@rubytech/create-sitedesk-code 0.1.452 → 0.1.453

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/skills/quotation/references/quote-generation.md

@@ -49,15 +49,18 @@ whatever the operator's brand or language:
   tool reconciles it against the engine total;
 - **`data-internal-only`** on every cost, margin, or internal-rate figure in the internal view, so the
   tool asserts the two client documents carry none;
-- **`data-esign-accept`** on the client quote's Sign-Online anchor (one line, double-quoted `href`), so
-  the tool asserts the acceptance link is live.
+- **`data-esign-accept`** on the client quote's Sign-Online anchor (one line, double-quoted `href`) —
+  present **only when the operator opted the quote into online acceptance** — so the tool asserts the
+  acceptance link is live.
 
 `quote-render` enforces three fail-closed gates before it files anything: **reconcile** (each
 document's `data-quote-total` equals the engine total), **margin-leak** (no `data-internal-only` in the
 client breakdown or client quote), and **link-liveness** (the client quote's `data-esign-accept` href
-is an absolute `https://` URL). If any gate fails the tool files nothing and returns a cause-naming
-fault (`reconcile-fail`, `margin-leak`, `sign-link`, `render-absent`, `render-error`). On success it
-files each document to its scope (below) and returns the three HTML paths plus the gate verdicts.
+is an absolute `https://` URL). Link-liveness runs **only on the opt-in path** — when a `signUrl` was
+passed; on the default, signer-less path the quote must carry no acceptance anchor, and a stray one
+fails closed. If any gate fails the tool files nothing and returns a cause-naming fault
+(`reconcile-fail`, `margin-leak`, `sign-link`, `render-absent`, `render-error`). On success it files
+each document to its scope (below) and returns the three HTML paths plus the gate verdicts.
 
 The tool produces **HTML, not PDF**. Print each returned path to PDF with the `browser` plugin as the
 final step: `browser-navigate` to its `file://` URL, then `browser-pdf-save` to a `.pdf` alongside it,
@@ -80,19 +83,28 @@ expose cost and margin freely. The two client documents **never** surface a cost
 internal-rate figure. A column or line that shows the price to the client is fine; a figure that
 reveals what the work cost the operator, or the markup applied, is a leak.
 
-### The acceptance block is the e-sign gated form
+### Online acceptance is optional and off by default
 
-The **acceptance block** in the client quote document is not free-form prose — it is the signing form
-of the `e-sign` skill (`platform/plugins/business-assistant/skills/e-sign/SKILL.md`). That skill owns
-how the quote is accepted: the `name` / `email` / intent-and-consent form, the capture to D1, the
+Most quotes carry **no** online-acceptance link. Online signing is an opt-in the operator asks for per
+quote, not a default. **By default the client quote has no acceptance block and no Sign-Online anchor,
+and it renders and ships with none.** The render script emits the acceptance block **only** when a
+`signUrl` is passed to `quote-render`; with no `signUrl` it omits the block entirely. Do not add an
+online-acceptance button to a quote the operator did not ask to be signable — a stray anchor on the
+default path fails the render closed (`sign-link`), because a signer link with no signing page behind
+it is a dead button.
+
+The **acceptance block**, when the operator does opt in, is not free-form prose — it is the signing
+form of the `e-sign` skill (`platform/plugins/business-assistant/skills/e-sign/SKILL.md`). That skill
+owns how the quote is accepted: the `name` / `email` / intent-and-consent form, the capture to D1, the
 stamped acceptance certificate, and the email dispatch. This contract produces the quote document;
 e-sign turns its acceptance block into a recordable signature. This contract does not restate those
 mechanics.
 
-**The Sign-Online link must be live before the quote is finalised — deploy first, then inject, then
-render.** The acceptance block carries a **Sign-Online anchor** — the button the client taps to reach
-the signing page. That page does not exist until e-sign deploys it, so the client quote **cannot be
-rendered until the deploy has run**. The order is fixed and load-bearing:
+**When the operator opts into online acceptance, the Sign-Online link must be live before the quote is
+finalised — deploy first, then inject, then render.** The acceptance block carries a **Sign-Online
+anchor** — the button the client taps to reach the signing page. That page does not exist until e-sign
+deploys it, so a **signable** client quote **cannot be rendered until the deploy has run**. The order
+is fixed and load-bearing:
 
 1. run **e-sign § 5** to deploy the signing page and take its returned absolute `https://` URL (e-sign
    § 5 names it as an explicit hand-back);
@@ -104,11 +116,13 @@ rendered until the deploy has run**. The order is fixed and load-bearing:
 
 The render script marks that one anchor with the stable attribute `data-esign-accept` so
 `quote-render`'s link-liveness gate finds it deterministically, whatever the operator's brand,
-wording, or language. The gate matches the anchor's opening tag, so the render script emits that
-opening tag on a **single line** with a **double-quoted `href`** (the default for these self-contained
-documents); a split tag or single-quoted `href` reads as no anchor and fails the gate closed. The
-anchor's `href` is **never** a placeholder, a bare `#`, or a `file://`/relative path: it is the
-deployed signing URL or the quote does not ship.
+wording, or language. The gate applies **only on the opt-in path** (a `signUrl` was passed); on the
+default path it does not run and the quote must carry no anchor. When it does apply, the gate matches
+the anchor's opening tag, so the render script emits that opening tag on a **single line** with a
+**double-quoted `href`** (the default for these self-contained documents); a split tag or
+single-quoted `href` reads as no anchor and fails the gate closed. The anchor's `href` is **never** a
+placeholder, a bare `#`, or a `file://`/relative path: it is the deployed signing URL or the quote
+does not ship.
 
 When the quote is **confidential to a named client**, the acceptance is gated per e-sign § 1a. That
 section's **same-origin invariant** is load-bearing: the `/api/accept` and `/api/status` capture
@@ -166,9 +180,13 @@ these checks are enforced deterministically at render time, not as a separate ha
 - **margin-leak.** The client breakdown and client quote must carry no `data-internal-only` marker. A
   leak files nothing and returns `margin-leak`. The margin boundary is structural, not a matter of
   remembering to omit a column.
-- **link-liveness.** The client quote's `data-esign-accept` href must be an absolute `https://` URL,
-  not empty, a bare fragment (`#…`), relative, `file://`, `about:`, or any non-https target. A dead
-  link files nothing and returns `sign-link`, because a dead link emits no other signal.
+- **link-liveness (opt-in only).** This gate runs only when the operator opted the quote into online
+  acceptance — a `signUrl` was passed. Then the client quote's `data-esign-accept` href must be an
+  absolute `https://` URL, not empty, a bare fragment (`#…`), relative, `file://`, `about:`, or any
+  non-https target; a dead link files nothing and returns `sign-link`, because a dead link emits no
+  other signal. On the default, signer-less path (no `signUrl`) the quote must carry **no** acceptance
+  anchor at all; a stray anchor also returns `sign-link` (a signer link with no signing page is a dead
+  button).
 
 The tool emits one `[quote-render] op=render jobId=… docs=3 internal=… breakdown=… quote=…` line on
 success and `[quote-render] op=fault jobId=… reason=… detail=…` on any gate failure. On success it also

package/payload/server/server.js

@@ -1447,7 +1447,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync38, existsSync as existsSync36, watchFile } from "fs";
+import { readFileSync as readFileSync38, existsSync as existsSync36, watchFile, readdirSync as readdirSync21, statSync as statSync14 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
 import { resolve as resolve35, join as join38, basename as basename12 } from "path";
@@ -26755,6 +26755,56 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const loop = setInterval(runReconcile, RECONCILE_INTERVAL_MS);
   loop.unref();
 }
+{
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const outlookScript = resolve35(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
+  const runOutlookComplete = () => {
+    if (!existsSync36(outlookScript)) return;
+    try {
+      const child = spawn3(process.execPath, [outlookScript], {
+        env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
+        stdio: "inherit"
+      });
+      child.unref();
+      child.on("error", (err) => console.error(`[outlook-complete] spawn-failed err="${err.message}"`));
+    } catch (err) {
+      console.error(`[outlook-complete] spawn-failed err="${err.message}"`);
+    }
+  };
+  const outlookFirst = setTimeout(runOutlookComplete, 18e3);
+  outlookFirst.unref();
+  const outlookLoop = setInterval(runOutlookComplete, OUTLOOK_COMPLETE_INTERVAL_MS);
+  outlookLoop.unref();
+}
+{
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const strandedAccountsDir = resolve35(auditRoot, "..", "data/accounts");
+  const STRANDED_AUDIT_INTERVAL_MS = 3e5;
+  const STRANDED_AGE_MS = 16 * 6e4;
+  const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  const runStrandedAudit = () => {
+    try {
+      if (!existsSync36(strandedAccountsDir)) return;
+      const now = Date.now();
+      for (const name of readdirSync21(strandedAccountsDir)) {
+        if (!STRANDED_UUID_RE.test(name)) continue;
+        const pendingPath2 = resolve35(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync36(pendingPath2)) continue;
+        const ageMs = now - statSync14(pendingPath2).mtimeMs;
+        if (ageMs > STRANDED_AGE_MS) {
+          console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs / 1e3)}`);
+        }
+      }
+    } catch (err) {
+      console.error(`[outlook-mcp] devicecode-stranded-audit error="${err.message}"`);
+    }
+  };
+  const strandedFirst = setTimeout(runStrandedAudit, 25e3);
+  strandedFirst.unref();
+  const strandedLoop = setInterval(runStrandedAudit, STRANDED_AUDIT_INTERVAL_MS);
+  strandedLoop.unref();
+}
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;