npm - @rubytech/create-maxy-code - Versions diffs - 0.1.118 → 0.1.120 - Mend

@rubytech/create-maxy-code 0.1.118 → 0.1.120

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (52) hide show

package/payload/server/{chunk-FJCI6X3H.js → chunk-HCYM5FLU.js} RENAMED Viewed

@@ -2705,6 +2705,7 @@ var REMOTE_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "remote-sessio
 var ADMIN_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "admin-session-secret");
 var TELEGRAM_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-webhook-secret");
 var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-admin-webhook-secret");
+var VISITOR_TOKEN_SECRET_FILE = resolve(MAXY_DIR, "credentials", "visitor-token-secret");
 var CLAUDE_CREDENTIALS_FILE = resolve(MAXY_DIR, ".claude", ".credentials.json");
 // app/lib/vnc-logger.ts
@@ -5476,6 +5477,7 @@ export {
   USERS_FILE,
   LOG_DIR,
   BIN_DIR,
+  VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
   vncLog,
   newCorrId,

package/payload/server/maxy-edge.js CHANGED Viewed

@@ -13,7 +13,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-FJCI6X3H.js";
+} from "./chunk-HCYM5FLU.js";
 import "./chunk-JSBRDJBE.js";
 // server/edge.ts

package/payload/server/public/privacy.html ADDED Viewed

@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Privacy</title>
+<style>
+  :root { --fg:#222; --bg:#FAFAF8; --muted:#666; --accent:#7C8C72; }
+  * { box-sizing: border-box; }
+  body { font: 16px/1.55 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; color: var(--fg); background: var(--bg); }
+  main { max-width: 720px; margin: 0 auto; padding: 48px 24px 96px; }
+  h1 { margin-top: 0; font-size: 32px; letter-spacing: -0.01em; }
+  h2 { margin-top: 36px; font-size: 20px; }
+  p, li { color: #333; }
+  ul { padding-left: 20px; }
+  code { background: #eee; padding: 1px 5px; border-radius: 3px; font-size: 13px; }
+  table { border-collapse: collapse; width: 100%; margin: 12px 0; }
+  th, td { border-bottom: 1px solid #ddd; padding: 8px 6px; text-align: left; vertical-align: top; }
+  th { background: #f0f0ee; font-weight: 600; }
+  .muted { color: var(--muted); font-size: 14px; }
+  .accent { color: var(--accent); }
+</style>
+</head>
+<body>
+<main>
+  <h1>Privacy</h1>
+  <p>This page describes the data this site collects about your visit, why, and how to ask for it to be removed.</p>
+  <h2>What we collect</h2>
+  <p>When you load a property listing page, a small first-party script (<code>/v.js</code>) records:</p>
+  <table>
+    <thead><tr><th>Field</th><th>Why</th><th>Stored as</th></tr></thead>
+    <tbody>
+      <tr><td>Page URL, page title, referrer</td><td>So we know which listings get visitors and where they came from.</td><td><code>:PageView</code> node</td></tr>
+      <tr><td>Visitor ID (random, browser-local)</td><td>So we can tell two visits from one device apart from two devices.</td><td><code>:AnonVisitor</code> node (anonymous), or linked to a <code>:Person</code> if you arrived via a personalised marketing link.</td></tr>
+      <tr><td>Session ID (random, per tab)</td><td>So one tab's activity stays together.</td><td><code>:Session</code> node</td></tr>
+      <tr><td>Clicks on tagged elements (gallery, floorplan, etc.)</td><td>So we know which parts of a listing get interaction.</td><td><code>:Click</code> node</td></tr>
+      <tr><td>Scroll depth — 25%, 50%, 75%, 100%</td><td>So we know how far you read.</td><td><code>:ScrollMilestone</code> node (one per page view, max depth recorded)</td></tr>
+      <tr><td>Time spent on a page (dwell)</td><td>Same.</td><td>Property of the <code>:PageView</code> node</td></tr>
+    </tbody>
+  </table>
+  <p class="muted">We do not collect: cursor positions, keystrokes, form contents, screen recordings, or anything from third-party tracking networks. The pixel is loaded from the same site as the listing, never from a third party.</p>
+  <h2>Cookies</h2>
+  <p>One cookie is set when you arrive via a personalised marketing link from the agent:</p>
+  <ul>
+    <li><code>mxy_v</code> — signed token containing your contact identifier. Set <code>HttpOnly</code>, <code>SameSite=Lax</code>, <code>Secure</code>. Lives for 30 days. Lets the site recognise you on later visits without you clicking the marketing link again.</li>
+  </ul>
+  <h2>Cross-session attribution</h2>
+  <p>If you visit anonymously today and later click a personalised marketing link from the agent, prior anonymous visits from the same browser are linked to your contact record. This is the only way an anonymous visit ever becomes named.</p>
+  <h2>Retention</h2>
+  <p>Visit data is kept for <strong>180 days</strong> by default, then removed automatically. The operator can change this — your acting agent will tell you the current value if you ask.</p>
+  <h2>Right to access and erasure</h2>
+  <p>To see what we hold or to ask for it to be removed, contact the agent. We honour GDPR Article 15 (access) and Article 17 (erasure). Erasure cascades: removing your contact removes every session, page view, click, and scroll milestone tied to your identity. Anonymous page views from browsers we cannot link to you are not removed individually — they cannot be identified, and they expire under the retention window above.</p>
+  <h2>Bots and crawlers</h2>
+  <p>Search engines and link checkers are filtered out by user-agent before any data is written. They are also excluded from rate-limit budgets so legitimate visitors are never blocked because a crawler hammered the endpoint.</p>
+  <h2>This page</h2>
+  <p class="muted">This is a static description. The behaviour above is implemented in <code>platform/ui/server/routes/visitor-event.ts</code> and <code>platform/ui/public/v.js</code>. The schema is declared in <code>platform/neo4j/schema.cypher</code> under the Visitor Graph section.</p>
+</main>
+</body>
+</html>

package/payload/server/public/v.js ADDED Viewed

@@ -0,0 +1,191 @@
+/* Visitor-graph pixel (Task 357).
+ *
+ * Single IIFE. Plain JS. No build step. ~3 KB minified.
+ *
+ * Loaded by hosted listing pages:
+ *
+ *   <script defer src="https://<brand>/v.js" data-site="<slug>"></script>
+ *
+ * Emits to POST /v/event:
+ *
+ *   pageview  — once per session per URL (idempotent within 5s for SPA nav)
+ *   click     — DOM clicks on elements with data-track="<label>", or
+ *               anchors flagged data-track-gallery / data-track-floorplan
+ *   scroll    — roll-up: one event per milestone {25,50,75,100} crossed
+ *   dwell     — on visibility change to hidden / pagehide, sendBeacon
+ *
+ * Identity: the server resolves identity from the mxy_v cookie. The pixel
+ * sends visitorId from localStorage (mints one if absent) as a fallback so
+ * cross-tab and same-browser-no-cookie cases still cluster.
+ */
+(function () {
+  if (typeof window === 'undefined' || typeof document === 'undefined') return
+  var script = document.currentScript
+  if (!script) return
+  var siteSlug = script.getAttribute('data-site') || ''
+  var endpoint = new URL('/v/event', script.src).toString()
+  var VISITOR_KEY = 'mxy_visitor_id'
+  var SESSION_KEY = 'mxy_session_id'
+  var SESSION_PV_KEY = 'mxy_session_pv'
+  var LAST_PV_KEY = 'mxy_last_pv'
+  var SCROLL_KEY = 'mxy_scroll_depth'
+  var DWELL_KEY = 'mxy_dwell_start'
+  function randomId() {
+    if (window.crypto && window.crypto.getRandomValues) {
+      var buf = new Uint8Array(16)
+      window.crypto.getRandomValues(buf)
+      return Array.prototype.map.call(buf, function (b) {
+        return ('0' + b.toString(16)).slice(-2)
+      }).join('')
+    }
+    return String(Date.now()) + '_' + Math.random().toString(36).slice(2, 10)
+  }
+  function getVisitorId() {
+    try {
+      var v = localStorage.getItem(VISITOR_KEY)
+      if (v) return v
+      var fresh = randomId()
+      localStorage.setItem(VISITOR_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'noltc-' + randomId()
+    }
+  }
+  function getSessionId() {
+    try {
+      var s = sessionStorage.getItem(SESSION_KEY)
+      if (s) return s
+      var fresh = randomId()
+      sessionStorage.setItem(SESSION_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'nots-' + randomId()
+    }
+  }
+  var visitorId = getVisitorId()
+  var sessionId = getSessionId()
+  function send(payload) {
+    payload.site = siteSlug
+    payload.vid = visitorId
+    payload.sid = sessionId
+    payload.url = location.href
+    payload.path = location.pathname
+    payload.title = (document.title || '').slice(0, 256)
+    payload.ts = Date.now()
+    try {
+      var body = JSON.stringify(payload)
+      if (navigator.sendBeacon) {
+        var blob = new Blob([body], { type: 'application/json' })
+        if (navigator.sendBeacon(endpoint, blob)) return
+      }
+      fetch(endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: body,
+        credentials: 'include',
+        keepalive: true,
+      }).catch(function () { /* fire-and-forget */ })
+    } catch (_e) {
+      /* silently drop — pixel must never break the page */
+    }
+  }
+  // ─────────── pageview (idempotent within 5s for SPA nav) ───────────
+  function emitPageview() {
+    try {
+      var last = sessionStorage.getItem(LAST_PV_KEY)
+      if (last) {
+        var parsed = JSON.parse(last)
+        if (parsed && parsed.url === location.href && Date.now() - parsed.ts < 5000) {
+          return
+        }
+      }
+      sessionStorage.setItem(LAST_PV_KEY, JSON.stringify({ url: location.href, ts: Date.now() }))
+      sessionStorage.setItem(SESSION_PV_KEY, randomId()) // PageView id for milestone roll-up
+      sessionStorage.setItem(SCROLL_KEY, '0')
+    } catch (_e) { /* localStorage / sessionStorage disabled */ }
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'pageview',
+      pvId: pvId,
+      referrer: document.referrer || '',
+    })
+  }
+  // ─────────── click tracking ───────────
+  document.addEventListener('click', function (ev) {
+    var el = ev.target && (ev.target.closest ? ev.target.closest('[data-track]') : null)
+    if (!el) return
+    var label = el.getAttribute('data-track') || 'unknown'
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'click',
+      label: label.slice(0, 64),
+      pvId: pvId,
+      href: el.getAttribute('href') || '',
+    })
+  }, true)
+  // ─────────── scroll milestones (roll-up) ───────────
+  var scrollScheduled = false
+  function onScroll() {
+    if (scrollScheduled) return
+    scrollScheduled = true
+    requestAnimationFrame(function () {
+      scrollScheduled = false
+      var doc = document.documentElement
+      var max = Math.max(doc.scrollHeight, document.body.scrollHeight) - window.innerHeight
+      if (max <= 0) return
+      var pct = Math.floor(((window.scrollY || doc.scrollTop) / max) * 100)
+      var threshold = pct >= 100 ? 100 : pct >= 75 ? 75 : pct >= 50 ? 50 : pct >= 25 ? 25 : 0
+      if (threshold === 0) return
+      try {
+        var prev = parseInt(sessionStorage.getItem(SCROLL_KEY) || '0', 10) || 0
+        if (threshold <= prev) return
+        sessionStorage.setItem(SCROLL_KEY, String(threshold))
+      } catch (_e) {}
+      var pvId = ''
+      try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+      send({ type: 'scroll', depth: threshold, pvId: pvId })
+    })
+  }
+  window.addEventListener('scroll', onScroll, { passive: true })
+  // ─────────── dwell on unload / visibility change ───────────
+  try { sessionStorage.setItem(DWELL_KEY, String(Date.now())) } catch (_e) {}
+  function emitDwell() {
+    var start = 0
+    try { start = parseInt(sessionStorage.getItem(DWELL_KEY) || '0', 10) || 0 } catch (_e) {}
+    if (!start) return
+    var ms = Date.now() - start
+    if (ms < 250) return // ignore drive-bys
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({ type: 'dwell', ms: ms, pvId: pvId })
+  }
+  document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'hidden') emitDwell()
+  })
+  window.addEventListener('pagehide', emitDwell)
+  // SPA navigation hooks — many listing sites are client-routed.
+  var origPushState = history.pushState
+  history.pushState = function () {
+    var r = origPushState.apply(this, arguments)
+    setTimeout(emitPageview, 0)
+    return r
+  }
+  window.addEventListener('popstate', emitPageview)
+  // Boot.
+  emitPageview()
+})()