@rubytech/create-maxy-code 0.1.491 → 0.1.492

package/payload/platform/lib/storage-broker/src/pages-output-dir.ts

@@ -0,0 +1,194 @@
+// Where a Pages deploy's assets actually start. Task 1917 — `wrangler pages
+// deploy <dir>` treats the positional argument as the asset root and overrides
+// `pages_build_output_dir`, so handing it the site root publishes a declared
+// output dir one level too deep and the served root 404s. Measured on glsmith
+// 2026-07-22: two trees with identical shape and config, one deployed by house
+// wrangler (document at the root, 200) and one by this broker (document
+// reachable only under /public/, root 404).
+//
+// Only the one key is interpreted, in any of the three config formats. This is
+// deliberately not a wrangler config parser: everything else in the file is
+// wrangler's business and stays wrangler's business.
+
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+
+// The filenames `wrangler pages deploy` discovers as its own configuration, in
+// wrangler's own precedence order (wrangler 4.112.0, wrangler-dist/cli.js:3189
+// — json, then jsonc, then toml). The order is load-bearing twice: it decides
+// which config declares the output dir here, and Task 1782 drops all three from
+// the upload so a config is never served publicly at /wrangler.toml, where it
+// would disclose the D1 database id and R2 bucket name.
+export const WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml",
+] as const;
+
+export type UploadDirSource = (typeof WRANGLER_CONFIG_NAMES)[number] | "site-root";
+
+export type UploadDirResolution = {
+  /** Absolute path to stage and hand wrangler as the asset root. */
+  uploadDir: string;
+  /** Which input decided it, so the caller logs the reason and not the value alone. */
+  source: UploadDirSource;
+  /** The verbatim declared value, present only when a config decided it. */
+  declared?: string;
+};
+
+const KEY = "pages_build_output_dir";
+
+/** Strips line comments and block comments that sit outside string literals.
+ *  JSON has no comments and jsonc does, so a jsonc file is de-commented before
+ *  JSON.parse. Scanning character-wise rather than by regex is what keeps a
+ *  `//` inside a value (a path like "a//b") from being eaten as a comment. */
+function stripJsonComments(text: string): string {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+
+/** Reads the one key from a TOML file's top level. Top level means before the
+ *  first `[section]` header: a key under `[env.preview]` is that environment's,
+ *  not the deploy's, and reading it would publish the wrong root. Nothing else
+ *  in the file is interpreted. */
+function readTomlKey(text: string): string | undefined {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return undefined;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return undefined;
+}
+
+/** Reads the one key from a JSON or JSONC file's top level. A present key whose
+ *  value is not a string is an error rather than an ignore: the tree declared an
+ *  output dir, and publishing its parent instead is the defect this closes. */
+function readJsonKey(text: string, name: string, jsonc: boolean): string | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = (parsed as Record<string, unknown>)[KEY];
+  if (value === undefined) return undefined;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+
+/** True when `child` is not `root` or a descendant of it. */
+function escapes(root: string, child: string): boolean {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+
+function outsideError(name: string, declared: string, resolved: string, root: string): Error {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`,
+  );
+}
+
+/** Resolves the directory whose contents become the served root for `dir`.
+ *
+ *  A tree that declares nothing keeps the site root, which is what every deploy
+ *  did before Task 1917. A tree that declares an output dir gets that dir. A
+ *  tree that declares one which cannot be resolved is an error naming the path:
+ *  falling back to the site root here is exactly the defect this closes, because
+ *  the deploy then succeeds while serving the wrong root. */
+export async function resolveUploadDir(dir: string): Promise<UploadDirResolution> {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text: string;
+    try {
+      text = await readFile(join(dir, name), "utf8");
+    } catch {
+      continue; // absent, or not readable as a file: the next name is wrangler's next choice
+    }
+    const declared =
+      name === "wrangler.toml"
+        ? readTomlKey(text)
+        : readJsonKey(text, name, name === "wrangler.jsonc");
+    // A config that declares nothing leaves the site root as the asset root,
+    // which is wrangler's own behaviour for a Pages project with no output dir.
+    if (declared === undefined) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    // Confinement, lexically first. A declared value is file content, and
+    // resolving file content into a publish path through the route that holds
+    // the account-wide Cloudflare credential is the moment it has to be
+    // bounded. This pass costs no filesystem call and rejects the plain
+    // `"../.."` before anything is touched.
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    // lstat, not stat: the link itself is what matters here, and stat would
+    // report a link to a directory as a directory.
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`,
+      );
+    }
+    // A link is refused wherever it points. The staging copy takes the upload
+    // directory as its source and does not dereference, so a link source fails
+    // the copy outright; and a target that can change between this check and
+    // that copy is not something to publish from a route holding the
+    // account-wide credential.
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`,
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`,
+      );
+    }
+    // Confinement again, on the real paths. The lexical pass above is blind to
+    // symlinks in the declared value's own parent segments: a declared "a/b"
+    // whose `a` links out of the tree stays inside by string comparison while
+    // resolving anywhere on disk, and the deploy would then publish whatever it
+    // resolves to. Both sides are resolved because the site root itself commonly
+    // arrives through a symlinked prefix (macOS /var, a linked account
+    // directory), which would otherwise read as an escape on its own.
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}

package/payload/platform/plugins/business-assistant/skills/e-sign/SKILL.md

@@ -92,6 +92,8 @@ Per-signer stamped copies (§ 6) are written alongside, in the same `<DOC_REF>`
 
 The § 1 default — an unguessable hex slug plus `noindex` — keeps a low-sensitivity document private by obscurity. For a **confidential** proposal to a **named** recipient, add a **Cloudflare Access** gate in front of the page so only allowlisted emails can load it at all. Gating is **additive**: the slug and `noindex` stay; the gate sits in front of them. It is never the default and never replaces them.
 
+> **Client account:** Access gating is the house's to apply. The broker offers no Access tool, and `cf-token.sh access` denies a client account that scope with the same `reason=not-house` it denies `pages`, so mint nothing here and run none of the calls below. Instead **request the gate**, handing the house three things: the **Pages project** carrying the document, the **document path or paths** to gate, and the **signer emails** (plus the business owner's) for the policy `include`. Say in the same request that **`/api/*` on that project is gated alongside those paths**, because gating the document path alone leaves `POST /api/accept` forgeable and `GET /api/status` world-readable, the bypass this section describes below. Never ask the client or the signer for a Cloudflare token (the callout that precedes § 0). Everything that follows (the One-Time PIN pre-flight, the app and policy calls, the `gate-probe`, and the neutral root portal) stays as written and is the house's to run.
+
 **One-Time PIN is the only correct identity provider here — and why.** The signer is an external party who belongs to **no** Cloudflare organization, so SSO, Google, GitHub, SAML and every other org-membership IdP cannot authenticate them. Cloudflare's built-in **One-Time PIN** emails a login code to **any allowlisted address** with no org membership required — exactly the external-signer case. Prescribe `onetimepin`; do not reach for another IdP type for an external signer (a higher-assurance provider is a separate capability, not this skill).
 
 **Load-bearing pre-flight — a gate requires an enabled login method.** Creating an Access application and policy does **not** enable a login method. If the org has **zero** identity providers when the gate goes live, the login page offers **nothing** and locks out *everyone, including the operator*. Before activating any Access app, list the org's IdPs and confirm the list is non-empty:

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -55,10 +55,14 @@ describe('schema.sql', () => {
   })
 })
 
-// The broker runs `wrangler pages deploy <dir>` with <dir> = the site root, so
-// the positional directory IS the asset root and pages_build_output_dir is
-// overridden. A nested public/ therefore publishes the site one level too deep
-// and `/` returns 404 — the live failure Task 1774 closes.
+// The template's flat shape and its `pages_build_output_dir = "."` have to agree,
+// because the two together are what puts index.html at the served root. Until
+// Task 1917 the broker handed wrangler the site root as the positional asset
+// directory, which overrode the declared output dir, so a nested public/ served
+// the site one level too deep and `/` returned 404 — the live failure Task 1774
+// closed by flattening. Since 1917 the broker publishes the declared output dir,
+// so a mismatch here no longer 404s; these assertions keep the shipped template
+// on the one shape that is deployed and measured.
 describe('template layout matches what the deploy publishes', () => {
   it('has no public/ level', () => {
     expect(existsSync(join(TEMPLATE, 'public'))).toBe(false)

package/payload/platform/plugins/cloudflare/references/hosting-sites.md

@@ -33,7 +33,7 @@ If the site captures form data, add the `[[d1_databases]]` binding from `d1-data
 
 ## 3. Load the reused deploy token
 
-> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool.
+> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool. The tool reads `pages_build_output_dir` from the site root's `wrangler.toml` (or `wrangler.json`/`.jsonc`) and publishes that directory as the served root, which is the same asset root step 4 below passes positionally. A declared output dir that is missing fails the deploy naming the path rather than publishing its parent.
 
 A Pages deploy needs **Account · Cloudflare Pages · Edit**. If the site has Pages Functions hitting D1, the token also needs **Account · D1 · Edit** (the single most common breakage — see `d1-data-capture.md`). The `pages` scope resolves the stable `<brand>-pages-d1` token, which carries both. Resolve it with the deterministic helper, which mints it once only if absent and reuses it thereafter. This is the one command; do not source the secrets file and hand the resulting `CLOUDFLARE_API_TOKEN` to `wrangler` — that variable holds the **master**, not the per-scope token, and `wrangler pages` then returns `Authentication error [code: 10000]`:
 

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -98,11 +98,11 @@ Copy `template/` to `<accountDir>/sites/<project>/` and fill `wrangler.toml`'s `
 placeholder in the assembled tree.**
 
 `sites/<project>/` is the only location the broker will publish: `resolveSiteDir` resolves
-`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat because
-the deploy publishes the directory it is handed — `index.html`, `portal.css`, `portal.js`,
+`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat: `index.html`, `portal.css`, `portal.js`,
 `functions/` and `wrangler.toml` all sit at its root, with no nested asset level, and
-`pages_build_output_dir` reads `"."` to match. A nested asset level publishes the site one level too
-deep, which serves 404 at the domain root.
+`pages_build_output_dir` reads `"."` to match. The deploy publishes whatever
+directory `pages_build_output_dir` declares, so the two must agree; a nested asset level that the
+config does not declare publishes the site one level too deep, which serves 404 at the domain root.
 
 The deploy serves everything in that tree except a fixed ignore list — `functions/`, `_worker.js`,
 `_redirects`, `_headers`, `_routes.json`, `node_modules`, `.git`, `.DS_Store`, `.wrangler` — and

package/payload/server/{chunk-KZFE3MOY.js → chunk-RPUTKSAJ.js}

@@ -92,19 +92,19 @@ function readHouseCredential(platformRoot) {
 import { execFile as execFile2 } from "child_process";
 import { cp, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2, relative } from "path";
+import { join as join3, relative as relative2 } from "path";
 
 // ../lib/storage-broker/src/house-scoped-token.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { execFile } from "child_process";
-var defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
+var defaultRun = (cmd, args, env) => new Promise((resolve2, reject) => {
   execFile(cmd, args, { env }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function readKey(path, key) {
@@ -145,8 +145,123 @@ function keyForScope(scope) {
   }
 }
 
+// ../lib/storage-broker/src/pages-output-dir.ts
+import { lstat, readFile, realpath } from "fs/promises";
+import { isAbsolute, join as join2, relative, resolve } from "path";
+var WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml"
+];
+var KEY = "pages_build_output_dir";
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+function readTomlKey(text) {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return void 0;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return void 0;
+}
+function readJsonKey(text, name, jsonc) {
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = parsed[KEY];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+function escapes(root, child) {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+function outsideError(name, declared, resolved, root) {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`
+  );
+}
+async function resolveUploadDir(dir) {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text;
+    try {
+      text = await readFile(join2(dir, name), "utf8");
+    } catch {
+      continue;
+    }
+    const declared = name === "wrangler.toml" ? readTomlKey(text) : readJsonKey(text, name, name === "wrangler.jsonc");
+    if (declared === void 0) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`
+      );
+    }
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`
+      );
+    }
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}
+
 // ../lib/storage-broker/src/cf-exec.ts
-var WRANGLER_CONFIG_NAMES = ["wrangler.json", "wrangler.jsonc", "wrangler.toml"];
 function encodeObjectKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
@@ -154,14 +269,14 @@ function objectUrl(accountId, bucket, key) {
   return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
 }
 var defaultFetch = (url, init) => fetch(url, init);
-var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve, reject) => {
+var defaultRun2 = (cmd, args, env, opts) => new Promise((resolve2, reject) => {
   execFile2(cmd, args, { env, cwd: opts?.cwd }, (err, stdout, stderr) => {
     if (err) {
       reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
 ${stderr}`));
       return;
     }
-    resolve({ stdout: stdout.toString() });
+    resolve2({ stdout: stdout.toString() });
   });
 });
 function parseJson(raw, context) {
@@ -373,15 +488,18 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
       }
     },
     async pagesDeploy(dir, project, branch) {
-      const staged = await mkdtemp(join2(tmpdir(), "maxy-pages-upload-"));
+      const { uploadDir, source: uploadDirSource } = await resolveUploadDir(dir);
+      const staged = await mkdtemp(join3(tmpdir(), "maxy-pages-upload-"));
       const excluded = [];
       try {
-        await cp(dir, staged, {
+        await cp(uploadDir, staged, {
           recursive: true,
-          // Only a config at the root of the tree is wrangler's own. A nested
-          // file of the same name is site content and stays published.
+          // Only a config at the root of what is uploaded is dropped. That root
+          // is the served root, which is the surface Task 1782 protects. A file
+          // of the same name anywhere below it is site content and stays
+          // published.
           filter: (src) => {
-            const rel = relative(dir, src);
+            const rel = relative2(uploadDir, src);
             if (!WRANGLER_CONFIG_NAMES.includes(rel)) return true;
             excluded.push(rel);
             return false;
@@ -396,7 +514,7 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
         if (!url) {
           throw new Error(`storage-broker: pages deploy returned no deployment url: ${stdout}`);
         }
-        return { url, excluded: excluded.sort() };
+        return { url, excluded: excluded.sort(), uploadDir, uploadDirSource };
       } finally {
         await rm(staged, { recursive: true, force: true });
       }
@@ -477,15 +595,15 @@ ${await res.text()}`
 }
 async function makeHouseCfExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }
 async function makeHousePagesExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
   const cred = readHouseCredential(platformRoot);
-  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
-  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const houseEnvPath = join3(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join3(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
   const scoped = await resolveHouseScopedToken("pages", houseEnvPath, cfTokenSh, run);
   return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
 }

package/payload/server/server.js

@@ -133,7 +133,7 @@ import {
   registerResource,
   resolveOwner,
   tooLargeMessage
-} from "./chunk-KZFE3MOY.js";
+} from "./chunk-RPUTKSAJ.js";
 import {
   __commonJS,
   __toESM
@@ -9660,9 +9660,9 @@ app3.post("/pages/deploy", pagesDeployBodyLimit, async (c) => {
       `[pages-broker] op=project-ensure pub=${pub} project=${project} existed=${existed} created=${!existed}`
     );
     const started = Date.now();
-    const { url, excluded } = await exec.pagesDeploy(dir, project, branch);
+    const { url, excluded, uploadDir, uploadDirSource } = await exec.pagesDeploy(dir, project, branch);
     console.error(
-      `[pages-broker] op=stage pub=${pub} excluded=${excluded.length > 0 ? excluded.join(",") : "none"}`
+      `[pages-broker] op=stage pub=${pub} upload=${uploadDir} uploadFrom=${uploadDirSource} excluded=${excluded.length > 0 ? excluded.join(",") : "none"}`
     );
     console.error(`[pages-broker] op=deploy pub=${pub} ranMs=${Date.now() - started} url=${url}`);
     const httpStatus = await verifyDeployed(url);
@@ -10032,7 +10032,7 @@ app3.post("/r2/object/delete", envelopeBodyLimit("write"), async (c) => {
 });
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-UYDFMWF4.js");
+  const { reconcileStorage } = await import("./src-JN6PIAJN.js");
   const cf = await makeHouseCfExec(root);
   const accountsDir = resolve11(root, "..", "data", "accounts");
   const strays = (await reconcileStorage({
@@ -10072,7 +10072,7 @@ async function runStorageAudit(root) {
   );
 }
 async function runPagesAudit(root) {
-  const { reconcilePages } = await import("./src-UYDFMWF4.js");
+  const { reconcilePages } = await import("./src-JN6PIAJN.js");
   const cf = await makeHousePagesExec(root);
   const r = await reconcilePages({
     cfProjects: async () => (await cf.pagesProjectList()).map((p) => p.name),

package/payload/server/{src-UYDFMWF4.js → src-JN6PIAJN.js}

@@ -23,7 +23,7 @@ import {
   stripAccountWideTokens,
   tooLargeMessage,
   validateMapping
-} from "./chunk-KZFE3MOY.js";
+} from "./chunk-RPUTKSAJ.js";
 import "./chunk-PFF6I7KP.js";
 export {
   D1_MAX_SQL_STATEMENT_BYTES,