@rubytech/create-sitedesk-code 0.1.451 → 0.1.453

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/dist/lib/render-run.js

@@ -10,6 +10,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { gateReconcile, gateMarginLeak, gateSignLink } from "./gates.js";
+import { writeRenderReceipt } from "./render-receipt.js";
 export async function runRender(a) {
     if (!existsSync(a.renderScriptPath)) {
         return { ok: false, reason: "render-absent", detail: `no render script at ${a.renderScriptPath}` };
@@ -62,10 +63,30 @@ export async function runRender(a) {
     const recQuote = gateReconcile(html.quote, engineTotal);
     const leakBreakdown = gateMarginLeak(html.breakdown);
     const leakQuote = gateMarginLeak(html.quote);
-    const signLink = gateSignLink(html.quote);
+    // E-sign is opt-in. The Sign-Online acceptance block and its link-liveness
+    // gate apply only when the operator supplied a signUrl for this job. On the
+    // default (no-signer) path the client quote must carry no acceptance anchor;
+    // a stray one is a dead/placeholder button and fails closed the same way a
+    // margin leak does. gateSignLink returns reason "no-anchor" exactly when the
+    // marked anchor is absent, so anchor-present is `reason !== "no-anchor"`.
+    const esignRequested = typeof a.signUrl === "string" && a.signUrl.length > 0;
+    const signVerdict = gateSignLink(html.quote);
+    const hasAnchor = signVerdict.reason !== "no-anchor";
+    let signOk;
+    let signDetail;
+    if (esignRequested) {
+        signOk = signVerdict.pass;
+        signDetail = `quote Sign-Online link ${signVerdict.reason} (href=${signVerdict.href ?? ""})`;
+    }
+    else {
+        signOk = !hasAnchor;
+        signDetail = "quote carries a Sign-Online acceptance anchor but no signer was requested (no signUrl) — e-sign is opt-in";
+    }
+    // The verdict is reported only when a signer was requested; null otherwise.
+    const signLink = esignRequested ? signVerdict : null;
     const internalOk = recInternal.pass;
     const breakdownOk = recBreakdown.pass && leakBreakdown.pass;
-    const quoteOk = recQuote.pass && leakQuote.pass && signLink.pass;
+    const quoteOk = recQuote.pass && leakQuote.pass && signOk;
     if (!internalOk || !breakdownOk || !quoteOk) {
         // Reason names the first failing gate, in document then gate order.
         let reason;
@@ -92,7 +113,7 @@ export async function runRender(a) {
         }
         else {
             reason = "sign-link";
-            detail = `quote Sign-Online link ${signLink.reason} (href=${signLink.href ?? ""})`;
+            detail = signDetail;
         }
         return { ok: false, reason, detail };
     }
@@ -103,6 +124,16 @@ export async function runRender(a) {
         mkdirSync(dirname(p), { recursive: true });
         writeFileSync(p, body);
     }
+    // Only now — every gate passed and all three docs filed — record the durable
+    // receipt. The delivery gate reads it to prove a real render produced this
+    // job's client quote; a fail-closed render above returned before this point,
+    // so an un-rendered job has no receipt.
+    writeRenderReceipt(a.accountDir, {
+        jobId: a.jobId,
+        engineTotal,
+        filed: { internal: internalPath, breakdown: breakdownPath, quote: quotePath },
+        renderedAt: new Date().toISOString(),
+    });
     return {
         ok: true,
         docs: { internal: internalPath, breakdown: breakdownPath, quote: quotePath },

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/dist/lib/render-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-run.js","sourceRoot":"","sources":["../../src/lib/render-run.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,iFAAiF;AAEjF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAwB,MAAM,YAAY,CAAC;AAuB/F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAgB;IAC9C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,OAAO,CAA0D,CAAC,OAAO,EAAE,EAAE;QACtH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzE,2EAA2E;QAC3E,8EAA8E;QAC9E,0EAA0E;QAC1E,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvH,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;QACtD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;QAC5H,CAAC;QACD,IAAI,GAAG,MAAiB,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,+BAA+B,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACrH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAI,CAAC,CAAC,OAAO,CAAC,MAAyC,EAAE,KAAK,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC1H,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,yBAAyB;IACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,gEAAgE,KAAK,EAAE,EAAE,CAAC;IAChI,CAAC;IAED,+EAA+E;IAC/E,yCAAyC;IACzC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;IAEjE,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,oEAAoE;QACpE,IAAI,MAAmB,CAAC;QACxB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,kBAAkB,WAAW,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACzH,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,mBAAmB,YAAY,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACjI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,aAAa,CAAC;YAAC,MAAM,GAAG,sCAAsC,CAAC;QAAC,CAAC;aACrG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,eAAe,QAAQ,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACrH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,aAAa,CAAC;YAAC,MAAM,GAAG,kCAAkC,CAAC;QAAC,CAAC;aAC7F,CAAC;YAAC,MAAM,GAAG,WAAW,CAAC;YAAC,MAAM,GAAG,0BAA0B,QAAQ,CAAC,MAAM,UAAU,QAAQ,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC;QAAC,CAAC;QAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC3G,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAU,EAAE,CAAC;QAC3H,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE;QAC5E,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"render-run.js","sourceRoot":"","sources":["../../src/lib/render-run.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,iFAAiF;AAEjF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAwB,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAyBzD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAgB;IAC9C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,OAAO,CAA0D,CAAC,OAAO,EAAE,EAAE;QACtH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzE,2EAA2E;QAC3E,8EAA8E;QAC9E,0EAA0E;QAC1E,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvH,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;QACtD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;QAC5H,CAAC;QACD,IAAI,GAAG,MAAiB,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,+BAA+B,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACrH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAI,CAAC,CAAC,OAAO,CAAC,MAAyC,EAAE,KAAK,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAC1H,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,yBAAyB;IACzB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,gEAAgE,KAAK,EAAE,EAAE,CAAC;IAChI,CAAC;IAED,+EAA+E;IAC/E,yCAAyC;IACzC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,UAAkB,CAAC;IACvB,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAC1B,UAAU,GAAG,0BAA0B,WAAW,CAAC,MAAM,UAAU,WAAW,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,CAAC,SAAS,CAAC;QACpB,UAAU,GAAG,2GAA2G,CAAC;IAC3H,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAA2B,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7E,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC;IAE1D,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,oEAAoE;QACpE,IAAI,MAAmB,CAAC;QACxB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,kBAAkB,WAAW,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACzH,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,mBAAmB,YAAY,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACjI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,aAAa,CAAC;YAAC,MAAM,GAAG,sCAAsC,CAAC;QAAC,CAAC;aACrG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,eAAe,QAAQ,CAAC,KAAK,cAAc,WAAW,EAAE,CAAC;QAAC,CAAC;aACrH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,aAAa,CAAC;YAAC,MAAM,GAAG,kCAAkC,CAAC;QAAC,CAAC;aAC7F,CAAC;YAAC,MAAM,GAAG,WAAW,CAAC;YAAC,MAAM,GAAG,UAAU,CAAC;QAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC;IAC3G,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAU,EAAE,CAAC;QAC3H,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,wCAAwC;IACxC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW;QACX,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE;QAC7E,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE;QAC5E,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/dist/tools/quote-render.js

@@ -11,7 +11,7 @@ import { resolveAccountDir } from "../lib/account.js";
 import { runRender } from "../lib/render-run.js";
 import { logLine } from "../lib/log.js";
 export function registerQuoteRender(server) {
-    lifelineTool(server, "quote-render", "Turn engine figures into the three reconciling HTML documents (internal margin view, client breakdown, client quote) via the operator's persisted quoting/render.mjs, enforcing three gates — reconcile (displayed total == engine total), margin-leak (no cost/margin in client docs), link-liveness (the client quote's Sign-Online href is absolute https). Files each doc by scope and returns the HTML paths. HTML only; print the PDFs with the browser plugin's browser-pdf-save. A gate failure files nothing.", {
+    lifelineTool(server, "quote-render", "Turn engine figures into the three reconciling HTML documents (internal margin view, client breakdown, client quote) via the operator's persisted quoting/render.mjs, enforcing reconcile (displayed total == engine total) and margin-leak (no cost/margin in client docs) always, plus link-liveness only when a signUrl is supplied (online acceptance is opt-in: with signUrl the client quote's Sign-Online href must be absolute https; without it the quote must carry no acceptance anchor). Files each doc by scope and returns the HTML paths. HTML only; print the PDFs with the browser plugin's browser-pdf-save. A gate failure files nothing.", {
         jobId: z.string().describe("Correlation id; figures load from quoting/jobs/<jobId>/figures.json unless figures is supplied inline."),
         figures: z.record(z.any()).optional().describe("Inline figures (overrides the persisted figures.json) — for fixed-figure render parity."),
         signUrl: z.string().optional().describe("The deployed e-sign signing URL injected into the client quote's acceptance anchor. Absent or non-https fails the link-liveness gate."),

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/dist/tools/quote-render.js.map

@@ -1 +1 @@
-{"version":3,"file":"quote-render.js","sourceRoot":"","sources":["../../src/tools/quote-render.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,iFAAiF;AACjF,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,YAAY,CACV,MAAM,EACN,cAAc,EACd,wfAAwf,EACxf;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;QACpI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yFAAyF,CAAC;QACzI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uIAAuI,CAAC;QAChL,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;KAC7H,EACD,KAAK,EAAE,MAA+B,EAAE,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAKpE,CAAC;QACF,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,4DAA4D,CAAC;YAC5E,OAAO,CAAC,iCAAiC,KAAK,qCAAqC,MAAM,EAAE,CAAC,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5I,CAAC;QAED,IAAI,OAAgC,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,iBAAiB,WAAW,+BAA+B,CAAC;gBAC3E,OAAO,CAAC,iCAAiC,KAAK,iCAAiC,MAAM,EAAE,CAAC,CAAC;gBACzF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,CAAC,iCAAiC,KAAK,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnJ,CAAC;QAED,OAAO,CAAC,kCAAkC,KAAK,oBAAoB,CAAC,CAAC,SAAS,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACzJ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"quote-render.js","sourceRoot":"","sources":["../../src/tools/quote-render.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,iFAAiF;AACjF,wDAAwD;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,YAAY,CACV,MAAM,EACN,cAAc,EACd,8nBAA8nB,EAC9nB;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;QACpI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yFAAyF,CAAC;QACzI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uIAAuI,CAAC;QAChL,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;KAC7H,EACD,KAAK,EAAE,MAA+B,EAAE,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAKpE,CAAC;QACF,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,4DAA4D,CAAC;YAC5E,OAAO,CAAC,iCAAiC,KAAK,qCAAqC,MAAM,EAAE,CAAC,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5I,CAAC;QAED,IAAI,OAAgC,CAAC;QACrC,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,iBAAiB,WAAW,+BAA+B,CAAC;gBAC3E,OAAO,CAAC,iCAAiC,KAAK,iCAAiC,MAAM,EAAE,CAAC,CAAC;gBACzF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,CAAC,iCAAiC,KAAK,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnJ,CAAC;QAED,OAAO,CAAC,kCAAkC,KAAK,oBAAoB,CAAC,CAAC,SAAS,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACzJ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/render-run.test.ts

@@ -1,8 +1,9 @@
 import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readdirSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { runRender } from "../render-run.js";
+import { receiptPath } from "../render-receipt.js";
 
 // Fixture render scripts simulating the operator's own quoting/render.mjs: read
 // {figures, signUrl}, emit the three HTML docs. Brand/layout is theirs; the tool
@@ -41,6 +42,23 @@ process.stdin.on("end", () => {
 // is sub-penny → the doc shows the penny total, the engine total is sub-penny
 const SUBPENNY = GOOD.replace("const t = figures.total;", "const t = figures.total.toFixed(2);");
 const THROW = `process.stdin.resume(); process.exit(1);`;
+// A conforming render script for the default (no-signer) path: it emits the
+// Sign-Online acceptance anchor only when a signUrl is supplied, and omits it
+// entirely otherwise. e-sign is opt-in.
+const NOSIGNER = `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures, signUrl } = JSON.parse(input);
+  const t = figures.total;
+  const accept = signUrl ? ('<a data-esign-accept href="' + signUrl + '">Sign online</a>') : '';
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><td data-internal-only>cost 900</td><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    quote: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p>' + accept + '</body></html>',
+  }));
+});
+`;
 
 let dir: string;
 const figures = { total: 1250, header: { phone: "44700900000" }, lines: [] };
@@ -56,6 +74,7 @@ beforeAll(() => {
   writeFileSync(join(dir, "quoting", "render-wrongtotal.mjs"), WRONGTOTAL);
   writeFileSync(join(dir, "quoting", "render-subpenny.mjs"), SUBPENNY);
   writeFileSync(join(dir, "quoting", "render-throw.mjs"), THROW);
+  writeFileSync(join(dir, "quoting", "render-nosigner.mjs"), NOSIGNER);
 });
 afterAll(() => rmSync(dir, { recursive: true, force: true }));
 const rs = (n: string) => join(dir, "quoting", n);
@@ -66,12 +85,57 @@ describe("runRender — happy path files all three docs to their scopes", () =>
     expect(r.ok).toBe(true);
     if (!r.ok) return;
     expect(r.reconcile).toEqual({ internal: true, breakdown: true, quote: true });
-    expect(r.signLink.pass).toBe(true);
+    expect(r.signLink?.pass).toBe(true);
     expect(r.docs.internal).toBe(join(dir, "memory/admin/customers/44700900000/quote-job-1-internal.html"));
     expect(r.docs.breakdown).toBe(join(dir, "memory/users/44700900000/documents/quote-job-1-breakdown.html"));
     expect(r.docs.quote).toBe(join(dir, "memory/users/44700900000/documents/quote-job-1.html"));
     expect(existsSync(r.docs.internal) && existsSync(r.docs.breakdown) && existsSync(r.docs.quote)).toBe(true);
   });
+
+  it("writes a durable render receipt keyed on the jobId, recording the engine total and the filed client-doc paths", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render.mjs"), figures, signUrl, jobId: "job-receipt" });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    const rp = receiptPath(dir, "job-receipt");
+    expect(rp).toBe(join(dir, "quoting/jobs/job-receipt/render-receipt.json"));
+    expect(existsSync(rp)).toBe(true);
+    const receipt = JSON.parse(readFileSync(rp, "utf8"));
+    expect(receipt.jobId).toBe("job-receipt");
+    expect(receipt.engineTotal).toBe(1250);
+    expect(receipt.filed.breakdown).toBe(r.docs.breakdown);
+    expect(receipt.filed.quote).toBe(r.docs.quote);
+    expect(typeof receipt.renderedAt).toBe("string");
+    expect(Number.isNaN(Date.parse(receipt.renderedAt))).toBe(false);
+  });
+});
+
+describe("runRender — e-sign is opt-in; the sign-link gate applies only when a signer is requested", () => {
+  it("files all three docs when no signer is requested and the quote carries no acceptance anchor", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-nosigner.mjs"), figures, jobId: "job-nosigner" });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.reconcile).toEqual({ internal: true, breakdown: true, quote: true });
+    // No signer requested → no sign-link verdict on the result.
+    expect(r.signLink).toBeNull();
+    expect(existsSync(join(dir, "memory/users/44700900000/documents/quote-job-nosigner.html"))).toBe(true);
+    expect(existsSync(receiptPath(dir, "job-nosigner"))).toBe(true);
+  });
+  it("still enforces the sign-link gate on the opt-in path when a signUrl is supplied", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-nosigner.mjs"), figures, signUrl, jobId: "job-optin" });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.signLink?.pass).toBe(true);
+    expect(r.signLink?.href).toBe(signUrl);
+  });
+  it("rejects a stray acceptance anchor when no signer was requested (fail-closed, nothing filed)", async () => {
+    // GOOD always injects the anchor; with no signUrl that is a stray/placeholder signer.
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render.mjs"), figures, jobId: "job-stray" });
+    expect(r).toMatchObject({ ok: false, reason: "sign-link" });
+    if (r.ok) return;
+    expect(r.detail).toMatch(/no signer|opt-in/i);
+    expect(existsSync(join(dir, "memory/users/44700900000/documents/quote-job-stray.html"))).toBe(false);
+    expect(existsSync(receiptPath(dir, "job-stray"))).toBe(false);
+  });
 });
 
 describe("runRender — a failing gate is fail-closed and atomic (no doc filed)", () => {
@@ -79,6 +143,8 @@ describe("runRender — a failing gate is fail-closed and atomic (no doc filed)"
     const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-leak.mjs"), figures, signUrl, jobId: "job-leak" });
     expect(r).toMatchObject({ ok: false, reason: "margin-leak" });
     expect(existsSync(join(dir, "memory/users/44700900000/documents/quote-job-leak.html"))).toBe(false);
+    // A fail-closed render files no receipt — the gate must treat this job as un-rendered.
+    expect(existsSync(receiptPath(dir, "job-leak"))).toBe(false);
   });
   it("sign-link when the client quote's acceptance href is dead", async () => {
     const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-deadlink.mjs"), figures, signUrl, jobId: "job-dead" });

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/render-receipt.ts

@@ -0,0 +1,36 @@
+// The durable render receipt — the queryable proof that quote-render actually
+// ran the deterministic path for a job. quote-render logs `op=render` to stderr
+// (journald), which no deterministic gate can read; the receipt is the on-disk
+// record the browser-pdf-save bypass gate checks before it lets a client-quote
+// PDF ship. One receipt per jobId, written only after every gate passed and all
+// three documents filed — a fail-closed render writes none, so the gate treats
+// that job as un-rendered.
+//
+// The path convention (quoting/jobs/<jobId>/render-receipt.json, next to the
+// job's figures.json) is mirrored verbatim in the gate hook
+// (platform/plugins/admin/hooks/quote-render-gate.sh); the two must agree.
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+export interface RenderReceipt {
+  jobId: string;
+  engineTotal: number;
+  filed: { internal: string; breakdown: string; quote: string };
+  renderedAt: string;
+}
+
+/** The receipt path for a job, relative to the account workspace root. */
+export function receiptPath(accountDir: string, jobId: string): string {
+  return join(accountDir, "quoting", "jobs", jobId, "render-receipt.json");
+}
+
+/** Write the receipt for a successful render. Called only after all gates pass
+ *  and the three documents are filed, so its presence is the "a real render ran
+ *  for this job" signal the delivery gate keys on. */
+export function writeRenderReceipt(accountDir: string, receipt: RenderReceipt): string {
+  const p = receiptPath(accountDir, receipt.jobId);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(receipt, null, 2));
+  return p;
+}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/render-run.ts

@@ -11,6 +11,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { gateReconcile, gateMarginLeak, gateSignLink, type SignLinkVerdict } from "./gates.js";
+import { writeRenderReceipt } from "./render-receipt.js";
 
 export type RenderFault = "render-absent" | "render-error" | "reconcile-fail" | "margin-leak" | "sign-link";
 
@@ -27,7 +28,9 @@ export type RenderResult =
       ok: true;
       docs: { internal: string; breakdown: string; quote: string };
       reconcile: { internal: boolean; breakdown: boolean; quote: boolean };
-      signLink: SignLinkVerdict;
+      // The link-liveness verdict, or null when e-sign was not requested for
+      // this job (no signUrl) — the default, signer-less quote.
+      signLink: SignLinkVerdict | null;
     }
   | { ok: false; reason: RenderFault; detail: string };
 
@@ -89,11 +92,31 @@ export async function runRender(a: RunRenderArgs): Promise<RenderResult> {
   const recQuote = gateReconcile(html.quote, engineTotal);
   const leakBreakdown = gateMarginLeak(html.breakdown);
   const leakQuote = gateMarginLeak(html.quote);
-  const signLink = gateSignLink(html.quote);
+
+  // E-sign is opt-in. The Sign-Online acceptance block and its link-liveness
+  // gate apply only when the operator supplied a signUrl for this job. On the
+  // default (no-signer) path the client quote must carry no acceptance anchor;
+  // a stray one is a dead/placeholder button and fails closed the same way a
+  // margin leak does. gateSignLink returns reason "no-anchor" exactly when the
+  // marked anchor is absent, so anchor-present is `reason !== "no-anchor"`.
+  const esignRequested = typeof a.signUrl === "string" && a.signUrl.length > 0;
+  const signVerdict = gateSignLink(html.quote);
+  const hasAnchor = signVerdict.reason !== "no-anchor";
+  let signOk: boolean;
+  let signDetail: string;
+  if (esignRequested) {
+    signOk = signVerdict.pass;
+    signDetail = `quote Sign-Online link ${signVerdict.reason} (href=${signVerdict.href ?? ""})`;
+  } else {
+    signOk = !hasAnchor;
+    signDetail = "quote carries a Sign-Online acceptance anchor but no signer was requested (no signUrl) — e-sign is opt-in";
+  }
+  // The verdict is reported only when a signer was requested; null otherwise.
+  const signLink: SignLinkVerdict | null = esignRequested ? signVerdict : null;
 
   const internalOk = recInternal.pass;
   const breakdownOk = recBreakdown.pass && leakBreakdown.pass;
-  const quoteOk = recQuote.pass && leakQuote.pass && signLink.pass;
+  const quoteOk = recQuote.pass && leakQuote.pass && signOk;
 
   if (!internalOk || !breakdownOk || !quoteOk) {
     // Reason names the first failing gate, in document then gate order.
@@ -104,7 +127,7 @@ export async function runRender(a: RunRenderArgs): Promise<RenderResult> {
     else if (!leakBreakdown.pass) { reason = "margin-leak"; detail = "breakdown carries data-internal-only"; }
     else if (!recQuote.pass) { reason = "reconcile-fail"; detail = `quote total ${recQuote.shown} != engine ${engineTotal}`; }
     else if (!leakQuote.pass) { reason = "margin-leak"; detail = "quote carries data-internal-only"; }
-    else { reason = "sign-link"; detail = `quote Sign-Online link ${signLink.reason} (href=${signLink.href ?? ""})`; }
+    else { reason = "sign-link"; detail = signDetail; }
     return { ok: false, reason, detail };
   }
 
@@ -116,6 +139,17 @@ export async function runRender(a: RunRenderArgs): Promise<RenderResult> {
     writeFileSync(p, body);
   }
 
+  // Only now — every gate passed and all three docs filed — record the durable
+  // receipt. The delivery gate reads it to prove a real render produced this
+  // job's client quote; a fail-closed render above returned before this point,
+  // so an un-rendered job has no receipt.
+  writeRenderReceipt(a.accountDir, {
+    jobId: a.jobId,
+    engineTotal,
+    filed: { internal: internalPath, breakdown: breakdownPath, quote: quotePath },
+    renderedAt: new Date().toISOString(),
+  });
+
   return {
     ok: true,
     docs: { internal: internalPath, breakdown: breakdownPath, quote: quotePath },

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/tools/quote-render.ts

@@ -17,7 +17,7 @@ export function registerQuoteRender(server: McpServer): void {
   lifelineTool(
     server,
     "quote-render",
-    "Turn engine figures into the three reconciling HTML documents (internal margin view, client breakdown, client quote) via the operator's persisted quoting/render.mjs, enforcing three gates — reconcile (displayed total == engine total), margin-leak (no cost/margin in client docs), link-liveness (the client quote's Sign-Online href is absolute https). Files each doc by scope and returns the HTML paths. HTML only; print the PDFs with the browser plugin's browser-pdf-save. A gate failure files nothing.",
+    "Turn engine figures into the three reconciling HTML documents (internal margin view, client breakdown, client quote) via the operator's persisted quoting/render.mjs, enforcing reconcile (displayed total == engine total) and margin-leak (no cost/margin in client docs) always, plus link-liveness only when a signUrl is supplied (online acceptance is opt-in: with signUrl the client quote's Sign-Online href must be absolute https; without it the quote must carry no acceptance anchor). Files each doc by scope and returns the HTML paths. HTML only; print the PDFs with the browser plugin's browser-pdf-save. A gate failure files nothing.",
     {
       jobId: z.string().describe("Correlation id; figures load from quoting/jobs/<jobId>/figures.json unless figures is supplied inline."),
       figures: z.record(z.any()).optional().describe("Inline figures (overrides the persisted figures.json) — for fixed-figure render parity."),

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/skills/quotation/references/quote-generation.md

@@ -49,15 +49,18 @@ whatever the operator's brand or language:
   tool reconciles it against the engine total;
 - **`data-internal-only`** on every cost, margin, or internal-rate figure in the internal view, so the
   tool asserts the two client documents carry none;
-- **`data-esign-accept`** on the client quote's Sign-Online anchor (one line, double-quoted `href`), so
-  the tool asserts the acceptance link is live.
+- **`data-esign-accept`** on the client quote's Sign-Online anchor (one line, double-quoted `href`) —
+  present **only when the operator opted the quote into online acceptance** — so the tool asserts the
+  acceptance link is live.
 
 `quote-render` enforces three fail-closed gates before it files anything: **reconcile** (each
 document's `data-quote-total` equals the engine total), **margin-leak** (no `data-internal-only` in the
 client breakdown or client quote), and **link-liveness** (the client quote's `data-esign-accept` href
-is an absolute `https://` URL). If any gate fails the tool files nothing and returns a cause-naming
-fault (`reconcile-fail`, `margin-leak`, `sign-link`, `render-absent`, `render-error`). On success it
-files each document to its scope (below) and returns the three HTML paths plus the gate verdicts.
+is an absolute `https://` URL). Link-liveness runs **only on the opt-in path** — when a `signUrl` was
+passed; on the default, signer-less path the quote must carry no acceptance anchor, and a stray one
+fails closed. If any gate fails the tool files nothing and returns a cause-naming fault
+(`reconcile-fail`, `margin-leak`, `sign-link`, `render-absent`, `render-error`). On success it files
+each document to its scope (below) and returns the three HTML paths plus the gate verdicts.
 
 The tool produces **HTML, not PDF**. Print each returned path to PDF with the `browser` plugin as the
 final step: `browser-navigate` to its `file://` URL, then `browser-pdf-save` to a `.pdf` alongside it,
@@ -80,19 +83,28 @@ expose cost and margin freely. The two client documents **never** surface a cost
 internal-rate figure. A column or line that shows the price to the client is fine; a figure that
 reveals what the work cost the operator, or the markup applied, is a leak.
 
-### The acceptance block is the e-sign gated form
+### Online acceptance is optional and off by default
 
-The **acceptance block** in the client quote document is not free-form prose — it is the signing form
-of the `e-sign` skill (`platform/plugins/business-assistant/skills/e-sign/SKILL.md`). That skill owns
-how the quote is accepted: the `name` / `email` / intent-and-consent form, the capture to D1, the
+Most quotes carry **no** online-acceptance link. Online signing is an opt-in the operator asks for per
+quote, not a default. **By default the client quote has no acceptance block and no Sign-Online anchor,
+and it renders and ships with none.** The render script emits the acceptance block **only** when a
+`signUrl` is passed to `quote-render`; with no `signUrl` it omits the block entirely. Do not add an
+online-acceptance button to a quote the operator did not ask to be signable — a stray anchor on the
+default path fails the render closed (`sign-link`), because a signer link with no signing page behind
+it is a dead button.
+
+The **acceptance block**, when the operator does opt in, is not free-form prose — it is the signing
+form of the `e-sign` skill (`platform/plugins/business-assistant/skills/e-sign/SKILL.md`). That skill
+owns how the quote is accepted: the `name` / `email` / intent-and-consent form, the capture to D1, the
 stamped acceptance certificate, and the email dispatch. This contract produces the quote document;
 e-sign turns its acceptance block into a recordable signature. This contract does not restate those
 mechanics.
 
-**The Sign-Online link must be live before the quote is finalised — deploy first, then inject, then
-render.** The acceptance block carries a **Sign-Online anchor** — the button the client taps to reach
-the signing page. That page does not exist until e-sign deploys it, so the client quote **cannot be
-rendered until the deploy has run**. The order is fixed and load-bearing:
+**When the operator opts into online acceptance, the Sign-Online link must be live before the quote is
+finalised — deploy first, then inject, then render.** The acceptance block carries a **Sign-Online
+anchor** — the button the client taps to reach the signing page. That page does not exist until e-sign
+deploys it, so a **signable** client quote **cannot be rendered until the deploy has run**. The order
+is fixed and load-bearing:
 
 1. run **e-sign § 5** to deploy the signing page and take its returned absolute `https://` URL (e-sign
    § 5 names it as an explicit hand-back);
@@ -104,11 +116,13 @@ rendered until the deploy has run**. The order is fixed and load-bearing:
 
 The render script marks that one anchor with the stable attribute `data-esign-accept` so
 `quote-render`'s link-liveness gate finds it deterministically, whatever the operator's brand,
-wording, or language. The gate matches the anchor's opening tag, so the render script emits that
-opening tag on a **single line** with a **double-quoted `href`** (the default for these self-contained
-documents); a split tag or single-quoted `href` reads as no anchor and fails the gate closed. The
-anchor's `href` is **never** a placeholder, a bare `#`, or a `file://`/relative path: it is the
-deployed signing URL or the quote does not ship.
+wording, or language. The gate applies **only on the opt-in path** (a `signUrl` was passed); on the
+default path it does not run and the quote must carry no anchor. When it does apply, the gate matches
+the anchor's opening tag, so the render script emits that opening tag on a **single line** with a
+**double-quoted `href`** (the default for these self-contained documents); a split tag or
+single-quoted `href` reads as no anchor and fails the gate closed. The anchor's `href` is **never** a
+placeholder, a bare `#`, or a `file://`/relative path: it is the deployed signing URL or the quote
+does not ship.
 
 When the quote is **confidential to a named client**, the acceptance is gated per e-sign § 1a. That
 section's **same-origin invariant** is load-bearing: the `/api/accept` and `/api/status` capture
@@ -166,14 +180,28 @@ these checks are enforced deterministically at render time, not as a separate ha
 - **margin-leak.** The client breakdown and client quote must carry no `data-internal-only` marker. A
   leak files nothing and returns `margin-leak`. The margin boundary is structural, not a matter of
   remembering to omit a column.
-- **link-liveness.** The client quote's `data-esign-accept` href must be an absolute `https://` URL,
-  not empty, a bare fragment (`#…`), relative, `file://`, `about:`, or any non-https target. A dead
-  link files nothing and returns `sign-link`, because a dead link emits no other signal.
+- **link-liveness (opt-in only).** This gate runs only when the operator opted the quote into online
+  acceptance — a `signUrl` was passed. Then the client quote's `data-esign-accept` href must be an
+  absolute `https://` URL, not empty, a bare fragment (`#…`), relative, `file://`, `about:`, or any
+  non-https target; a dead link files nothing and returns `sign-link`, because a dead link emits no
+  other signal. On the default, signer-less path (no `signUrl`) the quote must carry **no** acceptance
+  anchor at all; a stray anchor also returns `sign-link` (a signer link with no signing page is a dead
+  button).
 
 The tool emits one `[quote-render] op=render jobId=… docs=3 internal=… breakdown=… quote=…` line on
-success and `[quote-render] op=fault jobId=… reason=… detail=…` on any gate failure. A `Saved PDF to
-<path>` line for a client quote with no preceding successful `op=render` for the same job is itself a
-regression signature: the render gate was bypassed.
+success and `[quote-render] op=fault jobId=… reason=… detail=…` on any gate failure. On success it also
+writes a durable **render receipt** at `quoting/jobs/{jobId}/render-receipt.json` (recording the engine
+total and the filed client-doc paths) — the on-disk proof, next to the job's figures, that the
+deterministic path ran for this job.
+
+**The receipt is what makes the deterministic path the only route.** Printing a client quote to PDF is
+gated on it: a `browser-pdf-save` of a client-facing quote document
+(`memory/users/{phone}/documents/quote-{jobId}.pdf` or `…-breakdown.pdf`) with no render receipt for
+that job is **refused** — the print is blocked and the bypass surfaces as `[quote-render] op=bypass
+jobId=… detail=…`, not delivered. Hand-authoring the quote HTML and printing it is therefore not a
+route a customer document can reach: without a receipt the PDF does not ship. Produce every client
+quote through `quote-render` and print the HTML path it returns; there is no supported hand-authored
+path.
 
 **No-event standing check — filed quotes against live signing pages.** The gate fires only while a
 quote is being produced; it cannot catch a quote that shipped a bad link before the gate existed.

package/payload/server/{chunk-TTKYHVA7.js → chunk-SDYRKIYY.js}

@@ -67,8 +67,12 @@ function readHouseCredential(platformRoot) {
 }
 
 // ../lib/storage-broker/src/cf-exec.ts
+import { execFile as execFile2 } from "child_process";
+import { join as join2 } from "path";
+
+// ../lib/storage-broker/src/house-scoped-token.ts
+import { readFileSync as readFileSync2 } from "fs";
 import { execFile } from "child_process";
-var defaultFetch = (url, init) => fetch(url, init);
 var defaultRun = (cmd, args, env) => new Promise((resolve, reject) => {
   execFile(cmd, args, { env }, (err, stdout, stderr) => {
     if (err) {
@@ -79,6 +83,54 @@ ${stderr}`));
     resolve({ stdout: stdout.toString() });
   });
 });
+function readKey(path, key) {
+  for (const line of readFileSync2(path, "utf8").split("\n")) {
+    const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m && m[1] === key) return m[2].trim();
+  }
+  return void 0;
+}
+async function resolveHouseScopedToken(scope, houseEnvPath, cfTokenShPath, run = defaultRun) {
+  const preexisting = readKey(houseEnvPath, keyForScope(scope)) !== void 0;
+  const { stdout } = await run(
+    "bash",
+    [cfTokenShPath, scope, houseEnvPath],
+    { ...process.env }
+  );
+  const keyName = stdout.trim().split("\n").pop()?.trim() ?? "";
+  if (!keyName) throw new Error(`storage-broker: cf-token.sh ${scope} returned no key name`);
+  const value = readKey(houseEnvPath, keyName);
+  if (!value) {
+    throw new Error(`storage-broker: scoped token ${keyName} absent in ${houseEnvPath} after mint`);
+  }
+  console.error(
+    `[storage-broker] op=house-scoped-token src=house scope=${scope} action=${preexisting ? "reuse" : "mint"} result=active`
+  );
+  return value;
+}
+function keyForScope(scope) {
+  switch (scope) {
+    case "storage":
+      return "CF_STORAGE_TOKEN";
+    case "calendar-d1":
+      return "CF_CALENDAR_D1_TOKEN";
+    default:
+      return "";
+  }
+}
+
+// ../lib/storage-broker/src/cf-exec.ts
+var defaultFetch = (url, init) => fetch(url, init);
+var defaultRun2 = (cmd, args, env) => new Promise((resolve, reject) => {
+  execFile2(cmd, args, { env }, (err, stdout, stderr) => {
+    if (err) {
+      reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}
+${stderr}`));
+      return;
+    }
+    resolve({ stdout: stdout.toString() });
+  });
+});
 function parseJson(raw, context) {
   try {
     return JSON.parse(raw);
@@ -86,7 +138,7 @@ function parseJson(raw, context) {
     throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
   }
 }
-function makeCfExec(cred, run = defaultRun, fetchFn = defaultFetch) {
+function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
   const env = {
     ...process.env,
     CLOUDFLARE_API_TOKEN: cred.apiToken,
@@ -148,6 +200,13 @@ ${body}`);
     }
   };
 }
+async function makeHouseCfExec(platformRoot, run = defaultRun2, fetchFn = defaultFetch) {
+  const cred = readHouseCredential(platformRoot);
+  const houseEnvPath = join2(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join2(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
+  return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
+}
 
 // ../lib/storage-broker/src/audit.ts
 var ACCOUNT_WIDE_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
@@ -180,7 +239,13 @@ async function reconcileStorage(deps) {
 }
 
 // ../lib/storage-broker/src/remediate.ts
-var STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+var STRIP_KEYS = [
+  "CLOUDFLARE_API_TOKEN",
+  "CF_PAGES_D1_TOKEN",
+  "CF_PAGES_TOKEN",
+  "CF_STORAGE_TOKEN",
+  "CF_CALENDAR_D1_TOKEN"
+];
 function validateMapping(enumerated, mapping) {
   const missing = enumerated.filter((name) => !(name in mapping));
   return { ok: missing.length === 0, missing };
@@ -199,7 +264,9 @@ export {
   resolveOwner,
   listResources,
   readHouseCredential,
+  resolveHouseScopedToken,
   makeCfExec,
+  makeHouseCfExec,
   reconcileStorage,
   validateMapping,
   stripAccountWideTokens