@rubytech/create-maxy-code 0.1.436 → 0.1.438

package/payload/platform/lib/admins-write/dist/index.js

@@ -48,7 +48,11 @@ function appendUsersAuditLine(audit, fields) {
     // userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
     // unknown) carry no dash and are written whole so attribution stays readable.
     const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
-    const line = `[users-audit] action=${fields.action} actor=${actor}${sess} ` +
+    const targetFields = audit.target !== undefined
+        ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target}` +
+            ` explicitUserId=${audit.explicitUserId ? "true" : "false"}`
+        : "";
+    const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} ` +
         `field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
         `ts=${new Date().toISOString()}\n`;
     try {

package/payload/platform/lib/admins-write/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,iEAAiE;AACjE,wEAAwE;AACxE,EAAE;AACF,oDAAoD;AACpD,+DAA+D;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;;AAkCnE,8CAEC;AAgCD,sCAKC;AAoDD,0CAiEC;AAoBD,wDAuCC;AAsCD,kEAoEC;AAUD,0DAiBC;AA5XD,qCAAgI;AAChI,yCAA0C;AAuB1C,yEAAyE;AACzE,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;uDAEuD;AACvD,SAAgB,iBAAiB,CAAC,OAAiB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACzE,MAAM,IAAI,GACR,wBAAwB,MAAM,CAAC,MAAM,UAAU,KAAK,GAAG,IAAI,GAAG;QAC9D,SAAS,MAAM,CAAC,KAAK,eAAe,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,GAAG;QACtF,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAA,wBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,yCAAyC,KAAK,CAAC,OAAO,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;mEAEmE;AACnE,SAAgB,aAAa,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAwBD,SAAS,OAAO,CAAC,KAAsB,EAAE,MAAwB;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,mBAAmB,MAAM,CAAC,eAAe,sBAAsB,MAAM,CAAC,iBAAiB,EAAE;QACzF,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAa;IACxE,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChE,IAAA,uBAAa,EAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAA,oBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAsB;IACpD,MAAM,MAAM,GAAqB,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAExF,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,KAAK,GAAgB,EAAE,CAAC;QAC5B,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,KAAK,GAAG,MAAqB,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,mEAAmE;QACnE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;YAChC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC3C,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;YACtC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,MAAM,GAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAChC,2EAA2E;YAC3E,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAChC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,0CAA0C,MAAM,CAAC,iBAAiB,EAAE;QACpE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AA8BD;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAAiD;IAC3F,MAAM,MAAM,GAAqB,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAElH,uEAAuE;IACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;wBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5G,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACzD,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,GAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;gBAC7F,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/E,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,KAA0B;IAChE,MAAM,CAAC,GAAG,2BAA2B,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,iEAAiE;AACjE,wEAAwE;AACxE,EAAE;AACF,oDAAoD;AACpD,+DAA+D;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;;AA0CnE,8CAEC;AAqCD,sCAKC;AAoDD,0CAiEC;AAoBD,wDAuCC;AAsCD,kEAoEC;AAUD,0DAiBC;AAzYD,qCAAgI;AAChI,yCAA0C;AA+B1C,yEAAyE;AACzE,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;uDAEuD;AACvD,SAAgB,iBAAiB,CAAC,OAAiB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACzE,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM,KAAK,SAAS;QACxB,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1E,mBAAmB,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAC9D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GACR,wBAAwB,MAAM,CAAC,MAAM,UAAU,KAAK,GAAG,YAAY,GAAG,IAAI,GAAG;QAC7E,SAAS,MAAM,CAAC,KAAK,eAAe,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,GAAG;QACtF,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAA,wBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,yCAAyC,KAAK,CAAC,OAAO,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;mEAEmE;AACnE,SAAgB,aAAa,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAwBD,SAAS,OAAO,CAAC,KAAsB,EAAE,MAAwB;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,mBAAmB,MAAM,CAAC,eAAe,sBAAsB,MAAM,CAAC,iBAAiB,EAAE;QACzF,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAa;IACxE,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChE,IAAA,uBAAa,EAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAA,oBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAsB;IACpD,MAAM,MAAM,GAAqB,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAExF,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,KAAK,GAAgB,EAAE,CAAC;QAC5B,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,KAAK,GAAG,MAAqB,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,mEAAmE;QACnE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;YAChC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC3C,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;YACtC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,MAAM,GAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAChC,2EAA2E;YAC3E,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAChC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,0CAA0C,MAAM,CAAC,iBAAiB,EAAE;QACpE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AA8BD;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAAiD;IAC3F,MAAM,MAAM,GAAqB,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAElH,uEAAuE;IACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;wBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5G,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACzD,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,GAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;gBAC7F,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/E,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,KAA0B;IAChE,MAAM,CAAC,GAAG,2BAA2B,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;KAC3C,CAAC;AACJ,CAAC"}

package/payload/platform/lib/admins-write/src/index.ts

@@ -41,6 +41,14 @@ export interface AuditContext {
   actor: string;
   session?: string;
   logFile: string;
+  /** Task 1573 — the row being written, recorded on every credential write so
+   *  `actor != target` is the standing cross-identity signature. Omitted =>
+   *  the line carries no target field (a self write not routed through the
+   *  identity-resolving tools). */
+  target?: string;
+  /** Task 1573 — true when the caller passed an explicit `userId` (a deliberate
+   *  cross-identity or self write); false/absent for an implicit self write. */
+  explicitUserId?: boolean;
 }
 
 /** First 8 chars — the short-id convention used across the auth logs. */
@@ -68,8 +76,13 @@ function appendUsersAuditLine(
   // userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
   // unknown) carry no dash and are written whole so attribution stays readable.
   const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
+  const targetFields =
+    audit.target !== undefined
+      ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target}` +
+        ` explicitUserId=${audit.explicitUserId ? "true" : "false"}`
+      : "";
   const line =
-    `[users-audit] action=${fields.action} actor=${actor}${sess} ` +
+    `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} ` +
     `field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
     `ts=${new Date().toISOString()}\n`;
   try {

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId, and also requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId, and also requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -133,7 +133,9 @@ Tools are available via the `admin` MCP server.
 
 **Admin-seat authoring-skill gate.** `skill-load` and `plugin-read` refuse to return the body of a content-producer-owned authoring skill — `professional-document`, `a4-print-documents`, `publish-site` — when the caller is the admin seat (`MAXY_SESSION_ROLE=admin` with no `MAXY_SPECIALIST`). The refusal relays one line — "This deliverable is owned by content-producer. Dispatch it with the Agent tool and subagent_type content-producer." — so the admin's next action is the dispatch, not inline authoring. `plugin-read` extracts the skill slug from a `skills/<slug>/…` file path (or a slug buried in `pluginName`), so the raw-SKILL.md read path can't bypass the gate; `PLUGIN.md` and plain `references/*` reads are untouched. content-producer's own spawns carry `MAXY_SPECIALIST=content-producer` and resolve these skills normally (it reaches them via the native `Skill` tool regardless), and the public seat is out of scope. The gate is a pure name+env check before any filesystem read and fails open for any non-admin or unidentified seat — it never bricks a legitimate load. Each block emits `[admin-skill-gate] role=admin skill=<name> decision=block reason=content-producer-owned`. This is the enforcement layer; the IDENTITY.md delegation paragraph documents the intent but is not the gate ([[feedback_deterministic_means_remove_llm]], [[feedback_doctrine_paragraph_is_not_a_gate]]). Skills the admin invokes directly are deliberately excluded: `unzip-attachment` (its SKILL.md says "Invoked by the admin agent directly — admin owns all unzipping", then routes the extracted tree to a specialist) and `deck-pages` (admin-owned, a content-producer refusal target). The set is each skill's own SKILL.md "Invoked by" declaration, not the admin plugin's skill catalogue (which lists these admin-hosted skills for discovery — the catalogue is the inline path this gate closes).
 
-**Three-store admin auth invariant.** `admin-add` writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is forbidden by IDENTITY.md doctrine — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.
+**Client sub-accounts carry one owner identity, no operator seats.** Since admin access is install-wide (`canAccessAdmin` never reads `admins[]`), so `admin-add` on a `role:'client'` sub-account refuses before any store write and logs `[admin-add] op=refused-on-client reason=install-wide-access-no-seat account=<id8>`; only the house account seats admins. A standing session-manager audit (`redundant-operator-seat-audit.ts`) flags any pre-fix non-owner `AdminUser` on a client account with `[identity-audit] op=redundant-operator-seat`; removal of a flagged seat is a deliberate remediation, never automatic. See `.docs/admin-identity-surface.md`.
+
+**Three-store admin auth invariant.** `admin-add` (on the house account) writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is forbidden by IDENTITY.md doctrine — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.
 
 **Credential audit trail (append-only).** Every write to the credential stores emits one canonical `[users-audit] action=<set-access|clear-access|add|remove|set-pin|migrate> actor=<id8|onboarding|install|boot|unknown> [session=<id8>] field=<accessHash|pin|row> rowsBefore=<id8,…> rowsAfter=<id8,…> ts=<iso>` line to `~/{configDir}/logs/users-audit.log` — a dedicated file, distinct from `server.log`, so a credential mutation is greppable in isolation. The line is emitted at the writer chokepoint (`admin-access-password` for accessHash set/clear/migrate, `admins-write` `writeAdminEntry`/`removeAdminFromAccount` for row/pin/role) so every caller is covered; the one direct users.json writer that does not route through `writeAdminEntry` — `admin-update-pin` — emits the same line via the exported `logUsersAudit`. A write that changes no field (a clear with no hash, a migrate noop, an absent-admin remove) emits nothing. Credential-mutating MCP tools add `session=<id8>` from `SESSION_NODE_ID` so a mutation traces to its agent session even when the transcript is gone.
 

package/payload/platform/plugins/admin/mcp/dist/credential-identity.d.ts

@@ -0,0 +1,23 @@
+export type CredentialTargetResult = {
+    ok: true;
+    target: string;
+    isCrossIdentity: boolean;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Resolve which admin row a credential tool may write.
+ *
+ * - No explicit `userId`: writes the verified caller's own row. If there is no
+ *   verified caller identity, the call ERRORS (never a silent ambient fallback).
+ * - Explicit `userId` equal to the caller: a self write, no confirm needed.
+ * - Explicit `userId` differing from the caller (or with no caller to compare):
+ *   a cross-identity write, allowed only with `confirm === true`.
+ */
+export declare function resolveCredentialTarget(input: {
+    explicitUserId?: string;
+    callerUserId?: string;
+    confirm?: boolean;
+}): CredentialTargetResult;
+//# sourceMappingURL=credential-identity.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/credential-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-identity.d.ts","sourceRoot":"","sources":["../src/credential-identity.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,GAAG,sBAAsB,CAkBzB"}

package/payload/platform/plugins/admin/mcp/dist/credential-identity.js

@@ -0,0 +1,35 @@
+// Task 1573 — the verified-target resolver for the admin credential tools
+// (remote-auth-set-password, admin-update-pin, remote-auth-revoke-password).
+// It replaces the old `userId ?? process.env.USER_ID` fallback that let a
+// no-userId call silently rewrite whatever ambient USER_ID the MCP inherited
+// (the install owner, when the rc-spawn env leaked it). Pure and unit-tested;
+// the tools read process.env.USER_ID (empty -> undefined) and pass it as
+// callerUserId.
+/**
+ * Resolve which admin row a credential tool may write.
+ *
+ * - No explicit `userId`: writes the verified caller's own row. If there is no
+ *   verified caller identity, the call ERRORS (never a silent ambient fallback).
+ * - Explicit `userId` equal to the caller: a self write, no confirm needed.
+ * - Explicit `userId` differing from the caller (or with no caller to compare):
+ *   a cross-identity write, allowed only with `confirm === true`.
+ */
+export function resolveCredentialTarget(input) {
+    const { explicitUserId, callerUserId, confirm } = input;
+    const target = explicitUserId ?? callerUserId;
+    if (!target) {
+        return {
+            ok: false,
+            error: 'no verified admin identity: this session has no authenticated admin; pass an explicit userId to act on a specific admin.',
+        };
+    }
+    const isCrossIdentity = explicitUserId !== undefined && explicitUserId !== callerUserId;
+    if (isCrossIdentity && confirm !== true) {
+        return {
+            ok: false,
+            error: `cross-identity write requires confirm=true: this would change userId ${target}, not your own credential.`,
+        };
+    }
+    return { ok: true, target, isCrossIdentity };
+}
+//# sourceMappingURL=credential-identity.js.map

package/payload/platform/plugins/admin/mcp/dist/credential-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-identity.js","sourceRoot":"","sources":["../src/credential-identity.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,gBAAgB;AAMhB;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACvD,MAAM,MAAM,GAAG,cAAc,IAAI,YAAY,CAAA;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,0HAA0H;SAC7H,CAAA;IACH,CAAC;IACD,MAAM,eAAe,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,YAAY,CAAA;IACvF,IAAI,eAAe,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wEAAwE,MAAM,4BAA4B;SAClH,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;AAC9C,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -10,6 +10,7 @@ import { execFile, execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeAdminEntry, removeAdminFromAccount, logUsersAudit, formatAuditRowIds } from "../../../../lib/admins-write/dist/index.js";
 import { setAccessPassword as setAccessPasswordHash, clearAccessPassword as clearAccessPasswordHash, accessPasswordCollides } from "../../../../lib/admin-access-password/dist/index.js";
+import { resolveCredentialTarget } from "./credential-identity.js";
 import { embed } from "../../../../lib/embed-client/dist/index.js";
 import { requirePortEnv } from "../../../../lib/require-port-env/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
@@ -27,7 +28,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -53,6 +54,15 @@ const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname,
 // isolation in metadata-only mode.
 const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
 process.stderr.write(`[admin] boot accountId=${ACCOUNT_ID ?? "null"}\n`);
+/** Task 1573 — the verified caller identity for credential tools: the session's
+ *  authenticated admin, carried as process.env.USER_ID, with empty treated as
+ *  "no verified identity". Post Task 1573 the rc-spawn env stamps this from the
+ *  authenticated admin (or empty), never the install owner via fallback, so a
+ *  credential tool can trust it as the operating identity. */
+function verifiedCaller() {
+    const u = process.env.USER_ID;
+    return u && u.length > 0 ? u : undefined;
+}
 function refuseNoAccount(toolName) {
     process.stderr.write(`[admin] tool=${toolName} refuse reason=no-account-context\n`);
     return {
@@ -866,8 +876,20 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-add");
     const TAG = "[admin]";
-    if (!name.trim()) {
-        return { content: [{ type: "text", text: `${TAG} Name is required.` }], isError: true };
+    // Task 1568 — a client sub-account carries one owner identity and no operator
+    // seats. Since Task 999 admin access is install-wide, so a seat here grants
+    // nothing (canAccessAdmin never reads admins[]). Refuse before any store
+    // write; the house account is where operators hold PIN logins and admins[].
+    const clientRefusal = refuseClientAdminAdd(isHouseAccount(ACCOUNTS_ROOT, ACCOUNT_ID), ACCOUNT_ID);
+    if (clientRefusal) {
+        process.stderr.write(`${clientRefusal.logLine}\n`);
+        return { content: [{ type: "text", text: `${TAG} ${clientRefusal.message}` }], isError: true };
+    }
+    // Task 1567 — the same name-required invariant as the owner-seat seeds: a
+    // blank name or the literal "Owner" placeholder is refused, never persisted.
+    if (isPlaceholderOwnerName(name)) {
+        process.stderr.write(`[admin-add] op=refused reason=no-name\n`);
+        return { content: [{ type: "text", text: `${TAG} A real name is required (it cannot be blank or the placeholder "Owner").` }], isError: true };
     }
     let users;
     try {
@@ -896,7 +918,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
         return { content: [{ type: "text", text: `${TAG} Unable to verify admin limit — cannot add admin.` }], isError: true };
     }
     // Resolve the calling user's identity from the session environment
-    const callerUserId = process.env.USER_ID;
+    const callerUserId = verifiedCaller(); // Task 1573 — empty USER_ID -> "unknown" actor, not ''
     // PIN: use provided or generate. Constraint: minimum 4 digits, no upper bound.
     let plaintextPin;
     if (rawPin) {
@@ -985,10 +1007,8 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
             // pruned silently, costing the admin pin during onboarding.
             const result = await session.run(`MERGE (au:AdminUser {userId: $userId})
            ON CREATE SET au.accountId = $accountId,
-                         au.name = $name,
                          au.createdAt = $createdAt
            ON MATCH SET au.accountId = COALESCE(au.accountId, $accountId),
-                        au.name = $name,
                         au.updatedAt = $createdAt
            WITH au
            MATCH (b:LocalBusiness {accountId: $accountId})
@@ -1019,21 +1039,22 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
              MERGE (au)-[:OWNS]->(newPerson)
              RETURN false AS reused
            }
-           RETURN reused`, { userId, name: trimmedName, createdAt, accountId: ACCOUNT_ID, givenName, familyName, personEmbedding });
+           RETURN reused`, { userId, createdAt, accountId: ACCOUNT_ID, givenName, familyName, personEmbedding });
             if (result.records.length > 0) {
                 personReused = result.records[0].get("reused");
             }
-            // post-write assertion mirroring the one in neo4j-store.ts.
-            // MATCH back the AdminUser we just wrote and verify every required
-            // field landed. Loud-fail the tool call if accountId or name is null
-            // so a Cypher regression that drops the field is grep-detectable.
+            // Task 1570 — post-write assertion on the canonical invariants: the
+            // AdminUser has its accountId, and an OWNS-Person in its own account with
+            // a non-empty givenName (the sole name source). A Cypher regression that
+            // drops the Person or its name is grep-detectable and loud-fails the tool.
             const verify = await session.run(`MATCH (au:AdminUser {userId: $userId})
+           OPTIONAL MATCH (au)-[:OWNS]->(p:Person) WHERE p.accountId = au.accountId
            RETURN coalesce(au.accountId, '') AS accountId,
-                  coalesce(au.name, '')      AS name`, { userId });
+                  coalesce(p.givenName, '')  AS givenName`, { userId });
             const verifiedAccountId = verify.records[0]?.get("accountId") || "";
-            const verifiedName = verify.records[0]?.get("name") || "";
-            if (!verifiedAccountId || !verifiedName) {
-                throw new Error(`post-write assertion failed: AdminUser userId=${userIdShort} accountId=${verifiedAccountId || "(null)"} name=${verifiedName || "(null)"} — required fields missing after MERGE`);
+            const verifiedGivenName = (verify.records[0]?.get("givenName") || "").trim();
+            if (!verifiedAccountId || !verifiedGivenName) {
+                throw new Error(`post-write assertion failed: AdminUser userId=${userIdShort} accountId=${verifiedAccountId || "(null)"} owned-Person givenName=${verifiedGivenName || "(null)"} — required fields missing after MERGE`);
             }
         }
         finally {
@@ -1067,7 +1088,7 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-remove");
     const TAG = "[admin]";
-    const callerUserId = process.env.USER_ID;
+    const callerUserId = verifiedCaller(); // Task 1573 — empty USER_ID -> "unknown" actor, not ''
     // Read account.json and validate
     let config;
     let admins;
@@ -1096,17 +1117,22 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
             return { content: [{ type: "text", text: `${TAG} Cannot remove ${userId}: they are the managing admin of ${managed.length} client sub-account(s): ${managed.join(", ")}. Reassign each to another house admin with account_reassign_admin, then retry.` }], isError: true };
         }
     }
-    // Resolve the admin's name from Neo4j (canonical) for the confirmation
-    // message. Best-effort — fall back to userId if the graph is unreachable.
+    // Resolve the admin's name from the owned Person (Task 1570 — the canonical
+    // and only name source, keyed on the AdminUser's own account) for the
+    // confirmation message. Best-effort — fall back to userId if the graph is
+    // unreachable or the owned Person is absent/nameless.
     let removedName = userId;
     try {
         const session = getSession();
         try {
-            const result = await session.run(`MATCH (au:AdminUser {userId: $userId}) RETURN au.name AS name LIMIT 1`, { userId });
+            const result = await session.run(`MATCH (au:AdminUser {userId: $userId})-[:OWNS]->(p:Person)
+           WHERE p.accountId = au.accountId
+           RETURN p.givenName AS givenName, p.familyName AS familyName LIMIT 1`, { userId });
             if (result.records.length > 0) {
-                const name = result.records[0].get("name");
-                if (name && name.trim())
-                    removedName = name.trim();
+                const givenName = result.records[0].get("givenName")?.trim() ?? "";
+                const familyName = result.records[0].get("familyName")?.trim() ?? "";
+                if (givenName)
+                    removedName = familyName ? `${givenName} ${familyName}` : givenName;
             }
         }
         finally {
@@ -1166,20 +1192,23 @@ eagerTool(server, "admin-list", "List all admins for this account with their nam
     if (admins.length === 0) {
         return { content: [{ type: "text", text: `${TAG} No admins configured for this account.` }] };
     }
-    // Enrich with names from Neo4j AdminUser (canonical). Best
-    // effort — render "(unknown)" for any userId without a graph entry.
+    // Enrich with names from each admin's owned Person (Task 1570 — the
+    // canonical and only name source, keyed on the AdminUser's own account).
+    // Best effort — render "(unknown)" for any userId with no named owned Person.
     const userMap = new Map();
     try {
         const session = getSession();
         try {
             const result = await session.run(`UNWIND $userIds AS uid
-           MATCH (au:AdminUser {userId: uid})
-           RETURN au.userId AS userId, au.name AS name`, { userIds: admins.map(a => a.userId) });
+           MATCH (au:AdminUser {userId: uid})-[:OWNS]->(p:Person)
+           WHERE p.accountId = au.accountId
+           RETURN uid AS userId, p.givenName AS givenName, p.familyName AS familyName`, { userIds: admins.map(a => a.userId) });
             for (const record of result.records) {
                 const uid = record.get("userId");
-                const name = record.get("name");
-                if (name && name.trim())
-                    userMap.set(uid, name.trim());
+                const givenName = record.get("givenName")?.trim() ?? "";
+                const familyName = record.get("familyName")?.trim() ?? "";
+                if (givenName)
+                    userMap.set(uid, familyName ? `${givenName} ${familyName}` : givenName);
             }
         }
         finally {
@@ -1198,17 +1227,21 @@ eagerTool(server, "admin-list", "List all admins for this account with their nam
 eagerTool(server, "admin-update-pin", "Update an existing admin user's PIN. Defaults to the calling admin if no userId is given. PIN must be at least 4 digits and unique across all users on the device. PINs are device-level: updating another admin's PIN does not require shared account membership — any admin on the device can rotate any other admin's PIN, matching the existing trust model used by admin-remove.", {
     userId: z.string().optional().describe("The userId of the admin whose PIN to update. Defaults to the caller (the admin invoking this tool)."),
     newPin: z.string().describe("The new PIN. Minimum 4 digits, no upper bound."),
-}, async ({ userId: targetUserId, newPin }) => {
+    confirm: z.boolean().optional().describe("Required (true) only when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity PIN change."),
+}, async ({ userId: targetUserId, newPin, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-update-pin");
     const TAG = "[admin-update-pin]";
-    const callerUserId = process.env.USER_ID;
-    const userId = targetUserId ?? callerUserId;
-    const userIdLabel = userId ? userId.slice(0, 8) : "unknown";
-    if (!userId) {
-        console.error(`${TAG} userId=${userIdLabel} result=user-not-found reason=no-caller-context`);
-        return { content: [{ type: "text", text: `${TAG} No userId supplied and no caller context — cannot update.` }], isError: true };
-    }
+    const callerUserId = verifiedCaller();
+    // Task 1573 — no ambient owner fallback. Self resolves to the verified
+    // caller; a cross-identity write needs an explicit userId + confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: targetUserId, callerUserId, confirm });
+    if (!resolved.ok) {
+        console.error(`${TAG} result=refused reason=${resolved.error.split(":")[0]}`);
+        return { content: [{ type: "text", text: `${TAG} ${resolved.error}` }], isError: true };
+    }
+    const userId = resolved.target;
+    const userIdLabel = userId.slice(0, 8);
     if (newPin.length < 4) {
         console.error(`${TAG} userId=${userIdLabel} result=too-short`);
         return { content: [{ type: "text", text: `${TAG} PIN must be at least 4 digits.` }], isError: true };
@@ -1252,7 +1285,7 @@ eagerTool(server, "admin-update-pin", "Update an existing admin user's PIN. Defa
     // (a pin rotation); the audited field is the pin.
     {
         const rows = formatAuditRowIds(users.map(u => u.userId));
-        logUsersAudit({ actor: callerUserId ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG }, { action: "set-pin", field: "pin", rowsBefore: rows, rowsAfter: rows });
+        logUsersAudit({ actor: callerUserId ?? "unknown", target: userId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG }, { action: "set-pin", field: "pin", rowsBefore: rows, rowsAfter: rows });
     }
     const self = userId === callerUserId;
     return {
@@ -2113,13 +2146,18 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
     "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself.", {
     password: z.string(),
     userId: z.string().optional().describe("The admin to set the password for. Defaults to the calling admin. Use admin-list to find userIds."),
-}, async ({ password, userId }) => {
+    confirm: z.boolean().optional().describe("Required (true) only when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity password change."),
+}, async ({ password, userId, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-set-password");
-    const targetUserId = userId ?? process.env.USER_ID;
-    if (!targetUserId) {
-        return { content: [{ type: "text", text: "No target admin: pass userId, or run as an identified admin." }], isError: true };
-    }
+    const callerUserId = verifiedCaller();
+    // Task 1573 — no ambient owner fallback. Self resolves to the verified
+    // caller; a cross-identity write needs an explicit userId + confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: userId, callerUserId, confirm });
+    if (!resolved.ok) {
+        return { content: [{ type: "text", text: resolved.error }], isError: true };
+    }
+    const targetUserId = resolved.target;
     let users;
     try {
         users = readUsersJson();
@@ -2148,8 +2186,8 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
         return { content: [{ type: "text", text: `That password is already in use by another admin. Choose a different one.` }], isError: true };
     }
     try {
-        await setAccessPasswordHash(targetUserId, password, USERS_FILE, { actor: process.env.USER_ID ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
-        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)}`);
+        await setAccessPasswordHash(targetUserId, password, USERS_FILE, { actor: callerUserId ?? "unknown", target: targetUserId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
+        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)} actor=${(callerUserId ?? "unknown").slice(0, 8)} explicitUserId=${resolved.isCrossIdentity}`);
         return { content: [{ type: "text", text: `Remote access password set for userId ${targetUserId}.` }] };
     }
     catch (err) {
@@ -2160,9 +2198,17 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
     }
 });
 lifelineTool(server, "remote-auth-revoke-password", "Revoke an admin's remote access password so they can no longer obtain a NEW remote session (an already-open session lapses within 24h). " +
-    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds.") }, async ({ userId }) => {
+    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds."),
+    confirm: z.boolean().optional().describe("Required (true) when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity revoke.") }, async ({ userId, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-revoke-password");
+    const callerUserId = verifiedCaller();
+    // Task 1573 — actor is the verified caller, never ambient env; a revoke of
+    // another admin's password is a cross-identity write needing confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: userId, callerUserId, confirm });
+    if (!resolved.ok) {
+        return { content: [{ type: "text", text: resolved.error }], isError: true };
+    }
     let users;
     try {
         users = readUsersJson();
@@ -2182,8 +2228,8 @@ lifelineTool(server, "remote-auth-revoke-password", "Revoke an admin's remote ac
         return { content: [{ type: "text", text: "Refusing to revoke the last remaining remote access password — the install would have no remote access. Set another admin's password first." }], isError: true };
     }
     try {
-        clearAccessPasswordHash(userId, USERS_FILE, { actor: process.env.USER_ID ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
-        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)}`);
+        clearAccessPasswordHash(userId, USERS_FILE, { actor: callerUserId ?? "unknown", target: userId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
+        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)} actor=${(callerUserId ?? "unknown").slice(0, 8)} explicitUserId=${resolved.isCrossIdentity}`);
         return { content: [{ type: "text", text: `Remote access password revoked for userId ${userId}.` }] };
     }
     catch (err) {
@@ -3267,9 +3313,10 @@ eagerTool(server, "account_list", "List every sub-account on this install (one h
         content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
     };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES a managing admin: pass `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Refuses if no adminUserId is given or if it is not a current house admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES two things: `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating); and `ownerName`, the real name of the client business's owner (ask the operator for it — never invent it or reuse the house operator's name). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately. Refuses if adminUserId is missing/not a house admin, or if ownerName is missing/blank/the placeholder \"Owner\". Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
     adminUserId: z.string().describe("The userId of the house admin who will manage this client sub-account. Must be a current house admin (see admin-list). Required — creation is refused without it."),
-}, async ({ adminUserId }) => {
+    ownerName: z.string().describe("The real name of the client business's owner. Applied to both the owner AdminUser and owner Person for the new sub-account. Required — creation is refused when missing, blank, or the placeholder \"Owner\". Ask the operator; never reuse the house operator's name."),
+}, async ({ adminUserId, ownerName }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
     // Task 1500 — every client sub-account must carry a responsible house admin.
@@ -3279,6 +3326,14 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         process.stderr.write(`[account-lifecycle] op=create-refused reason=no-admin adminUserId=-\n`);
         return { content: [{ type: "text", text: `account_create refused: name the managing house admin (adminUserId). Call admin-list to see the choices and ask the operator which one manages this client.` }], isError: true };
     }
+    // Task 1567 — the business owner's name is a hard precondition of the
+    // sub-account. Refuse before any scaffold so a nameless create leaves no
+    // partial account directory or rootless graph behind. The same predicate
+    // guards the seed (seedAccountGraphRoot) as a defence in depth.
+    if (isPlaceholderOwnerName(ownerName)) {
+        process.stderr.write(`[account-create] op=refused reason=no-owner-name\n`);
+        return { content: [{ type: "text", text: `account_create refused: give the client business owner's real name (ownerName). It cannot be blank or the placeholder "Owner". Ask the operator whose business this is.` }], isError: true };
+    }
     const houseAdminUserIds = readHouseAdminUserIds(ACCOUNTS_ROOT);
     if (!houseAdminUserIds.includes(adminUserId)) {
         process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${adminUserId.slice(0, 8)}\n`);
@@ -3305,13 +3360,11 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         // MERGE-keyed on its own userId at accountId=house, so reusing it would
         // leave the client's account-scoped AdminUser MATCH empty.
         const ownerUserId = randomUUID();
-        let ownerName = "Owner";
-        try {
-            const users = JSON.parse(readFileSync(USERS_FILE, "utf-8"));
-            if (Array.isArray(users) && typeof users[0]?.name === "string")
-                ownerName = users[0].name;
-        }
-        catch { /* no users.json — default "Owner" */ }
+        // Task 1567 — ownerName is the validated business-owner name from the tool
+        // input (refused above if blank/placeholder). It is applied to both the
+        // owner AdminUser and the owner Person in seedAccountGraphRoot. It is never
+        // derived from the house operator's users.json — that seeded the wrong
+        // person's name and defaulted to the "Owner" placeholder.
         const seedSession = getSession();
         let rootSeeded = false;
         try {