@rubytech/create-sitedesk-code 0.1.509 → 0.1.510

package/payload/platform/docs/superpowers/specs/2026-07-26-task-2014-ui-suite-nondeterminism-design.md

@@ -0,0 +1,169 @@
+# Task 2014 design — cut the jsdom the `platform/ui` suite does not use
+
+Date: 2026-07-26
+Task: `.tasks/pending/2014-platform-ui-suite-is-nondeterministic-under-parallel-load.md`
+Supersedes brief: 1765, folded into 2014 on 2026-07-26
+
+## The measurement this design rests on
+
+All figures from the dev Mac, Node 22.22.0, vitest 4.1.2, worktree
+`task-2014-ui-suite-nondeterminism`, 2026-07-26.
+
+### Most apparent worktree flakiness is missing build output, not flakiness
+
+`platform/node_modules` and `platform/lib/*/dist` are gitignored build output. A
+fresh worktree has neither. Four full-suite runs, each after adding one more
+piece of provisioning:
+
+| Run | Worktree state | Failed | Duration |
+|---|---|---|---|
+| 1 | `platform/ui` deps only | 63 files / 32 tests | 435s |
+| 2 | + 3 libs built | 5 files / 8 tests | 180s |
+| 3 | + `platform` deps | 5 files / 3 tests | 111s |
+| 4 | + all 24 libs built | 0 | 143s |
+
+Runs 1 and 2 failed on `Cannot find module .../dist/index.js` and
+`Failed to resolve import "neo4j-driver"`. Those are absent artifacts, not
+timing. Only run 3's three failures are the defect this task describes, and all
+three are in the brief's population: both `/login/start` sub-account cases in
+`whatsapp-self-or-house-scope.test.ts` at 5013ms and 515ms, and
+`whatsapp-conversation-graph-state-projection.test.ts` "sub-account all-senders
+mode returns only its bound thread" at 5017ms. 5000ms is the vitest default
+`testTimeout`.
+
+### Environment setup costs six times what the tests cost
+
+Run 4, fully green:
+
+```
+tests        267s
+environment 1571s
+import       257s
+setup        196s
+transform     42s
+```
+
+`vitest.config.ts` sets `environment: 'jsdom'` globally. 530 test files pay it.
+
+### Roughly half the suite boots a DOM it never touches
+
+266 `.test.ts` files do not declare `@vitest-environment node`. Both runs
+back to back, same machine load:
+
+| | Duration | environment CPU |
+|---|---|---|
+| as-is (jsdom) | 103.0s | 1317.6s |
+| `--environment node` | 30.9s | 0.074s |
+
+Three consecutive node-environment passes over those 266 files agreed on 17
+`.ts` files that genuinely need a DOM. A file that appeared in only one pass
+(`route-cache-watchers.test.ts`) is the known flake, not a DOM dependency. A
+`.tsx` file in the failure list arrived because vitest CLI arguments are
+substring filters rather than exact paths.
+
+So the suite's problem is not 4757 tests. The tests are 267s of CPU. It is that
+about half the files run a browser DOM environment for nothing, and that is the
+CPU starving the workers the named tests race against.
+
+### Machine context
+
+The dev Mac ran these measurements at load average 100 to 350 with 60 `claude`
+processes across six peer worktree sessions. Self-contention from 20 vitest
+forks is not the only contender for CPU, and any verification has to record the
+load it ran under or a red run cannot be attributed.
+
+## Design
+
+### 1. Route the test environment by file extension
+
+`platform/ui/vitest.config.ts` replaces its single global `environment: 'jsdom'`
+with two projects:
+
+- `dom`: `**/*.{test,spec}.?(c|m)[jt]sx`, environment `jsdom`.
+- `node`: `**/*.{test,spec}.?(c|m)[jt]s` plus `../scripts/__tests__/**`,
+  environment `node`.
+
+The existing `resolve.dedupe`, `setupFiles`, `globals`, and `exclude` settings
+carry into both projects unchanged.
+
+The rule is structural, not a maintained list: a test that renders JSX gets a
+DOM, and anything else opts in explicitly. No `.tsx` file is edited.
+
+### 2. Seventeen `.ts` files opt back into jsdom
+
+Each gets `// @vitest-environment jsdom` with a short reason. Verified on vitest
+4.1.2 that a per-file docblock overrides a project's `environment` setting.
+
+```
+app/__tests__/spinning-class-global.test.ts
+app/__tests__/wa-viewer-width.test.ts
+app/graph/__tests__/side-panel-helpers.test.ts
+app/hooks/__tests__/useCopyFeedback.test.ts
+app/hooks/__tests__/useMediaQuery.test.ts
+app/hooks/__tests__/useVoiceRecorder.deviceId.test.ts
+app/hooks/__tests__/useVoiceRecorder.mic-result.test.ts
+app/lib/__tests__/admin-auth-login-remote-auth.test.ts
+app/lib/__tests__/switch-account-scope.test.ts
+app/lib/__tests__/use-admin-auth-claude-connected.test.ts
+app/lib/__tests__/use-admin-auth-heartbeat-remote-auth.test.ts
+app/lib/__tests__/useAdminFetch.test.ts
+app/lib/__tests__/useSubAccountSwitcher.test.ts
+app/public/__tests__/extract-seed-question.test.ts
+app/whatsapp/__tests__/useTranscriptStream-activity.test.ts
+app/whatsapp/__tests__/useTranscriptStream-endpoint.test.ts
+app/whatsapp/__tests__/useTranscriptStream.test.ts
+```
+
+A `.ts` test that needs a DOM and lacks the docblock fails loudly on
+`document is not defined`. It does not pass silently.
+
+### 3. A prebuild gate so the waste cannot creep back
+
+New `platform/ui/scripts/check-jsdom-budget.mjs`, joining the 24 checks already
+in the `prebuild` script. It counts the files that will boot jsdom, which is
+every `.test.tsx`/`.spec.tsx` plus every `.ts` test declaring the jsdom
+docblock, and fails the build when that count exceeds a ceiling written in the
+script. Adding a jsdom file becomes a deliberate one-line bump with a reason,
+not an accident. The failure message names the files above the ceiling and the
+CPU cost per jsdom file measured here, so a reader knows what the number buys.
+
+### 4. The 141 existing `@vitest-environment node` docblocks stay
+
+They remain accurate and are now redundant. Removing them is 141 files of churn
+for no behaviour change.
+
+## What this does not claim
+
+Removing the environment waste reduces the contention the named tests race
+against. It is not proven, before measurement, that the ten named tests stop
+failing. If group A's long-press tests still race React Testing Library's
+1000ms `findBy` default once contention drops, that is a second and separate
+lever, and it gets measured and brought back rather than stacked on top as a
+speculative second fix.
+
+## Verification
+
+**Group A and the suite.** Ten consecutive `npm test` runs in `platform/ui` on
+the merged branch, `uptime` captured before and after each run, exit code and
+any `×` lines collected to one file. Success is ten `exit=0` and zero `×`
+matches across the collection, reported alongside the load each ran under. A red
+run with its load recorded is attributable; a red run without is not.
+
+**Group B.** Ten runs do not test a one-in-twenty failure rate. Instead measure
+the wall-clock cost of the four group B seed calls under full-suite parallel
+load, before and after the change, and state the headroom inside the 5000ms
+default. The measurement is the evidence, not the run count.
+
+**The jsdom cut itself.** The suite must still report 530 files and 4757 tests.
+A file silently dropping out of the run because a glob missed it would look like
+a pass.
+
+## Out of scope
+
+- The `platform/lib` build artifacts that made runs 1 to 3 look flaky. That is
+  worktree provisioning friction and gets its own task file.
+- A blanket `testTimeout` bump, excluded by the brief.
+- Deleting, skipping, or loosening the four group B tests, excluded by the
+  brief: they are the only place the cross-account 403 ordering is asserted.
+- Removing the 141 redundant node docblocks.
+- Any product change to the whatsapp routes, the data browser, or graph-write.

package/payload/platform/plugins/admin/PLUGIN.md

@@ -2,6 +2,7 @@
 name: admin
 surface: platform
 description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the SiteDesk platform."
+account-owned-files: [{"file": "webchat-channel-bindings.json", "description": "Routes this account's inbound admin webchat messages. Written by the session manager's webchat-channel-store."}, {"file": "wa-channel-bindings.json", "description": "Routes this account's inbound WhatsApp messages. Written by the session manager's wa-channel-store, which runs on every brand whether or not the whatsapp plugin ships."}, {"file": "telegram-channel-bindings.json", "description": "Routes this account's inbound Telegram messages. Written by the session manager's telegram-channel-store, which runs on every brand whether or not the telegram plugin ships."}, {"file": "canonical-webchat-session.json", "description": "Pins the account's canonical webchat session. Written by the admin UI server."}, {"file": "session-titles.json", "description": "Operator renames of sessions. Written by the session manager's title stores."}, {"file": "agents-disabled.json", "description": "Names the agents the operator switched off. Written by the admin agents route; provision reads it to re-apply the disables and never creates it."}]
 tools:
   - name: system-status
     publicAllowlist: false

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:aabbb6dbe5d9f4fe8ff6f7b3e2f06a46bd1c5281ea46b820829ab2b3bc93a0c0
+content-hash: sha256:86e768fb27dbcb38fc304ace12dbca3462943fcb58435cea6925ebf2469a0647
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -5451,7 +5451,7 @@ If the initial Cloudflare login fails during setup, SiteDesk will fall back to a
 
 `maxy-edge.service` (always-on front door) classifies upstream errors and serves a brand-aware response. There are two distinct user-visible shapes; the right one depends on what failed.
 
-**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "SiteDesk is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
+**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "SiteDesk is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] ts=<ISO-8601> upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. `ts=` is what lets a run of these be read as an outage with a start, an end and a duration, and cross-read against `journalctl --user -u <brand>-code.service`; `path=` carries the endpoint only, never the query string, because this line fires on paths whose query can hold a download signature, an OAuth code, or a customer phone number. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
 
 **Branded plain-text 502 ("Bad Gateway (SiteDesk unavailable)") — real upstream failure, not cold-start.** Any error class other than `ECONNREFUSED` (timeouts, resets, host-unreachable) returns the existing 502 path. The diagnostic line carries `err-class=other`. Read the log with `tail -200 ~/.maxy/logs/edge.log | rg 'err-class=other'` and check `~/.maxy/logs/server.log` for upstream stack traces — the upstream itself is the source.
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,12 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-26 (0.1.510)
+
+- The admin screens load faster: page assets are now sent pre-compressed, and the sessions list reads from disk without holding up everything else on the server.
+- Fixed several admin screens that could answer for the wrong account when an install has more than one, including the calendar booking link, the logs search, and the chat settings.
+- When an account folder cannot be found, the error now says which condition it actually hit instead of blaming a missing file.
+
 ## 2026-07-26 (0.1.509)
 
 - The Agents page now names the tool that set an agent's risk level, and shows it by its short name instead of the full internal path.

package/payload/platform/plugins/business-assistant/PLUGIN.md

@@ -1,6 +1,7 @@
 ---
 name: business-assistant
 description: "Business assistant for small businesses. Handles customer enquiries, appointment booking, quote formatting, invoice generation, and daily briefings. Responds instantly, triages by urgency, and never lets a message fall through the cracks."
+account-owned-dirs: [{"dir": "e-sign", "description": "One folder per signed document, each holding that document's render-once base.pdf, its base.sha256, and the per-signer stamped copies. Written by the e-sign skill; the layout is skill-owned and recreated on the next document."}]
 metadata: {"platform":{"always":true,"embed":["admin"],"pluginKey":"business-assistant","optional":true,"recommended":true}}
 ---
 

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -1,6 +1,7 @@
 ---
 name: cloudflare
 description: Cloudflare operations — tunnel setup/reset, DNS, Pages hosting, D1 data capture, and dashboard guidance. Zero agent-facing MCP tools; every operation is the agent invoking `cloudflared` or `wrangler` directly via Bash, calling the Cloudflare API with a reused per-scope narrow token, or quoting a dashboard click-path the operator performs themselves.
+account-owned-files: [{"file": "data-portal.json", "description": "The account's data-portal folder index, written by bin/portal-index-push.mjs on every push."}]
 tools: []
 mcp-manifest: skip
 ---

package/payload/platform/plugins/cloudflare/mcp/__tests__/schema-exposed-dirs.test.ts

@@ -68,6 +68,27 @@ describe('resolveExposedDirs', () => {
     }
   })
 
+  it('does not read a declared file as a plugin-owned dir', () => {
+    // Task 1902 — the plugin-owned region also carries file lines now. This is
+    // the client-facing copy of the parser, kept separately from
+    // platform/lib/account-schema-regions, so it needs its own case: a file must
+    // never enter pluginOwned, and asking to expose one must not expose it. The
+    // trailing slash inside the backticks is the discriminator.
+    const withFile = [
+      '<!-- plugin-owned-dirs:start -->',
+      '## Plugin-owned top-level entries',
+      '',
+      '- `sites/` — Owned by the cloudflare plugin.',
+      '- `data-portal.json` — the account data-portal index.',
+      '<!-- plugin-owned-dirs:end -->',
+    ].join('\n')
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY, pluginOwned: withFile }), [
+      'data-portal.json',
+    ])
+    expect(r.pluginOwned).toEqual(['sites'])
+    expect(r.exposed).not.toContain('data-portal.json')
+  })
+
   it('reports a plugin-owned collision and keeps the dir out of exposed', () => {
     const collide = ONTOLOGY.replace('`quotes/`', '`sites/`').replace('Quotation', 'Site')
     const r = resolveExposedDirs(schema({ ontology: collide, pluginOwned: PLUGIN_OWNED }))

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -283,7 +283,7 @@ If the initial Cloudflare login fails during setup, {{productName}} will fall ba
 
 `maxy-edge.service` (always-on front door) classifies upstream errors and serves a brand-aware response. There are two distinct user-visible shapes; the right one depends on what failed.
 
-**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "{{productName}} is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
+**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "{{productName}} is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] ts=<ISO-8601> upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. `ts=` is what lets a run of these be read as an outage with a start, an end and a duration, and cross-read against `journalctl --user -u <brand>-code.service`; `path=` carries the endpoint only, never the query string, because this line fires on paths whose query can hold a download signature, an OAuth code, or a customer phone number. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
 
 **Branded plain-text 502 ("Bad Gateway ({{productName}} unavailable)") — real upstream failure, not cold-start.** Any error class other than `ECONNREFUSED` (timeouts, resets, host-unreachable) returns the existing 502 path. The diagnostic line carries `err-class=other`. Read the log with `tail -200 ~/.maxy/logs/edge.log | rg 'err-class=other'` and check `~/.maxy/logs/server.log` for upstream stack traces — the upstream itself is the source.
 

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -1,6 +1,7 @@
 ---
 name: scheduling
 description: "Calendar and scheduling — create events, manage appointments, set up recurring triggers."
+account-owned-files: [{"file": "calendar-availability.json", "description": "The booking page's availability config, written by the publish-availability script and read by the live booking page."}]
 tools:
   - name: schedule-event
     publicAllowlist: false

package/payload/platform/scripts/__tests__/account-schema-owned-dirs.test.sh

@@ -10,8 +10,10 @@ REAL_PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
 REAL_TEMPLATE="$REAL_PROJECT_DIR/templates/account-schema/SCHEMA.md"
 REAL_PREMIUM="$(cd "$REAL_PROJECT_DIR/.." && pwd)/premium-plugins"
 PASS=0; FAIL=0; FAILED=()
-assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
-assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+# `--` so a pattern that starts with a hyphen (a region line: "- `x.json` — …")
+# is read as the pattern, not as a grep option.
+assert_grep()   { if printf '%s' "$2" | grep -qF -- "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF -- "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
 assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
 assert_dir()    { if [ -d "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected directory [$1]"); fi; }
 assert_nodir()  { if [ -d "$1" ]; then FAIL=$((FAIL+1)); FAILED+=("$2: expected NO directory [$1]"); else PASS=$((PASS+1)); fi; }
@@ -57,7 +59,7 @@ assert_grep "op=seed-owned-dirs" "$OUT" "sd-seed-log"
 assert_grep "added=quoting" "$OUT" "sd-added-quoting"
 ALLOWED="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SD/SCHEMA.md")"
 assert_grep "quoting" "$ALLOWED" "sd-allowlist-has-quoting"
-assert_grep "Plugin-owned top-level workspaces" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
+assert_grep "Plugin-owned top-level entries" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
 assert_grep "plugin-owned-dirs:start" "$(cat "$A_SD/SCHEMA.md")" "sd-marker"
 
 # --- idempotency: second merge is byte-identical ---
@@ -73,7 +75,7 @@ export PROJECT_DIR="$T_MX/platform"
 merge_owned_dirs_into_schema "$A_MX" >/dev/null
 ALLOWED_MX="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_MX/SCHEMA.md")"
 assert_nogrep "quoting" "$ALLOWED_MX" "mx-no-quoting"
-assert_nogrep "Plugin-owned top-level workspaces" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
+assert_nogrep "Plugin-owned top-level entries" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
 
 # --- platform plugins declare pages (storage-broker) + archive (memory) ---
 # Task 1891: these two plugin-owned root dirs must land in the allowed block so
@@ -287,5 +289,111 @@ B_P="$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')"
 merge_owned_dirs_into_schema "$A_P" >/dev/null
 assert_eq "$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')" "$B_P" "prune-idempotent"
 
+# --- account-owned-files: a declared file joins the same allowed block ---
+# The block is a flat list of names and already carries SCHEMA.md and
+# account.json, so a file needs no second surface. A second plugin declares a
+# malformed value: its key is skipped and the valid declaration still merges.
+TF="$(mktemp -d)"
+mkdir -p "$TF/platform/plugins/filer" "$TF/platform/plugins/broken" \
+         "$TF/platform/config" "$TF/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TF/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"files-brand","shipsPremiumBundles":[]}\n' > "$TF/platform/config/brand.json"
+printf -- '---\nname: filer\naccount-owned-files: [{"file": "x.json", "description": "Filer index."}]\n---\n' \
+  > "$TF/platform/plugins/filer/PLUGIN.md"
+printf -- '---\nname: broken\naccount-owned-files: [{"file": "y.json"\n---\n' \
+  > "$TF/platform/plugins/broken/PLUGIN.md"
+A_TF="$(mktemp -d)"; cp "$TF/platform/templates/account-schema/SCHEMA.md" "$A_TF/SCHEMA.md"
+export PROJECT_DIR="$TF/platform"
+OUT_TF="$(merge_owned_dirs_into_schema "$A_TF")"
+ALLOWED_TF="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TF/SCHEMA.md")"
+assert_grep "x.json" "$ALLOWED_TF" "files-allowlist-has-x"
+assert_nogrep "y.json" "$ALLOWED_TF" "files-malformed-skipped"
+assert_grep "added=x.json" "$OUT_TF" "files-added-logged"
+# A file renders without the trailing slash a dir gets; three parsers read that
+# slash to tell a bucket from anything else.
+assert_grep '- `x.json` — Filer index.' "$(cat "$A_TF/SCHEMA.md")" "files-region-no-slash"
+assert_nogrep '- `x.json/`' "$(cat "$A_TF/SCHEMA.md")" "files-region-not-a-dir"
+RC_TF="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_TF")"
+assert_grep "ownedFile=x.json present=true" "$RC_TF" "files-reconcile-line"
+B_TF="$(shasum "$A_TF/SCHEMA.md" | awk '{print $1}')"
+merge_owned_dirs_into_schema "$A_TF" >/dev/null
+assert_eq "$(shasum "$A_TF/SCHEMA.md" | awk '{print $1}')" "$B_TF" "files-idempotent"
+
+# A dir declaration keeps its slash and its ownedDir= reconcile line.
+TD="$(mktemp -d)"
+mkdir -p "$TD/platform/plugins/dirred" "$TD/platform/config" "$TD/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TD/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"dirs-brand","shipsPremiumBundles":[]}\n' > "$TD/platform/config/brand.json"
+printf -- '---\nname: dirred\naccount-owned-dirs: [{"dir": "widgets", "description": "Widget workspace."}]\n---\n' \
+  > "$TD/platform/plugins/dirred/PLUGIN.md"
+A_TD="$(mktemp -d)"; cp "$TD/platform/templates/account-schema/SCHEMA.md" "$A_TD/SCHEMA.md"
+export PROJECT_DIR="$TD/platform"
+merge_owned_dirs_into_schema "$A_TD" >/dev/null
+assert_grep '- `widgets/` — Widget workspace.' "$(cat "$A_TD/SCHEMA.md")" "dirs-region-keeps-slash"
+RC_TD="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_TD")"
+assert_grep "ownedDir=widgets present=true" "$RC_TD" "dirs-reconcile-line"
+
+# --- a malformed ELEMENT skips its whole key, not just that element ---
+# json.loads succeeds and the first entry is well-formed, so an append-as-you-go
+# parse would merge a.json and silently drop c.json. A half-merged declaration is
+# worse than none: the dropped name reports as a stray forever with no line
+# anywhere saying its declaration failed.
+TP="$(mktemp -d)"
+mkdir -p "$TP/platform/plugins/partial" "$TP/platform/plugins/good" \
+         "$TP/platform/config" "$TP/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TP/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"partial-brand","shipsPremiumBundles":[]}\n' > "$TP/platform/config/brand.json"
+printf -- '---\nname: partial\naccount-owned-files: [{"file": "a.json"}, "b.json", {"file": "c.json"}]\n---\n' \
+  > "$TP/platform/plugins/partial/PLUGIN.md"
+printf -- '---\nname: good\naccount-owned-files: [{"file": "d.json", "description": "Good."}]\n---\n' \
+  > "$TP/platform/plugins/good/PLUGIN.md"
+A_TP="$(mktemp -d)"; cp "$TP/platform/templates/account-schema/SCHEMA.md" "$A_TP/SCHEMA.md"
+export PROJECT_DIR="$TP/platform"
+merge_owned_dirs_into_schema "$A_TP" >/dev/null
+ALLOWED_TP="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TP/SCHEMA.md")"
+assert_nogrep "a.json" "$ALLOWED_TP" "partial-first-entry-skipped"
+assert_nogrep "c.json" "$ALLOWED_TP" "partial-later-entry-skipped"
+assert_grep "d.json" "$ALLOWED_TP" "partial-sibling-plugin-still-merges"
+
+# --- a name carrying a path separator is refused ---
+# The trailing slash inside the backticks is what tells a bucket from a file in
+# the descriptive region, and the fence entry must match a readdir name. A
+# declared "foo/" would render as a bucket line and never match anything.
+TS_="$(mktemp -d)"
+mkdir -p "$TS_/platform/plugins/slashed" "$TS_/platform/config" "$TS_/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TS_/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"slash-brand","shipsPremiumBundles":[]}\n' > "$TS_/platform/config/brand.json"
+printf -- '---\nname: slashed\naccount-owned-files: [{"file": "foo/", "description": "Bad."}]\naccount-owned-dirs: [{"dir": "bar/baz", "description": "Bad."}]\n---\n' \
+  > "$TS_/platform/plugins/slashed/PLUGIN.md"
+A_TS="$(mktemp -d)"; cp "$TS_/platform/templates/account-schema/SCHEMA.md" "$A_TS/SCHEMA.md"
+export PROJECT_DIR="$TS_/platform"
+merge_owned_dirs_into_schema "$A_TS" >/dev/null
+assert_nogrep "foo/" "$(cat "$A_TS/SCHEMA.md")" "slash-file-refused"
+assert_nogrep "bar/baz" "$(cat "$A_TS/SCHEMA.md")" "slash-dir-refused"
+
+# --- shipped declarations reach an account's allowed block ---
+# Symlink the real plugin dirs so the case exercises the shipped PLUGIN.md
+# frontmatter, the same way the Task 1891 pages/archive case does.
+T_SHIP="$(make_tree '[]')"
+for _p in business-assistant cloudflare scheduling admin; do
+  ln -s "$REAL_PROJECT_DIR/plugins/$_p" "$T_SHIP/platform/plugins/$_p"
+done
+A_SHIP="$(make_account "$T_SHIP")"
+export PROJECT_DIR="$T_SHIP/platform"
+merge_owned_dirs_into_schema "$A_SHIP" >/dev/null
+ALLOWED_SHIP="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SHIP/SCHEMA.md")"
+# The four channel/session files are written by the session manager and the UI
+# server on every brand, so they are declared on admin, which no brand excludes.
+# realagent-code and property-administrators exclude the telegram plugin from
+# their payload (brands/*/brand.json) while still constructing the telegram store
+# (services/claude-session-manager/src/index.ts), so a declaration on the telegram
+# plugin would leave those two brands reporting a permanent false stray. This
+# tree deliberately omits whatsapp and telegram to prove the reach.
+for _n in e-sign data-portal.json calendar-availability.json wa-channel-bindings.json \
+          telegram-channel-bindings.json webchat-channel-bindings.json \
+          canonical-webchat-session.json session-titles.json agents-disabled.json; do
+  assert_grep "$_n" "$ALLOWED_SHIP" "ship-allow-$_n"
+done
+
 echo "PASS=$PASS FAIL=$FAIL"
 if [ "$FAIL" -ne 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/lib/account-schema-owned-dirs.py

@@ -1,16 +1,23 @@
 #!/usr/bin/env python3
-"""Resolve plugin-declared account-owned top-level dirs for the brand and merge
-them into an account's SCHEMA.md.
+"""Resolve plugin-declared account-owned top-level entries for the brand and
+merge them into an account's SCHEMA.md.
 
-A plugin declares owned top-level account dirs in its PLUGIN.md frontmatter:
+A plugin declares owned top-level account entries in its PLUGIN.md frontmatter,
+by kind:
 
-    account-owned-dirs: [{"dir": "quoting", "description": "..."}]
+    account-owned-dirs:  [{"dir": "quoting", "description": "..."}]
+    account-owned-files: [{"file": "data-portal.json", "description": "..."}]
 
-The owned-dir set for a brand is the union declared by every platform plugin
+The owned-entry set for a brand is the union declared by every platform plugin
 ($PROJECT_DIR/plugins/*/PLUGIN.md) and every premium sub-plugin of a bundle the
 brand ships ($PREMIUM_ROOT/<bundle>/plugins/*/PLUGIN.md, gated by brand.json
 shipsPremiumBundles). Reads PROJECT_DIR from the environment.
 
+A declaration reaches an account only on a brand whose payload carries the
+declaring plugin (brand.json plugins.excluded drops the directory entirely), so
+an entry written by platform code that runs on every brand belongs on a plugin
+no brand excludes, not on the plugin its feature is named after.
+
 The account SCHEMA.md also gains one domain-entity bucket per top-level
 operator-entry node type of the brand's business ontology. That set is derived
 from the brand vertical's schema reference (brand.json#vertical ->
@@ -102,7 +109,17 @@ def _read_vertical(project_dir):
 
 
 def _parse_plugin_md(path):
-    """Return (name, [ {dir, description} ]) from a PLUGIN.md, or (None, [])."""
+    """Return (name, [ {name, kind, description} ]) from a PLUGIN.md, or (None, []).
+    Two frontmatter keys, one list: `account-owned-dirs` yields kind='dir',
+    `account-owned-files` yields kind='file'. A key whose value is not a JSON
+    array of objects is skipped WHOLE: entries are staged and committed only once
+    every element parses, so a bad element cannot half-merge a declaration and
+    leave the rest reporting as strays. The other key and every other plugin
+    still merge, because one hand-edited manifest must never empty the set. A
+    name carrying a path separator is dropped: a fence entry has to match one
+    readdir name, and the region tells a bucket from a file by the trailing slash
+    it adds itself, so a declared `foo/` would render as a bucket that matches
+    nothing."""
     try:
         with open(path) as f:
             text = f.read()
@@ -117,16 +134,21 @@ def _parse_plugin_md(path):
     if nm:
         name = nm.group(1).strip().strip('"').strip("'")
     owned = []
-    om = re.search(r"^account-owned-dirs:\s*(.+)$", fm, re.MULTILINE)
-    if om:
+    for key, field, kind in (("account-owned-dirs", "dir", "dir"),
+                             ("account-owned-files", "file", "file")):
+        om = re.search(r"^" + key + r":\s*(.+)$", fm, re.MULTILINE)
+        if not om:
+            continue
+        staged = []
         try:
-            raw = json.loads(om.group(1).strip())
-            for e in raw:
-                d = (e.get("dir") or "").strip()
-                if d:
-                    owned.append({"dir": d, "description": (e.get("description") or "").strip()})
+            for e in json.loads(om.group(1).strip()):
+                n = (e.get(field) or "").strip()
+                if n and "/" not in n:
+                    staged.append({"name": n, "kind": kind,
+                                   "description": (e.get("description") or "").strip()})
         except Exception:
-            pass
+            continue
+        owned.extend(staged)
     return name, owned
 
 
@@ -158,18 +180,19 @@ def _plugin_md_paths(project_dir):
 
 
 def resolve(project_dir):
-    """Union of owned-dir declarations. First declarer of a dir wins its owner
-    label + description."""
+    """Union of owned-entry declarations. First declarer of a name wins its
+    owner label + description, whichever kind it declared."""
     seen = {}
     order = []
     for path in _plugin_md_paths(project_dir):
         name, owned = _parse_plugin_md(path)
         for e in owned:
-            if e["dir"] in seen:
+            if e["name"] in seen:
                 continue
-            seen[e["dir"]] = {"dir": e["dir"], "description": e["description"], "plugin": name or "unknown"}
-            order.append(e["dir"])
-    return [seen[d] for d in order]
+            seen[e["name"]] = {"name": e["name"], "kind": e["kind"],
+                               "description": e["description"], "plugin": name or "unknown"}
+            order.append(e["name"])
+    return [seen[n] for n in order]
 
 
 def _top_level_labels(schema_path):
@@ -304,7 +327,7 @@ def merge(project_dir, account_dir):
         # entity (non-blank Owner) nests under its owner and is not a target,
         # so a pre-fix account's empty owned bucket prunes while a populated one
         # is kept-and-logged like any other stale bucket.
-        target = FIXED_SEED | {e["dir"] for e in owned} | {b["dir"] for b in domain if _is_root(b["owner"])}
+        target = FIXED_SEED | {e["name"] for e in owned} | {b["dir"] for b in domain if _is_root(b["owner"])}
         # Reconcile existing entries: keep in-target; keep populated strays
         # (logged); drop empty/absent strays (logged).
         new_entries = []
@@ -319,9 +342,9 @@ def merge(project_dir, account_dir):
         # Append newly-projected owned then domain dirs not already present.
         insert = []
         for e in owned:
-            if e["dir"] not in present and e["dir"] not in insert:
-                insert.append(e["dir"])
-                added.append(e["dir"])
+            if e["name"] not in present and e["name"] not in insert:
+                insert.append(e["name"])
+                added.append(e["name"])
         for b in domain:
             if not _is_root(b["owner"]):
                 continue  # contained entity: no root bucket, nests under its owner
@@ -336,16 +359,21 @@ def merge(project_dir, account_dir):
     text = _strip_region(text, MARK_START, MARK_END)
     text = _strip_region(text, ONT_START, ONT_END)
     if owned:
-        region = [MARK_START, "## Plugin-owned top-level workspaces", "",
-                  "A plugin that owns a top-level workspace declares it. The internal",
-                  "structure is owned by that plugin's tools and recreated on the next",
-                  "write. Never reorganise it.", ""]
+        region = [MARK_START, "## Plugin-owned top-level entries", "",
+                  "A plugin declares the account-root entries its feature owns. A",
+                  "directory's internal structure belongs to that plugin's tools and is",
+                  "recreated on the next write, so never reorganise it; a declared file",
+                  "is written whole by its owner. Neither is operator data.", ""]
         for e in owned:
             desc = e["description"] or f"Owned by the {e['plugin']} plugin."
-            region.append(f"- `{e['dir']}/` — {desc}")
+            # The trailing slash marks a bucket. Three readers anchor on it to
+            # tell a directory from a declared file (account-schema-regions,
+            # schema-exposed-dirs.mjs), so a file must never gain one.
+            head = f"{e['name']}/" if e["kind"] == "dir" else e["name"]
+            region.append(f"- `{head}` — {desc}")
         region.append(MARK_END)
         text = text.rstrip("\n") + "\n\n" + "\n".join(region) + "\n"
-    owned_dirs = {e["dir"] for e in owned}
+    owned_dirs = {e["name"] for e in owned if e["kind"] == "dir"}
     # A dir already claimed by a plugin (described in the plugin-owned region)
     # is not also described here, so a name collision cannot double-describe.
     described = [b for b in domain if b["dir"] not in owned_dirs]
@@ -387,8 +415,9 @@ def reconcile(project_dir, account_dir):
             entries, _s, _e = _allowed_block(f.read())
         present = set(entries or [])
     for e in owned:
-        is_present = "true" if e["dir"] in present else "false"
-        print(f"brand={brand} plugin={e['plugin']} ownedDir={e['dir']} present={is_present}")
+        is_present = "true" if e["name"] in present else "false"
+        label = "ownedDir" if e["kind"] == "dir" else "ownedFile"
+        print(f"brand={brand} plugin={e['plugin']} {label}={e['name']} present={is_present}")
     vertical = _read_vertical(project_dir)
     domain = resolve_domain_buckets(project_dir)
     if vertical and not domain:

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,WAAW,SAAI,EACf,aAAa,SAAI,EACjB,UAAU,SAAI,GACb,MAAM,CAGR;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AA0DD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA8DtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}
+{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA8EA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,WAAW,SAAI,EACf,aAAa,SAAI,EACjB,UAAU,SAAI,GACb,MAAM,CAGR;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AA0DD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA8DtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}