@rubytech/create-maxy-code 0.1.439 → 0.1.441

package/payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.js

@@ -0,0 +1,241 @@
+/**
+ * Dispatcher script: publish-availability
+ *
+ * Self-contained, like reconcile-bookings. Publishes the install account's
+ * computed free/busy into its Cloudflare D1 `availability_snapshot` table so the
+ * public booking page's edge Function keeps serving open times while the device
+ * is offline. Runs while the device is ONLINE; when the device is off it simply
+ * does not run and the edge keeps serving the last snapshot until it returns.
+ *
+ * It reads the device's own free/busy from the always-running local server
+ * (127.0.0.1:$MAXY_UI_INTERNAL_PORT/api/calendar/free-busy — a gate-exempt public
+ * path), so it needs no Neo4j and no tunnel/DNS. The account whose free/busy the
+ * endpoint serves is the one the server resolved and hands in via
+ * PUBLISH_ACCOUNT_DIR / PUBLISH_ACCOUNT_ID.
+ *
+ * If the local endpoint is unreachable it makes NO D1 write (result=skipped-
+ * unreachable), leaving the last edge snapshot intact. A PID lock prevents
+ * overlapping runs. Each run records the outcome to a local last-publish.json so
+ * the server's audit tick can report snapshot age independent of this job.
+ *
+ * Observability — one [calendar-availability] op=publish line per run.
+ *
+ *   PLATFORM_ROOT=... MAXY_UI_INTERNAL_PORT=... PUBLISH_ACCOUNT_DIR=... \
+ *   PUBLISH_ACCOUNT_ID=... node dist/scripts/publish-availability.js
+ */
+import { spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync, existsSync, unlinkSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { resolve, join, basename } from "node:path";
+import { homedir, tmpdir } from "node:os";
+function resolveConfigDir() {
+    const platformRoot = process.env.PLATFORM_ROOT;
+    if (!platformRoot)
+        throw new Error("PLATFORM_ROOT environment variable is required");
+    const brandPath = resolve(platformRoot, "config", "brand.json");
+    if (!existsSync(brandPath))
+        throw new Error(`brand.json not found at ${brandPath}`);
+    const brand = JSON.parse(readFileSync(brandPath, "utf-8"));
+    if (!brand.configDir)
+        throw new Error(`brand.json at ${brandPath} is missing configDir`);
+    return brand.configDir;
+}
+const CONFIG_DIR = resolve(homedir(), resolveConfigDir());
+const LOCK_FILE = resolve(CONFIG_DIR, "publish-availability.lock");
+function acquireLock() {
+    mkdirSync(CONFIG_DIR, { recursive: true });
+    if (existsSync(LOCK_FILE)) {
+        const storedPid = readFileSync(LOCK_FILE, "utf-8").trim();
+        try {
+            process.kill(Number(storedPid), 0);
+            return false; // a run is in progress
+        }
+        catch {
+            unlinkSync(LOCK_FILE); // stale
+        }
+    }
+    writeFileSync(LOCK_FILE, String(process.pid));
+    return true;
+}
+function releaseLock() {
+    try {
+        if (existsSync(LOCK_FILE) && readFileSync(LOCK_FILE, "utf-8").trim() === String(process.pid)) {
+            unlinkSync(LOCK_FILE);
+        }
+    }
+    catch {
+        /* best effort */
+    }
+}
+/** Read `KEY=value` pairs from a secrets env file without polluting process.env. */
+function readEnvFile(path) {
+    const out = {};
+    if (!existsSync(path))
+        return out;
+    for (const line of readFileSync(path, "utf-8").split("\n")) {
+        const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+        if (m)
+            out[m[1]] = m[2];
+    }
+    return out;
+}
+/**
+ * Record the outcome for the server's audit tick. lastSuccessAt advances only on
+ * a successful D1 write, so a run of failures leaves it stale and the server
+ * reports a climbing snapshotAgeMs.
+ */
+function writeLastPublish(accountDir, result, slots, lastSuccessAt) {
+    const stateDir = join(accountDir, "state", "booking-availability");
+    try {
+        mkdirSync(stateDir, { recursive: true });
+        writeFileSync(join(stateDir, "last-publish.json"), JSON.stringify({ result, slots, lastSuccessAt, at: new Date().toISOString() }));
+    }
+    catch {
+        /* best effort — the log line is the primary signal */
+    }
+}
+function readPriorSuccessAt(accountDir) {
+    const path = join(accountDir, "state", "booking-availability", "last-publish.json");
+    if (!existsSync(path))
+        return null;
+    try {
+        const prior = JSON.parse(readFileSync(path, "utf-8"));
+        return prior.lastSuccessAt ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** UTC midnight of `now`, and `days` after it, as `YYYY-MM-DDT00:00:00Z`. */
+function utcMidnight(now, addDays) {
+    const d = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + addDays));
+    return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function main() {
+    if (!acquireLock()) {
+        console.error("[calendar-availability] op=publish result=skipped reason=lock-held");
+        return;
+    }
+    try {
+        const accountDir = process.env.PUBLISH_ACCOUNT_DIR;
+        if (!accountDir) {
+            console.error("[calendar-availability] op=publish result=skipped reason=no-account");
+            return;
+        }
+        const accountId = process.env.PUBLISH_ACCOUNT_ID ?? basename(accountDir);
+        const availPath = join(accountDir, "calendar-availability.json");
+        if (!existsSync(availPath)) {
+            // No booking site for this account — nothing to publish. Not an error.
+            return;
+        }
+        let avail;
+        try {
+            avail = JSON.parse(readFileSync(availPath, "utf-8"));
+        }
+        catch {
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=error reason=bad-availability-json`);
+            writeLastPublish(accountDir, "error", null, readPriorSuccessAt(accountDir));
+            return;
+        }
+        const dbName = avail.bookingDbName;
+        if (!dbName) {
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=skipped reason=no-booking-db`);
+            return;
+        }
+        const secrets = readEnvFile(join(accountDir, "secrets", "cloudflare.env"));
+        const token = secrets.CF_PAGES_D1_TOKEN;
+        if (!token) {
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=skipped reason=no-pages-d1-token`);
+            return;
+        }
+        const port = process.env.MAXY_UI_INTERNAL_PORT;
+        if (!port) {
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=error reason=no-internal-port`);
+            writeLastPublish(accountDir, "error", null, readPriorSuccessAt(accountDir));
+            return;
+        }
+        // Fetch the device's own computed free/busy over a horizon that covers the
+        // page's own (operator-set) window, +1 day of margin for the local-midnight
+        // boundary the page renders in.
+        const daysAhead = typeof avail.daysAhead === "number" && avail.daysAhead > 0 ? Math.floor(avail.daysAhead) : 14;
+        const now = new Date();
+        const from = utcMidnight(now, 0);
+        const to = utcMidnight(now, daysAhead + 1);
+        const nowIso = now.toISOString();
+        const url = `http://127.0.0.1:${port}/api/calendar/free-busy?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`;
+        let payload;
+        try {
+            // Bound the read so a wedged server cannot hold the PID lock.
+            const res = await fetch(url, { signal: AbortSignal.timeout(30_000) });
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            payload = await res.text();
+        }
+        catch (err) {
+            // Device/local endpoint unreachable — leave the last edge snapshot intact.
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=skipped-unreachable err="${err.message}"`);
+            writeLastPublish(accountDir, "skipped-unreachable", null, readPriorSuccessAt(accountDir));
+            return;
+        }
+        // Must be JSON carrying a slots array, or we would poison the snapshot.
+        let slotCount;
+        try {
+            const parsed = JSON.parse(payload);
+            if (!Array.isArray(parsed.slots))
+                throw new Error("no slots array");
+            slotCount = parsed.slots.length;
+        }
+        catch (err) {
+            console.error(`[calendar-availability] op=publish accountId=${accountId} result=skipped reason=bad-payload err="${err.message}"`);
+            writeLastPublish(accountDir, "skipped", null, readPriorSuccessAt(accountDir));
+            return;
+        }
+        // Upsert via a temp SQL file — robust for a large payload where a --command
+        // argv would be fragile. Single quotes are escaped for the SQL literal. The
+        // CREATE first makes this self-healing: a booking site provisioned before
+        // this feature (its D1 has `bookings` but no `availability_snapshot`) gets
+        // the table here on the first publish, without waiting for a skill re-run.
+        const esc = payload.replace(/'/g, "''");
+        const sql = `CREATE TABLE IF NOT EXISTS availability_snapshot (
+  id        INTEGER PRIMARY KEY CHECK (id = 1),
+  payload   TEXT,
+  updatedAt TEXT
+);
+INSERT INTO availability_snapshot (id, payload, updatedAt)
+VALUES (1, '${esc}', '${nowIso}')
+ON CONFLICT(id) DO UPDATE SET payload=excluded.payload, updatedAt=excluded.updatedAt;`;
+        const workDir = mkdtempSync(join(tmpdir(), "publish-availability-"));
+        const sqlFile = join(workDir, "upsert.sql");
+        try {
+            writeFileSync(sqlFile, sql);
+            const wranglerEnv = {
+                CLOUDFLARE_API_TOKEN: token,
+                ...(secrets.CLOUDFLARE_ACCOUNT_ID ? { CLOUDFLARE_ACCOUNT_ID: secrets.CLOUDFLARE_ACCOUNT_ID } : {}),
+            };
+            const proc = spawnSync("npx", ["wrangler", "d1", "execute", dbName, "--remote", "--file", sqlFile], {
+                env: { ...process.env, ...wranglerEnv },
+                encoding: "utf-8",
+                maxBuffer: 16 * 1024 * 1024,
+                timeout: 60_000,
+            });
+            if (proc.status !== 0) {
+                console.error(`[calendar-availability] op=publish accountId=${accountId} result=error reason=d1-write-failed status=${proc.status}${proc.signal ? ` signal=${proc.signal}` : ""}`);
+                writeLastPublish(accountDir, "error", slotCount, readPriorSuccessAt(accountDir));
+                return;
+            }
+        }
+        finally {
+            rmSync(workDir, { recursive: true, force: true });
+        }
+        console.error(`[calendar-availability] op=publish accountId=${accountId} slots=${slotCount} result=success`);
+        writeLastPublish(accountDir, "success", slotCount, nowIso);
+    }
+    finally {
+        releaseLock();
+    }
+}
+main().catch((err) => {
+    console.error(`[calendar-availability] op=publish result=error reason=fatal err="${err instanceof Error ? err.message : String(err)}"`);
+    releaseLock();
+    process.exit(1);
+});
+//# sourceMappingURL=publish-availability.js.map

package/payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-availability.js","sourceRoot":"","sources":["../../src/scripts/publish-availability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,SAAS,gBAAgB;IACvB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,uBAAuB,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AAEnE,SAAS,WAAW;IAClB,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,uBAAuB;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACjC,CAAC;IACH,CAAC;IACD,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7F,UAAU,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,UAAkB,EAClB,MAAqB,EACrB,KAAoB,EACpB,aAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,aAAa,CACX,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAC/E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAsC,CAAC;QAC3F,OAAO,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,GAAS,EAAE,OAAe;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAClG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,uEAAuE;YACvE,OAAO;QACT,CAAC;QACD,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,4CAA4C,CAAC,CAAC;YACrH,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,sCAAsC,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,0CAA0C,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,uCAAuC,CAAC,CAAC;YAChH,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,gCAAgC;QAChC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,oBAAoB,IAAI,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QAE5H,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,oCAAqC,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;YACtI,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpE,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,2CAA4C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;YAC7I,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG;;;;;;cAMF,GAAG,OAAO,MAAM;sFACwD,CAAC;QAEnF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5B,MAAM,WAAW,GAA2B;gBAC1C,oBAAoB,EAAE,KAAK;gBAC3B,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC;YACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;gBAClG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE;gBACvC,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,+CAA+C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnL,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,gDAAgD,SAAS,UAAU,SAAS,iBAAiB,CAAC,CAAC;QAC7G,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,qEAAqE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxI,WAAW,EAAE,CAAC;IACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/payload/platform/scripts/__tests__/account-schema-owned-dirs.test.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Tests the plugin-declared account-owned-dir merge/reconcile lib: a brand that
+# ships a plugin declaring an owned top-level dir gets it unioned into the
+# account SCHEMA.md allowed-top-level set; a brand without the plugin does not;
+# the merge is idempotent; the reconcile check reports present before/after.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAT_SCRIPTS="$SCRIPT_DIR/.."
+REAL_PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
+REAL_TEMPLATE="$REAL_PROJECT_DIR/templates/account-schema/SCHEMA.md"
+REAL_PREMIUM="$(cd "$REAL_PROJECT_DIR/.." && pwd)/premium-plugins"
+PASS=0; FAIL=0; FAILED=()
+assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+. "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.sh"
+
+# Build a fake platform tree at $T/platform whose premium sibling is a symlink to
+# the real premium-plugins (so the real sitedesk-job PLUGIN.md is exercised).
+make_tree() { # $1=ships (json array literal)
+  local T; T="$(mktemp -d)"
+  mkdir -p "$T/platform/plugins" "$T/platform/config" "$T/platform/templates/account-schema"
+  ln -s "$REAL_PREMIUM" "$T/premium-plugins"
+  cp "$REAL_TEMPLATE" "$T/platform/templates/account-schema/SCHEMA.md"
+  printf '{"installDir":"test-brand","shipsPremiumBundles":%s}\n' "$1" > "$T/platform/config/brand.json"
+  echo "$T"
+}
+make_account() { # $1=tree
+  local A; A="$(mktemp -d)"
+  cp "$1/platform/templates/account-schema/SCHEMA.md" "$A/SCHEMA.md"
+  printf '{"accountId":"x","role":"house"}\n' > "$A/account.json"
+  echo "$A"
+}
+
+# --- sitedesk-shipping brand: quoting added ---
+T_SD="$(make_tree '["sitedesk"]')"; A_SD="$(make_account "$T_SD")"
+export PROJECT_DIR="$T_SD/platform"
+OUT="$(merge_owned_dirs_into_schema "$A_SD")"
+assert_grep "op=seed-owned-dirs" "$OUT" "sd-seed-log"
+assert_grep "added=quoting" "$OUT" "sd-added-quoting"
+ALLOWED="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SD/SCHEMA.md")"
+assert_grep "quoting" "$ALLOWED" "sd-allowlist-has-quoting"
+assert_grep "Plugin-owned top-level workspaces" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
+assert_grep "plugin-owned-dirs:start" "$(cat "$A_SD/SCHEMA.md")" "sd-marker"
+
+# --- idempotency: second merge is byte-identical ---
+BEFORE="$(shasum "$A_SD/SCHEMA.md" | awk '{print $1}')"
+OUT2="$(merge_owned_dirs_into_schema "$A_SD")"
+AFTER="$(shasum "$A_SD/SCHEMA.md" | awk '{print $1}')"
+assert_eq "$AFTER" "$BEFORE" "idempotent-second-merge"
+assert_grep "added=none" "$OUT2" "sd-second-added-none"
+
+# --- non-sitedesk brand: no quoting ---
+T_MX="$(make_tree '[]')"; A_MX="$(make_account "$T_MX")"
+export PROJECT_DIR="$T_MX/platform"
+merge_owned_dirs_into_schema "$A_MX" >/dev/null
+ALLOWED_MX="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_MX/SCHEMA.md")"
+assert_nogrep "quoting" "$ALLOWED_MX" "mx-no-quoting"
+assert_nogrep "Plugin-owned top-level workspaces" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
+
+# --- reconcile: present=false on bare schema, present=true after merge ---
+A_RC="$(make_account "$T_SD")"
+export PROJECT_DIR="$T_SD/platform"
+RC_BEFORE="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_RC")"
+assert_grep "ownedDir=quoting present=false" "$RC_BEFORE" "rc-present-false"
+merge_owned_dirs_into_schema "$A_RC" >/dev/null
+RC_AFTER="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_RC")"
+assert_grep "ownedDir=quoting present=true" "$RC_AFTER" "rc-present-true"
+
+# --- sweep: backfills every account with an account.json ---
+ACCTS="$(mktemp -d)"; mkdir -p "$ACCTS/a1"
+cp "$T_SD/platform/templates/account-schema/SCHEMA.md" "$ACCTS/a1/SCHEMA.md"
+printf '{"accountId":"a1","role":"client"}\n' > "$ACCTS/a1/account.json"
+SWEEP="$(reconcile_all_accounts_owned_dirs "$ACCTS" 2>&1)"
+assert_grep "op=reconcile" "$SWEEP" "sweep-reconcile-log"
+ALLOWED_A1="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$ACCTS/a1/SCHEMA.md")"
+assert_grep "quoting" "$ALLOWED_A1" "sweep-backfilled-a1"
+
+# --- shape-b: a bundle-root PLUGIN.md declaration is resolved too ---
+# A premium bundle may declare an owned dir in its root PLUGIN.md (depth 1),
+# not only in a sub-plugin manifest (depth 2). Build a fully synthetic tree.
+TB="$(mktemp -d)"
+mkdir -p "$TB/platform/plugins" "$TB/platform/config" "$TB/platform/templates/account-schema"
+mkdir -p "$TB/premium-plugins/acme/plugins/acme-sub"
+cp "$REAL_TEMPLATE" "$TB/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"acme-brand","shipsPremiumBundles":["acme"]}\n' > "$TB/platform/config/brand.json"
+printf -- '---\nname: acme\naccount-owned-dirs: [{"dir": "ledger", "description": "Acme ledger."}]\n---\n' > "$TB/premium-plugins/acme/PLUGIN.md"
+printf -- '---\nname: acme-sub\n---\n' > "$TB/premium-plugins/acme/plugins/acme-sub/PLUGIN.md"
+A_TB="$(mktemp -d)"; cp "$TB/platform/templates/account-schema/SCHEMA.md" "$A_TB/SCHEMA.md"
+export PROJECT_DIR="$TB/platform"
+RES_TB="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" resolve)"
+assert_grep "ledger" "$RES_TB" "shapeb-resolve-ledger"
+assert_grep "\"plugin\": \"acme\"" "$RES_TB" "shapeb-owner-is-bundle"
+merge_owned_dirs_into_schema "$A_TB" >/dev/null
+ALLOWED_TB="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TB/SCHEMA.md")"
+assert_grep "ledger" "$ALLOWED_TB" "shapeb-allowlist-has-ledger"
+
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -ne 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/lib/account-schema-owned-dirs.py

@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+"""Resolve plugin-declared account-owned top-level dirs for the brand and merge
+them into an account's SCHEMA.md.
+
+A plugin declares owned top-level account dirs in its PLUGIN.md frontmatter:
+
+    account-owned-dirs: [{"dir": "quoting", "description": "..."}]
+
+The owned-dir set for a brand is the union declared by every platform plugin
+($PROJECT_DIR/plugins/*/PLUGIN.md) and every premium sub-plugin of a bundle the
+brand ships ($PREMIUM_ROOT/<bundle>/plugins/*/PLUGIN.md, gated by brand.json
+shipsPremiumBundles). Reads PROJECT_DIR from the environment.
+"""
+import json, os, re, sys
+
+MARK_START = "<!-- plugin-owned-dirs:start -->"
+MARK_END = "<!-- plugin-owned-dirs:end -->"
+
+
+def _project_dir():
+    pd = os.environ.get("PROJECT_DIR", "")
+    if not pd:
+        sys.stderr.write("account-schema-owned-dirs: PROJECT_DIR unset\n")
+        sys.exit(1)
+    return os.path.normpath(pd)
+
+
+def _read_brand(project_dir):
+    path = os.path.join(project_dir, "config", "brand.json")
+    if not os.path.isfile(path):
+        return "unknown", []
+    try:
+        with open(path) as f:
+            b = json.load(f)
+        return (b.get("installDir") or "unknown"), list(b.get("shipsPremiumBundles") or [])
+    except Exception:
+        return "unknown", []
+
+
+def _parse_plugin_md(path):
+    """Return (name, [ {dir, description} ]) from a PLUGIN.md, or (None, [])."""
+    try:
+        with open(path) as f:
+            text = f.read()
+    except Exception:
+        return None, []
+    m = re.match(r"^---\n(.*?)\n---", text, re.DOTALL)
+    if not m:
+        return None, []
+    fm = m.group(1)
+    name = None
+    nm = re.search(r"^name:\s*(.+)$", fm, re.MULTILINE)
+    if nm:
+        name = nm.group(1).strip().strip('"').strip("'")
+    owned = []
+    om = re.search(r"^account-owned-dirs:\s*(.+)$", fm, re.MULTILINE)
+    if om:
+        try:
+            raw = json.loads(om.group(1).strip())
+            for e in raw:
+                d = (e.get("dir") or "").strip()
+                if d:
+                    owned.append({"dir": d, "description": (e.get("description") or "").strip()})
+        except Exception:
+            pass
+    return name, owned
+
+
+def _plugin_md_paths(project_dir):
+    paths = []
+    plugins_root = os.path.join(project_dir, "plugins")
+    if os.path.isdir(plugins_root):
+        for entry in sorted(os.listdir(plugins_root)):
+            p = os.path.join(plugins_root, entry, "PLUGIN.md")
+            if os.path.isfile(p):
+                paths.append(p)
+    _brand, ships = _read_brand(project_dir)
+    premium_root = os.path.join(os.path.dirname(project_dir), "premium-plugins")
+    for bundle in ships:
+        bundle_dir = os.path.join(premium_root, bundle)
+        # Bundle-root manifest (shape b): premium-plugins/<bundle>/PLUGIN.md.
+        root_md = os.path.join(bundle_dir, "PLUGIN.md")
+        if os.path.isfile(root_md):
+            paths.append(root_md)
+        # Sub-plugin manifests (shape a): premium-plugins/<bundle>/plugins/*/PLUGIN.md.
+        subs = os.path.join(bundle_dir, "plugins")
+        if not os.path.isdir(subs):
+            continue
+        for entry in sorted(os.listdir(subs)):
+            p = os.path.join(subs, entry, "PLUGIN.md")
+            if os.path.isfile(p):
+                paths.append(p)
+    return paths
+
+
+def resolve(project_dir):
+    """Union of owned-dir declarations. First declarer of a dir wins its owner
+    label + description."""
+    seen = {}
+    order = []
+    for path in _plugin_md_paths(project_dir):
+        name, owned = _parse_plugin_md(path)
+        for e in owned:
+            if e["dir"] in seen:
+                continue
+            seen[e["dir"]] = {"dir": e["dir"], "description": e["description"], "plugin": name or "unknown"}
+            order.append(e["dir"])
+    return [seen[d] for d in order]
+
+
+def _allowed_block(text):
+    """Return (list_of_entries, start_idx, end_idx) for the fenced
+    allowed-top-level block. end_idx is the closing-fence line index."""
+    lines = text.split("\n")
+    start = None
+    for i, ln in enumerate(lines):
+        if ln.strip() == "```allowed-top-level":
+            start = i
+            break
+    if start is None:
+        return None, None, None
+    for j in range(start + 1, len(lines)):
+        if lines[j].strip() == "```":
+            return [l for l in lines[start + 1:j] if l.strip()], start, j
+    return None, None, None
+
+
+def _strip_region(text):
+    if MARK_START not in text:
+        return text
+    pre = text.split(MARK_START, 1)[0]
+    post = ""
+    if MARK_END in text:
+        post = text.split(MARK_END, 1)[1]
+    return (pre.rstrip("\n") + "\n" + post.lstrip("\n")).rstrip("\n") + "\n"
+
+
+def merge(project_dir, account_dir):
+    brand, _ = _read_brand(project_dir)
+    owned = resolve(project_dir)
+    schema_path = os.path.join(account_dir, "SCHEMA.md")
+    if not os.path.isfile(schema_path):
+        print(f"brand={brand} added=none")
+        return
+    with open(schema_path) as f:
+        text = f.read()
+    entries, start, end = _allowed_block(text)
+    added = []
+    if entries is not None:
+        present = set(entries)
+        lines = text.split("\n")
+        insert = []
+        for e in owned:
+            if e["dir"] not in present:
+                insert.append(e["dir"])
+                added.append(e["dir"])
+        if insert:
+            lines[end:end] = insert
+            text = "\n".join(lines)
+    # Regenerate the descriptive region wholesale (idempotent).
+    text = _strip_region(text)
+    if owned:
+        region = [MARK_START, "## Plugin-owned top-level workspaces", "",
+                  "A plugin that owns a top-level workspace declares it. The internal",
+                  "structure is owned by that plugin's tools and recreated on the next",
+                  "write. Never reorganise it.", ""]
+        for e in owned:
+            desc = e["description"] or f"Owned by the {e['plugin']} plugin."
+            region.append(f"- `{e['dir']}/` — {desc}")
+        region.append(MARK_END)
+        text = text.rstrip("\n") + "\n\n" + "\n".join(region) + "\n"
+    with open(schema_path, "w") as f:
+        f.write(text)
+    print(f"brand={brand} added={','.join(added) if added else 'none'}")
+
+
+def reconcile(project_dir, account_dir):
+    brand, _ = _read_brand(project_dir)
+    owned = resolve(project_dir)
+    schema_path = os.path.join(account_dir, "SCHEMA.md")
+    present = set()
+    if os.path.isfile(schema_path):
+        with open(schema_path) as f:
+            entries, _s, _e = _allowed_block(f.read())
+        present = set(entries or [])
+    for e in owned:
+        is_present = "true" if e["dir"] in present else "false"
+        print(f"brand={brand} plugin={e['plugin']} ownedDir={e['dir']} present={is_present}")
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit("usage: account-schema-owned-dirs.py {resolve|merge|reconcile} [account_dir]")
+    cmd = sys.argv[1]
+    pd = _project_dir()
+    if cmd == "resolve":
+        print(json.dumps(resolve(pd)))
+    elif cmd == "merge":
+        merge(pd, sys.argv[2])
+    elif cmd == "reconcile":
+        reconcile(pd, sys.argv[2])
+    else:
+        sys.exit(f"unknown command: {cmd}")
+
+
+if __name__ == "__main__":
+    main()

package/payload/platform/scripts/lib/account-schema-owned-dirs.sh

@@ -0,0 +1,33 @@
+# account-schema-owned-dirs.sh — merge plugin-declared owned top-level dirs into
+# an account's SCHEMA.md, and reconcile every account at install time.
+#
+# Requires PROJECT_DIR exported by the caller. Sourced by provision-account-dir.sh
+# and setup-account.sh.
+
+_ACCT_SCHEMA_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_ACCT_SCHEMA_PY="$_ACCT_SCHEMA_LIB_DIR/account-schema-owned-dirs.py"
+
+# merge_owned_dirs_into_schema <account_dir>
+# Unions the brand's declared owned dirs into <account_dir>/SCHEMA.md and logs
+# the seam. Idempotent.
+merge_owned_dirs_into_schema() {
+  local _acct="$1"
+  local _out
+  _out="$(PROJECT_DIR="$PROJECT_DIR" python3 "$_ACCT_SCHEMA_PY" merge "$_acct" 2>/dev/null)"
+  echo "  [acct-schema] op=seed-owned-dirs ${_out}"
+}
+
+# reconcile_all_accounts_owned_dirs <accounts_dir>
+# Standing check + backfill: for every account dir with an account.json, log the
+# pre-merge present state of each declared owned dir, then merge (backfill).
+reconcile_all_accounts_owned_dirs() {
+  local _accts="$1"
+  [ -d "$_accts" ] || return 0
+  local _acct
+  for _acct in "$_accts"/*/; do
+    [ -f "$_acct/account.json" ] || continue
+    PROJECT_DIR="$PROJECT_DIR" python3 "$_ACCT_SCHEMA_PY" reconcile "$_acct" 2>/dev/null \
+      | while IFS= read -r _line; do echo "  [acct-schema] op=reconcile ${_line}"; done
+    merge_owned_dirs_into_schema "$_acct"
+  done
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -15,6 +15,9 @@
 #   SCRIPT_DIR     — the platform/scripts dir (for lib bootstraps)
 #   USERS_FILE     — $HOME/<brand.configDir>/users.json (owner stamp; optional)
 
+# Owned-dir schema merge (plugin-declared top-level account dirs).
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/account-schema-owned-dirs.sh"
+
 provision_account_dir() {
   local ACCOUNT_DIR="$1"
   local ACCOUNT_ID="$2"
@@ -38,6 +41,10 @@ provision_account_dir() {
   fi
   echo "  [acct-schema] seeded dirs=$_seeded"
 
+  # Merge brand-shipped plugin-declared owned top-level dirs into the freshly
+  # seeded SCHEMA.md so the guard admits them (e.g. quoting/ on SiteDesk).
+  merge_owned_dirs_into_schema "$ACCOUNT_DIR"
+
   # Claude Code discovers project-level .claude/ relative to the nearest .git
   # root. Without a .git in the account dir it traverses up to ~/maxy/.git and
   # misses accountDir/.claude/. Initialise a repo so the account dir IS the root.

package/payload/platform/scripts/setup-account.sh

@@ -53,3 +53,13 @@ USERS_FILE="$USERS_FILE" resolve_and_sweep_account_dir
 # designation (migrating a legacy unlabelled account in the same step).
 export TEMPLATES_DIR PROJECT_DIR SCRIPT_DIR USERS_FILE
 provision_account_dir "$ACCOUNT_DIR" "$ACCOUNT_ID" "house"
+
+# ------------------------------------------------------------------
+# 3. Reconcile plugin-declared owned top-level dirs across every account
+# ------------------------------------------------------------------
+# Standing check + durable backfill: every account under data/accounts/ gets the
+# brand's plugin-declared owned dirs unioned into its SCHEMA.md. Runs on every
+# install so a re-provision cannot drop a previously-added owned dir.
+# reconcile_all_accounts_owned_dirs is available because provision-account-dir.sh
+# (sourced above) sources the owned-dir lib.
+reconcile_all_accounts_owned_dirs "$ACCOUNTS_DIR"

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAqB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EA4QtD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAqB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EA6QtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -232,6 +232,7 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_outlook_outlook__outlook-mail-search",
     "mcp__plugin_outlook_outlook__outlook-mail-send",
     "mcp__plugin_outlook_outlook__outlook-mailbox-info",
+    "mcp__plugin_outlook_outlook__outlook-mailbox-list",
     "mcp__plugin_quickbooks_quickbooks__quickbooks-authorize-url",
     "mcp__plugin_quickbooks_quickbooks__quickbooks-bill-create",
     "mcp__plugin_quickbooks_quickbooks__quickbooks-connections",