@orion-studios/cms 0.5.7 → 0.5.9

package/dist/studio/index.js

@@ -4,10 +4,11 @@ import {
   FORM_FIELD_TYPES,
   FormRenderer,
   getAutoReplyEmailFields
-} from "../chunk-ULE565KD.js";
+} from "../chunk-Z52R6XR7.js";
+import "../chunk-DPKXKG2S.js";
 
 // src/studio/Studio.tsx
-import { useCallback as useCallback5, useEffect as useEffect11, useMemo as useMemo5, useState as useState12 } from "react";
+import { useCallback as useCallback5, useEffect as useEffect11, useMemo as useMemo4, useState as useState12 } from "react";
 
 // src/studio/api.ts
 var StudioApiError = class extends Error {
@@ -121,6 +122,7 @@ function createStudioApi(options) {
     listActivity: () => call("GET", "/activity"),
     analytics: (params) => {
       const query = new URLSearchParams();
+      if (params?.days) query.set("days", String(params.days));
       if (params?.from) query.set("from", params.from);
       if (params?.to) query.set("to", params.to);
       const suffix = query.toString() ? `?${query.toString()}` : "";
@@ -382,7 +384,7 @@ function LoginView({ siteName, logoUrl }) {
 }
 
 // src/studio/views/AnalyticsView.tsx
-import { useEffect as useEffect2, useMemo as useMemo2, useState as useState3 } from "react";
+import { useEffect as useEffect2, useState as useState3 } from "react";
 import { Fragment, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 var RANGES = [
   { key: "7", label: "7 days", days: 7 },
@@ -459,7 +461,8 @@ function TrendChart({ trend }) {
 }
 function BarList({
   rows,
-  max
+  max,
+  emptyMessage = "Nothing recorded yet."
 }) {
   const top = max ?? Math.max(1, ...rows.map((row) => row.value));
   return /* @__PURE__ */ jsxs3("div", { className: "ost-barlist", children: [
@@ -474,7 +477,7 @@ function BarList({
         ] }) : null
       ] })
     ] }, row.label)),
-    rows.length === 0 ? /* @__PURE__ */ jsx3("p", { className: "ost-muted", children: "Nothing recorded yet." }) : null
+    rows.length === 0 ? /* @__PURE__ */ jsx3("p", { className: "ost-muted", children: emptyMessage }) : null
   ] });
 }
 function AnalyticsView({ api }) {
@@ -483,22 +486,22 @@ function AnalyticsView({ api }) {
   const [error, setError] = useState3("");
   useEffect2(() => {
     const range = RANGES.find((entry) => entry.key === rangeKey) ?? RANGES[1];
-    const to = /* @__PURE__ */ new Date();
-    const from = new Date(to.getTime() - range.days * 864e5);
+    let active = true;
     setData(null);
-    api.analytics({ from: from.toISOString(), to: to.toISOString() }).then(
-      setData,
-      (e) => setError(e.message)
+    setError("");
+    api.analytics({ days: range.days }).then(
+      (summary) => {
+        if (active) setData(summary);
+      },
+      (e) => {
+        if (active) setError(e.message);
+      }
     );
+    return () => {
+      active = false;
+    };
   }, [api, rangeKey]);
-  const localHours = useMemo2(() => {
-    if (!data) return [];
-    const offset = Math.round((/* @__PURE__ */ new Date()).getTimezoneOffset() / -60);
-    return data.hours.map((_, hour) => ({
-      hour,
-      count: data.hours[((hour - offset) % 24 + 24) % 24]
-    }));
-  }, [data]);
+  const localHours = data?.hours.map((count, hour) => ({ hour, count })) ?? [];
   if (error) return /* @__PURE__ */ jsx3("div", { className: "ost-view", children: /* @__PURE__ */ jsx3("div", { className: "ost-error", children: error }) });
   const kpis = data?.kpis ?? null;
   const previous = data?.previous;
@@ -551,7 +554,7 @@ function AnalyticsView({ api }) {
         /* @__PURE__ */ jsx3(
           Kpi,
           {
-            label: "Returning visitors",
+            label: "Repeat-day visitors",
             previous: previous ? { current: kpis.returningVisitors, prior: previous.returningVisitors } : void 0,
             value: String(kpis.returningVisitors)
           }
@@ -573,7 +576,7 @@ function AnalyticsView({ api }) {
           }
         ),
         /* @__PURE__ */ jsx3(Kpi, { label: "Pages per visitor", value: kpis.pagesPerVisitor.toFixed(1) }),
-        /* @__PURE__ */ jsx3(Kpi, { label: "Conversion rate", value: pct(kpis.conversionRate) }),
+        /* @__PURE__ */ jsx3(Kpi, { label: "Attributed visit conversion rate", value: pct(kpis.conversionRate) }),
         /* @__PURE__ */ jsx3(
           Kpi,
           {
@@ -584,15 +587,17 @@ function AnalyticsView({ api }) {
         )
       ] }),
       /* @__PURE__ */ jsxs3("p", { className: "ost-muted ost-analytics-note", children: [
-        "Returning visitors and cross-day totals use the pseudonymous cookie only after the visitor accepts analytics.",
-        kpis.visitors > 0 ? ` ${kpis.identifiedVisitors} of ${kpis.visitors} visitors in this range were cookie-identified.` : ""
+        "Traffic counts cover consented tracked visits. Requests sent includes every stored submission. Repeat-day visitors use the pseudonymous cookie only after the visitor accepts analytics.",
+        kpis.visitors > 0 ? ` ${kpis.identifiedVisitors} of ${kpis.visitors} visitors in this range were cookie-identified.` : "",
+        ` ${kpis.attributedSubmits} of ${kpis.formSubmits} requests were linked to a tracked visit.`,
+        ` Ranges use site-local calendar days including today. Dates and hours use ${data.timeZone}.`
       ] }),
       /* @__PURE__ */ jsxs3("section", { className: "ost-card ost-analytics-section", children: [
         /* @__PURE__ */ jsxs3("h3", { children: [
           "Daily visitors ",
           /* @__PURE__ */ jsxs3("span", { className: "ost-trend-key", children: [
             "\u25A0 visitors ",
-            /* @__PURE__ */ jsx3("em", { children: "\u25A0 conversions" })
+            /* @__PURE__ */ jsx3("em", { children: "\u25A0 verified actions" })
           ] })
         ] }),
         /* @__PURE__ */ jsx3(TrendChart, { trend: data.trend })
@@ -606,26 +611,27 @@ function AnalyticsView({ api }) {
               rows: data.pages.slice(0, 12).map((page) => ({
                 label: page.path === "/" ? "Home" : page.path,
                 value: page.views,
-                detail: page.conversions > 0 ? `\xB7 ${page.conversions} conv` : void 0
+                detail: page.conversions > 0 ? `\xB7 ${page.conversions} linked actions` : void 0
               }))
             }
           )
         ] }),
         /* @__PURE__ */ jsxs3("section", { className: "ost-card ost-analytics-section", children: [
-          /* @__PURE__ */ jsx3("h3", { children: "Where visitors come from" }),
+          /* @__PURE__ */ jsx3("h3", { children: "Where tracked visits come from" }),
           /* @__PURE__ */ jsx3(
             BarList,
             {
               rows: data.sources.map((source) => ({
                 label: source.source,
                 value: source.sessions,
-                detail: source.conversions > 0 ? `\xB7 ${source.conversions} conv` : void 0
+                detail: source.conversions > 0 ? `\xB7 ${source.conversions} linked actions` : void 0
               }))
             }
           )
         ] }),
         /* @__PURE__ */ jsxs3("section", { className: "ost-card ost-analytics-section", children: [
           /* @__PURE__ */ jsx3("h3", { children: "Form funnel" }),
+          /* @__PURE__ */ jsx3("p", { className: "ost-muted", children: "Each step counts unique tracked visits, not raw events. A view requires the first field to remain 75% visible for 2 seconds, or direct field interaction. Starts and submissions supply the minimum when a view event is unavailable. Legacy form loads are excluded." }),
           data.forms.length === 0 ? /* @__PURE__ */ jsx3("p", { className: "ost-muted", children: "No form activity yet." }) : null,
           data.forms.map((form) => /* @__PURE__ */ jsxs3("div", { className: "ost-funnel", children: [
             /* @__PURE__ */ jsx3("strong", { children: form.form }),
@@ -634,7 +640,7 @@ function AnalyticsView({ api }) {
               {
                 max: Math.max(form.views, 1),
                 rows: [
-                  { label: "Saw the form", value: form.views },
+                  { label: "Viewed form", value: form.views },
                   { label: "Started filling", value: form.starts },
                   { label: "Submitted", value: form.submits }
                 ]
@@ -643,7 +649,7 @@ function AnalyticsView({ api }) {
           ] }, form.form))
         ] }),
         /* @__PURE__ */ jsxs3("section", { className: "ost-card ost-analytics-section", children: [
-          /* @__PURE__ */ jsx3("h3", { children: "Visitor locations" }),
+          /* @__PURE__ */ jsx3("h3", { children: "Tracked visit locations" }),
           /* @__PURE__ */ jsx3(
             BarList,
             {
@@ -676,7 +682,11 @@ function AnalyticsView({ api }) {
             ": ",
             device.sessions
           ] }, device.device)) }),
-          /* @__PURE__ */ jsx3("h4", { className: "ost-analytics-subhead", children: "Busiest hours" }),
+          /* @__PURE__ */ jsxs3("h4", { className: "ost-analytics-subhead", children: [
+            "Busiest hours (",
+            data.timeZone,
+            ")"
+          ] }),
           /* @__PURE__ */ jsx3("div", { className: "ost-hours", children: localHours.map((entry) => {
             const max = Math.max(1, ...localHours.map((h) => h.count));
             return /* @__PURE__ */ jsx3(
@@ -684,14 +694,19 @@ function AnalyticsView({ api }) {
               {
                 className: "ost-hour-bar",
                 style: { height: `${Math.max(entry.count / max * 100, 4)}%` },
-                title: `${entry.hour}:00 \u2014 ${entry.count} views`
+                title: `${entry.hour}:00, ${entry.count} views`
               },
               entry.hour
             );
           }) }),
           /* @__PURE__ */ jsx3("h4", { className: "ost-analytics-subhead", children: "Broken links (404s)" }),
-          data.notFound.length === 0 ? /* @__PURE__ */ jsx3("p", { className: "ost-muted", children: "None \u2014 nice." }) : null,
-          /* @__PURE__ */ jsx3(BarList, { rows: data.notFound.slice(0, 8).map((entry) => ({ label: entry.path, value: entry.count })) })
+          /* @__PURE__ */ jsx3(
+            BarList,
+            {
+              emptyMessage: "No broken links recorded.",
+              rows: data.notFound.slice(0, 8).map((entry) => ({ label: entry.path, value: entry.count }))
+            }
+          )
         ] })
       ] })
     ] }) : null
@@ -739,9 +754,7 @@ function DashboardView({
   useEffect3(() => {
     api.dashboard().then(setData, (e) => setError(e.message));
     if (canReadAnalytics) {
-      const to = /* @__PURE__ */ new Date();
-      const from = new Date(to.getTime() - 7 * 864e5);
-      api.analytics({ from: from.toISOString(), to: to.toISOString() }).then(
+      api.analytics({ days: 7 }).then(
         (summary) => setWeek({
           visitors: summary.kpis.visitors,
           calls: summary.kpis.calls,
@@ -1445,7 +1458,7 @@ function FieldEditor({
 }
 
 // src/studio/views/PageEditor.tsx
-import { useCallback as useCallback2, useEffect as useEffect6, useMemo as useMemo3, useRef, useState as useState7 } from "react";
+import { useCallback as useCallback2, useEffect as useEffect6, useMemo as useMemo2, useRef, useState as useState7 } from "react";
 
 // src/studio/inline.ts
 function collectInlineTargets(definition, data) {
@@ -2173,7 +2186,7 @@ function PageEditor({
   const selectedIndex = selectedId ? layout.findIndex((block) => block.id === selectedId) : -1;
   const selected = selectedIndex >= 0 ? layout[selectedIndex] : null;
   const selectedDefinition = selected ? registry.get(selected.type) : void 0;
-  const changedSincePublish = useMemo3(() => {
+  const changedSincePublish = useMemo2(() => {
     if (!page) return false;
     if (page.status !== "published") return true;
     return dirty || title !== (page.published_title ?? "") || JSON.stringify(seo) !== JSON.stringify(page.published_seo ?? {}) || JSON.stringify(layout) !== JSON.stringify(page.published_layout ?? []);
@@ -2346,7 +2359,7 @@ function PageEditor({
     setDirty(false);
     setMessage("Version restored into draft.");
   };
-  const palette = useMemo3(() => registry.palette(), [registry]);
+  const palette = useMemo2(() => registry.palette(), [registry]);
   const insertBlock = (type, at) => {
     const instance = registry.createInstance(type);
     const next = [...layout];
@@ -3312,7 +3325,7 @@ function UsersView({ api, meId }) {
 }
 
 // src/studio/views/views.tsx
-import { useEffect as useEffect10, useMemo as useMemo4, useState as useState11 } from "react";
+import { useEffect as useEffect10, useMemo as useMemo3, useState as useState11 } from "react";
 import { Fragment as Fragment3, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
 var pageStatus = (page) => {
   if (page.publish_at) return { label: "scheduled", live: false };
@@ -3399,7 +3412,7 @@ function MediaView({
   const [selected, setSelected] = useState11(null);
   const [search, setSearch] = useState11("");
   const [error, setError] = useState11("");
-  const visible = useMemo4(() => {
+  const visible = useMemo3(() => {
     const term = search.trim().toLowerCase();
     if (!term) return media;
     return media.filter(
@@ -3740,7 +3753,7 @@ var NAV = [
 ];
 function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
   const { session, loading, getToken, signOut } = useStudioSession();
-  const api = useMemo5(() => createStudioApi({ getToken }), [getToken]);
+  const api = useMemo4(() => createStudioApi({ getToken }), [getToken]);
   useEffect11(() => {
     try {
       localStorage.setItem("orion-analytics-exclude", "1");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {

package/sql/bootstrap.sql

@@ -1074,6 +1074,49 @@ begin
 end;
 $$;
 
+-- Aggregate-only visitor count for care-report sharing. The service role
+-- invokes it, and raw visitor and session identifiers never leave PostgreSQL.
+create or replace function public.cms_analytics_unique_visitors(
+  p_from timestamptz,
+  p_to timestamptz
+) returns bigint
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  with session_identities as (
+    select
+      session_key,
+      max(nullif(visitor_key, '')) as visitor_key,
+      min(id) as first_event_id
+    from public.cms_events
+    where created_at >= p_from
+      and created_at <= p_to
+    group by session_key
+  )
+  select count(distinct coalesce(
+    visitor_key,
+    nullif(session_key, ''),
+    'event:' || first_event_id::text
+  ))::bigint
+  from session_identities;
+$$;
+
+revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from public;
+do $analytics_aggregate_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) to service_role;
+  end if;
+end $analytics_aggregate_grants$;
+
 -- 3) Row-level security -------------------------------------------------------
 -- Defense-in-depth. The app's API layer (service role) is the primary
 -- enforcement point; anonymous access is read-only and published-only.

package/sql/migrations/20260830143322_cms_analytics_unique_visitors.sql

@@ -0,0 +1,43 @@
+-- Aggregate-only visitor count for care-report sharing. Raw visitor and
+-- session identifiers stay inside PostgreSQL.
+create or replace function public.cms_analytics_unique_visitors(
+  p_from timestamptz,
+  p_to timestamptz
+) returns bigint
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  with session_identities as (
+    select
+      session_key,
+      max(nullif(visitor_key, '')) as visitor_key,
+      min(id) as first_event_id
+    from public.cms_events
+    where created_at >= p_from
+      and created_at <= p_to
+    group by session_key
+  )
+  select count(distinct coalesce(
+    visitor_key,
+    nullif(session_key, ''),
+    'event:' || first_event_id::text
+  ))::bigint
+  from session_identities;
+$$;
+
+revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from public;
+
+do $analytics_aggregate_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function public.cms_analytics_unique_visitors(timestamptz, timestamptz) to service_role;
+  end if;
+end $analytics_aggregate_grants$;