@rubytech/create-sitedesk-code 0.1.528 → 0.1.530

package/payload/server/server.js

@@ -183,7 +183,7 @@ import {
   waitForConnection,
   warnNonUuidAccount,
   writeChatMetadataMerged
-} from "./chunk-UTIHI6KV.js";
+} from "./chunk-2YMGNYA3.js";
 import {
   ACCOUNTS_DIR,
   BIN_DIR,
@@ -1800,10 +1800,10 @@ var require_dist5 = __commonJS({
 });
 
 // server/index.ts
-import { readFileSync as readFileSync45, existsSync as existsSync48, watchFile, readdirSync as readdirSync28, statSync as statSync25 } from "fs";
+import { readFileSync as readFileSync46, existsSync as existsSync49, watchFile, readdirSync as readdirSync29, statSync as statSync25 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve43, join as join52, basename as basename16 } from "path";
+import { resolve as resolve45, join as join52, basename as basename16 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -3299,20 +3299,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve44) => {
+  return new Promise((resolve46) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve44(true);
+      resolve46(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve44(false);
+      resolve46(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve44(false);
+      resolve46(false);
     });
   });
 }
@@ -4999,11 +4999,11 @@ async function defaultHttpGet(url) {
   }
 }
 async function defaultResolve(accountId) {
-  const { resolveSocket: resolveSocket2 } = await import("./manager-B4LRDZKC.js");
+  const { resolveSocket: resolveSocket2 } = await import("./manager-XPRN5UF5.js");
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
-  const resolve44 = deps.resolve;
+  const resolve46 = deps.resolve;
   const httpGet = deps.httpGet ?? defaultHttpGet;
   const maxAgeMs = deps.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const cached3 = readAvatar(accountId, jid);
@@ -5013,7 +5013,7 @@ async function fetchAvatar(accountId, jid, deps = {}) {
     return "fresh";
   }
   console.log(`${TAG6} op=cache jid=${jid} hit=false ageMs=${ageMs2}`);
-  const res = resolve44 ? resolve44(accountId) : await defaultResolve(accountId);
+  const res = resolve46 ? resolve46(accountId) : await defaultResolve(accountId);
   if (!res.ok) {
     console.log(`${TAG6} op=no-socket jid=${jid} account=${accountId.slice(0, 8)} reason=${res.reason}`);
     return "no-socket";
@@ -5982,8 +5982,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve44, reject) => {
-    resolveCode = resolve44;
+  const codePromise = new Promise((resolve46, reject) => {
+    resolveCode = resolve46;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6729,10 +6729,10 @@ app3.post("/config", async (c) => {
             const entries2 = readdirSync7(agentsDir, { withFileTypes: true });
             for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
-              if (!existsSync7(configPath2)) continue;
+              const configPath3 = resolve7(agentsDir, entry.name, "config.json");
+              if (!existsSync7(configPath3)) continue;
               try {
-                const config = JSON.parse(readFileSync9(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync9(configPath3, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG14} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -7905,10 +7905,10 @@ function discoverPortalAccounts(accountsDir, shared = null) {
   if (!existsSync8(accountsDir)) return [];
   const found = [];
   for (const accountId of readdirSync8(accountsDir)) {
-    const configPath2 = join15(accountsDir, accountId, "data-portal.json");
-    if (!existsSync8(configPath2)) continue;
+    const configPath3 = join15(accountsDir, accountId, "data-portal.json");
+    if (!existsSync8(configPath3)) continue;
     try {
-      const cfg = JSON.parse(readFileSync10(configPath2, "utf-8"));
+      const cfg = JSON.parse(readFileSync10(configPath3, "utf-8"));
       if (typeof cfg.portalDbName === "string" && cfg.portalDbName.length > 0 && typeof cfg.bucketName === "string" && cfg.bucketName.length > 0) {
         found.push({
           accountId,
@@ -13037,7 +13037,7 @@ app13.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load", "routines"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -13136,15 +13136,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve44 = async (a) => {
+  const resolve46 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve44)
+    accounts.filter((a) => a.config.role === "house").map(resolve46)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve44)
+    accounts.filter((a) => a.config.role !== "house").map(resolve46)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -14269,10 +14269,10 @@ app20.get("/", requireAdminSession, (c) => {
       for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
         if (!entry.isDirectory()) continue;
         if (entry.name === "admin") continue;
-        const configPath2 = resolve20(agentsDir, entry.name, "config.json");
-        if (!existsSync30(configPath2)) continue;
+        const configPath3 = resolve20(agentsDir, entry.name, "config.json");
+        if (!existsSync30(configPath3)) continue;
         try {
-          const config = JSON.parse(readFileSync28(configPath2, "utf-8"));
+          const config = JSON.parse(readFileSync28(configPath3, "utf-8"));
           agents.push({
             slug: entry.name,
             displayName: config.displayName ?? entry.name,
@@ -14406,11 +14406,11 @@ app20.get("/:slug", requireAdminSession, (c) => {
     });
   }
   const agentDir = resolve20(account.accountDir, "agents", slug);
-  const configPath2 = resolve20(agentDir, "config.json");
-  if (!existsSync30(configPath2)) return c.json({ error: "Agent not found" }, 404);
+  const configPath3 = resolve20(agentDir, "config.json");
+  if (!existsSync30(configPath3)) return c.json({ error: "Agent not found" }, 404);
   let config;
   try {
-    config = JSON.parse(readFileSync28(configPath2, "utf-8"));
+    config = JSON.parse(readFileSync28(configPath3, "utf-8"));
   } catch {
     console.error(`[admin/agents] op=detail slug=${slug} error="config.json parse failed"`);
     return c.json({ error: "Agent config unreadable" }, 500);
@@ -16907,9 +16907,9 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve24(accountsDir, name, "account.json");
+    const configPath3 = resolve24(accountsDir, name, "account.json");
     try {
-      const raw = await readFile9(configPath2, "utf8");
+      const raw = await readFile9(configPath3, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -21259,6 +21259,56 @@ var health_default2 = app41;
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
 
+// ../lib/account-ingest-token/src/index.ts
+import { randomBytes, timingSafeEqual } from "crypto";
+import { existsSync as existsSync37, readdirSync as readdirSync24, readFileSync as readFileSync34, writeFileSync as writeFileSync14 } from "fs";
+import { resolve as resolve30 } from "path";
+var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var INGEST_TOKEN_FIELD = "ingestToken";
+var TOKEN_RE = /^[0-9a-f]{64}$/;
+function configPath2(accountsDir, accountId) {
+  return resolve30(accountsDir, accountId, "account.json");
+}
+function readConfig2(accountsDir, accountId) {
+  const path = configPath2(accountsDir, accountId);
+  if (!existsSync37(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync34(path, "utf-8"));
+    return parsed !== null && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readIngestToken(accountsDir, accountId) {
+  const value = readConfig2(accountsDir, accountId)?.[INGEST_TOKEN_FIELD];
+  return typeof value === "string" && TOKEN_RE.test(value) ? value : null;
+}
+function listAccountIdsOnDisk(accountsDir) {
+  if (!existsSync37(accountsDir)) return [];
+  let entries2;
+  try {
+    entries2 = readdirSync24(accountsDir);
+  } catch {
+    return [];
+  }
+  return entries2.filter(
+    (name) => UUID_RE4.test(name) && existsSync37(resolve30(accountsDir, name, "account.json"))
+  );
+}
+function resolveAccountIdByIngestToken(accountsDir, token) {
+  if (typeof token !== "string" || !TOKEN_RE.test(token)) return null;
+  const probe = Buffer.from(token, "utf-8");
+  for (const accountId of listAccountIdsOnDisk(accountsDir)) {
+    const stored = readIngestToken(accountsDir, accountId);
+    if (!stored) continue;
+    const candidate = Buffer.from(stored, "utf-8");
+    if (candidate.length === probe.length && timingSafeEqual(candidate, probe)) {
+      return accountId;
+    }
+  }
+  return null;
+}
+
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase2() {
   const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "channel-pty-bridge:manager-client" });
@@ -21483,8 +21533,29 @@ function buildInitialMessage(env) {
   }
   return header;
 }
+var AUTH_TAG = "[linkedin-ingest-auth]";
+var requireIngestToken = async (c, next) => {
+  let token = "";
+  try {
+    const body = await c.req.json();
+    if (body && typeof body.ingest_token === "string") token = body.ingest_token;
+  } catch {
+  }
+  if (!token) {
+    console.error(`${AUTH_TAG} outcome=reject status=400 code=token-missing path=${c.req.path}`);
+    return c.json({ ok: false, error: "auth", code: "token-missing" }, 400);
+  }
+  const accountId = resolveAccountIdByIngestToken(ACCOUNTS_DIR, token);
+  if (!accountId) {
+    console.error(`${AUTH_TAG} outcome=reject status=401 code=token-unknown path=${c.req.path}`);
+    return c.json({ ok: false, error: "auth", code: "token-unknown" }, 401);
+  }
+  c.set("ingestAccountId", accountId);
+  console.log(`${AUTH_TAG} outcome=accept accountId=${accountId.slice(0, 8)} path=${c.req.path}`);
+  await next();
+};
 var app42 = new Hono();
-app42.post("/", requireAdminSession, async (c) => {
+app42.post("/", requireIngestToken, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21498,8 +21569,7 @@ app42.post("/", requireAdminSession, async (c) => {
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
-  const cacheKey = c.var.cacheKey ?? "";
-  const senderId = getAccountIdForSession(cacheKey) ?? "";
+  const senderId = c.var.ingestAccountId ?? "";
   if (!senderId) {
     console.error(TAG22 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
@@ -22009,7 +22079,7 @@ app48.post("/screencast-event", requireAdminSession, async (c) => {
 var browser_default = app48;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync37 } from "fs";
+import { existsSync as existsSync38 } from "fs";
 import { join as join44 } from "path";
 
 // server/lib/calendar-ics.ts
@@ -22109,7 +22179,7 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync34 } from "fs";
+import { readFileSync as readFileSync35 } from "fs";
 import { join as join43 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
@@ -22122,7 +22192,7 @@ function readAvailabilityConfig(accountDir) {
   const path = join43(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync34(path, "utf-8");
+    raw = readFileSync35(path, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path} not found`);
   }
@@ -22482,7 +22552,7 @@ app49.get("/booking-link", requireAdminSession, (c) => {
   }
   const id82 = account.accountId.slice(0, 8);
   try {
-    if (!existsSync37(join44(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log(`[calendar] op=booking-link accountId=${id82} bookingDomain=none source=availability-config`);
       return c.json({ bookingDomain: null });
     }
@@ -22501,7 +22571,7 @@ app49.get("/booking-link", requireAdminSession, (c) => {
 var calendar_default = app49;
 
 // server/routes/admin/data-portal.ts
-import { existsSync as existsSync38, readFileSync as readFileSync35 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync36 } from "fs";
 import { join as join45 } from "path";
 var app50 = new Hono();
 var PORTAL_FILENAME = "data-portal.json";
@@ -22514,11 +22584,11 @@ app50.get("/portal-link", requireAdminSession, (c) => {
   const id82 = account.accountId.slice(0, 8);
   try {
     const path = join45(account.accountDir, PORTAL_FILENAME);
-    if (!existsSync38(path)) {
+    if (!existsSync39(path)) {
       console.log(`[data-portal] op=portal-link accountId=${id82} portalDomain=none source=data-portal-config`);
       return c.json({ portalDomain: null });
     }
-    const cfg = JSON.parse(readFileSync35(path, "utf-8"));
+    const cfg = JSON.parse(readFileSync36(path, "utf-8"));
     const portalDomain = typeof cfg.portalDomain === "string" && cfg.portalDomain.trim() ? cfg.portalDomain.trim() : null;
     console.log(`[data-portal] op=portal-link accountId=${id82} portalDomain=${portalDomain ?? "none"} source=data-portal-config`);
     return c.json({ portalDomain });
@@ -22535,8 +22605,8 @@ import cronParser from "cron-parser";
 import { int as int2 } from "neo4j-driver";
 
 // ../lib/agent-dispatch-rule/src/index.ts
-import { readFileSync as readFileSync36 } from "fs";
-import { resolve as resolve30 } from "path";
+import { readFileSync as readFileSync37 } from "fs";
+import { resolve as resolve31 } from "path";
 function normalizeE1642(value) {
   let candidate = value.trim().replace(/[\s\-().]/g, "");
   candidate = candidate.replace(/^whatsapp:/i, "");
@@ -22553,7 +22623,7 @@ function phonesMatch2(a, b) {
 function readChannelAdmins(accountDir, channel) {
   let config = {};
   try {
-    config = JSON.parse(readFileSync36(resolve30(accountDir, "account.json"), "utf-8"));
+    config = JSON.parse(readFileSync37(resolve31(accountDir, "account.json"), "utf-8"));
   } catch {
     config = {};
   }
@@ -22585,9 +22655,16 @@ function registeredAccountForDestination(houseDir, houseAccountId, destination)
   if (adminPhones.some((p) => phonesMatch2(p, destination))) return houseAccountId;
   return null;
 }
+function boundSubAccountFor(accountDir, destination) {
+  const { accountManagers } = readChannelAdmins(accountDir, "whatsapp");
+  for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
+    if (subAccountId && phonesMatch2(managerPhone, destination)) return subAccountId;
+  }
+  return null;
+}
 function validateAgentDestination(accountsDir, houseAccountId, creatingAccountId, channel, destination) {
   if (channel === "whatsapp") {
-    const houseDir = resolve30(accountsDir, houseAccountId);
+    const houseDir = resolve31(accountsDir, houseAccountId);
     const registered = registeredAccountForDestination(houseDir, houseAccountId, destination);
     if (registered === null) return { valid: false, reason: "not-registered" };
     if (creatingAccountId === houseAccountId) return { valid: true };
@@ -22599,7 +22676,7 @@ function validateAgentDestination(accountsDir, houseAccountId, creatingAccountId
       scheduleAccount: creatingAccountId
     };
   }
-  const { adminUsers } = readChannelAdmins(resolve30(accountsDir, creatingAccountId), "telegram");
+  const { adminUsers } = readChannelAdmins(resolve31(accountsDir, creatingAccountId), "telegram");
   const asNumber = Number(destination);
   const ok = Number.isInteger(asNumber) && adminUsers.includes(asNumber);
   return ok ? { valid: true } : { valid: false, reason: "not-registered" };
@@ -22609,7 +22686,7 @@ function listDispatchDestinations(input) {
   const managers = [];
   const admins = [];
   if (houseAccountId !== null) {
-    const houseDir = resolve30(accountsDir, houseAccountId);
+    const houseDir = resolve31(accountsDir, houseAccountId);
     const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
     const seen = /* @__PURE__ */ new Set();
     for (const [phone, subAccountId] of Object.entries(accountManagers)) {
@@ -22627,7 +22704,7 @@ function listDispatchDestinations(input) {
       admins.push({ channel: "whatsapp", destination: phone, label: "House admin" });
     }
   }
-  const { adminUsers } = readChannelAdmins(resolve30(accountsDir, accountId), "telegram");
+  const { adminUsers } = readChannelAdmins(resolve31(accountsDir, accountId), "telegram");
   const telegram = [...adminUsers].sort((a, b) => a - b).map((id) => ({ channel: "telegram", destination: String(id), label: "Telegram admin" }));
   const byDestination = (a, b) => a.destination.localeCompare(b.destination);
   return [...managers.sort(byDestination), ...admins.sort(byDestination), ...telegram];
@@ -22643,7 +22720,8 @@ var ROUTINE_COLS = `e.eventId AS eventId, e.name AS name, e.eventStatus AS event
   e.timezone AS timezone, e.startDate AS startDate,
   e.agentChannel AS agentChannel, e.agentDestination AS agentDestination, e.agentPrompt AS agentPrompt,
   e.actionPlugin AS actionPlugin, e.actionTool AS actionTool, e.actionArgs AS actionArgs,
-  e.notes AS notes, e.lastDispatchResult AS lastDispatchResult, e.lastDispatchAt AS lastDispatchAt,
+  e.notes AS notes, e.routineDescription AS routineDescription,
+  e.lastDispatchResult AS lastDispatchResult, e.lastDispatchAt AS lastDispatchAt,
   e.suspendedInBulk AS suspendedInBulk`;
 function mapRoutine(r) {
   const g = (k) => r.get(k) ?? null;
@@ -22663,11 +22741,16 @@ function mapRoutine(r) {
     actionTool: g("actionTool"),
     actionArgs: g("actionArgs"),
     notes: g("notes"),
+    // Task 2214 — read-only on the wire. Deliberately absent from the PATCH
+    // field set below: the roster is its only writer, so a PATCH that accepted
+    // it would be discarded by the next seed, and silently accepting an edit
+    // that the next upgrade throws away is worse than refusing it.
+    routineDescription: g("routineDescription"),
     lastDispatchResult: g("lastDispatchResult"),
     lastDispatchAt: g("lastDispatchAt"),
     // Task 2106 — on the wire so the page can gate Resume all on the set the
     // server will actually act on. Without it the control reads `suspended`,
-    // which includes the ten seeded roster rows on every fresh install, and
+    // which includes the thirteen seeded roster rows on every fresh install, and
     // pressing it reports restoring nothing.
     suspendedInBulk: r.get("suspendedInBulk") === true
   };
@@ -23294,8 +23377,8 @@ app51.delete("/:eventId", requireAdminSession, async (c) => {
 var routines_default = app51;
 
 // server/routes/admin/skills.ts
-import { existsSync as existsSync39, readdirSync as readdirSync24, readFileSync as readFileSync37, rmSync as rmSync5 } from "fs";
-import { resolve as resolve31 } from "path";
+import { existsSync as existsSync40, readdirSync as readdirSync25, readFileSync as readFileSync38, rmSync as rmSync5 } from "fs";
+import { resolve as resolve32 } from "path";
 var app52 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function splitSkillMd(text) {
@@ -23318,9 +23401,9 @@ function stripQuotes(s) {
   return s;
 }
 function subdirs2(dir) {
-  if (!existsSync39(dir)) return [];
+  if (!existsSync40(dir)) return [];
   try {
-    return readdirSync24(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync25(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -23333,19 +23416,19 @@ app52.get("/", requireAdminSession, async (c) => {
   }
   ensureAccountWatchers(acct.accountId, acct.accountDir);
   const { value, state } = await getOrCompute("skills", acct.accountId, async () => {
-    const pluginsDir = resolve31(acct.accountDir, "plugins");
+    const pluginsDir = resolve32(acct.accountDir, "plugins");
     const skills = [];
     let pluginCount = 0;
     for (const plugin of subdirs2(pluginsDir)) {
       pluginCount++;
-      const skillsDir = resolve31(pluginsDir, plugin, "skills");
+      const skillsDir = resolve32(pluginsDir, plugin, "skills");
       for (const skill of subdirs2(skillsDir)) {
-        const skillMd = resolve31(skillsDir, skill, "SKILL.md");
-        if (!existsSync39(skillMd)) continue;
+        const skillMd = resolve32(skillsDir, skill, "SKILL.md");
+        if (!existsSync40(skillMd)) continue;
         try {
-          const { frontmatter } = splitSkillMd(readFileSync37(skillMd, "utf-8"));
-          const refsDir = resolve31(skillsDir, skill, "references");
-          const refCount = existsSync39(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
+          const { frontmatter } = splitSkillMd(readFileSync38(skillMd, "utf-8"));
+          const refsDir = resolve32(skillsDir, skill, "references");
+          const refCount = existsSync40(refsDir) ? readdirSync25(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
           skills.push({ plugin, skill, description: frontmatter.description, refCount });
         } catch (err) {
           console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
@@ -23367,15 +23450,15 @@ app52.get("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=get outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const skillDir = resolve31(acct.accountDir, "plugins", plugin, "skills", skill);
-  const skillMd = resolve31(skillDir, "SKILL.md");
-  const found = existsSync39(skillMd);
+  const skillDir = resolve32(acct.accountDir, "plugins", plugin, "skills", skill);
+  const skillMd = resolve32(skillDir, "SKILL.md");
+  const found = existsSync40(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
-    const { frontmatter, body } = splitSkillMd(readFileSync37(skillMd, "utf-8"));
-    const refsDir = resolve31(skillDir, "references");
-    const references = existsSync39(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
+    const { frontmatter, body } = splitSkillMd(readFileSync38(skillMd, "utf-8"));
+    const refsDir = resolve32(skillDir, "references");
+    const references = existsSync40(refsDir) ? readdirSync25(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -23392,10 +23475,10 @@ app52.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=delete outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const pluginDir = resolve31(acct.accountDir, "plugins", plugin);
-  const skillsDir = resolve31(pluginDir, "skills");
-  const skillDir = resolve31(skillsDir, skill);
-  if (!existsSync39(resolve31(skillDir, "SKILL.md"))) {
+  const pluginDir = resolve32(acct.accountDir, "plugins", plugin);
+  const skillsDir = resolve32(pluginDir, "skills");
+  const skillDir = resolve32(skillsDir, skill);
+  if (!existsSync40(resolve32(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -23403,7 +23486,7 @@ app52.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     rmSync5(skillDir, { recursive: true, force: true });
     const pluginDirRemoved = subdirs2(skillsDir).length === 0;
     if (pluginDirRemoved) rmSync5(pluginDir, { recursive: true, force: true });
-    const skillDirGone = !existsSync39(skillDir);
+    const skillDirGone = !existsSync40(skillDir);
     if (!skillDirGone) {
       console.error(`[admin:skills] op=delete plugin=${plugin} skill=${skill} outcome=rejected reason=rm-incomplete skillDirGone=false`);
       return c.json({ error: "Delete did not remove the skill directory" }, 503);
@@ -23875,20 +23958,20 @@ app57.post("/", requireAdminSession, async (c) => {
 var task_time_adjust_default = app57;
 
 // app/lib/admin-roster.ts
-import { existsSync as existsSync40, readdirSync as readdirSync25, readFileSync as readFileSync38 } from "fs";
-import { resolve as resolve32 } from "path";
+import { existsSync as existsSync41, readdirSync as readdirSync26, readFileSync as readFileSync39 } from "fs";
+import { resolve as resolve33 } from "path";
 function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
   let entries2;
   try {
-    entries2 = readdirSync25(accountsDir);
+    entries2 = readdirSync26(accountsDir);
   } catch {
     return [];
   }
   for (const entry of entries2) {
-    const cfgPath = resolve32(accountsDir, entry, "account.json");
-    if (!existsSync40(cfgPath)) continue;
+    const cfgPath = resolve33(accountsDir, entry, "account.json");
+    if (!existsSync41(cfgPath)) continue;
     try {
-      const cfg = JSON.parse(readFileSync38(cfgPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync39(cfgPath, "utf-8"));
       if (cfg.role !== "house") continue;
       if (!Array.isArray(cfg.admins)) return [];
       return cfg.admins.map(
@@ -24218,7 +24301,21 @@ app61.get("/", requireAdminSession, async (c) => {
 var admin_users_list_default = app61;
 
 // server/routes/admin/dispatch-destinations.ts
+import { resolve as resolve34 } from "path";
 var TAG37 = "[admin:routines]";
+function scopeFor(d, houseDir, houseAccountId) {
+  if (d.channel !== "whatsapp") return null;
+  if (d.label === "Account manager") return boundSubAccountFor(houseDir, d.destination);
+  return houseAccountId;
+}
+function telephoneVariants(destination) {
+  const digits = normalizeE1642(destination);
+  if (digits.length === 0) return [destination];
+  return [.../* @__PURE__ */ new Set([destination, digits, `+${digits}`])];
+}
+function scrubDigitRuns(message) {
+  return message.replace(/\d{7,}/g, "<redacted>");
+}
 var app62 = new Hono();
 app62.get("/", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
@@ -24234,15 +24331,62 @@ app62.get("/", requireAdminSession, async (c) => {
     console.error(`${TAG37} op=destinations account=${accountId.slice(0, 8)} outcome=house-unresolved reason="${message}"`);
   }
   const destinations = listDispatchDestinations({ accountsDir: ACCOUNTS_DIR, houseAccountId, accountId });
+  const houseDir = houseAccountId === null ? null : resolve34(ACCOUNTS_DIR, houseAccountId);
+  const byScope = /* @__PURE__ */ new Map();
+  for (const d of destinations) {
+    const scope = houseDir === null || houseAccountId === null ? null : scopeFor(d, houseDir, houseAccountId);
+    if (scope === null) continue;
+    const list = byScope.get(scope);
+    if (list) list.push(d);
+    else byScope.set(scope, [d]);
+  }
+  let namesUnresolved = null;
+  let named = 0;
+  if (byScope.size > 0) {
+    let session = null;
+    try {
+      session = getSession();
+      for (const [scopeAccountId, rows] of byScope) {
+        const telephones = [...new Set(rows.flatMap((d) => telephoneVariants(d.destination)))];
+        const result = await session.run(
+          `MATCH (p:Person {accountId: $accountId}) WHERE p.telephone IN $telephones
+           RETURN p.telephone AS telephone, p.givenName AS givenName, p.familyName AS familyName`,
+          { accountId: scopeAccountId, telephones }
+        );
+        const found = /* @__PURE__ */ new Map();
+        for (const rec of result.records) {
+          const tel = rec.get("telephone");
+          if (!tel) continue;
+          const name = [rec.get("givenName"), rec.get("familyName")].filter(Boolean).join(" ");
+          if (name.length > 0) found.set(normalizeE1642(tel), name);
+        }
+        for (const d of rows) {
+          const hit = found.get(normalizeE1642(d.destination));
+          if (hit) {
+            d.name = hit;
+            named += 1;
+          }
+        }
+      }
+    } catch (err) {
+      namesUnresolved = scrubDigitRuns(err instanceof Error ? err.message : String(err));
+      for (const d of destinations) delete d.name;
+      named = 0;
+    } finally {
+      if (session) await session.close();
+    }
+  }
+  const scopes = [...byScope.keys()];
+  const nameScope = scopes.length === 0 ? "none" : scopes.every((s) => s === houseAccountId) ? "house" : scopes.some((s) => s === houseAccountId) ? "mixed" : "account";
   console.log(
-    `${TAG37} op=destinations account=${accountId.slice(0, 8)} count=${destinations.length}` + (houseAccountId === null ? " outcome=house-unresolved" : "")
+    `${TAG37} op=destinations account=${accountId.slice(0, 8)} count=${destinations.length} named=${named} unnamed=${destinations.length - named} nameScope=${nameScope}` + (houseAccountId === null ? " outcome=house-unresolved" : "") + (namesUnresolved === null ? "" : ` outcome=names-unresolved reason="${namesUnresolved}"`)
   );
   return c.json({ destinations });
 });
 var dispatch_destinations_default = app62;
 
 // server/routes/admin/activity.ts
-import { readdirSync as readdirSync26 } from "fs";
+import { readdirSync as readdirSync27 } from "fs";
 var app63 = new Hono();
 var TAG38 = "[activity]";
 function resolveHouseAccountId(accounts) {
@@ -24258,7 +24402,7 @@ function requestToken() {
 var short = (id) => id ? id.slice(0, 8) : "unset";
 function countAccountDirsOnDisk() {
   try {
-    return readdirSync26(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+    return readdirSync27(ACCOUNTS_DIR, { withFileTypes: true }).filter(
       (e) => e.isDirectory() && !e.name.startsWith(".")
     ).length;
   } catch {
@@ -24522,9 +24666,9 @@ var verify_token_default = app65;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve33 } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve33(process.cwd(), "..");
-var SEND_SCRIPT = resolve33(
+import { resolve as resolve35 } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve35(process.cwd(), "..");
+var SEND_SCRIPT = resolve35(
   PLATFORM_ROOT5,
   "plugins",
   "email",
@@ -24666,8 +24810,8 @@ app67.route("/request-magic-link", request_magic_link_default);
 var access_default = app67;
 
 // server/routes/sites.ts
-import { existsSync as existsSync41, readFileSync as readFileSync39, realpathSync as realpathSync8, statSync as statSync22 } from "fs";
-import { resolve as resolve34 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync40, realpathSync as realpathSync8, statSync as statSync22 } from "fs";
+import { resolve as resolve36 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -24724,15 +24868,15 @@ app68.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve34(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve34(rootDir, ...segments);
+  const rootDir = resolve36(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve36(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat11;
   try {
-    stat11 = existsSync41(filePath) ? statSync22(filePath) : null;
+    stat11 = existsSync42(filePath) ? statSync22(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -24745,13 +24889,13 @@ app68.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve34(filePath, "index.html");
+    filePath = resolve36(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync41(filePath)) {
+  if (!existsSync42(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -24770,7 +24914,7 @@ app68.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync39(realPath);
+    body = readFileSync40(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -24805,8 +24949,8 @@ app68.get("/:rel{.*}", (c) => {
 var sites_default = app68;
 
 // app/lib/visitor-token.ts
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync40, writeFileSync as writeFileSync14 } from "fs";
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync41, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname15 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -24815,21 +24959,21 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync40(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync41(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
     }
   } catch {
   }
-  const fresh = randomBytes(SECRET_BYTES).toString("hex");
+  const fresh = randomBytes2(SECRET_BYTES).toString("hex");
   try {
     mkdirSync8(dirname15(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync14(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    writeFileSync15(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync40(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync41(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -24862,7 +25006,7 @@ function verifyVisitorToken(token, now = Date.now()) {
   const expected = signPayload(payloadJson, getSecret());
   const expectedBuf = Buffer.from(expected, "utf-8");
   const provBuf = Buffer.from(sigB64, "utf-8");
-  if (expectedBuf.length !== provBuf.length || !timingSafeEqual(expectedBuf, provBuf)) {
+  if (expectedBuf.length !== provBuf.length || !timingSafeEqual2(expectedBuf, provBuf)) {
     return { ok: false, reason: "bad-sig" };
   }
   let payload;
@@ -24882,7 +25026,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync42, readFileSync as readFileSync41 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync42 } from "fs";
 import { join as join47 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -24892,9 +25036,9 @@ function readBrandConfig() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
   const brandPath = join47(platformRoot5, "config", "brand.json");
-  if (!existsSync42(brandPath)) return null;
+  if (!existsSync43(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync41(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync42(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -25391,14 +25535,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app71;
 
 // server/routes/session.ts
-import { resolve as resolve35 } from "path";
-import { existsSync as existsSync43, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
-var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { resolve as resolve37 } from "path";
+import { existsSync as existsSync44, writeFileSync as writeFileSync16, mkdirSync as mkdirSync9 } from "fs";
+var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve35(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve37(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve35(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync16(resolve37(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -25408,7 +25552,7 @@ function parseVisitorCookie2(cookieHeader) {
   const match = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
   if (!match) return null;
   const value = decodeURIComponent(match[1]).trim();
-  return UUID_RE4.test(value) ? value : null;
+  return UUID_RE5.test(value) ? value : null;
 }
 function parseAccessSessionId2(cookieHeader) {
   if (!cookieHeader) return null;
@@ -25475,8 +25619,8 @@ app72.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve35(account.accountDir, "agents", agentSlug);
-    if (!existsSync43(agentDir) || !existsSync43(resolve35(agentDir, "config.json"))) {
+    const agentDir = resolve37(account.accountDir, "agents", agentSlug);
+    if (!existsSync44(agentDir) || !existsSync44(resolve37(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -25506,7 +25650,7 @@ app72.post("/", async (c) => {
       );
     }
   }
-  if (body.session_key && typeof body.session_key === "string" && UUID_RE4.test(body.session_key)) {
+  if (body.session_key && typeof body.session_key === "string" && UUID_RE5.test(body.session_key)) {
     if (visitorId) {
       const recent = await findRecentConversation(visitorId, accountId, agentSlug).catch(() => null);
       if (recent) {
@@ -25736,7 +25880,7 @@ var calendar_public_default = app73;
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile11, realpath } from "fs/promises";
-import { join as join48, resolve as resolve36, sep as sep11 } from "path";
+import { join as join48, resolve as resolve38, sep as sep11 } from "path";
 import { Readable as Readable3 } from "stream";
 var app74 = new Hono();
 var TAG41 = "[portal-fetch]";
@@ -25789,7 +25933,7 @@ ${expiresAtMs}`)
   return diff === 0;
 }
 async function readAccountSecret(accountId) {
-  const path = resolve36(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path = resolve38(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
     text = await readFile11(path, "utf8");
@@ -25825,7 +25969,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve36(accountDir, relPath);
+  const lexical = resolve38(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -25874,7 +26018,7 @@ async function handle(c, headOnly) {
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve36(DATA_ROOT, "accounts", accountId),
+    resolve38(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
@@ -25988,7 +26132,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync27, readFileSync as readFileSync42, statSync as statSync23 } from "fs";
+import { readdirSync as readdirSync28, readFileSync as readFileSync43, statSync as statSync23 } from "fs";
 import { join as join49 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -26037,7 +26181,7 @@ var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries2;
   try {
-    entries2 = readdirSync27(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
+    entries2 = readdirSync28(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
   } catch {
     return 0;
   }
@@ -26046,7 +26190,7 @@ function countWriteRejects24h(logDir, now) {
     const path = join49(logDir, name);
     try {
       if (now - statSync23(path).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync42(path, "utf8").split("\n")) {
+      for (const line of readFileSync43(path, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -26315,7 +26459,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve37, sep as sep12 } from "path";
+import { resolve as resolve39, sep as sep12 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -26334,7 +26478,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve37(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve39(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -26355,7 +26499,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve37(dataRoot, relativePath);
+    const absolute = resolve39(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -26379,7 +26523,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve37(dataRoot, rootName);
+    const absRoot = resolve39(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -26418,7 +26562,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir4, readdir as readdir6, rename as rename4, rm as rm3 } from "fs/promises";
-import { dirname as dirname16, relative as relative8, resolve as resolve38 } from "path";
+import { dirname as dirname16, relative as relative8, resolve as resolve40 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -26429,7 +26573,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries2) {
-    const abs = resolve38(dir, e.name);
+    const abs = resolve40(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -26449,7 +26593,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative8(srcDir, oldAbs);
-    const newAbs = resolve38(destDir, suffix);
+    const newAbs = resolve40(destDir, suffix);
     await mkdir4(dirname16(newAbs), { recursive: true });
     await rename4(oldAbs, newAbs);
     moved++;
@@ -26476,7 +26620,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve38(dataRoot, "uploads");
+  const oldRoot = resolve40(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -26497,8 +26641,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
-          resolve38(oldRoot, name),
-          resolve38(dataRoot, "accounts", name, "uploads"),
+          resolve40(oldRoot, name),
+          resolve40(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -26510,8 +26654,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve38(oldRoot, "public"),
-          resolve38(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve40(oldRoot, "public"),
+          resolve40(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -26541,7 +26685,7 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir7, readFile as readFile12, rename as rename5, writeFile as writeFile4, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync44 } from "fs";
+import { existsSync as existsSync45 } from "fs";
 import { join as join50 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -26571,7 +26715,7 @@ async function writeRaw(path, obj) {
     await rename5(tmp, path);
   } catch (err) {
     try {
-      if (existsSync44(tmp)) await unlink4(tmp);
+      if (existsSync45(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -26694,7 +26838,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
 
 // app/lib/migrate-sidecar-account-ids.ts
 import { readdir as readdir8, readFile as readFile13, rename as rename6, writeFile as writeFile5, unlink as unlink5 } from "fs/promises";
-import { existsSync as existsSync45 } from "fs";
+import { existsSync as existsSync46 } from "fs";
 import { join as join51 } from "path";
 var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
 function projectSlugForCwd(cwd) {
@@ -26721,7 +26865,7 @@ async function writeRaw2(path, obj) {
     await rename6(tmp, path);
   } catch (err) {
     try {
-      if (existsSync45(tmp)) await unlink5(tmp);
+      if (existsSync46(tmp)) await unlink5(tmp);
     } catch {
     }
     throw err;
@@ -27897,16 +28041,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve44) => {
+    return new Promise((resolve46) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve44({ timeout: true });
+        resolve46({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve44(r);
+        resolve46(r);
       });
     });
   }
@@ -27917,11 +28061,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve44) => {
+    return new Promise((resolve46) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve44({ timeout: true });
+        resolve46({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -27931,7 +28075,7 @@ var WebchatGateway = class _WebchatGateway {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
           this.deps.onPointerChange?.(p.key);
-          resolve44(r);
+          resolve46(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28507,7 +28651,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve39 } from "path";
+import { resolve as resolve41 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -28608,7 +28752,7 @@ function makeWebchatSendFile(entry) {
       console.error(`${TAG45} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve39(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve41(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
@@ -29172,7 +29316,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
-import { resolve as resolve40, basename as basename15 } from "path";
+import { resolve as resolve42, basename as basename15 } from "path";
 var TAG47 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -29183,7 +29327,7 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve40(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve42(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
@@ -29591,14 +29735,14 @@ function resolveScheduledEffectiveAccountForInstall(accountDir, destination) {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync46, readFileSync as readFileSync43 } from "fs";
-import { resolve as resolve41 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync44 } from "fs";
+import { resolve as resolve43 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve41(a.accountDir, "calendar-availability.json");
-    if (!existsSync46(availPath)) return false;
+    const availPath = resolve43(a.accountDir, "calendar-availability.json");
+    if (!existsSync47(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync43(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync44(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -29636,8 +29780,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync47, readFileSync as readFileSync44, statSync as statSync24 } from "fs";
-import { resolve as resolve42 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync45, statSync as statSync24 } from "fs";
+import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -29672,7 +29816,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve42(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve44(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -29684,8 +29828,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve42(brand.configDir, "entitlement.json");
-  if (!existsSync47(entitlementPath)) {
+  const entitlementPath = resolve44(brand.configDir, "entitlement.json");
+  if (!existsSync48(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat11 = statSync24(entitlementPath);
@@ -29700,7 +29844,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync44(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync45(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -29714,7 +29858,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync44(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync45(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -29878,12 +30022,12 @@ installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join52(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync48(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync49(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync49(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync45(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -29918,8 +30062,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join52(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync48(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync45(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync49(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync46(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -29994,7 +30138,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -30009,7 +30153,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -30711,20 +30855,20 @@ app75.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve43(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve43(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve45(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve45(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync48(filePath)) {
+  if (!existsSync49(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync45(filePath);
+  const body = readFileSync46(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -30741,20 +30885,20 @@ app75.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve43(account.accountDir, "generated", filename);
-  const expectedDir = resolve43(account.accountDir, "generated");
+  const filePath = resolve45(account.accountDir, "generated", filename);
+  const expectedDir = resolve45(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync48(filePath)) {
+  if (!existsSync49(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync45(filePath);
+  const body = readFileSync46(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -30767,9 +30911,9 @@ app75.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync49(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync45(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -30796,11 +30940,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync48(resolve43(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync49(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync45(resolve43(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync46(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -30809,8 +30953,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
     const versionFile = join52(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync48(versionFile)) return "unknown";
-    const content = readFileSync45(versionFile, "utf-8").trim();
+    if (!existsSync49(versionFile)) return "unknown";
+    const content = readFileSync46(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -30821,7 +30965,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync45(resolve43(process.cwd(), "public", file), "utf-8");
+    html = readFileSync46(resolve45(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -30843,8 +30987,8 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join52(configDir, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync48(cachePath)) return null;
-    return JSON.parse(readFileSync45(cachePath, "utf-8"));
+    if (!existsSync49(cachePath)) return null;
+    return JSON.parse(readFileSync46(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -30939,7 +31083,7 @@ app75.use("/vnc-popout.html", logViewerFetch);
 app75.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync45(resolve43(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync46(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -31092,9 +31236,9 @@ var httpServer = serve({ fetch: app75.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const reconcileScript = resolve43(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync48(reconcileScript)) return;
+    if (!existsSync49(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -31133,14 +31277,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const dreamSweepScript = resolve43(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync48(dreamSweepScript)) return;
+      if (!existsSync49(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -31157,10 +31301,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const outlookScript = resolve43(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync48(outlookScript)) return;
+    if (!existsSync49(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -31183,18 +31327,18 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const strandedAccountsDir = resolve43(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync48(strandedAccountsDir)) return;
+      if (!existsSync49(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync28(strandedAccountsDir)) {
+      for (const name of readdirSync29(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve43(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync48(pendingPath2)) continue;
+        const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync49(pendingPath2)) continue;
         const ageMs2 = now - statSync25(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
@@ -31213,7 +31357,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const googleAccountsDir = resolve43(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -31228,10 +31372,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve43(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve45(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync48(googleAuditScript)) return;
+    if (!existsSync49(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -31324,7 +31468,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const publishScript = resolve43(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -31335,7 +31479,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync48(publishScript)) return;
+    if (!existsSync49(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -31354,21 +31498,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve43(account.accountDir, "calendar-availability.json");
+    const availPath = resolve45(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync48(availPath)) {
-        const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
+      if (existsSync49(availPath)) {
+        const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve43(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve45(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync48(statePath)) {
+    if (existsSync49(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync45(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync46(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -31401,11 +31545,11 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..");
-  const auditScript = resolve43(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync48(auditScript)) return;
+    if (!existsSync49(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -31525,11 +31669,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync48(USERS_FILE)) {
+    if (!existsSync49(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync45(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync46(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -31581,8 +31725,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync48(USERS_FILE)) return 0;
-  const raw = readFileSync45(USERS_FILE, "utf-8").trim();
+  if (!existsSync49(USERS_FILE)) return 0;
+  const raw = readFileSync46(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -31716,7 +31860,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join52(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not