudflare master token must exist — house and single-tenant accounts only.** Which case you are in is a property of the account, so read it rather than assume it:
+
+   ```bash
+   jq -r '.role // "unset"' "${ACCOUNT_DIR}/account.json"
+   ```
+
+   `client` means the broker path (the callout above): the master is absent by design, this item does not apply, and you go straight to item 3. Anything else is the house or single-tenant path, which runs the check below. If that command instead errors `Could not open file /account.json`, `ACCOUNT_DIR` is unset — that is item 3's failure surfacing early, so settle item 3 first and come back rather than guessing which path you are on. With `SECRETS_DIR` per `api.md` (`~/<brand>-code/data/accounts/<accountId>/secrets`):
 
    ```bash
    ( test -s "${SECRETS_DIR}/cloudflare.env" && grep -q '^CLOUDFLARE_API_TOKEN=' "${SECRETS_DIR}/cloudflare.env" ) \
@@ -41,6 +51,8 @@ Do **not** deploy until all three pass. Each failure has one exact remediation;
    On `missing`, stop:
    > "There's no Cloudflare master token. Provision it once per `cloudflare/references/api.md` § Provisioning the master token, then ask me again."
 
+   That provisioning is an operator action on the house account. Never relay it onward, and never ask anyone outside the operator seat to create or send a Cloudflare token — not a client, not a signer, not a client's own hosting contact.
+
 3. **The account directory must be set (attachment capability).** `email-send` attaches the signed PDF by absolute path under the account directory, and § 5 persists the base PDF there. If `ACCOUNT_DIR` is unset, the attachment silently degrades to a **text-only** send — neither party receives the PDF — and there is nowhere to persist the base render. Assert it before any deploy or sweep:
 
    ```bash
@@ -80,6 +92,8 @@ Per-signer stamped copies (§ 6) are written alongside, in the same `<DOC_REF>`
 
 The § 1 default — an unguessable hex slug plus `noindex` — keeps a low-sensitivity document private by obscurity. For a **confidential** proposal to a **named** recipient, add a **Cloudflare Access** gate in front of the page so only allowlisted emails can load it at all. Gating is **additive**: the slug and `noindex` stay; the gate sits in front of them. It is never the default and never replaces them.
 
+> **Client account:** Access gating is the house's to apply. The broker offers no Access tool, and `cf-token.sh access` denies a client account that scope with the same `reason=not-house` it denies `pages`, so mint nothing here and run none of the calls below. Instead **request the gate**, handing the house three things: the **Pages project** carrying the document, the **document path or paths** to gate, and the **signer emails** (plus the business owner's) for the policy `include`. Say in the same request that **`/api/*` on that project is gated alongside those paths**, because gating the document path alone leaves `POST /api/accept` forgeable and `GET /api/status` world-readable, the bypass this section describes below. Never ask the client or the signer for a Cloudflare token (the callout that precedes § 0). Everything that follows (the One-Time PIN pre-flight, the app and policy calls, the `gate-probe`, and the neutral root portal) stays as written and is the house's to run.
+
 **One-Time PIN is the only correct identity provider here — and why.** The signer is an external party who belongs to **no** Cloudflare organization, so SSO, Google, GitHub, SAML and every other org-membership IdP cannot authenticate them. Cloudflare's built-in **One-Time PIN** emails a login code to **any allowlisted address** with no org membership required — exactly the external-signer case. Prescribe `onetimepin`; do not reach for another IdP type for an external signer (a higher-assurance provider is a separate capability, not this skill).
 
 **Load-bearing pre-flight — a gate requires an enabled login method.** Creating an Access application and policy does **not** enable a login method. If the org has **zero** identity providers when the gate goes live, the login page offers **nothing** and locks out *everyone, including the operator*. Before activating any Access app, list the org's IdPs and confirm the list is non-empty:
@@ -298,6 +312,8 @@ document.getElementById("esign").addEventListener("submit", async (e) => {
 
 Follow `d1-data-capture.md` for creating the database, the `wrangler.toml` binding, and the both-Pages-Edit-**and**-D1-Edit token. The schema here is generic — it imposes no business fields; operator-defined fields live in `captured_json`:
 
+> **Client account:** create the database with `storage-d1-create` if `storage-d1-list` does not already show it, then run the exact statement below through `storage-d1-query` (`name` is the database, `sql` is the statement verbatim). The schema, the column order, and both uniqueness guards are unchanged — including the "keep `doc_ref` defined before `token`" rule below, which is a property of the SQL, not of how it is executed.
+
 ```bash
 CLOUDFLARE_API_TOKEN="${MINTED_PAGES_D1}" wrangler d1 execute <db-name> --remote --command \
   "CREATE TABLE IF NOT EXISTS acceptances (
@@ -426,6 +442,8 @@ export const onRequestGet: PagesFunction<Env> = async ({ request, env }) => {
 
 Deploy the document + both Functions via `hosting-sites.md`, with the both-Pages-Edit-and-D1-Edit token. The `[[d1_databases]]` binding in `wrangler.toml` is what wires the deployed Functions to the `acceptances` database.
 
+> **Client account:** claim a brand-new Pages project with `storage-pages-create`, then publish it with `storage-pages-deploy` from a folder under the account's own `sites/`. Create first — a `storage-pages-deploy` against a project with no owner on record fails at `reason=unregistered`. A project that already exists on Cloudflare and was not created by this account is the house-adopt case (`storage-pages-adopt`, house admin only), so ask the house rather than re-creating it under a second name. The deploy itself runs house-side, so the Pages credential never enters the account. Keep `wrangler.toml` with its `[[d1_databases]]` binding at the root of that site folder exactly as the house does: the broker copies the tree to a staging dir with any root `wrangler.toml` filtered out and points wrangler at the copy, so the binding stays fully in force while the config is never published (a published `wrangler.toml` discloses the D1 database id and the R2 bucket name, both of which embed the account id). The site name is a single path segment; a name containing `/` is refused. Everything after the deploy — the base render, reading every rendered page, the handed-back `https://` URL — is unchanged.
+
 **Gated sites also ship the neutral root `index.html` (§ 1a).** When the document is Access-gated, the neutral portal goes in the **same Pages output dir** as the document(s), so the production deploy serves it at `/` in the same shot — no separate deploy. Redeploying *only* the root portal needs a **Pages-Write-only** token: the portal touches no database, so no D1 scope is minted for it.
 
 **Render the base PDF once, here, keyed by `DOC_REF`.** Immediately after the deploy, render the live document to PDF a single time and persist it under the account directory (§ 1). This is the *only* place the browser is used — `browser-navigate` to the deployed document URL, then `browser-pdf-save`, the `invoicing.md` step-4 pattern:
@@ -447,7 +465,9 @@ Before persisting, **read every rendered page** of `base.pdf` — full-bleed pag
 
 Dispatch runs **only** inside a live operator session on the account's own device — when the operator asks for new acceptances, or when an in-session watcher running inside a still-live session performs the sweep. There is no off-device dispatcher; never register a Claude Code `/schedule` routine or any headless/cloud scheduler to run it (§ 8.2 says why). Mint one **D1-Edit** token here — `${MINTED_D1_EDIT}` — per `api.md` § Minting a narrow token, resolving the permission-group id as `d1-data-capture.md` § 0 does. Reads use the Edit token too: the D1 **query** endpoint rejects a D1-Read token (`d1-data-capture.md`), so a separate read-scoped token is not minted.
 
-1. **Read the unswept rows** with `${MINTED_D1_EDIT}`:
+> **Client account:** mint nothing. Both statements in this section run through `storage-d1-query` against the same database, executed house-side, and the read returns JSON either way. Everything else about dispatch is identical: it still runs only inside a live operator session, it still stamps the persisted base, and it still flips `swept` one row at a time after both sends verify.
+
+1. **Read the unswept rows** with `${MINTED_D1_EDIT}` (client account: the same `SELECT` through `storage-d1-query`):
 
    ```bash
    CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --json --command \
@@ -495,7 +515,7 @@ Dispatch runs **only** inside a live operator session on the account's own devic
 
      **Owner-copy visibility.** The owner copy only *arrives* if the agent's mailbox actually receives mail addressed to the business address. A recipient-filter that drops mail to the business address (the bug fixed in `rubytech-shared-catchall-mailbox`) makes the owner copy vanish while the signer copy arrives — check that filter first if the owner reports a missing confirmation.
 
-   - **Mark this row — and only this row — swept, once both sends return a verified result**, keyed by its `id`:
+   - **Mark this row — and only this row — swept, once both sends return a verified result**, keyed by its `id` (client account: the same `UPDATE` through `storage-d1-query`):
 
      ```bash
      CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --command \
@@ -512,6 +532,8 @@ The acceptance flow is proven end-to-end on the **live** Pages deployment — th
 
 **When the document is Access-gated (§ 1a), `/api/*` is gated too** — so the `curl` POSTs to `/api/accept` and the `GET /api/status` below are themselves **Access-challenged (302 to login), not direct 200s**. Run this end-to-end verification either **before** the gate is applied, or from a context that can authenticate to Access — the same authenticated-session requirement § 5's base render already carries. The `wrangler d1 execute` rows reach D1 through the Cloudflare API, not the gated host, so they verify unchanged.
 
+> **Client account:** the `curl` steps are unchanged — they hit the public Pages host and need no credential. Every `wrangler d1 execute` step below runs through `storage-d1-query` with the same SQL, and the row counts it must return are the same. The contract is the D1 row either way, never the POST status.
+
 ```bash
 # 1. POST a first acceptance to the live Function.
 curl -sS -X POST -H "Content-Type: application/json" \
@@ -547,7 +569,7 @@ Surface every step as verb + target ("inserting a test acceptance", "sweeping un
 
 ## 8. Failure modes and the signal for each
 
-The flow has no application logging — the signal surface is the **D1 row state** plus the persisted-artifact filesystem, reconciled by standing checks. Every `wrangler d1 execute` below uses the **D1-Edit** token. The failure modes that emit no event are the ones this section exists to cover.
+The flow has no application logging — the signal surface is the **D1 row state** plus the persisted-artifact filesystem, reconciled by standing checks. Every `wrangler d1 execute` below uses the **D1-Edit** token; on a client account every one of them runs through `storage-d1-query` with the same SQL instead, and § 8.9 is the house's to run because Access has no broker tool. The failure modes that emit no event are the ones this section exists to cover.
 
 ### 8.1 POST silently 500s at the insert (token missing D1 Edit)
 
@@ -559,7 +581,7 @@ The sweep never ran, or `email-send` failed after the row existed — no log, be
 
 > Dispatch runs **only** inside a live operator session on the account's own device. Never register a Claude Code `/schedule` routine, a `RemoteTrigger`, a `CronCreate` durable job, or any off-device/headless scheduler to run the sweep. `/schedule` spawns a fresh agent on **claude.ai's cloud**, which has none of this account's D1 token, `email-send`, `stamp.mjs`, or `ACCOUNT_DIR` — it physically cannot stamp or send. It is a Claude Code capability, not a Maxy one, and it is not a substitute for the in-session sweep. Monitoring and dispatch happen in-session, while the session is live. That is the only path.
 
-The reconciliation query, run inside a live session at open and before close:
+The reconciliation query, run inside a live session at open and before close (client account: through `storage-d1-query`):
 
 ```bash
 CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --command \
@@ -585,7 +607,7 @@ d="${ACCOUNT_DIR}/e-sign/<DOC_REF>"
 
 ### 8.4 Duplicate-acceptance row by token (same-signer idempotency regressed)
 
-Signal: a `token` appears more than once — the `token`-UNIQUE handling regressed.
+Signal: a `token` appears more than once — the `token`-UNIQUE handling regressed (client account: through `storage-d1-query`).
 
 ```bash
 CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --command \
@@ -596,7 +618,7 @@ Healthy signature: re-POSTing a token leaves its count at one.
 
 ### 8.5 More than one acceptance per `doc_ref` (the lock failed — primary standing check)
 
-The lock's failure is a **no-event** failure: an extra row appears silently — the `doc_ref` guard was dropped on a redeploy, never applied to a pre-existing table, or a race slipped through. This is the primary lock check; run it on the same cadence as the § 8.2 reconciliation, reusing the same D1-Edit token:
+The lock's failure is a **no-event** failure: an extra row appears silently — the `doc_ref` guard was dropped on a redeploy, never applied to a pre-existing table, or a race slipped through. This is the primary lock check; run it on the same cadence as the § 8.2 reconciliation, reusing the same D1-Edit token (client account: through `storage-d1-query`):
 
 ```bash
 CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --command \
@@ -635,7 +657,7 @@ CLOUDFLARE_API_TOKEN="${MINTED_ACCESS}" curl -sS \
 
 Run on the same cadence as the § 8.2 reconciliation, but with an **Access-scoped** token — not the `${MINTED_D1_EDIT}` the other §8 checks share (this is a `curl` to the Access API, not a `wrangler d1` query). Two adjacent failures are **not** this one and need a different fix: a signer **refused after** the login page offered One-Time PIN is an allowlist miss (their email is absent from the policy `include`, § 1a); a signer who never receives the code despite the method being offered is an email-deliverability problem, not a gate defect. Gating is configuration state, so dispatch is unaffected — the sweep still stamps the persisted base (§ 1a, § 6), never the gated page.
 
-**Ground-truth lifeline** for one document's whole acceptance lifecycle:
+**Ground-truth lifeline** for one document's whole acceptance lifecycle (client account: through `storage-d1-query`):
 
 ```bash
 CLOUDFLARE_API_TOKEN="${MINTED_D1_EDIT}" wrangler d1 execute <db-name> --remote --json --command \

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -55,10 +55,14 @@ describe('schema.sql', () => {
   })
 })
 
-// The broker runs `wrangler pages deploy <dir>` with <dir> = the site root, so
-// the positional directory IS the asset root and pages_build_output_dir is
-// overridden. A nested public/ therefore publishes the site one level too deep
-// and `/` returns 404 — the live failure Task 1774 closes.
+// The template's flat shape and its `pages_build_output_dir = "."` have to agree,
+// because the two together are what puts index.html at the served root. Until
+// Task 1917 the broker handed wrangler the site root as the positional asset
+// directory, which overrode the declared output dir, so a nested public/ served
+// the site one level too deep and `/` returned 404 — the live failure Task 1774
+// closed by flattening. Since 1917 the broker publishes the declared output dir,
+// so a mismatch here no longer 404s; these assertions keep the shipped template
+// on the one shape that is deployed and measured.
 describe('template layout matches what the deploy publishes', () => {
   it('has no public/ level', () => {
     expect(existsSync(join(TEMPLATE, 'public'))).toBe(false)

package/payload/platform/plugins/cloudflare/references/hosting-sites.md

@@ -33,7 +33,7 @@ If the site captures form data, add the `[[d1_databases]]` binding from `d1-data
 
 ## 3. Load the reused deploy token
 
-> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool.
+> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool. The tool reads `pages_build_output_dir` from the site root's `wrangler.toml` (or `wrangler.json`/`.jsonc`) and publishes that directory as the served root, which is the same asset root step 4 below passes positionally. A declared output dir that is missing fails the deploy naming the path rather than publishing its parent.
 
 A Pages deploy needs **Account · Cloudflare Pages · Edit**. If the site has Pages Functions hitting D1, the token also needs **Account · D1 · Edit** (the single most common breakage — see `d1-data-capture.md`). The `pages` scope resolves the stable `<brand>-pages-d1` token, which carries both. Resolve it with the deterministic helper, which mints it once only if absent and reuses it thereafter. This is the one command; do not source the secrets file and hand the resulting `CLOUDFLARE_API_TOKEN` to `wrangler` — that variable holds the **master**, not the per-scope token, and `wrangler pages` then returns `Authentication error [code: 10000]`:
 

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -98,11 +98,11 @@ Copy `template/` to `<accountDir>/sites/<project>/` and fill `wrangler.toml`'s `
 placeholder in the assembled tree.**
 
 `sites/<project>/` is the only location the broker will publish: `resolveSiteDir` resolves
-`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat because
-the deploy publishes the directory it is handed — `index.html`, `portal.css`, `portal.js`,
+`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat: `index.html`, `portal.css`, `portal.js`,
 `functions/` and `wrangler.toml` all sit at its root, with no nested asset level, and
-`pages_build_output_dir` reads `"."` to match. A nested asset level publishes the site one level too
-deep, which serves 404 at the domain root.
+`pages_build_output_dir` reads `"."` to match. The deploy publishes whatever
+directory `pages_build_output_dir` declares, so the two must agree; a nested asset level that the
+config does not declare publishes the site one level too deep, which serves 404 at the domain root.
 
 The deploy serves everything in that tree except a fixed ignore list — `functions/`, `_worker.js`,
 `_redirects`, `_headers`, `_routes.json`, `node_modules`, `.git`, `.DS_Store`, `.wrangler` — and

package/payload/server/{chunk-KZFE3MOY.js → chunk-RPUTKSAJ.js}

@@ -92,19 +92,19 @@ function readHouseCredential(platformRoot) {
 import { execFile as execFile2 } from "child_process";
 import { cp, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2, relative } from "path";
+import { join as join3, relative as relative2 } from "path";
 
 // ../lib/storage-broker/src/house-scoped-token.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { execFile } from "child_process";
-var defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+var defaultRun = (cmd, args, env) => new Promise((resolve2, reject) => {
   execFile(cmd, args, { env }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function readKey(path, key) {
@@ -145,8 +145,123 @@ function keyForScope(scope) {
   }
 }
 
+// ../lib/storage-broker/src/pages-output-dir.ts
+import { lstat, readFile, realpath } from "fs/promises";
+import { isAbsolute, join as join2, relative, resolve } from "path";
+var WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml"
+];
+var KEY = "pages_build_output_dir";
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+function readTomlKey(text) {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return void 0;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return void 0;
+}
+function readJsonKey(text, name, jsonc) {
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = parsed[KEY];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+function escapes(root, child) {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+function outsideError(name, declared, resolved, root) {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`
+  );
+}
+async function resolveUploadDir(dir) {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text;
+    try {
+      text = await readFile(join2(dir, name), "utf8");
+    } catch {
+      continue;
+    }
+    const declared = name === "wrangler.toml" ? readTomlKey(text) : readJsonKey(text, name, name === "wrangler.jsonc");
+    if (declared === void 0) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`
+      );
+    }
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`
+      );
+    }
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}
+
 // ../lib/storage-broker/src/cf-exec.ts
-var WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
 function encodeObjectKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
@@ -154,14 +269,14 @@ function objectUrl(accountId, bucket, key) {
   return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
 }
 var defaultFetch = (url, init) => fetch(url, init);
-var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve, reject) => {
+var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve2, reject) => {
   execFile2(cmd, args, { env, cwd: opts?.cwd }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function parseJson(raw, context) {
@@ -373,15 +488,18 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
       }
     },
     async pagesDeploy(dir, project, branch) {
-      const staged = await mkdtemp(join2(tmpdir(), "maxy-pages-upload-"));
+      const { uploadDir, source: uploadDirSource } = await resolveUploadDir(dir);
+      const staged = await mkdtemp(join3(tmpdir(), "maxy-pages-upload-"));
       const excluded = [];
       try {
-        await cp(dir, staged, {
+        await cp(uploadDir, staged, {
           recursive: true,
-          // Only a config at the root of the tree is wrangler's own. A nested
-          // file of the same name is site content and stays published.
+          // Only a config at the root of what is uploaded is dropped. That root
+          // is the served root, which is the surface Task 1782 protects. A file
+          // of the same name anywhere below it is site content and stays
+          // published.
           filter: (src) => {
-            const rel = relative(dir, src);
+            const rel = relative2(uploadDir, src);
             if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
             excluded.push(rel);
             return false;
@@ -396,7 +514,7 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
         if (!url) {
           throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
         }
-        return { url, excluded: excluded.sort() };
+        return { url, excluded: excluded.sort(), uploadDir, uploadDirSource };
       } finally {
         await rm(staged, { recursive: true, force: true });
       }
@@ -477,15 +595,15 @@ ${await res.text()}`
 }
 async function makeHouseCfExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }
 async function makeHousePagesExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("pages", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }

package/payload/server/server.js

@@ -133,7 +133,7 @@ import {
   registerResource,
   resolveOwner,
   tooLargeMessage
-} from "./chunk-KZFE3MOY.js";
+} from "./chunk-RPUTKSAJ.js";
 import {
   __commonJS,
   __toESM
@@ -9660,9 +9660,9 @@ app3.post("/pages/deploy", pagesDeployBodyLimit, async (c) => {
       `[pages-broker] op=project-ensure pub=${pub} project=${project} existed=${existed} created=${!existed}`
     );
     const started = Date.now();
-    const { url, excluded } = await exec.pagesDeploy(dir, project, branch);
+    const { url, excluded, uploadDir, uploadDirSource } = await exec.pagesDeploy(dir, project, branch);
     console.error(
-      `[pages-broker] op=stage pub=${pub} excluded=${excluded.length > 0 ? excluded.join(",") : "none"}`
+      `[pages-broker] op=stage pub=${pub} upload=${uploadDir} uploadFrom=${uploadDirSource} excluded=${excluded.length > 0 ? excluded.join(",") : "none"}`
     );
     console.error(`[pages-broker] op=deploy pub=${pub} ranMs=${Date.now() - started} url=${url}`);
     const httpStatus = await verifyDeployed(url);
@@ -10032,7 +10032,7 @@ app3.post("/r2/object/delete", envelopeBodyLimit("write"), async (c) => {
 });
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-UYDFMWF4.js");
+  const { reconcileStorage } = await import("./src-JN6PIAJN.js");
   const cf = await makeHouseCfExec(root);
   const accountsDir = resolve11(root, "..", "data", "accounts");
   const strays = (await reconcileStorage({
@@ -10072,7 +10072,7 @@ async function runStorageAudit(root) {
   );
 }
 async function runPagesAudit(root) {
-  const { reconcilePages } = await import("./src-UYDFMWF4.js");
+  const { reconcilePages } = await import("./src-JN6PIAJN.js");
   const cf = await makeHousePagesExec(root);
   const r = await reconcilePages({
     cfProjects: async () => (await cf.pagesProjectList()).map((p) => p.name),