@rubytech/create-maxy-code 0.1.119 → 0.1.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.119",
+  "version": "0.1.121",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -355,7 +355,7 @@ FOR (n:LocalBusiness|Service|PriceSpecification|OpeningHoursSpecification|Organi
     |Task|Project|Event
     |Workflow|WorkflowStep|WorkflowRun|StepResult
     |Email|EmailAccount
-    |Position|Credential|Agent)
+    |Position|Credential|Agent|Idea)
 ON EACH [n.name, n.firstName, n.lastName, n.givenName, n.familyName,
          n.title, n.currentTitle, n.summary, n.body, n.content, n.text, n.description, n.headline, n.abstract,
          n.email, n.note, n.label, n.value, n.message, n.preview, n.tagline,
@@ -1204,3 +1204,94 @@ FOR (a:AEOAudit) ON (a.target);
 
 CREATE INDEX aeo_audit_run_at IF NOT EXISTS
 FOR (a:AEOAudit) ON (a.runAt);
+
+// ----------------------------------------------------------
+// Visitor graph (Task 357)
+//
+// Pixel emits pageview/click/scroll/dwell to POST /v/event. Events land
+// under :Session, attributed to :Person (via signed-token cookie) or
+// :AnonVisitor (cookie-less). When a previously anonymous browser
+// completes its first signed-token click, the AnonVisitor merges into
+// the Person and prior :Session edges reattribute. Schema-org-ish:
+// Session/PageView/Click are bespoke (no schema.org coverage of analytics);
+// Page is `schema:WebPage`-shaped (url, name).
+//
+// Multi-tenancy: every node carries accountId. Uniqueness constraints
+// are composite (accountId, idKey) — sessionId/visitorId/url collisions
+// across accounts are valid.
+//
+// Cascade: contact-erase on :Person trashes (:Session)-[:HAS_EVENT]->(*)
+// the same way profile-delete cascades preferences. :Page and :Listing
+// are content metadata and intentionally survive (no PII).
+// ----------------------------------------------------------
+
+CREATE CONSTRAINT session_id_unique IF NOT EXISTS
+FOR (s:Session) REQUIRE (s.accountId, s.sessionId) IS UNIQUE;
+
+CREATE INDEX session_account IF NOT EXISTS
+FOR (s:Session) ON (s.accountId);
+
+CREATE INDEX session_started_at IF NOT EXISTS
+FOR (s:Session) ON (s.startedAt);
+
+CREATE CONSTRAINT anon_visitor_id_unique IF NOT EXISTS
+FOR (av:AnonVisitor) REQUIRE (av.accountId, av.visitorId) IS UNIQUE;
+
+CREATE INDEX anon_visitor_account IF NOT EXISTS
+FOR (av:AnonVisitor) ON (av.accountId);
+
+CREATE CONSTRAINT page_url_unique IF NOT EXISTS
+FOR (pg:Page) REQUIRE (pg.accountId, pg.url) IS UNIQUE;
+
+CREATE INDEX page_account IF NOT EXISTS
+FOR (pg:Page) ON (pg.accountId);
+
+// PageView/Click/ScrollMilestone/Recommendation: no uniqueness, just
+// accountId index. ScrollMilestone is a roll-up (one per PageView,
+// updated in place) so a uniqueness constraint on (sessionId, pageViewId)
+// would also work — left as index until a write pattern needs it.
+CREATE INDEX pageview_account IF NOT EXISTS
+FOR (pv:PageView) ON (pv.accountId);
+
+CREATE INDEX pageview_occurred_at IF NOT EXISTS
+FOR (pv:PageView) ON (pv.occurredAt);
+
+CREATE INDEX click_account IF NOT EXISTS
+FOR (cl:Click) ON (cl.accountId);
+
+CREATE INDEX click_occurred_at IF NOT EXISTS
+FOR (cl:Click) ON (cl.occurredAt);
+
+CREATE INDEX scroll_milestone_account IF NOT EXISTS
+FOR (sm:ScrollMilestone) ON (sm.accountId);
+
+CREATE INDEX recommendation_account IF NOT EXISTS
+FOR (rec:Recommendation) ON (rec.accountId);
+
+CREATE INDEX recommendation_session_key IF NOT EXISTS
+FOR (rec:Recommendation) ON (rec.sessionKey);
+
+// ----------------------------------------------------------
+// Idea (Task 352) — original-thinking candidates extracted by
+// the signal-detector specialist from admin-side conversations.
+// Written via memory-write(labels:["Idea"], ...) with one edge
+// (:Conversation)-[:HAS_IDEA]->(:Idea). Forward-only write surface:
+// no historical backfill, no dedup, no clustering — let the brain
+// accumulate first. Declared here so memory-write's label validator
+// (db.labels() ∪ schema.cypher) registers the label on a fresh
+// deploy where no :Idea node has yet landed; without this, the
+// first write is rejected as "unknown label" and the specialist's
+// LOUD-FAIL surfaces the rejection without anything landing.
+// ----------------------------------------------------------
+
+CREATE INDEX idea_account IF NOT EXISTS
+FOR (i:Idea) ON (i.accountId);
+
+CREATE VECTOR INDEX idea_embedding IF NOT EXISTS
+FOR (i:Idea) ON (i.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-erase.d.ts

@@ -6,7 +6,12 @@
  *   2. Conversations left empty after message removal
  *   3. Emails matching the contact's email (fromAddress or toAddresses)
  *   4. AccessGrants via (Person)-[:HAS_ACCESS]->(AccessGrant)
- *   5. Person node itself (DETACH DELETE)
+ *   5. Visitor-graph data (Task 357):
+ *      - :Session reachable via (Person)-[:VISITED]->(Session)
+ *      - all :HAS_EVENT children (PageView/Click/ScrollMilestone)
+ *      - :AnonVisitor via (Person)-[:OWNS_VISITOR]->(AnonVisitor)
+ *      :Page and :Listing are content metadata and are intentionally preserved.
+ *   6. Person node itself (DETACH DELETE)
  *
  * Requires `confirm: true` to execute. Without it, returns a preview
  * of what would be deleted (counts per node type) but does not delete.
@@ -33,6 +38,12 @@ interface EraseCounts {
     conversations: number;
     emails: number;
     accessGrants: number;
+    /** Visitor-graph Sessions removed (Task 357). */
+    visitorSessions: number;
+    /** Visitor-graph event nodes removed (PageView + Click + ScrollMilestone). */
+    visitorEvents: number;
+    /** AnonVisitor nodes owned by this Person and removed. */
+    anonVisitors: number;
     person: number;
 }
 export type ContactEraseResult = ErasePreview | EraseReceipt;

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-erase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contact-erase.d.ts","sourceRoot":"","sources":["../../src/tools/contact-erase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,UAAU,kBAAkB;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,YAAY,CAAC;AAE7D,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAsL7B"}
+{"version":3,"file":"contact-erase.d.ts","sourceRoot":"","sources":["../../src/tools/contact-erase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,UAAU,kBAAkB;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,YAAY,CAAC;AAE7D,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CA6N7B"}

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-erase.js

@@ -6,7 +6,12 @@
  *   2. Conversations left empty after message removal
  *   3. Emails matching the contact's email (fromAddress or toAddresses)
  *   4. AccessGrants via (Person)-[:HAS_ACCESS]->(AccessGrant)
- *   5. Person node itself (DETACH DELETE)
+ *   5. Visitor-graph data (Task 357):
+ *      - :Session reachable via (Person)-[:VISITED]->(Session)
+ *      - all :HAS_EVENT children (PageView/Click/ScrollMilestone)
+ *      - :AnonVisitor via (Person)-[:OWNS_VISITOR]->(AnonVisitor)
+ *      :Page and :Listing are content metadata and are intentionally preserved.
+ *   6. Person node itself (DETACH DELETE)
  *
  * Requires `confirm: true` to execute. Without it, returns a preview
  * of what would be deleted (counts per node type) but does not delete.
@@ -45,8 +50,27 @@ export async function contactErase(params) {
             conversations: 0,
             emails: 0,
             accessGrants: 0,
+            visitorSessions: 0,
+            visitorEvents: 0,
+            anonVisitors: 0,
             person: 1,
         };
+        // Count visitor-graph data — Sessions, events, AnonVisitors (Task 357)
+        {
+            const visitorCounts = await session.run(`MATCH (p:Person) WHERE elementId(p) = $personNodeId
+         OPTIONAL MATCH (p)-[:VISITED]->(vs:Session)
+         OPTIONAL MATCH (vs)-[:HAS_EVENT]->(ev)
+         OPTIONAL MATCH (p)-[:OWNS_VISITOR]->(av:AnonVisitor)
+         RETURN count(DISTINCT vs) AS visitorSessions,
+                count(DISTINCT ev) AS visitorEvents,
+                count(DISTINCT av) AS anonVisitors`, { personNodeId });
+            if (visitorCounts.records.length > 0) {
+                const row = visitorCounts.records[0];
+                counts.visitorSessions = Number(row.get("visitorSessions")?.valueOf?.() ?? row.get("visitorSessions") ?? 0);
+                counts.visitorEvents = Number(row.get("visitorEvents")?.valueOf?.() ?? row.get("visitorEvents") ?? 0);
+                counts.anonVisitors = Number(row.get("anonVisitors")?.valueOf?.() ?? row.get("anonVisitors") ?? 0);
+            }
+        }
         // Count Messages + Conversations via sessionId
         if (sessionId) {
             const convCountResult = await session.run(`MATCH (c:Conversation {conversationId: $sessionId, accountId: $accountId})
@@ -107,6 +131,15 @@ export async function contactErase(params) {
             await tx.run(`MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant)
          WHERE elementId(p) = $personNodeId
          DELETE g`, { personNodeId });
+            // 3d-bis. Visitor-graph cascade (Task 357). :Page and :Listing are
+            // content metadata and intentionally preserved — they have no PII.
+            await tx.run(`MATCH (p:Person) WHERE elementId(p) = $personNodeId
+         OPTIONAL MATCH (p)-[:VISITED]->(vs:Session)
+         OPTIONAL MATCH (vs)-[:HAS_EVENT]->(ev)
+         DETACH DELETE ev, vs`, { personNodeId });
+            await tx.run(`MATCH (p:Person)-[:OWNS_VISITOR]->(av:AnonVisitor)
+         WHERE elementId(p) = $personNodeId
+         DETACH DELETE av`, { personNodeId });
             // 3e. Delete Person node (DETACH DELETE to remove any remaining relationships)
             await tx.run(`MATCH (p:Person) WHERE elementId(p) = $personNodeId
          DETACH DELETE p`, { personNodeId });

package/payload/platform/plugins/contacts/mcp/dist/tools/contact-erase.js.map

@@ -1 +1 @@
-{"version":3,"file":"contact-erase.js","sourceRoot":"","sources":["../../src/tools/contact-erase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAgC9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACrD,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAC5B,SAAS,EACT,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IAEF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,GAAG,WAAW;;mEAE+C,EAC7D,WAAW,CACZ,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,WAAW;gBACnB,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAW,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAkB,CAAC;QAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAkB,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAkB,CAAC;QAC3D,MAAM,UAAU,GAAG,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,SAAS,CAAC;QAErE,sCAAsC;QACtC,MAAM,MAAM,GAAgB;YAC1B,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;SACV,CAAC;QAEF,+CAA+C;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CACvC;;qEAE6D,EAC7D,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;YACF,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,aAAa,GAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjG,MAAM,CAAC,QAAQ,GAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC;;uCAE+B,EAC/B,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CAAC;YACF,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,MAAM,GAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC;;qCAE+B,EAC/B,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,YAAY,GAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,SAAS;gBACjB,UAAU;gBACV,SAAS,EAAE,KAAK;gBAChB,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YAEF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,2DAA2D;QAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,kDAAkD;YAClD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,GAAG,CACV;2BACiB,EACjB,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;gBAEF,qCAAqC;gBACrC,MAAM,EAAE,CAAC,GAAG,CACV;;2BAEiB,EACjB,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;YACJ,CAAC;YAED,iDAAiD;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,EAAE,CAAC,GAAG,CACV;;2BAEiB,EACjB,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CAAC;YACJ,CAAC;YAED,2CAA2C;YAC3C,MAAM,EAAE,CAAC,GAAG,CACV;;kBAEU,EACV,EAAE,YAAY,EAAE,CACjB,CAAC;YAEF,+EAA+E;YAC/E,MAAM,EAAE,CAAC,GAAG,CACV;yBACiB,EACjB,EAAE,YAAY,EAAE,CACjB,CAAC;YAEF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,OAAO;gBACf,UAAU;gBACV,SAAS,EAAE,IAAI;gBACf,MAAM;gBACN,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,SAAS,EAAE,IAAI;YACf,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"contact-erase.js","sourceRoot":"","sources":["../../src/tools/contact-erase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAsC9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACrD,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAC5B,SAAS,EACT,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IAEF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,GAAG,WAAW;;mEAE+C,EAC7D,WAAW,CACZ,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,IAAI,SAAS,IAAI,MAAM,IAAI,SAAS,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,WAAW;gBACnB,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAW,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAkB,CAAC;QAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAkB,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAkB,CAAC;QAC3D,MAAM,UAAU,GAAG,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,SAAS,CAAC;QAErE,sCAAsC;QACtC,MAAM,MAAM,GAAgB;YAC1B,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;YACf,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,CAAC;SACV,CAAC;QAEF,uEAAuE;QACvE,CAAC;YACC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC;;;;;;mDAM2C,EAC3C,EAAE,YAAY,EAAE,CACjB,CAAC;YACF,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,eAAe,GAAG,MAAM,CAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAA+B,EAAE,OAAO,EAAE,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3I,MAAM,CAAC,aAAa,GAAG,MAAM,CAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAA+B,EAAE,OAAO,EAAE,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAA+B,EAAE,OAAO,EAAE,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACpI,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CACvC;;qEAE6D,EAC7D,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;YACF,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,aAAa,GAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjG,MAAM,CAAC,QAAQ,GAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC;;uCAE+B,EAC/B,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CAAC;YACF,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,MAAM,GAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC;;qCAE+B,EAC/B,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,YAAY,GAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,SAAS;gBACjB,UAAU;gBACV,SAAS,EAAE,KAAK;gBAChB,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YAEF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,2DAA2D;QAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAEtC,IAAI,CAAC;YACH,kDAAkD;YAClD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,GAAG,CACV;2BACiB,EACjB,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;gBAEF,qCAAqC;gBACrC,MAAM,EAAE,CAAC,GAAG,CACV;;2BAEiB,EACjB,EAAE,SAAS,EAAE,SAAS,EAAE,CACzB,CAAC;YACJ,CAAC;YAED,iDAAiD;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,EAAE,CAAC,GAAG,CACV;;2BAEiB,EACjB,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CAAC;YACJ,CAAC;YAED,2CAA2C;YAC3C,MAAM,EAAE,CAAC,GAAG,CACV;;kBAEU,EACV,EAAE,YAAY,EAAE,CACjB,CAAC;YAEF,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,EAAE,CAAC,GAAG,CACV;;;8BAGsB,EACtB,EAAE,YAAY,EAAE,CACjB,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CACV;;0BAEkB,EAClB,EAAE,YAAY,EAAE,CACjB,CAAC;YAEF,+EAA+E;YAC/E,MAAM,EAAE,CAAC,GAAG,CACV;yBACiB,EACjB,EAAE,YAAY,EAAE,CACjB,CAAC;YAEF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,OAAO;gBACf,UAAU;gBACV,SAAS,EAAE,IAAI;gBACf,MAAM;gBACN,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aAChC,CAAC,CACH,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,SAAS,EAAE,IAAI;YACf,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/docs/references/visitor-graph.md

@@ -0,0 +1,82 @@
+# Visitor graph (Task 357)
+
+Behavioural analytics that connect anonymous page visits to known `:Person` contacts. Replaces the anonymous click-through metric from Task 336 with a fully attributed graph.
+
+## What this gives the operator
+
+- A morning briefing surface: "who has been on the site overnight, and what did they look at?"
+- An engagement-ranked nurture queue, ordered by recency × depth × dwell.
+- A graph-backed click-through-rate report for property recommendations.
+- A full event timeline for any one session, for prep and diagnosis.
+- A signed-cookie that recognises a named visitor on later visits without re-clicking the marketing link.
+
+## Data model
+
+| Node | Meaning |
+|------|---------|
+| `:Session` | One browser tab session. Composite key `(accountId, sessionId)`. |
+| `:AnonVisitor` | Pre-identification browser identity. Merges into `:Person` on first signed-token click. |
+| `:PageView` | One page load. Carries `referrer`, `path`, optional `dwellMs`. |
+| `:Click` | One DOM click on a tagged element (`data-track="<label>"`). |
+| `:ScrollMilestone` | Roll-up of scroll depth — one node per `:PageView`, `maxDepth` ∈ {25,50,75,100}. |
+| `:Page` | URL metadata. Content-only, survives erasure. |
+| `:Recommendation` | Materialised `[property-recommended]` log line for CTR computation. |
+
+| Edge | Direction |
+|------|-----------|
+| `VISITED` | `Person → Session` or `AnonVisitor → Session` |
+| `OWNS_VISITOR` | `Person → AnonVisitor` (cross-session merge) |
+| `HAS_EVENT` | `Session → PageView / Click / ScrollMilestone` |
+| `OF_PAGE` | `PageView → Page` |
+| `OF_LISTING` | `PageView → Listing` |
+| `FOR_SESSION` | `Recommendation → Session` |
+
+## How identity gets resolved
+
+The signed-token cookie `mxy_v` carries a `:Person` elementId, signed HMAC-SHA256 with a brand-local 32-byte secret (file at `~/.<brand>/credentials/visitor-token-secret`, minted on first read). When the recommender's `/listings/<slug>/click?session=<sk>&v=<token>` URL is visited:
+
+1. The click handler verifies the HMAC on `<token>`.
+2. If valid, the same token value is written into `mxy_v` (Max-Age 30 days, SameSite=Lax, HttpOnly, Secure).
+3. On subsequent visits, `POST /v/event` reads the cookie, verifies it, and attributes every event to the bound `:Person`.
+
+When a previously-anonymous browser binds for the first time, any `:Session` already attributed to the `:AnonVisitor` is re-attached to the `:Person`, and the merge fires `[anonvisitor-merge]` with the count of reattributed sessions.
+
+## Tools
+
+All under the `real-agent-buyers` plugin, admin-side only:
+
+| Tool | Purpose |
+|------|---------|
+| `visitor-recent-by-person` | Recent sessions for a known `:Person` (morning round, 1:1 prep). |
+| `visitor-recent-by-page` | Recent visitors of a given listing slug or URL. |
+| `visitor-engagement-score` | Engagement-ranked `:Person` list (nurture queue). |
+| `visitor-recommendation-ctr` | Graph-backed CTR over a window. Replaces the Task 336 log-scan after the 14-day parity cutover. |
+| `visitor-session-detail` | Full event timeline for one `:Session`. |
+| `visitor-event-ingest` | Admin companion to `POST /v/event` for test harness work. |
+| `visitor-backfill-from-logs` | One-shot importer: parses `[property-recommended]` and `[property-card-click]` log lines, computes a parity check, populates the graph. |
+
+## Privacy
+
+The full description is at `/privacy` on every brand domain. Highlights:
+
+- First-party cookie only, no third-party scripts.
+- 180-day default retention; configurable per brand via `brand.json:visitorGraphRetentionDays`.
+- Right-to-erasure cascades through `contact-erase`: `:Session`, every `:HAS_EVENT` child, and any owned `:AnonVisitor` are removed when the `:Person` is erased. `:Page` and `:Listing` are content metadata and intentionally preserved.
+
+## Verification
+
+Quick checks the operator can run after deployment:
+
+1. Load a published listing page; grep `[visitor-event] type=pageview` in `server.log` within 1s.
+2. Scroll past 50%; grep `[visitor-event] type=scroll depth=50`.
+3. Click an element marked `data-track="floorplan"`; grep `[visitor-event] type=click label=floorplan`.
+4. Run `visitor-backfill-from-logs` over the existing Task 336 log window; the response includes `parityCheck=ok` when graph CTR matches log-scan CTR exactly.
+
+## Failure signals
+
+| Symptom | What it means | Where to look |
+|---------|---------------|---------------|
+| `[visitor-event]` count drops to zero with no `[v-event-error]` | Pixel silently failing on the brand domain (probably CSP, CORS, or origin mismatch). | Check brand.json `publishedSiteOrigins`; check browser console on a published listing page. |
+| `[token-bind] reject reason=bad-sig` spikes | HMAC verify failing — either the secret rotated and old cookies are being rejected (expected during rotation) or the recommender is minting against a stale secret. | Compare `~/.<brand>/credentials/visitor-token-secret` across processes. |
+| `[anonvisitor-merge]` never fires after first signed-token click | The pixel isn't reading the cookie. | Inspect the `mxy_v` cookie in DevTools; check CORS `Access-Control-Allow-Credentials: true`. |
+| `[v-event-error] reason=rate-limit` for legitimate operator traffic | Operator IP shares a NAT with high-volume crawlers. | Adjust `RATE_LIMIT` in `visitor-event.ts` or whitelist the IP at the proxy. |

package/payload/platform/plugins/memory/references/schema-base.md

@@ -40,7 +40,11 @@ When loading this reference, confirm which schema files were consulted by noting
 | WhatsApp Conversation (legacy) | `WhatsAppConversation` | extends `schema:Conversation` | — | `accountId`, `conversationId`, `archiveSourceFile`, `firstMessageAt`, `lastMessageAt`, `participantCount`, `messageCount`, `scope`, `createdByAgent`, `createdBySession`, `createdAt` |
 | WhatsApp Message (legacy) | `WhatsAppMessage` | extends `schema:Message` | — | `accountId`, `conversationId`, `messageId`, `dateSent`, `body`, `senderName`, `sequenceIndex`, `scope`, `createdByAgent`, `createdBySession`, `createdAt` |
 | ConversationArchive | `ConversationArchive` | platform-native (chunked conversation archive parent) | — | `accountId`, `conversationIdentity`, `archiveSourceFile`, `summary`, `keywords`, `lastIngestedMessageHash`, `lastIngestedMessageAt`, `lastIngestedArchiveSha256`, `scope`, `createdByAgent`, `createdBySession`, `createdAt` |
+<<<<<<< HEAD
 | AEO Audit | `AEOAudit` | platform-native (AEO audit history) | — | `accountId`, `auditId`, `target`, `score`, `heuristicsJson`, `runAt`, `createdByAgent`, `createdBySession`, `createdAt` |
+=======
+| Idea | `Idea` | platform-native (signal-detector original-thinking candidate) | — | `accountId`, `body`, `conversationId`, `scope`, `createdByAgent`, `createdBySession`, `createdAt` |
+>>>>>>> worktree-task-352-idea-schema
 
 **Branding properties on LocalBusiness:** `primaryColor`, `accentColor`, `backgroundColor`, `tagline` — optional, used to brand the public chat endpoint. Hex color values must match `#[0-9a-fA-F]{3,8}`. Logo and icon are linked via `HAS_BRAND_ASSET → ImageObject` with `purpose: "logo"` or `"icon"`.
 
@@ -56,6 +60,8 @@ When loading this reference, confirm which schema files were consulted by noting
 
 **Position** carries a single role held by a `UserProfile` at an `Organization` — its title, dates, and per-role properties (e.g. achievement bullets in `description`, `endDate` for a finished role). Each role is its own node so it can carry its own structure; multiple Positions per UserProfile (career history); one Organization may host many Positions across many UserProfiles. Written by the `document-ingest` skill when a CV section classifies as `Position`. The natural pattern is `(:UserProfile)-[:HAS_POSITION]->(:Position)-[:AT]->(:Organization)` — never set the employer name as a property on Position; always create the AT edge to the (MERGEd) Organization.
 
+**Idea** is a forward-only write surface for original-thinking candidates extracted from admin-side conversations by the `signal-detector` specialist (dispatched only by the admin agent's Stop hook). `body` is the verbatim operator statement; `conversationId` denormalises the source conversation; `scope` is always `"admin"`. Never written by any other path. No dedup or clustering at write time — let the brain accumulate first.
+
 **Durable-action properties on Task:** `kind` (string discriminator, e.g. `"onboarding-establish-owner"`, `"cloudflare-tunnel-login"`), `steps` (string[], append-only as the action progresses), `startedAt` (ISO timestamp, set when status transitions to `running`), `completedAt` (ISO timestamp, set when status transitions to `completed` or `failed`), `errorMessage` (string, set when status=`failed`; cleared to `null` when the same Task transitions to `completed`), `inputsProvided` (string[] of property names supplied at action start — the canonical "call shape" record), `inputs.<field>` (Record of arbitrary non-secret JSON values from the action's form payload, redacted at write time per the schema declared at the form definition). All optional. Per-kind value-field enumeration is intentionally absent — values vary by what the action records, governed by the central `redactSecrets` primitive rather than per-kind allow-lists. The `running` status value joins the existing `pending|active|completed|failed|cancelled` enum to discriminate "an action is mid-flight in this conversation" from `active` ("a commitment the operator has accepted").
 
 ---
@@ -138,6 +144,7 @@ Do not write placeholder values ("TBD", "unknown", empty strings) for properties
 (:Person|:AdminUser)-[:SENT]->(:Message)
 (:Person|:AdminUser)-[:PARTICIPANT_IN]->(:Conversation)
 (:Message)-[:NEXT]->(:Message)
+(:Conversation)-[:HAS_IDEA]->(:Idea)
 ```
 
 ### WhatsApp ingest natural-key contract
@@ -226,6 +233,43 @@ Patterns with high occurrence count are candidates for new section-kind labels.
 
 ---
 
+## Visitor Graph (Task 357)
+
+Behavioural analytics — pixel events from operator-owned listing pages land here.
+Cross-session attribution is via a signed-token cookie that the property-recommender
+issues; the pixel never sees a third-party domain.
+
+| Entity | Neo4j Label | schema.org | Description | Required Properties |
+|---|---|---|---|---|
+| Session | `Session` | (none — bespoke) | One browser tab session. | `accountId`, `sessionId`, `startedAt` |
+| AnonVisitor | `AnonVisitor` | (none — bespoke) | Pre-identification browser identity. Merges into `:Person` on signed-token click. | `accountId`, `visitorId` |
+| PageView | `PageView` | `schema:ViewAction` | One page load. One node per pageview; idempotent within 5s. | `accountId`, `occurredAt`, `referrer` |
+| Click | `Click` | `schema:InteractAction` | DOM click on `data-track="<label>"` or a known interaction (gallery / floorplan). | `accountId`, `label`, `occurredAt` |
+| ScrollMilestone | `ScrollMilestone` | (none — bespoke) | Roll-up: one node per PageView with `maxDepth` ∈ {25,50,75,100}. Updated in place. | `accountId`, `maxDepth` |
+| Page | `Page` | `schema:WebPage` | URL metadata. Persists across erasure (no PII). | `accountId`, `url` |
+| Recommendation | `Recommendation` | `schema:Recommendation` | Materialised `[property-recommended]` log line — what the recommender suggested for this session. | `accountId`, `sessionKey`, `listingSlug`, `recommendedAt` |
+
+### Edges
+
+| Edge | Direction | Note |
+|---|---|---|
+| `VISITED` | `Person` → `Session` or `AnonVisitor` → `Session` | One edge per session. Re-attribution on merge replaces the AnonVisitor edge with a Person edge. |
+| `OWNS_VISITOR` | `Person` → `AnonVisitor` | Created on first signed-token click. Records the merge history. |
+| `HAS_EVENT` | `Session` → `PageView` / `Click` / `ScrollMilestone` | Every event hangs off its Session. |
+| `OF_PAGE` | `PageView` → `Page` | Click/Scroll inherit their Page through their PageView. |
+| `OF_LISTING` | `PageView` → `Listing` | Optional: present when the URL was a known listing slug. |
+| `FOR_SESSION` | `Recommendation` → `Session` | Joins recommendations to the session their CTR is computed against. |
+
+### Cascade rules
+
+- `contact-erase` on a `:Person` trashes every `(:Session)<-[:VISITED]-(:Person)` and every `(:Session)-[:HAS_EVENT]->(*)` reachable from it. Uses the same `trashNode` pattern as `profile-delete`.
+- `:Page` and `:Listing` are content metadata — they do not cascade.
+- `:Recommendation` cascades only when its `:Session` cascades; orphan `:Recommendation`s without a session never exist (the writer always pairs them).
+
+### Retention
+
+`accountId`-scoped setting `visitorGraphRetentionDays` (default 180). Sessions older than the retention window are trashed by a separate cron — wired in this task as a setting, the cron itself is filed as a follow-up. The privacy page surfaces the active value.
+
 ## Order Node — Disambiguation
 
 The base `Order` label is used for general jobs and orders. Several vertical schemas define specialised subtypes that also map to `schema:Order` but use different Neo4j labels:

package/payload/server/{chunk-FJCI6X3H.js → chunk-HCYM5FLU.js}

@@ -2705,6 +2705,7 @@ var REMOTE_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "remote-sessio
 var ADMIN_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "admin-session-secret");
 var TELEGRAM_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-webhook-secret");
 var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-admin-webhook-secret");
+var VISITOR_TOKEN_SECRET_FILE = resolve(MAXY_DIR, "credentials", "visitor-token-secret");
 var CLAUDE_CREDENTIALS_FILE = resolve(MAXY_DIR, ".claude", ".credentials.json");
 
 // app/lib/vnc-logger.ts
@@ -5476,6 +5477,7 @@ export {
   USERS_FILE,
   LOG_DIR,
   BIN_DIR,
+  VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
   vncLog,
   newCorrId,

package/payload/server/maxy-edge.js

@@ -13,7 +13,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-FJCI6X3H.js";
+} from "./chunk-HCYM5FLU.js";
 import "./chunk-JSBRDJBE.js";
 
 // server/edge.ts

package/payload/server/public/privacy.html

@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Privacy</title>
+<style>
+  :root { --fg:#222; --bg:#FAFAF8; --muted:#666; --accent:#7C8C72; }
+  * { box-sizing: border-box; }
+  body { font: 16px/1.55 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; color: var(--fg); background: var(--bg); }
+  main { max-width: 720px; margin: 0 auto; padding: 48px 24px 96px; }
+  h1 { margin-top: 0; font-size: 32px; letter-spacing: -0.01em; }
+  h2 { margin-top: 36px; font-size: 20px; }
+  p, li { color: #333; }
+  ul { padding-left: 20px; }
+  code { background: #eee; padding: 1px 5px; border-radius: 3px; font-size: 13px; }
+  table { border-collapse: collapse; width: 100%; margin: 12px 0; }
+  th, td { border-bottom: 1px solid #ddd; padding: 8px 6px; text-align: left; vertical-align: top; }
+  th { background: #f0f0ee; font-weight: 600; }
+  .muted { color: var(--muted); font-size: 14px; }
+  .accent { color: var(--accent); }
+</style>
+</head>
+<body>
+<main>
+  <h1>Privacy</h1>
+  <p>This page describes the data this site collects about your visit, why, and how to ask for it to be removed.</p>
+
+  <h2>What we collect</h2>
+  <p>When you load a property listing page, a small first-party script (<code>/v.js</code>) records:</p>
+  <table>
+    <thead><tr><th>Field</th><th>Why</th><th>Stored as</th></tr></thead>
+    <tbody>
+      <tr><td>Page URL, page title, referrer</td><td>So we know which listings get visitors and where they came from.</td><td><code>:PageView</code> node</td></tr>
+      <tr><td>Visitor ID (random, browser-local)</td><td>So we can tell two visits from one device apart from two devices.</td><td><code>:AnonVisitor</code> node (anonymous), or linked to a <code>:Person</code> if you arrived via a personalised marketing link.</td></tr>
+      <tr><td>Session ID (random, per tab)</td><td>So one tab's activity stays together.</td><td><code>:Session</code> node</td></tr>
+      <tr><td>Clicks on tagged elements (gallery, floorplan, etc.)</td><td>So we know which parts of a listing get interaction.</td><td><code>:Click</code> node</td></tr>
+      <tr><td>Scroll depth — 25%, 50%, 75%, 100%</td><td>So we know how far you read.</td><td><code>:ScrollMilestone</code> node (one per page view, max depth recorded)</td></tr>
+      <tr><td>Time spent on a page (dwell)</td><td>Same.</td><td>Property of the <code>:PageView</code> node</td></tr>
+    </tbody>
+  </table>
+  <p class="muted">We do not collect: cursor positions, keystrokes, form contents, screen recordings, or anything from third-party tracking networks. The pixel is loaded from the same site as the listing, never from a third party.</p>
+
+  <h2>Cookies</h2>
+  <p>One cookie is set when you arrive via a personalised marketing link from the agent:</p>
+  <ul>
+    <li><code>mxy_v</code> — signed token containing your contact identifier. Set <code>HttpOnly</code>, <code>SameSite=Lax</code>, <code>Secure</code>. Lives for 30 days. Lets the site recognise you on later visits without you clicking the marketing link again.</li>
+  </ul>
+
+  <h2>Cross-session attribution</h2>
+  <p>If you visit anonymously today and later click a personalised marketing link from the agent, prior anonymous visits from the same browser are linked to your contact record. This is the only way an anonymous visit ever becomes named.</p>
+
+  <h2>Retention</h2>
+  <p>Visit data is kept for <strong>180 days</strong> by default, then removed automatically. The operator can change this — your acting agent will tell you the current value if you ask.</p>
+
+  <h2>Right to access and erasure</h2>
+  <p>To see what we hold or to ask for it to be removed, contact the agent. We honour GDPR Article 15 (access) and Article 17 (erasure). Erasure cascades: removing your contact removes every session, page view, click, and scroll milestone tied to your identity. Anonymous page views from browsers we cannot link to you are not removed individually — they cannot be identified, and they expire under the retention window above.</p>
+
+  <h2>Bots and crawlers</h2>
+  <p>Search engines and link checkers are filtered out by user-agent before any data is written. They are also excluded from rate-limit budgets so legitimate visitors are never blocked because a crawler hammered the endpoint.</p>
+
+  <h2>This page</h2>
+  <p class="muted">This is a static description. The behaviour above is implemented in <code>platform/ui/server/routes/visitor-event.ts</code> and <code>platform/ui/public/v.js</code>. The schema is declared in <code>platform/neo4j/schema.cypher</code> under the Visitor Graph section.</p>
+</main>
+</body>
+</html>