@rubytech/create-maxy-code 0.1.118 → 0.1.120

package/payload/server/server.js

@@ -13,6 +13,7 @@ import {
   PLATFORM_ROOT,
   RFB_PORT,
   USERS_FILE,
+  VISITOR_TOKEN_SECRET_FILE,
   VNC_DISPLAY,
   WEBSOCKIFY_PORT,
   autoDeliverPremiumPlugins,
@@ -82,7 +83,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-FJCI6X3H.js";
+} from "./chunk-HCYM5FLU.js";
 import {
   __commonJS,
   __toESM
@@ -587,8 +588,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync19, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve21, join as join14, basename as basename5 } from "path";
+import { readFileSync as readFileSync21, existsSync as existsSync24, watchFile } from "fs";
+import { resolve as resolve21, join as join15, basename as basename5 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -2025,8 +2026,8 @@ import { resolve } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
-  const cached2 = cache.get(accountsDir);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = cache.get(accountsDir);
+  if (cached3 !== void 0) return cached3;
   let names;
   try {
     names = readdirSync(accountsDir);
@@ -2913,8 +2914,8 @@ function watchForDisconnect(conn) {
   });
 }
 async function getGroupMeta(conn, jid) {
-  const cached2 = conn.groupMetaCache.get(jid);
-  if (cached2 && cached2.expires > Date.now()) return cached2;
+  const cached3 = conn.groupMetaCache.get(jid);
+  if (cached3 && cached3.expires > Date.now()) return cached3;
   if (!conn.sock) return null;
   console.error(`${TAG12} group metadata cache miss for ${jid}, fetching from Baileys account=${conn.accountId}`);
   try {
@@ -12174,6 +12175,83 @@ app34.get("/:rel{.*}", (c) => {
 });
 var sites_default = app34;
 
+// app/lib/visitor-token.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5 } from "path";
+var TOKEN_PREFIX = "v1.";
+var SECRET_BYTES = 32;
+var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var cachedSecret = null;
+function getSecret() {
+  if (cachedSecret) return cachedSecret;
+  try {
+    const hex2 = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    if (hex2.length === SECRET_BYTES * 2) {
+      cachedSecret = Buffer.from(hex2, "hex");
+      return cachedSecret;
+    }
+  } catch {
+  }
+  const fresh = randomBytes(SECRET_BYTES).toString("hex");
+  try {
+    mkdirSync4(dirname5(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync7(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
+  } catch {
+  }
+  const hex = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  cachedSecret = Buffer.from(hex, "hex");
+  return cachedSecret;
+}
+function base64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(s) {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function signPayload(payloadJson, secret) {
+  return base64urlEncode(createHmac("sha256", secret).update(payloadJson).digest());
+}
+function verifyVisitorToken(token, now = Date.now()) {
+  if (!token || typeof token !== "string" || !token.startsWith(TOKEN_PREFIX)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const rest = token.slice(TOKEN_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot === -1) return { ok: false, reason: "malformed" };
+  const payloadB64 = rest.slice(0, dot);
+  const sigB64 = rest.slice(dot + 1);
+  if (!payloadB64 || !sigB64) return { ok: false, reason: "malformed" };
+  let payloadJson;
+  try {
+    payloadJson = base64urlDecode(payloadB64).toString("utf-8");
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  const expected = signPayload(payloadJson, getSecret());
+  const expectedBuf = Buffer.from(expected, "utf-8");
+  const provBuf = Buffer.from(sigB64, "utf-8");
+  if (expectedBuf.length !== provBuf.length || !timingSafeEqual(expectedBuf, provBuf)) {
+    return { ok: false, reason: "bad-sig" };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadJson);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!payload || typeof payload !== "object" || typeof payload.p !== "string" || typeof payload.e !== "number") {
+    return { ok: false, reason: "malformed" };
+  }
+  const { p, e } = payload;
+  if (now > e) return { ok: false, reason: "expired" };
+  return { ok: true, personId: p, expiryMs: e };
+}
+var VISITOR_COOKIE_NAME = "mxy_v";
+var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
+
 // server/routes/listings.ts
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
@@ -12182,6 +12260,7 @@ app35.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
+  const tokenParam = c.req.query("v") ?? "";
   if (!SAFE_SLUG_RE.test(slug)) {
     console.error(`[property-card-click] reject reason=bad-slug-shape slug=${JSON.stringify(slug)} status=400`);
     return c.text("Bad Request", 400);
@@ -12218,11 +12297,318 @@ app35.get("/:slug/click", async (c) => {
     console.error(`[property-card-click] reject reason=listing-not-found slug=${slug} sessionKey=${sessionKey} accountId=${account.accountId} status=404`);
     return c.text("Not Found", 404);
   }
+  if (tokenParam) {
+    const verify = verifyVisitorToken(tokenParam);
+    if (verify.ok) {
+      c.header(
+        "Set-Cookie",
+        `${VISITOR_COOKIE_NAME}=${tokenParam}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
+      );
+      console.log(`[token-bind] sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+    } else {
+      console.error(`[token-bind] reject reason=${verify.reason} sessionKey=${sessionKey} listingSlug=${slug}`);
+    }
+  }
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(pageUrl, 302);
 });
 var listings_default = app35;
 
+// app/lib/brand-config.ts
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
+import { join as join14 } from "path";
+var cached2 = null;
+var cachedAttempted = false;
+function readBrandConfig() {
+  if (cachedAttempted) return cached2;
+  cachedAttempted = true;
+  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot) return null;
+  const brandPath = join14(platformRoot, "config", "brand.json");
+  if (!existsSync22(brandPath)) return null;
+  try {
+    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
+    return cached2;
+  } catch {
+    return null;
+  }
+}
+
+// server/routes/visitor-event.ts
+var app36 = new Hono();
+var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
+var buckets = /* @__PURE__ */ new Map();
+var RATE_LIMIT = 60;
+var RATE_WINDOW_MS = 6e4;
+function rateLimit(ip, now = Date.now()) {
+  const b = buckets.get(ip);
+  if (!b || now >= b.resetAt) {
+    buckets.set(ip, { count: 1, resetAt: now + RATE_WINDOW_MS });
+    return { ok: true, resetIn: RATE_WINDOW_MS };
+  }
+  b.count += 1;
+  if (b.count > RATE_LIMIT) return { ok: false, resetIn: b.resetAt - now };
+  return { ok: true, resetIn: b.resetAt - now };
+}
+setInterval(() => {
+  const now = Date.now();
+  for (const [ip, b] of buckets) {
+    if (now >= b.resetAt) buckets.delete(ip);
+  }
+}, 5 * RATE_WINDOW_MS).unref?.();
+var VALID_TYPES = /* @__PURE__ */ new Set(["pageview", "click", "scroll", "dwell"]);
+var ID_RE = /^[A-Za-z0-9_-]{6,128}$/;
+function parseEvent(body) {
+  if (!body || typeof body !== "object") return null;
+  const e = body;
+  if (typeof e.type !== "string" || !VALID_TYPES.has(e.type)) return null;
+  if (typeof e.sid !== "string" || !ID_RE.test(e.sid)) return null;
+  if (typeof e.vid !== "string" || !ID_RE.test(e.vid)) return null;
+  if (typeof e.url !== "string" || e.url.length === 0 || e.url.length > 2048) return null;
+  if (typeof e.ts !== "number" || !Number.isFinite(e.ts)) return null;
+  return e;
+}
+function getCookie(c, name) {
+  const raw = c.req.header("cookie");
+  if (!raw) return null;
+  for (const part of raw.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === name) return rest.join("=");
+  }
+  return null;
+}
+function getOrigin(c) {
+  return c.req.header("origin") ?? c.req.header("referer") ?? "";
+}
+function setCorsHeaders(c, origin) {
+  if (origin) c.header("Access-Control-Allow-Origin", origin);
+  c.header("Access-Control-Allow-Credentials", "true");
+  c.header("Access-Control-Allow-Methods", "POST, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "Content-Type");
+  c.header("Vary", "Origin");
+}
+function originAllowed(origin, allowlist) {
+  if (!allowlist || allowlist.length === 0) return true;
+  if (!origin) return true;
+  try {
+    const u = new URL(origin);
+    const host = u.host;
+    return allowlist.some((entry) => {
+      if (entry === host) return true;
+      if (entry.startsWith("*.")) return host.endsWith(entry.slice(1));
+      return false;
+    });
+  } catch {
+    return false;
+  }
+}
+app36.options("/event", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  return c.body(null, 204);
+});
+app36.post("/event", async (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  const ua = c.req.header("user-agent") ?? "";
+  if (BOT_UA_RE.test(ua)) {
+    console.error(`[v-event-error] reason=bot-ua ua=${JSON.stringify(ua.slice(0, 120))}`);
+    return c.body(null, 204);
+  }
+  const ip = c.req.header("x-forwarded-for")?.split(",")[0].trim() || c.req.header("x-real-ip") || "unknown";
+  const rl = rateLimit(ip);
+  if (!rl.ok) {
+    console.error(`[v-event-error] reason=rate-limit ip=${ip} resetInMs=${rl.resetIn}`);
+    c.header("Retry-After", String(Math.ceil(rl.resetIn / 1e3)));
+    return c.text("Too Many Requests", 429);
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`[v-event-error] reason=no-account ip=${ip}`);
+    return c.text("Not Found", 404);
+  }
+  const brand = readBrandConfig();
+  if (!originAllowed(origin, brand?.publishedSiteOrigins)) {
+    console.error(`[v-event-error] reason=origin-mismatch origin=${JSON.stringify(origin)} ip=${ip}`);
+    return c.text("Forbidden", 403);
+  }
+  let raw;
+  try {
+    raw = await c.req.json();
+  } catch {
+    console.error(`[v-event-error] reason=bad-json ip=${ip}`);
+    return c.text("Bad Request", 400);
+  }
+  const event = parseEvent(raw);
+  if (!event) {
+    console.error(`[v-event-error] reason=bad-event ip=${ip}`);
+    return c.text("Bad Request", 400);
+  }
+  const cookieVal = getCookie(c, VISITOR_COOKIE_NAME);
+  let personId = null;
+  if (cookieVal) {
+    const v = verifyVisitorToken(cookieVal);
+    if (v.ok) {
+      personId = v.personId;
+    } else {
+      console.error(`[token-bind] reject reason=${v.reason} sessionId=${event.sid} via=cookie`);
+    }
+  }
+  const session = getSession();
+  try {
+    await writeEvent({
+      session,
+      accountId: account.accountId,
+      personId,
+      event,
+      origin
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[v-event-error] reason=neo4j sessionId=${event.sid} err=${JSON.stringify(message)}`);
+    await session.close().catch(() => {
+    });
+    return c.text("Service Unavailable", 503);
+  } finally {
+    await session.close().catch(() => {
+    });
+  }
+  console.log(
+    `[visitor-event] type=${event.type} sessionId=${event.sid} visitorId=${event.vid} personId=${personId ?? "-"} path=${event.path ?? ""} label=${event.label ?? "-"} depth=${event.depth ?? "-"} ms=${event.ms ?? "-"}`
+  );
+  return c.body(null, 204);
+});
+async function writeEvent(opts) {
+  const { session, accountId, personId, event } = opts;
+  const occurredAt = new Date(event.ts).toISOString();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  if (event.type === "pageview") {
+    await session.run(
+      `MERGE (s:Session {accountId: $accountId, sessionId: $sid})
+         ON CREATE SET s.startedAt = datetime($occurredAt), s.lastSeenAt = datetime($occurredAt)
+         ON MATCH  SET s.lastSeenAt = datetime($occurredAt)
+       MERGE (pg:Page {accountId: $accountId, url: $url})
+         ON CREATE SET pg.firstSeenAt = datetime($occurredAt), pg.title = $title, pg.site = $site
+         ON MATCH  SET pg.title = $title
+       CREATE (pv:PageView {
+         accountId: $accountId,
+         pageViewId: $pvId,
+         occurredAt: datetime($occurredAt),
+         referrer: $referrer,
+         path: $path,
+         createdAt: datetime($now)
+       })
+       MERGE (s)-[:HAS_EVENT]->(pv)
+       MERGE (pv)-[:OF_PAGE]->(pg)
+       WITH s, pv
+       OPTIONAL MATCH (l:Listing {accountId: $accountId, slug: $site})
+         WHERE l.scope = 'public'
+       FOREACH (_ IN CASE WHEN l IS NULL THEN [] ELSE [1] END |
+         MERGE (pv)-[:OF_LISTING]->(l)
+       )`,
+      {
+        accountId,
+        sid: event.sid,
+        url: event.url,
+        title: event.title ?? "",
+        site: event.site ?? "",
+        pvId: event.pvId ?? `${event.sid}_${event.ts}`,
+        path: event.path ?? "",
+        referrer: event.referrer ?? "",
+        occurredAt,
+        now,
+        personId
+      }
+    );
+  } else if (event.type === "click") {
+    await session.run(
+      `MERGE (s:Session {accountId: $accountId, sessionId: $sid})
+         ON CREATE SET s.startedAt = datetime($occurredAt), s.lastSeenAt = datetime($occurredAt)
+         ON MATCH  SET s.lastSeenAt = datetime($occurredAt)
+       CREATE (cl:Click {
+         accountId: $accountId,
+         label: $label,
+         href: $href,
+         pageViewId: $pvId,
+         occurredAt: datetime($occurredAt)
+       })
+       MERGE (s)-[:HAS_EVENT]->(cl)`,
+      {
+        accountId,
+        sid: event.sid,
+        label: (event.label ?? "unknown").slice(0, 64),
+        href: (event.href ?? "").slice(0, 2048),
+        pvId: event.pvId ?? "",
+        occurredAt
+      }
+    );
+  } else if (event.type === "scroll") {
+    await session.run(
+      `MERGE (s:Session {accountId: $accountId, sessionId: $sid})
+         ON CREATE SET s.startedAt = datetime($occurredAt), s.lastSeenAt = datetime($occurredAt)
+         ON MATCH  SET s.lastSeenAt = datetime($occurredAt)
+       MERGE (sm:ScrollMilestone {accountId: $accountId, sessionId: $sid, pageViewId: $pvId})
+         ON CREATE SET sm.maxDepth = $depth, sm.firstAt = datetime($occurredAt), sm.lastAt = datetime($occurredAt)
+         ON MATCH  SET sm.maxDepth = CASE WHEN sm.maxDepth >= $depth THEN sm.maxDepth ELSE $depth END,
+                       sm.lastAt = datetime($occurredAt)
+       MERGE (s)-[:HAS_EVENT]->(sm)`,
+      { accountId, sid: event.sid, pvId: event.pvId ?? "", depth: event.depth ?? 0, occurredAt }
+    );
+  } else if (event.type === "dwell") {
+    await session.run(
+      `MATCH (s:Session {accountId: $accountId, sessionId: $sid})
+       MATCH (pv:PageView {accountId: $accountId, pageViewId: $pvId})
+       SET pv.dwellMs = coalesce(pv.dwellMs, 0) + $ms,
+           pv.dwellLastAt = datetime($occurredAt)
+       SET s.lastSeenAt = datetime($occurredAt)`,
+      { accountId, sid: event.sid, pvId: event.pvId ?? "", ms: event.ms ?? 0, occurredAt }
+    );
+  }
+  if (personId) {
+    await session.run(
+      `MATCH (p:Person {accountId: $accountId}) WHERE elementId(p) = $personId
+       MATCH (s:Session {accountId: $accountId, sessionId: $sid})
+       MERGE (p)-[:VISITED {accountId: $accountId}]->(s)`,
+      { accountId, personId, sid: event.sid }
+    );
+    const mergeResult = await session.run(
+      `MATCH (p:Person {accountId: $accountId}) WHERE elementId(p) = $personId
+       OPTIONAL MATCH (av:AnonVisitor {accountId: $accountId, visitorId: $vid})
+       WITH p, av
+       WHERE av IS NOT NULL
+       MERGE (p)-[:OWNS_VISITOR {accountId: $accountId}]->(av)
+       WITH p, av
+       OPTIONAL MATCH (av)-[r:VISITED]->(prior:Session)
+       FOREACH (_ IN CASE WHEN prior IS NULL THEN [] ELSE [1] END |
+         MERGE (p)-[:VISITED {accountId: $accountId}]->(prior)
+       )
+       WITH r, prior
+       FOREACH (_ IN CASE WHEN r IS NULL THEN [] ELSE [1] END |
+         DELETE r
+       )
+       RETURN count(prior) AS reattributed`,
+      { accountId, personId, vid: event.vid }
+    );
+    const reattributed = mergeResult.records[0]?.get("reattributed") ?? 0;
+    if (typeof reattributed === "number" ? reattributed > 0 : Number(reattributed) > 0) {
+      console.log(
+        `[anonvisitor-merge] anonVisitorId=${event.vid} person=${personId} sessionsReattributed=${reattributed}`
+      );
+    }
+  } else {
+    await session.run(
+      `MERGE (av:AnonVisitor {accountId: $accountId, visitorId: $vid})
+         ON CREATE SET av.firstSeenAt = datetime($occurredAt), av.lastSeenAt = datetime($occurredAt)
+         ON MATCH  SET av.lastSeenAt = datetime($occurredAt)
+       WITH av
+       MATCH (s:Session {accountId: $accountId, sessionId: $sid})
+       MERGE (av)-[:VISITED {accountId: $accountId}]->(s)`,
+      { accountId, vid: event.vid, sid: event.sid, occurredAt }
+    );
+  }
+}
+var visitor_event_default = app36;
+
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
 var timer = null;
@@ -12365,7 +12751,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash3, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync18, statSync as statSync8 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
 import { resolve as resolve20 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -12414,7 +12800,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve20(brand.configDir, "entitlement.json");
-  if (!existsSync22(entitlementPath)) {
+  if (!existsSync23(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync8(entitlementPath);
@@ -12429,7 +12815,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync18(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -12443,7 +12829,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync18(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -12604,14 +12990,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join14(PLATFORM_ROOT7, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join15(PLATFORM_ROOT7, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync19(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -12630,11 +13016,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join14(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join15(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync19(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -12658,9 +13044,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app36 = new Hono();
-app36.use("*", clientIpMiddleware);
-app36.use("*", async (c, next) => {
+var app37 = new Hono();
+app37.use("*", clientIpMiddleware);
+app37.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -12670,7 +13056,7 @@ app36.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app36.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -12703,7 +13089,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app36.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -12743,7 +13129,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app36.post("/__remote-auth/login", async (c) => {
+app37.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -12788,7 +13174,7 @@ app36.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app36.get("/__remote-auth/logout", (c) => {
+app37.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -12801,7 +13187,7 @@ app36.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app36.post("/__remote-auth/change-password", async (c) => {
+app37.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -12852,13 +13238,13 @@ app36.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app36.get("/__remote-auth/setup", (c) => {
+app37.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app36.post("/__remote-auth/set-initial-password", async (c) => {
+app37.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -12896,10 +13282,10 @@ app36.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app36.get("/api/remote-auth/status", (c) => {
+app37.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app36.post("/api/remote-auth/set-password", async (c) => {
+app37.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12930,9 +13316,9 @@ app36.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app36.route("/api/_client-error", client_error_default);
+app37.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app36.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -12965,11 +13351,11 @@ app36.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app36.route("/api/health", health_default);
-app36.route("/api/chat", chat_default);
-app36.route("/api/whatsapp", whatsapp_default);
-app36.route("/api/onboarding", onboarding_default);
-app36.route("/api/admin", admin_default);
+app37.route("/api/health", health_default);
+app37.route("/api/chat", chat_default);
+app37.route("/api/whatsapp", whatsapp_default);
+app37.route("/api/onboarding", onboarding_default);
+app37.route("/api/admin", admin_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -12981,7 +13367,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app36.get("/agent-assets/:slug/:filename", (c) => {
+app37.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -13003,20 +13389,20 @@ app36.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync19(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app36.get("/generated/:filename", (c) => {
+app37.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13033,27 +13419,28 @@ app36.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync19(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app36.route("/sites", sites_default);
-app36.route("/listings", listings_default);
+app37.route("/sites", sites_default);
+app37.route("/listings", listings_default);
+app37.route("/v", visitor_event_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync19(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -13070,9 +13457,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT7) return "unknown";
-    const versionFile = join14(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync19(versionFile, "utf-8").trim();
+    const versionFile = join15(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync24(versionFile)) return "unknown";
+    const content = readFileSync21(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -13113,7 +13500,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync19(resolve21(process.cwd(), "public", file), "utf-8");
+    html = readFileSync21(resolve21(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -13129,26 +13516,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join14(homedir4(), BRAND.configDir);
+  const configDir2 = join15(homedir4(), BRAND.configDir);
   try {
-    const accountJsonPath = join14(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
+    const accountJsonPath = join15(configDir2, "account.json");
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync19(cachePath, "utf-8"));
+    const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync24(cachePath)) return null;
+    return JSON.parse(readFileSync21(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join14(homedir4(), BRAND.configDir);
-    const accountJsonPath = join14(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
+    const configDir2 = join15(homedir4(), BRAND.configDir);
+    const accountJsonPath = join15(configDir2, "account.json");
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -13157,11 +13544,11 @@ function resolveDefaultSlug() {
 function brandedPublicHtml(agentSlug) {
   const baseHtml = cachedHtml("public.html");
   if (!agentSlug) return baseHtml;
-  const cached2 = brandedHtmlCache.get(agentSlug);
+  const cached3 = brandedHtmlCache.get(agentSlug);
   const branding = loadBrandingCache(agentSlug);
   if (!branding) return baseHtml;
   const brandHash = JSON.stringify(branding).length;
-  if (cached2 && cached2.mtime === brandHash) return cached2.html;
+  if (cached3 && cached3.mtime === brandHash) return cached3.html;
   const title = escapeHtml(branding.name);
   const description = branding.tagline ? escapeHtml(branding.tagline) : "";
   const themeColor = branding.primaryColor || "";
@@ -13184,7 +13571,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app36.get("/", (c) => {
+app37.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13192,12 +13579,12 @@ app36.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app36.get("/public", (c) => {
+app37.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app36.get("/chat", (c) => {
+app37.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13216,12 +13603,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app36.use("/vnc-viewer.html", logViewerFetch);
-app36.use("/vnc-popout.html", logViewerFetch);
-app36.get("/vnc-popout.html", (c) => {
+app37.use("/vnc-viewer.html", logViewerFetch);
+app37.use("/vnc-popout.html", logViewerFetch);
+app37.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync19(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync21(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -13231,7 +13618,7 @@ app36.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app36.post("/api/vnc/client-event", async (c) => {
+app37.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13252,25 +13639,25 @@ app36.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app36.get("/g/:slug", (c) => {
+app37.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app36.get("/graph", (c) => {
+app37.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app36.get("/sessions", (c) => {
+app37.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app36.get("/data", (c) => {
+app37.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app36.get("/:slug", async (c, next) => {
+app37.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13280,15 +13667,15 @@ app36.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app36.get("/favicon.ico", (c) => {
+  app37.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app36.use("/*", serveStatic({ root: "./public" }));
+app37.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app36.fetch, port, hostname });
+var httpServer = serve({ fetch: app37.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13313,7 +13700,8 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
-  { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default }
+  { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
+  { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default }
 ];
 for (const m of SUBAPP_MANIFEST) {
   const routeCount = Array.isArray(m.subapp.routes) ? m.subapp.routes.length : 0;
@@ -13321,7 +13709,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app36.routes ?? []) {
+  for (const r of app37.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -13343,8 +13731,8 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync23(USERS_FILE)) return;
-    const usersRaw = readFileSync19(USERS_FILE, "utf-8").trim();
+    if (!existsSync24(USERS_FILE)) return;
+    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -13436,7 +13824,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve21(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
+  platformRoot: resolve21(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {