@rubytech/create-maxy-code 0.1.341 → 0.1.343

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.341",
+  "version": "0.1.343",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -40,7 +40,10 @@
     "logo": "maxy-square.png",
     "icon": "maxy-monochrome.png",
     "favicon": "favicon.ico",
-    "ogCard": "maxy-og-image.png"
+    "ogCard": "maxy-og-image.png",
+    "appIcon": "maxy-app-icon-512.png",
+    "appIcon192": "maxy-app-icon-192.png",
+    "maskableIcon": "maxy-app-icon-maskable-512.png"
   },
 
   "npm": {

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:7276f9a571c11e5350ab9a29cdc60f6416f4f0b685f58679217efff1b53413e9
+content-hash: sha256:fd3531bf43b1c57e87512398e56b517563f2a5b44b28a00250dceeab8a68a92c
 brand: maxy-code
 product-name: Maxy
 ---
@@ -1880,6 +1880,67 @@ A QuickBooks connection goes stale if it sits unused for about 100 days, or if y
 
 Switching your Intuit app from sandbox to production requires passing Intuit's own production security review. That is between you and Intuit; it is not something the agent does for you.
 
+---
+# Calendar and Booking
+Source: https://docs.getmaxy.com/calendar-booking.md
+
+# Calendar and booking
+
+Maxy gives you a calendar of your meetings and a public page where people can book time with you. They are two sides of the same data: the meetings the calendar shows are the same meetings a booking creates.
+
+## The admin calendar
+
+Open `/calendar` on your Maxy address (the same sign-in as the dashboard). It shows your meetings in four views:
+
+- **Day** and **Week** show an hour grid with each meeting as a timed block.
+- **Month** shows the familiar month grid with a few meetings per day.
+- **Year** shows twelve small months; days with a meeting carry a dot, and clicking a month opens it.
+
+Use **Today** and the arrows to move around, and the view buttons to switch. The calendar reads your live meetings, so anything in your graph (imported from a calendar export, or created by a booking) appears here. The view is read-only: it shows meetings, it does not create or edit them.
+
+The meetings come from the same `:Meeting` records the rest of Maxy uses, scoped to your account.
+
+## The public booking page
+
+The booking page is a separate, public site on its own web address (for example `book.yourdomain.com`). A visitor sees only open time slots, never the titles or details of your existing meetings. They pick a slot, enter their name, email, and an optional note, and submit. That is the whole flow, like a simple Calendly.
+
+The page is hosted on Cloudflare so it keeps working and keeps taking bookings even if your Maxy device is briefly offline. Each submission is stored safely at the edge first, then turned into a meeting on your calendar shortly after.
+
+## Putting the booking page live
+
+Ask the admin to run the **calendar-site** skill ("put up a booking link" or "deploy the booking site"). It will ask for:
+
+- your **time zone**,
+- the **meeting length** (for example 30 minutes),
+- a **buffer** between meetings (for example 10 minutes),
+- your **weekly availability** (which days and hours you take bookings),
+- the **web address** the booking page should use.
+
+It writes those settings, builds the page, puts it live on that address, and checks that a test booking is captured. To change your availability later, run the same skill again with the new numbers.
+
+## How a booking becomes a meeting
+
+1. A visitor submits a booking on the public page.
+2. The booking is saved immediately at the edge (so it is never lost).
+3. Your Maxy device picks it up on a short cycle, creates a `:Meeting` for it, and links the visitor as a contact.
+4. You are notified by email (and by WhatsApp only if you already have a thread with the agent; it never starts a new WhatsApp conversation).
+5. The new meeting appears on your `/calendar`.
+
+This usually completes within a couple of minutes of the booking.
+
+## If a booking does not show up
+
+Bookings are reconciled on a cycle and the system audits itself each run. In the device logs:
+
+- `[calendar-booking]` lines trace one booking through submit, write, notify, and done.
+- `[calendar-reconcile]` lines report two health numbers per account: `pendingUnreconciled` (bookings captured but not yet turned into meetings) and `orphanMeetings` (booking meetings with no matching saved booking).
+
+A `pendingUnreconciled` number that stays above zero across several runs means the reconcile step is stuck and is worth investigating. To read them: `journalctl --user -u <brand-service> | grep -E '\[calendar-booking\]|\[calendar-reconcile\]'`, then filter by one booking id for its full story. The edge half of a booking (before your device sees it) is in the Cloudflare Pages function logs.
+
+## What this does not do
+
+One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows availability live from your device, so while your device is offline the page can still take a booking but may not show fresh open times until it is back.
+
 ---
 # LinkedIn Extension
 Source: https://docs.getmaxy.com/linkedin-extension.md
@@ -2650,6 +2711,32 @@ Two endpoints, two surfaces, two restart-survival roles:
   string. Hosted on `maxy-edge.service` so the Software Update modal
   can read it while the brand service is mid-restart.
 
+## Installable PWA
+
+The admin (`index.html`), operator (`operator.html`), and chat (`chat.html`)
+shells are installable. Each links its own webmanifest (`/manifest-admin`,
+`/manifest-operator`, `/manifest-chat`) whose `icons` declare an explicit
+`192x192` and `512x512` `any` entry plus a `512x512` `maskable` entry, and an
+`apple-touch-icon`. These all point at an **opaque, padded** app icon baked on a
+white tile — never the transparent brand mark, because iOS/macOS composite a
+transparent app icon onto black. The opaque icons ship per brand
+(`assets.appIcon` / `appIcon192` / `maskableIcon`); `manifest`
+`background_color` only paints the splash screen, so the tile background is
+baked into the PNG. The maskable variant carries a wider safe zone so Android's
+circular crop never clips the mark.
+
+The sign-in page is installable too. The remote-auth gate redirects every
+unauthenticated request to it, so a fresh device installs from there; the page
+links the admin manifest and the opaque `apple-touch-icon` so the install adopts
+the brand name and icon instead of a monogram generated from the title. The
+sign-in page registers no service worker — only the authenticated shells do.
+
+A boot census logs `[pwa-census] surfaces=3 manifest-linked=3 icons-present=3`
+when every shell links its manifest and the app-icon files are present; a missing
+or mis-named icon asset shows `icons-present<3`, and a dropped head injection
+shows `manifest-linked<3`. The graph, data, and browser shells are intentionally
+non-installable.
+
 ## Related references
 
 - [`platform.md`](platform.md) — UI layout, session reconcile model,

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -32,6 +32,7 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 | Skill | Purpose |
 |---|---|
 | [cloudflare/SKILL.md](skills/cloudflare/SKILL.md) | The entry point for every Cloudflare operation. Routes each operation class to its reference, names the outcome contracts (tunnel external HTTP 200; hosting deployed URL; D1 round-trip), and states the tool-discipline + secret-redaction rules that bind the agent. |
+| [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md` and `d1-data-capture.md`. Admin-run; a content specialist hands the deploy off to it. |
 
 ### References
 

package/payload/platform/plugins/cloudflare/skills/calendar-site/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: calendar-site
+description: Stand up a public "book time with me" page on a custom domain, backed by the account calendar. This is the skill behind "give me a booking link", "put up a Calendly-style page", "let people book a call with me", "deploy the booking site", and "set my availability for bookings". It writes the account availability window (one duration, one weekly window, one buffer), assembles the booking page plus its D1 capture into the canonical Pages tree, provisions the D1 bookings table, deploys to Cloudflare Pages via the site-deploy skill on the booking domain, and gates done on a live booking page whose open slots load from the brand tunnel and whose test submission lands in D1. The admin calendar that shows the resulting meetings is served separately at /calendar on the brand tunnel and needs no deploy. Admin-run; holds Bash and the account secrets surface.
+---
+
+# Stand up a calendar booking site
+
+Run by the admin/main session, the surface that holds `Bash` and reads the account secrets file. This skill composes `cloudflare:site-deploy` for the Pages deploy and adds the two things a booking site needs that a plain landing page does not: the account availability config the platform reads to compute open slots, and a `bookings` D1 table written by the booking page rather than a contact form.
+
+This is an outcome contract, not a copy of the Pages mechanics. The deploy, custom-domain attach, token discipline, and live done-gate are owned by `site-deploy`; read it with `plugin-read` before deploying. The D1 mechanics live in `references/d1-data-capture.md` and the token discipline in `references/api.md`; read those before issuing their commands.
+
+## What this skill produces, and what it does not
+
+- It produces the **public booking page** on a custom domain (the booking domain), backed by a D1 `bookings` table.
+- It writes the **availability config** the platform free/busy endpoint reads.
+- It does **not** deploy the admin calendar. The four-view admin calendar (Day, Week, Month, Year) is served by the install itself at `https://<brand-tunnel-domain>/calendar`, behind the existing admin sign-in. Point the operator there once the booking site is live; there is nothing to deploy for it.
+
+## The two routes and why only one is deployed
+
+A booking visitor and the admin look at the same `:Meeting` data from opposite sides:
+
+| Surface | Where it lives | Gate | Reads |
+|---|---|---|---|
+| Admin calendar (4 views) | the install, at `/calendar` on the brand tunnel | admin sign-in | full `:Meeting` detail for the account |
+| Public booking page | Cloudflare Pages, on the booking domain | open | free/busy only, never any meeting detail |
+
+Only the public page is deployed here, because it must stay reachable and keep capturing bookings even when the install device is briefly offline. The admin calendar is dynamic, account-scoped, and authenticated, so it is served by the install over the tunnel and is same-origin with its data. Do not try to put the admin calendar on Pages.
+
+## Set the availability window first
+
+The public page shows open slots computed as the weekly window minus busy `:Meeting` intervals minus a buffer. Those inputs live in one file the platform reads:
+
+```
+<accountDir>/calendar-availability.json
+```
+
+Collect from the operator, then write the file: the account `timezone` (IANA), the meeting `durationMins`, the `bufferMins` between meetings, and the `weekly` window as `{ mon: [["09:00","17:00"]], ... }` with an empty array for days that are closed. Add the `apiBase` (the brand tunnel origin that serves free/busy, `https://<brand-tunnel-domain>`), the `bookingDomain` (the custom domain the page will answer on), and `bookingDbName` (the D1 database name chosen below). Re-running this skill with new numbers is how availability is changed later; there is no separate editor.
+
+## Assemble the canonical tree
+
+Copy the skill template into the one canonical Pages source path `site-deploy` expects:
+
+```
+<accountDir>/pages/<project>/
+```
+
+The template ships `public/index.html`, `public/booking.js`, `public/booking.css`, `functions/api/book.ts`, `wrangler.toml`, and `schema.sql`. Two substitutions make it concrete: set the `<meta name="api-base">` content in `public/index.html` to the `apiBase` value (the booking page fetches free/busy cross-origin from the brand tunnel), and fill `wrangler.toml`'s `__PROJECT_NAME__`, `__D1_DATABASE_NAME__`, and `__D1_DATABASE_ID__` from the project name and the database created below. Leave no `__...__` placeholder in the assembled tree.
+
+## Provision the D1 bookings table
+
+This is a `bookings` table, not the `leads` table of a contact form, so the booking-specific schema ships with the template. Load the stable `<brand>-pages-d1` token from the account secrets file, minting it once only if absent and persisting it, exactly as `references/api.md` and `references/d1-data-capture.md` prescribe; the token needs both Pages Edit and D1 Edit. Create the database, record its id into `wrangler.toml`, and apply `schema.sql` to the remote database. The token is never written into the tree, never committed, never echoed.
+
+## Deploy through site-deploy
+
+Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged.
+
+## Done-gate
+
+Done is a live behavioural signal on the booking domain, surfaced verbatim:
+
+- The booking domain returns `HTTP/2 200` on a cache-busted request.
+- The page's free/busy call succeeds: `curl` the brand tunnel free/busy endpoint and confirm it returns a `slots` array and carries no meeting title, description, or location field. A `404` here means availability was not written; a blocked or unauthenticated response means the free/busy path is not reachable on the brand host.
+
+```bash
+curl -s "https://<brand-tunnel-domain>/api/calendar/free-busy?from=$(date -u +%Y-%m-%dT00:00:00Z)&to=$(date -u -v+14d +%Y-%m-%dT00:00:00Z)" | head -c 400
+```
+
+- A test submission lands in D1 unswept, reusing the same token and database name already loaded:
+
+```bash
+curl -sS -X POST -H 'content-type: application/json' \
+  -d '{"slotStart":"2026-01-01T09:00:00Z","slotEnd":"2026-01-01T09:30:00Z","name":"verify","email":"verify@example.com"}' \
+  "https://<booking-domain>/api/book" -i | head -1
+CLOUDFLARE_API_TOKEN="${PAGES_D1}" wrangler d1 execute <db-name> --remote --command \
+  "SELECT bookingId FROM bookings WHERE swept = 0;"
+```
+
+The install reconciles accepted rows into `:Meeting` nodes on its own interval, so the test submission will appear in the admin calendar at `/calendar` within a couple of minutes and can be removed there or left as proof. Tell the operator the booking link (the booking domain) and the admin calendar link (`/calendar` on the brand tunnel) in the result.
+
+## Tool discipline
+
+The permitted surface is `wrangler`, `curl`, and the Cloudflare API via Bash following the cloudflare references, using the reused per-scope token. Do not mint a fresh token per deploy, do not drive the dashboard with a browser, do not synthesise `wrangler` flags from web search, and never write or echo a token. When a step fails, report the exact output with secrets redacted, name the failing URL or command, and stop.

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/functions/api/book.ts

@@ -0,0 +1,112 @@
+// Booking capture Pages Function (calendar-site skill).
+//
+// Served at POST /api/book on the booking domain. Writes the submission
+// straight to D1 so capture survives a brief Pi outage — the platform reconcile
+// pass turns accepted rows into Neo4j :Meeting nodes later. Emits the
+// [calendar-booking] submit + d1-write lifeline (Cloudflare Pages captures
+// console output).
+//
+// The handler is split so its logic is verifiable without the Pages runtime:
+// processBooking takes an injected DB + logger and returns the HTTP shape.
+
+interface D1Result {
+  meta?: { changes?: number }
+}
+interface D1PreparedStatement {
+  bind: (...values: unknown[]) => D1PreparedStatement
+  run: () => Promise<D1Result>
+}
+interface D1Database {
+  prepare: (query: string) => D1PreparedStatement
+}
+interface BookingEnv {
+  DB: D1Database
+}
+
+interface BookingBody {
+  slotStart?: unknown
+  slotEnd?: unknown
+  name?: unknown
+  email?: unknown
+  note?: unknown
+  company?: unknown // honeypot — real users never fill this
+}
+
+type Logger = (line: string) => void
+
+function isNonEmptyString(v: unknown): v is string {
+  return typeof v === 'string' && v.trim().length > 0
+}
+
+// Field caps so a malicious POST cannot store an unbounded blob in D1.
+const MAX = { name: 200, email: 320, note: 2000, slot: 40 }
+
+function isIsoTimestamp(v: unknown): v is string {
+  return typeof v === 'string' && v.length <= MAX.slot && !Number.isNaN(Date.parse(v))
+}
+
+export async function processBooking(
+  body: BookingBody,
+  env: BookingEnv,
+  log: Logger,
+  newId: () => string,
+): Promise<{ status: number; payload: Record<string, unknown> }> {
+  // Honeypot: a populated `company` field means a bot. Return ok (so the bot
+  // sees success) but write nothing.
+  if (isNonEmptyString(body.company)) {
+    return { status: 200, payload: { ok: true } }
+  }
+
+  if (
+    !isIsoTimestamp(body.slotStart) ||
+    !isIsoTimestamp(body.slotEnd) ||
+    !isNonEmptyString(body.name) ||
+    !isNonEmptyString(body.email)
+  ) {
+    return { status: 400, payload: { ok: false, error: 'name, email, and ISO slotStart/slotEnd are required' } }
+  }
+  if (body.name.length > MAX.name || body.email.length > MAX.email) {
+    return { status: 400, payload: { ok: false, error: 'name or email too long' } }
+  }
+
+  const bookingId = newId()
+  const note = isNonEmptyString(body.note) ? body.note.slice(0, MAX.note) : ''
+  const createdAt = new Date().toISOString()
+  log(`[calendar-booking] op=submit bookingId=${bookingId} slotStart=${body.slotStart} email=${body.email}`)
+
+  const result = await env.DB.prepare(
+    `INSERT INTO bookings (bookingId, slotStart, slotEnd, name, email, note, status, createdAt, swept)
+     VALUES (?, ?, ?, ?, ?, ?, 'accepted', ?, 0)`,
+  )
+    .bind(bookingId, body.slotStart, body.slotEnd, body.name, body.email, note, createdAt)
+    .run()
+
+  const rowsWritten = result.meta?.changes ?? 0
+  log(`[calendar-booking] op=d1-write bookingId=${bookingId} rowsWritten=${rowsWritten}`)
+
+  if (rowsWritten < 1) {
+    return { status: 500, payload: { ok: false, error: 'capture failed' } }
+  }
+  return { status: 200, payload: { ok: true, bookingId } }
+}
+
+interface PagesContext {
+  request: Request
+  env: BookingEnv
+}
+
+export async function onRequestPost(context: PagesContext): Promise<Response> {
+  let body: BookingBody
+  try {
+    body = (await context.request.json()) as BookingBody
+  } catch {
+    return Response.json({ ok: false, error: 'invalid JSON' }, { status: 400 })
+  }
+  const { status, payload } = await processBooking(
+    body,
+    context.env,
+    (line) => console.log(line),
+    () => crypto.randomUUID(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/public/booking.css

@@ -0,0 +1,100 @@
+/* Public booking page (calendar-site skill). Clean single-column Calendly-style
+   layout. Self-contained — no shared tokens, since this ships to Cloudflare
+   Pages, not the admin shell. The skill may overlay brand colors. */
+:root {
+  --bk-bg: #f6f6f4;
+  --bk-card: #ffffff;
+  --bk-ink: #1d1d1f;
+  --bk-muted: #6b6b70;
+  --bk-line: #e3e3e0;
+  --bk-accent: #4b6358;
+  --bk-accent-ink: #ffffff;
+  --bk-radius: 12px;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--bk-bg);
+  color: var(--bk-ink);
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+  display: flex;
+  justify-content: center;
+  padding: 32px 16px;
+}
+
+.bk-card {
+  width: 100%;
+  max-width: 520px;
+  background: var(--bk-card);
+  border: 1px solid var(--bk-line);
+  border-radius: var(--bk-radius);
+  padding: 28px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.bk-title { margin: 0 0 4px; font-size: 1.6rem; }
+.bk-sub { margin: 0 0 20px; color: var(--bk-muted); }
+.bk-status { margin: 8px 0; color: var(--bk-muted); }
+
+.bk-day { margin-bottom: 20px; }
+.bk-day-title { font-size: 0.95rem; margin: 0 0 8px; color: var(--bk-ink); }
+.bk-day-slots { display: flex; flex-wrap: wrap; gap: 8px; }
+
+.bk-slot {
+  border: 1px solid var(--bk-accent);
+  background: transparent;
+  color: var(--bk-accent);
+  border-radius: 8px;
+  padding: 8px 14px;
+  font-size: 0.9rem;
+  cursor: pointer;
+}
+.bk-slot:hover { background: var(--bk-accent); color: var(--bk-accent-ink); }
+
+.bk-form { display: flex; flex-direction: column; gap: 14px; }
+.bk-chosen { font-weight: 600; margin: 0 0 4px; }
+.bk-label { display: flex; flex-direction: column; gap: 4px; font-size: 0.85rem; color: var(--bk-muted); }
+.bk-input {
+  border: 1px solid var(--bk-line);
+  border-radius: 8px;
+  padding: 10px 12px;
+  font-size: 1rem;
+  color: var(--bk-ink);
+  font-family: inherit;
+}
+.bk-input:focus { outline: 2px solid var(--bk-accent); border-color: var(--bk-accent); }
+
+/* honeypot — visually and from the layout removed, still in the DOM for bots */
+.bk-hp {
+  position: absolute;
+  left: -9999px;
+  width: 1px;
+  height: 1px;
+  opacity: 0;
+}
+
+.bk-actions { display: flex; justify-content: space-between; gap: 12px; margin-top: 4px; }
+.bk-back {
+  background: transparent;
+  border: 1px solid var(--bk-line);
+  border-radius: 8px;
+  padding: 10px 16px;
+  cursor: pointer;
+  color: var(--bk-muted);
+}
+.bk-submit {
+  background: var(--bk-accent);
+  color: var(--bk-accent-ink);
+  border: none;
+  border-radius: 8px;
+  padding: 10px 20px;
+  font-size: 1rem;
+  cursor: pointer;
+}
+.bk-submit:disabled { opacity: 0.6; cursor: default; }
+
+.bk-done { text-align: center; padding: 16px 0; }
+.bk-done-title { margin: 0 0 8px; font-size: 1.3rem; }
+.bk-done-msg { color: var(--bk-muted); margin: 0; }

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/public/booking.js

@@ -0,0 +1,155 @@
+// Public booking page (calendar-site skill). Dependency-free.
+// 1. Fetch open slots from the brand tunnel free/busy endpoint.
+// 2. Let the visitor pick one, then collect name/email/note.
+// 3. POST the booking to the same-origin Pages Function (/api/book → D1).
+(function () {
+  'use strict'
+
+  var DAYS_AHEAD = 14
+  var apiBaseMeta = document.querySelector('meta[name="api-base"]')
+  var apiBase = (apiBaseMeta && apiBaseMeta.getAttribute('content')) || ''
+
+  var statusEl = document.getElementById('bk-status')
+  var slotsEl = document.getElementById('bk-slots')
+  var formEl = document.getElementById('bk-form')
+  var chosenEl = document.getElementById('bk-chosen')
+  var doneEl = document.getElementById('bk-done')
+  var doneMsg = document.getElementById('bk-done-msg')
+  var durationEl = document.getElementById('bk-duration')
+  var backBtn = document.getElementById('bk-back')
+
+  var chosenSlot = null
+
+  function setStatus(msg) {
+    statusEl.textContent = msg || ''
+  }
+
+  function fmtDayHeading(d) {
+    return d.toLocaleDateString([], { weekday: 'long', month: 'long', day: 'numeric' })
+  }
+  function fmtTime(d) {
+    return d.toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' })
+  }
+
+  function renderSlots(data) {
+    var slots = (data && data.slots) || []
+    if (data && data.durationMins) {
+      durationEl.textContent = data.durationMins + ' minute meeting'
+    }
+    if (slots.length === 0) {
+      setStatus('No open times in the next two weeks. Please check back later.')
+      return
+    }
+    setStatus('')
+
+    var byDay = {}
+    var order = []
+    slots.forEach(function (s) {
+      var start = new Date(s.start)
+      var key = start.toDateString()
+      if (!byDay[key]) {
+        byDay[key] = []
+        order.push(key)
+      }
+      byDay[key].push(s)
+    })
+
+    order.forEach(function (key) {
+      var group = document.createElement('div')
+      group.className = 'bk-day'
+      var h = document.createElement('h2')
+      h.className = 'bk-day-title'
+      h.textContent = fmtDayHeading(new Date(key))
+      group.appendChild(h)
+
+      var row = document.createElement('div')
+      row.className = 'bk-day-slots'
+      byDay[key].forEach(function (s) {
+        var btn = document.createElement('button')
+        btn.type = 'button'
+        btn.className = 'bk-slot'
+        btn.textContent = fmtTime(new Date(s.start))
+        btn.addEventListener('click', function () {
+          chooseSlot(s)
+        })
+        row.appendChild(btn)
+      })
+      group.appendChild(row)
+      slotsEl.appendChild(group)
+    })
+  }
+
+  function chooseSlot(slot) {
+    chosenSlot = slot
+    var start = new Date(slot.start)
+    chosenEl.textContent = fmtDayHeading(start) + ' at ' + fmtTime(start)
+    slotsEl.hidden = true
+    formEl.hidden = false
+  }
+
+  backBtn.addEventListener('click', function () {
+    chosenSlot = null
+    formEl.hidden = true
+    slotsEl.hidden = false
+  })
+
+  formEl.addEventListener('submit', function (e) {
+    e.preventDefault()
+    if (!chosenSlot) return
+    var fd = new FormData(formEl)
+    var payload = {
+      slotStart: chosenSlot.start,
+      slotEnd: chosenSlot.end,
+      name: fd.get('name'),
+      email: fd.get('email'),
+      note: fd.get('note'),
+      company: fd.get('company'),
+    }
+    var submitBtn = formEl.querySelector('.bk-submit')
+    submitBtn.disabled = true
+    submitBtn.textContent = 'Booking…'
+
+    fetch('/api/book', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(payload),
+    })
+      .then(function (res) {
+        return res.json().then(function (body) {
+          return { ok: res.ok, body: body }
+        })
+      })
+      .then(function (r) {
+        if (!r.ok || !r.body.ok) {
+          throw new Error((r.body && r.body.error) || 'Booking failed')
+        }
+        formEl.hidden = true
+        doneEl.hidden = false
+        var start = new Date(chosenSlot.start)
+        doneMsg.textContent = 'Confirmed for ' + fmtDayHeading(start) + ' at ' + fmtTime(start) + '. A confirmation will follow by email.'
+      })
+      .catch(function (err) {
+        submitBtn.disabled = false
+        submitBtn.textContent = 'Confirm booking'
+        setStatus('Sorry, that did not go through: ' + err.message + '. Please try again.')
+      })
+  })
+
+  function load() {
+    setStatus('Loading available times…')
+    var from = new Date()
+    var to = new Date(from.getTime() + DAYS_AHEAD * 24 * 60 * 60 * 1000)
+    var url = apiBase + '/api/calendar/free-busy?from=' + encodeURIComponent(from.toISOString()) + '&to=' + encodeURIComponent(to.toISOString())
+    fetch(url)
+      .then(function (res) {
+        if (!res.ok) throw new Error('HTTP ' + res.status)
+        return res.json()
+      })
+      .then(renderSlots)
+      .catch(function () {
+        setStatus('Could not load available times right now. Please refresh in a moment.')
+      })
+  }
+
+  load()
+})()

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/public/index.html

@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <!-- The calendar-site skill rewrites the content of this tag to the brand
+       tunnel origin that serves /api/calendar/free-busy. -->
+  <meta name="api-base" content="__API_BASE__" />
+  <title>Book a time</title>
+  <link rel="stylesheet" href="/booking.css" />
+</head>
+<body>
+  <main class="bk-card">
+    <h1 class="bk-title">Book a time</h1>
+    <p class="bk-sub" id="bk-duration"></p>
+
+    <div id="bk-status" class="bk-status" role="status"></div>
+
+    <section id="bk-slots" class="bk-slots" aria-label="Available times"></section>
+
+    <form id="bk-form" class="bk-form" hidden>
+      <p class="bk-chosen" id="bk-chosen"></p>
+      <label class="bk-label">Name
+        <input class="bk-input" type="text" name="name" required autocomplete="name" />
+      </label>
+      <label class="bk-label">Email
+        <input class="bk-input" type="email" name="email" required autocomplete="email" />
+      </label>
+      <label class="bk-label">Note (optional)
+        <textarea class="bk-input" name="note" rows="3"></textarea>
+      </label>
+      <!-- honeypot: hidden from people, tempting to bots -->
+      <input class="bk-hp" type="text" name="company" tabindex="-1" autocomplete="off" aria-hidden="true" />
+      <div class="bk-actions">
+        <button class="bk-back" type="button" id="bk-back">Back</button>
+        <button class="bk-submit" type="submit">Confirm booking</button>
+      </div>
+    </form>
+
+    <div id="bk-done" class="bk-done" hidden>
+      <h2 class="bk-done-title">You are booked</h2>
+      <p id="bk-done-msg" class="bk-done-msg"></p>
+    </div>
+  </main>
+  <script src="/booking.js"></script>
+</body>
+</html>

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/schema.sql

@@ -0,0 +1,18 @@
+-- D1 schema for the booking site (calendar-site skill).
+-- One row per public booking submission. Captured at the edge so a submission
+-- survives a brief Pi outage; the platform reconcile pass later reads accepted,
+-- unswept rows and writes each into Neo4j as a :Meeting.
+CREATE TABLE IF NOT EXISTS bookings (
+  id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  bookingId TEXT UNIQUE NOT NULL,
+  slotStart TEXT NOT NULL,
+  slotEnd   TEXT NOT NULL,
+  name      TEXT NOT NULL,
+  email     TEXT NOT NULL,
+  note      TEXT,
+  status    TEXT NOT NULL DEFAULT 'accepted',
+  createdAt TEXT NOT NULL,
+  swept     INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS bookings_unswept ON bookings (status, swept);