@rubytech/create-maxy-code 0.1.342 → 0.1.344

package/payload/server/server.js

@@ -105,7 +105,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-5BG6CHGH.js";
+} from "./chunk-QAKVFSEJ.js";
 import {
   __commonJS,
   __toESM
@@ -1292,8 +1292,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync32, existsSync as existsSync31, watchFile } from "fs";
-import { resolve as resolve33, join as join29, basename as basename10 } from "path";
+import { readFileSync as readFileSync33, existsSync as existsSync31, watchFile } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { resolve as resolve33, join as join30, basename as basename10 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1343,7 +1344,15 @@ function buildManifest(s, b) {
     display: "standalone",
     theme_color: b.themeColor,
     background_color: b.backgroundColor,
-    icons: [{ src: b.iconPath, sizes: "any", purpose: "any" }]
+    // Explicit 192/512 `any` icons (iOS/macOS composite transparency onto black,
+    // so these are opaque) plus a wider-safe-zone `maskable` entry for Android's
+    // circular crop. background_color sets only the splash; the tile background
+    // is baked into the PNGs.
+    icons: [
+      { src: b.appIcon192, sizes: "192x192", purpose: "any" },
+      { src: b.appIcon512, sizes: "512x512", purpose: "any" },
+      { src: b.maskableIcon, sizes: "512x512", purpose: "maskable" }
+    ]
   };
 }
 function escAttr(s) {
@@ -1358,18 +1367,20 @@ function swRegisterScript(s) {
     "</script>"
   ].join("\n");
 }
-function pwaHeadTags(s, b) {
+function installHeadLines(manifestPath, b) {
   return [
-    `<link rel="manifest" href="${escAttr(s.manifestPath)}">`,
-    `<link rel="apple-touch-icon" href="${escAttr(b.iconPath)}">`,
+    `<link rel="manifest" href="${escAttr(manifestPath)}">`,
+    `<link rel="apple-touch-icon" href="${escAttr(b.appleTouchIcon)}">`,
     // Both the standards-based and the legacy Apple capable meta: Chromium
     // deprecates `apple-mobile-web-app-capable` in favour of
     // `mobile-web-app-capable`, while iOS Safari still reads the apple one.
     '<meta name="mobile-web-app-capable" content="yes">',
     '<meta name="apple-mobile-web-app-capable" content="yes">',
-    `<meta name="theme-color" content="${escAttr(b.themeColor)}">`,
-    swRegisterScript(s)
-  ].join("\n");
+    `<meta name="theme-color" content="${escAttr(b.themeColor)}">`
+  ];
+}
+function pwaHeadTags(s, b) {
+  return [...installHeadLines(s.manifestPath, b), swRegisterScript(s)].join("\n");
 }
 function pwaCensus(d) {
   const manifestLinked = PWA_SURFACES.filter((s) => {
@@ -5328,8 +5339,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app53 = new Hono();
-  app53.post("/", async (c) => {
+  const app55 = new Hono();
+  app55.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -5592,7 +5603,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app53;
+  return app55;
 }
 
 // server/routes/whatsapp.ts
@@ -8634,8 +8645,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app53 = new Hono();
-  app53.post("/send", requireAdminSession, async (c) => {
+  const app55 = new Hono();
+  app55.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -8805,7 +8816,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app53.post("/settings", requireAdminSession, async (c) => {
+  app55.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -8845,7 +8856,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app53.get("/session", requireAdminSession, async (c) => {
+  app55.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -8921,7 +8932,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app53.post("/permission-verdict", requireAdminSession, async (c) => {
+  app55.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -8938,7 +8949,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app53;
+  return app55;
 }
 
 // server/routes/webchat-greeting.ts
@@ -13449,6 +13460,89 @@ async function dropFileIndex(accountId, relativePath, opts) {
   });
 }
 
+// server/lib/zip.ts
+import { deflateRawSync } from "zlib";
+var LOCAL_SIG = 67324752;
+var CENTRAL_SIG = 33639248;
+var EOCD_SIG = 101010256;
+var VERSION = 20;
+var FLAG_UTF8 = 2048;
+var crcTable = null;
+function crc32(buf) {
+  if (!crcTable) {
+    crcTable = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+      let c = n;
+      for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+      crcTable[n] = c >>> 0;
+    }
+  }
+  let crc = 4294967295;
+  for (let i = 0; i < buf.length; i++) crc = crcTable[(crc ^ buf[i]) & 255] ^ crc >>> 8;
+  return (crc ^ 4294967295) >>> 0;
+}
+function buildZip(entries) {
+  const localChunks = [];
+  const centralChunks = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const nameBytes = Buffer.from(entry.name, "utf8");
+    const crc = crc32(entry.data);
+    const uncompressedSize = entry.data.length;
+    const deflated = deflateRawSync(entry.data);
+    const useDeflate = deflated.length < uncompressedSize;
+    const method = useDeflate ? 8 : 0;
+    const payload = useDeflate ? deflated : entry.data;
+    const compressedSize = payload.length;
+    const localHeader = Buffer.alloc(30);
+    localHeader.writeUInt32LE(LOCAL_SIG, 0);
+    localHeader.writeUInt16LE(VERSION, 4);
+    localHeader.writeUInt16LE(FLAG_UTF8, 6);
+    localHeader.writeUInt16LE(method, 8);
+    localHeader.writeUInt16LE(0, 10);
+    localHeader.writeUInt16LE(0, 12);
+    localHeader.writeUInt32LE(crc, 14);
+    localHeader.writeUInt32LE(compressedSize, 18);
+    localHeader.writeUInt32LE(uncompressedSize, 22);
+    localHeader.writeUInt16LE(nameBytes.length, 26);
+    localHeader.writeUInt16LE(0, 28);
+    localChunks.push(localHeader, nameBytes, payload);
+    const centralHeader = Buffer.alloc(46);
+    centralHeader.writeUInt32LE(CENTRAL_SIG, 0);
+    centralHeader.writeUInt16LE(VERSION, 4);
+    centralHeader.writeUInt16LE(VERSION, 6);
+    centralHeader.writeUInt16LE(FLAG_UTF8, 8);
+    centralHeader.writeUInt16LE(method, 10);
+    centralHeader.writeUInt16LE(0, 12);
+    centralHeader.writeUInt16LE(0, 14);
+    centralHeader.writeUInt32LE(crc, 16);
+    centralHeader.writeUInt32LE(compressedSize, 20);
+    centralHeader.writeUInt32LE(uncompressedSize, 24);
+    centralHeader.writeUInt16LE(nameBytes.length, 28);
+    centralHeader.writeUInt16LE(0, 30);
+    centralHeader.writeUInt16LE(0, 32);
+    centralHeader.writeUInt16LE(0, 34);
+    centralHeader.writeUInt16LE(0, 36);
+    centralHeader.writeUInt32LE(0, 38);
+    centralHeader.writeUInt32LE(offset, 42);
+    centralChunks.push(centralHeader, nameBytes);
+    offset += localHeader.length + nameBytes.length + payload.length;
+  }
+  const centralDir = Buffer.concat(centralChunks);
+  const centralSize = centralDir.length;
+  const centralOffset = offset;
+  const eocd = Buffer.alloc(22);
+  eocd.writeUInt32LE(EOCD_SIG, 0);
+  eocd.writeUInt16LE(0, 4);
+  eocd.writeUInt16LE(0, 6);
+  eocd.writeUInt16LE(entries.length, 8);
+  eocd.writeUInt16LE(entries.length, 10);
+  eocd.writeUInt32LE(centralSize, 12);
+  eocd.writeUInt32LE(centralOffset, 16);
+  eocd.writeUInt16LE(0, 20);
+  return Buffer.concat([...localChunks, centralDir, eocd]);
+}
+
 // server/routes/admin/files.ts
 var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -13766,6 +13860,61 @@ app20.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
+var ZIP_MAX_FILES = 200;
+var ZIP_MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+app20.get("/download-zip", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error(`[data] auth-rejected endpoint="/api/admin/files/download-zip" reason="no account for session"`);
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const rawPaths = c.req.queries("path") ?? [];
+  if (rawPaths.length === 0) return c.json({ error: "path required" }, 400);
+  if (rawPaths.length > ZIP_MAX_FILES) {
+    return c.json({ error: `Too many files (max ${ZIP_MAX_FILES})` }, 413);
+  }
+  const entries = [];
+  let total = 0;
+  for (const rawPath of rawPaths) {
+    const resolution = resolveDataPath(rawPath);
+    if (!resolution.ok) {
+      if (resolution.status === 403) {
+        console.error(`[data] path-traversal-blocked endpoint="/api/admin/files/download-zip" requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
+      }
+      return c.json({ error: resolution.error }, resolution.status);
+    }
+    const { absolute, relative: relPath } = resolution;
+    if (crossesForeignAccountPartition(relPath, accountId)) {
+      console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download-zip" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
+      return c.json({ error: "Not found" }, 404);
+    }
+    try {
+      const info = await stat5(absolute);
+      if (!info.isFile()) return c.json({ error: "Path is not a file" }, 400);
+      total += info.size;
+      if (total > ZIP_MAX_TOTAL_BYTES) {
+        return c.json({ error: "Selection too large to zip" }, 413);
+      }
+      entries.push({ name: basename8(absolute), data: await readFile5(absolute) });
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") return c.json({ error: "Not found" }, 404);
+      throw err;
+    }
+  }
+  const archive = buildZip(entries);
+  console.error(`[data] file-download-zip files=${entries.length} bytes=${archive.length}`);
+  return new Response(new Uint8Array(archive), {
+    status: 200,
+    headers: {
+      "Content-Type": "application/zip",
+      "Content-Length": String(archive.length),
+      "Content-Disposition": `attachment; filename="files.zip"`,
+      "Cache-Control": "no-store"
+    }
+  });
+});
 function dataUploadCeiling() {
   const override = Number(process.env.MAXY_DATA_UPLOAD_MAX_BYTES);
   return Number.isFinite(override) && override > 0 ? override : MAX_DATA_UPLOAD_BYTES;
@@ -17431,49 +17580,118 @@ app42.post("/launch", requireAdminSession, async (c) => {
 });
 var browser_default = app42;
 
-// server/routes/admin/index.ts
+// server/routes/admin/calendar.ts
 var app43 = new Hono();
-app43.route("/session", session_default);
-app43.route("/logs", logs_default);
-app43.route("/claude-info", claude_info_default);
-app43.route("/attachment", attachment_default);
-app43.route("/agents", agents_default);
-app43.route("/sessions", sessions_default);
-app43.route("/claude-sessions", claude_sessions_default);
-app43.route("/log-ingest", log_ingest_default);
-app43.route("/events", events_default);
-app43.route("/files", files_default);
-app43.route("/graph-search", graph_search_default);
-app43.route("/graph-subgraph", graph_subgraph_default);
-app43.route("/graph-delete", graph_delete_default);
-app43.route("/graph-restore", graph_restore_default);
-app43.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app43.route("/graph-default-view", graph_default_view_default);
-app43.route("/sidebar-artefacts", sidebar_artefacts_default);
-app43.route("/sidebar-sessions", sidebar_sessions_default);
-app43.route("/session-delete", session_delete_default);
-app43.route("/session-stop", session_stop_default);
-app43.route("/session-archive", session_archive_default);
-app43.route("/session-rename", session_rename_default);
-app43.route("/browser", browser_default);
-app43.route("/session-rc-spawn", session_rc_spawn_default);
-app43.route("/session-reseat", session_reseat_default);
-app43.route("/system-stats", system_stats_default);
-app43.route("/health-brand", health_default2);
-app43.route("/linkedin-ingest", linkedin_ingest_default);
-app43.route("/post-turn-context", post_turn_context_default);
-app43.route("/public-session-context", public_session_context_default);
-app43.route("/public-session-exit", public_session_exit_default);
-app43.route("/access-session-evict", access_session_evict_default);
-app43.route("/enrol-person", enrol_person_default);
-var admin_default = app43;
+app43.get("/meetings", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[calendar] op=admin-read auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const from = c.req.query("from");
+  const to = c.req.query("to");
+  if (!from || !to) return c.json({ error: "from and to (ISO) required" }, 400);
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (m:Meeting {accountId: $accountId})
+       WHERE NOT (m.endsAt IS NOT NULL AND m.endsAt <= datetime($from))
+         AND m.startsAt < datetime($to)
+       RETURN elementId(m) AS id, m.title AS title,
+              toString(m.startsAt) AS startsAt, toString(m.endsAt) AS endsAt,
+              m.location AS location, coalesce(m.isAllDay, false) AS isAllDay,
+              'meeting' AS kind
+       UNION
+       MATCH (e:Event {accountId: $accountId})
+       WHERE e.actionPlugin IS NULL
+         AND NOT (e.endDate IS NOT NULL AND datetime(e.endDate) <= datetime($from))
+         AND datetime(e.startDate) < datetime($to)
+       RETURN elementId(e) AS id, e.name AS title,
+              toString(datetime(e.startDate)) AS startsAt,
+              CASE WHEN e.endDate IS NULL THEN null ELSE toString(datetime(e.endDate)) END AS endsAt,
+              e.location AS location, false AS isAllDay,
+              'event' AS kind
+       UNION
+       MATCH (t:Task {accountId: $accountId})
+       WHERE t.dueDate IS NOT NULL
+         AND datetime(t.dueDate) >= datetime($from)
+         AND datetime(t.dueDate) < datetime($to)
+       RETURN elementId(t) AS id, t.name AS title,
+              toString(datetime(t.dueDate)) AS startsAt, null AS endsAt,
+              null AS location, true AS isAllDay,
+              'task' AS kind`,
+      { accountId, from, to }
+    );
+    const meetings = res.records.map((r) => ({
+      meetingId: r.get("id"),
+      title: r.get("title"),
+      startsAt: r.get("startsAt"),
+      endsAt: r.get("endsAt"),
+      location: r.get("location"),
+      isAllDay: r.get("isAllDay"),
+      kind: r.get("kind")
+    })).sort((a, b) => new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime());
+    const counts = { meeting: 0, event: 0, task: 0 };
+    for (const m of meetings) counts[m.kind]++;
+    console.log(
+      `[calendar] op=admin-read events=${counts.event} meetings=${counts.meeting} tasks=${counts.task} range=${from}..${to}`
+    );
+    return c.json({ meetings });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar] op=admin-read-fail err="${message}"`);
+    return c.json({ error: `Calendar unavailable: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+var calendar_default = app43;
+
+// server/routes/admin/index.ts
+var app44 = new Hono();
+app44.route("/session", session_default);
+app44.route("/logs", logs_default);
+app44.route("/claude-info", claude_info_default);
+app44.route("/attachment", attachment_default);
+app44.route("/agents", agents_default);
+app44.route("/sessions", sessions_default);
+app44.route("/claude-sessions", claude_sessions_default);
+app44.route("/log-ingest", log_ingest_default);
+app44.route("/events", events_default);
+app44.route("/files", files_default);
+app44.route("/graph-search", graph_search_default);
+app44.route("/graph-subgraph", graph_subgraph_default);
+app44.route("/graph-delete", graph_delete_default);
+app44.route("/graph-restore", graph_restore_default);
+app44.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app44.route("/graph-default-view", graph_default_view_default);
+app44.route("/sidebar-artefacts", sidebar_artefacts_default);
+app44.route("/sidebar-sessions", sidebar_sessions_default);
+app44.route("/session-delete", session_delete_default);
+app44.route("/session-stop", session_stop_default);
+app44.route("/session-archive", session_archive_default);
+app44.route("/session-rename", session_rename_default);
+app44.route("/browser", browser_default);
+app44.route("/session-rc-spawn", session_rc_spawn_default);
+app44.route("/session-reseat", session_reseat_default);
+app44.route("/system-stats", system_stats_default);
+app44.route("/health-brand", health_default2);
+app44.route("/linkedin-ingest", linkedin_ingest_default);
+app44.route("/post-turn-context", post_turn_context_default);
+app44.route("/public-session-context", public_session_context_default);
+app44.route("/public-session-exit", public_session_exit_default);
+app44.route("/access-session-evict", access_session_evict_default);
+app44.route("/enrol-person", enrol_person_default);
+app44.route("/calendar", calendar_default);
+var admin_default = app44;
 
 // server/routes/access/verify-token.ts
 var TAG37 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app44 = new Hono();
-app44.post("/", async (c) => {
+var app45 = new Hono();
+app45.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -17555,7 +17773,7 @@ app44.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app44;
+var verify_token_default = app45;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -17618,9 +17836,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG38 = "[access-request-link]";
-var app45 = new Hono();
+var app46 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app45.post("/", async (c) => {
+app46.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17694,13 +17912,13 @@ app45.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app45;
+var request_magic_link_default = app46;
 
 // server/routes/access/index.ts
-var app46 = new Hono();
-app46.route("/verify-token", verify_token_default);
-app46.route("/request-magic-link", request_magic_link_default);
-var access_default = app46;
+var app47 = new Hono();
+app47.route("/verify-token", verify_token_default);
+app47.route("/request-magic-link", request_magic_link_default);
+var access_default = app47;
 
 // server/routes/sites.ts
 import { existsSync as existsSync26, readFileSync as readFileSync28, realpathSync as realpathSync7, statSync as statSync11 } from "fs";
@@ -17735,8 +17953,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app47 = new Hono();
-app47.get("/:rel{.*}", (c) => {
+var app48 = new Hono();
+app48.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -17839,7 +18057,7 @@ app47.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app47;
+var sites_default = app48;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -17939,7 +18157,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app48 = new Hono();
+var app49 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -17984,17 +18202,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app48.options("/consent", (c) => {
+app49.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app48.options("/brand-config", (c) => {
+app49.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app48.post("/consent", async (c) => {
+app49.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -18034,7 +18252,7 @@ app48.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app48.get("/brand-config", (c) => {
+app49.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -18044,7 +18262,7 @@ app48.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app48;
+var visitor_consent_default = app49;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -18071,8 +18289,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app49 = new Hono();
-app49.get("/:slug/click", async (c) => {
+var app50 = new Hono();
+app50.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -18136,10 +18354,10 @@ app49.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app49;
+var listings_default = app50;
 
 // server/routes/visitor-event.ts
-var app50 = new Hono();
+var app51 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -18206,12 +18424,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app50.options("/event", (c) => {
+app51.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app50.post("/event", async (c) => {
+app51.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -18416,7 +18634,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app50;
+var visitor_event_default = app51;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
@@ -18462,8 +18680,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app51 = new Hono();
-app51.post("/", async (c) => {
+var app52 = new Hono();
+app52.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -18610,7 +18828,175 @@ app51.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app51;
+var session_default2 = app52;
+
+// server/lib/calendar-availability.ts
+import { readFileSync as readFileSync31 } from "fs";
+import { join as join28 } from "path";
+var AVAILABILITY_FILENAME = "calendar-availability.json";
+var REQUIRED_KEYS = [
+  "timezone",
+  "durationMins",
+  "bufferMins",
+  "weekly"
+];
+function readAvailabilityConfig(accountDir) {
+  const path2 = join28(accountDir, AVAILABILITY_FILENAME);
+  let raw;
+  try {
+    raw = readFileSync31(path2, "utf-8");
+  } catch {
+    throw new Error(`availability not configured: ${path2} not found`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`invalid JSON in ${path2}: ${err.message}`);
+  }
+  const cfg = parsed;
+  for (const key of REQUIRED_KEYS) {
+    if (cfg[key] === void 0 || cfg[key] === null) {
+      throw new Error(`availability config ${path2} missing required key: ${key}`);
+    }
+  }
+  return cfg;
+}
+
+// server/lib/calendar-slots.ts
+var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+function tzOffsetMs(instant, timeZone) {
+  const dtf = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  const parts = {};
+  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
+  let hour = Number(parts.hour);
+  if (hour === 24) hour = 0;
+  const asUTC = Date.UTC(
+    Number(parts.year),
+    Number(parts.month) - 1,
+    Number(parts.day),
+    hour,
+    Number(parts.minute),
+    Number(parts.second)
+  );
+  return asUTC - instant.getTime();
+}
+function zonedWallClockToUtc(y, m, d, hh, mm, timeZone) {
+  const naiveUtc = Date.UTC(y, m - 1, d, hh, mm, 0, 0);
+  const offset = tzOffsetMs(new Date(naiveUtc), timeZone);
+  return new Date(naiveUtc - offset);
+}
+function tzCalendarDate(instant, timeZone) {
+  const dtf = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  });
+  const parts = {};
+  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
+  return { y: Number(parts.year), m: Number(parts.month), d: Number(parts.day) };
+}
+function parseHHMM(s) {
+  const [hh, mm] = s.split(":").map(Number);
+  return { hh, mm };
+}
+function computeOpenSlots(config, busy, fromISO, toISO) {
+  const tz = config.timezone;
+  const durMs = config.durationMins * 6e4;
+  const bufMs = config.bufferMins * 6e4;
+  const from = new Date(fromISO).getTime();
+  const to = new Date(toISO).getTime();
+  const busyMs = busy.map((b) => ({ start: new Date(b.start).getTime(), end: new Date(b.end).getTime() }));
+  const slots = [];
+  const firstDate = tzCalendarDate(new Date(from), tz);
+  let dayMidnight = zonedWallClockToUtc(firstDate.y, firstDate.m, firstDate.d, 0, 0, tz);
+  for (let guard = 0; guard < 400 && dayMidnight.getTime() < to; guard++) {
+    const { y, m, d } = tzCalendarDate(dayMidnight, tz);
+    const weekday = WEEKDAYS[new Date(Date.UTC(y, m - 1, d)).getUTCDay()];
+    const windows = config.weekly[weekday] ?? [];
+    for (const [openStr, closeStr] of windows) {
+      const open = parseHHMM(openStr);
+      const close = parseHHMM(closeStr);
+      const openUtc = zonedWallClockToUtc(y, m, d, open.hh, open.mm, tz).getTime();
+      const closeUtc = zonedWallClockToUtc(y, m, d, close.hh, close.mm, tz).getTime();
+      for (let s = openUtc; s + durMs <= closeUtc; s += durMs) {
+        const slotEnd = s + durMs;
+        if (s < from || s >= to) continue;
+        const blocked = busyMs.some((b) => b.start < slotEnd + bufMs && b.end > s - bufMs);
+        if (blocked) continue;
+        slots.push({ start: new Date(s).toISOString(), end: new Date(slotEnd).toISOString() });
+      }
+    }
+    const next = tzCalendarDate(new Date(dayMidnight.getTime() + 26 * 36e5), tz);
+    dayMidnight = zonedWallClockToUtc(next.y, next.m, next.d, 0, 0, tz);
+  }
+  return slots;
+}
+
+// server/routes/calendar-public.ts
+var app53 = new Hono();
+function setCors(c) {
+  c.header("Access-Control-Allow-Origin", "*");
+  c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "content-type");
+}
+app53.options("/free-busy", (c) => {
+  setCors(c);
+  return c.body(null, 204);
+});
+app53.get("/free-busy", async (c) => {
+  setCors(c);
+  const from = c.req.query("from");
+  const to = c.req.query("to");
+  if (!from || !to) return c.json({ error: "from and to (ISO) required" }, 400);
+  if (Number.isNaN(Date.parse(from)) || Number.isNaN(Date.parse(to))) {
+    return c.json({ error: "from and to must be parseable ISO timestamps" }, 400);
+  }
+  const account = resolveAccount();
+  if (!account) return c.json({ error: "No account configured" }, 500);
+  let config;
+  try {
+    config = readAvailabilityConfig(account.accountDir);
+  } catch (err) {
+    console.error(`[calendar] op=free-busy-unconfigured err="${err.message}"`);
+    return c.json({ error: "Availability not configured" }, 404);
+  }
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (m:Meeting {accountId: $accountId})
+       WHERE NOT (m.endsAt IS NOT NULL AND m.endsAt <= datetime($from))
+         AND m.startsAt < datetime($to)
+       RETURN toString(m.startsAt) AS start, toString(m.endsAt) AS end`,
+      { accountId: account.accountId, from, to }
+    );
+    const busy = res.records.map((r) => {
+      const start = r.get("start");
+      const rawEnd = r.get("end");
+      const end = rawEnd ?? new Date(new Date(start).getTime() + config.durationMins * 6e4).toISOString();
+      return { start, end };
+    });
+    const slots = computeOpenSlots(config, busy, from, to);
+    return c.json({ durationMins: config.durationMins, timezone: config.timezone, slots });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar] op=free-busy-fail err="${message}"`);
+    return c.json({ error: `Availability unavailable: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+var calendar_public_default = app53;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -18958,7 +19344,7 @@ async function migrateUploads(opts = {}) {
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync29 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -19003,7 +19389,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join28(projectsRoot, slug.name);
+    const slugDir = join29(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -19012,9 +19398,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join28(slugDir, entry.name));
+        out.push(join29(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join28(slugDir, entry.name);
+        const subDir = join29(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -19022,7 +19408,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join28(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join29(subDir, s.name));
         }
       }
     }
@@ -19034,7 +19420,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join28(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join29(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -19376,8 +19762,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app53 = new Hono();
-  app53.get("/wa-channel/inbound", (c) => {
+  const app55 = new Hono();
+  app55.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -19395,7 +19781,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app53.post("/wa-channel/reply", async (c) => {
+  app55.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -19416,7 +19802,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app53.post("/wa-channel/reply-document", async (c) => {
+  app55.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -19455,7 +19841,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app53.post("/wa-channel/ready", async (c) => {
+  app55.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -19464,7 +19850,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app53.post("/wa-channel/received", async (c) => {
+  app55.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -19474,7 +19860,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app53.post("/wa-channel/turn-end", async (c) => {
+  app55.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -19505,7 +19891,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=fallback bytes=${bytes}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app53;
+  return app55;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -19798,8 +20184,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app53 = new Hono();
-  app53.get("/webchat-channel/inbound", (c) => {
+  const app55 = new Hono();
+  app55.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -19817,7 +20203,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app53.post("/webchat-channel/reply", async (c) => {
+  app55.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -19827,7 +20213,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app53.post("/webchat-channel/ready", async (c) => {
+  app55.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -19836,7 +20222,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app53.post("/webchat-channel/permission-request", async (c) => {
+  app55.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -19850,7 +20236,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app53.post("/webchat-channel/received", async (c) => {
+  app55.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -19860,7 +20246,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app53.post("/webchat-channel/turn-end", async (c) => {
+  app55.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -19880,7 +20266,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
     return c.json({ ok: true, delivered: "undelivered" });
   });
-  return app53;
+  return app55;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -20372,7 +20758,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync31, statSync as statSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync32, statSync as statSync12 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -20436,7 +20822,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync31(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync32(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -20450,7 +20836,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync31(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync32(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -20611,14 +20997,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join29(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join30(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync31(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync32(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync33(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -20626,6 +21012,12 @@ if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   }
 }
 var brandFaviconPath = BRAND.assets?.favicon ? `/brand/${BRAND.assets.favicon}` : "/favicon.ico";
+var brandAssetsBoot = BRAND.assets ?? {};
+var brandIconPathBoot = brandAssetsBoot.icon ? `/brand/${brandAssetsBoot.icon}` : "/brand/maxy-monochrome.png";
+var brandAppIcon512Path = brandAssetsBoot.appIcon ? `/brand/${brandAssetsBoot.appIcon}` : brandIconPathBoot;
+var brandAppIcon192Path = brandAssetsBoot.appIcon192 ? `/brand/${brandAssetsBoot.appIcon192}` : brandAppIcon512Path;
+var brandMaskableIconPath = brandAssetsBoot.maskableIcon ? `/brand/${brandAssetsBoot.maskableIcon}` : brandAppIcon512Path;
+var ADMIN_MANIFEST_PATH = PWA_SURFACES.find((s) => s.surface === "admin").manifestPath;
 var brandLoginOpts = {
   primaryColor: BRAND.defaultColors?.primary,
   primaryHoverColor: BRAND.defaultColors?.primaryHover,
@@ -20637,13 +21029,18 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName,
   tagline: BRAND.tagline,
-  ogCardPath: BRAND.assets?.ogCard ? `/brand/${BRAND.assets.ogCard}` : void 0
+  ogCardPath: BRAND.assets?.ogCard ? `/brand/${BRAND.assets.ogCard}` : void 0,
+  // Make the sign-in page installable: link the admin manifest + opaque
+  // apple-touch-icon so an install from there adopts the brand name + icon.
+  manifestPath: ADMIN_MANIFEST_PATH,
+  appleTouchIconPath: brandAppIcon512Path,
+  themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join29(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join30(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync31(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync32(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync33(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -20667,11 +21064,11 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app52 = new Hono();
+var app54 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join30(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -20687,7 +21084,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, ".."))
+      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join30(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -20717,7 +21114,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app52.route("/", waGateway.routes());
+app54.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   gatewayUrl: webchatGatewayUrl(),
@@ -20790,15 +21187,15 @@ var webchatGateway = new WebchatGateway({
   deleteSession: (sessionId) => managerDelete(sessionId),
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
-app52.route("/", webchatGateway.routes());
+app54.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   awaitReply: (key, timeoutMs) => webchatGateway.awaitReply(key, timeoutMs)
 });
-app52.use("*", clientIpMiddleware);
-app52.use("*", async (c, next) => {
+app54.use("*", clientIpMiddleware);
+app54.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -20808,7 +21205,7 @@ app52.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app52.use("*", async (c, next) => {
+app54.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -20826,7 +21223,7 @@ app52.use("*", async (c, next) => {
     });
   }
 });
-app52.use("*", async (c, next) => {
+app54.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -20864,7 +21261,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app52.post("/__remote-auth/login", async (c) => {
+app54.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -20909,7 +21306,7 @@ app52.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app52.get("/__remote-auth/logout", (c) => {
+app54.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -20922,7 +21319,7 @@ app52.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app52.post("/__remote-auth/change-password", async (c) => {
+app54.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -20981,13 +21378,13 @@ app52.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app52.get("/__remote-auth/setup", (c) => {
+app54.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app52.post("/__remote-auth/set-initial-password", async (c) => {
+app54.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -21025,10 +21422,10 @@ app52.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app52.get("/api/remote-auth/status", (c) => {
+app54.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app52.post("/api/remote-auth/set-password", async (c) => {
+app54.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21067,13 +21464,17 @@ app52.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app52.route("/api/_client-error", client_error_default);
+app54.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app52.use("*", async (c, next) => {
+app54.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
-  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || PWA_PUBLIC_PATHS.has(path2)) {
+  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
+  // origin) against the brand host with no admin cookie. It is public by
+  // design — open slots only, no :Meeting detail — so it bypasses the gate
+  // exactly like /brand/. The detail-leak guard lives in the route + its test.
+  path2 === "/api/calendar/free-busy" || PWA_PUBLIC_PATHS.has(path2)) {
     await next();
     return;
   }
@@ -21110,25 +21511,26 @@ app52.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path2 }), 200);
 });
-app52.route("/api/health", health_default);
-app52.route("/api/chat", chatRoutes);
-app52.route("/api/whatsapp", whatsapp_default);
-app52.route("/api/whatsapp-reader", whatsapp_reader_default);
-app52.route("/api/public-reader", public_reader_default);
-app52.route("/api/webchat", createWebchatRoutes({
+app54.route("/api/health", health_default);
+app54.route("/api/chat", chatRoutes);
+app54.route("/api/whatsapp", whatsapp_default);
+app54.route("/api/whatsapp-reader", whatsapp_reader_default);
+app54.route("/api/public-reader", public_reader_default);
+app54.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app52.route("/api/webchat/greeting", webchat_greeting_default);
-app52.route("/api/telegram", telegram_default);
-app52.route("/api/quickbooks", quickbooks_default);
-app52.route("/api/onboarding", onboarding_default);
-app52.route("/api/admin", admin_default);
-app52.route("/api/access", access_default);
-app52.route("/api/session", session_default2);
+app54.route("/api/webchat/greeting", webchat_greeting_default);
+app54.route("/api/telegram", telegram_default);
+app54.route("/api/quickbooks", quickbooks_default);
+app54.route("/api/onboarding", onboarding_default);
+app54.route("/api/admin", admin_default);
+app54.route("/api/access", access_default);
+app54.route("/api/session", session_default2);
+app54.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -21140,7 +21542,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app52.get("/agent-assets/:slug/:filename", (c) => {
+app54.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -21169,13 +21571,13 @@ app52.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync32(filePath);
+  const body = readFileSync33(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app52.get("/generated/:filename", (c) => {
+app54.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -21199,22 +21601,22 @@ app52.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync32(filePath);
+  const body = readFileSync33(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app52.route("/sites", sites_default);
-app52.route("/listings", listings_default);
-app52.route("/v", visitor_event_default);
-app52.route("/v", visitor_consent_default);
+app54.route("/sites", sites_default);
+app54.route("/listings", listings_default);
+app54.route("/v", visitor_event_default);
+app54.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync32(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync33(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -21240,11 +21642,12 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 })}</script>`;
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
-var brandIconFsPath = resolve33(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
-var brandIconExists = existsSync31(brandIconFsPath);
+var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
+  (p) => existsSync31(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+);
 var SW_SOURCE = (() => {
   try {
-    return readFileSync32(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync33(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -21252,9 +21655,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join29(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join30(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync31(versionFile)) return "unknown";
-    const content = readFileSync32(versionFile, "utf-8").trim();
+    const content = readFileSync33(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -21295,12 +21698,12 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync32(resolve33(process.cwd(), "public", file), "utf-8");
+    html = readFileSync33(resolve33(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
     const pwaSurface = pwaSurfaceForShell(file);
-    const pwaHead = pwaSurface ? "\n" + pwaHeadTags(pwaSurface, { iconPath: brandIconPath, themeColor: brandThemeColor }) + "\n" : "";
+    const pwaHead = pwaSurface ? "\n" + pwaHeadTags(pwaSurface, { appleTouchIcon: brandAppIcon512Path, themeColor: brandThemeColor }) + "\n" : "";
     const headInjection = (file === "index.html" ? `${brandScript}
 ${versionScript}
 ${clientErrorReporterScript}
@@ -21312,13 +21715,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join29(homedir3(), BRAND.configDir);
+  const configDir2 = join30(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join29(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join30(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync31(cachePath)) return null;
-    return JSON.parse(readFileSync32(cachePath, "utf-8"));
+    return JSON.parse(readFileSync33(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -21362,7 +21765,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app52.get("/", (c) => {
+app54.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -21384,12 +21787,12 @@ app52.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app52.get("/public", (c) => {
+app54.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app52.get("/public-chat", (c) => {
+app54.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -21408,12 +21811,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app52.use("/vnc-viewer.html", logViewerFetch);
-app52.use("/vnc-popout.html", logViewerFetch);
-app52.get("/vnc-popout.html", (c) => {
+app54.use("/vnc-viewer.html", logViewerFetch);
+app54.use("/vnc-popout.html", logViewerFetch);
+app54.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync32(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync33(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -21423,7 +21826,7 @@ app52.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app52.post("/api/vnc/client-event", async (c) => {
+app54.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21444,25 +21847,27 @@ app52.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app52.get("/g/:slug", (c) => {
+app54.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app52.get(pwa.manifestPath, (c) => {
+  app54.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
-      iconPath: brandIconPath,
+      appIcon192: brandAppIcon192Path,
+      appIcon512: brandAppIcon512Path,
+      maskableIcon: brandMaskableIconPath,
       themeColor: brandThemeColor,
       backgroundColor: brandBackgroundColor
     });
     c.header("Content-Type", MANIFEST_CONTENT_TYPE);
     console.log(
-      `[pwa] op=manifest surface=${pwa.surface} brand=${BRAND.productName} status=200 ct=${MANIFEST_CONTENT_TYPE} icon=${brandIconPath} iconExists=${brandIconExists}`
+      `[pwa] op=manifest surface=${pwa.surface} brand=${BRAND.productName} status=200 ct=${MANIFEST_CONTENT_TYPE} icon=${brandAppIcon512Path} iconExists=${brandAppIconsExist}`
     );
     return c.body(JSON.stringify(manifest));
   });
 }
-app52.get("/sw.js", (c) => {
+app54.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -21471,27 +21876,32 @@ app52.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app52.get("/graph", (c) => {
+app54.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app52.get("/chat", (c) => {
+app54.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app52.get("/data", (c) => {
+app54.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app52.get("/browser", (c) => {
+app54.get("/calendar", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("calendar.html"));
+});
+app54.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app52.get("/:slug", async (c, next) => {
+app54.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -21506,13 +21916,13 @@ app52.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app52.get("/favicon.ico", (c) => {
+  app54.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app52.use("/*", serveStatic({ root: "./public" }));
-app52.all("*", (c) => {
+app54.use("/*", serveStatic({ root: "./public" }));
+app54.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -21526,8 +21936,30 @@ app52.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app52.fetch, port, hostname });
+var httpServer = serve({ fetch: app54.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+{
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join30(__dirname, "..");
+  const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const RECONCILE_INTERVAL_MS = 12e4;
+  const runReconcile = () => {
+    if (!existsSync31(reconcileScript)) return;
+    try {
+      const child = spawn3(process.execPath, [reconcileScript], {
+        env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
+        stdio: "inherit"
+      });
+      child.unref();
+      child.on("error", (err) => console.error(`[calendar-reconcile] spawn-failed err="${err.message}"`));
+    } catch (err) {
+      console.error(`[calendar-reconcile] spawn-failed err="${err.message}"`);
+    }
+  };
+  const firstRun = setTimeout(runReconcile, 15e3);
+  firstRun.unref();
+  const loop = setInterval(runReconcile, RECONCILE_INTERVAL_MS);
+  loop.unref();
+}
 {
   const census = pwaCensus({
     shellHtml: (file) => {
@@ -21537,7 +21969,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
         return null;
       }
     },
-    iconExists: () => brandIconExists
+    iconExists: () => brandAppIconsExist
   });
   console.log(
     `[pwa-census] surfaces=${census.surfaces} manifest-linked=${census.manifestLinked} icons-present=${census.iconsPresent}`
@@ -21569,6 +22001,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
   { prefix: "/api/session", file: "server/routes/session.ts", subapp: session_default2 },
+  { prefix: "/api/calendar", file: "server/routes/calendar-public.ts", subapp: calendar_public_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
   { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
@@ -21580,7 +22013,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app52.routes ?? []) {
+  for (const r of app54.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -21624,7 +22057,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync32(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync33(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -21738,7 +22171,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, "..")),
+  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join30(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {