@rubytech/create-sitedesk-code 0.1.401 → 0.1.404

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.401",
+  "version": "0.1.404",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -48,7 +48,7 @@ echo "\$@" >> "\$SB/curl.log"
 url=""; for a in "\$@"; do case "\$a" in https://*) url="\$a";; esac; done
 case "\$url" in
   *"/tokens/permission_groups"*)
-    echo '{"success":true,"result":[{"id":"pg_pages","name":"Cloudflare Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
+    echo '{"success":true,"result":[{"id":"pg_pages","name":"Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
     ;;
   *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
   *"/tokens"*)        echo '{"success":true,"result":{"id":"tok1","value":"'"$SECRET_VALUE"'"}}';;
@@ -191,5 +191,100 @@ echo "$ERR" | grep -q "code=1001" && ok "failure code surfaced" || bad "code not
 no_leak "real failure"
 teardown
 
+# 9. pages exact-name: three custom-pages decoys ordered BEFORE the real group.
+#    The old fuzzy /pages.*(write|edit)/ + head -1 picks "Access: Custom Pages Write";
+#    exact-name must mint the real Pages Write + D1 Write ids and none of the decoys.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_x1","name":"Access: Custom Pages Write"},{"id":"pg_x2","name":"Account Custom Pages Write"},{"id":"pg_x3","name":"Custom Pages Write"},{"id":"pg_pages_real","name":"Pages Write"},{"id":"pg_d1_real","name":"D1 Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "pages exact-name skips custom-pages decoys" pages 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_pages_real" && ok "minted real Pages Write id" || bad "did not mint real pages id: $POSTLINE"
+echo "$POSTLINE" | grep -q "pg_d1_real" && ok "minted real D1 Write id" || bad "did not mint real d1 id"
+echo "$POSTLINE" | grep -qE "pg_x1|pg_x2|pg_x3" && bad "minted a custom-pages decoy id: $POSTLINE" || ok "no custom-pages decoy id minted"
+no_leak "pages exact-name"
+teardown
+
+# 10. dns exact-name on cfat_: skip the "Account DNS Settings Write" / "DNS Firewall
+#     Write" decoys, mint the real "DNS Write" id, AND nest the zone resource under
+#     the account resource (account-owned masters reject the flat zone.* with 1001).
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"},{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns exact-name cfat nests zone under account" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_dns_real" && ok "minted real DNS Write id" || bad "did not mint real dns id: $POSTLINE"
+echo "$POSTLINE" | grep -qE "pg_dnsx1|pg_dnsx2" && bad "minted a dns decoy id: $POSTLINE" || ok "no dns decoy id minted"
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.acc123":{"com.cloudflare.api.account.zone.*":"*"}}' && ok "cfat nests zone under account" || bad "zone resource not nested for cfat: $POSTLINE"
+no_leak "dns cfat nested"
+teardown
+
+# 11. dns exact-name on cfut_: the flat top-level zone resource is preserved, with
+#     no account nesting (user-owned masters accept the flat zone.* shape).
+setup "cfut_master_xyz"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfut_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns cfut keeps flat zone resource" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.zone.*":"*"}' && ok "cfut flat zone resource" || bad "cfut resource not flat: $POSTLINE"
+echo "$POSTLINE" | grep -qF 'account.acc123":{' && bad "cfut wrongly nested under account: $POSTLINE" || ok "cfut not nested under account"
+no_leak "dns cfut flat"
+teardown
+
+# 12. a Cloudflare group rename surfaces as a NAMED miss, not a silent wrong-group
+#     mint: with only decoys present and no exact "DNS Write", the helper dies 1 and
+#     names the exact group it looked for.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "missing exact group fails closed" dns 1
+grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted despite no exact group match" || ok "no mint on missing exact group"
+echo "$ERR" | grep -qF "no permission group named 'DNS Write'" && ok "die names the missing exact group" || bad "die message not named: $ERR"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -41,13 +41,17 @@ fi
 [ -n "$brand" ] || die "cannot derive brand from path; set CF_TOKEN_BRAND"
 
 # Scope table - resolved by case, never inferred.
-legacy=""
+# pages/d1/dns select their permission group by EXACT name (a broad substring once
+# picked "Access: Custom Pages Write" over "Pages Write"); access keeps a regex
+# because it legitimately enumerates duplicate-named candidates and functional-probes.
+legacy=""; names=""; regexes=""; zone_scoped=""
 case "$scope" in
   pages|d1) suffix="pages-d1"; key="CF_PAGES_D1_TOKEN"; legacy="CF_PAGES_TOKEN"
-            # per-group regexes separated by ';' (each may use '|' internally)
-            regexes="pages.*(write|edit);d1.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
+            # exact permission-group names separated by ';'
+            names="Pages Write;D1 Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
   dns)      suffix="dns"; key="CF_DNS_TOKEN"
-            regexes="dns.*(write|edit)"; res='{"com.cloudflare.api.account.zone.*":"*"}';;
+            # zone-scoped: res is set after the master-prefix routing (nesting differs)
+            names="DNS Write"; zone_scoped=1;;
   access)   suffix="access"; key="CF_ACCESS_TOKEN"
             regexes="access.*apps.*polic.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
 esac
@@ -74,9 +78,20 @@ case "$CLOUDFLARE_API_TOKEN" in
      die "unrecognised master token prefix (not cfat_/cfut_); refusing to guess an endpoint";;
 esac
 
+# Zone-scoped resource shape branches by master type. An account-owned (cfat_) master
+# rejects a flat zone.* resource with code 1001 "Must specify a zone for account owned
+# tokens, or nest zone under specific account resource"; nest it under the account.
+# A user-owned (cfut_) master accepts the flat zone.* shape.
+if [ -n "$zone_scoped" ]; then
+  case "$mtag" in
+    cfat) res='{"com.cloudflare.api.account.'"$ACC"'":{"com.cloudflare.api.account.zone.*":"*"}}';;
+    cfut) res='{"com.cloudflare.api.account.zone.*":"*"}';;
+  esac
+fi
+
 api_get() { curl -sS -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" "$1"; }
 
-# Resolve permission-group id(s) by name regex (case-insensitive).
+# Resolve permission-group id(s): access matches by regex, pages/d1/dns by exact name.
 pg_json="$(api_get "${base}/tokens/permission_groups")"
 echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
   code=$(echo "$pg_json" | jq -r '.errors[0].code // "?"')
@@ -85,6 +100,7 @@ echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
 }
 
 collect_ids() { echo "$pg_json" | jq -r --arg re "$1" '.result[] | select(.name|test($re;"i")) | .id'; }
+collect_exact() { echo "$pg_json" | jq -r --arg n "$1" '.result[] | select(.name==$n) | .id'; }
 
 mint_with() { # $1 = json permission_groups array -> echoes minted token value or empty
   local body
@@ -136,12 +152,12 @@ if [ "$scope" = "access" ]; then
 else
   pg_array='[]'
   OLDIFS=$IFS; IFS=';'
-  for rx in $regexes; do
-    id=$(collect_ids "$rx" | head -1)
+  for nm in $names; do
+    id=$(collect_exact "$nm" | head -1)
     [ -n "$id" ] || {
       IFS=$OLDIFS
       echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0" >&2
-      die "no permission group matched /${rx}/"; }
+      die "no permission group named '${nm}'"; }
     pg_array=$(echo "$pg_array" | jq -c --arg id "$id" '. + [{id:$id}]')
   done
   IFS=$OLDIFS

package/payload/platform/plugins/cloudflare/references/api.md

@@ -112,6 +112,8 @@ The master an operator provisions is usually **account-scoped** (`cfat_…`, cre
 
 Cross-type calls fail with a stable, recognizable signal: a `cfat_…` token at `/user/tokens/verify` returns `Invalid API Token`; a `cfut_…` token at any `/accounts/{id}/…` endpoint returns `9109`. The diagnostic is the verify call's JSON `errors[].code`.
 
+The prefix also governs the **resource shape** of a zone-scoped mint body, not just the endpoint. A `cfut_…` master accepts a flat zone resource — `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A `cfat_…` (account-owned) master **rejects** that flat shape with code `1001` ("Must specify a zone for account owned tokens, or nest zone under specific account resource"); it requires the zone resource nested under the account resource — `"resources": { "com.cloudflare.api.account.${ACC}": { "com.cloudflare.api.account.zone.*": "*" } }`. Non-zone scopes (Pages/D1/Access) already scope to `com.cloudflare.api.account.${ACC}` and need no branch.
+
 **Creating** a token stays an account-level, operator-owned concern — each account documents its own master token and its type (e.g. a per-account `secrets/cloudflare.README.md`). Where an account *can* mint an account-scoped token that is the cleaner default; but a skill that merely *consumes* a supplied token must detect the prefix and adapt, never assume it can mint at `/accounts/…`.
 
 ---
@@ -154,7 +156,7 @@ CLOUDFLARE_API_TOKEN="${PAGES_D1}" wrangler pages deploy ./dist --project-name <
 
 No `expires_on`: the per-scope token is permanent and reused, so decay is the job of the **reconcile pass** (§ Reconcile), not a per-token TTL — the old short-TTL guidance was never honored in practice and produced only never-expiring strays. Look up `<pages-edit-permission-group-id>` (and the ids for DNS Edit, D1 Edit, etc.) once via `GET /accounts/{account_id}/tokens/permission_groups`; they are stable per account. Before reusing or before reconciling, `GET …/tokens` (§ Curated endpoint map) shows what already exists, so a scope is never minted twice under different names.
 
-**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, but since it is a single stable token reused across every zone the install routes, its resource covers the account's zones: `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
+**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, and since it is a single stable token reused across every zone the install routes, its resource covers the account's zones — but the exact shape depends on the master's prefix (see § Token type — route endpoints by prefix): a `cfut_…` master takes the flat `"resources": { "com.cloudflare.api.account.zone.*": "*" }`, while a `cfat_…` master requires the zone nested under the account, `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": { "com.cloudflare.api.account.zone.*": "*" } }` (the flat shape returns `1001` on an account-owned master). A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
 
 **Redaction is binding.** Every example above pipes the token into a variable or an `Authorization` header and never to stdout. The agent surfaces the operation as verb + target — "minting a Pages-deploy token", "creating CNAME `chat.example.com`" — never the secret. A failure surfaces the API error body with any `Authorization` value masked.
 

package/payload/platform/plugins/web-designer/skills/web-design/references/placeholders.md

@@ -45,8 +45,25 @@ with a `<strong>lead-in.</strong>`) ·
 `CRAFT_HEADLINE` `CRAFT_PARA_1..3` (the "How we work" block).
 
 The `BUILD_*` / `CRAFT_*` token names are historical; the visible sections read
-**What we do** and **How we work**. Fill them with the business's real offer and
-way of working, in plain language.
+**What we do** and **How we work** by default. Fill them with the business's real
+offer and way of working, in plain language.
+
+## Section framing (nav labels, eyebrows, section IDs) — defaulted
+
+These seven tokens carry the generic framing of the two middle body sections and
+their nav links. **Each defaults to its generic value** below; fill the default
+unless the business is framed differently (for example a construction trade that
+says "What we build" / "Our craft"). The nav label and the eyebrow of a section are
+separate tokens because they need not match.
+
+- `NAV_STORY_LABEL` — the story-section nav label. Default `About`.
+- `NAV_OFFER_LABEL` — the offer-section nav label. Default `What we do`.
+- `NAV_HOW_LABEL` — the process-section nav label. Default `How we work`.
+- `OFFER_EYEBROW` — the offer-section eyebrow. Default `What we do`.
+- `HOW_EYEBROW` — the process-section eyebrow. Default `Start to finish`.
+- `OFFER_SECTION_ID` — the offer section's anchor id (nav `href` + article `id`).
+  Default `offer`.
+- `HOW_SECTION_ID` — the process section's anchor id. Default `how`.
 
 ## Photo alts (grids and full-bleed)
 

package/payload/platform/plugins/web-designer/skills/web-design/templates/index.html

@@ -635,9 +635,9 @@
     <span></span><span></span><span></span>
   </button>
   <div class="left">
-    <a href="#story">About</a>
-    <a href="#offer">What we do</a>
-    <a href="#how">How we work</a>
+    <a href="#story">{{ NAV_STORY_LABEL }}</a>
+    <a href="#{{ OFFER_SECTION_ID }}">{{ NAV_OFFER_LABEL }}</a>
+    <a href="#{{ HOW_SECTION_ID }}">{{ NAV_HOW_LABEL }}</a>
     <a href="#founder">{{ FOUNDER_SECTION_LABEL }}</a>
   </div>
   <div class="center">
@@ -654,9 +654,9 @@
 <div class="drawer" id="drawer" aria-hidden="true">
   <button class="drawer-close" aria-label="Close menu">&times;</button>
   <nav class="drawer-nav">
-    <a href="#story">About</a>
-    <a href="#offer">What we do</a>
-    <a href="#how">How we work</a>
+    <a href="#story">{{ NAV_STORY_LABEL }}</a>
+    <a href="#{{ OFFER_SECTION_ID }}">{{ NAV_OFFER_LABEL }}</a>
+    <a href="#{{ HOW_SECTION_ID }}">{{ NAV_HOW_LABEL }}</a>
     <a href="#founder">{{ FOUNDER_SECTION_LABEL }}</a>
     <a href="#words">Reviews</a>
     <a href="#services">Services</a>
@@ -679,7 +679,7 @@
     <span class="price">{{ SECTOR_LABEL }} · Est. {{ ESTABLISHED_YEAR }}</span>
   </div>
   <div class="right">
-    <a href="#how">How we work</a>
+    <a href="#{{ HOW_SECTION_ID }}">{{ NAV_HOW_LABEL }}</a>
     <a href="#services">Services</a>
     <a href="#words">Reviews</a>
     <a href="mailto:{{ EMAIL }}?subject=Project%20enquiry" class="cta">Get in touch</a>
@@ -713,7 +713,7 @@
       <span>{{ HERO_SPEC_4 }}</span>
     </div>
     <div class="links">
-      <a href="#offer">Our work</a>
+      <a href="#{{ OFFER_SECTION_ID }}">Our work</a>
       <a href="#words">Reviews</a>
       <a href="#services">Services</a>
     </div>
@@ -741,8 +741,8 @@
   </div>
 
   <!-- WHAT WE DO -->
-  <article class="body-block" id="offer">
-    <div class="section-eyebrow">What we do</div>
+  <article class="body-block" id="{{ OFFER_SECTION_ID }}">
+    <div class="section-eyebrow">{{ OFFER_EYEBROW }}</div>
     <h2>{{ BUILD_HEADLINE }}</h2>
     <p>{{ BUILD_PARA_1 }}</p>
     <p>{{ BUILD_PARA_2 }}</p>
@@ -758,8 +758,8 @@
   </div>
 
   <!-- HOW WE WORK -->
-  <article class="body-block" id="how">
-    <div class="section-eyebrow">Start to finish</div>
+  <article class="body-block" id="{{ HOW_SECTION_ID }}">
+    <div class="section-eyebrow">{{ HOW_EYEBROW }}</div>
     <h2>{{ CRAFT_HEADLINE }}</h2>
     <p>{{ CRAFT_PARA_1 }}</p>
     <p>{{ CRAFT_PARA_2 }}</p>

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -50,6 +50,9 @@ const ALLOWLIST = new Set([
   // Same vi.hoisted pattern: Task 576's claude-auth refresh-lock test
   // builds a tmpdir + creds path before the module's `../paths` mock fires.
   'platform/ui/app/lib/__tests__/claude-auth-refresh-lock.test.ts',
+  // Same vi.hoisted pattern: Task 1410's claude-auth atomic-write test
+  // builds a tmpdir + creds path before the module's `../paths` mock fires.
+  'platform/ui/app/lib/__tests__/claude-auth-atomic-write.test.ts',
   // Task 666: the module under test is a pure .cjs preload
   // (server-init-line-stamper.cjs); the test loads it via the sanctioned
   // createRequire(import.meta.url) ESM→CJS bridge, not a raw require.

package/payload/premium-plugins/sitedesk/BUNDLE.md

@@ -1,6 +1,6 @@
 ---
 name: sitedesk
-description: "SiteDesk premium bundle for independent service businesses. Two sub-plugins: sitedesk-media turns an operator's photos, website, social links and notes into a marketing micro-site plus share-ready social tiles; sitedesk-job captures the operator's own pricing/quotation method and applies it to produce the live quote, and issues recurring interim valuations (progress claims) from carried job state with a deterministic roll-up, and rolls up field workers' daily check-ins into per-worker timesheets and CIS invoices. Brand-agnostic — no client content ships in the templates or the pricing/job tree. 7 skills, 0 MCP tools."
+description: "SiteDesk premium bundle for independent service businesses. Two sub-plugins: sitedesk-media turns an operator's photos, website, social links and notes into a marketing micro-site plus share-ready social tiles; sitedesk-job captures the operator's own pricing/quotation method and applies it to produce the live quote, and issues recurring interim valuations (progress claims) from carried job state with a deterministic roll-up, and rolls up field workers' daily check-ins into per-worker timesheets and CIS invoices. Brand-agnostic — no client content ships in the templates or the pricing/job tree. 5 skills, 0 MCP tools."
 plugins:
   - sitedesk-media
   - sitedesk-job
@@ -27,12 +27,14 @@ as `plugin:sitedesk:<name>` — so it contributes four `installedPremiumSpeciali
 entries on any brand that ships `sitedesk`. Each owns one deliverable and the
 skill(s) that produce it: `quoter` owns `quotation`, `valuer` owns `valuation`,
 `payroll-clerk` owns `timesheet` (the three `sitedesk-job` skills), and
-`media-producer` owns the four `sitedesk-media` skills. The admin agent dispatches
-the one whose deliverable matches the brief via `subagent_type`.
+`media-producer` owns the two `sitedesk-media` skills — the construction `microsite`
+wrapper and the `job`/`valuation` `socials` adapter — over the shared `web-designer`
+builder. The admin agent dispatches the one whose deliverable matches the brief via
+`subagent_type`.
 
 ## Sub-Plugins
 
 | Sub-Plugin | Skills | MCP Tools | Focus |
 |---|---|---|---|
-| `sitedesk-media` | 4 | — | Marketing collateral pipeline — brand extract, single-page micro-site, Open Graph + social tiles with gallery and captions. From an operator's photos + website + social links + notes, asking questions to fill every gap. |
+| `sitedesk-media` | 2 | — | Marketing collateral over the shared `web-designer` builder — a construction `microsite` wrapper (web-designer's site with construction framing as input) and a `socials` job/valuation adapter (renders job progress through web-designer's tile core under the money boundary). Generic brand-extract, build, and rendering are web-designer's. |
 | `sitedesk-job` | 3 | — | Job-centric workflows — `quotation` captures the operator's own pricing method (items, quantity rules, pricing rules, roll-up, documents) and applies it to produce the live quote; `valuation` sets up a job and issues its recurring interim valuations (progress claims) from carried state and a per-cycle delta, with a deterministic roll-up that reconciles to the penny; `timesheet` rolls up field workers' daily check-ins into per-worker timesheets and CIS invoices for a period, reconciled to the penny. No business content ships; everything is the operator's data. |

package/payload/premium-plugins/sitedesk/PLUGIN.md

@@ -11,8 +11,8 @@ they appear in the native Claude Code subagent registry as
 `plugin:sitedesk:<name>`. Each owns one deliverable and the skill(s) that
 produce it: `quoter` the `quotation` skill, `valuer` the `valuation` skill,
 `payroll-clerk` the `timesheet` skill (all three in `sitedesk-job`), and
-`media-producer` the `sitedesk-media` skills (`make-media`, `brand-extract`,
-`microsite`, `socials`).
+`media-producer` the two `sitedesk-media` skills (`microsite`, `socials`) over the
+shared `web-designer` builder.
 
 No tools, hooks, or commands are declared at this layer — the sub-plugins under
 `plugins/` register via their own `PLUGIN.md` and carry the skills and commands.

package/payload/premium-plugins/sitedesk/agents/sitedesk--media-producer.md

@@ -1,6 +1,6 @@
 ---
 name: media-producer
-description: "SiteDesk media producer. Delegate when the deliverable is marketing collateral — turning an operator's photos, website, social links and notes into a marketing micro-site plus share-ready social tiles. Owns the whole media pipeline: brand extract, single-page micro-site, and Open Graph plus social tiles with gallery and captions. Not for job pricing, valuations or timesheets (those are the quoter, valuer and payroll-clerk)."
+description: "SiteDesk media producer. Delegate when the deliverable is marketing collateral — turning an operator's photos, website, social links and notes into a construction micro-site plus share-ready social tiles. Owns the media deliverable end to end, built on the shared web-designer builder: brand extract, single-page micro-site with construction framing, and Open Graph plus social tiles with gallery and captions. Not for job pricing, valuations or timesheets (those are the quoter, valuer and payroll-clerk)."
 summary: "Your media producer — turns an operator's photos, website and notes into a marketing micro-site and social tiles."
 model: claude-sonnet-5
 tools: Skill, Read, Write, Edit, Bash, Glob, Grep, WebFetch, mcp__plugin_browser_browser__browser-navigate, mcp__plugin_browser_browser__browser-evaluate, mcp__plugin_browser_browser__browser-render, mcp__plugin_browser_browser__browser-resize, mcp__plugin_browser_browser__browser-screenshot, mcp__plugin_browser_browser__browser-wait-for
@@ -18,16 +18,27 @@ You never invent the operator's business content. Brand facts, copy and the sour
 
 ## What you own
 
-Load each skill on demand with the `Skill` tool; it carries its own method.
+You own two SiteDesk skills — the construction `microsite` wrapper and the
+`socials` job/valuation adapter. The shared builder underneath them is the
+`web-designer` plugin; you drive its skills directly. Load each skill on demand with
+the `Skill` tool; it carries its own method.
 
 | Skill | Sub-plugin | What it does |
 |-------|------------|--------------|
-| `make-media` | `sitedesk-media` | Single-entry orchestrator: intake → ask the gaps → `brand-extract` → `microsite` → `socials`. Use when the deliverable is "a website and social images for this business" from mixed source material. |
-| `brand-extract` | `sitedesk-media` | Turn an existing website into a brand pack — tokenized palette, logo/icon image files, and a `brand.md` of company facts plus an explicit "still unknown" list. |
-| `microsite` | `sitedesk-media` | Build the scrollable single-page micro-site (`site/` directory: `index.html` + `llms.txt`, with JSON-LD) from the placeholder template, brand pack, photos and copy. |
-| `socials` | `sitedesk-media` | Render exact-size Open Graph and social tiles (1200×628, 1200×1200, 1080×1350) as PNG for a named subject, with a PII gate for any client-data source, a gallery with download links, captions for all five platforms, and a redaction report; wires the site's `og:image` for micro-sites. Drives the on-device `browser` plugin to screenshot each tile at its exact viewport. |
+| `microsite` | `sitedesk-media` | Build the construction micro-site by driving `web-designer:web-design` with the construction framing (schema, UK geography, the trade-shaped section labels) as inputs. Owns no template. |
+| `socials` | `sitedesk-media` | Render social tiles for a SiteDesk subject. `microsite`/`bespoke` delegate to `web-designer:socials`; `job`/`valuation` read the job's progress under the money boundary and render through `web-designer:socials` bespoke mode. |
 
-When the operator asks for the full marketing deliverable, run `make-media` — it orchestrates the other three. Run the individual media skills directly only when the upstream output already exists.
+The generic builder underneath is web-designer's, dispatched directly:
+
+| Skill | Plugin | What it does |
+|-------|--------|--------------|
+| `brand-extract` | `web-designer` | Turn an existing website into a brand pack — tokenized palette, logo/icon files, and a `brand.md` of company facts plus a "still unknown" list. |
+| `web-design` | `web-designer` | The single canonical single-page site template, substitution contract, image convention, and page-state verification. `microsite` supplies the construction inputs. |
+| `socials` | `web-designer` | The tile render core (exact-size PNG tiles, gallery, captions, PII gate, og:image wiring). SiteDesk's `socials` delegates here. |
+
+For the full marketing deliverable — a site and its social tiles — orchestrate the
+steps yourself: `web-designer:brand-extract` → `microsite` → `socials`. Run any one
+skill directly when the upstream output already exists.
 
 ## Output contract
 

package/payload/premium-plugins/sitedesk/plugins/sitedesk-media/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sitedesk-media",
-  "description": "Turn an operator's raw inputs (a folder or zip of photos, an existing website URL, social-media links, and any notes about the business) into a finished marketing micro-site plus a set of share-ready Open Graph and social tiles. A single-entry orchestrator extracts the brand, asks the operator targeted questions to fill every gap, builds a scrollable single-page site (hero rotator, story, founder section, testimonial, services, FAQ, AEO/JSON-LD), then renders the social tiles with a gallery and captions. Brand-agnostic: all copy and tokens live as placeholders in the templates.",
+  "description": "Turn an operator's raw inputs (a folder or zip of photos, an existing website URL, social-media links, and any notes about the business) into a finished construction micro-site plus a set of share-ready Open Graph and social tiles. Built on the shared web-designer builder: web-designer extracts the brand, builds the single-page site, and renders the tiles; SiteDesk supplies the construction framing and the job/valuation social subjects. Brand-agnostic: no client content ships here, and no builder template is copied.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/premium-plugins/sitedesk/plugins/sitedesk-media/PLUGIN.md

@@ -1,49 +1,53 @@
 ---
 name: sitedesk-media
-description: "Turn an operator's raw inputs (a folder or zip of photos, an existing website URL, social-media links, and any notes about the business) into a finished marketing micro-site plus a set of share-ready Open Graph and social tiles. A single-entry orchestrator extracts the brand, asks the operator targeted questions to fill every gap, builds a scrollable single-page site (hero rotator, story, founder section, testimonial, services, FAQ, AEO/JSON-LD), then renders the social tiles with a gallery and captions. Brand-agnostic: all copy and tokens live as placeholders in the templates."
+description: "Turn an operator's raw inputs (a folder or zip of photos, an existing website URL, social-media links, and any notes about the business) into a finished construction micro-site plus a set of share-ready Open Graph and social tiles. Built on the shared web-designer builder: web-designer extracts the brand, builds the single-page site, and renders the tiles; SiteDesk supplies the construction framing and the job/valuation social subjects. Brand-agnostic: no client content ships here, and no builder template is copied."
 tools: []
 metadata: {"platform":{"optional":true,"embed":["admin"]}}
 ---
 
 # SiteDesk — Media
 
-End-to-end marketing-collateral pipeline. From an operator's photos, their
-existing website, social links and any notes, the skills produce a self-contained
-`site/` directory — a scrollable single-page micro-site (`index.html` + `llms.txt`)
-plus a `socials/` folder of Open Graph and social tiles with a gallery and
-captions. The agent extracts the brand, then asks the operator to fill every gap;
-it never invents a fact.
+Marketing collateral for an independent building contractor, built on the shared
+`web-designer` plugin. From an operator's photos, their existing website, social
+links and any notes, the pipeline produces a self-contained `site/` directory — a
+scrollable single-page micro-site (`index.html` + `llms.txt`) plus a `socials/`
+folder of Open Graph and social tiles with a gallery and captions. web-designer owns
+the brand extraction, the site template, and the tile render core; SiteDesk owns the
+construction framing and the job/valuation social subjects. The agent never invents a
+fact — it extracts and asks.
 
 ## When to Activate
 
-The operator wants a website and social images for a service business, built from
-mixed source material (photos + a site + social links + notes).
+The operator wants a construction micro-site and social images for a building firm,
+built from mixed source material (photos + a site + social links + notes), or social
+tiles for a live job's progress.
 
 ## Skills
 
 | Skill | Purpose |
 |-------|---------|
-| `make-media` | Single-entry orchestrator — intake → ask the gaps → brand-extract → microsite → socials |
-| `brand-extract` | Pull a tokenized palette, logo/icon, and company facts (plus an explicit "still unknown" list) from an existing website |
-| `microsite` | Build the scrollable single-page site from the placeholder template + brand + photos + answers |
-| `socials` | Render exact-size Open Graph + social tiles (PNG) and captions for a named subject — micro-site, job, valuation, or bespoke — with a PII gate for client-data sources; gallery + redaction report; wires og:image for micro-sites |
+| `microsite` | Build the construction micro-site by driving `web-designer:web-design` with the construction framing (schema, UK geography, trade-shaped section labels) as inputs. Owns no template. |
+| `socials` | Render social tiles for a SiteDesk subject. `microsite`/`bespoke` delegate to `web-designer:socials`; `job`/`valuation` read the job's progress under the money boundary and render through `web-designer:socials` bespoke mode. |
+
+The generic builder — `brand-extract`, the `web-design` template and substitution
+contract, and the `socials` tile render core — is the `web-designer` plugin's, used
+as-is.
 
 ## Commands
 
-`/make-media <images-dir-or-zip> [website-url] [social-links] [notes…]` — run the full pipeline.
+`/make-media <images-dir-or-zip> [website-url] [social-links] [notes…]` — orchestrate
+the full pipeline (`web-designer:brand-extract` → `microsite` → `socials`).
 
 ## Tools Used
 
 No MCP server of its own. Skills operate via existing platform tools (Bash, Read,
-Write, Edit, Glob, Grep, WebFetch). Tile rendering uses the on-device `browser`
-plugin (Chrome DevTools Protocol): it sets the viewport and screenshots each tile at
-its exact size against the device's running Chromium — no Playwright ships on a Pi.
-The image encoder for site photos is `cwebp` (libwebp); the browser plugin writes
-tiles as PNG.
-
-## Templates
-
-All copy and colour are placeholders — no client data ships in the templates.
-The token dictionary is in `skills/microsite/references/placeholders.md`; the
-section + image map is in `skills/microsite/references/sections.md`; the operator
-question set is in `skills/make-media/references/intake-and-questions.md`.
+Write, Edit, Glob, Grep, WebFetch) and the `Skill` tool to drive the web-designer
+skills. Tile rendering is web-designer's, which drives the on-device `browser` plugin
+to screenshot each tile at its exact size.
+
+## No templates ship here
+
+The site template, the placeholder dictionary, the section + image map, and the tile
+render templates all live in `web-designer`. SiteDesk's `microsite` supplies the
+construction values as inputs; SiteDesk's `socials` keeps only the `job`/`valuation`
+source contract in `skills/socials/references/sources.md`.

package/payload/premium-plugins/sitedesk/plugins/sitedesk-media/README.md

@@ -1,19 +1,19 @@
 # sitedesk-media
 
 Turn an operator's raw inputs — a folder of photos, an existing website, social
-links, and any notes about the business — into a finished marketing **micro-site**
-plus a set of **share-ready social tiles**. The agent extracts the brand, asks the
-operator targeted questions to fill every gap, then builds the site and the social
-collateral. All copy and colour live as placeholders in the templates, so the
-pipeline is brand-agnostic.
+links, and any notes about the business — into a finished construction **micro-site**
+plus a set of **share-ready social tiles**. Built on the shared `web-designer`
+plugin: web-designer extracts the brand, builds the single-page site, and renders the
+tiles; SiteDesk adds the construction framing and the job/valuation social subjects.
+No client content and no builder template ship here.
 
 ## Pipeline
 
 ```
-make-media  (orchestrator: intake → ask the gaps → route the steps)
-  ├─ brand-extract   website → palette tokens + logo/icon + company facts (+ gaps)
-  ├─ microsite       templates + brand + photos + answers → site/index.html + llms.txt
-  └─ socials         resolved subject → og/social tiles (PNG) + gallery + captions
+/make-media  (media-producer orchestrates the steps)
+  ├─ web-designer:brand-extract   website → palette tokens + logo/icon + company facts (+ gaps)
+  ├─ microsite                    drives web-designer:web-design with construction framing → site/index.html + llms.txt
+  └─ socials                      microsite/bespoke → web-designer:socials; job/valuation → staged brief → web-designer:socials bespoke
 ```
 
 Run it with the command:
@@ -22,9 +22,8 @@ Run it with the command:
 /make-media <images-dir-or-zip> [website-url] [social-links] [notes…]
 ```
 
-or invoke the `make-media` skill directly. Each sub-skill is also usable on its
-own (`brand-extract` for just tokens + logo; `microsite` for just the page;
-`socials` for just the tiles).
+Each step is also usable on its own (`web-designer:brand-extract` for just tokens +
+logo; `microsite` for just the page; `socials` for just the tiles).
 
 ## What you get
 
@@ -36,35 +35,26 @@ own (`brand-extract` for just tokens + logo; `microsite` for just the page;
   socials.html    # tile gallery + OG meta snippet
   social-posts.md # captions per tile and platform
   og.html         # tile render page (kept for re-runs)
-<output>/<brand-slug>-microsite.zip
 ```
 
 ## Principles
 
-- **Ask, never invent.** Every placeholder is a fact about a real business. What
-  the website and the operator's notes don't supply, the agent asks for. A guessed
-  year, phone number, or testimonial is a defect.
-- **Keep claims as claims.** "Trading since 1987" is not an incorporation date;
-  "over 35 years" is not a company age. Company-registration facts come from the
-  register or the operator, never a marketing line.
-- **Verify images by eye, name by convention.** Photos are matched to slots by
-  content (never filename), optimised to webp, and a person is only ever shown in
-  the founder slots and a portrait-only tile.
+- **Ask, never invent.** Every fact is about a real business. What the website and
+  the operator's notes don't supply, the agent asks for. A guessed year, phone
+  number, or testimonial is a defect.
+- **Keep claims as claims.** "Trading since 1987" is not an incorporation date.
+  Company-registration facts come from the register or the operator, never a
+  marketing line.
+- **The money boundary is absolute.** A job or valuation tile carries the progress,
+  never a figure: no contract, valuation, or payment amount, no `pctComplete` value,
+  no client identifier. The read never touches the money fields.
 - **Plain register for all copy.** No em-dashes, no inflation vocabulary, no
   AI-marketing cadence. Real testimonials are used verbatim.
-- **Built for answer engines.** The site ships `JSON-LD` (business + FAQ),
-  Open Graph tiles, and an `llms.txt`.
 
-## Templates (all placeholder, no client data)
+## What lives where
 
-```
-skills/microsite/templates/index.html     # the single-page site
-skills/microsite/templates/llms.txt
-skills/socials/templates/og.html           # tile render page
-skills/socials/templates/socials.html
-skills/socials/templates/social-posts.md
-```
-
-The full token dictionary is in `skills/microsite/references/placeholders.md`; the
-section + image map is in `skills/microsite/references/sections.md`; the operator
-question set is in `skills/make-media/references/intake-and-questions.md`.
+SiteDesk owns two thin skills — `skills/microsite/SKILL.md` (the construction
+wrapper) and `skills/socials/SKILL.md` plus `skills/socials/references/sources.md`
+(the job/valuation source contract and the money boundary). Everything else — the
+site template, the placeholder dictionary, the section + image map, and the tile
+render templates — is `web-designer`'s.