@rubytech/create-realagent 1.0.406

package/payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.js","sourceRoot":"","sources":["../../src/lib/cloudflared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EAET,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,MAAM,YAAY,GAAG;IACnB,4BAA4B;IAC5B,sBAAsB;IACtB,IAAI,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC;CAC1C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,oBAAoB;IACpB,IAAI,CAAC;QACH,gBAAgB,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE;YACxD,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,gBAAgB,GAAG,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,UAAU,EAAE,KAAK,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAOhD,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB;IAC5D,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAE3D,MAAM,UAAU,OAAO;IACrB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE7C,MAAM,WAAW,GAAG,mCAAmC,CAAC;QACxD,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAElD,MAAM,GAAG,GAAG,GAAG;aACZ,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;aAC5C,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEzF,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,KAAK,EACH,sFAAsF;aACzF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI;YAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI;SACvC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,KAAK,EAAE,8EAA8E;aACtF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,GAAG;SACX,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,WAAW,EAAG,IAAI,CAAC,YAAyB,IAAI,EAAE;YAClD,OAAO,EAAE;gBACP,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;gBACzB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,SAAS,MAAM,iDAAiD,SAAS,IAAI,MAAM,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAE1C,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QAC/D,UAAU,EAAE,SAAS;QACrB,IAAI;QACJ,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;QAC/D,UAAU,EAAE,SAAS;QACrB,IAAI;QACJ,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,oBAAoB,EAAE;KACtC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAc,EACd,IAAY;IAEZ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzE,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE;gBACpE,EAAE,QAAQ,EAAE,UAAU,MAAM,EAAE,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE;gBACrE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC7C;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB;IAEhB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAC1E,QAAQ,EACR,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACF,MAAM,OAAO,GAAI,MAAc,EAAE,MAAM,EAAE,OAAO,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,QAAgB,EAChB,OAAe,KAAK;IAEpB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE/C,4DAA4D;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,kEAAkE;IAClE,MAAM,UAAU,GAAG,KAAK;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAE/D,uDAAuD;IACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE;QACzE,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,GAAG,UAAU;gBACb,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE;gBACjD,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC7C;SACF;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAE1E,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAClG,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sDAAsD,GAAG,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,aAAa;IACjD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CACnE,QAAQ,EACR,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;IACF,wCAAwC;IACxC,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAAiB,EACjB,QAAgB;IAEhB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,GAAG,QAAQ,mBAAmB,CAAC;IAEnD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7C,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC1B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,yDAAyD;QACzD,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;YACzC,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;SACP,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,CAAC,EAAE,gBAAgB;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAUD,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;YAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,UAAU,GAAG,uCAAuC,CAAC;QAE3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,sEAAsE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7F,CACF,CAAC;YACJ,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAC;QAEV,SAAS,aAAa,CAAC,KAAa;YAClC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,IAAI,KAAK,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,2DAA2D;gBAC3D,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACxB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAE3E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;AAYhE,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAkB;IACpC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAGD,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,EAAE,EAAE,QAAQ,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,SAAS,EAAE,EAAE,MAAM,IAAI,IAAI,CAAC;AACrC,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAe;IAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE5D,MAAM,eAAe,GAAG,MAAM,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IAExD,OAAO;QACL,SAAS,EAAE,WAAW,EAAE;QACxB,OAAO,EAAE,OAAO,EAAE;QAClB,OAAO,EAAE,OAAO,EAAE;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QAC7B,OAAO;QACP,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,KAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QAChC,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI;QACjC,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,iBAAiB,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI;QACrE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,kBAAkB,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI;QACvE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAC1C,YAAY,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,cAAsB,EACtB,QAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE1D,0CAA0C;IAC1C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,wFAAwF;IACxF,8DAA8D;IAE9D,kDAAkD;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAErC,4CAA4C;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE;QACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAElE,UAAU,CAAC;QACT,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc;QACd,QAAQ;QACR,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QAED,6BAA6B;QAC7B,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC;IAED,oDAAoD;IACpD,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/payload/platform/plugins/cloudflare/mcp/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@maxy/cloudflare",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "cloudflare": "^5.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/payload/platform/plugins/cloudflare/references/setup-guide.md

@@ -0,0 +1,126 @@
+# Cloudflare Tunnel Setup Guide
+
+## Prerequisites
+
+- A Cloudflare account (free at cloudflare.com)
+- A domain on Cloudflare (see "Getting a domain on Cloudflare" below)
+
+### Getting a domain on Cloudflare
+
+The tunnel needs a domain managed by Cloudflare. There are two paths:
+
+**Option A: Buy a new domain through Cloudflare**
+Cloudflare sells domains at cost (no markup). Navigate to cloudflare.com, go to Domains, and buy a domain. The domain is automatically set up — no further DNS configuration needed.
+
+**Option B: Add an existing domain**
+If the user already owns a domain through another registrar (GoDaddy, Namecheap, etc.):
+- Add the domain in Cloudflare's dashboard (Domains → Onboard a domain) and select the Free plan
+- Cloudflare scans existing DNS records and imports them — the user should review to ensure everything is present (website, email, etc.)
+- Cloudflare provides two nameservers — the user replaces the existing nameservers at their registrar with these
+- Propagation is usually minutes but can take up to 24 hours
+- Cloudflare shows the domain as Active once propagation is complete
+
+**Will my website go down?** No. Cloudflare imports all existing DNS records, so traffic continues to reach the same servers as before. The only thing that changes is which nameservers answer DNS queries.
+
+Once the domain is active on Cloudflare, the tunnel setup creates two subdomains (`admin.{domain}` and `public.{domain}`) automatically. Any domain works.
+
+## Setup Flow
+
+The entire setup is done through conversation with the admin agent. The agent walks through each step, using the VNC browser for Cloudflare interactions. The user never leaves the chat interface.
+
+### Authentication
+
+The agent opens Cloudflare in the VNC browser (visible in the chat). The user signs in to their Cloudflare account in that browser. The browser-specialist then navigates to the API Tokens page and creates a connection key with the required permissions. The agent stores the key via `cf-set-token`, which validates it against the Cloudflare API and discovers the account ID.
+
+**Auth validation:** `tunnel-status` reports `hasToken` (key file exists) and `tokenValid` (key tested against Cloudflare API). Only `tokenValid: true` means the connection is valid. An invalid or expired key requires the user to create a new one.
+
+### Tunnel creation
+
+After authentication, the agent calls `tunnel-create` with the domain. This creates the tunnel and routes DNS for both subdomains automatically:
+
+- `admin.{domain}` — remote access to the admin interface (requires a remote password)
+- `public.{domain}` — public chat for customers
+
+No manual Cloudflare dashboard interaction is needed — DNS records (CNAMEs) are created automatically.
+
+### Remote password
+
+Before the tunnel can be enabled, a remote password must be set. This protects the admin interface when accessed from the public internet. It is separate from the local PIN.
+
+Password requirements: at least 8 characters, must contain a number and a special character, no leading/trailing spaces.
+
+### Enabling the tunnel
+
+Once the remote password is set, the agent calls `tunnel-enable` to start the tunnel process. The tunnel runs with automatic health monitoring and restart on failure.
+
+After enabling, the agent verifies the tunnel process survives for 5 seconds and then tests the public URL via browser-specialist. URLs are not reported as working until verified. If verification fails, the agent reports the failure and possible causes (DNS propagation delay, domain not configured in Cloudflare, etc.).
+
+After verified:
+- Admin interface is live at `https://admin.{domain}` (requires remote password)
+- Public chat is live at `https://public.{domain}`
+- Local network access continues to work with the PIN as before
+
+## After Setup
+
+Check tunnel status at any time by asking the agent. The `tunnel-status` tool reports whether the tunnel is running, the configured domain, uptime, and restart count.
+
+### Alias domains
+
+An alias domain (e.g. `maxy.chat`) serves the public chat directly — the URL stays as the alias domain in the browser bar, no redirect. This is the primary method for attaching a custom domain to the public chat.
+
+**How it works:** The `tunnel-add-hostname` tool adds the alias hostname to the tunnel ingress (so Cloudflare routes traffic for that hostname through the tunnel), creates a CNAME record in the alias domain's zone pointing to the tunnel, and registers the alias in `~/.maxy/alias-domains.json` so the web server treats it as a public hostname.
+
+**Requirements:**
+- The alias domain must be an Active zone on the same Cloudflare account
+- The tunnel must already be created (the tool needs a tunnel ID)
+
+**Do not use a CNAME pointing to `public.{primary domain}`.** The tunnel ingress only accepts hostnames it was configured with. A CNAME preserves the original `Host` header, so the tunnel sees the alias hostname and returns 404. The correct CNAME target is `{tunnelId}.cfargotunnel.com`, and the alias must be added to the tunnel's ingress rules — both of which `tunnel-add-hostname` handles automatically.
+
+## Troubleshooting
+
+### Tunnel won't start
+- Ask the agent to check `tunnel-status` for details
+- If the connection key has expired, create a new one via the tunnel setup flow
+- If the key file is missing (`~/.cloudflare/api-token`), create a new connection key
+
+### DNS not resolving (most common issue)
+
+**The #1 cause of "tunnel running but URLs dead" is wrong nameservers.** The domain must use Cloudflare's nameservers, not the registrar's defaults (e.g. Namecheap's `dns1.registrar-servers.com`). `tunnel-status` checks this automatically and emits a CRITICAL warning when nameservers are wrong.
+
+To fix:
+1. Sign in to Cloudflare dashboard
+2. Confirm the domain shows as **Active** (not Pending)
+3. If Pending or not listed: add the domain, select the Free plan, then change nameservers at the registrar to Cloudflare's (shown in the dashboard)
+4. Wait for propagation (usually minutes, up to 24 hours)
+
+Other DNS issues:
+- Use `dns-lookup` to check whether subdomains resolve — never use `dig`, `nslookup`, or other system DNS binaries (they are not installed on the Pi)
+- DNS propagation can take 1-5 minutes after tunnel creation
+- Verify the tunnel is running via `tunnel-status`
+- Check the Cloudflare dashboard to confirm the CNAME records exist for both `admin.{domain}` and `public.{domain}`
+
+### Remote login issues
+- After 5 failed login attempts, there is a 15-minute lockout — wait for it to expire
+- The remote password can be reset by asking the agent on the local network
+
+### Changing domain
+- Ask the agent to disable the tunnel
+- Re-authenticate with Cloudflare using the new domain
+- Create a new tunnel — new DNS records are generated automatically
+- Old DNS records can be removed from the Cloudflare dashboard
+
+## Agent Tools
+
+Nine MCP tools provide full tunnel lifecycle management:
+
+| Tool | Purpose |
+|------|---------|
+| `cf-set-token` | Store and validate a Cloudflare API token (connection key) |
+| `cf-zone-status` | List domains on the account with activation status and nameservers |
+| `tunnel-status` | Full status: installed, token valid, running, domain, URLs, uptime |
+| `tunnel-install` | Install the cloudflared binary |
+| `tunnel-create` | Create tunnel and route DNS for admin/public subdomains |
+| `tunnel-add-hostname` | Add an alias domain for direct serving (no redirect). Handles tunnel ingress, DNS CNAME, and web server registration. Idempotent |
+| `tunnel-enable` | Start the tunnel process with health monitoring |
+| `tunnel-disable` | Stop the tunnel, preserve config for re-enabling |
+| `dns-lookup` | Resolve DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA) without system binaries. Use this for all DNS diagnostics — `dig` and `nslookup` are not available on the Pi |

package/payload/platform/plugins/cloudflare/skills/setup-tunnel.md

@@ -0,0 +1,217 @@
+---
+name: setup-tunnel
+description: Set up a Cloudflare Tunnel using cloudflared login for auth and the Cloudflare SDK for tunnel/DNS operations. One-click authorization in VNC browser. Handles domain verification, tunnel creation, DNS routing, and remote password gating.
+---
+
+# Set Up Cloudflare Tunnel
+
+Create a Cloudflare Tunnel so the platform is accessible from the public internet via `admin.{domain}` and `public.{domain}`. Authentication uses `cloudflared tunnel login` (one-click authorize in the VNC browser). Tunnel and DNS operations use the Cloudflare SDK.
+
+Browser-specialist is dispatched for:
+1. **Cloudflare authorization** — opening the auth URL and confirming the user has authorized
+2. **Domain addition** — adding a domain to Cloudflare if not already present
+3. **Registrar nameserver changes** — updating nameservers at Namecheap, GoDaddy, etc.
+4. **URL verification** — confirming the tunnel URLs load after setup
+
+## User-facing language
+
+Never say "API token", "scoped token", "cert.pem", "Zone", "DNS", "CNAME", "ingress", or any Cloudflare-internal terminology to the user. Use plain language:
+
+| Internal term | Say instead |
+|---------------|-------------|
+| API token / cert.pem | connection |
+| Zone | domain |
+| DNS records | domain routing |
+| Nameservers | domain settings |
+| CNAME | routing entry |
+| Tunnel ID | (don't mention) |
+| Ingress rules | (don't mention) |
+
+Technical details are for tool calls and specialist briefs only — never in messages to the user.
+
+## Prerequisites
+
+Before starting, call `tunnel-status` to assess the current state.
+
+- **Tunnel already running with no DNS warnings:** Tunnel is set up. Confirm to the user and stop.
+- **Tunnel running but DNS NOT RESOLVING warning:** The tunnel process works but URLs are dead because nameservers don't point to Cloudflare. Proceed to "Check domain status."
+- **cloudflared not installed:** Call `tunnel-install`. If it fails, tell the user and stop.
+- **`tokenValid: true`, not running:** Token is valid — skip auth. Proceed to "Check domain status."
+- **`hasCert: true` but `hasToken: false`:** cert.pem exists but credentials haven't been derived. Call `tunnel-login` — it will derive credentials from the cert automatically.
+- **`hasCert: false` and `hasToken: false`:** Full flow required. Proceed to "Connect to Cloudflare."
+
+## Connect to Cloudflare
+
+The platform needs to connect to the user's Cloudflare account. This uses `cloudflared tunnel login` — the user signs in and clicks Authorize once in the VNC browser.
+
+1. **Tell the user what's happening.** "I need to connect to your Cloudflare account. I'll open a Cloudflare authorization page in the browser — sign in and click Authorize, and I'll take care of the rest."
+
+2. **Show the browser** (if not already shown). Call `render-component` with `name: "browser-viewer"` and `data: { title: "Cloudflare" }`.
+
+3. **Start the login.** Call `tunnel-login`. It returns an auth URL.
+
+4. **Open the auth URL.** Dispatch `specialists:browser-specialist`:
+
+   > Navigate to {auth_url}. Take a screenshot. Report whether a Cloudflare sign-in page is shown, a zone selection page, or an authorization prompt.
+
+5. **Handle sign-in.**
+   - Authorization prompt or zone selection visible: tell the user to select their zone (if prompted) and click Authorize. "Click Authorize in the browser to connect your Cloudflare account."
+   - Sign-in form shown: tell the user: "Sign in to your Cloudflare account in the browser. If you don't have one yet, use the sign-up link on the page. Let me know when you're signed in." Wait for confirmation, then dispatch browser-specialist to screenshot and check if the authorization prompt is now visible.
+
+6. **Wait for authorization.** After the user clicks Authorize, dispatch browser-specialist to take a screenshot. The page should show a success message ("You have successfully logged in").
+
+7. **Derive credentials.** Call `tunnel-login` again. It detects `cert.pem` and derives API credentials automatically.
+
+8. **Handle the result.**
+   - Success ("Credentials derived"): tell the user "Connected to your Cloudflare account" with the account name. Proceed to "Check domain status."
+   - cert.pem parsing failure: tell the user there was a problem connecting. Fall back to manual token creation — walk them through creating a token in the Cloudflare dashboard and use `cf-set-token`. See "Fallback" section.
+   - cert.pem not yet written: the user may not have clicked Authorize. Ask them to check the browser and click Authorize. Retry step 6. Maximum 3 attempts.
+
+## Check domain status
+
+9. **Call `cf-zone-status`** to list all domains on the account with their activation status and nameservers.
+
+10. **Handle the domain status.**
+    - **Domain is Active:** Proceed to "Create the tunnel."
+    - **Domain is Pending:** Nameservers haven't been updated yet. Proceed to "Update nameservers."
+    - **No domain on the account:** The user needs to add their domain to Cloudflare. Proceed to "Add domain."
+
+### Add domain
+
+If no domain is listed on the Cloudflare account, guide the user through adding one via browser-specialist.
+
+11. **Ask which domain.** "Which domain would you like to use? (e.g., mybusiness.com)"
+
+12. **Add the domain via browser.** Dispatch `specialists:browser-specialist`:
+
+    > Navigate to https://dash.cloudflare.com. Click "Add a site" (or "Add site" or similar). Enter the domain "{domain}". Select the Free plan. Complete the setup wizard. Take a screenshot after each step. Report the Cloudflare-assigned nameservers shown at the end (two addresses ending in .ns.cloudflare.com).
+
+13. **Verify.** Re-run `cf-zone-status` to confirm the domain appears. Report the nameservers to proceed to "Update nameservers."
+
+### Update nameservers
+
+If the domain shows Pending status, the nameservers at the registrar still point elsewhere.
+
+14. **Get the Cloudflare nameservers** from the `cf-zone-status` output (two hostnames ending in `.ns.cloudflare.com`).
+
+15. **Ask the user which registrar they use.** "Your domain needs to be pointed to Cloudflare. Which company did you register your domain with? (e.g., Namecheap, GoDaddy, Porkbun)"
+
+16. **Show the browser** (if title changed). Call `render-component` with:
+    - `name: "browser-viewer"`
+    - `data: { title: "Registrar" }`
+
+17. **Navigate to the registrar in the VNC browser.** Dispatch browser-specialist:
+
+    > Navigate to {registrar_url}. Take a screenshot. Report whether a sign-in page is shown or the user is already signed in.
+
+18. **User signs in to their registrar.** Tell the user: "Sign in to your {registrar} account in the browser. Let me know when you're signed in."
+
+19. **Navigate to nameserver settings.** Dispatch browser-specialist:
+
+    > Find the domain "{domain}" in the registrar dashboard. Navigate to its DNS or nameserver settings. Take a screenshot. Report the current nameservers and whether there is an option to set custom nameservers.
+
+20. Tell the user to update the nameservers:
+
+    > Update the nameservers in the browser to:
+    > - `{cf_nameserver_1}`
+    > - `{cf_nameserver_2}`
+    >
+    > Replace the existing nameservers and save. Let me know when done.
+
+21. Wait for confirmation. Re-run `cf-zone-status` to check the domain status. If still Pending: "The settings are updated but it can take a few minutes to take effect. We can continue setting up the tunnel — everything will start working once the change propagates."
+
+    Proceed to "Create the tunnel."
+
+## Create the tunnel
+
+22. **Call `tunnel-create`** with the domain. `tunnel-create` is idempotent — safe to call again. It creates the tunnel on Cloudflare's edge, configures ingress rules via the API, and creates CNAME records for `admin.{domain}` and `public.{domain}`.
+
+23. **Check the response for DNS warnings.** If the domain isn't Active on Cloudflare, return to "Update nameservers." If DNS propagation is in progress, wait and re-check.
+
+24. **Tell the user.** "Your tunnel is created and your domain is configured. One more step — setting a password for remote access."
+
+## Enable the tunnel
+
+25. **Set remote password.** The remote password gates external access to the admin interface — `tunnel-enable` refuses to start without it. The password is set by the user in their own browser, never in chat.
+
+    Check: `test -f ~/.maxy/.remote-password && echo "exists" || echo "missing"` via Bash.
+
+    - If exists: proceed to enable.
+    - If missing: tell the user to open the setup page in their own browser (not the VNC browser) and set a remote access password. This password protects admin access over the internet — separate from the local PIN.
+
+      > Open this URL in your browser to set your remote access password:
+      > **http://maxy.local:19200/__remote-auth/setup**
+      >
+      > Choose a strong password — at least 8 characters, with a number and a special character. You'll use this password when accessing your platform remotely.
+
+    - **Verification gate:** After the user confirms, wait 3 seconds before checking the file — scrypt hashing and file write on the Pi take a moment. Check `sleep 3 && test -f ~/.maxy/.remote-password && echo "exists" || echo "missing"` via Bash. When the file exists, confirm and proceed. If the file doesn't exist after the delay, tell the user to try again — the form may not have submitted successfully.
+
+    - **The agent never collects, sees, or handles the password.** It only verifies the file exists.
+
+26. **Enable the tunnel.** Call `tunnel-enable` with the tunnel ID and domain.
+
+27. **Verify the URLs work.** Call `tunnel-status` to confirm `running: true`. Then dispatch browser-specialist:
+
+    > Navigate to https://public.{domain}. Take a screenshot. Report whether the chat interface loads or a connection error appears.
+
+    - Chat loads: tell the user both URLs are live and working.
+    - Connection error after 2 retries: "The tunnel is running but the URLs are not responding yet. This usually takes a few minutes. Try visiting the link shortly."
+    - **Do NOT use `web-fetch`** for verification — use browser-specialist only.
+    - If browser-specialist is unavailable: tell the user explicitly to check the URL in their own browser.
+    - **Never report URLs as working without verification.**
+
+## Fallback
+
+If browser-specialist is unavailable (not installed, Agent tool fails, Playwright tools not accessible):
+
+1. For Cloudflare authorization: call `tunnel-login` to get the auth URL. Tell the user: "Open this link in your browser and click Authorize. Let me know when done." Then call `tunnel-login` again to derive credentials.
+2. For domain addition: tell the user to add their domain via the Cloudflare dashboard. "Go to your Cloudflare dashboard and click 'Add a site.' Enter your domain and choose the free plan. Let me know when it's done."
+3. For registrar nameserver changes: tell the user to update their nameservers manually. "Go to your domain registrar and change the nameservers to the two addresses I'll give you. Let me know when done."
+4. For URL verification: tell the user to check `https://public.{domain}` in their own browser and confirm it loads.
+
+If `tunnel-login` credential derivation fails (cert.pem format unreadable): fall back to manual token creation. Walk the user through the Cloudflare dashboard in plain language — "Go to your Cloudflare account, then to your profile, then API Tokens, and create a new custom token." Guide one step at a time. Use `cf-set-token` to store the token.
+
+Even in fallback mode, never use internal terminology. Guide in plain English.
+
+## Add alias domain
+
+An alias domain (e.g. `maxy.chat`) serves the public chat directly — the URL stays as the alias domain in the browser bar. No redirect.
+
+### Prerequisites
+
+- A working tunnel (the main setup flow above must be complete)
+- The alias domain must be an Active zone on the Cloudflare account (same as the primary domain — added via the dashboard or purchased through Cloudflare)
+- The tunnel ID (from `tunnel-status`)
+
+### Flow
+
+1. **Confirm the alias domain.** The user says something like "attach maxy.chat to my public chat" or "add maxy.chat as an alias." Extract the alias domain.
+
+2. **Check the alias domain is on Cloudflare.** Call `cf-zone-status`. The alias domain must appear as Active. If it's not listed, guide the user through adding it (same as "Add domain" in the main flow). If it's Pending, guide nameserver changes.
+
+3. **Get the tunnel ID.** Call `tunnel-status`. The tunnel must be running or at least have a known tunnel ID.
+
+4. **Add the alias hostname.** Call `tunnel-add-hostname` with the alias domain and tunnel ID. The tool handles everything: adds the hostname to the tunnel ingress, creates a CNAME in the alias domain's zone pointing to the tunnel, and registers the alias so the web server recognises it. The web server hot-reloads alias domains automatically — no restart needed.
+
+5. **Verify the alias URL works.** Wait a few seconds for the web server to pick up the change, then dispatch browser-specialist to navigate to `https://{alias_domain}` and take a screenshot. The public chat should load directly.
+   - If it loads: "Your public chat is now live at https://{alias_domain}. The URL stays as {alias_domain} — no redirect."
+   - If it fails: check DNS propagation (1-5 minutes for CNAME). Retry after waiting. If still failing, use `dns-lookup` to diagnose.
+
+### User-facing language
+
+Same rules as the main flow — no technical terminology. Say "alias domain" or "custom domain" when talking to the user. Never say CNAME, ingress, or zone.
+
+### Idempotency
+
+`tunnel-add-hostname` is idempotent — safe to call multiple times with the same hostname. If the alias is already configured, it reports that and does nothing.
+
+## Important
+
+- **Everything in the chat.** Authorization happens in the VNC browser via browser-specialist. Domain checks use `cf-zone-status`. Tunnel creation and routing use the SDK. The user never navigates to external websites on their own.
+- **Never claim URLs are working without testing them.** Every setup ends with browser-specialist verification or an explicit "I could not verify" message.
+- **`render-component` before any specialist dispatch.** Without it, automation runs invisibly.
+- **The user signs in themselves** — the specialist does not fill credentials at any site.
+- **`tunnel-create` is idempotent** — safe to call multiple times with the same domain.
+- **`tunnel-login` is idempotent** — safe to call multiple times. It detects state and does the right thing.
+- **`tunnel-add-hostname` is idempotent** — safe to call multiple times with the same hostname. No duplicates.
+- **DNS propagation takes 1-5 minutes** after tunnel creation. Nameserver propagation takes minutes to 24 hours.

package/payload/platform/plugins/contacts/PLUGIN.md

@@ -0,0 +1,20 @@
+---
+name: contacts
+description: "CRM contacts plugin. Provides contact-create, contact-lookup, contact-update, contact-delete, and contact-list tools for managing the customer contact graph."
+icon: 👥
+tools:
+  - contact-create
+  - contact-lookup
+  - contact-update
+  - contact-delete
+  - contact-list
+always: false
+embed: false
+metadata: {"taskmaster":{"optional":true,"recommended":true}}
+---
+
+# Contacts
+
+Manages customer contact records in the knowledge graph. Admin agent only — the public agent has no write access.
+
+Tools are available via the `contacts` MCP server.

package/payload/platform/plugins/contacts/mcp/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/contacts/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/contacts/mcp/dist/index.js

@@ -0,0 +1,210 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { contactCreate } from "./tools/contact-create.js";
+import { contactLookup } from "./tools/contact-lookup.js";
+import { contactUpdate } from "./tools/contact-update.js";
+import { contactList } from "./tools/contact-list.js";
+import { contactDelete } from "./tools/contact-delete.js";
+import { closeDriver } from "./lib/neo4j.js";
+const server = new McpServer({
+    name: "maxy-contacts",
+    version: "0.1.0",
+});
+const accountId = process.env.ACCOUNT_ID;
+if (!accountId) {
+    throw new Error("ACCOUNT_ID environment variable is required");
+}
+server.tool("contact-create", "Create a new contact (schema:Person) in the graph. Deduplicates by email — returns existing contact if email already exists.", {
+    givenName: z.string().describe("First name"),
+    familyName: z.string().optional().describe("Last name"),
+    email: z.string().email().describe("Email address (canonical identifier)"),
+    telephone: z.string().optional().describe("Phone number"),
+    jobTitle: z.string().optional().describe("Job title"),
+    source: z
+        .string()
+        .describe("Where this contact came from (e.g. public.maxy.bot, telegram)"),
+    status: z
+        .string()
+        .optional()
+        .describe("Contact status (e.g. active, prospect, waitlist)"),
+}, async (params) => {
+    try {
+        const result = await contactCreate({ ...params, accountId });
+        if (result.alreadyExists) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Contact already exists with email ${result.email} (ID: ${result.nodeId}). No duplicate created.`,
+                    },
+                ],
+            };
+        }
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Contact created: ${params.givenName} <${result.email}> (ID: ${result.nodeId}, status: ${params.status ?? "waitlist"})`,
+                },
+            ],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Failed to create contact: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+server.tool("contact-lookup", "Search for contacts by email, name, or list recent contacts. Returns schema:Person nodes.", {
+    email: z.string().optional().describe("Exact email match"),
+    name: z.string().optional().describe("Partial name search (first or last name)"),
+    limit: z.number().int().optional().describe("Max results (default 10)"),
+}, async ({ email, name, limit }) => {
+    try {
+        const results = await contactLookup({ email, name, accountId, limit });
+        if (results.length === 0) {
+            return {
+                content: [
+                    { type: "text", text: "No contacts found." },
+                ],
+            };
+        }
+        const formatted = results
+            .map((c) => `${c.givenName}${c.familyName ? ` ${c.familyName}` : ""} <${c.email}> — ${c.status} (from ${c.source}, ${c.createdOn})`)
+            .join("\n");
+        return {
+            content: [{ type: "text", text: formatted }],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Lookup failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+server.tool("contact-update", "Update properties of an existing contact. Cannot change email or accountId.", {
+    email: z.string().optional().describe("Find contact by email"),
+    nodeId: z.string().optional().describe("Find contact by node ID"),
+    updates: z
+        .record(z.string(), z.unknown())
+        .describe("Properties to update (e.g. status, telephone, jobTitle)"),
+}, async ({ email, nodeId, updates }) => {
+    try {
+        const result = await contactUpdate({
+            email,
+            nodeId,
+            updates: updates,
+            accountId,
+        });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Contact updated (ID: ${result.nodeId})`,
+                },
+            ],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Update failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+server.tool("contact-list", "List contacts with optional filters. Returns summary of matching Person nodes.", {
+    status: z
+        .string()
+        .optional()
+        .describe("Filter by status (e.g. waitlist)"),
+    source: z
+        .string()
+        .optional()
+        .describe("Filter by source (e.g. public.maxy.bot, telegram)"),
+    since: z
+        .string()
+        .optional()
+        .describe("ISO date — only contacts created after this date"),
+    limit: z.number().int().optional().describe("Max results (default 50)"),
+}, async (params) => {
+    try {
+        const result = await contactList({ ...params, accountId });
+        if (result.contacts.length === 0) {
+            return {
+                content: [
+                    { type: "text", text: "No contacts match the filters." },
+                ],
+            };
+        }
+        const header = `${result.total} total contacts${params.status ? ` with status '${params.status}'` : ""}:\n\n`;
+        const formatted = result.contacts
+            .map((c) => `${c.givenName}${c.familyName ? ` ${c.familyName}` : ""} <${c.email}> — ${c.status} (${c.source}, ${c.createdOn})`)
+            .join("\n");
+        return {
+            content: [{ type: "text", text: header + formatted }],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `List failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+server.tool("contact-delete", "Permanently delete a contact (Person node) and all its relationships from the graph. Identify the contact by email or node ID. This is irreversible.", {
+    email: z.string().optional().describe("Find contact by email"),
+    nodeId: z.string().optional().describe("Find contact by node ID"),
+}, async ({ email, nodeId }) => {
+    try {
+        const result = await contactDelete({ email, nodeId, accountId });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Contact deleted: ${result.email}`,
+                },
+            ],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `Delete failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+process.on("SIGINT", async () => {
+    await closeDriver();
+    process.exit(0);
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map