@rubytech/create-maxy-code 0.1.329 → 0.1.331

package/dist/index.js

@@ -2848,14 +2848,31 @@ function registerSpecialistAgents() {
 // time for the post-install banner.
 // ---------------------------------------------------------------------------
 function resolveInstallAccountId() {
+    // Managed-service model: prefer the single `role:"house"` account; fall back
+    // to the sole account in the pre-migration window. Returns "" on no accounts
+    // or genuine drift (zero-house with >1, or multiple houses).
     const accountsDir = join(INSTALL_DIR, "data/accounts");
     if (!existsSync(accountsDir))
         return "";
     try {
+        const candidates = [];
+        const houses = [];
         for (const d of readdirSync(accountsDir)) {
-            if (existsSync(join(accountsDir, d, "account.json")))
-                return d;
+            const configPath = join(accountsDir, d, "account.json");
+            if (!existsSync(configPath))
+                continue;
+            candidates.push(d);
+            try {
+                const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+                if (cfg.role === "house")
+                    houses.push(d);
+            }
+            catch { /* unparseable — not a house candidate */ }
         }
+        if (houses.length === 1)
+            return houses[0];
+        if (houses.length === 0 && candidates.length === 1)
+            return candidates[0];
     }
     catch { /* directory unreadable */ }
     return "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.329",
+  "version": "0.1.331",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -17,6 +17,7 @@
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],
+  "primaryContainer": { "label": "Project", "term": "Projects" },
 
   "defaultColors": {
     "primary": "#7C8C72",

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -6,6 +6,39 @@
  * be hiding).
  */
 export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+export declare function resolveHouseAccountId(accountsDir: string): string;
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+export declare function resolveHouseOrSoleAccountId(accountsDir: string): string;
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.resolveHouseAccountId = resolveHouseAccountId;
+exports.resolveHouseOrSoleAccountId = resolveHouseOrSoleAccountId;
 exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
 exports._resetEnumerationCache = _resetEnumerationCache;
 exports.validateAccountIdEnv = validateAccountIdEnv;
@@ -71,6 +73,80 @@ function enumerateValidAccountIds(accountsDir) {
     cache.set(accountsDir, valid);
     return valid;
 }
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+function resolveHouseAccountId(accountsDir) {
+    const valid = enumerateValidAccountIds(accountsDir);
+    const houses = [];
+    for (const id of valid) {
+        const configPath = (0, node_path_1.resolve)(accountsDir, id, "account.json");
+        try {
+            const cfg = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            if (cfg.role === "house")
+                houses.push(id);
+        }
+        catch {
+            // already excluded from `valid` if unparseable; a race here just skips it
+        }
+    }
+    if (houses.length !== 1) {
+        throw new Error(`[account-registry] resolveHouseAccountId: houses=${houses.length} under ${accountsDir} ` +
+            `(${houses.join(", ") || "none"}) — exactly one role:"house" account is required. ` +
+            `Loud-fail rather than picking one silently.`);
+    }
+    return houses[0];
+}
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+function resolveHouseOrSoleAccountId(accountsDir) {
+    const valid = enumerateValidAccountIds(accountsDir);
+    const houses = [];
+    for (const id of valid) {
+        const configPath = (0, node_path_1.resolve)(accountsDir, id, "account.json");
+        try {
+            const cfg = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            if (cfg.role === "house")
+                houses.push(id);
+        }
+        catch {
+            // already excluded from `valid` if unparseable
+        }
+    }
+    if (houses.length === 1)
+        return houses[0];
+    if (houses.length === 0 && valid.length === 1)
+        return valid[0];
+    throw new Error(`[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} ` +
+        `under ${accountsDir} — expected exactly one role:"house" (or a single unlabelled account). ` +
+        `Loud-fail rather than picking one silently.`);
+}
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AA3ID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AAzND;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/payload/platform/lib/account-enumeration/src/index.ts

@@ -68,6 +68,84 @@ export function enumerateValidAccountIds(accountsDir: string): string[] {
   return valid;
 }
 
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+export function resolveHouseAccountId(accountsDir: string): string {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses: string[] = [];
+  for (const id of valid) {
+    const configPath = resolve(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync(configPath, "utf-8")) as {
+        role?: unknown;
+      };
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+      // already excluded from `valid` if unparseable; a race here just skips it
+    }
+  }
+  if (houses.length !== 1) {
+    throw new Error(
+      `[account-registry] resolveHouseAccountId: houses=${houses.length} under ${accountsDir} ` +
+        `(${houses.join(", ") || "none"}) — exactly one role:"house" account is required. ` +
+        `Loud-fail rather than picking one silently.`,
+    );
+  }
+  return houses[0];
+}
+
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+export function resolveHouseOrSoleAccountId(accountsDir: string): string {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses: string[] = [];
+  for (const id of valid) {
+    const configPath = resolve(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync(configPath, "utf-8")) as {
+        role?: unknown;
+      };
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+      // already excluded from `valid` if unparseable
+    }
+  }
+  if (houses.length === 1) return houses[0];
+  if (houses.length === 0 && valid.length === 1) return valid[0];
+  throw new Error(
+    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} ` +
+      `under ${accountsDir} — expected exactly one role:"house" (or a single unlabelled account). ` +
+      `Loud-fail rather than picking one silently.`,
+  );
+}
+
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -24,6 +24,18 @@ tools:
   - name: account-update
     publicAllowlist: false
     adminAllowlist: false
+  - name: account_list
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: account_create
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: account_delete
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: account_purge
+    publicAllowlist: false
+    adminAllowlist: true
   - name: admin-add
     publicAllowlist: false
     adminAllowlist: true

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.js

@@ -27,12 +27,11 @@ describe("isAdminSeat", () => {
     });
 });
 describe("CONTENT_PRODUCER_AUTHORING_SKILLS", () => {
-    it("is the render/publish authoring skills, the consulting prose deliverables, and the relocated property brochure", () => {
+    it("is the render/publish authoring skills, the consulting prose deliverables, and the relocated property brochure (pitch-deck is admin-orchestrated, not owned)", () => {
         expect([...CONTENT_PRODUCER_AUTHORING_SKILLS].sort()).toEqual([
             "a4-print-documents",
             "decision-memo",
             "narrative-builder",
-            "pitch-deck",
             "professional-document",
             "property-brochure",
             "publish-site",

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-authoring-skill-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-authoring-skill-gate.test.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAChE,oEAAoE;AACpE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,iCAAiC,EACjC,WAAW,EACX,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,KAAK,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAClE,MAAM,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC7F,MAAM,MAAM,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAEpE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;IACzF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,gHAAgH,EAAE,GAAG,EAAE;QACxH,MAAM,CAAC,CAAC,GAAG,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC3D;YACE,oBAAoB;YACpB,eAAe;YACf,mBAAmB;YACnB,YAAY;YACZ,uBAAuB;YACvB,mBAAmB;YACnB,cAAc;SACf,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAClF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC,CAAC,IAAI,CACzF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,qBAAqB,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,KAAK,MAAM,IAAI,IAAI,iCAAiC,EAAE,CAAC;YACrD,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2EAA2E;QAC3E,8EAA8E;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"admin-authoring-skill-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-authoring-skill-gate.test.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAChE,oEAAoE;AACpE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,iCAAiC,EACjC,WAAW,EACX,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,KAAK,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAClE,MAAM,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC7F,MAAM,MAAM,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAEpE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;IACzF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,8JAA8J,EAAE,GAAG,EAAE;QACtK,MAAM,CAAC,CAAC,GAAG,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC3D;YACE,oBAAoB;YACpB,eAAe;YACf,mBAAmB;YACnB,uBAAuB;YACvB,mBAAmB;YACnB,cAAc;SACf,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAClF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC,CAAC,IAAI,CACzF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,qBAAqB,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,KAAK,MAAM,IAAI,IAAI,iCAAiC,EAAE,CAAC;YACrD,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2EAA2E;QAC3E,8EAA8E;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/content-producer-authoring-skills.d.ts

@@ -1,2 +1,2 @@
-export declare const CONTENT_PRODUCER_AUTHORING_SKILL_SLUGS: readonly ["professional-document", "a4-print-documents", "publish-site", "decision-memo", "narrative-builder", "pitch-deck", "property-brochure"];
+export declare const CONTENT_PRODUCER_AUTHORING_SKILL_SLUGS: readonly ["professional-document", "a4-print-documents", "publish-site", "decision-memo", "narrative-builder", "property-brochure"];
 //# sourceMappingURL=content-producer-authoring-skills.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/content-producer-authoring-skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-producer-authoring-skills.d.ts","sourceRoot":"","sources":["../src/content-producer-authoring-skills.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,sCAAsC,mJAQzC,CAAC"}
+{"version":3,"file":"content-producer-authoring-skills.d.ts","sourceRoot":"","sources":["../src/content-producer-authoring-skills.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,sCAAsC,qIAOzC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/content-producer-authoring-skills.js

@@ -12,25 +12,30 @@
 // generator's declaration scan already excludes them; this list is the gate's
 // compiled-in guard against a declaration regression.
 //
-// The first three are the original render/publish/print authoring skills. The
-// next three are the management-consulting prose deliverables. The last is the
-// property brochure: like the consulting deliverables, its output is finished
-// external-facing prose, so it composes on content-producer (the authoring seat,
-// which carries plainly + prose-craft + voice-retrieve-conditioning). The 19
-// management-consulting analysis-framework skills stay admin-run and are not
-// listed here. The founder fundraise pack (investor-data-room) is the other
-// remaining admin-run voice consumer but cannot move here: it must dispatch the
-// research-assistant specialist for its mandatory citation routing, which
-// content-producer (a leaf authoring seat with no Task/Agent tool) cannot do.
-// Until that is re-architected, voice-retrieve-conditioning stays on the admin
-// surface for investor-data-room.
+// The first three are the original render/publish/print authoring skills.
+// decision-memo and narrative-builder are management-consulting prose
+// deliverables; property-brochure is the estate-agent brochure. Each is
+// finished external-facing prose composed end-to-end on content-producer (the
+// authoring seat, which carries plainly + prose-craft + voice-retrieve-
+// conditioning), so the admin must dispatch them rather than author them.
+//
+// pitch-deck is deliberately NOT here (Task 979). The admin orchestrates it: it
+// asks the operator the deck kind, light or dark, and the colour set — choices
+// only the admin can put to the operator — and delegates just the compose and
+// render steps to content-producer. So the admin must be able to load it; gating
+// it would lock those operator choices inside a subagent that cannot ask.
+//
+// The 19 management-consulting analysis-framework skills stay admin-run and are
+// not listed here. The founder fundraise pack (investor-data-room) stays
+// admin-run, keeping voice-retrieve-conditioning on the admin surface, until its
+// mandatory research-assistant citation routing can move off a leaf authoring
+// seat that has no Task/Agent tool.
 export const CONTENT_PRODUCER_AUTHORING_SKILL_SLUGS = [
     "professional-document",
     "a4-print-documents",
     "publish-site",
     "decision-memo",
     "narrative-builder",
-    "pitch-deck",
     "property-brochure",
 ];
 //# sourceMappingURL=content-producer-authoring-skills.js.map

package/payload/platform/plugins/admin/mcp/dist/content-producer-authoring-skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-producer-authoring-skills.js","sourceRoot":"","sources":["../src/content-producer-authoring-skills.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,sDAAsD;AACtD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,mBAAmB;CACX,CAAC"}
+{"version":3,"file":"content-producer-authoring-skills.js","sourceRoot":"","sources":["../src/content-producer-authoring-skills.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,sDAAsD;AACtD,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,8EAA8E;AAC9E,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,8EAA8E;AAC9E,oCAAoC;AACpC,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,mBAAmB;CACX,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -26,6 +26,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -3180,6 +3181,107 @@ eagerTool(server, "action-edit", "Edit a pending action's input and then execute
         };
     }
 });
+// ---------------------------------------------------------------------------
+// Multi-account lifecycle (Task 983) — admin-core only, never public/specialist.
+// One Rubytech operator hosts N client accounts on one brand install: one
+// role:"house" account receives customer-channel inbound; clients are
+// operator-provisioned tenants. Account scope is a property (n.accountId), never
+// an edge. The accounts root is install-wide, so these tools resolve it from
+// PLATFORM_ROOT rather than the per-session ACCOUNT_ID.
+// ---------------------------------------------------------------------------
+const ACCOUNTS_ROOT = resolve(PLATFORM_ROOT, "..", "data/accounts");
+eagerTool(server, "account_list", "List every account on this install (one house + N clients) with its role. Managed-service operator tool — the active account drives which account a switched session reads and writes.", {}, async () => {
+    const accounts = listAccountsFromDir(ACCOUNTS_ROOT);
+    const lines = accounts.map((a) => `${a.accountId} role=${a.role}${a.isHouse ? " (house)" : ""}`);
+    return {
+        content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
+    };
+});
+eagerTool(server, "account_create", "Provision a new CLIENT account on this install (managed service). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\"), seeds default plugins, and adds you (the install owner) to the account's admins so you can switch to it. Returns the new accountId. Operator-only; never creates the house account (that is the install itself).", {}, async () => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_create");
+    const newId = randomUUID();
+    try {
+        const accountDir = provisionClientAccount({
+            platformRoot: PLATFORM_ROOT,
+            accountsDir: ACCOUNTS_ROOT,
+            accountId: newId,
+            usersFile: USERS_FILE,
+        });
+        const accountJson = join(accountDir, "account.json");
+        const dirExists = existsSync(accountJson);
+        let role = "client";
+        try {
+            role = String(JSON.parse(readFileSync(accountJson, "utf-8")).role ?? "client");
+        }
+        catch { /* keep default */ }
+        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} role=${role}\n`);
+        if (!dirExists) {
+            return { content: [{ type: "text", text: `account_create FAILED: scaffold did not produce ${accountJson}` }], isError: true };
+        }
+        return { content: [{ type: "text", text: `Created client account ${newId}. Switch to it from the account picker to work in its data.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=false role=client error=${msg}\n`);
+        return { content: [{ type: "text", text: `account_create FAILED: ${msg}` }], isError: true };
+    }
+});
+eagerTool(server, "account_delete", "Archive a CLIENT account: move its directory to data/accounts/.trash/ so it no longer appears in the account list. Graph data is RETAINED — run account_purge with the typed confirmation to irreversibly delete it. Refuses to archive the house account. Pass the accountId to archive.", {
+    accountId: z.string().describe("The client accountId (UUID) to archive."),
+}, async ({ accountId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_delete");
+    if (!existsSync(join(ACCOUNTS_ROOT, accountId, "account.json"))) {
+        return { content: [{ type: "text", text: `account_delete: ${accountId} is not a registered account on this install.` }], isError: true };
+    }
+    if (isHouseAccount(ACCOUNTS_ROOT, accountId)) {
+        return { content: [{ type: "text", text: `account_delete refused: ${accountId} is the house account and cannot be archived.` }], isError: true };
+    }
+    const ts = new Date().toISOString().replace(/[:.]/g, "").replace(/-/g, "");
+    try {
+        const { trashPath, dirAbsent } = archiveAccountDir(ACCOUNTS_ROOT, accountId, ts);
+        process.stderr.write(`[account-lifecycle] op=archive accountId=${accountId} trash-path=${trashPath} dir-absent=${dirAbsent}\n`);
+        return { content: [{ type: "text", text: `Archived ${accountId} to ${trashPath}. Graph data retained — run account_purge to delete it permanently.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { content: [{ type: "text", text: `account_delete FAILED: ${msg}` }], isError: true };
+    }
+});
+eagerTool(server, "account_purge", "IRREVERSIBLY delete every graph node carrying an account's accountId (DETACH DELETE). Two-step safety: account_delete archives first; this purges. Requires a typed confirmation equal to the accountId itself — any mismatch refuses. Refuses the house account. Returns the node count before and after (after must be zero).", {
+    accountId: z.string().describe("The accountId (UUID) whose graph data to purge."),
+    confirm: z.string().describe("Type the accountId exactly to confirm the irreversible purge."),
+}, async ({ accountId, confirm }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_purge");
+    if (isHouseAccount(ACCOUNTS_ROOT, accountId)) {
+        return { content: [{ type: "text", text: `account_purge refused: ${accountId} is the house account.` }], isError: true };
+    }
+    if (confirm !== accountId) {
+        return { content: [{ type: "text", text: `account_purge refused: confirmation does not match the accountId. Type the accountId exactly to confirm.` }], isError: true };
+    }
+    const session = getSession();
+    try {
+        const before = await session.run(ACCOUNT_NODE_COUNT_CYPHER, { id: accountId });
+        const beforeCount = Number(before.records[0]?.get("c") ?? 0);
+        await session.run(ACCOUNT_PURGE_CYPHER, { id: accountId });
+        const after = await session.run(ACCOUNT_NODE_COUNT_CYPHER, { id: accountId });
+        const afterCount = Number(after.records[0]?.get("c") ?? 0);
+        process.stderr.write(`[account-lifecycle] op=purge accountId=${accountId} nodes-before=${beforeCount} nodes-after=${afterCount}\n`);
+        if (afterCount !== 0) {
+            return { content: [{ type: "text", text: `account_purge INCOMPLETE: ${afterCount} node(s) still carry accountId ${accountId} (was ${beforeCount}).` }], isError: true };
+        }
+        return { content: [{ type: "text", text: `Purged ${beforeCount} node(s) for account ${accountId}. This is irreversible.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { content: [{ type: "text", text: `account_purge FAILED: ${msg}` }], isError: true };
+    }
+    finally {
+        await session.close();
+    }
+});
 // Cleanup on exit (SIGTERM for systemd service stops on Pi)
 const cleanup = async () => {
     await closeDriver();