@rubytech/create-maxy-code 0.1.342 → 0.1.344

package/payload/platform/plugins/admin/mcp/dist/lib/admin-hostname.d.ts

@@ -0,0 +1,15 @@
+export type AdminHostnameSource = "cloudflared-config.yml";
+export interface AdminHostnameHit {
+    hostname: string;
+    isApex: boolean;
+    source: AdminHostnameSource;
+}
+export interface AdminHostnameMiss {
+    hostname: null;
+    isApex: null;
+    source: null;
+    reason: "no-admin-host";
+}
+export type AdminHostnameResult = AdminHostnameHit | AdminHostnameMiss;
+export declare function resolveAdminHostname(configDir: string): AdminHostnameResult;
+//# sourceMappingURL=admin-hostname.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/lib/admin-hostname.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-hostname.d.ts","sourceRoot":"","sources":["../../src/lib/admin-hostname.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAuDvE,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAU3E"}

package/payload/platform/plugins/admin/mcp/dist/lib/admin-hostname.js

@@ -0,0 +1,86 @@
+// admin-hostname resolver — the admin-host twin of public-hostname.ts.
+//
+// Where public-hostname returns the operator's public-facing host, this
+// returns the admin host: the surface that serves /calendar and the rest of
+// the admin shell behind sign-in. The two are different hosts, often on
+// different base domains (public `maxy.chat`, admin `admin.maxy.bot`), so the
+// admin host can never be string-derived from the public one. It is read from
+// the same files cloudflared and platform/ui/server already trust to route.
+//
+// The admin host is defined exactly as classifyHost() defines it in
+// platform/ui/server/public-host-gate.ts: the ingress hostname that routes to
+// the brand UI over http and is neither public (public. prefix or an
+// alias-domains.json entry) nor operator (an operator-domains.json entry).
+// Only http:// ingress rules are considered, so ssh:// and tcp:// rows (off-LAN
+// SSH/SMB) can never be mistaken for the admin host. When more than one
+// admin-class host exists, the first in file order wins — admin is listed
+// first by every documented config.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+function isExcluded(host) {
+    return host === "localhost" || host.endsWith(".local");
+}
+// Apex = single domain (e.g. "maxy.bot"), with optional `www.` prefix stripped.
+function isApex(host) {
+    const stripped = host.startsWith("www.") ? host.slice(4) : host;
+    return stripped.split(".").length === 2;
+}
+// Read the ingress hostnames whose service is an http:// URL — the brand UI
+// surfaces. cloudflared writes each rule as a `- hostname:` line followed by a
+// `service:` line; the catch-all `- service: http_status:404` carries no
+// hostname. ssh:// and tcp:// rows are dropped here so they never reach the
+// admin-class filter.
+function readUiIngressHostnames(configDir) {
+    const path = join(configDir, "cloudflared", "config.yml");
+    if (!existsSync(path))
+        return [];
+    let yaml;
+    try {
+        yaml = readFileSync(path, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const hosts = [];
+    let pendingHost = null;
+    for (const line of yaml.split("\n")) {
+        const hostMatch = line.match(/^\s*-\s*hostname:\s*(\S+)/);
+        if (hostMatch) {
+            pendingHost = hostMatch[1];
+            continue;
+        }
+        const serviceMatch = line.match(/^\s*service:\s*(\S+)/);
+        if (serviceMatch && pendingHost) {
+            if (serviceMatch[1].startsWith("http://"))
+                hosts.push(pendingHost);
+            pendingHost = null;
+        }
+    }
+    return hosts.filter((h) => !isExcluded(h));
+}
+function readStringArray(configDir, file) {
+    const path = join(configDir, file);
+    if (!existsSync(path))
+        return new Set();
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        if (!Array.isArray(parsed))
+            return new Set();
+        return new Set(parsed.filter((h) => typeof h === "string" && h.length > 0));
+    }
+    catch {
+        return new Set();
+    }
+}
+export function resolveAdminHostname(configDir) {
+    const uiHosts = readUiIngressHostnames(configDir);
+    const alias = readStringArray(configDir, "alias-domains.json");
+    const operator = readStringArray(configDir, "operator-domains.json");
+    const isPublic = (h) => h.startsWith("public.") || alias.has(h);
+    const chosen = uiHosts.find((h) => !isPublic(h) && !operator.has(h));
+    if (chosen !== undefined) {
+        return { hostname: chosen, isApex: isApex(chosen), source: "cloudflared-config.yml" };
+    }
+    return { hostname: null, isApex: null, source: null, reason: "no-admin-host" };
+}
+//# sourceMappingURL=admin-hostname.js.map

package/payload/platform/plugins/admin/mcp/dist/lib/admin-hostname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-hostname.js","sourceRoot":"","sources":["../../src/lib/admin-hostname.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,qEAAqE;AACrE,2EAA2E;AAC3E,gFAAgF;AAChF,wEAAwE;AACxE,0EAA0E;AAC1E,oCAAoC;AAEpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmBjC,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,sBAAsB;AACtB,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACxD,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnE,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACjF,CAAC"}

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:7276f9a571c11e5350ab9a29cdc60f6416f4f0b685f58679217efff1b53413e9
+content-hash: sha256:08b7c50d9eb3edfd9739f7ab91977b7fd28aacdfc0024d1fad41ddd067f8cdc5
 brand: maxy-code
 product-name: Maxy
 ---
@@ -1880,6 +1880,67 @@ A QuickBooks connection goes stale if it sits unused for about 100 days, or if y
 
 Switching your Intuit app from sandbox to production requires passing Intuit's own production security review. That is between you and Intuit; it is not something the agent does for you.
 
+---
+# Calendar and Booking
+Source: https://docs.getmaxy.com/calendar-booking.md
+
+# Calendar and booking
+
+Maxy gives you a calendar of your schedule and a public page where people can book time with you. The calendar and the booking page are two sides of the same data: a booking someone makes shows up on your calendar straight away.
+
+## The admin calendar
+
+Open `/calendar` on your Maxy address (the same sign-in as the dashboard). It shows your schedule in four views:
+
+- **Day** and **Week** show an hour grid with each timed entry as a block.
+- **Month** shows the familiar month grid with a few entries per day.
+- **Year** shows twelve small months; days with something on them carry a dot, and clicking a month opens it.
+
+Use **Today** and the arrows to move around, and the view buttons to switch. The calendar reads everything time-bound in your graph: meetings imported from a calendar export or created by a booking, appointments Maxy schedules for you in chat, and tasks that have a due date (shown on their day). The view is read-only: it shows your schedule, it does not create or edit it.
+
+Everything on the calendar comes from records the rest of Maxy already uses, scoped to your account.
+
+## The public booking page
+
+The booking page is a separate, public site on its own web address (for example `book.yourdomain.com`). A visitor sees only open time slots, never the titles or details of your existing meetings. They pick a slot, enter their name, email, and an optional note, and submit. That is the whole flow, like a simple Calendly.
+
+The page is hosted on Cloudflare so it keeps working and keeps taking bookings even if your Maxy device is briefly offline. Each submission is stored safely at the edge first, then turned into a meeting on your calendar shortly after.
+
+## Putting the booking page live
+
+Ask the admin to run the **calendar-site** skill ("put up a booking link" or "deploy the booking site"). It will ask for:
+
+- your **time zone**,
+- the **meeting length** (for example 30 minutes),
+- a **buffer** between meetings (for example 10 minutes),
+- your **weekly availability** (which days and hours you take bookings),
+- the **web address** the booking page should use.
+
+It writes those settings, builds the page, puts it live on that address, and checks that a test booking is captured. To change your availability later, run the same skill again with the new numbers.
+
+## How a booking becomes a meeting
+
+1. A visitor submits a booking on the public page.
+2. The booking is saved immediately at the edge (so it is never lost).
+3. Your Maxy device picks it up on a short cycle, creates a `:Meeting` for it, and links the visitor as a contact.
+4. You are notified by email (and by WhatsApp only if you already have a thread with the agent; it never starts a new WhatsApp conversation).
+5. The new meeting appears on your `/calendar`.
+
+This usually completes within a couple of minutes of the booking.
+
+## If a booking does not show up
+
+Bookings are reconciled on a cycle and the system audits itself each run. In the device logs:
+
+- `[calendar-booking]` lines trace one booking through submit, write, notify, and done.
+- `[calendar-reconcile]` lines report two health numbers per account: `pendingUnreconciled` (bookings captured but not yet turned into meetings) and `orphanMeetings` (booking meetings with no matching saved booking).
+
+A `pendingUnreconciled` number that stays above zero across several runs means the reconcile step is stuck and is worth investigating. To read them: `journalctl --user -u <brand-service> | grep -E '\[calendar-booking\]|\[calendar-reconcile\]'`, then filter by one booking id for its full story. The edge half of a booking (before your device sees it) is in the Cloudflare Pages function logs.
+
+## What this does not do
+
+One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows availability live from your device, so while your device is offline the page can still take a booking but may not show fresh open times until it is back.
+
 ---
 # LinkedIn Extension
 Source: https://docs.getmaxy.com/linkedin-extension.md
@@ -2650,6 +2711,32 @@ Two endpoints, two surfaces, two restart-survival roles:
   string. Hosted on `maxy-edge.service` so the Software Update modal
   can read it while the brand service is mid-restart.
 
+## Installable PWA
+
+The admin (`index.html`), operator (`operator.html`), and chat (`chat.html`)
+shells are installable. Each links its own webmanifest (`/manifest-admin`,
+`/manifest-operator`, `/manifest-chat`) whose `icons` declare an explicit
+`192x192` and `512x512` `any` entry plus a `512x512` `maskable` entry, and an
+`apple-touch-icon`. These all point at an **opaque, padded** app icon baked on a
+white tile — never the transparent brand mark, because iOS/macOS composite a
+transparent app icon onto black. The opaque icons ship per brand
+(`assets.appIcon` / `appIcon192` / `maskableIcon`); `manifest`
+`background_color` only paints the splash screen, so the tile background is
+baked into the PNG. The maskable variant carries a wider safe zone so Android's
+circular crop never clips the mark.
+
+The sign-in page is installable too. The remote-auth gate redirects every
+unauthenticated request to it, so a fresh device installs from there; the page
+links the admin manifest and the opaque `apple-touch-icon` so the install adopts
+the brand name and icon instead of a monogram generated from the title. The
+sign-in page registers no service worker — only the authenticated shells do.
+
+A boot census logs `[pwa-census] surfaces=3 manifest-linked=3 icons-present=3`
+when every shell links its manifest and the app-icon files are present; a missing
+or mis-named icon asset shows `icons-present<3`, and a dropped head injection
+shows `manifest-linked<3`. The graph, data, and browser shells are intentionally
+non-installable.
+
 ## Related references
 
 - [`platform.md`](platform.md) — UI layout, session reconcile model,
@@ -3253,6 +3340,8 @@ Maxy hosts a generic per-account static-tree publish surface at `https://public.
 
 **Deterministic public-hostname surface.** The `<public-host>` half of the URL the operator pastes is resolved by the `mcp__plugin_admin_admin__public-hostname` MCP tool. It reads `<configDir>/cloudflared/config.yml` (ingress list) then falls back to `<configDir>/alias-domains.json` — the same two files `cloudflared` and `platform/ui/server/index.ts`'s `isPublicHost()` already trust to route. Returns `{hostname, isApex, source}` on hit (`source` is `"cloudflared-config.yml"` or `"alias-domains.json"`), or `{hostname:null, source:null, reason:"no-tunnel"}` on miss. Tiebreak: apex wins over subdomain (single-label, or `www.<apex>` stripped). `publish-site` step 6 calls it after the move and emits the full URL (`https://<hostname><path-slug>`) in the same turn. Graph queries are no longer involved — any earlier graph-backed resolver returned `(none)` on accounts bootstrapped without `cloudflare-task-tracker.ts` writes (laptop Real Agent, manual `cloudflared` setup), the `llm-framing-deterministic` recurrence class. The graph-mcp shim additionally runs a sequential envelope-warning probe on every read response — when Neo4j emits `gql_status` codes matching `^0[12]N5\d$` (e.g. `01N52` "property does not exist"), the shim stitches them into a prefix content block on the response so property-name misses surface to the agent inline instead of returning silent `[]`. Probe failure is best-effort: the upstream response forwards unchanged with `[mcp:graph] probe-error`.
 
+**Deterministic admin-hostname surface.** The admin shell — `/calendar` and every other authenticated route — is served only on the admin host, never the public host (`/calendar` returns `404 Not found` on a public host). The `mcp__plugin_admin_admin__admin-hostname` MCP tool is the admin-host twin of `public-hostname`: it resolves the host an operator should be pointed at for an admin-surface URL. It reads `<configDir>/cloudflared/config.yml` ingress, keeps only rules whose `service:` is an `http://` URL (so `ssh://`/`tcp://` off-LAN rows are excluded), and returns the first such hostname that is neither public (`public.` prefix or a `<configDir>/alias-domains.json` entry) nor operator (a `<configDir>/operator-domains.json` entry) — exactly the admin class of `classifyHost()` in `platform/ui/server/public-host-gate.ts`. Returns `{hostname, isApex, source:"cloudflared-config.yml"}` on hit, or `{hostname:null, source:null, reason:"no-admin-host"}` on miss. The admin host is often a different base domain from the public host (public `maxy.chat`, admin `admin.maxy.bot`), so it can never be string-derived from the public one — the `calendar-site` skill calls this tool to surface the admin `/calendar` link instead of guessing.
+
 ### Cross-tab session rotation
 
 When you click "New conversation" in the chat tab, Maxy mints a fresh admin session key on the server and clears the old one. Sibling admin tabs (`/graph`, `/data`) opened in the same browser keep working without re-login: the chat tab broadcasts the new key on a same-origin channel so each sibling tab updates its captured key instantly, and any in-flight admin request that 401s with the rotation-orphan code retries once after re-reading the latest key from per-tab storage. If neither path recovers (browser locked down, second 401 after retry, session expired), the tab shows a single banner — "Your admin session was renewed in another tab. Click to reload." — and one click sends you back through login. No silent 401s; no re-clicking through the same trash icon hoping it sticks. See `.docs/web-chat.md` "Cross-tab rotation contract" for the wire-level `code` taxonomy and observability surfaces.

package/payload/platform/plugins/cloudflare/skills/calendar-site/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: calendar-site
+description: Stand up a public "book time with me" page on a custom domain, backed by the account calendar. This is the skill behind "give me a booking link", "put up a Calendly-style page", "let people book a call with me", "deploy the booking site", and "set my availability for bookings". It writes the account availability window (one duration, one weekly window, one buffer), assembles the booking page plus its D1 capture into the canonical Pages tree, provisions the D1 bookings table, deploys to Cloudflare Pages via the site-deploy skill on the booking domain, and gates done on a live booking page whose open slots load from the brand tunnel and whose test submission lands in D1. The admin calendar that shows the resulting meetings is served separately at /calendar on the admin host (resolve it with the admin-hostname tool, never the public host, which 404s /calendar) and needs no deploy. Admin-run; holds Bash and the account secrets surface.
+---
+
+# Stand up a calendar booking site
+
+Run by the admin/main session, the surface that holds `Bash` and reads the account secrets file. This skill composes `cloudflare:site-deploy` for the Pages deploy and adds the two things a booking site needs that a plain landing page does not: the account availability config the platform reads to compute open slots, and a `bookings` D1 table written by the booking page rather than a contact form.
+
+This is an outcome contract, not a copy of the Pages mechanics. The deploy, custom-domain attach, token discipline, and live done-gate are owned by `site-deploy`; read it with `plugin-read` before deploying. The D1 mechanics live in `references/d1-data-capture.md` and the token discipline in `references/api.md`; read those before issuing their commands.
+
+## What this skill produces, and what it does not
+
+- It produces the **public booking page** on a custom domain (the booking domain), backed by a D1 `bookings` table.
+- It writes the **availability config** the platform free/busy endpoint reads.
+- It does **not** deploy the admin calendar. The four-view admin calendar (Day, Week, Month, Year) is served by the install itself at `https://<admin-host>/calendar`, behind the existing admin sign-in. The `<admin-host>` is **not** the public host; `/calendar` 404s on the public host. Resolve the admin host with the `admin-hostname` tool (the admin-host twin of `public-hostname`; it reads the cloudflared ingress and returns the host that is neither public nor operator), then point the operator at `https://<admin-host>/calendar` once the booking site is live. There is nothing to deploy for it.
+
+## The two routes and why only one is deployed
+
+A booking visitor and the admin look at the booking from opposite sides — the visitor sees only free/busy, the admin sees the booked meeting in full alongside the rest of their schedule:
+
+| Surface | Where it lives | Gate | Reads |
+|---|---|---|---|
+| Admin calendar (4 views) | the install, at `/calendar` on the admin host (resolve via `admin-hostname`) | admin sign-in | every time-bound item for the account — booked and imported meetings, agent-scheduled appointments, and tasks with a due date |
+| Public booking page | Cloudflare Pages, on the booking domain | open | free/busy only, never any meeting detail |
+
+Only the public page is deployed here, because it must stay reachable and keep capturing bookings even when the install device is briefly offline. The admin calendar is dynamic, account-scoped, and authenticated, so it is served by the install over the tunnel and is same-origin with its data. Do not try to put the admin calendar on Pages.
+
+## Set the availability window first
+
+The public page shows open slots computed as the weekly window minus busy `:Meeting` intervals minus a buffer. Those inputs live in one file the platform reads:
+
+```
+<accountDir>/calendar-availability.json
+```
+
+Collect from the operator, then write the file: the account `timezone` (IANA), the meeting `durationMins`, the `bufferMins` between meetings, and the `weekly` window as `{ mon: [["09:00","17:00"]], ... }` with an empty array for days that are closed. Add the `apiBase` (the brand tunnel origin that serves free/busy, `https://<brand-tunnel-domain>`), the `bookingDomain` (the custom domain the page will answer on), and `bookingDbName` (the D1 database name chosen below). Re-running this skill with new numbers is how availability is changed later; there is no separate editor.
+
+## Assemble the canonical tree
+
+Copy the skill template into the one canonical Pages source path `site-deploy` expects:
+
+```
+<accountDir>/pages/<project>/
+```
+
+The template ships `public/index.html`, `public/booking.js`, `public/booking.css`, `functions/api/book.ts`, `wrangler.toml`, and `schema.sql`. Two substitutions make it concrete: set the `<meta name="api-base">` content in `public/index.html` to the `apiBase` value (the booking page fetches free/busy cross-origin from the brand tunnel), and fill `wrangler.toml`'s `__PROJECT_NAME__`, `__D1_DATABASE_NAME__`, and `__D1_DATABASE_ID__` from the project name and the database created below. Leave no `__...__` placeholder in the assembled tree.
+
+## Provision the D1 bookings table
+
+This is a `bookings` table, not the `leads` table of a contact form, so the booking-specific schema ships with the template. Load the stable `<brand>-pages-d1` token from the account secrets file, minting it once only if absent and persisting it, exactly as `references/api.md` and `references/d1-data-capture.md` prescribe; the token needs both Pages Edit and D1 Edit. Create the database, record its id into `wrangler.toml`, and apply `schema.sql` to the remote database. The token is never written into the tree, never committed, never echoed.
+
+## Deploy through site-deploy
+
+Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged.
+
+## Done-gate
+
+Done is a live behavioural signal on the booking domain, surfaced verbatim:
+
+- The booking domain returns `HTTP/2 200` on a cache-busted request.
+- The page's free/busy call succeeds: `curl` the brand tunnel free/busy endpoint and confirm it returns a `slots` array and carries no meeting title, description, or location field. A `404` here means availability was not written; a blocked or unauthenticated response means the free/busy path is not reachable on the brand host.
+
+```bash
+curl -s "https://<brand-tunnel-domain>/api/calendar/free-busy?from=$(date -u +%Y-%m-%dT00:00:00Z)&to=$(date -u -v+14d +%Y-%m-%dT00:00:00Z)" | head -c 400
+```
+
+- A test submission lands in D1 unswept, reusing the same token and database name already loaded:
+
+```bash
+curl -sS -X POST -H 'content-type: application/json' \
+  -d '{"slotStart":"2026-01-01T09:00:00Z","slotEnd":"2026-01-01T09:30:00Z","name":"verify","email":"verify@example.com"}' \
+  "https://<booking-domain>/api/book" -i | head -1
+CLOUDFLARE_API_TOKEN="${PAGES_D1}" wrangler d1 execute <db-name> --remote --command \
+  "SELECT bookingId FROM bookings WHERE swept = 0;"
+```
+
+The install reconciles accepted rows into `:Meeting` nodes on its own interval, so the test submission will appear in the admin calendar at `/calendar` within a couple of minutes and can be removed there or left as proof. Tell the operator the booking link (the booking domain) and the admin calendar link (`https://<admin-host>/calendar`, with `<admin-host>` resolved via the `admin-hostname` tool, not the public host) in the result.
+
+## Tool discipline
+
+The permitted surface is `wrangler`, `curl`, and the Cloudflare API via Bash following the cloudflare references, using the reused per-scope token. Do not mint a fresh token per deploy, do not drive the dashboard with a browser, do not synthesise `wrangler` flags from web search, and never write or echo a token. When a step fails, report the exact output with secrets redacted, name the failing URL or command, and stop.

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/functions/api/book.ts

@@ -0,0 +1,112 @@
+// Booking capture Pages Function (calendar-site skill).
+//
+// Served at POST /api/book on the booking domain. Writes the submission
+// straight to D1 so capture survives a brief Pi outage — the platform reconcile
+// pass turns accepted rows into Neo4j :Meeting nodes later. Emits the
+// [calendar-booking] submit + d1-write lifeline (Cloudflare Pages captures
+// console output).
+//
+// The handler is split so its logic is verifiable without the Pages runtime:
+// processBooking takes an injected DB + logger and returns the HTTP shape.
+
+interface D1Result {
+  meta?: { changes?: number }
+}
+interface D1PreparedStatement {
+  bind: (...values: unknown[]) => D1PreparedStatement
+  run: () => Promise<D1Result>
+}
+interface D1Database {
+  prepare: (query: string) => D1PreparedStatement
+}
+interface BookingEnv {
+  DB: D1Database
+}
+
+interface BookingBody {
+  slotStart?: unknown
+  slotEnd?: unknown
+  name?: unknown
+  email?: unknown
+  note?: unknown
+  company?: unknown // honeypot — real users never fill this
+}
+
+type Logger = (line: string) => void
+
+function isNonEmptyString(v: unknown): v is string {
+  return typeof v === 'string' && v.trim().length > 0
+}
+
+// Field caps so a malicious POST cannot store an unbounded blob in D1.
+const MAX = { name: 200, email: 320, note: 2000, slot: 40 }
+
+function isIsoTimestamp(v: unknown): v is string {
+  return typeof v === 'string' && v.length <= MAX.slot && !Number.isNaN(Date.parse(v))
+}
+
+export async function processBooking(
+  body: BookingBody,
+  env: BookingEnv,
+  log: Logger,
+  newId: () => string,
+): Promise<{ status: number; payload: Record<string, unknown> }> {
+  // Honeypot: a populated `company` field means a bot. Return ok (so the bot
+  // sees success) but write nothing.
+  if (isNonEmptyString(body.company)) {
+    return { status: 200, payload: { ok: true } }
+  }
+
+  if (
+    !isIsoTimestamp(body.slotStart) ||
+    !isIsoTimestamp(body.slotEnd) ||
+    !isNonEmptyString(body.name) ||
+    !isNonEmptyString(body.email)
+  ) {
+    return { status: 400, payload: { ok: false, error: 'name, email, and ISO slotStart/slotEnd are required' } }
+  }
+  if (body.name.length > MAX.name || body.email.length > MAX.email) {
+    return { status: 400, payload: { ok: false, error: 'name or email too long' } }
+  }
+
+  const bookingId = newId()
+  const note = isNonEmptyString(body.note) ? body.note.slice(0, MAX.note) : ''
+  const createdAt = new Date().toISOString()
+  log(`[calendar-booking] op=submit bookingId=${bookingId} slotStart=${body.slotStart} email=${body.email}`)
+
+  const result = await env.DB.prepare(
+    `INSERT INTO bookings (bookingId, slotStart, slotEnd, name, email, note, status, createdAt, swept)
+     VALUES (?, ?, ?, ?, ?, ?, 'accepted', ?, 0)`,
+  )
+    .bind(bookingId, body.slotStart, body.slotEnd, body.name, body.email, note, createdAt)
+    .run()
+
+  const rowsWritten = result.meta?.changes ?? 0
+  log(`[calendar-booking] op=d1-write bookingId=${bookingId} rowsWritten=${rowsWritten}`)
+
+  if (rowsWritten < 1) {
+    return { status: 500, payload: { ok: false, error: 'capture failed' } }
+  }
+  return { status: 200, payload: { ok: true, bookingId } }
+}
+
+interface PagesContext {
+  request: Request
+  env: BookingEnv
+}
+
+export async function onRequestPost(context: PagesContext): Promise<Response> {
+  let body: BookingBody
+  try {
+    body = (await context.request.json()) as BookingBody
+  } catch {
+    return Response.json({ ok: false, error: 'invalid JSON' }, { status: 400 })
+  }
+  const { status, payload } = await processBooking(
+    body,
+    context.env,
+    (line) => console.log(line),
+    () => crypto.randomUUID(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/public/booking.css

@@ -0,0 +1,100 @@
+/* Public booking page (calendar-site skill). Clean single-column Calendly-style
+   layout. Self-contained — no shared tokens, since this ships to Cloudflare
+   Pages, not the admin shell. The skill may overlay brand colors. */
+:root {
+  --bk-bg: #f6f6f4;
+  --bk-card: #ffffff;
+  --bk-ink: #1d1d1f;
+  --bk-muted: #6b6b70;
+  --bk-line: #e3e3e0;
+  --bk-accent: #4b6358;
+  --bk-accent-ink: #ffffff;
+  --bk-radius: 12px;
+}
+
+* { box-sizing: border-box; }
+
+body {
+  margin: 0;
+  background: var(--bk-bg);
+  color: var(--bk-ink);
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+  display: flex;
+  justify-content: center;
+  padding: 32px 16px;
+}
+
+.bk-card {
+  width: 100%;
+  max-width: 520px;
+  background: var(--bk-card);
+  border: 1px solid var(--bk-line);
+  border-radius: var(--bk-radius);
+  padding: 28px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.bk-title { margin: 0 0 4px; font-size: 1.6rem; }
+.bk-sub { margin: 0 0 20px; color: var(--bk-muted); }
+.bk-status { margin: 8px 0; color: var(--bk-muted); }
+
+.bk-day { margin-bottom: 20px; }
+.bk-day-title { font-size: 0.95rem; margin: 0 0 8px; color: var(--bk-ink); }
+.bk-day-slots { display: flex; flex-wrap: wrap; gap: 8px; }
+
+.bk-slot {
+  border: 1px solid var(--bk-accent);
+  background: transparent;
+  color: var(--bk-accent);
+  border-radius: 8px;
+  padding: 8px 14px;
+  font-size: 0.9rem;
+  cursor: pointer;
+}
+.bk-slot:hover { background: var(--bk-accent); color: var(--bk-accent-ink); }
+
+.bk-form { display: flex; flex-direction: column; gap: 14px; }
+.bk-chosen { font-weight: 600; margin: 0 0 4px; }
+.bk-label { display: flex; flex-direction: column; gap: 4px; font-size: 0.85rem; color: var(--bk-muted); }
+.bk-input {
+  border: 1px solid var(--bk-line);
+  border-radius: 8px;
+  padding: 10px 12px;
+  font-size: 1rem;
+  color: var(--bk-ink);
+  font-family: inherit;
+}
+.bk-input:focus { outline: 2px solid var(--bk-accent); border-color: var(--bk-accent); }
+
+/* honeypot — visually and from the layout removed, still in the DOM for bots */
+.bk-hp {
+  position: absolute;
+  left: -9999px;
+  width: 1px;
+  height: 1px;
+  opacity: 0;
+}
+
+.bk-actions { display: flex; justify-content: space-between; gap: 12px; margin-top: 4px; }
+.bk-back {
+  background: transparent;
+  border: 1px solid var(--bk-line);
+  border-radius: 8px;
+  padding: 10px 16px;
+  cursor: pointer;
+  color: var(--bk-muted);
+}
+.bk-submit {
+  background: var(--bk-accent);
+  color: var(--bk-accent-ink);
+  border: none;
+  border-radius: 8px;
+  padding: 10px 20px;
+  font-size: 1rem;
+  cursor: pointer;
+}
+.bk-submit:disabled { opacity: 0.6; cursor: default; }
+
+.bk-done { text-align: center; padding: 16px 0; }
+.bk-done-title { margin: 0 0 8px; font-size: 1.3rem; }
+.bk-done-msg { color: var(--bk-muted); margin: 0; }