@rubytech/create-realagent-code 0.1.117 → 0.1.120

package/payload/premium-plugins/real-agent/plugins/buyers/mcp/src/tools/visitor-recent-by-person.ts

@@ -0,0 +1,65 @@
+// visitor-recent-by-person — list recent :Session activity for a :Person.
+// Walks (Person)-[:VISITED]->(Session)-[:HAS_EVENT]->(*) and returns a
+// chronological summary the morning-round skill folds into its briefing.
+
+import { getSession } from "../lib/neo4j.js";
+
+export interface RecentByPersonParams {
+  accountId: string;
+  personId: string;
+  sinceDays?: number;
+  limit?: number;
+}
+
+export interface SessionSummary {
+  sessionId: string;
+  startedAt: string;
+  lastSeenAt: string;
+  pageviewCount: number;
+  clickCount: number;
+  maxScrollDepth: number;
+  listingSlugs: string[];
+  dwellMs: number;
+}
+
+export async function visitorRecentByPerson(p: RecentByPersonParams): Promise<{ sessions: SessionSummary[] }> {
+  const since = p.sinceDays ?? 30;
+  const limit = Math.max(1, Math.min(p.limit ?? 50, 200));
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (per:Person {accountId: $accountId}) WHERE elementId(per) = $personId
+       MATCH (per)-[:VISITED]->(s:Session)
+       WHERE s.startedAt >= datetime() - duration({days: $since})
+       OPTIONAL MATCH (s)-[:HAS_EVENT]->(pv:PageView)
+       OPTIONAL MATCH (s)-[:HAS_EVENT]->(cl:Click)
+       OPTIONAL MATCH (s)-[:HAS_EVENT]->(sm:ScrollMilestone)
+       OPTIONAL MATCH (pv)-[:OF_LISTING]->(l:Listing)
+       WITH s, count(DISTINCT pv) AS pageviews, count(DISTINCT cl) AS clicks,
+            coalesce(max(sm.maxDepth), 0) AS maxDepth,
+            collect(DISTINCT l.slug) AS slugs,
+            coalesce(sum(pv.dwellMs), 0) AS dwellMs
+       RETURN s.sessionId AS sessionId,
+              toString(s.startedAt) AS startedAt,
+              toString(s.lastSeenAt) AS lastSeenAt,
+              pageviews, clicks, maxDepth, slugs, dwellMs
+       ORDER BY s.lastSeenAt DESC
+       LIMIT $limit`,
+      { accountId: p.accountId, personId: p.personId, since, limit },
+    );
+    return {
+      sessions: result.records.map((r) => ({
+        sessionId: r.get("sessionId"),
+        startedAt: r.get("startedAt"),
+        lastSeenAt: r.get("lastSeenAt"),
+        pageviewCount: Number(r.get("pageviews") ?? 0),
+        clickCount: Number(r.get("clicks") ?? 0),
+        maxScrollDepth: Number(r.get("maxDepth") ?? 0),
+        listingSlugs: (r.get("slugs") ?? []).filter((s: unknown): s is string => typeof s === "string"),
+        dwellMs: Number(r.get("dwellMs") ?? 0),
+      })),
+    };
+  } finally {
+    await session.close();
+  }
+}

package/payload/premium-plugins/real-agent/plugins/buyers/mcp/src/tools/visitor-recommendation-ctr.ts

@@ -0,0 +1,67 @@
+// visitor-recommendation-ctr — graph-backed CTR replacement for the
+// log-scan aggregation that ships with Task 336. Operates on Recommendation
+// nodes (materialised from [property-recommended] log lines via backfill)
+// joined to :Click events. Output schema matches the log-scan tool's so
+// the cutover (separate follow-up task) is a one-line swap.
+
+import { getSession } from "../lib/neo4j.js";
+
+export interface RecommendationCtrParams {
+  accountId: string;
+  /** Days back from now. Defaults to 7. */
+  sinceDays?: number;
+  /** Optional listingSlug filter. */
+  listingSlug?: string;
+}
+
+export interface CtrRow {
+  listingSlug: string;
+  recommended: number;
+  clicked: number;
+  ctr: number;
+}
+
+export interface CtrSummary {
+  windowDays: number;
+  totalRecommended: number;
+  totalClicked: number;
+  ctr: number;
+  perListing: CtrRow[];
+}
+
+export async function visitorRecommendationCtr(p: RecommendationCtrParams): Promise<CtrSummary> {
+  const since = p.sinceDays ?? 7;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (rec:Recommendation {accountId: $accountId})
+       WHERE rec.recommendedAt >= datetime() - duration({days: $since})
+         AND ($slug IS NULL OR rec.listingSlug = $slug)
+       OPTIONAL MATCH (rec)-[:FOR_SESSION]->(s:Session)-[:HAS_EVENT]->(cl:Click {label: 'card'})
+       WITH rec.listingSlug AS slug,
+            count(DISTINCT rec) AS recommended,
+            count(DISTINCT cl) AS clicked
+       RETURN slug AS listingSlug, recommended, clicked,
+              CASE WHEN recommended > 0 THEN toFloat(clicked) / recommended ELSE 0.0 END AS ctr
+       ORDER BY recommended DESC`,
+      { accountId: p.accountId, since, slug: p.listingSlug ?? null },
+    );
+    const perListing: CtrRow[] = result.records.map((r) => ({
+      listingSlug: r.get("listingSlug") ?? "",
+      recommended: Number(r.get("recommended") ?? 0),
+      clicked: Number(r.get("clicked") ?? 0),
+      ctr: Number(r.get("ctr") ?? 0),
+    }));
+    const totalRecommended = perListing.reduce((a, b) => a + b.recommended, 0);
+    const totalClicked = perListing.reduce((a, b) => a + b.clicked, 0);
+    return {
+      windowDays: since,
+      totalRecommended,
+      totalClicked,
+      ctr: totalRecommended > 0 ? totalClicked / totalRecommended : 0,
+      perListing,
+    };
+  } finally {
+    await session.close();
+  }
+}

package/payload/premium-plugins/real-agent/plugins/buyers/mcp/src/tools/visitor-session-detail.ts

@@ -0,0 +1,127 @@
+// visitor-session-detail — full event timeline for one :Session.
+// Operator-side query: "show me everything Sarah did in session abc12".
+
+import { getSession } from "../lib/neo4j.js";
+
+export interface SessionDetailParams {
+  accountId: string;
+  sessionId: string;
+}
+
+export interface SessionEvent {
+  kind: "pageview" | "click" | "scroll";
+  occurredAt: string;
+  /** PageView only */
+  url?: string;
+  path?: string;
+  pageViewId?: string;
+  referrer?: string;
+  dwellMs?: number;
+  /** Click only */
+  label?: string;
+  href?: string;
+  /** Scroll only */
+  maxDepth?: number;
+  /** Optional listing link */
+  listingSlug?: string;
+}
+
+export interface SessionDetail {
+  sessionId: string;
+  startedAt: string | null;
+  lastSeenAt: string | null;
+  personId: string | null;
+  personName: string | null;
+  anonVisitorId: string | null;
+  events: SessionEvent[];
+}
+
+export async function visitorSessionDetail(p: SessionDetailParams): Promise<SessionDetail> {
+  const session = getSession();
+  try {
+    const sessionRes = await session.run(
+      `MATCH (s:Session {accountId: $accountId, sessionId: $sessionId})
+       OPTIONAL MATCH (per:Person)-[:VISITED]->(s)
+       OPTIONAL MATCH (av:AnonVisitor)-[:VISITED]->(s)
+       RETURN toString(s.startedAt) AS startedAt,
+              toString(s.lastSeenAt) AS lastSeenAt,
+              elementId(per) AS personId,
+              per.name AS personName,
+              av.visitorId AS anonVisitorId
+       LIMIT 1`,
+      { accountId: p.accountId, sessionId: p.sessionId },
+    );
+    if (sessionRes.records.length === 0) {
+      return {
+        sessionId: p.sessionId,
+        startedAt: null,
+        lastSeenAt: null,
+        personId: null,
+        personName: null,
+        anonVisitorId: null,
+        events: [],
+      };
+    }
+    const head = sessionRes.records[0];
+
+    const eventsRes = await session.run(
+      `MATCH (s:Session {accountId: $accountId, sessionId: $sessionId})-[:HAS_EVENT]->(e)
+       OPTIONAL MATCH (e)-[:OF_PAGE]->(pg:Page)
+       OPTIONAL MATCH (e)-[:OF_LISTING]->(l:Listing)
+       RETURN labels(e) AS labels,
+              toString(e.occurredAt) AS occurredAt,
+              toString(coalesce(e.firstAt, e.occurredAt)) AS firstAt,
+              e.url AS url,
+              pg.url AS pageUrl,
+              e.path AS path,
+              e.pageViewId AS pageViewId,
+              e.referrer AS referrer,
+              e.dwellMs AS dwellMs,
+              e.label AS label,
+              e.href AS href,
+              e.maxDepth AS maxDepth,
+              l.slug AS listingSlug
+       ORDER BY firstAt ASC`,
+      { accountId: p.accountId, sessionId: p.sessionId },
+    );
+
+    const events: SessionEvent[] = eventsRes.records.map((r) => {
+      const labels = r.get("labels") as string[];
+      const kind: SessionEvent["kind"] = labels.includes("PageView")
+        ? "pageview"
+        : labels.includes("Click")
+          ? "click"
+          : "scroll";
+      const base: SessionEvent = {
+        kind,
+        occurredAt: r.get("occurredAt") ?? r.get("firstAt") ?? "",
+      };
+      if (kind === "pageview") {
+        base.url = r.get("pageUrl") ?? r.get("url") ?? "";
+        base.path = r.get("path") ?? undefined;
+        base.pageViewId = r.get("pageViewId") ?? undefined;
+        base.referrer = r.get("referrer") ?? undefined;
+        base.dwellMs = r.get("dwellMs") != null ? Number(r.get("dwellMs")) : undefined;
+        base.listingSlug = r.get("listingSlug") ?? undefined;
+      } else if (kind === "click") {
+        base.label = r.get("label") ?? "unknown";
+        base.href = r.get("href") ?? undefined;
+      } else {
+        base.maxDepth = r.get("maxDepth") != null ? Number(r.get("maxDepth")) : undefined;
+      }
+      return base;
+    });
+
+    return {
+      sessionId: p.sessionId,
+      startedAt: head.get("startedAt"),
+      lastSeenAt: head.get("lastSeenAt"),
+      personId: head.get("personId"),
+      personName: head.get("personName"),
+      anonVisitorId: head.get("anonVisitorId"),
+      events,
+    };
+  } finally {
+    await session.close();
+  }
+}

package/payload/premium-plugins/real-agent/plugins/buyers/mcp/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src"],
+  "exclude": ["src/**/__tests__/**", "src/**/*.test.ts"]
+}

package/payload/premium-plugins/real-agent/plugins/buyers/skills/property-recommender/SKILL.md

@@ -114,3 +114,14 @@ awk -F'sessionKey=' '/\[property-card-click\]/{split($2,a," "); print a[1]}' ser
 ```
 
 Sessions appearing in the first count but not the second never clicked through. A high uniform zero is the load-bearing alarm — the recommendation is not earning the click. Sessions where `sessionKey=invalid` appears on the click line indicate a malformed `session` query param on the redirect URL (skill template defect); the click still landed but cannot be joined to its fire log.
+
+## Visitor-graph integration (Task 357)
+
+This skill runs on the public chat where the visitor is anonymous by default, so the rendered card link does **not** append a signed `&v=<token>` query parameter. The click still records `[property-card-click]`, but attribution remains anonymous unless the visitor previously clicked a marketing link that bound the `mxy_v` cookie. The `/listings/:slug/click` handler resolves identity from the cookie, not from the card markdown.
+
+Outbound marketing surfaces (the morning-round briefing, the nurture-list outreach, the vendor weekly email) are responsible for minting `&v=<token>` on the URLs they send out, because they know whose `:Person` they're contacting. See `morning-round`, `lead-nurturing`, and `vendor-updates` for that side of the contract.
+
+### Recommendation feedback loop
+
+When a visitor has prior `:Session` activity (cookie identified, or AnonVisitor merged in), memory-search returns `:Person`-attributed visit counts in the `related` array of any prior `:Listing` recommendations. Use `visitor-recent-by-person` (admin-side query, not public-chat) to verify repeat interest before recommending the same listing twice in one session. The principle: a returning visitor who has already viewed a listing three times this week wants a different listing surfaced, not the same one.
+

package/payload/premium-plugins/real-agent/plugins/leads/skills/lead-nurturing/SKILL.md

@@ -135,3 +135,12 @@ Encourage the user to capture:
 - **Neighbour notification letter** → `references/neighbour-notification-letter.md`
 - **Buyer search letter** → `references/buyer-search-letter.md`
 - **Database reactivation** → `references/database-reactivation.md`
+
+## Visitor-graph nurture queue (Task 357)
+
+Call `visitor-engagement-score` with the default 30-day window to rank `:Person` contacts by engagement: visit count × recency × scroll depth × dwell time. The output is the nurture queue. Top of the queue gets outreach today; bottom decays into low-touch.
+
+When composing outbound messages that include a listing URL, append `&v=<token>` to the click URL. The token is minted server-side against the recipient's `:Person` elementId; the agent receives it as a sentinel in the system prompt for that outreach. Without the token the recipient's click is anonymous, defeating the point of the nurture loop.
+
+The signal that says "this person stopped engaging": their score drops two consecutive weeks. That's a prompt for a pattern-break message (different listing, different framing), not a follow-up of the same thread.
+

package/payload/premium-plugins/real-agent/plugins/leads/skills/morning-round/SKILL.md

@@ -70,3 +70,14 @@ The chase-progression workflow uses the same `chain-progression-tracker` skill t
 - `realagent.stalled_threshold_days.broker`
 - `realagent.stalled_threshold_days.surveyor`
 - `realagent.awaiting_reply_lookback_days`
+
+## Visitor-graph briefing (Task 357)
+
+Before the morning round, call `visitor-recent-by-person` for every `:Person` in the active follow-up queue with `sinceDays: 1` to surface overnight activity. Persons with non-empty results land at the top of the briefing — they've been on the site since you last spoke. The briefing line takes the shape:
+
+> _Sarah Chen — viewed Oak Street twice last night, opened the floorplan, scrolled the listing to 75%. Last seen 06:12._
+
+Also call `visitor-recent-by-page` for any listing that picks up activity from previously-unidentified visitors — these are anonymous prospects worth surfacing to the operator even when no `:Person` is attached.
+
+Outbound URLs in the briefing (links the operator might click to send to the contact) are minted via `mint-visitor-token` against the `:Person` and appended as `&v=<token>` to the existing `/listings/<slug>/click?session=<sk>` URL. The token binds the recipient's browser to the `:Person` on click.
+

package/payload/premium-plugins/real-agent/plugins/vendors/skills/vendor-updates/SKILL.md

@@ -151,3 +151,16 @@ Escalate to the agent (human) for:
 - Requests to change agent terms
 - Threats to withdraw instruction
 - Legal or compliance queries
+
+## Visitor-graph for the weekly vendor email (Task 357)
+
+The weekly vendor email reports on viewing activity against the vendor's listing. Pull the numbers via `visitor-recent-by-page` with `listingSlug: <slug>` and `sinceDays: 7`. Report:
+
+- total identified visitors (named `:Person`s) and total anonymous browsers in the window,
+- the count of repeat visitors (the same `:Person` with two or more sessions),
+- max-scroll-depth and average dwell across all PageViews on the listing.
+
+The vendor sees real engagement, not just enquiry count. Tone stays factual — "twelve known visitors and twenty-three anonymous browsers" is honest; "interest is strong" is editorial. Let the numbers speak.
+
+Outbound URLs in vendor emails are NOT tokenised — the vendor is not the visitor, and binding the vendor's browser to their own listing's `:Person` is meaningless.
+

package/payload/server/{chunk-FJCI6X3H.js → chunk-HCYM5FLU.js}

@@ -2705,6 +2705,7 @@ var REMOTE_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "remote-sessio
 var ADMIN_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "admin-session-secret");
 var TELEGRAM_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-webhook-secret");
 var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-admin-webhook-secret");
+var VISITOR_TOKEN_SECRET_FILE = resolve(MAXY_DIR, "credentials", "visitor-token-secret");
 var CLAUDE_CREDENTIALS_FILE = resolve(MAXY_DIR, ".claude", ".credentials.json");
 
 // app/lib/vnc-logger.ts
@@ -5476,6 +5477,7 @@ export {
   USERS_FILE,
   LOG_DIR,
   BIN_DIR,
+  VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
   vncLog,
   newCorrId,

package/payload/server/maxy-edge.js

@@ -13,7 +13,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-FJCI6X3H.js";
+} from "./chunk-HCYM5FLU.js";
 import "./chunk-JSBRDJBE.js";
 
 // server/edge.ts

package/payload/server/public/privacy.html

@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Privacy</title>
+<style>
+  :root { --fg:#222; --bg:#FAFAF8; --muted:#666; --accent:#7C8C72; }
+  * { box-sizing: border-box; }
+  body { font: 16px/1.55 system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; color: var(--fg); background: var(--bg); }
+  main { max-width: 720px; margin: 0 auto; padding: 48px 24px 96px; }
+  h1 { margin-top: 0; font-size: 32px; letter-spacing: -0.01em; }
+  h2 { margin-top: 36px; font-size: 20px; }
+  p, li { color: #333; }
+  ul { padding-left: 20px; }
+  code { background: #eee; padding: 1px 5px; border-radius: 3px; font-size: 13px; }
+  table { border-collapse: collapse; width: 100%; margin: 12px 0; }
+  th, td { border-bottom: 1px solid #ddd; padding: 8px 6px; text-align: left; vertical-align: top; }
+  th { background: #f0f0ee; font-weight: 600; }
+  .muted { color: var(--muted); font-size: 14px; }
+  .accent { color: var(--accent); }
+</style>
+</head>
+<body>
+<main>
+  <h1>Privacy</h1>
+  <p>This page describes the data this site collects about your visit, why, and how to ask for it to be removed.</p>
+
+  <h2>What we collect</h2>
+  <p>When you load a property listing page, a small first-party script (<code>/v.js</code>) records:</p>
+  <table>
+    <thead><tr><th>Field</th><th>Why</th><th>Stored as</th></tr></thead>
+    <tbody>
+      <tr><td>Page URL, page title, referrer</td><td>So we know which listings get visitors and where they came from.</td><td><code>:PageView</code> node</td></tr>
+      <tr><td>Visitor ID (random, browser-local)</td><td>So we can tell two visits from one device apart from two devices.</td><td><code>:AnonVisitor</code> node (anonymous), or linked to a <code>:Person</code> if you arrived via a personalised marketing link.</td></tr>
+      <tr><td>Session ID (random, per tab)</td><td>So one tab's activity stays together.</td><td><code>:Session</code> node</td></tr>
+      <tr><td>Clicks on tagged elements (gallery, floorplan, etc.)</td><td>So we know which parts of a listing get interaction.</td><td><code>:Click</code> node</td></tr>
+      <tr><td>Scroll depth — 25%, 50%, 75%, 100%</td><td>So we know how far you read.</td><td><code>:ScrollMilestone</code> node (one per page view, max depth recorded)</td></tr>
+      <tr><td>Time spent on a page (dwell)</td><td>Same.</td><td>Property of the <code>:PageView</code> node</td></tr>
+    </tbody>
+  </table>
+  <p class="muted">We do not collect: cursor positions, keystrokes, form contents, screen recordings, or anything from third-party tracking networks. The pixel is loaded from the same site as the listing, never from a third party.</p>
+
+  <h2>Cookies</h2>
+  <p>One cookie is set when you arrive via a personalised marketing link from the agent:</p>
+  <ul>
+    <li><code>mxy_v</code> — signed token containing your contact identifier. Set <code>HttpOnly</code>, <code>SameSite=Lax</code>, <code>Secure</code>. Lives for 30 days. Lets the site recognise you on later visits without you clicking the marketing link again.</li>
+  </ul>
+
+  <h2>Cross-session attribution</h2>
+  <p>If you visit anonymously today and later click a personalised marketing link from the agent, prior anonymous visits from the same browser are linked to your contact record. This is the only way an anonymous visit ever becomes named.</p>
+
+  <h2>Retention</h2>
+  <p>Visit data is kept for <strong>180 days</strong> by default, then removed automatically. The operator can change this — your acting agent will tell you the current value if you ask.</p>
+
+  <h2>Right to access and erasure</h2>
+  <p>To see what we hold or to ask for it to be removed, contact the agent. We honour GDPR Article 15 (access) and Article 17 (erasure). Erasure cascades: removing your contact removes every session, page view, click, and scroll milestone tied to your identity. Anonymous page views from browsers we cannot link to you are not removed individually — they cannot be identified, and they expire under the retention window above.</p>
+
+  <h2>Bots and crawlers</h2>
+  <p>Search engines and link checkers are filtered out by user-agent before any data is written. They are also excluded from rate-limit budgets so legitimate visitors are never blocked because a crawler hammered the endpoint.</p>
+
+  <h2>This page</h2>
+  <p class="muted">This is a static description. The behaviour above is implemented in <code>platform/ui/server/routes/visitor-event.ts</code> and <code>platform/ui/public/v.js</code>. The schema is declared in <code>platform/neo4j/schema.cypher</code> under the Visitor Graph section.</p>
+</main>
+</body>
+</html>

package/payload/server/public/v.js

@@ -0,0 +1,191 @@
+/* Visitor-graph pixel (Task 357).
+ *
+ * Single IIFE. Plain JS. No build step. ~3 KB minified.
+ *
+ * Loaded by hosted listing pages:
+ *
+ *   <script defer src="https://<brand>/v.js" data-site="<slug>"></script>
+ *
+ * Emits to POST /v/event:
+ *
+ *   pageview  — once per session per URL (idempotent within 5s for SPA nav)
+ *   click     — DOM clicks on elements with data-track="<label>", or
+ *               anchors flagged data-track-gallery / data-track-floorplan
+ *   scroll    — roll-up: one event per milestone {25,50,75,100} crossed
+ *   dwell     — on visibility change to hidden / pagehide, sendBeacon
+ *
+ * Identity: the server resolves identity from the mxy_v cookie. The pixel
+ * sends visitorId from localStorage (mints one if absent) as a fallback so
+ * cross-tab and same-browser-no-cookie cases still cluster.
+ */
+(function () {
+  if (typeof window === 'undefined' || typeof document === 'undefined') return
+  var script = document.currentScript
+  if (!script) return
+  var siteSlug = script.getAttribute('data-site') || ''
+  var endpoint = new URL('/v/event', script.src).toString()
+
+  var VISITOR_KEY = 'mxy_visitor_id'
+  var SESSION_KEY = 'mxy_session_id'
+  var SESSION_PV_KEY = 'mxy_session_pv'
+  var LAST_PV_KEY = 'mxy_last_pv'
+  var SCROLL_KEY = 'mxy_scroll_depth'
+  var DWELL_KEY = 'mxy_dwell_start'
+
+  function randomId() {
+    if (window.crypto && window.crypto.getRandomValues) {
+      var buf = new Uint8Array(16)
+      window.crypto.getRandomValues(buf)
+      return Array.prototype.map.call(buf, function (b) {
+        return ('0' + b.toString(16)).slice(-2)
+      }).join('')
+    }
+    return String(Date.now()) + '_' + Math.random().toString(36).slice(2, 10)
+  }
+
+  function getVisitorId() {
+    try {
+      var v = localStorage.getItem(VISITOR_KEY)
+      if (v) return v
+      var fresh = randomId()
+      localStorage.setItem(VISITOR_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'noltc-' + randomId()
+    }
+  }
+
+  function getSessionId() {
+    try {
+      var s = sessionStorage.getItem(SESSION_KEY)
+      if (s) return s
+      var fresh = randomId()
+      sessionStorage.setItem(SESSION_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'nots-' + randomId()
+    }
+  }
+
+  var visitorId = getVisitorId()
+  var sessionId = getSessionId()
+
+  function send(payload) {
+    payload.site = siteSlug
+    payload.vid = visitorId
+    payload.sid = sessionId
+    payload.url = location.href
+    payload.path = location.pathname
+    payload.title = (document.title || '').slice(0, 256)
+    payload.ts = Date.now()
+    try {
+      var body = JSON.stringify(payload)
+      if (navigator.sendBeacon) {
+        var blob = new Blob([body], { type: 'application/json' })
+        if (navigator.sendBeacon(endpoint, blob)) return
+      }
+      fetch(endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: body,
+        credentials: 'include',
+        keepalive: true,
+      }).catch(function () { /* fire-and-forget */ })
+    } catch (_e) {
+      /* silently drop — pixel must never break the page */
+    }
+  }
+
+  // ─────────── pageview (idempotent within 5s for SPA nav) ───────────
+  function emitPageview() {
+    try {
+      var last = sessionStorage.getItem(LAST_PV_KEY)
+      if (last) {
+        var parsed = JSON.parse(last)
+        if (parsed && parsed.url === location.href && Date.now() - parsed.ts < 5000) {
+          return
+        }
+      }
+      sessionStorage.setItem(LAST_PV_KEY, JSON.stringify({ url: location.href, ts: Date.now() }))
+      sessionStorage.setItem(SESSION_PV_KEY, randomId()) // PageView id for milestone roll-up
+      sessionStorage.setItem(SCROLL_KEY, '0')
+    } catch (_e) { /* localStorage / sessionStorage disabled */ }
+
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'pageview',
+      pvId: pvId,
+      referrer: document.referrer || '',
+    })
+  }
+
+  // ─────────── click tracking ───────────
+  document.addEventListener('click', function (ev) {
+    var el = ev.target && (ev.target.closest ? ev.target.closest('[data-track]') : null)
+    if (!el) return
+    var label = el.getAttribute('data-track') || 'unknown'
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'click',
+      label: label.slice(0, 64),
+      pvId: pvId,
+      href: el.getAttribute('href') || '',
+    })
+  }, true)
+
+  // ─────────── scroll milestones (roll-up) ───────────
+  var scrollScheduled = false
+  function onScroll() {
+    if (scrollScheduled) return
+    scrollScheduled = true
+    requestAnimationFrame(function () {
+      scrollScheduled = false
+      var doc = document.documentElement
+      var max = Math.max(doc.scrollHeight, document.body.scrollHeight) - window.innerHeight
+      if (max <= 0) return
+      var pct = Math.floor(((window.scrollY || doc.scrollTop) / max) * 100)
+      var threshold = pct >= 100 ? 100 : pct >= 75 ? 75 : pct >= 50 ? 50 : pct >= 25 ? 25 : 0
+      if (threshold === 0) return
+      try {
+        var prev = parseInt(sessionStorage.getItem(SCROLL_KEY) || '0', 10) || 0
+        if (threshold <= prev) return
+        sessionStorage.setItem(SCROLL_KEY, String(threshold))
+      } catch (_e) {}
+      var pvId = ''
+      try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+      send({ type: 'scroll', depth: threshold, pvId: pvId })
+    })
+  }
+  window.addEventListener('scroll', onScroll, { passive: true })
+
+  // ─────────── dwell on unload / visibility change ───────────
+  try { sessionStorage.setItem(DWELL_KEY, String(Date.now())) } catch (_e) {}
+  function emitDwell() {
+    var start = 0
+    try { start = parseInt(sessionStorage.getItem(DWELL_KEY) || '0', 10) || 0 } catch (_e) {}
+    if (!start) return
+    var ms = Date.now() - start
+    if (ms < 250) return // ignore drive-bys
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({ type: 'dwell', ms: ms, pvId: pvId })
+  }
+  document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'hidden') emitDwell()
+  })
+  window.addEventListener('pagehide', emitDwell)
+
+  // SPA navigation hooks — many listing sites are client-routed.
+  var origPushState = history.pushState
+  history.pushState = function () {
+    var r = origPushState.apply(this, arguments)
+    setTimeout(emitPageview, 0)
+    return r
+  }
+  window.addEventListener('popstate', emitPageview)
+
+  // Boot.
+  emitPageview()
+})()