@rubytech/create-maxy-code 0.1.112 → 0.1.114

package/payload/premium-plugins/venture-studio/skills/prototype-host/references/cloudflared-ingress-edit.md

@@ -0,0 +1,81 @@
+# Cloudflared ingress edit — append a hostname rule before the catch-all
+
+This is the canonical pattern for adding a new hostname → local port mapping to an existing brand cloudflared `config.yml`. Sourced from the multi-hostname ingress block documented at [`platform/plugins/cloudflare/references/manual-setup.md`](../../../../../platform/plugins/cloudflare/references/manual-setup.md) under the "Multi-ingress: adding hostnames for prototype services" section.
+
+## The config.yml shape
+
+A working brand `config.yml` always looks like:
+
+```yaml
+tunnel: <TUNNEL_ID>
+credentials-file: <CFG_DIR>/<TUNNEL_ID>.json
+ingress:
+  - hostname: admin.<BRAND_HOSTNAME>
+    service: http://localhost:<PORT>
+  - hostname: public.<BRAND_HOSTNAME>
+    service: http://localhost:<PORT>
+  - service: http_status:404
+```
+
+A new prototype rule must land **before** the `http_status:404` catch-all; otherwise cloudflared matches the catch-all first and the prototype hostname returns 404.
+
+## The append pattern
+
+`sed` cannot safely insert before the last block of a multi-line YAML rule (`- service: http_status:404` is one logical entry but the line above it might be a comment or blank). `awk` is the right primitive: scan for the literal `- service: http_status:404` line and insert two lines before it.
+
+```bash
+SURFACE="<surface>"            # e.g. landing
+PORT="<port>"                  # from <surface-dir>/.port
+HOSTNAME="${SURFACE}.${BRAND_HOSTNAME}"
+
+# Idempotency guard — skip if the hostname already appears as an ingress rule.
+if grep -qE "^[[:space:]]*-[[:space:]]+hostname:[[:space:]]+${HOSTNAME}\b" "${CFG_DIR}/config.yml"; then
+  echo "[prototype-host] ingress-row-exists hostname=${HOSTNAME} — skipping append"
+else
+  awk -v host="${HOSTNAME}" -v port="${PORT}" '
+    /^[[:space:]]*-[[:space:]]+service:[[:space:]]+http_status:404[[:space:]]*$/ {
+      print "  - hostname: " host
+      print "    service: http://localhost:" port
+    }
+    { print }
+  ' "${CFG_DIR}/config.yml" > "${CFG_DIR}/config.yml.new"
+  mv "${CFG_DIR}/config.yml.new" "${CFG_DIR}/config.yml"
+fi
+```
+
+## Validate, route, reload
+
+```bash
+# 1. Validate the YAML and ingress semantics.
+cloudflared --origincert "${CFG_DIR}/cert.pem" \
+  --config "${CFG_DIR}/config.yml" \
+  tunnel ingress validate
+
+# 2. Create the DNS row (CNAME from <hostname> to <TUNNEL_ID>.cfargotunnel.com).
+TUNNEL_ID=$(jq -r '.id // .tunnelId' "${CFG_DIR}/tunnel.state")
+cloudflared --origincert "${CFG_DIR}/cert.pem" \
+  tunnel route dns --overwrite-dns "${TUNNEL_ID}" "${HOSTNAME}"
+
+# 3. Reload the connector so it picks up the new ingress rule.
+systemctl --user restart "${BRAND}-cloudflared.service"
+```
+
+Each step is its own command, runs sequentially, exits non-zero on failure. The skill propagates the failing command's stderr verbatim — no parsing, no narration ([[feedback_no_stdout_parsing_for_control_flow]]).
+
+## What `--overwrite-dns` does
+
+If a CNAME for `<hostname>` already exists in the account's DNS (e.g. from a prior install), `tunnel route dns` errors with `record already exists`. `--overwrite-dns` replaces the existing record with one pointing at this tunnel. Use it unconditionally — the alternative (probe-then-create) doubles the API surface and races with concurrent DNS edits.
+
+## Why restart, not reload
+
+`cloudflared` watches `config.yml` only when launched with `--config-watch` (off by default in the brand service unit). `systemctl --user restart` is the deterministic way to pick up the new rule. Brief connection blip (~1s) is acceptable because the brand's admin + public hostnames already tolerate the same blip on every cloudflared upgrade.
+
+## Failure points
+
+| Symptom | Root cause | Fix |
+|---|---|---|
+| `validate: ingress rule N has no service` | `awk` inserted only the hostname line, not the service line | Re-run; the snippet emits both lines atomically per match |
+| `validate: failed to parse YAML` | A previous `awk` run left a partial line | `cat ${CFG_DIR}/config.yml` and hand-fix; the skill cannot recover from corrupt YAML |
+| `route dns: 1004 invalid hostname` | `<surface>` violates DNS label rules (uppercase, underscore, leading dash) | Re-run with a valid `<surface>`; the skill validates `^[a-z0-9-]+$` before phase 4 |
+| `route dns: 9103 unauthorized` | The cert.pem in `${CFG_DIR}` doesn't grant DNS-edit on the zone | Re-run Step 1 of the cloudflare runbook to refresh `cert.pem` |
+| Restart succeeds but `curl -I` returns 502 | The dev server isn't actually listening on `<port>` | Phase 5 (systemd) failed earlier; the skill should have caught it. Read `journalctl --user -u ${BRAND}-prototype-<surface>.service -n 50` |

package/payload/premium-plugins/venture-studio/skills/prototype-host/references/scaffold-frameworks.md

@@ -0,0 +1,60 @@
+# Framework scaffolders, dev-server commands, and port overrides
+
+Five frameworks supported. Each row gives the exact command set the prototype-host skill runs in phases 2 and 5.
+
+## Selection defaults
+
+| Surface intent | Default framework | Reason |
+|---|---|---|
+| `landing` | `static` | One HTML file rendered from `01-narrative/LANDING.md` is faster to ship and faster to load than a Vite bundle. Lighthouse-clean by construction. |
+| `prototype` | `vite` | Vue/React/Svelte all supported; HMR is the founder's iteration loop. |
+
+If the operator names a framework explicitly, use that. Otherwise these defaults stand.
+
+## `static`
+
+No scaffolder. The skill writes a single `index.html` directly into `<surface-dir>/` from `01-narrative/LANDING.md`, with brand tokens inlined into `<style>` in the `<head>`.
+
+- **Build:** none (raw HTML); for a `dist/` build (if the operator adds Tailwind etc later) the skill respects `<surface-dir>/dist/` if present.
+- **Serve:** `cloudflared file-server --port <port> <surface-dir>` (or `<surface-dir>/dist` if a build directory exists).
+- **Port override:** `--port <port>` on `cloudflared file-server`.
+
+## `vite`
+
+- **Scaffold:** `cd <surface-dir-parent> && npm create vite@latest <surface-name> -- --template vanilla-ts -- --yes`. The agent prompts the operator before this if they want a non-vanilla template (`react-ts`, `svelte-ts`, `vue-ts`); otherwise `vanilla-ts` is the default — the founder can rewrite `index.html` + `src/main.ts` to anything from there.
+- **Install:** `cd <surface-dir> && npm install`
+- **Build:** `npm run build` (outputs to `<surface-dir>/dist/`)
+- **Dev server:** `npm run dev -- --port <port> --host 127.0.0.1`
+- **Port override:** `--port <port>` (Vite respects the flag; `PORT=` is ignored).
+
+## `next`
+
+- **Scaffold:** `cd <surface-dir-parent> && npx -y create-next-app@latest <surface-name> --typescript --app --tailwind --eslint --src-dir --import-alias "@/*" --use-npm --yes`
+- **Install:** scaffolder runs `npm install` automatically.
+- **Build:** `npm run build`
+- **Dev server:** `npm run dev -- -p <port> -H 127.0.0.1`
+- **Port override:** `-p <port>` (Next.js dev/start respect the flag; `PORT=` also works but `-p` is explicit).
+
+## `sveltekit`
+
+- **Scaffold:** `cd <surface-dir-parent> && npx -y sv create <surface-name> --template minimal --types ts --no-add-ons --install npm`
+- **Install:** scaffolder runs `npm install` automatically when `--install npm` is passed.
+- **Build:** `npm run build`
+- **Dev server:** `npm run dev -- --port <port> --host 127.0.0.1`
+- **Port override:** `--port <port>`.
+
+## `astro`
+
+- **Scaffold:** `cd <surface-dir-parent> && npm create astro@latest <surface-name> -- --template minimal --typescript strict --install --no-git --yes`
+- **Install:** scaffolder runs `npm install` when `--install` is passed.
+- **Build:** `npm run build` (outputs to `<surface-dir>/dist/`)
+- **Dev server:** `npm run dev -- --port <port> --host 127.0.0.1`
+- **Port override:** `--port <port>`.
+
+## Why `--host 127.0.0.1`
+
+Every dev server above binds to `127.0.0.1`, not `0.0.0.0`. Cloudflared connects to the loopback address; binding to `0.0.0.0` would expose the dev server on the install device's LAN address, which is unwanted (LAN clients should reach the prototype through the tunnel, not directly).
+
+## Why no `--yes` on `create-next-app` interactive prompts in older versions
+
+`create-next-app@latest` (≥14.2) treats all listed flags as the answer set and runs non-interactively. If a flag is omitted it falls back to a TTY prompt — fatal under the agent's non-TTY Bash invocation. Always pass every flag the table lists.

package/payload/premium-plugins/venture-studio/skills/prototype-host/references/systemd-user-service.md

@@ -0,0 +1,104 @@
+# Systemd user unit template for a hosted prototype surface
+
+One unit per hosted surface: `${HOME}/.config/systemd/user/${BRAND}-prototype-<surface>.service`.
+
+Two flavours: dev-server mode (frameworks with hot-reload) and static file-server mode (raw HTML or built `dist/`).
+
+## Dev-server mode (vite, next, sveltekit, astro)
+
+```ini
+[Unit]
+Description=${BRAND} prototype surface <surface> — <framework> dev server
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=<surface-dir>
+Environment="PORT=<port>"
+Environment="NODE_ENV=development"
+ExecStart=/usr/bin/env npm run dev -- <framework-port-flag> <port> --host 127.0.0.1
+Restart=on-failure
+RestartSec=3
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+```
+
+`<framework-port-flag>` is the per-framework override from [`scaffold-frameworks.md`](scaffold-frameworks.md): `--port` for Vite/SvelteKit/Astro, `-p` for Next.
+
+## Static file-server mode
+
+For the `static` framework (raw HTML rendered from `LANDING.md`):
+
+```ini
+[Unit]
+Description=${BRAND} prototype surface <surface> — static file server
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=<surface-dir>
+ExecStart=/usr/local/bin/cloudflared file-server --port <port> --address 127.0.0.1 <surface-dir>
+Restart=on-failure
+RestartSec=3
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+```
+
+If `<surface-dir>/dist/` exists (the founder added a build step later), point `ExecStart`'s last arg at `<surface-dir>/dist` instead of `<surface-dir>`. The skill detects this automatically with `[ -d <surface-dir>/dist ] && SERVE_DIR=<surface-dir>/dist || SERVE_DIR=<surface-dir>`.
+
+## Why a user unit, not a root unit
+
+The brand cloudflared connector already runs as a `systemctl --user` unit ([`platform/plugins/cloudflare/references/reset-guide.md`](../../../../../platform/plugins/cloudflare/references/reset-guide.md)). Keeping prototype units in the same scope means:
+
+- Same `journalctl --user` namespace — the operator reads one log namespace, not two.
+- No `sudo` required to install, enable, or restart.
+- `loginctl enable-linger <user>` (already set by the installer) survives reboot — units come back without an SSH session.
+
+Root units would also work, but split the operator's mental model and require `sudo` for every restart. Not worth the tradeoff for a per-prototype surface.
+
+## Enabling and starting
+
+```bash
+systemctl --user daemon-reload
+systemctl --user enable --now "${BRAND}-prototype-<surface>.service"
+
+# Verify it stayed up.
+systemctl --user is-active "${BRAND}-prototype-<surface>.service"
+
+# If not active, dump the journal and surface verbatim.
+if [ "$(systemctl --user is-active "${BRAND}-prototype-<surface>.service")" != "active" ]; then
+  journalctl --user -u "${BRAND}-prototype-<surface>.service" -n 50 --no-pager >&2
+  exit 1
+fi
+```
+
+## Re-run after edit
+
+If the skill regenerates the unit file (e.g. the port changed, or the static surface gained a `dist/` directory), the sequence is:
+
+```bash
+systemctl --user daemon-reload
+systemctl --user restart "${BRAND}-prototype-<surface>.service"
+```
+
+`daemon-reload` is required after any unit-file edit; `restart` picks up the new `ExecStart`.
+
+## Why `Restart=on-failure`, not `always`
+
+Dev servers exit 0 in legitimate cases (the operator killed `npm run dev` from another shell to apply a config edit). `on-failure` respects those exits; `always` would fight them.
+
+## Logging
+
+All output (stdout + stderr from the dev server / file server) goes to the user journal. Read with:
+
+```bash
+journalctl --user -u "${BRAND}-prototype-<surface>.service" -f
+```
+
+No file-based log rotation needed — systemd handles journal rotation.

package/payload/server/server.js

@@ -12134,6 +12134,55 @@ app34.get("/:rel{.*}", (c) => {
 });
 var sites_default = app34;
 
+// server/routes/listings.ts
+var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
+var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
+var app35 = new Hono();
+app35.get("/:slug/click", async (c) => {
+  const slug = c.req.param("slug") ?? "";
+  const rawSession = c.req.query("session") ?? "";
+  const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
+  if (!SAFE_SLUG_RE.test(slug)) {
+    console.error(`[property-card-click] reject reason=bad-slug-shape slug=${JSON.stringify(slug)} status=400`);
+    return c.text("Bad Request", 400);
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`[property-card-click] reject reason=no-account slug=${slug} status=404`);
+    return c.text("Not Found", 404);
+  }
+  let pageUrl = null;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (l:Listing {accountId: $accountId, slug: $slug})
+       WHERE l.scope = 'public'
+       RETURN l.pageUrl AS pageUrl
+       LIMIT 1`,
+      { accountId: account.accountId, slug }
+    );
+    const record = result.records[0];
+    const raw = record?.get("pageUrl");
+    pageUrl = typeof raw === "string" && raw.length > 0 ? raw : null;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[property-card-click] reject reason=neo4j-error slug=${slug} sessionKey=${sessionKey} err=${JSON.stringify(message)} status=503`);
+    await session.close().catch(() => {
+    });
+    return c.text("Service Unavailable", 503);
+  } finally {
+    await session.close().catch(() => {
+    });
+  }
+  if (!pageUrl) {
+    console.error(`[property-card-click] reject reason=listing-not-found slug=${slug} sessionKey=${sessionKey} accountId=${account.accountId} status=404`);
+    return c.text("Not Found", 404);
+  }
+  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
+  return c.redirect(pageUrl, 302);
+});
+var listings_default = app35;
+
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
 var timer = null;
@@ -12567,9 +12616,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app35 = new Hono();
-app35.use("*", clientIpMiddleware);
-app35.use("*", async (c, next) => {
+var app36 = new Hono();
+app36.use("*", clientIpMiddleware);
+app36.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -12579,7 +12628,7 @@ app35.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -12612,7 +12661,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -12652,7 +12701,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app35.post("/__remote-auth/login", async (c) => {
+app36.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -12697,7 +12746,7 @@ app35.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app35.get("/__remote-auth/logout", (c) => {
+app36.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -12710,7 +12759,7 @@ app35.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app35.post("/__remote-auth/change-password", async (c) => {
+app36.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -12761,13 +12810,13 @@ app35.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app35.get("/__remote-auth/setup", (c) => {
+app36.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app35.post("/__remote-auth/set-initial-password", async (c) => {
+app36.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -12805,10 +12854,10 @@ app35.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app35.get("/api/remote-auth/status", (c) => {
+app36.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app35.post("/api/remote-auth/set-password", async (c) => {
+app36.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12839,9 +12888,9 @@ app35.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app35.route("/api/_client-error", client_error_default);
+app36.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app35.use("*", async (c, next) => {
+app36.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -12874,12 +12923,12 @@ app35.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app35.route("/api/health", health_default);
-app35.route("/api/chat", chat_default);
-app35.route("/api/whatsapp", whatsapp_default);
-app35.route("/api/onboarding", onboarding_default);
-app35.route("/api/admin", admin_default);
-var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
+app36.route("/api/health", health_default);
+app36.route("/api/chat", chat_default);
+app36.route("/api/whatsapp", whatsapp_default);
+app36.route("/api/onboarding", onboarding_default);
+app36.route("/api/admin", admin_default);
+var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
   ".png": "image/png",
@@ -12890,10 +12939,10 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app35.get("/agent-assets/:slug/:filename", (c) => {
+app36.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
-  if (!SAFE_SLUG_RE.test(slug)) {
+  if (!SAFE_SLUG_RE2.test(slug)) {
     console.error(`[agent-assets] invalid-slug slug=${slug}`);
     return c.text("Not found", 404);
   }
@@ -12925,7 +12974,7 @@ app35.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app35.get("/generated/:filename", (c) => {
+app36.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -12955,7 +13004,8 @@ app35.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app35.route("/sites", sites_default);
+app36.route("/sites", sites_default);
+app36.route("/listings", listings_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13092,7 +13142,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app35.get("/", (c) => {
+app36.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13100,12 +13150,12 @@ app35.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app35.get("/public", (c) => {
+app36.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app35.get("/chat", (c) => {
+app36.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13124,9 +13174,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app35.use("/vnc-viewer.html", logViewerFetch);
-app35.use("/vnc-popout.html", logViewerFetch);
-app35.get("/vnc-popout.html", (c) => {
+app36.use("/vnc-viewer.html", logViewerFetch);
+app36.use("/vnc-popout.html", logViewerFetch);
+app36.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync19(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13139,7 +13189,7 @@ app35.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app35.post("/api/vnc/client-event", async (c) => {
+app36.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13160,25 +13210,25 @@ app35.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app35.get("/g/:slug", (c) => {
+app36.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app35.get("/graph", (c) => {
+app36.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app35.get("/sessions", (c) => {
+app36.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app35.get("/data", (c) => {
+app36.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app35.get("/:slug", async (c, next) => {
+app36.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13188,15 +13238,15 @@ app35.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app35.get("/favicon.ico", (c) => {
+  app36.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app35.use("/*", serveStatic({ root: "./public" }));
+app36.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app35.fetch, port, hostname });
+var httpServer = serve({ fetch: app36.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13220,7 +13270,8 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/whatsapp", file: "server/routes/whatsapp.ts", subapp: whatsapp_default },
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
-  { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default }
+  { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
+  { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default }
 ];
 for (const m of SUBAPP_MANIFEST) {
   const routeCount = Array.isArray(m.subapp.routes) ? m.subapp.routes.length : 0;
@@ -13228,7 +13279,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app35.routes ?? []) {
+  for (const r of app36.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });