@rubytech/create-sitedesk-code 0.1.519 → 0.1.520

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-multipart.test.ts

@@ -37,6 +37,10 @@ function harness(opts: { folders?: string[] } = {}) {
   }
 
   const env = {
+    // This portal's own account, baked into wrangler at assemble time. Every
+    // object key and every query binds it, so the fake session row below has to
+    // carry the same value or resolveSession refuses.
+    PORTAL_ACCOUNT_ID: 'acct',
     BUCKET: {
       async createMultipartUpload(key: string) {
         const id = `r2-${++seq}`
@@ -69,7 +73,10 @@ function harness(opts: { folders?: string[] } = {}) {
                 return null
               },
               async run() {
-                rows.set(String(args[3]), { fileId: args[0], size: args[4] })
+                // The manifest upsert binds (fileId, accountId, ownerId,
+                // filename, objectKey, size, ...), so the key is arg 4 and the
+                // size arg 5.
+                rows.set(String(args[4]), { fileId: args[0], size: args[5] })
               },
             }
           },
@@ -105,7 +112,7 @@ describe('multipart create', () => {
     )
     expect(res.status).toBe(200)
     expect(res.payload.r2UploadId).toBe('r2-1')
-    expect(res.payload.key).toBe('alice/big.zip')
+    expect(res.payload.key).toBe('acct/alice/big.zip')
   })
 
   it('applies the same target rule as a single-shot upload', async () => {
@@ -122,7 +129,7 @@ describe('multipart create', () => {
     const res = await processMultipartCreate(
       's', 'big.zip', 'jobs', 1024, h.env, h.log, h.newId, () => 1,
     )
-    expect(res.payload.key).toBe('alice/jobs/big.zip')
+    expect(res.payload.key).toBe('acct/alice/jobs/big.zip')
   })
 })
 
@@ -131,17 +138,18 @@ describe('multipart part', () => {
     const h = harness()
     await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
     const res = await processMultipartPart(
-      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(MAX_PART_BYTES + 1), h.env, h.log,
+      's', 'acct/alice/big.zip', 'r2-1', 1, new Uint8Array(MAX_PART_BYTES + 1), h.env, h.log,
     )
     expect(res.status).toBe(413)
   })
 
   it('refuses a part whose key is not the caller own', async () => {
     // The key arrives on EVERY part request, so it is re-authorized every time.
-    // A session that may write alice/ must not be able to append to bob/.
+    // A session that may write acct/alice/ must not be able to append to
+    // acct/bob/, even though both live in this portal's own account.
     const h = harness()
     const res = await processMultipartPart(
-      's', 'bob/big.zip', 'r2-1', 1, new Uint8Array(4), h.env, h.log,
+      's', 'acct/bob/big.zip', 'r2-1', 1, new Uint8Array(4), h.env, h.log,
     )
     expect(res.status).toBe(403)
   })
@@ -150,7 +158,7 @@ describe('multipart part', () => {
     const h = harness()
     await processMultipartCreate('s', 'big.zip', '', 200 * 1024 * 1024, h.env, h.log, h.newId, () => 1)
     const res = await processMultipartPart(
-      's', 'alice/big.zip', 'r2-1', 1, new Uint8Array(8), h.env, h.log,
+      's', 'acct/alice/big.zip', 'r2-1', 1, new Uint8Array(8), h.env, h.log,
     )
     expect(res.status).toBe(200)
     expect(res.payload.etag).toBe('etag-1')
@@ -161,15 +169,15 @@ describe('multipart complete', () => {
   it('assembles the object and writes one manifest row', async () => {
     const h = harness()
     await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
-    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(60), h.env, h.log)
-    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 2, new Uint8Array(40), h.env, h.log)
+    await processMultipartPart('s', 'acct/alice/big.zip', 'r2-1', 1, new Uint8Array(60), h.env, h.log)
+    await processMultipartPart('s', 'acct/alice/big.zip', 'r2-1', 2, new Uint8Array(40), h.env, h.log)
     const res = await processMultipartComplete(
-      's', 'alice/big.zip', 'r2-1', '',
+      's', 'acct/alice/big.zip', 'r2-1', '',
       [{ partNumber: 1, etag: 'etag-1' }, { partNumber: 2, etag: 'etag-2' }],
       h.env, h.log, h.newId, () => 1,
     )
     expect(res.status).toBe(200)
-    expect(h.objects.get('alice/big.zip')).toBe(100)
+    expect(h.objects.get('acct/alice/big.zip')).toBe(100)
     expect(h.rows.size).toBe(1)
   })
 
@@ -179,7 +187,7 @@ describe('multipart complete', () => {
     const h = harness()
     await processMultipartCreate('s', 'big.zip', '', 100, h.env, h.log, h.newId, () => 1)
     const res = await processMultipartComplete(
-      's', 'alice/big.zip', 'r2-1', '',
+      's', 'acct/alice/big.zip', 'r2-1', '',
       [{ partNumber: 1, etag: 'e', size: MAX_TOTAL_BYTES }, { partNumber: 2, etag: 'e', size: 1 }],
       h.env, h.log, h.newId, () => 1,
     )
@@ -191,7 +199,7 @@ describe('multipart complete', () => {
   it('refuses a complete for a key that is not the caller own', async () => {
     const h = harness()
     const res = await processMultipartComplete(
-      's', 'bob/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'e' }], h.env, h.log, h.newId, () => 1,
+      's', 'acct/bob/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'e' }], h.env, h.log, h.newId, () => 1,
     )
     expect(res.status).toBe(403)
   })
@@ -199,9 +207,9 @@ describe('multipart complete', () => {
   it('logs op=complete with a re-read post-condition', async () => {
     const h = harness()
     await processMultipartCreate('s', 'big.zip', '', 10, h.env, h.log, h.newId, () => 1)
-    await processMultipartPart('s', 'alice/big.zip', 'r2-1', 1, new Uint8Array(10), h.env, h.log)
+    await processMultipartPart('s', 'acct/alice/big.zip', 'r2-1', 1, new Uint8Array(10), h.env, h.log)
     await processMultipartComplete(
-      's', 'alice/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'etag-1' }],
+      's', 'acct/alice/big.zip', 'r2-1', '', [{ partNumber: 1, etag: 'etag-1' }],
       h.env, h.log, h.newId, () => 1,
     )
     expect(

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-upload-target.test.ts

@@ -3,9 +3,11 @@ import { processUpload } from '../../skills/data-portal/template/functions/api/u
 import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
 
 /**
- * The manifest is a Map keyed on objectKey, so the schema's `objectKey UNIQUE`
- * is real rather than assumed. Task 1704's lesson: a fake that accepts what the
- * store rejects passes a test the production path fails.
+ * The manifest is a Map keyed on objectKey, so the schema's
+ * `UNIQUE (accountId, objectKey)` is real rather than assumed. Every key now
+ * leads with the account segment, so on this single-account harness keying on
+ * objectKey alone is that same conflict key. Task 1704's lesson: a fake that
+ * accepts what the store rejects passes a test the production path fails.
  */
 function harness(opts: { folders?: string[]; grant?: string[] } = {}) {
   const folders = opts.folders ?? ['jobs']
@@ -14,6 +16,9 @@ function harness(opts: { folders?: string[]; grant?: string[] } = {}) {
   const lines: string[] = []
 
   const env = {
+    // This portal's own account, baked into wrangler.toml at assemble time. It
+    // is the tenant scope for every query and the leading segment of every key.
+    PORTAL_ACCOUNT_ID: 'acct',
     BUCKET: {
       async put(key: string, body: Uint8Array) {
         objects.set(key, body)
@@ -45,17 +50,20 @@ function harness(opts: { folders?: string[]; grant?: string[] } = {}) {
                 return null
               },
               async run() {
-                // The upsert: conflict on objectKey replaces in place, which is
-                // what the real ON CONFLICT (objectKey) does.
-                const key = String(args[3])
+                // The upsert: conflict on (accountId, objectKey) replaces in
+                // place, which is what the real
+                // ON CONFLICT (accountId, objectKey) does. accountId is bind 1,
+                // so every column after it sits one index later than it used to.
+                const key = String(args[4])
                 rows.set(key, {
                   fileId: args[0],
-                  ownerId: args[1],
-                  filename: args[2],
+                  accountId: args[1],
+                  ownerId: args[2],
+                  filename: args[3],
                   objectKey: key,
-                  size: args[4],
+                  size: args[5],
                   ingested: 0,
-                  targetPath: args[7],
+                  targetPath: args[8],
                 })
               },
             }
@@ -83,8 +91,8 @@ describe('targeted upload', () => {
       's', 'a.pdf', 'jobs', new Uint8Array([1, 2]), h.env, h.log, h.newId, () => 1000,
     )
     expect(res.status).toBe(200)
-    expect([...h.objects.keys()]).toEqual(['alice/jobs/a.pdf'])
-    expect(h.rows.get('alice/jobs/a.pdf')!.targetPath).toBe('jobs')
+    expect([...h.objects.keys()]).toEqual(['acct/alice/jobs/a.pdf'])
+    expect(h.rows.get('acct/alice/jobs/a.pdf')!.targetPath).toBe('jobs')
   })
 
   it('stores at the owner root when untargeted', async () => {
@@ -93,7 +101,7 @@ describe('targeted upload', () => {
       's', 'a.pdf', '', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000,
     )
     expect(res.status).toBe(200)
-    expect([...h.objects.keys()]).toEqual(['alice/a.pdf'])
+    expect([...h.objects.keys()]).toEqual(['acct/alice/a.pdf'])
   })
 
   it('keeps the same filename in two folders as two distinct objects', async () => {
@@ -102,7 +110,7 @@ describe('targeted upload', () => {
     const h = harness({ folders: ['jobs', 'output'] })
     await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
     await processUpload('s', 'a.pdf', 'output', new Uint8Array([2]), h.env, h.log, h.newId, () => 1000)
-    expect([...h.objects.keys()].sort()).toEqual(['alice/jobs/a.pdf', 'alice/output/a.pdf'])
+    expect([...h.objects.keys()].sort()).toEqual(['acct/alice/jobs/a.pdf', 'acct/alice/output/a.pdf'])
     expect(h.rows.size).toBe(2)
   })
 
@@ -111,7 +119,7 @@ describe('targeted upload', () => {
     await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([1]), h.env, h.log, h.newId, () => 1000)
     await processUpload('s', 'a.pdf', 'jobs', new Uint8Array([2, 2]), h.env, h.log, h.newId, () => 2000)
     expect(h.rows.size).toBe(1)
-    expect(h.rows.get('alice/jobs/a.pdf')!.size).toBe(2)
+    expect(h.rows.get('acct/alice/jobs/a.pdf')!.size).toBe(2)
   })
 
   it('refuses an out-of-grant target and stores nothing', async () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-uploads-listing.test.ts

@@ -20,6 +20,10 @@ function envWithGenerations(
   manifest: Record<string, unknown>[] = [],
 ) {
   return {
+    // The portal's own account, baked in at assemble time. On the shared store
+    // (Task 2099) it is the tenant scope every query binds, so the fake below
+    // honours it the same way it honours the generation pointer.
+    PORTAL_ACCOUNT_ID: 'acct',
     DB: {
       prepare(sql: string) {
         return {
@@ -27,6 +31,10 @@ function envWithGenerations(
             return {
               async first() {
                 if (sql.includes('FROM sessions')) {
+                  // Bound (sessionId, accountId, nowMs). A session belonging to
+                  // another portal's account resolves to nothing here, and the
+                  // joined people row carries the account the caller asked for.
+                  if (bound[1] !== 'acct') return null
                   return { ownerId: 'alice', accountId: 'acct', folders: '' }
                 }
                 return null

package/payload/platform/plugins/cloudflare/mcp/__tests__/skill-contract.test.ts

@@ -44,13 +44,30 @@ describe('data-portal SKILL.md', () => {
     expect(skill()).toMatch(/plugin-read/)
   })
 
-  it('records the two-session provisioning sequence', () => {
-    // The load-bearing sequencing decision: the broker registers a bucket to
-    // whoever creates it, ON CREATE and never reassigned, so the client
-    // account must create its own or its ingestion sweep is denied forever.
+  it('records the shared store and single-session provisioning (Task 2099)', () => {
+    // The load-bearing decision, and the reverse of what this test used to
+    // pin. Provisioning was two sessions so the client account would own its
+    // own bucket. That is gone: every portal binds ONE shared house-owned
+    // database and bucket, created once, and a per-client store is what put
+    // the account on Cloudflare's ten-database cap.
     const text = skill()
-    expect(text).toMatch(/storage-r2-bucket-create/)
-    expect(text).toMatch(/client|sub-account/i)
+    expect(text).toMatch(/one session|single house session|provisioning is one session/i)
+    expect(text).toMatch(/DATA_PORTAL_DB_NAME/)
+    expect(text).toMatch(/DATA_PORTAL_BUCKET/)
+    // The per-client creates must not come back by copy-paste.
+    expect(text).not.toMatch(/storage-r2-bucket-create/)
+  })
+
+  it('pins the tenant discriminator, since one store now holds every client', () => {
+    const text = skill()
+    expect(text).toMatch(/PORTAL_ACCOUNT_ID/)
+    expect(text).toMatch(/storageModel/)
+  })
+
+  it('forbids hand-filling the assembled config', () => {
+    // Two sessions resolving the same placeholder independently is what
+    // shipped a portal whose bucket name and config disagreed.
+    expect(skill()).toMatch(/portal-assemble\.mjs/)
   })
 
   it('names the passcode discipline', () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/upload-route.test.ts

@@ -3,13 +3,18 @@ import { processUpload } from '../../skills/data-portal/template/functions/api/u
 import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
 
 // The fake must model the constraints the schema actually declares, not just
-// the happy path. `objectKey TEXT UNIQUE` is what makes a re-upload an upsert
-// rather than a second row; a fake that accepts duplicates would let the
-// "exactly one manifest row" assertion pass while the real D1 threw.
+// the happy path. The table-level `UNIQUE (accountId, objectKey)` is what makes
+// a re-upload an upsert rather than a second row; a fake that accepts
+// duplicates would let the "exactly one manifest row" assertion pass while the
+// real D1 threw. The store is shared by every portal, so the uniqueness is per
+// account and never on objectKey alone.
 function makeEnv() {
   const manifestRows: unknown[][] = []
   const objects = new Map<string, Uint8Array>()
   const env = {
+    // This portal's own account, baked into wrangler.toml [vars] at assemble
+    // time. It is the tenant scope for every query and every object key.
+    PORTAL_ACCOUNT_ID: 'acct-a',
     DB: {
       prepare(query: string) {
         let bound: unknown[] = []
@@ -20,11 +25,14 @@ function makeEnv() {
           },
           async run() {
             if (/INSERT INTO manifest/i.test(query)) {
-              const objectKey = bound[3] as string
-              const existing = manifestRows.findIndex((r) => r[3] === objectKey)
+              const accountId = bound[1] as string
+              const objectKey = bound[4] as string
+              const existing = manifestRows.findIndex(
+                (r) => r[1] === accountId && r[4] === objectKey,
+              )
               if (existing >= 0) {
-                if (!/ON CONFLICT\s*\(\s*objectKey\s*\)\s*DO UPDATE/i.test(query)) {
-                  throw new Error('UNIQUE constraint failed: manifest.objectKey')
+                if (!/ON CONFLICT\s*\(\s*accountId\s*,\s*objectKey\s*\)\s*DO UPDATE/i.test(query)) {
+                  throw new Error('UNIQUE constraint failed: manifest.accountId, manifest.objectKey')
                 }
                 manifestRows[existing] = bound
               } else {
@@ -38,11 +46,19 @@ function makeEnv() {
           },
           async first<T>() {
             if (/FROM sessions/i.test(query)) {
-              return (bound[0] === 'sess-a' ? { ownerId: 'alice' } : null) as T | null
+              // Bound (sessionId, accountId, nowMs). The joined people row
+              // carries its own account, and resolveSession returns null unless
+              // that account equals the one it was asked about.
+              return (bound[0] === 'sess-a' && bound[1] === 'acct-a'
+                ? { ownerId: 'alice', accountId: 'acct-a' }
+                : null) as T | null
             }
             if (/FROM manifest/i.test(query)) {
+              // Bound (objectKey, accountId).
               const key = bound[0] as string
-              return (objects.has(key) ? { fileId: 'x' } : null) as T | null
+              return (objects.has(key) && bound[1] === 'acct-a'
+                ? { fileId: 'x' }
+                : null) as T | null
             }
             return null as T | null
           },
@@ -72,7 +88,7 @@ function makeEnv() {
 }
 
 describe('processUpload', () => {
-  it('writes the object under the owner prefix and exactly one manifest row', async () => {
+  it('writes the object under the account and owner prefix and exactly one manifest row', async () => {
     const { env, manifestRows, objects } = makeEnv()
     const lines: string[] = []
     const res = await processUpload(
@@ -85,7 +101,7 @@ describe('processUpload', () => {
       () => 1_000_000,
     )
     expect(res.status).toBe(200)
-    expect([...objects.keys()]).toEqual(['alice/invoice.pdf'])
+    expect([...objects.keys()]).toEqual(['acct-a/alice/invoice.pdf'])
     expect(manifestRows.length).toBe(1)
   })
 
@@ -100,8 +116,8 @@ describe('processUpload', () => {
       () => 'up-1',
       () => 1_000_000,
     )
-    // Column order: fileId, ownerId, filename, objectKey, size, uploadedAt, ingested
-    expect(manifestRows[0][6]).toBe(0)
+    // Column order: fileId, accountId, ownerId, filename, objectKey, size, uploadedAt, ingested
+    expect(manifestRows[0][7]).toBe(0)
   })
 
   it('emits the full lifeline correlated by uploadId, ending in a verified post-condition', async () => {
@@ -139,7 +155,7 @@ describe('processUpload', () => {
     expect(manifestRows.length).toBe(0)
   })
 
-  it('rejects a filename that escapes the owner prefix, and writes nothing', async () => {
+  it('rejects a filename that escapes the account and owner prefix, and writes nothing', async () => {
     const { env, objects, manifestRows } = makeEnv()
     const res = await processUpload(
       'sess-a',
@@ -230,16 +246,16 @@ describe('processUpload', () => {
       )
       expect(second.status).toBe(200)
       expect(manifestRows.length).toBe(1)
-      expect(objects.get('alice/invoice.pdf')?.length).toBe(3)
+      expect(objects.get('acct-a/alice/invoice.pdf')?.length).toBe(3)
     })
 
     it('updates the row to describe the new object, not the old one', async () => {
       const { env, manifestRows } = makeEnv()
       await processUpload('sess-a', 'invoice.pdf', '', new Uint8Array([1]), env, () => {}, () => 'up-1', () => 1_000)
       await processUpload('sess-a', 'invoice.pdf', '', new Uint8Array([9, 9, 9]), env, () => {}, () => 'up-2', () => 2_000)
-      // Column order: fileId, ownerId, filename, objectKey, size, uploadedAt, ingested
-      expect(manifestRows[0][4]).toBe(3)
-      expect(manifestRows[0][5]).toBe(new Date(2_000).toISOString())
+      // Column order: fileId, accountId, ownerId, filename, objectKey, size, uploadedAt, ingested
+      expect(manifestRows[0][5]).toBe(3)
+      expect(manifestRows[0][6]).toBe(new Date(2_000).toISOString())
     })
 
     it('re-arms ingestion by resetting ingested to 0', async () => {
@@ -248,9 +264,9 @@ describe('processUpload', () => {
       // ingested, and nothing would ever say so.
       const { env, manifestRows } = makeEnv()
       await processUpload('sess-a', 'invoice.pdf', '', new Uint8Array([1]), env, () => {}, () => 'up-1', () => 1_000)
-      manifestRows[0][6] = 1 // the device-side sweep marks it ingested
+      manifestRows[0][7] = 1 // the device-side sweep marks it ingested
       await processUpload('sess-a', 'invoice.pdf', '', new Uint8Array([9, 9, 9]), env, () => {}, () => 'up-2', () => 2_000)
-      expect(manifestRows[0][6]).toBe(0)
+      expect(manifestRows[0][7]).toBe(0)
     })
   })
 })

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -25,34 +25,81 @@ Uploads must keep succeeding while the device is offline, which is the same reas
 went to Pages. The install's magic-link gate cannot be reused: it gates `/api/chat` on the install
 and its sessions live in memory, so it does not cross origins.
 
-## Provisioning is two sessions, and the order matters
+## One shared store, and provisioning is one session
 
-The storage broker registers a bucket to **whoever creates it**, and that ownership is set on create
-and never reassigned. There is no delegation.
+Every portal binds the **same** house-owned D1 database and the **same** house-owned R2 bucket. They
+are created once, for the whole install, and reused by every client thereafter. Do **not** create a
+database or a bucket per client: that is what put the account on Cloudflare's ten-database cap and
+blocked the eleventh portal outright.
 
-1. **In the client account's own session**, create the bucket with `storage-r2-bucket-create`, named
-   from `bin/cf-store-name.sh <accountId> <purpose>`. It registers to that account.
-2. **In the admin session**, do everything else: the D1 database, the assembly, recording the Pages
-   project to the client account with `storage-pages-adopt`, and then the deploy.
+Their identity lives in three keys in `platform/config/cloudflare-house.env`, written once when the
+store is created and never retyped:
 
-If the admin creates the bucket instead, it registers to the house, and the client account's own
-ingestion sweep is denied `cross-account` against its own files — permanently, because ownership is
-never reassigned. The portal would appear to work while nothing on the client side could read what
-it stored.
+```
+DATA_PORTAL_DB_NAME=<the one shared database>
+DATA_PORTAL_DB_ID=<its id>
+DATA_PORTAL_BUCKET=<the one shared bucket>
+```
+
+That file is house-only and is preserved across upgrades. A new file under `platform/config/` would
+not be: the installer wipes that directory and restores only this one.
+
+Because the store already exists, **provisioning is a single house session**. There is no client-side
+step. What is still per client: the Pages project and its custom domain, the account's own
+`PORTAL_FETCH_SECRET`, enrolment of the people, and the assembled tree.
+
+Isolation is no longer one store per client. It is an `accountId` column on every row and an
+`<accountId>/` prefix on every object key, with the portal's own account baked into its worker as
+`PORTAL_ACCOUNT_ID` at assemble time. The worker binds that value into every query and every key
+check, so it is the one thing separating this client's rows and objects from another's.
+
+`data-portal.json` must carry `"storageModel": "shared"`. An absent value means a pre-2099 portal on
+its own dedicated database.
+
+The house-side loops do not take that field at its word. They compare the account's `portalDbName`
+and `bucketName` against the shared names in `cloudflare-house.env` and use what the config actually
+NAMES, logging `op=storage-model result=overridden` when the two disagree. The label is hand-written
+in a hand-maintained file, and trusting it is fail-open in the one direction that leaks: a config
+naming the shared database whose label was dropped or mis-cased would otherwise be read store-wide,
+and the uploads pull would carry another client's files into this account's tree. Write the field
+correctly anyway; it is what the assemble step reads, and it is the fallback before cutover. Those keep their own store **and their own deployed worker**: this
+template binds `accountId` in every query and their database has no such column, so a dedicated
+account is refused at assemble rather than redeployed. Migrating one is deliberate work.
+
+The old two-session split is gone, and so is the reason given for it. It existed so the client
+account would own the bucket, on the grounds that its ingestion sweep would otherwise be denied
+`cross-account` against its own files. That was not so: the sweep (`portal-uploads-pull`) runs
+house-level through the house credential and is not owner-gated. The split's real effect was that
+two sessions filled the same store name independently and disagreed, which is the bug this design
+removes.
 
 ## Enrol the people first
 
 Collect from the operator the portal's custom domain and the list of people, then write
-`<accountDir>/data-portal.json` carrying `portalDomain`, `portalDbName`, `bucketName`, and a
-`people` array of `{ name, ownerId, prefix }`.
+`<accountDir>/data-portal.json` carrying `portalDomain`, `accountId`, `projectName`,
+`"storageModel": "shared"`, `portalDbName`, `bucketName`, and a `people` array of
+`{ name, ownerId, prefix }`.
+
+`portalDbName` and `bucketName` are the SHARED store's names, identical in every account's file and
+copied from `cloudflare-house.env`. They stay in this file because the house-side loops (the uploads
+pull, the index push, the audit) enumerate accounts by it and read the store names from it, which is
+what lets shared and pre-2099 dedicated portals run side by side with no other branching.
 
 For each person:
 
 ```bash
 node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
-  --account <accountId> [--folders <a,b,c>] | npx wrangler d1 execute <portalDbName> --remote --file=-
+  --account <accountId> [--storage-model shared|dedicated] [--folders <a,b,c>] \
+  | npx wrangler d1 execute <portalDbName> --remote --file=-
 ```
 
+`--storage-model` picks the upsert's conflict target and defaults to `shared`. It must match the
+account's `data-portal.json`, because the two `people` tables have different keys: the shared one is
+keyed `(accountId, ownerId)` so two clients can each enrol a person of the same name, and a
+pre-2099 one is keyed on `ownerId` alone. Naming the wrong pair does not degrade, it fails the whole
+statement, so a grandfathered portal must pass `--storage-model dedicated` or its passcode rotation
+stops working. That failure is loud and happens at the database before any row moves.
+
 The script mints the passcode and prints it **once to stderr**, so it reaches the operator's terminal
 and never the pipe; stdout carries the `INSERT` alone. Do not hand-roll this: the passcode's length
 and alphabet are pinned in `template/functions/api/_lib/passcode.mjs`, the script is what applies
@@ -93,9 +140,22 @@ files. The gate enforces it too, but do not enrol a name it will reject.
 
 ## Assemble the canonical tree
 
-Copy `template/` to `<accountDir>/sites/<project>/` and fill `wrangler.toml`'s `__PROJECT_NAME__`,
-`__D1_DATABASE_NAME__`, `__D1_DATABASE_ID__`, and `__R2_BUCKET_NAME__`. **Leave no `__...__`
-placeholder in the assembled tree.**
+Copy `template/` to `<accountDir>/sites/<project>/`, then fill `wrangler.toml` with the script. Do
+**not** fill it by hand:
+
+```bash
+node platform/plugins/cloudflare/bin/portal-assemble.mjs \
+  --account-dir <accountDir> --platform-root platform \
+  --install-origin https://<public-tunnel-hostname> \
+  --template platform/plugins/cloudflare/skills/data-portal/template/wrangler.toml
+```
+
+It reads the shared store's identity from `cloudflare-house.env` and the account's own id from
+`data-portal.json`, substitutes every placeholder including `__PORTAL_ACCOUNT_ID__`, and fails closed
+with the offending name when a shared key is missing, when the account is on the dedicated model, or
+when any placeholder survives. Hand-filling these values is exactly what shipped a portal whose
+bucket name and config disagreed, so the one right answer comes from one file and is substituted
+mechanically.
 
 `sites/<project>/` is the only location the broker will publish: `resolveSiteDir` resolves
 `<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat: `index.html`, `portal.css`, `portal.js`,
@@ -107,10 +167,11 @@ config does not declare publishes the site one level too deep, which serves 404
 The deploy serves everything in that tree except a fixed ignore list — `functions/`, `_worker.js`,
 `_redirects`, `_headers`, `_routes.json`, `node_modules`, `.git`, `.DS_Store`, `.wrangler` — and
 `pages deploy` reads no `.assetsignore`, so anything else you leave there is public. Nothing else
-belongs in it. `schema.sql` therefore lives beside `template/` in the skill, not inside it. Name the D1 database
-with the same `bin/cf-store-name.sh` scheme as the bucket, and apply
-`platform/plugins/cloudflare/skills/data-portal/schema.sql` to the remote database from there. It is
-`IF NOT EXISTS` throughout, so re-applying is safe.
+belongs in it. `schema.sql` therefore lives beside `template/` in the skill, not inside it. It is
+applied ONCE, to the one shared database named by `DATA_PORTAL_DB_NAME`, when that store is first
+created. A new client portal needs no schema step at all: the tables are already there, and its rows
+are separated from every other client's by `accountId`. The file is `IF NOT EXISTS` throughout, so
+re-applying is safe.
 
 Safe, but not a migration: `IF NOT EXISTS` adds no column to a table that already exists. A portal
 whose `directory` table predates the `isDir` column keeps failing every index push, because the push
@@ -356,4 +417,6 @@ event at request time.
 ## Tool discipline
 
 Never write a token into the tree, never commit one, never echo one. The bucket name and database
-name come from `bin/cf-store-name.sh`, never hand-built.
+name come from `platform/config/cloudflare-house.env` by way of `bin/portal-assemble.mjs`, never
+hand-built and never retyped. (`bin/cf-store-name.sh` still names per-account stores for booking and
+other skills; the portal no longer has one.)