@rubytech/create-maxy-code 0.1.486 → 0.1.488

package/payload/server/server.js

@@ -1643,10 +1643,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync42, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
+import { readFileSync as readFileSync43, existsSync as existsSync39, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve38, join as join45, basename as basename12 } from "path";
+import { resolve as resolve39, join as join45, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -2920,7 +2920,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve39) => setTimeout(() => resolve39("timeout"), timeoutMs)
+    (resolve40) => setTimeout(() => resolve40("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -3097,11 +3097,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve39, reject) => {
+  return new Promise((resolve40, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve39();
+        resolve40();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3209,7 +3209,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve39, reject) => {
+  return new Promise((resolve40, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3219,7 +3219,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve39(value);
+        resolve40(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -4278,8 +4278,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve39) => {
-    release = resolve39;
+  const mine = new Promise((resolve40) => {
+    release = resolve40;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -6016,11 +6016,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve39) => {
-        const timer = setTimeout(resolve39, delay);
+      await new Promise((resolve40) => {
+        const timer = setTimeout(resolve40, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve39();
+          resolve40();
         }, { once: true });
       });
     }
@@ -6028,16 +6028,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve39) => {
+  return new Promise((resolve40) => {
     if (!conn.sock) {
-      resolve39();
+      resolve40();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve39();
+        resolve40();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6511,8 +6511,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve39) => {
-      resolvePending = resolve39;
+    const sttPending = new Promise((resolve40) => {
+      resolvePending = resolve40;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -6901,20 +6901,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve39) => {
+  return new Promise((resolve40) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve39(true);
+      resolve40(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve39(false);
+      resolve40(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve39(false);
+      resolve40(false);
     });
   });
 }
@@ -8245,8 +8245,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve39, reject) => {
-    resolveCode = resolve39;
+  const codePromise = new Promise((resolve40, reject) => {
+    resolveCode = resolve40;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -14681,15 +14681,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve39 = async (a) => {
+  const resolve40 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve39)
+    accounts.filter((a) => a.config.role === "house").map(resolve40)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve39)
+    accounts.filter((a) => a.config.role !== "house").map(resolve40)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -19393,16 +19393,23 @@ function parseTableTopLevelLabels(referencesDir) {
   }
   return { labels, contributingFiles };
 }
+var ADDITIONAL_BASE_LABELS = Object.freeze(
+  /* @__PURE__ */ new Set(["Supplier"])
+);
 var cached = null;
 function getTopLevelLabelAllowlist(opts = {}) {
   if (!opts.referencesDir && cached) return cached;
   const referencesDir = opts.referencesDir ?? resolveReferencesDir();
   const { labels: derived, contributingFiles } = parseTableTopLevelLabels(referencesDir);
+  const excluded = [];
+  for (const label of ADDITIONAL_BASE_LABELS) {
+    if (derived.delete(label)) excluded.push(label);
+  }
   const derivedCount = derived.size;
   for (const label of STATIC_TOP_LEVEL_LABELS) derived.add(label);
   const result = Object.freeze(derived);
   process.stderr.write(
-    `[graph-page] op=top-level-labels source=ontology count=${derived.size} files=${contributingFiles.join("|") || "none"} derived=${derivedCount} static=${STATIC_TOP_LEVEL_LABELS.size}
+    `[graph-page] op=top-level-labels source=ontology count=${derived.size} files=${contributingFiles.join("|") || "none"} derived=${derivedCount} static=${STATIC_TOP_LEVEL_LABELS.size} excluded=${excluded.join(",") || "none"}
 `
   );
   if (!opts.referencesDir) cached = result;
@@ -24494,7 +24501,17 @@ app62.get("/free-busy", async (c) => {
   if (Number.isNaN(Date.parse(from)) || Number.isNaN(Date.parse(to))) {
     return c.json({ error: "from and to must be parseable ISO timestamps" }, 400);
   }
-  const account = resolveAccount();
+  const accountParam = c.req.query("account");
+  let account;
+  if (accountParam) {
+    account = listValidAccounts().find((a) => a.accountId === accountParam) ?? null;
+    if (!account) {
+      console.error(`[calendar] op=free-busy-unknown-account account="${accountParam}"`);
+      return c.json({ error: "Availability not configured" }, 404);
+    }
+  } else {
+    account = resolveAccount();
+  }
   if (!account) return c.json({ error: "No account configured" }, 500);
   let config;
   try {
@@ -24546,6 +24563,8 @@ var ONT_END = "<!-- ontology-buckets:end -->";
 var OWNED_START = "<!-- plugin-owned-dirs:start -->";
 var OWNED_END = "<!-- plugin-owned-dirs:end -->";
 var ALWAYS_EXPOSED = "output";
+var SYSTEM_DIRS = /* @__PURE__ */ new Set(["agents", "secrets", "specialists", "state", "memory", "cache", "logs", "tmp"]);
+var SAFE_FOLDER = /^[A-Za-z0-9_-]+$/;
 var DOMAIN_LINE = /^- `([^`/]+)\/` - one folder per /;
 var OWNED_LINE = /^- `([^`/]+)\/` — /;
 function region(text, start, end) {
@@ -24565,7 +24584,7 @@ function allowedBlockOrNull(text) {
   }
   return null;
 }
-function resolveExposedDirs(schemaText) {
+function resolveExposedDirs(schemaText, exposeFolders = []) {
   const empty = {
     schemaPresent: false,
     allowed: (
@@ -24607,7 +24626,11 @@ function resolveExposedDirs(schemaText) {
   const pluginOwned = dirsIn(owned, OWNED_LINE);
   const collisions = domainBuckets.filter((d) => pluginOwned.includes(d));
   const candidates = [ALWAYS_EXPOSED, ...domainBuckets.filter((d) => !collisions.includes(d))];
-  const exposed = [...new Set(candidates)].filter((d) => allowed.includes(d)).sort();
+  const ontologyExposed = [...new Set(candidates)].filter((d) => allowed.includes(d));
+  const extras = (Array.isArray(exposeFolders) ? exposeFolders : []).filter(
+    (f) => typeof f === "string" && SAFE_FOLDER.test(f) && !SYSTEM_DIRS.has(f)
+  );
+  const exposed = [.../* @__PURE__ */ new Set([...ontologyExposed, ...extras])].sort();
   return { schemaPresent: true, allowed, domainBuckets, pluginOwned, collisions, exposed };
 }
 
@@ -24656,6 +24679,14 @@ async function readAccountSecret(accountId) {
 function isValidAccountId2(value) {
   return /^[A-Za-z0-9-]+$/.test(value);
 }
+async function readExposeFolders(accountDir) {
+  try {
+    const cfg = JSON.parse(await readFile6(join42(accountDir, "data-portal.json"), "utf8"));
+    return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
+  } catch {
+    return [];
+  }
+}
 async function resolveFetchTarget(accountDir, relPath) {
   let schemaText = null;
   try {
@@ -24663,7 +24694,8 @@ async function resolveFetchTarget(accountDir, relPath) {
   } catch {
     schemaText = null;
   }
-  const { exposed } = resolveExposedDirs(schemaText);
+  const exposeFolders = await readExposeFolders(accountDir);
+  const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0) return { ok: false, reason: "not-exposed" };
   const lexical = resolve32(accountDir, relPath);
   let root;
@@ -26484,16 +26516,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve39) => {
+    return new Promise((resolve40) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve39({ timeout: true });
+        resolve40({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve39(r);
+        resolve40(r);
       });
     });
   }
@@ -26504,11 +26536,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve39) => {
+    return new Promise((resolve40) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve39({ timeout: true });
+        resolve40({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -26517,7 +26549,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve39(r);
+          resolve40(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28141,6 +28173,22 @@ function warnOnChannelAdminBindingDrift() {
   }
 }
 
+// server/lib/booking-site-accounts.ts
+import { existsSync as existsSync37, readFileSync as readFileSync41 } from "fs";
+import { resolve as resolve37 } from "path";
+function listBookingSiteAccounts(accounts) {
+  return accounts.filter((a) => {
+    const availPath = resolve37(a.accountDir, "calendar-availability.json");
+    if (!existsSync37(availPath)) return false;
+    try {
+      const cfg = JSON.parse(readFileSync41(availPath, "utf-8"));
+      return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
+    } catch {
+      return false;
+    }
+  });
+}
+
 // app/lib/admin-sse-registry.ts
 var activeAdminSSEControllers = /* @__PURE__ */ new Set();
 function broadcastAdminShutdown(reason) {
@@ -28171,8 +28219,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync37, readFileSync as readFileSync41, statSync as statSync16 } from "fs";
-import { resolve as resolve37 } from "path";
+import { existsSync as existsSync38, readFileSync as readFileSync42, statSync as statSync16 } from "fs";
+import { resolve as resolve38 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -28207,7 +28255,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve37(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve38(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -28219,8 +28267,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve37(brand.configDir, "entitlement.json");
-  if (!existsSync37(entitlementPath)) {
+  const entitlementPath = resolve38(brand.configDir, "entitlement.json");
+  if (!existsSync38(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat9 = statSync16(entitlementPath);
@@ -28235,7 +28283,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync41(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync42(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -28249,7 +28297,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync41(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync42(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -28413,12 +28461,12 @@ installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join45(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync38(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync39(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync39(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync43(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -28453,8 +28501,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join45(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync38(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync42(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync39(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync43(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -28527,7 +28575,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve38(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve39(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -28542,7 +28590,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve38(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, ".."))
+      platformRoot: resolve39(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -29218,20 +29266,20 @@ app64.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve38(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve38(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve39(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve39(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync38(filePath)) {
+  if (!existsSync39(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync42(filePath);
+  const body = readFileSync43(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -29248,20 +29296,20 @@ app64.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve38(account.accountDir, "generated", filename);
-  const expectedDir = resolve38(account.accountDir, "generated");
+  const filePath = resolve39(account.accountDir, "generated", filename);
+  const expectedDir = resolve39(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync38(filePath)) {
+  if (!existsSync39(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync42(filePath);
+  const body = readFileSync43(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -29274,9 +29322,9 @@ app64.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync39(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync43(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -29303,11 +29351,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync38(resolve38(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync39(resolve39(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync42(resolve38(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync43(resolve39(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -29316,8 +29364,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join45(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync38(versionFile)) return "unknown";
-    const content = readFileSync42(versionFile, "utf-8").trim();
+    if (!existsSync39(versionFile)) return "unknown";
+    const content = readFileSync43(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -29358,7 +29406,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync42(resolve38(process.cwd(), "public", file), "utf-8");
+    html = readFileSync43(resolve39(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -29380,8 +29428,8 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join45(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync38(cachePath)) return null;
-    return JSON.parse(readFileSync42(cachePath, "utf-8"));
+    if (!existsSync39(cachePath)) return null;
+    return JSON.parse(readFileSync43(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -29476,7 +29524,7 @@ app64.use("/vnc-popout.html", logViewerFetch);
 app64.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync42(resolve38(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync43(resolve39(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -29614,10 +29662,10 @@ var httpServer = serve({ fetch: app64.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const reconcileScript = resolve38(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve39(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = (ctx) => {
-    if (!existsSync38(reconcileScript)) return;
+    if (!existsSync39(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -29640,10 +29688,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const outlookScript = resolve38(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve39(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync38(outlookScript)) return;
+    if (!existsSync39(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -29666,18 +29714,18 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const strandedAccountsDir = resolve38(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve39(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync38(strandedAccountsDir)) return;
+      if (!existsSync39(strandedAccountsDir)) return;
       const now = Date.now();
       for (const name of readdirSync26(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve38(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync38(pendingPath2)) continue;
+        const pendingPath2 = resolve39(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync39(pendingPath2)) continue;
         const ageMs = now - statSync17(pendingPath2).mtimeMs;
         if (ageMs > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs / 1e3)}`);
@@ -29696,7 +29744,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const googleAccountsDir = resolve38(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve39(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -29711,10 +29759,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve38(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve39(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync38(googleAuditScript)) return;
+    if (!existsSync39(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -29774,18 +29822,18 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const publishScript = resolve38(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve39(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
-  const currentAccount = () => {
+  const bookingAccounts = () => {
     try {
-      return resolveAccount();
+      return listBookingSiteAccounts(listValidAccounts());
     } catch (err) {
-      console.error(`[calendar-availability] op=publish result=error reason=account-resolve-failed err="${err.message}"`);
-      return null;
+      console.error(`[calendar-availability] op=publish result=error reason=enumerate-failed err="${err.message}"`);
+      return [];
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync38(publishScript)) return;
+    if (!existsSync39(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -29804,21 +29852,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve38(account.accountDir, "calendar-availability.json");
+    const availPath = resolve39(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync38(availPath)) {
-        const cfg = JSON.parse(readFileSync42(availPath, "utf-8"));
+      if (existsSync39(availPath)) {
+        const cfg = JSON.parse(readFileSync43(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve38(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve39(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync38(statePath)) {
+    if (existsSync39(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync42(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync43(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -29830,10 +29878,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=${ageMs ?? "na"}`);
   };
   const publishTick = (ctx) => {
-    const account = currentAccount();
-    if (!account) return;
-    spawnPublish(account, ctx);
-    auditSnapshotAge(account);
+    for (const account of bookingAccounts()) {
+      try {
+        spawnPublish(account, ctx);
+        auditSnapshotAge(account);
+      } catch (err) {
+        console.error(`[calendar-availability] op=publish accountId=${account.accountId} result=error reason=tick-failed err="${err.message}"`);
+      }
+    }
   };
   registerLoop({
     name: "calendar-availability-publish",
@@ -29847,11 +29899,11 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..");
-  const auditScript = resolve38(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve39(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync38(auditScript)) return;
+    if (!existsSync39(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -29971,11 +30023,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync38(USERS_FILE)) {
+    if (!existsSync39(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync42(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync43(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -30022,8 +30074,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync38(USERS_FILE)) return 0;
-  const raw = readFileSync42(USERS_FILE, "utf-8").trim();
+  if (!existsSync39(USERS_FILE)) return 0;
+  const raw = readFileSync43(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -30156,7 +30208,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve38(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..")),
+  platformRoot: resolve39(process.env.MAXY_PLATFORM_ROOT ?? join45(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {