@rubytech/create-maxy-code 0.1.126 → 0.1.127

package/payload/server/server.js

@@ -12396,11 +12396,161 @@ function verifyVisitorToken(token, now = Date.now()) {
 var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
+// app/lib/brand-config.ts
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
+import { join as join14 } from "path";
+var cached2 = null;
+var cachedAttempted = false;
+function readBrandConfig() {
+  if (cachedAttempted) return cached2;
+  cachedAttempted = true;
+  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot) return null;
+  const brandPath = join14(platformRoot, "config", "brand.json");
+  if (!existsSync22(brandPath)) return null;
+  try {
+    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
+    return cached2;
+  } catch {
+    return null;
+  }
+}
+
+// server/routes/visitor-consent.ts
+var app35 = new Hono();
+var CONSENT_COOKIE_NAME = "mxy_consent";
+var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
+var DEFAULT_CONSENT_COPY = {
+  title: "Before you browse",
+  body: "We use a small first-party script to count page views, scrolls and clicks on this listing. Nothing is shared with third parties. You can change your mind at any time.",
+  accept: "Accept",
+  reject: "Reject",
+  manage: "Manage cookies",
+  policyLinkText: "Read the cookie policy",
+  policyHref: "/privacy.html#cookies"
+};
+var DEFAULT_CONSENT_PALETTE = {
+  bg: "#FFFFFF",
+  fg: "#1F1F1F",
+  accent: "#1F1F1F",
+  accentFg: "#FFFFFF",
+  border: "#E5E5E2"
+};
+function getOrigin(c) {
+  return c.req.header("origin") ?? c.req.header("referer") ?? "";
+}
+function setCorsHeaders(c, origin) {
+  if (origin) c.header("Access-Control-Allow-Origin", origin);
+  c.header("Access-Control-Allow-Credentials", "true");
+  c.header("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
+  c.header("Access-Control-Allow-Headers", "Content-Type");
+  c.header("Vary", "Origin");
+}
+function parseConsent(body) {
+  if (!body || typeof body !== "object") return null;
+  const b = body;
+  if (b.decision !== "yes" && b.decision !== "no") return null;
+  const v = typeof b.v === "string" && b.v.length > 0 && b.v.length <= 2048 ? b.v : null;
+  return { decision: b.decision, v };
+}
+function siteSlugFromReferer(referer) {
+  try {
+    const u = new URL(referer);
+    const parts = u.pathname.split("/").filter(Boolean);
+    return parts[parts.length - 1]?.slice(0, 120) ?? "";
+  } catch {
+    return "";
+  }
+}
+app35.options("/consent", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  return c.body(null, 204);
+});
+app35.options("/brand-config", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  return c.body(null, 204);
+});
+app35.post("/consent", async (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  let raw;
+  try {
+    raw = await c.req.json();
+  } catch {
+    console.error("[consent-error] reason=bad-json");
+    return c.text("Bad Request", 400);
+  }
+  const parsed = parseConsent(raw);
+  if (!parsed) {
+    console.error("[consent-error] reason=bad-body");
+    return c.text("Bad Request", 400);
+  }
+  const referer = c.req.header("referer") ?? "";
+  const site = siteSlugFromReferer(referer);
+  const brand = readBrandConfig();
+  const brandName = brand?.productName ?? "-";
+  const cookies = [];
+  cookies.push(
+    `${CONSENT_COOKIE_NAME}=${parsed.decision}; Max-Age=${CONSENT_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure`
+  );
+  let tokenBound = false;
+  if (parsed.decision === "yes" && parsed.v) {
+    const verify = verifyVisitorToken(parsed.v);
+    if (verify.ok) {
+      cookies.push(
+        `${VISITOR_COOKIE_NAME}=${parsed.v}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
+      );
+      tokenBound = true;
+      console.log(`[token-bind] via=consent site=${site} person=${verify.personId}`);
+    } else {
+      console.error(`[token-bind] reject reason=${verify.reason} via=consent site=${site}`);
+    }
+  }
+  for (const cookie of cookies) c.header("Set-Cookie", cookie, { append: true });
+  console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
+  return c.body(null, 204);
+});
+app35.get("/brand-config", (c) => {
+  const origin = getOrigin(c);
+  setCorsHeaders(c, origin);
+  const brand = readBrandConfig();
+  const consent = brand?.consent ?? {};
+  const copy = { ...DEFAULT_CONSENT_COPY, ...consent.copy ?? {} };
+  const palette = { ...DEFAULT_CONSENT_PALETTE, ...consent.palette ?? {} };
+  c.header("Cache-Control", "public, max-age=300");
+  return c.json({ consent: { copy, palette } });
+});
+var visitor_consent_default = app35;
+
 // server/routes/listings.ts
+function getCookie(headerValue, name) {
+  if (!headerValue) return null;
+  for (const part of headerValue.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === name) return rest.join("=");
+  }
+  return null;
+}
+function appendConsentParams(pageUrl, token) {
+  try {
+    const u = new URL(pageUrl);
+    u.searchParams.set("consent", "needed");
+    u.searchParams.set("v", token);
+    return u.toString();
+  } catch {
+    const hashIdx = pageUrl.indexOf("#");
+    const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
+    const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
+    const sep4 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep4 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+  }
+}
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app35 = new Hono();
-app35.get("/:slug/click", async (c) => {
+var app36 = new Hono();
+app36.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -12441,45 +12591,33 @@ app35.get("/:slug/click", async (c) => {
     console.error(`[property-card-click] reject reason=listing-not-found slug=${slug} sessionKey=${sessionKey} accountId=${account.accountId} status=404`);
     return c.text("Not Found", 404);
   }
+  let redirectUrl = pageUrl;
+  const consentCookie = getCookie(c.req.header("cookie"), CONSENT_COOKIE_NAME);
+  const consented = consentCookie === "yes";
   if (tokenParam) {
     const verify = verifyVisitorToken(tokenParam);
     if (verify.ok) {
-      c.header(
-        "Set-Cookie",
-        `${VISITOR_COOKIE_NAME}=${tokenParam}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
-      );
-      console.log(`[token-bind] sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      if (consented) {
+        c.header(
+          "Set-Cookie",
+          `${VISITOR_COOKIE_NAME}=${tokenParam}; Max-Age=${VISITOR_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Lax; Secure; HttpOnly`
+        );
+        console.log(`[token-bind] sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      } else {
+        redirectUrl = appendConsentParams(pageUrl, tokenParam);
+        console.error(`[token-bind] reject reason=no-consent sessionKey=${sessionKey} person=${verify.personId} listingSlug=${slug}`);
+      }
     } else {
       console.error(`[token-bind] reject reason=${verify.reason} sessionKey=${sessionKey} listingSlug=${slug}`);
     }
   }
-  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
-  return c.redirect(pageUrl, 302);
+  console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
+  return c.redirect(redirectUrl, 302);
 });
-var listings_default = app35;
-
-// app/lib/brand-config.ts
-import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
-import { join as join14 } from "path";
-var cached2 = null;
-var cachedAttempted = false;
-function readBrandConfig() {
-  if (cachedAttempted) return cached2;
-  cachedAttempted = true;
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot) return null;
-  const brandPath = join14(platformRoot, "config", "brand.json");
-  if (!existsSync22(brandPath)) return null;
-  try {
-    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
-    return cached2;
-  } catch {
-    return null;
-  }
-}
+var listings_default = app36;
 
 // server/routes/visitor-event.ts
-var app36 = new Hono();
+var app37 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -12512,7 +12650,7 @@ function parseEvent(body) {
   if (typeof e.ts !== "number" || !Number.isFinite(e.ts)) return null;
   return e;
 }
-function getCookie(c, name) {
+function getCookie2(c, name) {
   const raw = c.req.header("cookie");
   if (!raw) return null;
   for (const part of raw.split(";")) {
@@ -12521,10 +12659,10 @@ function getCookie(c, name) {
   }
   return null;
 }
-function getOrigin(c) {
+function getOrigin2(c) {
   return c.req.header("origin") ?? c.req.header("referer") ?? "";
 }
-function setCorsHeaders(c, origin) {
+function setCorsHeaders2(c, origin) {
   if (origin) c.header("Access-Control-Allow-Origin", origin);
   c.header("Access-Control-Allow-Credentials", "true");
   c.header("Access-Control-Allow-Methods", "POST, OPTIONS");
@@ -12546,14 +12684,14 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app36.options("/event", (c) => {
-  const origin = getOrigin(c);
-  setCorsHeaders(c, origin);
+app37.options("/event", (c) => {
+  const origin = getOrigin2(c);
+  setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app36.post("/event", async (c) => {
-  const origin = getOrigin(c);
-  setCorsHeaders(c, origin);
+app37.post("/event", async (c) => {
+  const origin = getOrigin2(c);
+  setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
   if (BOT_UA_RE.test(ua)) {
     console.error(`[v-event-error] reason=bot-ua ua=${JSON.stringify(ua.slice(0, 120))}`);
@@ -12576,6 +12714,11 @@ app36.post("/event", async (c) => {
     console.error(`[v-event-error] reason=origin-mismatch origin=${JSON.stringify(origin)} ip=${ip}`);
     return c.text("Forbidden", 403);
   }
+  const consentCookie = getCookie2(c, CONSENT_COOKIE_NAME);
+  if (consentCookie !== "yes") {
+    console.log(`[v-event] drop reason=no-consent consent=${consentCookie ?? "absent"} ip=${ip} origin=${JSON.stringify(origin)}`);
+    return c.body(null, 204);
+  }
   let raw;
   try {
     raw = await c.req.json();
@@ -12588,7 +12731,7 @@ app36.post("/event", async (c) => {
     console.error(`[v-event-error] reason=bad-event ip=${ip}`);
     return c.text("Bad Request", 400);
   }
-  const cookieVal = getCookie(c, VISITOR_COOKIE_NAME);
+  const cookieVal = getCookie2(c, VISITOR_COOKIE_NAME);
   let personId = null;
   if (cookieVal) {
     const v = verifyVisitorToken(cookieVal);
@@ -12618,7 +12761,7 @@ app36.post("/event", async (c) => {
     });
   }
   console.log(
-    `[visitor-event] type=${event.type} sessionId=${event.sid} visitorId=${event.vid} personId=${personId ?? "-"} path=${event.path ?? ""} label=${event.label ?? "-"} depth=${event.depth ?? "-"} ms=${event.ms ?? "-"}`
+    `[visitor-event] type=${event.type} sessionId=${event.sid} visitorId=${event.vid} personId=${personId ?? "-"} consent=${consentCookie} path=${event.path ?? ""} label=${event.label ?? "-"} depth=${event.depth ?? "-"} ms=${event.ms ?? "-"}`
   );
   return c.body(null, 204);
 });
@@ -12751,7 +12894,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app36;
+var visitor_event_default = app37;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13188,9 +13331,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app37 = new Hono();
-app37.use("*", clientIpMiddleware);
-app37.use("*", async (c, next) => {
+var app38 = new Hono();
+app38.use("*", clientIpMiddleware);
+app38.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13200,7 +13343,7 @@ app37.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13233,7 +13376,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13273,7 +13416,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app37.post("/__remote-auth/login", async (c) => {
+app38.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13318,7 +13461,7 @@ app37.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app37.get("/__remote-auth/logout", (c) => {
+app38.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13331,7 +13474,7 @@ app37.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app37.post("/__remote-auth/change-password", async (c) => {
+app38.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13382,13 +13525,13 @@ app37.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app37.get("/__remote-auth/setup", (c) => {
+app38.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app37.post("/__remote-auth/set-initial-password", async (c) => {
+app38.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13426,10 +13569,10 @@ app37.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app37.get("/api/remote-auth/status", (c) => {
+app38.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app37.post("/api/remote-auth/set-password", async (c) => {
+app38.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13460,9 +13603,9 @@ app37.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app37.route("/api/_client-error", client_error_default);
+app38.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13495,11 +13638,11 @@ app37.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app37.route("/api/health", health_default);
-app37.route("/api/chat", chat_default);
-app37.route("/api/whatsapp", whatsapp_default);
-app37.route("/api/onboarding", onboarding_default);
-app37.route("/api/admin", admin_default);
+app38.route("/api/health", health_default);
+app38.route("/api/chat", chat_default);
+app38.route("/api/whatsapp", whatsapp_default);
+app38.route("/api/onboarding", onboarding_default);
+app38.route("/api/admin", admin_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13511,7 +13654,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app37.get("/agent-assets/:slug/:filename", (c) => {
+app38.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -13546,7 +13689,7 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app37.get("/generated/:filename", (c) => {
+app38.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13576,9 +13719,10 @@ app37.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app37.route("/sites", sites_default);
-app37.route("/listings", listings_default);
-app37.route("/v", visitor_event_default);
+app38.route("/sites", sites_default);
+app38.route("/listings", listings_default);
+app38.route("/v", visitor_event_default);
+app38.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13715,7 +13859,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app37.get("/", (c) => {
+app38.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13723,12 +13867,12 @@ app37.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app37.get("/public", (c) => {
+app38.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app37.get("/chat", (c) => {
+app38.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13747,9 +13891,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app37.use("/vnc-viewer.html", logViewerFetch);
-app37.use("/vnc-popout.html", logViewerFetch);
-app37.get("/vnc-popout.html", (c) => {
+app38.use("/vnc-viewer.html", logViewerFetch);
+app38.use("/vnc-popout.html", logViewerFetch);
+app38.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync21(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13762,7 +13906,7 @@ app37.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app37.post("/api/vnc/client-event", async (c) => {
+app38.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13783,25 +13927,25 @@ app37.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app37.get("/g/:slug", (c) => {
+app38.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app37.get("/graph", (c) => {
+app38.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app37.get("/sessions", (c) => {
+app38.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app37.get("/data", (c) => {
+app38.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app37.get("/:slug", async (c, next) => {
+app38.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13811,15 +13955,15 @@ app37.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app37.get("/favicon.ico", (c) => {
+  app38.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app37.use("/*", serveStatic({ root: "./public" }));
+app38.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app37.fetch, port, hostname });
+var httpServer = serve({ fetch: app38.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13845,7 +13989,8 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
-  { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default }
+  { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
+  { prefix: "/v", file: "server/routes/visitor-consent.ts", subapp: visitor_consent_default }
 ];
 for (const m of SUBAPP_MANIFEST) {
   const routeCount = Array.isArray(m.subapp.routes) ? m.subapp.routes.length : 0;
@@ -13853,7 +13998,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app37.routes ?? []) {
+  for (const r of app38.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });