@rubytech/create-sitedesk-code 0.1.523 → 0.1.524

package/payload/server/server.js

@@ -1798,10 +1798,10 @@ var require_dist5 = __commonJS({
 });
 
 // server/index.ts
-import { readFileSync as readFileSync44, existsSync as existsSync48, watchFile, readdirSync as readdirSync28, statSync as statSync25 } from "fs";
+import { readFileSync as readFileSync45, existsSync as existsSync48, watchFile, readdirSync as readdirSync28, statSync as statSync25 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve42, join as join52, basename as basename16 } from "path";
+import { resolve as resolve43, join as join52, basename as basename16 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -2367,11 +2367,11 @@ function staticCacheHeaders(root) {
 }
 
 // server/lib/static-mounts.ts
-function mountStaticFiles(app75, root) {
-  app75.use("/*", staticCacheHeaders(root));
-  app75.use("/assets/*", assetsVary);
-  app75.use("/assets/*", serveStatic({ root, precompressed: true }));
-  app75.use("/*", serveStatic({ root }));
+function mountStaticFiles(app76, root) {
+  app76.use("/*", staticCacheHeaders(root));
+  app76.use("/assets/*", assetsVary);
+  app76.use("/assets/*", serveStatic({ root, precompressed: true }));
+  app76.use("/*", serveStatic({ root }));
 }
 var assetsVary = async (c, next) => {
   await next();
@@ -3308,20 +3308,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve43) => {
+  return new Promise((resolve44) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve43(true);
+      resolve44(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve43(false);
+      resolve44(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve43(false);
+      resolve44(false);
     });
   });
 }
@@ -3582,8 +3582,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app75 = new Hono();
-  app75.post("/", async (c) => {
+  const app76 = new Hono();
+  app76.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -3855,7 +3855,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app75;
+  return app76;
 }
 
 // server/routes/channel/schedule-inject.ts
@@ -4799,8 +4799,8 @@ function transcriptBoundary(sessionKey) {
   }
 }
 function createScheduleInjectRoutes(deps) {
-  const app75 = new Hono();
-  app75.post("/", async (c) => {
+  const app76 = new Hono();
+  app76.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -4902,7 +4902,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG5} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true, sessionKey: sessionId, ...transcriptBoundary(sessionId) }, 200);
   });
-  return app75;
+  return app76;
 }
 
 // server/index.ts
@@ -5012,7 +5012,7 @@ async function defaultResolve(accountId) {
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
-  const resolve43 = deps.resolve;
+  const resolve44 = deps.resolve;
   const httpGet = deps.httpGet ?? defaultHttpGet;
   const maxAgeMs = deps.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const cached3 = readAvatar(accountId, jid);
@@ -5022,7 +5022,7 @@ async function fetchAvatar(accountId, jid, deps = {}) {
     return "fresh";
   }
   console.log(`${TAG6} op=cache jid=${jid} hit=false ageMs=${ageMs2}`);
-  const res = resolve43 ? resolve43(accountId) : await defaultResolve(accountId);
+  const res = resolve44 ? resolve44(accountId) : await defaultResolve(accountId);
   if (!res.ok) {
     console.log(`${TAG6} op=no-socket jid=${jid} account=${accountId.slice(0, 8)} reason=${res.reason}`);
     return "no-socket";
@@ -5991,8 +5991,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve43, reject) => {
-    resolveCode = resolve43;
+  const codePromise = new Promise((resolve44, reject) => {
+    resolveCode = resolve44;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -11430,8 +11430,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app75 = new Hono();
-  app75.post("/send", requireAdminSession, async (c) => {
+  const app76 = new Hono();
+  app76.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -11629,7 +11629,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app75.post("/interrupt", requireAdminSession, async (c) => {
+  app76.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -11657,7 +11657,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app75.post("/settings", requireAdminSession, async (c) => {
+  app76.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -11693,7 +11693,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted accountId=${account.accountId.slice(0, 8)} value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app75.get("/session", requireAdminSession, async (c) => {
+  app76.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -11766,7 +11766,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app75.post("/permission-verdict", requireAdminSession, async (c) => {
+  app76.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -11783,7 +11783,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app75;
+  return app76;
 }
 
 // server/routes/webchat-greeting.ts
@@ -13139,15 +13139,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve43 = async (a) => {
+  const resolve44 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve43)
+    accounts.filter((a) => a.config.role === "house").map(resolve44)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve43)
+    accounts.filter((a) => a.config.role !== "house").map(resolve44)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -15902,18 +15902,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app24 = new Hono();
 app24.post("/", async (c) => {
-  const TAG49 = "[admin:events]";
+  const TAG50 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG49} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG50} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG49} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG50} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -22504,9 +22504,111 @@ var data_portal_default = app50;
 // server/routes/admin/routines.ts
 import cronParser from "cron-parser";
 import { int as int2 } from "neo4j-driver";
+
+// ../lib/agent-dispatch-rule/src/index.ts
+import { readFileSync as readFileSync36 } from "fs";
+import { resolve as resolve30 } from "path";
+function normalizeE1642(value) {
+  let candidate = value.trim().replace(/[\s\-().]/g, "");
+  candidate = candidate.replace(/^whatsapp:/i, "");
+  if (candidate.startsWith("+")) candidate = candidate.slice(1);
+  else if (candidate.startsWith("00")) candidate = candidate.slice(2);
+  if (!/^\d+$/.test(candidate)) return "";
+  return candidate;
+}
+function phonesMatch2(a, b) {
+  const na = normalizeE1642(a);
+  const nb = normalizeE1642(b);
+  return na.length > 0 && na === nb;
+}
+function readChannelAdmins(accountDir, channel) {
+  let config = {};
+  try {
+    config = JSON.parse(readFileSync36(resolve30(accountDir, "account.json"), "utf-8"));
+  } catch {
+    config = {};
+  }
+  if (channel === "whatsapp") {
+    const wa = config.whatsapp ?? {};
+    const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
+    const managersRaw = wa.accountManagers ?? {};
+    const accountManagers = {};
+    for (const [k, v] of Object.entries(managersRaw)) {
+      if (typeof v === "string") accountManagers[k] = v;
+      else if (v && typeof v === "object" && typeof v.managesAccount === "string") {
+        const mode = v.mode;
+        if (mode === void 0 || mode === "active") {
+          accountManagers[k] = v.managesAccount;
+        }
+      }
+    }
+    return { adminPhones, accountManagers };
+  }
+  const tg = config.telegram ?? {};
+  const adminUsers = Array.isArray(tg.adminUsers) ? tg.adminUsers.filter((u) => typeof u === "number") : [];
+  return { adminUsers };
+}
+function registeredAccountForDestination(houseDir, houseAccountId, destination) {
+  const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
+  for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
+    if (subAccountId && phonesMatch2(managerPhone, destination)) return subAccountId;
+  }
+  if (adminPhones.some((p) => phonesMatch2(p, destination))) return houseAccountId;
+  return null;
+}
+function validateAgentDestination(accountsDir, houseAccountId, creatingAccountId, channel, destination) {
+  if (channel === "whatsapp") {
+    const houseDir = resolve30(accountsDir, houseAccountId);
+    const registered = registeredAccountForDestination(houseDir, houseAccountId, destination);
+    if (registered === null) return { valid: false, reason: "not-registered" };
+    if (creatingAccountId === houseAccountId) return { valid: true };
+    if (registered === creatingAccountId) return { valid: true };
+    return {
+      valid: false,
+      reason: "cross-account",
+      destinationAccount: registered,
+      scheduleAccount: creatingAccountId
+    };
+  }
+  const { adminUsers } = readChannelAdmins(resolve30(accountsDir, creatingAccountId), "telegram");
+  const asNumber = Number(destination);
+  const ok = Number.isInteger(asNumber) && adminUsers.includes(asNumber);
+  return ok ? { valid: true } : { valid: false, reason: "not-registered" };
+}
+function listDispatchDestinations(input) {
+  const { accountsDir, houseAccountId, accountId } = input;
+  const managers = [];
+  const admins = [];
+  if (houseAccountId !== null) {
+    const houseDir = resolve30(accountsDir, houseAccountId);
+    const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
+    const seen = /* @__PURE__ */ new Set();
+    for (const [phone, subAccountId] of Object.entries(accountManagers)) {
+      const key = normalizeE1642(phone);
+      if (key.length === 0 || seen.has(key)) continue;
+      if (accountId !== houseAccountId && subAccountId !== accountId) continue;
+      seen.add(key);
+      managers.push({ channel: "whatsapp", destination: phone, label: "Account manager" });
+    }
+    for (const phone of adminPhones) {
+      const key = normalizeE1642(phone);
+      if (key.length === 0 || seen.has(key)) continue;
+      if (accountId !== houseAccountId) continue;
+      seen.add(key);
+      admins.push({ channel: "whatsapp", destination: phone, label: "House admin" });
+    }
+  }
+  const { adminUsers } = readChannelAdmins(resolve30(accountsDir, accountId), "telegram");
+  const telegram = [...adminUsers].sort((a, b) => a - b).map((id) => ({ channel: "telegram", destination: String(id), label: "Telegram admin" }));
+  const byDestination = (a, b) => a.destination.localeCompare(b.destination);
+  return [...managers.sort(byDestination), ...admins.sort(byDestination), ...telegram];
+}
+
+// server/routes/admin/routines.ts
 var { parseExpression } = cronParser;
 var app51 = new Hono();
 var AUTOMATION_WHERE = "(e.recurrence IS NOT NULL OR e.agentChannel IS NOT NULL OR e.actionPlugin IS NOT NULL)";
+var DISPATCH_CHANNELS = /* @__PURE__ */ new Set(["whatsapp", "telegram"]);
 var ROUTINE_COLS = `e.eventId AS eventId, e.name AS name, e.eventStatus AS eventStatus,
   e.recurrence AS recurrence, e.nextRun AS nextRun, e.lastTriggered AS lastTriggered,
   e.timezone AS timezone, e.startDate AS startDate,
@@ -22622,6 +22724,74 @@ function mapRun(props) {
     error: props.error ?? null
   };
 }
+var RUN_CSV_COLUMNS = [
+  "runId",
+  "eventId",
+  "kind",
+  "mode",
+  "status",
+  "target",
+  "scheduledFor",
+  "startedAt",
+  "endedAt",
+  "finishedAt",
+  "ranMs",
+  "httpStatus",
+  "dispatchResult",
+  "sessionKey",
+  "transcriptOffset",
+  "bounded",
+  "error"
+];
+function csvField(v) {
+  if (v === null || v === void 0) return "";
+  const s = String(v);
+  return /["\r\n,]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+}
+function toCsv(rows) {
+  const lines = [RUN_CSV_COLUMNS.join(",")];
+  for (const row of rows) {
+    lines.push(RUN_CSV_COLUMNS.map((k) => csvField(row[k])).join(","));
+  }
+  return lines.join("\r\n") + "\r\n";
+}
+function countCsvDataRows(csv) {
+  let rows = 0;
+  let inQuotes = false;
+  let sawContent = false;
+  for (let i = 0; i < csv.length; i++) {
+    const ch = csv[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (csv[i + 1] === '"') i++;
+        else inQuotes = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inQuotes = true;
+      sawContent = true;
+      continue;
+    }
+    if (ch === "\n") {
+      if (sawContent) rows++;
+      sawContent = false;
+      continue;
+    }
+    if (ch !== "\r") sawContent = true;
+  }
+  if (sawContent) rows++;
+  return Math.max(rows - 1, 0);
+}
+function runsCsvGuard(csv, expected) {
+  const emitted = countCsvDataRows(csv);
+  return emitted === expected ? { ok: true } : { ok: false, emitted };
+}
+function runsCsvFilename(name, eventId, date) {
+  const clean = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const slug = clean(name ?? "").slice(0, 48).replace(/-+$/, "");
+  return `${slug || clean(eventId.slice(0, 8)) || "routine"}-runs-${date}.csv`;
+}
 app51.get("/:eventId/runs", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) {
@@ -22652,6 +22822,53 @@ app51.get("/:eventId/runs", requireAdminSession, async (c) => {
     await session.close();
   }
 });
+app51.get("/:eventId/runs.csv", requireAdminSession, async (c) => {
+  const accountId = getAccountIdForSession(c.var.cacheKey);
+  const eventId = c.req.param("eventId");
+  if (!accountId) {
+    console.error('[admin:routines] op=runs-export auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (r:RoutineRun)-[:RUN_OF]->(e:Event {eventId: $eventId, accountId: $accountId})
+       WHERE r.accountId = $accountId
+       RETURN r, e.name AS name
+       ORDER BY r.startedAt DESC`,
+      { eventId, accountId }
+    );
+    if (res.records.length === 0) {
+      console.error(`[admin:routines] op=runs-export id=${eventId.slice(0, 8)} rows=0 bytes=0 outcome=not-found`);
+      return c.json({ error: "No runs for this routine" }, 404);
+    }
+    const rows = res.records.map(
+      (rec) => mapRun(rec.get("r").properties)
+    );
+    const name = res.records[0].get("name") ?? null;
+    const csv = toCsv(rows);
+    const bytes = Buffer.byteLength(csv, "utf-8");
+    const guard = runsCsvGuard(csv, rows.length);
+    if (!guard.ok) {
+      console.error(
+        `[admin:routines] op=runs-export id=${eventId.slice(0, 8)} rows=${guard.emitted} bytes=${bytes} outcome=mismatch expected=${rows.length}`
+      );
+      return c.json({ error: "Failed to produce a complete run history" }, 500);
+    }
+    const filename = runsCsvFilename(name, eventId, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10));
+    console.log(`[admin:routines] op=runs-export id=${eventId.slice(0, 8)} rows=${rows.length} bytes=${bytes} outcome=ok`);
+    return c.body(csv, 200, {
+      "content-type": "text/csv; charset=utf-8",
+      "content-disposition": `attachment; filename="${filename}"`
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[admin:routines] op=runs-export id=${eventId.slice(0, 8)} outcome=error err="${message}"`);
+    return c.json({ error: `Run export failed: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
 app51.get("/:eventId", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -22681,33 +22898,110 @@ app51.patch("/:eventId", requireAdminSession, async (c) => {
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
   const eventId = c.req.param("eventId");
   const body = await c.req.json().catch(() => ({}));
+  const id82 = eventId.slice(0, 8);
   const setClauses = [];
   const params = { eventId, accountId };
   const fields = [];
   let nextRunLog = "unchanged";
-  if (typeof body.agentPrompt === "string") {
-    setClauses.push("e.agentPrompt = $agentPrompt");
-    params.agentPrompt = body.agentPrompt;
-    fields.push("agentPrompt");
-    setClauses.push("e.operatorEdited = $operatorEdited");
-    params.operatorEdited = (/* @__PURE__ */ new Date()).toISOString();
-  }
-  if (typeof body.recurrence === "string") {
-    const tzSession = getSession();
-    let timezone = null;
+  let bindingLog = "";
+  const hasChannel = "agentChannel" in body;
+  const hasDestination = "agentDestination" in body;
+  const bindingTouched = hasChannel || hasDestination;
+  const clearing = bindingTouched && body.agentChannel === null && body.agentDestination === null;
+  const binding = bindingTouched && typeof body.agentChannel === "string" && body.agentChannel.length > 0 && typeof body.agentDestination === "string" && body.agentDestination.length > 0;
+  if (bindingTouched && !clearing && !binding) {
+    console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=partial-binding`);
+    return c.json({ error: "A dispatch binding needs both a channel and a destination, or both cleared." }, 400);
+  }
+  if (binding && !DISPATCH_CHANNELS.has(body.agentChannel)) {
+    console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=invalid-channel channel=${body.agentChannel}`);
+    return c.json({ error: `Unknown dispatch channel "${body.agentChannel}".` }, 400);
+  }
+  let timezone = null;
+  let storedPrompt = null;
+  let storedRecurrence = null;
+  let storedActionPlugin = null;
+  if (typeof body.recurrence === "string" || binding || clearing) {
+    const preSession = getSession();
     try {
-      const tzRes = await tzSession.run(
-        `MATCH (e:Event {eventId: $eventId, accountId: $accountId}) RETURN e.timezone AS timezone`,
+      const pre = await preSession.run(
+        `MATCH (e:Event {eventId: $eventId, accountId: $accountId})
+         RETURN e.timezone AS timezone, e.agentPrompt AS agentPrompt,
+                e.recurrence AS recurrence, e.actionPlugin AS actionPlugin`,
         { eventId, accountId }
       );
-      timezone = tzRes.records[0]?.get("timezone") ?? null;
+      timezone = pre.records[0]?.get("timezone") ?? null;
+      storedPrompt = pre.records[0]?.get("agentPrompt") ?? null;
+      storedRecurrence = pre.records[0]?.get("recurrence") ?? null;
+      storedActionPlugin = pre.records[0]?.get("actionPlugin") ?? null;
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      console.error(`[admin:routines] op=patch id=${eventId.slice(0, 8)} outcome=rejected reason=tz-read-fail err="${message}"`);
+      console.error(`[admin:routines] op=patch id=${id82} outcome=rejected reason=tz-read-fail err="${message}"`);
       return c.json({ error: `Routine unavailable: ${message}` }, 503);
     } finally {
-      await tzSession.close();
+      await preSession.close();
+    }
+  }
+  if (binding) {
+    if (storedActionPlugin !== null) {
+      console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=action-routine`);
+      return c.json(
+        { error: "This routine runs a tool. Binding a dispatch would stop the tool running, so it is refused; make a separate routine for the dispatch." },
+        400
+      );
+    }
+    const effectivePrompt = typeof body.agentPrompt === "string" ? body.agentPrompt : storedPrompt ?? "";
+    if (effectivePrompt.trim().length === 0) {
+      console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=no-prompt`);
+      return c.json({ error: "A bound routine needs an instruction, or it will fire and do nothing." }, 400);
+    }
+    const channel = body.agentChannel;
+    const destination = body.agentDestination;
+    let houseAccountId;
+    try {
+      houseAccountId = channel === "whatsapp" ? resolveHouseOrSoleAccountId(ACCOUNTS_DIR) : accountId;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=house-unresolved err="${message}"`);
+      return c.json({ error: `WhatsApp destinations cannot be validated on this install: ${message}` }, 503);
     }
+    const check = validateAgentDestination(ACCOUNTS_DIR, houseAccountId, accountId, channel, destination);
+    if (!check.valid) {
+      console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=${check.reason}`);
+      return c.json(
+        {
+          error: check.reason === "cross-account" ? `That destination belongs to a different account on ${channel}.` : `That destination is not a registered admin or account manager on ${channel}.`
+        },
+        400
+      );
+    }
+    setClauses.push("e.agentChannel = $agentChannel", "e.agentDestination = $agentDestination");
+    params.agentChannel = channel;
+    params.agentDestination = destination;
+    fields.push("agentChannel", "agentDestination");
+    bindingLog = ` channel=${channel} destination=${destination.slice(-4)}`;
+  }
+  if (clearing) {
+    const keepsRow = typeof body.recurrence === "string" || storedRecurrence !== null || storedActionPlugin !== null;
+    if (!keepsRow) {
+      console.error(`[admin:routines] op=patch id=${id82} fields=agentChannel+agentDestination outcome=rejected reason=clear-would-orphan`);
+      return c.json(
+        { error: "Clearing the dispatch on a one-time routine would leave nothing to show. Give it a schedule first, or delete it." },
+        400
+      );
+    }
+    setClauses.push("e.agentChannel = null", "e.agentDestination = null");
+    fields.push("agentChannel", "agentDestination");
+    bindingLog = " channel=none destination=none";
+  }
+  if (typeof body.agentPrompt === "string") {
+    setClauses.push("e.agentPrompt = $agentPrompt");
+    params.agentPrompt = body.agentPrompt;
+    fields.push("agentPrompt");
+    setClauses.push("e.operatorEdited = $operatorEdited");
+    params.operatorEdited = (/* @__PURE__ */ new Date()).toISOString();
+  }
+  if (typeof body.recurrence === "string") {
     try {
       const interval = parseExpression(body.recurrence, { currentDate: /* @__PURE__ */ new Date(), tz: timezone ?? void 0 });
       const nextRun = interval.next().toISOString();
@@ -22718,7 +23012,7 @@ app51.patch("/:eventId", requireAdminSession, async (c) => {
       nextRunLog = nextRun;
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
-      console.error(`[admin:routines] op=patch id=${eventId.slice(0, 8)} outcome=rejected reason=invalid-cron cron=${body.recurrence}`);
+      console.error(`[admin:routines] op=patch id=${id82} outcome=rejected reason=invalid-cron cron=${body.recurrence}`);
       return c.json({ error: `Invalid recurrence: ${reason}` }, 400);
     }
   }
@@ -22735,14 +23029,14 @@ app51.patch("/:eventId", requireAdminSession, async (c) => {
       params
     );
     if (res.records.length === 0) {
-      console.error(`[admin:routines] op=patch id=${eventId.slice(0, 8)} outcome=rejected reason=not-found`);
+      console.error(`[admin:routines] op=patch id=${id82} outcome=rejected reason=not-found`);
       return c.json({ error: "Routine not found" }, 404);
     }
-    console.log(`[admin:routines] op=patch id=${eventId.slice(0, 8)} fields=${fields.join("+")} outcome=ok nextRun=${nextRunLog} cron=${params.recurrence ?? "unchanged"}`);
+    console.log(`[admin:routines] op=patch id=${id82} fields=${fields.join("+")} outcome=ok nextRun=${nextRunLog} cron=${params.recurrence ?? "unchanged"}${bindingLog}`);
     return c.json({ routine: mapRoutine(res.records[0]) });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[admin:routines] op=patch id=${eventId.slice(0, 8)} outcome=rejected reason=${message}`);
+    console.error(`[admin:routines] op=patch id=${id82} outcome=rejected reason=${message}`);
     return c.json({ error: `Update failed: ${message}` }, 503);
   } finally {
     await session.close();
@@ -22971,8 +23265,8 @@ app51.delete("/:eventId", requireAdminSession, async (c) => {
 var routines_default = app51;
 
 // server/routes/admin/skills.ts
-import { existsSync as existsSync39, readdirSync as readdirSync24, readFileSync as readFileSync36, rmSync as rmSync4 } from "fs";
-import { resolve as resolve30 } from "path";
+import { existsSync as existsSync39, readdirSync as readdirSync24, readFileSync as readFileSync37, rmSync as rmSync4 } from "fs";
+import { resolve as resolve31 } from "path";
 var app52 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function splitSkillMd(text) {
@@ -23010,18 +23304,18 @@ app52.get("/", requireAdminSession, async (c) => {
   }
   ensureAccountWatchers(acct.accountId, acct.accountDir);
   const { value, state } = await getOrCompute("skills", acct.accountId, async () => {
-    const pluginsDir = resolve30(acct.accountDir, "plugins");
+    const pluginsDir = resolve31(acct.accountDir, "plugins");
     const skills = [];
     let pluginCount = 0;
     for (const plugin of subdirs2(pluginsDir)) {
       pluginCount++;
-      const skillsDir = resolve30(pluginsDir, plugin, "skills");
+      const skillsDir = resolve31(pluginsDir, plugin, "skills");
       for (const skill of subdirs2(skillsDir)) {
-        const skillMd = resolve30(skillsDir, skill, "SKILL.md");
+        const skillMd = resolve31(skillsDir, skill, "SKILL.md");
         if (!existsSync39(skillMd)) continue;
         try {
-          const { frontmatter } = splitSkillMd(readFileSync36(skillMd, "utf-8"));
-          const refsDir = resolve30(skillsDir, skill, "references");
+          const { frontmatter } = splitSkillMd(readFileSync37(skillMd, "utf-8"));
+          const refsDir = resolve31(skillsDir, skill, "references");
           const refCount = existsSync39(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
           skills.push({ plugin, skill, description: frontmatter.description, refCount });
         } catch (err) {
@@ -23044,14 +23338,14 @@ app52.get("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=get outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const skillDir = resolve30(acct.accountDir, "plugins", plugin, "skills", skill);
-  const skillMd = resolve30(skillDir, "SKILL.md");
+  const skillDir = resolve31(acct.accountDir, "plugins", plugin, "skills", skill);
+  const skillMd = resolve31(skillDir, "SKILL.md");
   const found = existsSync39(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
-    const { frontmatter, body } = splitSkillMd(readFileSync36(skillMd, "utf-8"));
-    const refsDir = resolve30(skillDir, "references");
+    const { frontmatter, body } = splitSkillMd(readFileSync37(skillMd, "utf-8"));
+    const refsDir = resolve31(skillDir, "references");
     const references = existsSync39(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
@@ -23069,10 +23363,10 @@ app52.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=delete outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const pluginDir = resolve30(acct.accountDir, "plugins", plugin);
-  const skillsDir = resolve30(pluginDir, "skills");
-  const skillDir = resolve30(skillsDir, skill);
-  if (!existsSync39(resolve30(skillDir, "SKILL.md"))) {
+  const pluginDir = resolve31(acct.accountDir, "plugins", plugin);
+  const skillsDir = resolve31(pluginDir, "skills");
+  const skillDir = resolve31(skillsDir, skill);
+  if (!existsSync39(resolve31(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -23552,8 +23846,8 @@ app57.post("/", requireAdminSession, async (c) => {
 var task_time_adjust_default = app57;
 
 // app/lib/admin-roster.ts
-import { existsSync as existsSync40, readdirSync as readdirSync25, readFileSync as readFileSync37 } from "fs";
-import { resolve as resolve31 } from "path";
+import { existsSync as existsSync40, readdirSync as readdirSync25, readFileSync as readFileSync38 } from "fs";
+import { resolve as resolve32 } from "path";
 function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
   let entries2;
   try {
@@ -23562,10 +23856,10 @@ function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
     return [];
   }
   for (const entry of entries2) {
-    const cfgPath = resolve31(accountsDir, entry, "account.json");
+    const cfgPath = resolve32(accountsDir, entry, "account.json");
     if (!existsSync40(cfgPath)) continue;
     try {
-      const cfg = JSON.parse(readFileSync37(cfgPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync38(cfgPath, "utf-8"));
       if (cfg.role !== "house") continue;
       if (!Array.isArray(cfg.admins)) return [];
       return cfg.admins.map(
@@ -23891,10 +24185,34 @@ app61.get("/", requireAdminSession, async (c) => {
 });
 var admin_users_list_default = app61;
 
+// server/routes/admin/dispatch-destinations.ts
+var TAG37 = "[admin:routines]";
+var app62 = new Hono();
+app62.get("/", requireAdminSession, async (c) => {
+  const accountId = getAccountIdForSession(c.var.cacheKey);
+  if (!accountId) {
+    console.error(`${TAG37} op=destinations auth-rejected reason="no account for session"`);
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  let houseAccountId = null;
+  try {
+    houseAccountId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG37} op=destinations account=${accountId.slice(0, 8)} outcome=house-unresolved reason="${message}"`);
+  }
+  const destinations = listDispatchDestinations({ accountsDir: ACCOUNTS_DIR, houseAccountId, accountId });
+  console.log(
+    `${TAG37} op=destinations account=${accountId.slice(0, 8)} count=${destinations.length}` + (houseAccountId === null ? " outcome=house-unresolved" : "")
+  );
+  return c.json({ destinations });
+});
+var dispatch_destinations_default = app62;
+
 // server/routes/admin/activity.ts
 import { readdirSync as readdirSync26 } from "fs";
-var app62 = new Hono();
-var TAG37 = "[activity]";
+var app63 = new Hono();
+var TAG38 = "[activity]";
 function resolveHouseAccountId(accounts) {
   const houses = accounts.filter((a) => a.config.role === "house");
   if (houses.length === 1) return { accountId: houses[0].accountId, reason: "house" };
@@ -23915,7 +24233,7 @@ function countAccountDirsOnDisk() {
     return null;
   }
 }
-app62.get("/", requireAdminSession, async (c) => {
+app63.get("/", requireAdminSession, async (c) => {
   const req = requestToken();
   const cacheKey = c.var.cacheKey;
   const caller2 = getAccountIdForSession(cacheKey) ?? null;
@@ -23923,19 +24241,19 @@ app62.get("/", requireAdminSession, async (c) => {
   const house = resolveHouseAccountId(valid);
   const isHouse = caller2 !== null && house.accountId !== null && caller2 === house.accountId;
   console.log(
-    `${TAG37} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
+    `${TAG38} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
   );
   if (!isHouse) {
     const reason = house.accountId === null ? house.reason : "not-house";
     console.error(
-      `${TAG37} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
+      `${TAG38} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
     );
     return c.json({ error: "house-only" }, 403);
   }
-  console.log(`${TAG37} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
+  console.log(`${TAG38} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
   const onDisk = countAccountDirsOnDisk();
   console.log(
-    `${TAG37} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
+    `${TAG38} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
   );
   const start = Date.now();
   let res;
@@ -23951,17 +24269,17 @@ app62.get("/", requireAdminSession, async (c) => {
     });
   } catch (err) {
     console.error(
-      `${TAG37} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
+      `${TAG38} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
     );
     return c.json({ error: "manager-unreachable" }, 502);
   }
   if (res.status !== 200) {
-    console.error(`${TAG37} op=manager-fail req=${req} reason=status status=${res.status}`);
+    console.error(`${TAG38} op=manager-fail req=${req} reason=status status=${res.status}`);
     return c.json({ error: `manager-status-${res.status}` }, 502);
   }
   const body = await res.json().catch(() => null);
   if (!body || !Array.isArray(body.rows)) {
-    console.error(`${TAG37} op=manager-fail req=${req} reason=bad-json`);
+    console.error(`${TAG38} op=manager-fail req=${req} reason=bad-json`);
     return c.json({ error: "manager-bad-json" }, 502);
   }
   const rows = body.rows;
@@ -23972,10 +24290,10 @@ app62.get("/", requireAdminSession, async (c) => {
   const ageNull = rows.filter((r) => r.ageMs === null).length;
   const sidecarNull = rows.filter((r) => r.sidecarMissing).length;
   console.log(
-    `${TAG37} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
+    `${TAG38} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
   );
   console.log(
-    `${TAG37} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
+    `${TAG38} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
   );
   const names = {};
   await Promise.all(
@@ -23994,7 +24312,7 @@ app62.get("/", requireAdminSession, async (c) => {
     return acc;
   }, {});
   console.log(
-    `${TAG37} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
+    `${TAG38} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
   );
   return c.json({
     rows,
@@ -24024,68 +24342,69 @@ app62.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var activity_default = app62;
+var activity_default = app63;
 
 // server/routes/admin/index.ts
-var app63 = new Hono();
-app63.route("/session", session_default);
-app63.route("/accounts", accounts_default);
-app63.route("/logs", logs_default);
-app63.route("/claude-info", claude_info_default);
-app63.route("/attachment", attachment_default);
-app63.route("/session-upload", session_upload_default);
-app63.route("/agents", agents_default);
-app63.route("/sessions", sessions_default);
-app63.route("/claude-sessions", claude_sessions_default);
-app63.route("/log-ingest", log_ingest_default);
-app63.route("/events", events_default);
-app63.route("/files", files_default);
-app63.route("/graph-search", graph_search_default);
-app63.route("/graph-subgraph", graph_subgraph_default);
-app63.route("/graph-delete", graph_delete_default);
-app63.route("/graph-restore", graph_restore_default);
-app63.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app63.route("/graph-default-view", graph_default_view_default);
-app63.route("/sidebar-artefacts", sidebar_artefacts_default);
-app63.route("/sidebar-sessions", sidebar_sessions_default);
-app63.route("/session-delete", session_delete_default);
-app63.route("/session-stop", session_stop_default);
-app63.route("/session-archive", session_archive_default);
-app63.route("/session-rename", session_rename_default);
-app63.route("/session-usage", session_usage_default);
-app63.route("/browser", browser_default);
-app63.route("/session-rc-spawn", session_rc_spawn_default);
-app63.route("/session-reseat", session_reseat_default);
-app63.route("/system-stats", system_stats_default);
-app63.route("/health-brand", health_default2);
-app63.route("/linkedin-ingest", linkedin_ingest_default);
-app63.route("/post-turn-context", post_turn_context_default);
-app63.route("/public-session-context", public_session_context_default);
-app63.route("/public-session-exit", public_session_exit_default);
-app63.route("/access-session-evict", access_session_evict_default);
-app63.route("/enrol-person", enrol_person_default);
-app63.route("/calendar", calendar_default);
-app63.route("/data-portal", data_portal_default);
-app63.route("/routines", routines_default);
-app63.route("/skills", skills_default);
-app63.route("/tasks-list", tasks_list_default);
-app63.route("/task-timer-start", task_timer_start_default);
-app63.route("/task-timer-stop", task_timer_stop_default);
-app63.route("/task-complete", task_complete_default);
-app63.route("/task-time-adjust", task_time_adjust_default);
-app63.route("/task-assign", task_assign_default);
-app63.route("/task-session-open", task_session_open_default);
-app63.route("/task-session-link", task_session_link_default);
-app63.route("/admin-users-list", admin_users_list_default);
-app63.route("/activity", activity_default);
-var admin_default = app63;
+var app64 = new Hono();
+app64.route("/session", session_default);
+app64.route("/accounts", accounts_default);
+app64.route("/logs", logs_default);
+app64.route("/claude-info", claude_info_default);
+app64.route("/attachment", attachment_default);
+app64.route("/session-upload", session_upload_default);
+app64.route("/agents", agents_default);
+app64.route("/sessions", sessions_default);
+app64.route("/claude-sessions", claude_sessions_default);
+app64.route("/log-ingest", log_ingest_default);
+app64.route("/events", events_default);
+app64.route("/files", files_default);
+app64.route("/graph-search", graph_search_default);
+app64.route("/graph-subgraph", graph_subgraph_default);
+app64.route("/graph-delete", graph_delete_default);
+app64.route("/graph-restore", graph_restore_default);
+app64.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app64.route("/graph-default-view", graph_default_view_default);
+app64.route("/sidebar-artefacts", sidebar_artefacts_default);
+app64.route("/sidebar-sessions", sidebar_sessions_default);
+app64.route("/session-delete", session_delete_default);
+app64.route("/session-stop", session_stop_default);
+app64.route("/session-archive", session_archive_default);
+app64.route("/session-rename", session_rename_default);
+app64.route("/session-usage", session_usage_default);
+app64.route("/browser", browser_default);
+app64.route("/session-rc-spawn", session_rc_spawn_default);
+app64.route("/session-reseat", session_reseat_default);
+app64.route("/system-stats", system_stats_default);
+app64.route("/health-brand", health_default2);
+app64.route("/linkedin-ingest", linkedin_ingest_default);
+app64.route("/post-turn-context", post_turn_context_default);
+app64.route("/public-session-context", public_session_context_default);
+app64.route("/public-session-exit", public_session_exit_default);
+app64.route("/access-session-evict", access_session_evict_default);
+app64.route("/enrol-person", enrol_person_default);
+app64.route("/calendar", calendar_default);
+app64.route("/data-portal", data_portal_default);
+app64.route("/routines", routines_default);
+app64.route("/skills", skills_default);
+app64.route("/tasks-list", tasks_list_default);
+app64.route("/task-timer-start", task_timer_start_default);
+app64.route("/task-timer-stop", task_timer_stop_default);
+app64.route("/task-complete", task_complete_default);
+app64.route("/task-time-adjust", task_time_adjust_default);
+app64.route("/task-assign", task_assign_default);
+app64.route("/task-session-open", task_session_open_default);
+app64.route("/task-session-link", task_session_link_default);
+app64.route("/admin-users-list", admin_users_list_default);
+app64.route("/dispatch-destinations", dispatch_destinations_default);
+app64.route("/activity", activity_default);
+var admin_default = app64;
 
 // server/routes/access/verify-token.ts
-var TAG38 = "[access-verify]";
+var TAG39 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app64 = new Hono();
-app64.post("/", async (c) => {
+var app65 = new Hono();
+app65.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -24100,39 +24419,39 @@ app64.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG38} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG39} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG38} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG39} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -24148,12 +24467,12 @@ app64.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -24167,13 +24486,13 @@ app64.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app64;
+var verify_token_default = app65;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve32 } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
-var SEND_SCRIPT = resolve32(
+import { resolve as resolve33 } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve33(process.cwd(), "..");
+var SEND_SCRIPT = resolve33(
   PLATFORM_ROOT5,
   "plugins",
   "email",
@@ -24229,10 +24548,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG39 = "[access-request-link]";
-var app65 = new Hono();
+var TAG40 = "[access-request-link]";
+var app66 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app65.post("/", async (c) => {
+app66.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24246,18 +24565,18 @@ app65.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG39} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG40} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG39} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG40} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG39} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG40} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -24265,7 +24584,7 @@ app65.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG39} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG40} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -24297,26 +24616,26 @@ app65.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG39} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG40} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG39} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG40} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app65;
+var request_magic_link_default = app66;
 
 // server/routes/access/index.ts
-var app66 = new Hono();
-app66.route("/verify-token", verify_token_default);
-app66.route("/request-magic-link", request_magic_link_default);
-var access_default = app66;
+var app67 = new Hono();
+app67.route("/verify-token", verify_token_default);
+app67.route("/request-magic-link", request_magic_link_default);
+var access_default = app67;
 
 // server/routes/sites.ts
-import { existsSync as existsSync41, readFileSync as readFileSync38, realpathSync as realpathSync8, statSync as statSync22 } from "fs";
-import { resolve as resolve33 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync39, realpathSync as realpathSync8, statSync as statSync22 } from "fs";
+import { resolve as resolve34 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -24347,8 +24666,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app67 = new Hono();
-app67.get("/:rel{.*}", (c) => {
+var app68 = new Hono();
+app68.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -24373,8 +24692,8 @@ app67.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve33(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve33(rootDir, ...segments);
+  const rootDir = resolve34(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve34(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -24394,7 +24713,7 @@ app67.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve33(filePath, "index.html");
+    filePath = resolve34(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -24419,7 +24738,7 @@ app67.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync38(realPath);
+    body = readFileSync39(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -24451,11 +24770,11 @@ app67.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app67;
+var sites_default = app68;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync39, writeFileSync as writeFileSync14 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync40, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname15 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -24464,7 +24783,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync39(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync40(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -24478,7 +24797,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync39(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync40(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -24531,7 +24850,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync42, readFileSync as readFileSync40 } from "fs";
+import { existsSync as existsSync42, readFileSync as readFileSync41 } from "fs";
 import { join as join47 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -24543,7 +24862,7 @@ function readBrandConfig() {
   const brandPath = join47(platformRoot5, "config", "brand.json");
   if (!existsSync42(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync40(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync41(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -24551,7 +24870,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app68 = new Hono();
+var app69 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -24596,17 +24915,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app68.options("/consent", (c) => {
+app69.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app68.options("/brand-config", (c) => {
+app69.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app68.post("/consent", async (c) => {
+app69.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -24646,7 +24965,7 @@ app68.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app68.get("/brand-config", (c) => {
+app69.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -24656,7 +24975,7 @@ app68.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app68;
+var visitor_consent_default = app69;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -24683,8 +25002,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app69 = new Hono();
-app69.get("/:slug/click", async (c) => {
+var app70 = new Hono();
+app70.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -24748,10 +25067,10 @@ app69.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app69;
+var listings_default = app70;
 
 // server/routes/visitor-event.ts
-var app70 = new Hono();
+var app71 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -24827,12 +25146,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app70.options("/event", (c) => {
+app71.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app70.post("/event", async (c) => {
+app71.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -25037,17 +25356,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app70;
+var visitor_event_default = app71;
 
 // server/routes/session.ts
-import { resolve as resolve34 } from "path";
+import { resolve as resolve35 } from "path";
 import { existsSync as existsSync43, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve34(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve35(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve34(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync15(resolve35(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -25083,8 +25402,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app71 = new Hono();
-app71.post("/", async (c) => {
+var app72 = new Hono();
+app72.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25124,8 +25443,8 @@ app71.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve34(account.accountDir, "agents", agentSlug);
-    if (!existsSync43(agentDir) || !existsSync43(resolve34(agentDir, "config.json"))) {
+    const agentDir = resolve35(account.accountDir, "agents", agentSlug);
+    if (!existsSync43(agentDir) || !existsSync43(resolve35(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -25231,7 +25550,7 @@ app71.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app71;
+var session_default2 = app72;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -25314,17 +25633,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app72 = new Hono();
+var app73 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app72.options("/free-busy", (c) => {
+app73.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app72.get("/free-busy", async (c) => {
+app73.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -25380,15 +25699,15 @@ app72.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app72;
+var calendar_public_default = app73;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile11, realpath } from "fs/promises";
-import { join as join48, resolve as resolve35, sep as sep11 } from "path";
+import { join as join48, resolve as resolve36, sep as sep11 } from "path";
 import { Readable as Readable3 } from "stream";
-var app73 = new Hono();
-var TAG40 = "[portal-fetch]";
+var app74 = new Hono();
+var TAG41 = "[portal-fetch]";
 async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
   if (!secret || !signature) return false;
   if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false;
@@ -25438,19 +25757,19 @@ ${expiresAtMs}`)
   return diff === 0;
 }
 async function readAccountSecret(accountId) {
-  const path = resolve35(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path = resolve36(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
     text = await readFile11(path, "utf8");
   } catch {
-    console.error(`${TAG40} op=no-secret account="${accountId}" path="${path}"`);
+    console.error(`${TAG41} op=no-secret account="${accountId}" path="${path}"`);
     return "";
   }
   for (const line of text.split("\n")) {
     const m = line.match(/^PORTAL_FETCH_SECRET=(.*)$/);
     if (m) return m[1].trim();
   }
-  console.error(`${TAG40} op=no-secret account="${accountId}" reason=key-absent path="${path}"`);
+  console.error(`${TAG41} op=no-secret account="${accountId}" reason=key-absent path="${path}"`);
   return "";
 }
 function isValidAccountId2(value) {
@@ -25474,7 +25793,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve35(accountDir, relPath);
+  const lexical = resolve36(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -25510,33 +25829,33 @@ async function handle(c, headOnly) {
   const sig = c.req.query("sig") ?? "";
   const owner = c.req.query("owner") ?? "";
   console.log(
-    `${TAG40} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
+    `${TAG41} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
   );
   if (!isValidAccountId2(accountId)) {
-    console.error(`${TAG40} op=denied account=${q(accountId)} reason=account-id`);
+    console.error(`${TAG41} op=denied account=${q(accountId)} reason=account-id`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const secret = await readAccountSecret(accountId);
   const verified = owner ? await verifyOwnUploadSignature(secret, accountId, owner, relPath, exp, sig, Date.now()) : await verifySignature(secret, accountId, relPath, exp, sig, Date.now());
   if (!verified) {
-    console.error(`${TAG40} op=denied account=${q(accountId)} reason=secret`);
+    console.error(`${TAG41} op=denied account=${q(accountId)} reason=secret`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve35(DATA_ROOT, "accounts", accountId),
+    resolve36(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
   if (!target.ok) {
     const op = target.reason === "enoent" ? "miss" : "denied";
-    console.error(`${TAG40} op=${op} account=${accountId} reason=${target.reason}`);
+    console.error(`${TAG41} op=${op} account=${accountId} reason=${target.reason}`);
     return c.json({ ok: false, error: "not found" }, 404);
   }
   if (headOnly) {
-    console.log(`${TAG40} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
+    console.log(`${TAG41} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
     return c.body(null, 200);
   }
-  console.log(`${TAG40} op=served account=${accountId} bytes=${target.sizeBytes}`);
+  console.log(`${TAG41} op=served account=${accountId} bytes=${target.sizeBytes}`);
   return new Response(Readable3.toWeb(createReadStream3(target.absolute)), {
     status: 200,
     headers: {
@@ -25550,12 +25869,12 @@ async function handle(c, headOnly) {
     }
   });
 }
-app73.get("/fetch", (c) => handle(c, false));
-app73.on("HEAD", "/fetch", (c) => handle(c, true));
-var portal_fetch_default = app73;
+app74.get("/fetch", (c) => handle(c, false));
+app74.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app74;
 
 // app/lib/timeentry-census.ts
-var TAG41 = "[timeentry-census]";
+var TAG42 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -25595,12 +25914,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG41} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG42} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG41} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG42} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -25614,13 +25933,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG41} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG42} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG41} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG42} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -25637,7 +25956,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync27, readFileSync as readFileSync41, statSync as statSync23 } from "fs";
+import { readdirSync as readdirSync27, readFileSync as readFileSync42, statSync as statSync23 } from "fs";
 import { join as join49 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -25681,7 +26000,7 @@ function formatCensusLine(f) {
 }
 
 // app/lib/ledger-census.ts
-var TAG42 = "[ledger-census]";
+var TAG43 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries2;
@@ -25695,7 +26014,7 @@ function countWriteRejects24h(logDir, now) {
     const path = join49(logDir, name);
     try {
       if (now - statSync23(path).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync41(path, "utf8").split("\n")) {
+      for (const line of readFileSync42(path, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -25757,7 +26076,7 @@ async function runLedgerCensusOnce(session, now) {
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG42} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG43} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -25770,7 +26089,7 @@ function startLedgerCensus(openSession, opts = {}) {
       session = openSession();
     } catch (err) {
       console.error(
-        `${TAG42} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG43} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
       return;
     }
@@ -25778,7 +26097,7 @@ function startLedgerCensus(openSession, opts = {}) {
       await runLedgerCensusOnce(session, Date.now());
     } catch (err) {
       console.error(
-        `${TAG42} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG43} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
     } finally {
       try {
@@ -25796,7 +26115,7 @@ function startLedgerCensus(openSession, opts = {}) {
 }
 
 // app/lib/conversation-audit.ts
-var TAG43 = "[conversation-audit]";
+var TAG44 = "[conversation-audit]";
 async function runConversationAudit() {
   const session = getSession();
   try {
@@ -25833,12 +26152,12 @@ async function runConversationAudit() {
       multiAnchored: Number(multiRec?.get("multiAnchored") ?? 0)
     };
     console.error(
-      `${TAG43} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+      `${TAG44} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
     );
     return result;
   } catch (err) {
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(`${TAG43} op=failed reason=${reason}`);
+    console.error(`${TAG44} op=failed reason=${reason}`);
     return null;
   } finally {
     await session.close();
@@ -25964,7 +26283,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve36, sep as sep12 } from "path";
+import { resolve as resolve37, sep as sep12 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -25983,7 +26302,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve36(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve37(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -26004,7 +26323,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve36(dataRoot, relativePath);
+    const absolute = resolve37(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -26028,7 +26347,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve36(dataRoot, rootName);
+    const absRoot = resolve37(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -26067,7 +26386,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir4, readdir as readdir6, rename as rename4, rm as rm3 } from "fs/promises";
-import { dirname as dirname16, relative as relative8, resolve as resolve37 } from "path";
+import { dirname as dirname16, relative as relative8, resolve as resolve38 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -26078,7 +26397,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries2) {
-    const abs = resolve37(dir, e.name);
+    const abs = resolve38(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -26098,7 +26417,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative8(srcDir, oldAbs);
-    const newAbs = resolve37(destDir, suffix);
+    const newAbs = resolve38(destDir, suffix);
     await mkdir4(dirname16(newAbs), { recursive: true });
     await rename4(oldAbs, newAbs);
     moved++;
@@ -26125,7 +26444,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve37(dataRoot, "uploads");
+  const oldRoot = resolve38(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -26146,8 +26465,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
-          resolve37(oldRoot, name),
-          resolve37(dataRoot, "accounts", name, "uploads"),
+          resolve38(oldRoot, name),
+          resolve38(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -26159,8 +26478,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve37(oldRoot, "public"),
-          resolve37(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve38(oldRoot, "public"),
+          resolve38(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -26732,8 +27051,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app75 = new Hono();
-  app75.get("/wa-channel/inbound", (c) => {
+  const app76 = new Hono();
+  app76.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -26751,7 +27070,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app75.post("/wa-channel/reply", async (c) => {
+  app76.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -26773,7 +27092,7 @@ function createWaChannelRoutes(deps) {
     deps.onReplyDispatch?.(senderId, Date.now());
     return c.json({ ok: true });
   });
-  app75.post("/wa-channel/reply-document", async (c) => {
+  app76.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -26812,7 +27131,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app75.post("/wa-channel/ready", async (c) => {
+  app76.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -26821,7 +27140,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app75.post("/wa-channel/received", async (c) => {
+  app76.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -26831,7 +27150,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app75.post("/wa-channel/turn-end", async (c) => {
+  app76.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -26877,7 +27196,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end ${decision} delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app75;
+  return app76;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -27386,8 +27705,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app75 = new Hono();
-  app75.get("/webchat-channel/inbound", (c) => {
+  const app76 = new Hono();
+  app76.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     const role = c.req.query("role");
@@ -27412,7 +27731,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app75.post("/webchat-channel/reply", async (c) => {
+  app76.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -27422,7 +27741,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app75.post("/webchat-channel/connector-auth", async (c) => {
+  app76.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27435,7 +27754,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app75.post("/webchat-channel/ready", async (c) => {
+  app76.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -27444,7 +27763,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app75.post("/webchat-channel/permission-request", async (c) => {
+  app76.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -27458,7 +27777,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app75.post("/webchat-channel/received", async (c) => {
+  app76.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -27468,7 +27787,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app75.post("/webchat-channel/turn-end", async (c) => {
+  app76.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27488,7 +27807,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onTurnEnd?.(key, role);
     return c.json({ ok: true });
   });
-  return app75;
+  return app76;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -27546,16 +27865,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve43) => {
+    return new Promise((resolve44) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve43({ timeout: true });
+        resolve44({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve43(r);
+        resolve44(r);
       });
     });
   }
@@ -27566,11 +27885,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve43) => {
+    return new Promise((resolve44) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve43({ timeout: true });
+        resolve44({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -27580,7 +27899,7 @@ var WebchatGateway = class _WebchatGateway {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
           this.deps.onPointerChange?.(p.key);
-          resolve43(r);
+          resolve44(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28156,7 +28475,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve38 } from "path";
+import { resolve as resolve39 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -28247,29 +28566,29 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG44 = "[webchat-adaptor]";
+var TAG45 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG44} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG45} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve38(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve39(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG44} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG45} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG44} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG45} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -28278,7 +28597,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG44,
+    tag: TAG45,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -28340,7 +28659,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG45 = "[whatsapp-adaptor]";
+var TAG46 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -28358,7 +28677,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG45} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG46} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -28366,7 +28685,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG45,
+    tag: TAG46,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -28401,7 +28720,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG45} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG46} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -28584,8 +28903,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app75 = new Hono();
-  app75.get("/tg-channel/inbound", (c) => {
+  const app76 = new Hono();
+  app76.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -28603,7 +28922,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app75.post("/tg-channel/reply", async (c) => {
+  app76.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -28619,7 +28938,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app75.post("/tg-channel/ready", async (c) => {
+  app76.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -28628,7 +28947,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app75.post("/tg-channel/received", async (c) => {
+  app76.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -28638,7 +28957,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app75.post("/tg-channel/turn-end", async (c) => {
+  app76.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -28671,7 +28990,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app75;
+  return app76;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -28821,8 +29140,8 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
-import { resolve as resolve39, basename as basename15 } from "path";
-var TAG46 = "[telegram:outbound]";
+import { resolve as resolve40, basename as basename15 } from "path";
+var TAG47 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -28832,17 +29151,17 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve39(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve40(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG46} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG47} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG46} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG47} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -28851,14 +29170,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG46} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG47} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG46} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG47} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG46} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG47} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -28891,13 +29210,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG46} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG47} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG47 = "[telegram:outbound]";
+var TAG48 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -28909,11 +29228,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG47} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG48} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG47} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG48} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -28930,7 +29249,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG47,
+    tag: TAG48,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -28971,7 +29290,7 @@ function startTelegramNativeFileFollower(input) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID12 } from "crypto";
-var TAG48 = "[public-session-review]";
+var TAG49 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -28998,7 +29317,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG48} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG49} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -29022,7 +29341,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG48} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG49} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -29030,7 +29349,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG48} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG49} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -29059,7 +29378,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID12();
-  console.log(`${TAG48} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG49} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -29079,21 +29398,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -29107,19 +29426,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG48} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG49} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -29240,14 +29559,14 @@ function resolveScheduledEffectiveAccountForInstall(accountDir, destination) {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync46, readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve40 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync43 } from "fs";
+import { resolve as resolve41 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve40(a.accountDir, "calendar-availability.json");
+    const availPath = resolve41(a.accountDir, "calendar-availability.json");
     if (!existsSync46(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync42(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync43(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -29285,8 +29604,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync47, readFileSync as readFileSync43, statSync as statSync24 } from "fs";
-import { resolve as resolve41 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync44, statSync as statSync24 } from "fs";
+import { resolve as resolve42 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -29321,7 +29640,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve41(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve42(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -29333,7 +29652,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve41(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve42(brand.configDir, "entitlement.json");
   if (!existsSync47(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -29349,7 +29668,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync43(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync44(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -29363,7 +29682,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync43(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync44(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -29532,7 +29851,7 @@ if (BRAND_JSON_PATH && !existsSync48(BRAND_JSON_PATH)) {
 }
 if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync44(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync45(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -29568,7 +29887,7 @@ var ALIAS_DOMAINS_PATH = join52(homedir4(), BRAND.configDir, "alias-domains.json
 function loadAliasDomains() {
   try {
     if (!existsSync48(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync44(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync45(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -29594,7 +29913,7 @@ startManagerEventsSubscriber();
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app74 = new Hono();
+var app75 = new Hono();
 function resolveChannelOverride(accountId, channel, senderId) {
   try {
     const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
@@ -29643,7 +29962,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve42(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -29658,7 +29977,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve42(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."))
+      platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -29771,7 +30090,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app74.route("/", waGateway.routes());
+app75.route("/", waGateway.routes());
 waGateway.startSweeper();
 registerLoop({
   name: "whatsapp-link-census",
@@ -29908,7 +30227,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app74.route("/", webchatGateway.routes());
+app75.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -29952,7 +30271,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app74.route("/", telegramGateway.routes());
+app75.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -29991,19 +30310,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
   // and why the real dependencies are bound there rather than assembled here.
   effectiveAccountFor: resolveScheduledEffectiveAccountForInstall
 });
-app74.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app74.use("*", clientIpMiddleware);
+app75.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app75.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path) {
   return path === "/vnc-viewer.html" || path.startsWith("/api/admin/attachment/") || path.startsWith("/api/public-reader/attachment/") || path === "/api/admin/files/download" || path === "/api/admin/session-upload";
 }
-app74.use("*", async (c, next) => {
+app75.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app74.use("*", async (c, next) => {
+app75.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -30021,7 +30340,7 @@ app74.use("*", async (c, next) => {
     });
   }
 });
-app74.use("*", async (c, next) => {
+app75.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -30059,7 +30378,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app74.post("/__remote-auth/login", async (c) => {
+app75.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -30104,7 +30423,7 @@ app74.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app74.get("/__remote-auth/logout", (c) => {
+app75.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -30117,7 +30436,7 @@ app74.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app74.post("/__remote-auth/change-password", async (c) => {
+app75.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -30176,13 +30495,13 @@ app74.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app74.get("/__remote-auth/setup", (c) => {
+app75.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app74.post("/__remote-auth/set-initial-password", async (c) => {
+app75.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -30220,10 +30539,10 @@ app74.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app74.get("/api/remote-auth/status", (c) => {
+app75.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app74.post("/api/remote-auth/set-password", async (c) => {
+app75.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30262,10 +30581,10 @@ app74.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app74.route("/api/_client-error", client_error_default);
+app75.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app74.use("*", async (c, next) => {
+app75.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path = c.req.path;
   if (path === "/favicon.ico" || path.startsWith("/assets/") || path.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -30309,30 +30628,30 @@ app74.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path }), 200);
 });
-app74.route("/api/health", health_default);
-app74.route("/api/chat", chatRoutes);
-app74.route("/api/whatsapp", whatsapp_default);
-app74.route("/api/storage", storage_broker_default);
-app74.route("/api/whatsapp-reader", whatsapp_reader_default);
-app74.route("/api/session-reader", session_reader_default);
-app74.route("/api/operator-conversations", operator_conversations_default);
-app74.route("/api/public-reader", public_reader_default);
-app74.route("/api/webchat", createWebchatRoutes({
+app75.route("/api/health", health_default);
+app75.route("/api/chat", chatRoutes);
+app75.route("/api/whatsapp", whatsapp_default);
+app75.route("/api/storage", storage_broker_default);
+app75.route("/api/whatsapp-reader", whatsapp_reader_default);
+app75.route("/api/session-reader", session_reader_default);
+app75.route("/api/operator-conversations", operator_conversations_default);
+app75.route("/api/public-reader", public_reader_default);
+app75.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app74.route("/api/webchat/greeting", webchat_greeting_default);
-app74.route("/api/telegram", telegram_default);
-app74.route("/api/quickbooks", quickbooks_default);
-app74.route("/api/onboarding", onboarding_default);
-app74.route("/api/admin", admin_default);
-app74.route("/api/access", access_default);
-app74.route("/api/session", session_default2);
-app74.route("/api/calendar", calendar_public_default);
-app74.route("/api/portal", portal_fetch_default);
+app75.route("/api/webchat/greeting", webchat_greeting_default);
+app75.route("/api/telegram", telegram_default);
+app75.route("/api/quickbooks", quickbooks_default);
+app75.route("/api/onboarding", onboarding_default);
+app75.route("/api/admin", admin_default);
+app75.route("/api/access", access_default);
+app75.route("/api/session", session_default2);
+app75.route("/api/calendar", calendar_public_default);
+app75.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -30344,7 +30663,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app74.get("/agent-assets/:slug/:filename", (c) => {
+app75.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -30360,8 +30679,8 @@ app74.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve42(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve42(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve43(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve43(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -30373,13 +30692,13 @@ app74.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync44(filePath);
+  const body = readFileSync45(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app74.get("/generated/:filename", (c) => {
+app75.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -30390,8 +30709,8 @@ app74.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve42(account.accountDir, "generated", filename);
-  const expectedDir = resolve42(account.accountDir, "generated");
+  const filePath = resolve43(account.accountDir, "generated", filename);
+  const expectedDir = resolve43(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -30403,22 +30722,22 @@ app74.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync44(filePath);
+  const body = readFileSync45(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app74.route("/sites", sites_default);
-app74.route("/listings", listings_default);
-app74.route("/v", visitor_event_default);
-app74.route("/v", visitor_consent_default);
+app75.route("/sites", sites_default);
+app75.route("/listings", listings_default);
+app75.route("/v", visitor_event_default);
+app75.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync44(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync45(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -30445,11 +30764,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync48(resolve42(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync48(resolve43(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync44(resolve42(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync45(resolve43(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -30459,7 +30778,7 @@ function readInstalledVersion() {
     if (!PLATFORM_ROOT6) return "unknown";
     const versionFile = join52(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
     if (!existsSync48(versionFile)) return "unknown";
-    const content = readFileSync44(versionFile, "utf-8").trim();
+    const content = readFileSync45(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -30470,7 +30789,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync44(resolve42(process.cwd(), "public", file), "utf-8");
+    html = readFileSync45(resolve43(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -30493,7 +30812,7 @@ function loadBrandingCache(agentSlug) {
     if (!accountId) return null;
     const cachePath = join52(configDir, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync48(cachePath)) return null;
-    return JSON.parse(readFileSync44(cachePath, "utf-8"));
+    return JSON.parse(readFileSync45(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -30537,7 +30856,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app74.get("/", (c) => {
+app75.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -30559,12 +30878,12 @@ app74.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app74.get("/public", (c) => {
+app75.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app74.get("/public-chat", (c) => {
+app75.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -30583,12 +30902,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app74.use("/vnc-viewer.html", logViewerFetch);
-app74.use("/vnc-popout.html", logViewerFetch);
-app74.get("/vnc-popout.html", (c) => {
+app75.use("/vnc-viewer.html", logViewerFetch);
+app75.use("/vnc-popout.html", logViewerFetch);
+app75.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync44(resolve42(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync45(resolve43(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -30598,7 +30917,7 @@ app74.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app74.post("/api/vnc/client-event", async (c) => {
+app75.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30619,11 +30938,11 @@ app74.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app74.get("/g/:slug", (c) => {
+app75.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app74.get(pwa.manifestPath, (c) => {
+  app75.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -30639,7 +30958,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app74.get("/sw.js", (c) => {
+app75.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -30648,12 +30967,12 @@ app74.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app74.get("/graph", (c) => {
+app75.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app74.get("/chat", (c) => {
+app75.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -30662,47 +30981,47 @@ app74.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app74.get("/data", (c) => {
+app75.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app74.get("/tasks", (c) => {
+app75.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app74.get("/activity", (c) => {
+app75.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app74.get("/calendar", (c) => {
+app75.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app74.get("/routines", (c) => {
+app75.get("/routines", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("routines.html"));
 });
-app74.get("/skills", (c) => {
+app75.get("/skills", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("skills.html"));
 });
-app74.get("/agents", (c) => {
+app75.get("/agents", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("agents.html"));
 });
-app74.get("/browser", (c) => {
+app75.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app74.get("/:slug", async (c, next) => {
+app75.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -30717,13 +31036,13 @@ app74.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app74.get("/favicon.ico", (c) => {
+  app75.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-mountStaticFiles(app74, "./public");
-app74.all("*", (c) => {
+mountStaticFiles(app75, "./public");
+app75.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path = c.req.path;
   if (isPublicHost(host)) {
@@ -30737,11 +31056,11 @@ app74.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app74.fetch, port, hostname });
+var httpServer = serve({ fetch: app75.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const reconcileScript = resolve42(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve43(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync48(reconcileScript)) return;
     try {
@@ -30782,7 +31101,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const dreamSweepScript = resolve42(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve43(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
@@ -30806,7 +31125,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const outlookScript = resolve42(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve43(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
     if (!existsSync48(outlookScript)) return;
@@ -30832,7 +31151,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const strandedAccountsDir = resolve42(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve43(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -30842,7 +31161,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
       const now = Date.now();
       for (const name of readdirSync28(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve42(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        const pendingPath2 = resolve43(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync48(pendingPath2)) continue;
         const ageMs2 = now - statSync25(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
@@ -30862,7 +31181,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const googleAccountsDir = resolve42(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve43(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -30877,7 +31196,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve42(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve43(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
     if (!existsSync48(googleAuditScript)) return;
@@ -30973,7 +31292,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const publishScript = resolve42(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve43(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -31003,21 +31322,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve42(account.accountDir, "calendar-availability.json");
+    const availPath = resolve43(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync48(availPath)) {
-        const cfg = JSON.parse(readFileSync44(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve42(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve43(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync48(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync44(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync45(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -31050,7 +31369,7 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const auditScript = resolve42(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve43(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
@@ -31134,7 +31453,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app74.routes ?? []) {
+  for (const r of app75.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -31178,7 +31497,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync44(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync45(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -31231,7 +31550,7 @@ registerLoop({
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync48(USERS_FILE)) return 0;
-  const raw = readFileSync44(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync45(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -31365,7 +31684,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve42(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..")),
+  platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not