@rubytech/create-maxy-code 0.1.125 → 0.1.127

package/payload/server/server.js

@@ -365,6 +365,239 @@ var require_dist = __commonJS({
   }
 });
 
+// ../lib/graph-style/dist/index.js
+var require_dist2 = __commonJS({
+  "../lib/graph-style/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ALL_GRAPH_LABELS = exports.FALLBACK_LABEL_COLOUR = exports.GRAPH_LABEL_COLOURS = void 0;
+    exports.pickDisplayLabel = pickDisplayLabel2;
+    exports.colourForLabel = colourForLabel2;
+    exports.resolveNodeColour = resolveNodeColour2;
+    exports.formatRunTimestamp = formatRunTimestamp;
+    exports.formatMessageTimestamp = formatMessageTimestamp;
+    exports.pickShortLabel = pickShortLabel;
+    exports.pickDisplayName = pickDisplayName;
+    exports.GRAPH_LABEL_COLOURS = {
+      // Business identity — slate-blue family
+      LocalBusiness: "#4F6B8A",
+      Service: "#6B85A0",
+      PriceSpecification: "#8AA0B8",
+      OpeningHoursSpecification: "#A8BACE",
+      // Estate-agent ontology. Listing/Property share the business slate-blue
+      // family; Viewing/Offer are transactional events placed in a warm amber
+      // family distinct from Agent and from the dusty-rose Task/Project/Event
+      // hues so the legend reads them as a separate band.
+      Listing: "#3F5670",
+      Property: "#5C7A99",
+      Viewing: "#D4A574",
+      Offer: "#B08850",
+      // External business entity — schema:Organization, written by memory-write
+      // as the Supplier label. Warm tobacco — distinct hue from internal-business
+      // slates so external entities are scannable at a glance.
+      Organization: "#8A6B47",
+      // People — terracotta family (warm, human)
+      Person: "#B86E4A",
+      UserProfile: "#D08960",
+      Preference: "#DFA67A",
+      AdminUser: "#8C5230",
+      AccessGrant: "#66381F",
+      // Knowledge — moss family (organic)
+      KnowledgeDocument: "#6E8A5A",
+      // chunked WhatsApp/messaging archive parent. Sits in the
+      // knowledge moss family because it's structurally a document parent
+      // (HAS_SECTION → :Section:Conversation chunks); the conversational
+      // plum family is reserved for the live Conversation/Message labels.
+      ConversationArchive: "#82A06A",
+      Section: "#8AA876",
+      Chunk: "#A6C194",
+      DigitalDocument: "#5A7548",
+      CreativeWork: "#B5C9A2",
+      Question: "#C7D6B5",
+      FAQPage: "#95B385",
+      DefinedTerm: "#76906A",
+      Review: "#3F5A2E",
+      ImageObject: "#A0BB8C",
+      // Conversational — muted plum/lavender family.
+      // Pairwise-distinctness invariants enforced by the UI test
+      // graph-labels.test.ts; UserMessage matches Preference (Person/family cue,
+      // the one intentional duplicate in the registry).
+      Conversation: "#6B5A85",
+      AdminConversation: "#4F4070",
+      PublicConversation: "#8A75A8",
+      Message: "#6B7280",
+      UserMessage: "#DFA67A",
+      AssistantMessage: "#C9A876",
+      ToolCall: "#B5ABCB",
+      // Tasks / projects / events — dusty rose family
+      Task: "#B0617A",
+      Project: "#8E4A60",
+      Event: "#C68095",
+      // Workflows — muted teal
+      Workflow: "#3A6F77",
+      WorkflowStep: "#5A8E96",
+      WorkflowRun: "#7AAAB2",
+      StepResult: "#9CC4CB",
+      // Email — muted moss, hue-adjacent to Knowledge but lower-saturation
+      // and warmer; never co-rendered with KnowledgeDocument.
+      Email: "#6F7F4A",
+      EmailAccount: "#91A063",
+      // Public-agent projection — burnished bronze sits between
+      // people-terracotta and email-moss but shares neither hue.
+      Agent: "#B8893D"
+    };
+    exports.FALLBACK_LABEL_COLOUR = "#94A3B8";
+    exports.ALL_GRAPH_LABELS = Object.freeze(Object.keys(exports.GRAPH_LABEL_COLOURS));
+    function pickDisplayLabel2(labels) {
+      for (let i = 1; i < labels.length; i++) {
+        if (Object.prototype.hasOwnProperty.call(exports.GRAPH_LABEL_COLOURS, labels[i])) {
+          return labels[i];
+        }
+      }
+      return labels[0] ?? null;
+    }
+    function colourForLabel2(label) {
+      return exports.GRAPH_LABEL_COLOURS[label] ?? exports.FALLBACK_LABEL_COLOUR;
+    }
+    function resolveNodeColour2(labels) {
+      const displayLabel = pickDisplayLabel2(labels);
+      const colour = displayLabel ? colourForLabel2(displayLabel) : exports.FALLBACK_LABEL_COLOUR;
+      let driftCandidates = 0;
+      for (let i = 1; i < labels.length; i++) {
+        if (Object.prototype.hasOwnProperty.call(exports.GRAPH_LABEL_COLOURS, labels[i])) {
+          driftCandidates++;
+        }
+      }
+      return { displayLabel, colour, driftCandidates };
+    }
+    var ISO_MINUTE_RE = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2})/;
+    var ISO_SECOND_RE = /^\d{4}-\d{2}-\d{2}T(\d{2}:\d{2}:\d{2})/;
+    function formatRunTimestamp(iso) {
+      const m = iso.match(ISO_MINUTE_RE);
+      if (!m)
+        return null;
+      return `${m[1]} ${m[2]}`;
+    }
+    function formatMessageTimestamp(iso) {
+      const m = iso.match(ISO_SECOND_RE);
+      if (!m)
+        return null;
+      return m[1];
+    }
+    function pickShortLabel(node) {
+      const props = node.properties;
+      const primaryLabel = node.labels[0];
+      if (primaryLabel === "ToolCall") {
+        const v = props.toolName;
+        if (typeof v === "string" && v.length > 0) {
+          return v.length > 24 ? v.slice(0, 24) + "\u2026" : v;
+        }
+      } else if (primaryLabel === "WorkflowRun") {
+        const v = props.startedAt;
+        if (typeof v === "string" && v.length > 0) {
+          const ts = formatRunTimestamp(v);
+          if (ts)
+            return ts;
+        }
+      } else if (primaryLabel === "WorkflowStep") {
+        const v = props.label;
+        if (typeof v === "string" && v.length > 0) {
+          return v.length > 24 ? v.slice(0, 24) + "\u2026" : v;
+        }
+      } else if (primaryLabel === "Person") {
+        const given = typeof props.givenName === "string" ? props.givenName : "";
+        const family = typeof props.familyName === "string" ? props.familyName : "";
+        const full = [given, family].filter((s) => s.length > 0).join(" ");
+        if (full.length > 0) {
+          return full.length > 24 ? full.slice(0, 24) + "\u2026" : full;
+        }
+      } else if (primaryLabel === "Agent") {
+        const dn = typeof props.displayName === "string" ? props.displayName : "";
+        const slug = typeof props.slug === "string" ? props.slug : "";
+        const v = dn.length > 0 ? dn : slug;
+        if (v.length > 0) {
+          return v.length > 24 ? v.slice(0, 24) + "\u2026" : v;
+        }
+      } else if (primaryLabel === "Message") {
+        const role = typeof props.role === "string" ? props.role : "";
+        const roleShort = role === "user" ? "user" : role === "assistant" ? "asst" : role === "system" ? "sys" : role === "tool" ? "tool" : null;
+        const createdAt = typeof props.createdAt === "string" ? props.createdAt : "";
+        if (roleShort && createdAt) {
+          const ts = formatMessageTimestamp(createdAt);
+          if (ts)
+            return `${roleShort} ${ts}`;
+        }
+      } else if (primaryLabel === "ConversationArchive") {
+        const t = typeof props.title === "string" ? props.title : "";
+        if (t.length > 0) {
+          return t.length > 24 ? t.slice(0, 24) + "\u2026" : t;
+        }
+        return primaryLabel;
+      }
+      for (const k of ["name", "title", "summary", "givenName", "subject", "text"]) {
+        const v = props[k];
+        if (typeof v === "string" && v.length > 0) {
+          return v.length > 24 ? v.slice(0, 24) + "\u2026" : v;
+        }
+      }
+      if (primaryLabel === "Conversation") {
+        const id = typeof props.conversationId === "string" ? props.conversationId : null;
+        if (id)
+          return `Conv ${id.slice(0, 8)}`;
+      }
+      return primaryLabel ?? "\u2026";
+    }
+    function pickDisplayName(node) {
+      const props = node.properties;
+      const primaryLabel = node.labels[0];
+      if (primaryLabel === "ToolCall") {
+        const v = props.toolName;
+        if (typeof v === "string" && v.length > 0)
+          return v;
+      } else if (primaryLabel === "WorkflowRun") {
+        const v = props.startedAt;
+        if (typeof v === "string" && v.length > 0) {
+          const ts = formatRunTimestamp(v);
+          if (ts)
+            return ts;
+        }
+      } else if (primaryLabel === "WorkflowStep") {
+        const v = props.label;
+        if (typeof v === "string" && v.length > 0)
+          return v;
+      } else if (primaryLabel === "Person") {
+        const given = typeof props.givenName === "string" ? props.givenName : "";
+        const family = typeof props.familyName === "string" ? props.familyName : "";
+        const full = [given, family].filter((s) => s.length > 0).join(" ");
+        if (full.length > 0)
+          return full;
+      } else if (primaryLabel === "Agent") {
+        const dn = typeof props.displayName === "string" ? props.displayName : "";
+        const slug = typeof props.slug === "string" ? props.slug : "";
+        const v = dn.length > 0 ? dn : slug;
+        if (v.length > 0)
+          return v;
+      } else if (primaryLabel === "ConversationArchive") {
+        const t = typeof props.title === "string" ? props.title : "";
+        if (t.length > 0)
+          return t;
+        return primaryLabel;
+      }
+      for (const k of ["name", "title", "summary", "givenName", "subject", "text"]) {
+        const v = props[k];
+        if (typeof v === "string" && v.length > 0)
+          return v;
+      }
+      if (primaryLabel === "Conversation") {
+        const id = typeof props.conversationId === "string" ? props.conversationId : null;
+        if (id)
+          return `Conv ${id.slice(0, 8)}`;
+      }
+      return primaryLabel ?? "\u2026";
+    }
+  }
+});
+
 // node_modules/hono/dist/utils/mime.js
 var getMimeType = (filename, mimes = baseMimes) => {
   const regexp = /\.([a-zA-Z0-9]+?)$/;
@@ -9943,97 +10176,8 @@ var graph_search_default = app19;
 import neo4j from "neo4j-driver";
 
 // app/lib/graph-labels.ts
-var GRAPH_LABEL_COLOURS = {
-  // Business identity — slate-blue family
-  LocalBusiness: "#4F6B8A",
-  Service: "#6B85A0",
-  PriceSpecification: "#8AA0B8",
-  OpeningHoursSpecification: "#A8BACE",
-  // Estate-agent ontology (Task 358). :Listing and :Property
-  // share the business slate-blue family (they describe a business's
-  // inventory). :Viewing and :Offer are transactional events — placed in
-  // a warm amber family distinct from Agent (#B8893D) and the dusty-rose
-  // Task/Project/Event hues so the legend reads them as a separate band.
-  Listing: "#3F5670",
-  Property: "#5C7A99",
-  Viewing: "#D4A574",
-  Offer: "#B08850",
-  // External business entity — schema:Organization, written by memory-write
-  // as the Supplier label (per platform/plugins/memory/references/schema-base.md).
-  // Warm tobacco — distinct hue from internal-business slates so external
-  // entities are scannable at a glance.
-  Organization: "#8A6B47",
-  // People — terracotta family (warm, human)
-  Person: "#B86E4A",
-  UserProfile: "#D08960",
-  Preference: "#DFA67A",
-  AdminUser: "#8C5230",
-  AccessGrant: "#66381F",
-  // Knowledge — moss family (organic)
-  KnowledgeDocument: "#6E8A5A",
-  // chunked WhatsApp/messaging archive parent. Sits in the
-  // knowledge moss family because it's structurally a document parent
-  // (HAS_SECTION → :Section:Conversation chunks); the conversational
-  // plum family is reserved for the live Conversation/Message labels.
-  ConversationArchive: "#82A06A",
-  Section: "#8AA876",
-  Chunk: "#A6C194",
-  DigitalDocument: "#5A7548",
-  CreativeWork: "#B5C9A2",
-  Question: "#C7D6B5",
-  FAQPage: "#95B385",
-  DefinedTerm: "#76906A",
-  Review: "#3F5A2E",
-  ImageObject: "#A0BB8C",
-  // Conversational — muted plum/lavender family
-  //
-  // Pairwise-distinctness invariants (carried forward
-  // palette):
-  //   - Four sublabelled conversation/message labels (AdminConversation,
-  //     PublicConversation, UserMessage, AssistantMessage) are pairwise
-  //     distinct on canvas.
-  //   - UserMessage matches Preference (Person/family cue: a user-authored
-  //     message inherits the person family colour). This is the one
-  //     intentional duplicate in the registry — see the
-  //     `INTENTIONAL_DUPLICATES` set in `graph-labels.test.ts`.
-  //   - Conversation base distinct from both AdminConversation and
-  //     PublicConversation so base-Conversation rows don't visually
-  //     collide with the sublabelled split.
-  //   - Message base distinct from PublicConversation (`#A78BFA`
-  //     collision class).
-  Conversation: "#6B5A85",
-  AdminConversation: "#4F4070",
-  PublicConversation: "#8A75A8",
-  Message: "#6B7280",
-  UserMessage: "#DFA67A",
-  AssistantMessage: "#C9A876",
-  ToolCall: "#B5ABCB",
-  // Tasks / projects / events — dusty rose family
-  Task: "#B0617A",
-  Project: "#8E4A60",
-  Event: "#C68095",
-  // Workflows — muted teal
-  Workflow: "#3A6F77",
-  WorkflowStep: "#5A8E96",
-  WorkflowRun: "#7AAAB2",
-  StepResult: "#9CC4CB",
-  // Email — muted moss (hue-adjacent to Knowledge but lower-saturation
-  // and warmer; never co-rendered with KnowledgeDocument so visual
-  // confusion doesn't apply, but kept distinguishable for the legend)
-  Email: "#6F7F4A",
-  EmailAccount: "#91A063",
-  // Public-agent projection — burnished bronze sits between
-  // people-terracotta and email-moss but shares neither hue, signalling
-  // "operator-defined persona that traverses to KnowledgeDocuments,
-  // Conversations, and other entities" without colliding with any existing
-  // family. Pairs with the four owned KnowledgeDocument projections rendered
-  // in the moss family — visual contrast cues the operator that the agent
-  // node is a different kind of thing from its IDENTITY/SOUL/KNOWLEDGE docs.
-  Agent: "#B8893D"
-};
-var ALL_GRAPH_LABELS = Object.freeze(
-  Object.keys(GRAPH_LABEL_COLOURS)
-);
+var import_dist2 = __toESM(require_dist2(), 1);
+var import_dist3 = __toESM(require_dist2(), 1);
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
   /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
@@ -10089,7 +10233,7 @@ var EXCLUDED_EDGE_TYPES = Object.freeze(
   ])
 );
 function isKnownLabel(label) {
-  return Object.prototype.hasOwnProperty.call(GRAPH_LABEL_COLOURS, label);
+  return Object.prototype.hasOwnProperty.call(import_dist3.GRAPH_LABEL_COLOURS, label);
 }
 function isHiddenByDefault(label) {
   return HIDDEN_BY_DEFAULT_LABELS.has(label);
@@ -12252,11 +12396,161 @@ function verifyVisitorToken(token, now = Date.now()) {
 var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
+// app/lib/brand-config.ts
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
+import { join as join14 } from "path";
+var cached2 = null;
+var cachedAttempted = false;
+function readBrandConfig() {
+  if (cachedAttempted) return cached2;
+  cachedAttempted = true;
+  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot) return null;
+  const brandPath = join14(platformRoot, "config", "brand.json");
+  if (!existsSync22(brandPath)) return null;
+  try {
+    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
+    return cached2;
+  } catch {
+    return null;
+  }
+}
+
+// server/routes/visitor-consent.ts
+var app35 = new Hono();
+var CONSENT_COOKIE_NAME = "mxy_consent";
+var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
+var DEFAULT_CONSENT_COPY = {
+  title: "Before you browse",
+  body: "We use a small first-party script to count page views, scrolls and clicks on this listing. Nothing is shared with third parties. You can change your mind at any time.",
+  accept: "Accept",
+  reject: "Reject",
+  manage: "Manage cookies",
+  policyLinkText: "Read the cookie policy",
+  policyHref: "/privacy.html#cookies"
+};
+var DEFAULT_CONSENT_PALETTE = {
+  bg: "#FFFFFF",
+  fg: "#1F1F1F",
+  accent: "#1F1F1F",
+  accentFg: "#FFFFFF",
+  border: "#E5E5E2"
+};
+function getOrigin(c) {
+  return c.req.header("origin") ?? c.req.header("referer") ?? "";
+}
+function setCorsHeaders(c, origin) {
+  if (origin) c.header("Access-Control-Allow-Origin", origin);
+  c.header("Access-Control-Allow-Credentials", "true");
+  c.header("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "Content-Type");
+  c.header("Vary", "Origin");
+}
+function parseConsent(body) {
+  if (!body || typeof body !== "object") return null;
+  const b = body;
+  if (b.decision !== "yes" && b.decision !== "no") return null;
+  const v = typeof b.v === "string" && b.v.length > 0 && b.v.length <= 2048 ? b.v : null;
+  return { decision: b.decision, v };
+}
+function siteSlugFromReferer(referer) {
+  try {
+    const u = new URL(referer);
+    const parts = u.pathname.split("/").filter(Boolean);
+    return parts[parts.length - 1]?.slice(0, 120) ?? "";
+  } catch {
+    return "";
+  }
+}
+app35.options("/consent", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  return c.body(null, 204);
+});
+app35.options("/brand-config", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  return c.body(null, 204);
+});
+app35.post("/consent", async (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  let raw;
+  try {
+    raw = await c.req.json();
+  } catch {
+    console.error("[consent-error] reason=bad-json");
+    return c.text("Bad Request", 400);
+  }
+  const parsed = parseConsent(raw);
+  if (!parsed) {
+    console.error("[consent-error] reason=bad-body");
+    return c.text("Bad Request", 400);
+  }
+  const referer = c.req.header("referer") ?? "";
+  const site = siteSlugFromReferer(referer);
+  const brand = readBrandConfig();
+  const brandName = brand?.productName ?? "-";
+  const cookies = [];
+  cookies.push(
+    `${CONSENT_COOKIE_NAME}=${parsed.decision}; Max-Age=${CONSENT_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure`
+  );
+  let tokenBound = false;
+  if (parsed.decision === "yes" && parsed.v) {
+    const verify = verifyVisitorToken(parsed.v);
+    if (verify.ok) {
+      cookies.push(
+        `${VISITOR_COOKIE_NAME}=${parsed.v}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
+      );
+      tokenBound = true;
+      console.log(`[token-bind] via=consent site=${site} person=${verify.personId}`);
+    } else {
+      console.error(`[token-bind] reject reason=${verify.reason} via=consent site=${site}`);
+    }
+  }
+  for (const cookie of cookies) c.header("Set-Cookie", cookie, { append: true });
+  console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
+  return c.body(null, 204);
+});
+app35.get("/brand-config", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  const brand = readBrandConfig();
+  const consent = brand?.consent ?? {};
+  const copy = { ...DEFAULT_CONSENT_COPY, ...consent.copy ?? {} };
+  const palette = { ...DEFAULT_CONSENT_PALETTE, ...consent.palette ?? {} };
+  c.header("Cache-Control", "public, max-age=300");
+  return c.json({ consent: { copy, palette } });
+});
+var visitor_consent_default = app35;
+
 // server/routes/listings.ts
+function getCookie(headerValue, name) {
+  if (!headerValue) return null;
+  for (const part of headerValue.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === name) return rest.join("=");
+  }
+  return null;
+}
+function appendConsentParams(pageUrl, token) {
+  try {
+    const u = new URL(pageUrl);
+    u.searchParams.set("consent", "needed");
+    u.searchParams.set("v", token);
+    return u.toString();
+  } catch {
+    const hashIdx = pageUrl.indexOf("#");
+    const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
+    const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
+    const sep4 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep4 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+  }
+}
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app35 = new Hono();
-app35.get("/:slug/click", async (c) => {
+var app36 = new Hono();
+app36.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -12297,45 +12591,33 @@ app35.get("/:slug/click", async (c) => {
     console.error(`[property-card-click] reject reason=listing-not-found slug=${slug} sessionKey=${sessionKey} accountId=${account.accountId} status=404`);
     return c.text("Not Found", 404);
   }
+  let redirectUrl = pageUrl;
+  const consentCookie = getCookie(c.req.header("cookie"), CONSENT_COOKIE_NAME);
+  const consented = consentCookie === "yes";
   if (tokenParam) {
     const verify = verifyVisitorToken(tokenParam);
     if (verify.ok) {
-      c.header(
-        "Set-Cookie",
-        `${VISITOR_COOKIE_NAME}=${tokenParam}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
-      );
-      console.log(`[token-bind] sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      if (consented) {
+        c.header(
+          "Set-Cookie",
+          `${VISITOR_COOKIE_NAME}=${tokenParam}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
+        );
+        console.log(`[token-bind] sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      } else {
+        redirectUrl = appendConsentParams(pageUrl, tokenParam);
+        console.error(`[token-bind] reject reason=no-consent sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      }
     } else {
       console.error(`[token-bind] reject reason=${verify.reason} sessionKey=${sessionKey} listingSlug=${slug}`);
     }
   }
-  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
-  return c.redirect(pageUrl, 302);
+  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
+  return c.redirect(redirectUrl, 302);
 });
-var listings_default = app35;
-
-// app/lib/brand-config.ts
-import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
-import { join as join14 } from "path";
-var cached2 = null;
-var cachedAttempted = false;
-function readBrandConfig() {
-  if (cachedAttempted) return cached2;
-  cachedAttempted = true;
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot) return null;
-  const brandPath = join14(platformRoot, "config", "brand.json");
-  if (!existsSync22(brandPath)) return null;
-  try {
-    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
-    return cached2;
-  } catch {
-    return null;
-  }
-}
+var listings_default = app36;
 
 // server/routes/visitor-event.ts
-var app36 = new Hono();
+var app37 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -12368,7 +12650,7 @@ function parseEvent(body) {
   if (typeof e.ts !== "number" || !Number.isFinite(e.ts)) return null;
   return e;
 }
-function getCookie(c, name) {
+function getCookie2(c, name) {
   const raw = c.req.header("cookie");
   if (!raw) return null;
   for (const part of raw.split(";")) {
@@ -12377,10 +12659,10 @@ function getCookie(c, name) {
   }
   return null;
 }
-function getOrigin(c) {
+function getOrigin2(c) {
   return c.req.header("origin") ?? c.req.header("referer") ?? "";
 }
-function setCorsHeaders(c, origin) {
+function setCorsHeaders2(c, origin) {
   if (origin) c.header("Access-Control-Allow-Origin", origin);
   c.header("Access-Control-Allow-Credentials", "true");
   c.header("Access-Control-Allow-Methods", "POST, OPTIONS");
@@ -12402,14 +12684,14 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app36.options("/event", (c) => {
-  const origin = getOrigin(c);
-  setCorsHeaders(c, origin);
+app37.options("/event", (c) => {
+  const origin = getOrigin2(c);
+  setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app36.post("/event", async (c) => {
-  const origin = getOrigin(c);
-  setCorsHeaders(c, origin);
+app37.post("/event", async (c) => {
+  const origin = getOrigin2(c);
+  setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
   if (BOT_UA_RE.test(ua)) {
     console.error(`[v-event-error] reason=bot-ua ua=${JSON.stringify(ua.slice(0, 120))}`);
@@ -12432,6 +12714,11 @@ app36.post("/event", async (c) => {
     console.error(`[v-event-error] reason=origin-mismatch origin=${JSON.stringify(origin)} ip=${ip}`);
     return c.text("Forbidden", 403);
   }
+  const consentCookie = getCookie2(c, CONSENT_COOKIE_NAME);
+  if (consentCookie !== "yes") {
+    console.log(`[v-event] drop reason=no-consent consent=${consentCookie ?? "absent"} ip=${ip} origin=${JSON.stringify(origin)}`);
+    return c.body(null, 204);
+  }
   let raw;
   try {
     raw = await c.req.json();
@@ -12444,7 +12731,7 @@ app36.post("/event", async (c) => {
     console.error(`[v-event-error] reason=bad-event ip=${ip}`);
     return c.text("Bad Request", 400);
   }
-  const cookieVal = getCookie(c, VISITOR_COOKIE_NAME);
+  const cookieVal = getCookie2(c, VISITOR_COOKIE_NAME);
   let personId = null;
   if (cookieVal) {
     const v = verifyVisitorToken(cookieVal);
@@ -12474,7 +12761,7 @@ app36.post("/event", async (c) => {
     });
   }
   console.log(
-    `[visitor-event] type=${event.type} sessionId=${event.sid} visitorId=${event.vid} personId=${personId ?? "-"} path=${event.path ?? ""} label=${event.label ?? "-"} depth=${event.depth ?? "-"} ms=${event.ms ?? "-"}`
+    `[visitor-event] type=${event.type} sessionId=${event.sid} visitorId=${event.vid} personId=${personId ?? "-"} consent=${consentCookie} path=${event.path ?? ""} label=${event.label ?? "-"} depth=${event.depth ?? "-"} ms=${event.ms ?? "-"}`
   );
   return c.body(null, 204);
 });
@@ -12607,7 +12894,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app36;
+var visitor_event_default = app37;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13044,9 +13331,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app37 = new Hono();
-app37.use("*", clientIpMiddleware);
-app37.use("*", async (c, next) => {
+var app38 = new Hono();
+app38.use("*", clientIpMiddleware);
+app38.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13056,7 +13343,7 @@ app37.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13089,7 +13376,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13129,7 +13416,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app37.post("/__remote-auth/login", async (c) => {
+app38.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13174,7 +13461,7 @@ app37.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app37.get("/__remote-auth/logout", (c) => {
+app38.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13187,7 +13474,7 @@ app37.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app37.post("/__remote-auth/change-password", async (c) => {
+app38.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13238,13 +13525,13 @@ app37.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app37.get("/__remote-auth/setup", (c) => {
+app38.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app37.post("/__remote-auth/set-initial-password", async (c) => {
+app38.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13282,10 +13569,10 @@ app37.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app37.get("/api/remote-auth/status", (c) => {
+app38.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app37.post("/api/remote-auth/set-password", async (c) => {
+app38.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13316,9 +13603,9 @@ app37.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app37.route("/api/_client-error", client_error_default);
+app38.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13351,11 +13638,11 @@ app37.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app37.route("/api/health", health_default);
-app37.route("/api/chat", chat_default);
-app37.route("/api/whatsapp", whatsapp_default);
-app37.route("/api/onboarding", onboarding_default);
-app37.route("/api/admin", admin_default);
+app38.route("/api/health", health_default);
+app38.route("/api/chat", chat_default);
+app38.route("/api/whatsapp", whatsapp_default);
+app38.route("/api/onboarding", onboarding_default);
+app38.route("/api/admin", admin_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13367,7 +13654,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app37.get("/agent-assets/:slug/:filename", (c) => {
+app38.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -13402,7 +13689,7 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app37.get("/generated/:filename", (c) => {
+app38.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13432,9 +13719,10 @@ app37.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app37.route("/sites", sites_default);
-app37.route("/listings", listings_default);
-app37.route("/v", visitor_event_default);
+app38.route("/sites", sites_default);
+app38.route("/listings", listings_default);
+app38.route("/v", visitor_event_default);
+app38.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13571,7 +13859,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app37.get("/", (c) => {
+app38.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13579,12 +13867,12 @@ app37.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app37.get("/public", (c) => {
+app38.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app37.get("/chat", (c) => {
+app38.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13603,9 +13891,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app37.use("/vnc-viewer.html", logViewerFetch);
-app37.use("/vnc-popout.html", logViewerFetch);
-app37.get("/vnc-popout.html", (c) => {
+app38.use("/vnc-viewer.html", logViewerFetch);
+app38.use("/vnc-popout.html", logViewerFetch);
+app38.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync21(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13618,7 +13906,7 @@ app37.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app37.post("/api/vnc/client-event", async (c) => {
+app38.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13639,25 +13927,25 @@ app37.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app37.get("/g/:slug", (c) => {
+app38.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app37.get("/graph", (c) => {
+app38.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app37.get("/sessions", (c) => {
+app38.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app37.get("/data", (c) => {
+app38.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app37.get("/:slug", async (c, next) => {
+app38.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13667,15 +13955,15 @@ app37.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app37.get("/favicon.ico", (c) => {
+  app38.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app37.use("/*", serveStatic({ root: "./public" }));
+app38.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app37.fetch, port, hostname });
+var httpServer = serve({ fetch: app38.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13701,7 +13989,8 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
-  { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default }
+  { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
+  { prefix: "/v", file: "server/routes/visitor-consent.ts", subapp: visitor_consent_default }
 ];
 for (const m of SUBAPP_MANIFEST) {
   const routeCount = Array.isArray(m.subapp.routes) ? m.subapp.routes.length : 0;
@@ -13709,7 +13998,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app37.routes ?? []) {
+  for (const r of app38.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });