Software Updates

Boost media page image quality: quality=95, wider sizes hint

• Root cause: Next.js <Image> served 288px thumbnails at 75% quality
• for the media grid. Bumped to quality=95 and sizes='33vw' so the
• on-screen display matches what Stella sees on the storefront.
• Downloads were already full HD (raw Supabase/Shopify CDN fetch).

Split media into photos + videos pages, HD downloads

• /admin/stella/media → Photos only (was combined tabs)
• /admin/stella/media/videos → New dedicated videos page
• HD downloads: prefers 'large' URL > 'url', strips transform params
• API now returns 'large' field for ProductImage
• Cross-links between photos ↔ videos pages
• Sidebar: 'Stella Photos' + 'Stella Videos' nav items
• Updated EN + PT translations

move media buttons below image name in vertical column

• Remove all floating overlay buttons from photos and videos
• Buttons now live below image name/SKU in CardContent
• Stacked vertically (flex-col) so they never fight screen width
• Full-width outline buttons with left-aligned icons + labels:
• Save to Camera Roll (share icon)
• Download (arrow icon)
• View Product (external link icon, photos only)
• Clean image/video display with no overlapping UI

add Download button + Stella Media sidebar link

• Add dedicated Download button (arrow icon) alongside Save/Share button
• Save (share icon) → Camera Roll on iPhone via Web Share API
• Download (arrow icon) → Downloads folder via blob download
• Both buttons visible on mobile (always) and desktop (hover overlay)
• Works for both photos and videos
• Add 'Stella Media' nav item below 'Stella Marketing' with Film icon
• Links to /admin/stella/media
• Added EN + PT translations for nav.stellaMedia

split media page into Photos + Videos tabs with camera roll save

• Split /admin/stella/media into Photos tab and Videos tab
• Videos tab fetches from /api/admin/media/videos, shows auto-playing cards
• Videos auto-play muted with loop and playsInline for mobile
• Replace Download button with Save button using Web Share API
• On iPhone: triggers native share sheet → Save Image / Save Video to Camera Roll
• On desktop: falls back to blob download
• Extracted PhotoCard and VideoCard as separate components
• Both show mobile-always-visible save button + desktop hover overlay
• Save confirmation with green checkmark on success
• Grid size slider shared across both tabs

major site builder overhaul + 8 new themes

• Fix +Add Section: inline searchable section picker with categorized grid
• Add InsertBetweenButton for inserting sections between existing ones
• Redesign EmptyCanvas with quick-start section grid + browse all picker
• Make Style Panel fully editable: color pickers, font selectors, theme switcher
• Implement drag-from-palette-to-canvas via DraggablePaletteItem + CanvasDropZone
• Move DndContext to wrap both palette and canvas for cross-container DnD
• DragOverlay shows section name chip for palette drags, preview for reorder drags
• Save now persists custom colors/fonts/theme alongside page sections
• Fix bootstrap creating sections with empty props (now uses SECTION_DEFINITIONS defaultProps)
• Add 8 new themes: Estate, Gallery, Art Deco (premium), Rosé, Noir (premium), Coastal, Studio, Bohème
• Total: 13 themes across luxury, minimal, modern, artisan, feminine, classic categories
• Fix createdAt/updatedAt null constraint in theme seed SQL

dramatically accelerate Stella Marketing page load

• Merge 5 sequential Promise.all batches → 2 (excluded-users, then one mega-batch of ~40 queries running fully in parallel)
• Add 3-minute in-memory cache with X-Cache header (marketing data is stale-tolerant; ?noCache=1 bypasses)
• Add take limits on order/wishlist findMany (200/100) to prevent unbounded result sets with N+1-like joins
• Cart: (referrerChannel, createdAt), (tenantId, createdAt)
• CartItem: (tenantId, createdAt), (productId, createdAt)
• Order: (tenantId, createdAt), (tenantId, isShopifyImport, source, status, createdAt), (tenantId, status, createdAt), (email, createdAt)
• WishlistItem: (tenantId, addedAt), (productId, addedAt)
• HeroEvent: (tenantId, createdAt), (visitorId)

resolve 3 failing health tests

• Env: AUTH_SECRET → NEXTAUTH_SECRET (correct env var name used everywhere)
• Database: Active Products Have Prices — price is NOT NULL in schema, check for zero/negative price instead of null
• Database: Write Test — insert parent SyntheticTestRun row first to satisfy FK constraint before inserting SyntheticTestResult

comprehensive health tests + live streaming progress UI

• Add ~130 new synthetic health tests covering auth, CRM, HR, analytics, treasury, payroll, admin APIs, SEO, DB integrity, crons, webhooks, security headers, MCP, settings, CORS, env vars, and performance
• Add SSE streaming endpoint /api/admin/monitoring/stream
• Add runSyntheticTestsStreaming() with callback-based progress reporting
• Replace spinner with LiveProgressPanel: real progress bar, ETA, current test name, pass/fail/slow counters, live results feed
• Update critical alert patterns for new test categories

comprehensive audit logging with IP/UA across 32 API routes

• Added createAuditLog + IP/UA capture to all unaudited mutation routes: account (change-password, delete, profile), feature-flags, inventory, contractors (CRUD), imports, customers (CRUD), commissions (create + bulk), appointments (CRUD), articles, blog (CRUD), careers, assets, goals (CRUD), promotions (CRUD), services (CRUD), invite, purchase-orders
• Enhanced existing audit logs with IP/UA: products (update/delete), orders (manual create), collections (CRUD), categories (CRUD)
• Added 60+ new action label mappings to getActionLabel in audit API route for all new entity types (Inventory, Import, Customer, Commission, Appointment, Article, BlogPost, JobPosting, Asset, SalesGoal, ServiceRequest, PurchaseOrder, ProductCategory)
• All routes capture x-forwarded-for/x-real-ip for IP address tracking
• All routes capture user-agent for device/browser identification
• Categories: auth, crm, data, hr, payroll, system as appropriate

correct clock-in/out action labels, show IP address, expand event types

• Root cause: clock-in route was creating audit logs with action='create' entity='User'
• instead of action='clock_in' entity='TimeEntry', so the audit page showed 'Created User'
• instead of 'Clocked In'.

custom date ranges + multi-metric time series chart

• API: accept from/to date params alongside days preset, granularity param (hourly/daily/weekly)
• API: CTE-based timeSeries query combining ProductView + HeroEvent clicks + CartItem data
• UI: preset buttons (7D/14D/30D/90D/1Y) + custom date range picker with Apply
• UI: granularity toggle (hourly/daily/weekly) with smart defaults based on range
• UI: interactive multi-metric bar chart with views, hero clicks, cart adds
• UI: legend toggles to show/hide individual metrics, hover tooltips, summary row
• Backward-compatible: dailyViews still returned for any consumers

aggressive cookie clearing for sign-out

• Sign-out endpoint now clears ALL possible cookie name variants (authjs, __Secure-authjs, next-auth, __Secure-next-auth)
• Clears both with domain=.katura1999.com AND without domain (handles cookies set either way)
• All fetch calls now use credentials:'include' to ensure cookies are sent and received properly
• Uses .then(r => r.json()) instead of .finally() to ensure the Set-Cookie response is fully processed before redirecting

sign-out now uses custom endpoint to clear domain-scoped cookie

• NEW: src/app/api/auth/sign-out/route.ts
• user-menu.tsx, admin/layout.tsx, sign-out-button.tsx
• platform-admin-header.tsx, signout/page.tsx
• account/settings/page.tsx (delete account flow)
• wholesale-portal.tsx
• platform login-form.tsx

sign-out not working — use redirect:false + window.location.href

• user-menu.tsx (desktop dropdown + mobile nav)
• admin/layout.tsx (desktop dropdown + mobile dropdown)
• sign-out-button.tsx
• platform-admin-header.tsx
• signout/page.tsx

add homepage + cart attribution to per-product analytics, fix UTM capture

• Per-product page now shows 3 data sources instead of just ProductView: 1. Homepage Exposure: hero impressions + clicks by channel (Direct, Facebook, Instagram, etc.) 2. Cart Attribution: which channels led to add-to-cart for this product 3. Product Page Traffic: existing ProductView-based deep analytics
• Fixed UTM capture bug: was parsing UTMs from referrer URL (facebook.com) instead of the actual page URL (katura.com/creations/izzy?utm_source=facebook)
• Lowered ProductView bounce filter from 3s to 1s so views accumulate faster while campaigns are live
• API: 3 new parallel queries (heroImpressions, heroClicks, cartChannels) using same channelCaseSql classification as main dashboard

Meta Pixel + CAPI only fire conversion events for Meta traffic

• Before: AddToCart, Purchase, InitiateCheckout, AddToWishlist fired for
• ALL visitors. Meta's Custom Conversions dashboard showed inflated
• numbers (23 Add to Bag) because it counted Google/direct/organic
• traffic too.
• After: Conversion events only fire if visitor has confirmed Meta
• signals: _fbc cookie, fbclid param, facebook/instagram referrer,
• or utm_source=ig/fb/facebook/instagram/meta.
• ViewContent still fires for all visitors (needed for retargeting
• audience building).
• Applies to both client-side Pixel and server-side CAPI.

products page shows cart adds, channel funnels count unattributed carts

• Products table now merges ProductView data with CartItem data so every product with any activity (views OR cart adds) appears, with a new 'Add to Cart' column showing count + unique carts
• Channel funnels: count carts with null referrerChannel + null visitorId as 'Direct' (most likely in-app browser traffic that strips all tracking headers)
• Per-product deep-dive: funnel bars now show when there are cart adds even with 0 views (uses max of all stages as denominator)
• Corrected Izzy analysis: 3 carts are 'Direct', 2 are null channel — cannot confirm any came from Facebook/Instagram

update Izzy analysis with Stella's actual /bin/zsh.38 CPC data

• Rewrites all cost projections from assumed industry CPC to actual
• /bin/zsh.38. Changes projected spend-per-sale from -4K to -320.
• Adds CPC creep risk section and revised budget recommendations.

sign-out, per-product analytics, rename Impressions→Site Visits

• Sign-out: switch all 6 call sites from signOut({redirect:false})+manual redirect to signOut({callbackUrl:'/'}) so cookies actually clear
• Per-product analytics: new API /api/admin/analytics/product/[productId] and deep-dive UI page at /admin/stella/marketing/products/[productId] with funnel, traffic sources, engagement, geo, devices, UTM campaigns
• Rename 'Impressions' → 'Site Visits' (EN+PT) — these are HeroEvent homepage loads, not ad impressions; less confusing for Stella
• Products table now links product names to the deep-dive page
• Add Izzy Diamond Earrings campaign analysis MD for Stella

Fix SQL alias mismatch crashing marketing dashboard

• The sqlExcludeCartUser fragment uses c."userId" but the cartByChannel
• query had FROM "Cart" without an alias, causing a PostgreSQL error:
• 'missing FROM-clause entry for table c'. This 500'd the entire
• conversions API, and the layout set the error JSON as data, crashing
• on data.kpis.productViews.

Fix missing exclusion filter on cartByChannel query in channel funnels

include anonymous ProductViews in analytics (NULL userId was excluded)

• The Prisma { userId: { notIn: [...] } } filter excludes NULL values
• because NULL NOT IN (...) evaluates to NULL (falsy in SQL).
• Changed to: { OR: [{ userId: null }, { userId: { notIn: excludedUserIds } }] }
• This is what caused 'Product view tracking has no data yet' to show
• on the Stella Marketing dashboard — most product views are from
• anonymous (not-logged-in) visitors, so they all have userId=null.

perf+fix: exclude dev emails from analytics + parallelize conversions API

• Add EXCLUDED_EMAILS constant (rosserembrasil@gmail.com)
• Resolve excluded user IDs once, filter ALL analytics queries:
• ProductView: exclude by userId
• CartItem: exclude via Cart→User join
• WishlistItem: exclude via Wishlist→User join
• Order: exclude by email field
• Revenue/channel funnels: exclude from raw SQL queries
• Parallelize ~25+ sequential DB queries into 3 Promise.all batches:
• Batch 1: 14 KPI counts (views, carts, wishlists, orders, revenue, hero)
• Batch 2: 7 detail queries (cart detail, daily carts, recent events, wishlists, sales, revenue, website orders)
• Batch 3: 6 traffic/trend queries (channels, prev channels, hero devices, daily orders, wishlist conversion, daily channel trends)
• Batch 4: 4 channel funnel queries
• ProductView analytics: 9 queries in parallel
• Use Prisma.sql + Prisma.empty for safe dynamic SQL fragments
• Deduplicate channel CASE expression into shared channelCaseSql variable
• Expected ~3-5x faster page load for /admin/stella/marketing

remove duplicate '| KATURA' suffix from 31 page titles

• The root layout uses title.template = '%s | KATURA' which automatically
• appends '| KATURA' to every page title. But 31 storefront pages were
• manually including '| KATURA' (or variants like '| KATURA Fine Jewelry',
• '| KATURA Education') in their own titles, resulting in doubled suffixes
• like 'Your Cart | KATURA | KATURA' in browser tabs and GA4 reports.
• This caused GA4 to show multiple rows of 'Handcrafted Earrings &
• Minimalist Jewelry | KATURA' in the top pages report — because many
• different pages were all falling back to the same homepage title, making
• them indistinguishable in analytics.
• Now every page sets just its unique portion (e.g. 'Your Cart') and lets
• the template add '| KATURA' once.

add missing /collections/ → /creations/ redirects (SEO)

• /collections/necklaces → /creations/necklaces
• /collections/bracelets → /creations/bracelets
• /collections/rings → /creations/rings
• /collections/engagement-rings → /creations/engagement-rings
• /collections/wedding-bands → /creations/wedding-bands

fire AddToCart event on /cart page to satisfy Custom Conversion

• The 'Add to Bag' Custom Conversion has a compound rule:
• Event = AddToCart AND URL contains '/cart'
• The AddToCart event was only firing from product pages (URL like
• /creations/some-ring), so the URL condition never matched. Now we
• also fire AddToCart when the cart page loads with items, which
• satisfies both conditions simultaneously.

fire Meta ViewContent on /cart page + widen CSP for Facebook

• Two changes to ensure the 'Add to Bag' Custom Conversion activates:
• 1. Cart page now fires fbq('track', 'ViewContent') when the cart loads
• with items. This gives Meta an explicit event on the /cart URL, not
• just a PageView.
• 2. Widened CSP connect-src to include https://*.facebook.com (was only
• https://www.facebook.com). The pixel can beacon to subdomains like
• tr.facebook.com which weren't covered.

remove meta-pixel-test page — no longer needed

• All 4 Meta Custom Conversions will activate once the canonical fix
• deploys and the user visits /cart.

canonical URL bug — root layout was overriding all pages' canonical to homepage

• Removed alternates (canonical + languages) from root layout.tsx
• Added proper canonical to /cart layout (https://katura1999.com/cart)
• Added proper canonical to /checkout layout
• Created /checkout/success layout with proper canonical
• Pages that already set their own canonical (homepage, collections, products, etc.) are unaffected since they override independently.

add /meta-pixel-test page to activate Custom Conversions

• Fires AddToCart, InitiateCheckout, and Purchase standard events
• on a single page load so Meta's Custom Conversions move from
• Inactive → Active. Visit katura1999.com/meta-pixel-test to trigger.
• Delete this page once all conversions show Active in Meta.

fire Meta Pixel PageView on SPA navigations

• The Meta Pixel base snippet in layout.tsx fires fbq('track','PageView')
• only on the initial full page load. Subsequent client-side (SPA)
• navigations never sent another PageView, so URL-based Custom
• Conversions in Meta for /cart, /checkout, and /checkout/success
• never saw those page visits — showing 0 conversions despite the
• standard events (AddToCart, InitiateCheckout, Purchase) already
• being wired up in the code.
• Fix: PageViewTracker now fires fbq('track','PageView') on every
• SPA navigation (in addition to the existing GA4 page_view).
• Skips the initial render to avoid double-counting with layout.tsx.

add Google Tag Manager (GTM-WSV33RDH)

• GTM script in <head> (with nonce for CSP compliance)
• GTM noscript iframe after <body> for JS-disabled fallback
• Only loads on production domain (katura1999.com)

sign-out not working + video uploadDate timezone

• Fix signOut() not navigating: use redirect:false then window.location.href to force a full page reload (fixes same-URL no-op when already on /)
• Updated all 5 sign-out call sites: user-menu, sign-out-button, admin layout (x2), platform-admin-header
• Fix Google Search Console video structured data warnings: uploadDate now uses full ISO 8601 with timezone (was date-only)
• Fixed in structured-data.ts and video-sitemap.xml/route.ts