@orion-studios/cms 0.5.3 → 0.5.5

package/dist/{chunk-WQDHEQDE.js → chunk-2BCEB26C.js}

@@ -348,7 +348,6 @@ function FormRenderer({
         return;
       }
       setState("success");
-      funnel("submit");
       onSuccess?.();
     } catch {
       setState("error");

package/dist/{chunk-VPUODCNH.js → chunk-LQTXMLKZ.js}

@@ -241,19 +241,19 @@ function createMemoryRateLimitStore(options) {
   const windowMs = options?.windowMs ?? 6e4;
   const hits = /* @__PURE__ */ new Map();
   return {
-    isLimited(key, now) {
-      const windowStart = now - windowMs;
-      const entries = (hits.get(key) || []).filter((timestamp) => timestamp > windowStart);
-      entries.push(now);
-      hits.set(key, entries);
+    isLimited(key, now, cost = 1) {
+      const normalizedCost = Number.isSafeInteger(cost) && cost > 0 ? cost : max + 1;
+      const existing = hits.get(key);
+      const entry = !existing || now - existing.windowStart >= windowMs ? { windowStart: now, count: normalizedCost } : { ...existing, count: existing.count + normalizedCost };
+      hits.set(key, entry);
       if (hits.size > 1e4) {
-        for (const [entryKey, timestamps] of hits) {
-          if (timestamps.every((timestamp) => timestamp <= windowStart)) {
+        for (const [entryKey, candidate] of hits) {
+          if (now - candidate.windowStart >= windowMs) {
             hits.delete(entryKey);
           }
         }
       }
-      return entries.length > max;
+      return entry.count > max;
     }
   };
 }

package/dist/forms/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FormConfig, a as FormFieldConfig, b as FormNotifyConfig, H as HONEYPOT_FIELD_NAME, P as ProcessSubmissionArgs, c as ProcessSubmissionResult, R as RateLimitStore, d as createMemoryRateLimitStore, p as processSubmission } from '../submission-BKdBedOe.js';
+export { F as FormConfig, a as FormFieldConfig, b as FormNotifyConfig, H as HONEYPOT_FIELD_NAME, P as ProcessSubmissionArgs, c as ProcessSubmissionResult, R as RateLimitStore, d as createMemoryRateLimitStore, p as processSubmission } from '../submission-D_x2qNJl.js';
 
 /**
  * Shared, isomorphic form validation and normalization.

package/dist/forms/index.js

@@ -16,7 +16,7 @@ import {
   validatePhoneUS,
   validateRequired,
   validateUrl
-} from "../chunk-VPUODCNH.js";
+} from "../chunk-LQTXMLKZ.js";
 export {
   FORM_FIELD_TYPES,
   HONEYPOT_FIELD_NAME,

package/dist/forms/react.js

@@ -2,7 +2,7 @@
 "use client";
 import {
   FormRenderer
-} from "../chunk-WQDHEQDE.js";
+} from "../chunk-2BCEB26C.js";
 export {
   FormRenderer
 };

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
 import { SupabaseClient } from '@supabase/supabase-js';
 import { BlockRegistry, PageLayout } from '../blocks/index.js';
-import { F as FormConfig, R as RateLimitStore } from '../submission-BKdBedOe.js';
+import { F as FormConfig, R as RateLimitStore } from '../submission-D_x2qNJl.js';
 export { CONTENT_CACHE_TAG } from '../content/index.js';
 import 'react';
 import 'zod';
@@ -69,6 +69,16 @@ type CmsRoutesOptions = {
     maxUploadBytes?: number;
     /** Days of raw analytics events to keep (default 90). */
     analyticsRetentionDays?: number;
+    /** Optional stricter public analytics budgets. Values cannot raise defaults. */
+    analyticsLimits?: Partial<{
+        requestsPerMinute: number;
+        siteRequestsPerMinute: number;
+        siteRequestsPerDay: number;
+        clientEventsPerMinute: number;
+        clientEventsPerDay: number;
+        siteEventsPerMinute: number;
+        siteEventsPerDay: number;
+    }>;
     /**
      * Dev-only: uploads are stored as data URLs instead of Supabase Storage so
      * the memory backend can serve them. Never enable in production.
@@ -92,6 +102,7 @@ declare function createDurableRateLimitStore(getClient: () => SupabaseClient, op
     max?: number;
     windowMs?: number;
     bucket?: string;
+    failClosed?: boolean;
 }): RateLimitStore;
 declare function createCmsRoutes(options: CmsRoutesOptions): {
     GET: (request: Request, context: RouteContext) => Promise<Response>;
@@ -123,8 +134,9 @@ declare function getPreviewPage(client: SupabaseClient, token: string, secret: s
  * out. Isomorphic and dependency-free so the same code serves the Supabase
  * and memory backends and is trivially testable.
  *
- * Conversion = a call tap, a form submission, or an email click. A session
- * "converted" when it contains at least one conversion event.
+ * Call and email taps are useful interaction counts, but browser events are
+ * forgeable. A conversion requires a server-verified event, currently a form
+ * submission recorded after the authoritative lead write succeeds.
  */
 type StoredEvent = {
     id?: number | string;
@@ -139,6 +151,7 @@ type StoredEvent = {
     region: string;
     city: string;
     meta: Record<string, unknown> | null;
+    server_verified?: boolean;
     created_at: string;
 };
 type AnalyticsKpis = {

package/dist/server/index.js

@@ -1,11 +1,11 @@
-import {
-  CONTENT_CACHE_TAG
-} from "../chunk-AYV6KYDP.js";
 import {
   createMemoryRateLimitStore,
   isOriginAllowed,
   processSubmission
-} from "../chunk-VPUODCNH.js";
+} from "../chunk-LQTXMLKZ.js";
+import {
+  CONTENT_CACHE_TAG
+} from "../chunk-AYV6KYDP.js";
 
 // src/server/routes.ts
 import { createHash as createHash2 } from "crypto";
@@ -38,7 +38,7 @@ function normalizeSource(utmSource, referrer) {
   if (host.includes("twitter.") || host === "t.co" || host.includes("x.com")) return "X (Twitter)";
   return host;
 }
-var isConversion = (event) => event.type === "click" && CONVERSION_NAMES.has(event.name) || event.type === "form" && event.name.endsWith(":submit");
+var isConversion = (event) => event.server_verified === true && (event.type === "click" && CONVERSION_NAMES.has(event.name) || event.type === "form" && event.name.endsWith(":submit"));
 var top = (map, limit, by) => [...map.entries()].sort((a, b) => by(b[1]) - by(a[1])).slice(0, limit);
 function computeKpis(events) {
   const sessions = /* @__PURE__ */ new Set();
@@ -63,10 +63,12 @@ function computeKpis(events) {
     if (event.type === "click" && event.name === "call") calls += 1;
     if (event.type === "click" && event.name === "email") emails += 1;
     if (event.type === "click" && event.name === "portal") portalClicks += 1;
-    if (event.type === "form" && event.name.endsWith(":submit")) formSubmits += 1;
+    if (event.server_verified === true && event.type === "form" && event.name.endsWith(":submit")) {
+      formSubmits += 1;
+    }
     if (isConversion(event) && event.session_key) converting.add(event.session_key);
   }
-  const conversions = calls + formSubmits + emails;
+  const conversions = events.filter(isConversion).length;
   const returningVisitors = [...visitorSessions.values()].filter((keys) => keys.size > 1).length;
   return {
     visitors: visitors.size,
@@ -173,7 +175,7 @@ function aggregateAnalytics(events, previousEvents, range) {
     const entry = forms.get(slug) || { views: 0, starts: 0, submits: 0 };
     if (stage === "view") entry.views += 1;
     if (stage === "start") entry.starts += 1;
-    if (stage === "submit") entry.submits += 1;
+    if (stage === "submit" && event.server_verified === true) entry.submits += 1;
     forms.set(slug, entry);
   }
   const notFound = /* @__PURE__ */ new Map();
@@ -389,7 +391,7 @@ var MIN_ROLE = {
   "pages.delete": "admin",
   "pages.restore": "editor",
   "globals.read": "content",
-  "globals.write": "content",
+  "globals.write": "editor",
   "media.read": "content",
   "media.upload": "content",
   "media.update": "content",
@@ -506,6 +508,11 @@ async function resolveUser(request, client = getServiceClient()) {
 
 // src/server/sync.ts
 var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var publicFormConfig = (value) => {
+  const config = isRecord(value) ? { ...value } : {};
+  delete config.notify;
+  return config;
+};
 var mimeByExtension = {
   avif: "image/avif",
   gif: "image/gif",
@@ -629,7 +636,7 @@ async function runContentSync(client, registry, input) {
       {
         slug: form.slug,
         title: typeof form.title === "string" ? form.title : form.slug,
-        config: isRecord(form.config) ? form.config : {},
+        config: publicFormConfig(form.config),
         success_message: typeof form.successMessage === "string" ? form.successMessage : "",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
@@ -663,16 +670,32 @@ var errors = {
 var isRecord2 = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
 var SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var PATH_PATTERN = /^\/(?:[a-z0-9-]+(?:\/[a-z0-9-]+)*)?$/;
+var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var canonicalizeUserId = (value) => USER_ID_PATTERN.test(value) ? value.toLowerCase() : null;
 var DEFAULT_MAX_UPLOAD_BYTES = 15 * 1024 * 1024;
-var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/gif",
-  "image/avif",
-  "image/svg+xml",
-  "application/pdf"
-]);
+var UPLOAD_RULES = {
+  "image/jpeg": {
+    extensions: ["jpg", "jpeg"],
+    decodedFormat: "jpeg"
+  },
+  "image/png": {
+    extensions: ["png"],
+    decodedFormat: "png"
+  },
+  "image/webp": {
+    extensions: ["webp"],
+    decodedFormat: "webp"
+  },
+  "image/gif": {
+    extensions: ["gif"],
+    decodedFormat: "gif"
+  },
+  "image/avif": {
+    extensions: ["avif"],
+    decodedFormat: "heif"
+  }
+};
+var uploadExtension = (filename) => filename.split(".").pop()?.toLowerCase() || "";
 async function readJson(request) {
   try {
     const parsed = await request.json();
@@ -733,22 +756,36 @@ async function readJsonLimited(request, limits) {
   return parsed;
 }
 var hashedClientKey = (ip) => createHash2("sha256").update(ip).digest("hex").slice(0, 24);
+var requestPagePath = (request) => {
+  const referrer = request.headers.get("referer");
+  if (!referrer) return "";
+  try {
+    const page = new URL(referrer);
+    if (page.origin !== new URL(request.url).origin) return "";
+    return PATH_PATTERN.test(page.pathname) ? page.pathname : "";
+  } catch {
+    return "";
+  }
+};
 function createDurableRateLimitStore(getClient, options) {
   const max = options?.max ?? 5;
   const windowSeconds = Math.max(1, Math.round((options?.windowMs ?? 6e4) / 1e3));
   const bucket = options?.bucket ?? "default";
+  const failClosed = options?.failClosed === true;
   return {
-    async isLimited(key) {
+    async isLimited(key, _now, cost = 1) {
       try {
-        const { data, error } = await getClient().rpc("cms_rate_limit_consume", {
+        const args = {
           p_key: `${bucket}:${key}`,
           p_max: max,
           p_window_seconds: windowSeconds
-        });
-        if (error) return false;
-        return data === false;
+        };
+        if (cost !== 1) args.p_cost = cost;
+        const { data, error } = await getClient().rpc("cms_rate_limit_consume", args);
+        if (error) return failClosed;
+        return failClosed ? data !== true : data === false;
       } catch {
-        return false;
+        return failClosed;
       }
     }
   };
@@ -764,7 +801,48 @@ function createCmsRoutes(options) {
     if (hostedMemoryMode) return "";
     return options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
   };
-  const eventsRateLimit = options.memoryMode ? createMemoryRateLimitStore({ max: 120, windowMs: 6e4 }) : createDurableRateLimitStore(db, { max: 120, windowMs: 6e4, bucket: "events" });
+  const analyticsLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
+  const boundedAnalyticsMax = (name, fallback) => {
+    const candidate = options.analyticsLimits?.[name];
+    return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? Math.min(candidate, fallback) : fallback;
+  };
+  const analyticsLimits = {
+    siteRequestsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("siteRequestsPerMinute", 300),
+      6e4,
+      "events-site-request-minute"
+    ),
+    siteRequestsPerDay: analyticsLimit(
+      boundedAnalyticsMax("siteRequestsPerDay", 2e4),
+      864e5,
+      "events-site-request-day"
+    ),
+    requestsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("requestsPerMinute", 60),
+      6e4,
+      "events-request-minute"
+    ),
+    clientEventsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("clientEventsPerMinute", 120),
+      6e4,
+      "events-client-minute"
+    ),
+    clientEventsPerDay: analyticsLimit(
+      boundedAnalyticsMax("clientEventsPerDay", 1e3),
+      864e5,
+      "events-client-day"
+    ),
+    siteEventsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("siteEventsPerMinute", 2e3),
+      6e4,
+      "events-site-minute"
+    ),
+    siteEventsPerDay: analyticsLimit(
+      boundedAnalyticsMax("siteEventsPerDay", 5e4),
+      864e5,
+      "events-site-day"
+    )
+  };
   const analyticsRetentionDays = options.analyticsRetentionDays ?? 90;
   const requestSessionKey = (request) => {
     const secret = previewSecret() || "orion-analytics";
@@ -1156,15 +1234,56 @@ function createCmsRoutes(options) {
     if (error) return errors.badRequest(error.message);
     return json({ media: data });
   };
-  const validateUpload = (file) => {
+  const prepareUpload = async (file, target) => {
     if (file.size > maxUploadBytes) {
       return `File is too large (max ${Math.round(maxUploadBytes / 1024 / 1024)} MB).`;
     }
     const type = file.type || "";
-    if (!ALLOWED_UPLOAD_TYPES.has(type)) {
-      return "Unsupported file type. Allowed: images (JPEG, PNG, WebP, GIF, AVIF, SVG) and PDF.";
+    const rule = UPLOAD_RULES[type];
+    if (!rule) {
+      return "Unsupported file type. Allowed: JPEG, PNG, WebP, GIF, and AVIF images.";
+    }
+    const extension = uploadExtension(file.name);
+    if (!rule.extensions.includes(extension)) {
+      return "File extension does not match its declared type.";
+    }
+    if (target) {
+      const knownTargetType = Boolean(UPLOAD_RULES[target.mimeType]);
+      const pathMatches = target.path.startsWith("data:") || rule.extensions.includes(uploadExtension(target.path));
+      if (knownTargetType && target.mimeType !== type || !knownTargetType && !pathMatches) {
+        return "Replacement files must use the same format as the stored file.";
+      }
+    }
+    try {
+      const { default: sharp } = await import("sharp");
+      const input = Buffer.from(await file.arrayBuffer());
+      const image = sharp(input, {
+        animated: type === "image/gif",
+        failOn: "error",
+        limitInputPixels: 4e7
+      });
+      const metadata = await image.metadata();
+      const width = metadata.width || 0;
+      const height = metadata.height || 0;
+      const pages = metadata.pages || 1;
+      if (metadata.format !== rule.decodedFormat || width < 1 || height < 1 || width * height * pages > 4e7) {
+        return "File contents do not match its declared type.";
+      }
+      const normalized = type === "image/jpeg" ? await image.rotate().jpeg({ quality: 90 }).toBuffer() : type === "image/png" ? await image.rotate().png().toBuffer() : type === "image/webp" ? await image.rotate().webp({ quality: 90 }).toBuffer() : type === "image/gif" ? await image.rotate().gif().toBuffer() : await image.rotate().avif({ quality: 60 }).toBuffer();
+      if (normalized.byteLength > maxUploadBytes) {
+        return `Normalized file is too large (max ${Math.round(maxUploadBytes / 1024 / 1024)} MB).`;
+      }
+      return {
+        file: new File([Uint8Array.from(normalized)], file.name, {
+          type,
+          lastModified: file.lastModified
+        }),
+        width,
+        height
+      };
+    } catch {
+      return "File contents do not match its declared type.";
     }
-    return null;
   };
   const uploadMedia = async (request) => {
     const auth = await guard(request, "media.upload");
@@ -1172,35 +1291,32 @@ function createCmsRoutes(options) {
     const form = await request.formData().catch(() => null);
     const file = form?.get("file");
     if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
-    const invalid = validateUpload(file);
-    if (invalid) return errors.badRequest(invalid);
+    const prepared = await prepareUpload(file);
+    if (typeof prepared === "string") return errors.badRequest(prepared);
+    const normalizedFile = prepared.file;
     const safeName = file.name.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
     let storagePath = `${Date.now().toString(36)}-${safeName}`;
     if (options.memoryMode) {
-      const buffer = Buffer.from(await file.arrayBuffer());
-      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
-    } else {
-      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, { contentType: file.type || "application/octet-stream" });
-      if (storageError) return errors.badRequest(storageError.message);
+      const buffer = Buffer.from(await normalizedFile.arrayBuffer());
+      storagePath = `data:${normalizedFile.type};base64,${buffer.toString("base64")}`;
     }
-    const uploadedToStorage = !options.memoryMode;
-    const width = Number(form.get("width")) || null;
-    const height = Number(form.get("height")) || null;
     const { data, error } = await db().from("cms_media").insert({
       storage_path: storagePath,
       filename: safeName,
       alt: String(form.get("alt") || ""),
       caption: String(form.get("caption") || ""),
-      mime_type: file.type || "",
-      width,
-      height,
-      filesize: file.size
+      mime_type: normalizedFile.type,
+      width: prepared.width,
+      height: prepared.height,
+      filesize: normalizedFile.size
     }).select("*").single();
-    if (error) {
-      if (uploadedToStorage) {
-        await db().storage.from("media").remove([storagePath]).catch(() => void 0);
+    if (error) return errors.badRequest(error.message);
+    if (!options.memoryMode) {
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, normalizedFile, { contentType: normalizedFile.type });
+      if (storageError) {
+        await db().from("cms_media").delete().eq("id", data.id);
+        return errors.badRequest(storageError.message);
       }
-      return errors.badRequest(error.message);
     }
     await logActivity(auth.user, "media.upload", safeName);
     return json({ media: data }, 201);
@@ -1246,27 +1362,29 @@ function createCmsRoutes(options) {
     const form = await request.formData().catch(() => null);
     const file = form?.get("file");
     if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
-    const invalid = validateUpload(file);
-    if (invalid) return errors.badRequest(invalid);
+    const prepared = await prepareUpload(file, {
+      path: String(doc.storage_path),
+      mimeType: String(doc.mime_type || "")
+    });
+    if (typeof prepared === "string") return errors.badRequest(prepared);
+    const normalizedFile = prepared.file;
     let storagePath = String(doc.storage_path);
     if (options.memoryMode) {
-      const buffer = Buffer.from(await file.arrayBuffer());
-      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
+      const buffer = Buffer.from(await normalizedFile.arrayBuffer());
+      storagePath = `data:${normalizedFile.type};base64,${buffer.toString("base64")}`;
     } else {
-      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, {
-        contentType: file.type || "application/octet-stream",
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, normalizedFile, {
+        contentType: normalizedFile.type,
         upsert: true
       });
       if (storageError) return errors.badRequest(storageError.message);
     }
-    const width = Number(form.get("width")) || null;
-    const height = Number(form.get("height")) || null;
     const { data, error } = await db().from("cms_media").update({
       storage_path: storagePath,
-      mime_type: file.type || "",
-      filesize: file.size,
-      width,
-      height,
+      mime_type: normalizedFile.type,
+      filesize: normalizedFile.size,
+      width: prepared.width,
+      height: prepared.height,
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).eq("id", id).select("*").single();
     if (error) return errors.badRequest(error.message);
@@ -1284,11 +1402,17 @@ function createCmsRoutes(options) {
     if (usage.length > 0 && !force) {
       return errors.conflict("This file is used on pages.", { usage });
     }
+    const storagePath = String(doc.storage_path);
+    if (!storagePath.startsWith("data:") && !storagePath.startsWith("/")) {
+      try {
+        const { error: storageError } = await db().storage.from("media").remove([storagePath]);
+        if (storageError) return errors.badRequest(storageError.message);
+      } catch (error2) {
+        return errors.badRequest(error2 instanceof Error ? error2.message : "Unable to remove stored file.");
+      }
+    }
     const { error } = await db().from("cms_media").delete().eq("id", id);
     if (error) return errors.badRequest(error.message);
-    if (!String(doc.storage_path).startsWith("data:")) {
-      await db().storage.from("media").remove([doc.storage_path]).catch(() => void 0);
-    }
     await logActivity(auth.user, "media.delete", String(doc.filename));
     return json({ success: true });
   };
@@ -1518,6 +1642,23 @@ function createCmsRoutes(options) {
       session_key: requestSessionKey(request)
     }).select("id").single();
     if (error) return errors.badRequest(error.message);
+    try {
+      const userAgent = request.headers.get("user-agent") || "";
+      await db().from("cms_events").insert({
+        session_key: requestSessionKey(request),
+        visitor_key: "",
+        type: "form",
+        name: `${form.slug}:submit`,
+        path: requestPagePath(request),
+        referrer: "",
+        utm: {},
+        device: deviceFrom(userAgent),
+        ...geoFrom(request),
+        meta: {},
+        server_verified: true
+      });
+    } catch {
+    }
     if (sendEmail) {
       await notifySubmission({
         sendEmail,
@@ -1569,11 +1710,17 @@ function createCmsRoutes(options) {
     if (!isOriginAllowed(request, allowedOrigins)) return errors.forbidden();
     const userAgent = request.headers.get("user-agent") || "";
     if (isBotRequest(userAgent)) return json({ success: true });
+    const now = Date.now();
+    if (await analyticsLimits.siteRequestsPerMinute.isLimited("all", now) || await analyticsLimits.siteRequestsPerDay.isLimited("all", now)) {
+      return json({ success: true });
+    }
     const key = hashedClientKey(clientKey(request));
-    if (await eventsRateLimit.isLimited(key, Date.now())) return json({ success: true });
+    if (await analyticsLimits.requestsPerMinute.isLimited(key, now)) {
+      return json({ success: true });
+    }
     const body = await readJsonLimited(request, { maxBytes: 128 * 1024, maxDepth: 8 });
     if (!body) return json({ success: true });
-    const { rows } = parseEventBatch(body, {
+    const parsed = parseEventBatch(body, {
       sessionKey: requestSessionKey(request),
       visitorKey: visitorKeyFor(
         body?.visitorId,
@@ -1582,9 +1729,25 @@ function createCmsRoutes(options) {
       device: deviceFrom(userAgent),
       ...geoFrom(request)
     });
+    const rows = parsed.rows.filter(
+      (row) => !(row.type === "form" && row.name.endsWith(":submit"))
+    );
     if (rows.length > 0) {
+      const limitChecks = [
+        [analyticsLimits.clientEventsPerMinute, key],
+        [analyticsLimits.clientEventsPerDay, key],
+        [analyticsLimits.siteEventsPerMinute, "all"],
+        [analyticsLimits.siteEventsPerDay, "all"]
+      ];
+      for (const [limit, limitKey] of limitChecks) {
+        if (await limit.isLimited(limitKey, now, rows.length)) {
+          return json({ success: true });
+        }
+      }
       try {
-        await db().from("cms_events").insert(rows);
+        await db().from("cms_events").insert(
+          rows.map((row) => ({ ...row, server_verified: false }))
+        );
       } catch {
       }
     }
@@ -1594,7 +1757,7 @@ function createCmsRoutes(options) {
     const all = [];
     let cursor = 0;
     for (let page = 0; page < 60; page += 1) {
-      const { data, error } = await db().from("cms_events").select("id, session_key, type, name, path, referrer, utm, device, region, city, meta, created_at").gte("created_at", fromIso).lte("created_at", toIso).gt("id", cursor).order("id", { ascending: true }).limit(1e3);
+      const { data, error } = await db().from("cms_events").select("id, session_key, type, name, path, referrer, utm, device, region, city, meta, server_verified, created_at").gte("created_at", fromIso).lte("created_at", toIso).gt("id", cursor).order("id", { ascending: true }).limit(1e3);
       if (error || !data || data.length === 0) break;
       all.push(...data);
       cursor = Number(data[data.length - 1].id);
@@ -1621,8 +1784,10 @@ function createCmsRoutes(options) {
   };
   const pruneEvents = async () => {
     const cutoff = new Date(Date.now() - analyticsRetentionDays * 864e5).toISOString();
+    const limitCutoff = new Date(Date.now() - 2 * 864e5).toISOString();
     try {
       await db().from("cms_events").delete().lt("created_at", cutoff);
+      await db().rpc("cms_prune_rate_limits", { p_before: limitCutoff });
     } catch {
     }
   };
@@ -1706,23 +1871,30 @@ function createCmsRoutes(options) {
   const listUsers = async (request) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
-    const { data: authData, error: authError } = await db().auth.admin.listUsers({ perPage: 1e3 });
-    if (authError) return errors.badRequest(authError.message);
     const { data: profiles, error: profileError } = await db().from("cms_profiles").select("user_id, role, name");
     if (profileError) return errors.badRequest(profileError.message);
-    const roleById = new Map(
-      (profiles || []).map((profile) => [profile.user_id, profile])
-    );
-    const users = authData.users.map((user) => {
-      const profile = roleById.get(user.id);
-      return {
+    const profileById = /* @__PURE__ */ new Map();
+    for (const profile of profiles || []) {
+      const userId = typeof profile.user_id === "string" ? canonicalizeUserId(profile.user_id) : null;
+      if (!userId || !isCmsRole(profile.role)) continue;
+      profileById.set(userId, {
+        role: profile.role,
+        name: typeof profile.name === "string" ? profile.name : ""
+      });
+    }
+    const { data: authData, error: authError } = await db().auth.admin.listUsers({ perPage: 1e3 });
+    if (authError) return errors.badRequest(authError.message);
+    const users = authData.users.flatMap((user) => {
+      const canonicalUserId = canonicalizeUserId(user.id);
+      const profile = canonicalUserId ? profileById.get(canonicalUserId) : void 0;
+      return profile ? [{
         id: user.id,
         email: user.email ?? null,
-        name: profile?.name || "",
-        role: profile?.role ?? null,
+        name: profile.name,
+        role: profile.role,
         created_at: user.created_at ?? null,
         last_sign_in_at: user.last_sign_in_at ?? null
-      };
+      }] : [];
     });
     return json({ users, assignableRoles: assignableRoles(auth.user.role) });
   };
@@ -1757,20 +1929,31 @@ function createCmsRoutes(options) {
     await logActivity(auth.user, "user.create", email);
     return json({ user: { id: userId, email, name, role } }, 201);
   };
-  const targetRole = async (userId) => {
-    const { data } = await db().from("cms_profiles").select("role").eq("user_id", userId).maybeSingle();
-    return data?.role ?? null;
+  const loadMembership = async (userId) => {
+    const { data, error } = await db().from("cms_profiles").select("role").eq("user_id", userId).maybeSingle();
+    if (error) return { status: "query-error", message: error.message };
+    if (!data) return { status: "missing" };
+    if (!isCmsRole(data.role)) return { status: "invalid-role" };
+    return { status: "valid", role: data.role };
+  };
+  const membershipError = (membership) => {
+    if (membership.status === "missing") return errors.notFound();
+    if (membership.status === "invalid-role") return errors.badRequest("Invalid CMS profile role.");
+    return errors.badRequest(membership.message);
   };
   const updateUser = async (request, userId) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
+    const canonicalUserId = canonicalizeUserId(userId);
+    if (!canonicalUserId) return errors.badRequest("Invalid user ID.");
     const body = await readJson(request);
     if (!body) return errors.badRequest("Invalid body.");
-    const current = await targetRole(userId);
-    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
+    const membership = await loadMembership(canonicalUserId);
+    if (membership.status !== "valid") return membershipError(membership);
+    if (!outranksOrEqual(auth.user.role, membership.role)) return errors.forbidden();
     if (body.role !== void 0) {
       if (!isCmsRole(body.role)) return errors.badRequest("Invalid role.");
-      if (userId === auth.user.id && body.role !== auth.user.role) {
+      if (canonicalUserId === auth.user.id && body.role !== auth.user.role) {
         return errors.badRequest("You can't change your own role.");
       }
       if (!outranksOrEqual(auth.user.role, body.role)) {
@@ -1779,32 +1962,37 @@ function createCmsRoutes(options) {
     }
     if (typeof body.password === "string") {
       if (body.password.length < 8) return errors.badRequest("Password must be at least 8 characters.");
-      const { error: passwordError } = await db().auth.admin.updateUserById(userId, {
+      const { error: passwordError } = await db().auth.admin.updateUserById(canonicalUserId, {
         password: body.password
       });
       if (passwordError) return errors.badRequest(passwordError.message);
     }
     if (body.role !== void 0 || typeof body.name === "string") {
-      const patch = { user_id: userId };
+      const patch = {};
       if (body.role !== void 0) patch.role = body.role;
       if (typeof body.name === "string") patch.name = body.name.trim();
-      const { error: profileError } = await db().from("cms_profiles").upsert(patch, { onConflict: "user_id" });
+      const { error: profileError } = await db().from("cms_profiles").update(patch).eq("user_id", canonicalUserId);
       if (profileError) return errors.badRequest(profileError.message);
     }
-    await logActivity(auth.user, "user.update", userId);
+    await logActivity(auth.user, "user.update", canonicalUserId);
     return json({ success: true });
   };
   const deleteUser = async (request, userId) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
-    if (userId === auth.user.id) return errors.badRequest("You can't remove your own account.");
-    const current = await targetRole(userId);
-    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
-    const { error: authError } = await db().auth.admin.deleteUser(userId);
+    const canonicalUserId = canonicalizeUserId(userId);
+    if (!canonicalUserId) return errors.badRequest("Invalid user ID.");
+    const membership = await loadMembership(canonicalUserId);
+    if (membership.status !== "valid") return membershipError(membership);
+    if (canonicalUserId === auth.user.id) {
+      return errors.badRequest("You can't remove your own account.");
+    }
+    if (!outranksOrEqual(auth.user.role, membership.role)) return errors.forbidden();
+    const { error: authError } = await db().auth.admin.deleteUser(canonicalUserId);
     if (authError) return errors.badRequest(authError.message);
-    const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", userId);
+    const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", canonicalUserId);
     if (profileError) return errors.badRequest(profileError.message);
-    await logActivity(auth.user, "user.delete", userId);
+    await logActivity(auth.user, "user.delete", canonicalUserId);
     return json({ success: true });
   };
   const runSync = async (request) => {
@@ -2237,7 +2425,11 @@ function runRpc(store, fn, args = {}) {
       const limits = store.table("cms_rate_limits");
       const key = String(args.p_key);
       const max = Number(args.p_max);
+      const cost = args.p_cost === void 0 ? 1 : Number(args.p_cost);
       const windowMs = Number(args.p_window_seconds) * 1e3;
+      if (!Number.isSafeInteger(cost) || cost < 1 || cost > max) {
+        return { data: false, error: null };
+      }
       const nowMs = Date.now();
       let row = limits.find((r) => r.key === key);
       if (!row) {
@@ -2246,12 +2438,22 @@ function runRpc(store, fn, args = {}) {
       }
       if (nowMs - Number(row.window_start) >= windowMs) {
         row.window_start = nowMs;
-        row.count = 1;
+        row.count = cost;
       } else {
-        row.count = Number(row.count) + 1;
+        row.count = Number(row.count) + cost;
       }
       return { data: Number(row.count) <= max, error: null };
     }
+    case "cms_prune_rate_limits": {
+      const before = Date.parse(String(args.p_before));
+      const limits = store.table("cms_rate_limits");
+      const kept = limits.filter((row) => {
+        const started = typeof row.window_start === "number" ? row.window_start : Date.parse(String(row.window_start));
+        return !Number.isFinite(before) || !Number.isFinite(started) || started >= before;
+      });
+      store.setTable("cms_rate_limits", kept);
+      return { data: limits.length - kept.length, error: null };
+    }
     case "cms_publish_due_pages": {
       const nowMs = Date.now();
       const published = [];

package/dist/studio/index.js

@@ -3,7 +3,7 @@
 import {
   FORM_FIELD_TYPES,
   FormRenderer
-} from "../chunk-WQDHEQDE.js";
+} from "../chunk-2BCEB26C.js";
 
 // src/studio/Studio.tsx
 import { useCallback as useCallback5, useEffect as useEffect11, useMemo as useMemo5, useState as useState12 } from "react";
@@ -149,7 +149,7 @@ var MIN_ROLE = {
   "pages.delete": "admin",
   "pages.restore": "editor",
   "globals.read": "content",
-  "globals.write": "content",
+  "globals.write": "editor",
   "media.read": "content",
   "media.upload": "content",
   "media.update": "content",
@@ -179,13 +179,14 @@ var SECTION_ACTION = {
   forms: "forms.read",
   submissions: "submissions.read",
   analytics: "analytics.read",
-  globals: "globals.read",
+  globals: "globals.write",
   redirects: "redirects.manage",
   users: "users.manage"
 };
 var userForRole = (role) => ({ id: "", email: null, name: "", role });
 var studioCan = (role, action) => can(userForRole(role), action);
 var canViewStudioSection = (role, section) => studioCan(role, SECTION_ACTION[section]);
+var resolveStudioSection = (role, section) => role && canViewStudioSection(role, section) ? section : "dashboard";
 var studioAccess = (role) => ({
   changePageStructure: studioCan(role, "pages.changeStructure"),
   publishPages: studioCan(role, "pages.publish"),
@@ -3378,7 +3379,7 @@ function MediaView({
           /* @__PURE__ */ jsx11(
             "input",
             {
-              accept: "image/*,application/pdf",
+              accept: "image/jpeg,image/png,image/webp,image/gif,image/avif",
               hidden: true,
               onChange: async (event) => {
                 const file = event.currentTarget.files?.[0];
@@ -3492,12 +3493,12 @@ function MediaDetail({
           children: saving ? "Saving\u2026" : "Save details"
         }
       ),
-      canReplace ? /* @__PURE__ */ jsxs11("label", { className: "ost-btn", title: "The new file keeps every existing reference. CDN caching can take up to an hour to show the new version everywhere.", children: [
+      canReplace && media.mime_type.startsWith("image/") ? /* @__PURE__ */ jsxs11("label", { className: "ost-btn", title: "The new file keeps every existing reference. CDN caching can take up to an hour to show the new version everywhere.", children: [
         replacing ? "Replacing\u2026" : "Replace file",
         /* @__PURE__ */ jsx11(
           "input",
           {
-            accept: media.mime_type.startsWith("image/") ? "image/*" : "application/pdf",
+            accept: "image/jpeg,image/png,image/webp,image/gif,image/avif",
             hidden: true,
             onChange: async (event) => {
               const file = event.currentTarget.files?.[0];
@@ -3728,11 +3729,15 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
   useEffect11(() => {
     if (!session) {
       setRole(null);
+      setSection("dashboard");
+      setOpenPageId(null);
+      setSubmissionsFormId(null);
       return;
     }
     api.me().then(
       ({ user }) => {
         setRole(user.role);
+        setSection((currentSection) => resolveStudioSection(user.role, currentSection));
         refreshMedia();
         refreshUnread();
         refreshPages();
@@ -3784,6 +3789,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
   if (!role) return /* @__PURE__ */ jsx12("div", { className: "ost-root ost-loading", children: "Loading Studio\u2026" });
   const access = studioAccess(role);
   const nav = NAV.filter((item) => canViewStudioSection(role, item.key));
+  const selectedSection = resolveStudioSection(role, section);
   const goTo = (key) => {
     setSection(key);
     setOpenPageId(null);
@@ -3806,7 +3812,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
       nav.map((item) => /* @__PURE__ */ jsxs12(
         "button",
         {
-          className: `ost-nav-item${section === item.key && !openPageId ? " is-active" : ""}`,
+          className: `ost-nav-item${selectedSection === item.key && !openPageId ? " is-active" : ""}`,
           onClick: () => goTo(item.key),
           type: "button",
           children: [
@@ -3841,7 +3847,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         role
       },
       openPageId
-    ) : section === "pages" ? /* @__PURE__ */ jsx12(PagesView, { api, canCreate: access.createPages, onOpen: openPage }) : section === "media" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "pages" ? /* @__PURE__ */ jsx12(PagesView, { api, canCreate: access.createPages, onOpen: openPage }) : selectedSection === "media" ? /* @__PURE__ */ jsx12(
       MediaView,
       {
         api,
@@ -3852,7 +3858,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onChanged: refreshMedia,
         onUpload: uploadMedia
       }
-    ) : section === "forms" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "forms" ? /* @__PURE__ */ jsx12(
       FormsView,
       {
         api,
@@ -3864,7 +3870,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
           setSection("submissions");
         }
       }
-    ) : section === "submissions" && access.readSubmissions ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "submissions" && access.readSubmissions ? /* @__PURE__ */ jsx12(
       SubmissionsView,
       {
         api,
@@ -3873,7 +3879,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onUnreadChanged: refreshUnread
       },
       submissionsFormId || "all"
-    ) : section === "analytics" && access.readAnalytics ? /* @__PURE__ */ jsx12(AnalyticsView, { api }) : section === "globals" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "analytics" && access.readAnalytics ? /* @__PURE__ */ jsx12(AnalyticsView, { api }) : selectedSection === "globals" ? /* @__PURE__ */ jsx12(
       GlobalsView,
       {
         api,
@@ -3883,7 +3889,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onUploadMedia: uploadMedia,
         pages
       }
-    ) : section === "redirects" && access.manageRedirects ? /* @__PURE__ */ jsx12(RedirectsView, { api }) : section === "users" && access.manageUsers ? /* @__PURE__ */ jsx12(UsersView, { api, meId: session.user.id }) : /* @__PURE__ */ jsx12(
+    ) : selectedSection === "redirects" && access.manageRedirects ? /* @__PURE__ */ jsx12(RedirectsView, { api }) : selectedSection === "users" && access.manageUsers ? /* @__PURE__ */ jsx12(UsersView, { api, meId: session.user.id }) : /* @__PURE__ */ jsx12(
       DashboardView,
       {
         api,

package/dist/{submission-BKdBedOe.d.ts → submission-D_x2qNJl.d.ts}

@@ -33,7 +33,7 @@ type FormConfig = {
     notify?: FormNotifyConfig;
 };
 type RateLimitStore = {
-    isLimited(key: string, now: number): boolean | Promise<boolean>;
+    isLimited(key: string, now: number, cost?: number): boolean | Promise<boolean>;
 };
 declare function createMemoryRateLimitStore(options?: {
     max?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {
@@ -56,6 +56,7 @@
   "dependencies": {
     "@supabase/ssr": "^0.7.0",
     "@supabase/supabase-js": "^2.58.0",
+    "sharp": "^0.35.3",
     "zod": "^3.25.0"
   },
   "peerDependencies": {

package/sql/bootstrap.sql

@@ -244,7 +244,10 @@ create table if not exists cms_forms (
 -- public form renderer needs the field list), notify addresses are not.
 alter table cms_forms add column if not exists notify jsonb not null default '{}'::jsonb;
 update cms_forms
-  set notify = coalesce(config->'notify', '{}'::jsonb),
+  set notify = case
+        when jsonb_typeof(notify) = 'object' and notify <> '{}'::jsonb then notify
+        else coalesce(config->'notify', '{}'::jsonb)
+      end,
       config = config - 'notify'
   where config ? 'notify';
 
@@ -301,8 +304,10 @@ create table if not exists cms_events (
   region text not null default '',
   city text not null default '',
   meta jsonb not null default '{}'::jsonb,
+  server_verified boolean not null default false,
   created_at timestamptz not null default now()
 );
+alter table cms_events add column if not exists server_verified boolean not null default false;
 create index if not exists cms_events_day_idx on cms_events (created_at desc);
 create index if not exists cms_events_session_idx on cms_events (session_key, created_at);
 create index if not exists cms_events_visitor_idx on cms_events (visitor_key, created_at)
@@ -700,7 +705,8 @@ $$;
 create or replace function cms_rate_limit_consume(
   p_key text,
   p_max integer,
-  p_window_seconds integer
+  p_window_seconds integer,
+  p_cost integer
 ) returns boolean
 language plpgsql
 security definer
@@ -709,13 +715,23 @@ as $$
 declare
   v_count integer;
 begin
+  if p_key is null or length(p_key) < 1 or length(p_key) > 256
+     or p_max < 1 or p_max > 1000000
+     or p_window_seconds < 1 or p_window_seconds > 604800
+     or p_cost < 1 or p_cost > p_max then
+    return false;
+  end if;
+
   insert into cms_rate_limits (key, window_start, count)
-  values (p_key, now(), 1)
+  values (p_key, now(), p_cost)
   on conflict (key) do update
     set count = case
           when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
-          then 1
-          else cms_rate_limits.count + 1
+          then p_cost
+          else least(
+            (p_max + 1)::bigint,
+            cms_rate_limits.count::bigint + p_cost::bigint
+          )::integer
         end,
         window_start = case
           when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
@@ -728,6 +744,35 @@ begin
 end;
 $$;
 
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean
+language sql
+security definer
+set search_path = public
+as $$
+  select cms_rate_limit_consume(p_key, p_max, p_window_seconds, 1);
+$$;
+
+create or replace function cms_prune_rate_limits(
+  p_before timestamptz
+) returns bigint
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_deleted bigint;
+begin
+  delete from cms_rate_limits
+  where window_start < p_before;
+  get diagnostics v_deleted = row_count;
+  return v_deleted;
+end;
+$$;
+
 create or replace function cms_update_global(
   p_key text,
   p_data jsonb,
@@ -789,8 +834,6 @@ create policy cms_globals_public_read on cms_globals
   for select using (true);
 
 drop policy if exists cms_media_public_read on cms_media;
-create policy cms_media_public_read on cms_media
-  for select using (true);
 
 drop policy if exists cms_forms_public_read on cms_forms;
 create policy cms_forms_public_read on cms_forms
@@ -830,6 +873,8 @@ declare
     'cms_sync_page(text, text, text, jsonb, jsonb)',
     'cms_publish_due_pages()',
     'cms_rate_limit_consume(text, integer, integer)',
+    'cms_rate_limit_consume(text, integer, integer, integer)',
+    'cms_prune_rate_limits(timestamptz)',
     'cms_update_global(text, jsonb, uuid)'
   ];
 begin
@@ -853,6 +898,9 @@ end $fn_lockdown$;
 -- site-specific role, the PostgREST roles get nothing — so grant explicitly.
 -- Wrapped per-role so bootstrap also works on plain Postgres (dev/tests).
 revoke update, delete on cms_page_versions from public;
+revoke select on cms_forms from public;
+revoke select (notify) on cms_forms from public;
+revoke select on cms_media from public;
 do $grants$
 begin
   if exists (select 1 from pg_roles where rolname = 'service_role') then
@@ -868,22 +916,26 @@ begin
   -- cms_pages and cms_forms get column-level read grants. Anonymous readers
   -- see published page state only and never form notification addresses.
   if exists (select 1 from pg_roles where rolname = 'anon') then
-    grant select on cms_globals, cms_media, cms_redirects to anon;
+    grant select on cms_globals, cms_redirects to anon;
+    revoke select on cms_media from anon;
     revoke select on cms_pages from anon;
     grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to anon;
     revoke all on cms_page_versions from anon;
     revoke select on cms_forms from anon;
+    revoke select (notify) on cms_forms from anon;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to anon;
   end if;
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
-    grant select on cms_globals, cms_media, cms_profiles, cms_redirects to authenticated;
+    grant select on cms_globals, cms_profiles, cms_redirects to authenticated;
+    revoke select on cms_media from authenticated;
     revoke select on cms_pages from authenticated;
     grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to authenticated;
     revoke all on cms_page_versions from authenticated;
     revoke select on cms_forms from authenticated;
+    revoke select (notify) on cms_forms from authenticated;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to authenticated;
   end if;

package/sql/migrations/20260827164127_sec_014_form_notify_privacy.sql

@@ -0,0 +1,41 @@
+-- SEC-014: move legacy notification settings out of public form config.
+
+alter table cms_forms
+  add column if not exists notify jsonb not null default '{}'::jsonb;
+
+-- Current private settings remain authoritative when both representations
+-- exist. Older rows without private settings inherit the legacy value.
+update cms_forms
+set notify = case
+      when jsonb_typeof(notify) = 'object' and notify <> '{}'::jsonb then notify
+      else coalesce(config->'notify', '{}'::jsonb)
+    end,
+    config = config - 'notify'
+where config ? 'notify';
+
+-- RLS limits rows, while column grants keep notification settings out of the
+-- public form definition returned by the Supabase Data API.
+revoke select on cms_forms from public;
+revoke select (notify) on cms_forms from public;
+
+do $form_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke select on cms_forms from anon;
+    revoke select (notify) on cms_forms from anon;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to anon;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke select on cms_forms from authenticated;
+    revoke select (notify) on cms_forms from authenticated;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to authenticated;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on cms_forms to service_role;
+  end if;
+end
+$form_grants$;

package/sql/migrations/20260827172120_sec_015_analytics_ingest_limits.sql

@@ -0,0 +1,101 @@
+-- Bound public analytics storage by accepted event count and separate
+-- server-verified conversions from forgeable browser observations.
+
+alter table cms_events
+  add column if not exists server_verified boolean not null default false;
+
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer,
+  p_cost integer
+) returns boolean
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_count integer;
+begin
+  if p_key is null or length(p_key) < 1 or length(p_key) > 256
+     or p_max < 1 or p_max > 1000000
+     or p_window_seconds < 1 or p_window_seconds > 604800
+     or p_cost < 1 or p_cost > p_max then
+    return false;
+  end if;
+
+  insert into cms_rate_limits (key, window_start, count)
+  values (p_key, now(), p_cost)
+  on conflict (key) do update
+    set count = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then p_cost
+          else least(
+            (p_max + 1)::bigint,
+            cms_rate_limits.count::bigint + p_cost::bigint
+          )::integer
+        end,
+        window_start = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then now()
+          else cms_rate_limits.window_start
+        end
+  returning count into v_count;
+
+  return v_count <= p_max;
+end;
+$$;
+
+-- Preserve the existing form-submission caller while new analytics callers
+-- use the weighted overload.
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean
+language sql
+security definer
+set search_path = public
+as $$
+  select cms_rate_limit_consume(p_key, p_max, p_window_seconds, 1);
+$$;
+
+create or replace function cms_prune_rate_limits(
+  p_before timestamptz
+) returns bigint
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_deleted bigint;
+begin
+  delete from cms_rate_limits
+  where window_start < p_before;
+  get diagnostics v_deleted = row_count;
+  return v_deleted;
+end;
+$$;
+
+revoke execute on function cms_rate_limit_consume(text, integer, integer) from public;
+revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from public;
+revoke execute on function cms_prune_rate_limits(timestamptz) from public;
+
+do $lockdown$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from anon;
+    revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from anon;
+    revoke execute on function cms_prune_rate_limits(timestamptz) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from authenticated;
+    revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from authenticated;
+    revoke execute on function cms_prune_rate_limits(timestamptz) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_rate_limit_consume(text, integer, integer) to service_role;
+    grant execute on function cms_rate_limit_consume(text, integer, integer, integer) to service_role;
+    grant execute on function cms_prune_rate_limits(timestamptz) to service_role;
+  end if;
+end $lockdown$;

package/sql/migrations/20260827232146_sec_016_media_privacy.sql

@@ -0,0 +1,21 @@
+-- SEC-016: keep unused and draft media metadata out of public enumeration.
+-- Published layouts already carry the storage paths needed by public pages.
+
+drop policy if exists cms_media_public_read on cms_media;
+revoke select on cms_media from public;
+
+do $media_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke select on cms_media from anon;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke select on cms_media from authenticated;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on cms_media to service_role;
+  end if;
+end
+$media_grants$;