Software Updates

tabbed marketing dashboard, Recharts charts, channel trend lines, Meta CAPI, loading progress bar

• Reorganized into 4 tabs: Overview, Traffic, Orders & Revenue, Products
• Added animated loading progress bar with stage labels (KPIs → Traffic → Orders → Products)
• Replaced unlabeled bar charts with Recharts BarChart (proper XAxis labels, YAxis, Tooltip)
• Added Channel Trend Lines (LineChart) showing daily traffic per channel source
• Color-coded channels: Direct, Google, Instagram, Facebook, LinkedIn, etc.
• Created src/lib/tracking/meta-capi.ts with SHA-256 hashed PII, _fbp/_fbc cookie parsing
• Wired AddToCart events into POST /api/cart
• Wired InitiateCheckout + Purchase into POST /api/create-payment-intent
• Wired Purchase into Stripe webhook on payment_intent.succeeded
• Added META_CAPI_ACCESS_TOKEN to env files
• Added channelTrends query (daily channel breakdown from HeroEvent table)
• New response field: channelTrends { dates, channels[{ name, data[] }] }

per-channel funnel attribution — traffic source → cart → checkout → purchase

• Added visitorId + referrerChannel columns to Cart and Order tables
• Migration: prisma/add-visitor-tracking.sql (already applied to production)
• New lib: src/lib/referrer-channel.ts — classifies document.referrer into channels (Google, Facebook, Instagram, LinkedIn, Email/Brevo, Direct, etc.)
• New component: ReferrerCapture — captures first-touch referrer on page load into sessionStorage, mounted in root layout
• cart-context.tsx: addItem now sends visitorId + referrerChannel to /api/cart
• checkout/page.tsx: sends visitorId + referrerChannel to /api/create-payment-intent
• /api/cart: stores visitorId + referrerChannel on Cart creation, backfills existing carts that don't have attribution yet
• /api/create-payment-intent: stores visitorId + referrerChannel on Order
• /api/checkout: stores visitorId + referrerChannel on Order
• Section 8: CHANNEL FUNNELS — queries Cart and Order by referrerChannel, with visitorId→HeroEvent join fallback for pre-migration carts
• Returns per-channel: impressions, carts, checkouts, purchases, revenue, conversionRate, cartRate
• New 'Channel Funnels' card with horizontal funnel bars per channel (impression → add to bag → checkout → purchase) with colored stages
• Shows revenue and conversion rate badges per channel
• Warning banner when funnel data hasn't accumulated yet
• i18n: EN + PT keys for all funnel labels

traffic channel attribution from HeroEvent data

• API: classify HeroEvent referrers into channels (Google, Facebook, Instagram, LinkedIn, Email/Brevo, Direct, Other Search, etc.)
• API: period-over-period comparison for each channel + total impressions
• API: device breakdown from HeroEvent (always available, unlike ProductView)
• Frontend: new Traffic Channels card with progress bars, change badges, emoji icons per channel, and device breakdown — always visible
• Frontend: separated Geo into its own card (still gated behind ProductView)
• i18n: updated EN/PT labels for Traffic Channels section

marketing dashboard data integrity + GA-level granularity

• Website purchases now correctly filtered by source='KATURA_WEBSITE' (was 6, now 2)
• Website revenue now shows only katura.com orders (was K+, now )
• Offline sales (IN_PERSON, PRIVATE_COMMISSION, RESTYLING) shown separately
• Revenue by source breakdown shows exact attribution per channel
• Cart Activity tab: per-product breakdown (times added, unique carts, first/last date)
• Recent Cart Events timeline: individual add-to-cart events with timestamps
• Wishlist Activity tab: each save with product detail and date
• Orders & Revenue tab: website orders table, all-sales table, revenue by source
• Order status badges (PAID, CANCELLED, DELIVERED, etc.)
• Source labels (Katura Website, In-Person, Private Commission, Restyling)
• ProductView table has 0 rows — view-dependent sections hidden with banner
• 'Product view tracking has no data yet' warning explains what will appear
• Cart, wishlist, and order data shown since it IS being collected
• Funnel rates show N/A when views unavailable

Stella Marketing hub: i18n (EN/PT), visual upgrades, real analytics

• New /admin/stella route structure (layout, marketing, media)
• Conversions API: 10 real-data sections (funnel, traffic, UTM, devices, geo, engagement, hourly, products, wishlist, daily trends)
• Full i18n: ~100 translation keys for EN + PT via admin-i18n-provider
• Visual polish: gradient KPI cards, colored funnel bars, medal emojis, hover effects, intensity-based hourly chart
• Nav renamed to Stella Marketing with expanded keywords
• Old /admin/media redirects to /admin/stella/media

cancel bot orders, block disposable emails, fix inventory display

• 8 bot orders from johnsmith###@storebotmail.joonix.net holding reservations
• cleanup-orders cron was NOT scheduled in vercel.json (never ran)
• Admin page only showed quantity, not quantity-reserved (misleading)
• Cancelled all 8 bot PENDING orders and released their inventory
• Released stale reservation on Golden South Seas Pearls (no matching order)
• src/lib/security/email-validation.ts: blocks 50+ disposable/bot email domains and suspicious patterns (johnsmith###@, testuser###@, etc.)
• Checkout + create-payment-intent routes now validate emails before creating orders/reserving inventory
• cleanup-orders now runs hourly (was never scheduled)
• Bot emails: cancelled after 30 min (was 24h)
• Normal emails: cancelled after 4h (was 24h)
• Orders cancelled (not deleted) for audit trail
• Added to vercel.json cron schedule
• Products list now shows 'Avail: X (Y held)' in amber when reserved > 0
• Product edit form shows reserved inventory warning banner
• New /api/admin/inventory/audit endpoint (GET=diagnose, POST=fix)

use CartItem for add-to-cart tracking, filter Shopify imports

• Funnel was showing 0 add-to-carts and 0 purchases because:
• 1. Add to Cart used UserEvent table which only records for SIGNED-IN
• users. Guest checkout (the common path) was never tracked.
• → Now uses CartItem.createdAt as primary source (works for all users)
• → Falls back to UserEvent if it has more data
• 2. Checkout count included Shopify-imported historical orders (9 total)
• inflating the number beyond actual Katura site checkouts.
• → Now filters isShopifyImport=false for checkout counts
• 3. The 'safe capping' logic was zeroing out checkout/purchase when
• addToCart was 0 (Math.min(9, 0) = 0).
• → Removed artificial capping — shows real numbers with warnings
• 4. Purchase count was 0 despite 2 real orders — likely the orders
• have PENDING status (Stripe webhook may not have fired).
• → Added specific warning when orders exist but none are settled
• Also updated funnel-trends API with same CartItem + Shopify filter fixes.

checkout rejects variantId:null — Zod z.string().optional() doesn't accept null

• Cart items have variantId: string | null. When serialized to JSON, null is
• sent literally. But z.string().optional() only accepts string | undefined,
• not null. Changed to z.string().nullable().optional() on all checkout APIs.
• This was the ACTUAL 'Invalid request data' error — the shippingMethod and
• giftBalanceAmount fixes from the previous commit were also needed but this
• null variantId was the primary trigger since most products have no variant.

checkout 'Invalid request data' — Zod schema rejects international shipping + string giftBalanceAmount

• Root cause: Two Zod validation failures in /api/create-payment-intent:
• 1. shippingMethod: Client sends 'international' for non-US orders but
• schema only accepted z.enum(['standard', 'express']). Added 'international'.
• 2. giftBalanceAmount: Client sent as string (customGiftAmount is useState(''))
• but schema expected z.number(). Added z.union to accept both types with
• string→number coercion. Also fixed client to send parseFloat().
• 3. promoCode: Client sends promoCode but field was missing from schema.
• Zod strips unknown keys by default so this wasn't the cause, but added
• it for correctness.
• Also fixed /api/checkout/route.ts shippingMethod enum for consistency.

replace next/script with nonce'd raw script tags

• Root cause: next/script strategy='afterInteractive' does NOT propagate
• the CSP nonce to dynamically injected script elements. With strict CSP
• (nonce-based script-src), the inline gtag config script was silently
• blocked by the browser.
• Fix: Switch to raw <script nonce={nonce}> tags with dangerouslySetInnerHTML,
• matching the proven pattern already used for Meta Pixel. This ensures:
• 1. External gtag.js loads with nonce (CSP compliant)
• 2. Inline gtag config executes with nonce (CSP compliant)
• 3. Both render server-side in the initial HTML (no hydration race condition)
• Also removes unused next/script import.

add missing GA4 data collection domains to connect-src

• https://*.doubleclick.net (stats.g.doubleclick.net/g/collect)
• https://*.googlesyndication.com (pagead2.googlesyndication.com/ccm/collect)
• https://*.googleadservices.com (conversion tracking)
• https://adservice.google.com (ad service endpoint)
• https://cct.google (new Google tag agent)
• https://cct.google (cct.google/taggy/agent.js)

wire GA4 e-commerce events alongside Meta Pixel across full funnel

• PROBLEM: GA4 was loading correctly but zero e-commerce events were firing.
• The tracking functions existed in google-analytics.ts but were never imported
• or called anywhere. Only Meta Pixel events were wired up.
• Additionally, PageViewTracker (SPA navigation tracking) was defined but
• never mounted — GA4 only saw initial page loads, not client-side navigations.

Phase 2 translations — 4,428 keys across 22 languages

• scripts/count-untranslated.js
• scripts/section-audit.js
• scripts/untranslated-keys.json

complete Phase 1 translation overhaul — 4,308 keys across 23 languages

• Phase 1: 1,657 keys (checkout, footer for 14 red-tier languages)
• Phase 1B: 532 keys (checkout+footer for da/sv/no/ru)
• Phase 1C: 1,119 keys (checkout+footer+home for nl/he/hi/hu/pl/tr/th/id/vi/uk)
• Phase 1D: 1,000 keys (remaining customer-facing: contact, cart, product, wishlist, blog, about, shipping, wholesale, careers)

add missing GA4 domains to CSP connect-src and script-src

• https://analytics.google.com
• https://*.google-analytics.com (region endpoints like region1.google-analytics.com)
• https://*.analytics.google.com
• https://*.googletagmanager.com

Meta Pixel console logs now report whether fbq() was actually called or silently dropped

Add comprehensive troubleshooting guide for pixel not firing issue

Add urgent action guide for Vercel Meta Pixel setup

Add Vercel deployment guides for Meta Pixel environment variable

Add diagnostic guides for Meta Pixel firing issue

Set real Meta Pixel ID in .env.production - 1263804075100220

🎯 Add Stella's Complete Verification Package Summary

• Overview of all 4 testing documents
• What each document is for and when to use it
• The 5 critical events to test
• Quick verification checklist
• How Stella should use these guides
• Complete package contents
• Critical points before launching ads
• Expected Meta Events Manager display
• Troubleshooting guidance
• Next steps for Stella
• Success metrics to monitor
• Reading guide for different time constraints

📚 Add Master Testing Index & Navigation Guide

• Complete navigation guide for all testing documents
• Document overview and comparison
• Quick navigation by scenario (in a hurry, detailed, broken, etc.)
• The 5 critical events to test
• Success criteria checklist
• Testing flow diagram
• Campaign launch readiness matrix
• Pro tips and do's/don'ts
• Support & troubleshooting guide

✅ Complete Test Verification Guides for Stella's Campaign Launch

• Complete 5-part testing framework
• Pre-flight checklist
• Step-by-step instructions for each event
• Real world simulation
• Troubleshooting guide
• Final verification summary
• Issue reporting template
• One-page quick reference card
• 5 core tests to run
• Where to verify results
• Pass/fail criteria
• Campaign launch decision matrix
• Visual mockups of what to expect
• Console output examples
• Meta Events Manager display examples
• Correct vs incorrect outputs
• Perfect test run example
• Screenshot checklist

🎉 Add Completion Summary Document

• What just happened
• What's working now
• Impact on your ads & ROI
• Code changes made (with examples)
• Testing checklist
• Next action items
• Reading guide for all documentation

📖 Add Meta Pixel Quick Reference Guide

• Event status overview (5/10 critical events working)
• How to verify events firing (3 methods)
• Event funnel visualization
• Business impact before/after
• Quick test checklist
• Technical parameters reference
• Next priority actions

📚 Add Meta Pixel Testing & Explanation Guides

• TEST_PIXEL_EVENTS.md: Step-by-step guide to verify events are firing
• How to use Meta Pixel Helper
• What to expect for each event
• How to access Meta Events Manager
• Troubleshooting tips
• PIXEL_CHANGES_EXPLAINED.md: Before/after code explanation
• Shows exactly what changed in each file
• Explains what each event does
• Shows the complete event funnel
• Lists next priority events to wire

🎯 Wire Meta Pixel Purchase & InitiateCheckout Events

• Add Purchase event tracking to checkout success page
• Fires when order loads with all order details
• Tracks: content_ids, num_items, value, currency
• Enables ROAS calculation and sales optimization
• Add InitiateCheckout event tracking to checkout page
• Fires when user enters checkout with cart items
• Tracks: cart items, quantity, subtotal, currency
• Enables funnel analysis and checkout optimization
• What's currently firing (PageView, ViewContent, AddToCart)
• What's missing (Purchase, Lead, InitiateCheckout)
• How to verify in Meta Events Manager
• Action items by priority

cert parser Vercel 500 — preload pdfjs worker + polyfill DOMMatrix/Path2D

• Root cause: pdfjs-dist in Node.js mode does `await import('./pdf.worker.mjs')`
• which fails on Vercel because the bundler doesn't include the worker file.
• Fix: statically import the worker module and set it on
• `globalThis.pdfjsWorker` so pdfjs-dist finds WorkerMessageHandler
• via its #mainThreadWorkerMessageHandler check and never attempts
• the dynamic import.
• Also polyfill DOMMatrix and Path2D which are browser-only globals
• that pdfjs-dist references internally.

cert parser 500 on Vercel — polyfill DOMMatrix/Path2D + add Wise cert support

• Polyfill DOMMatrix and Path2D globals for Vercel serverless (Node.js env lacks these browser APIs that pdfjs-dist references internally)
• Add Wise certificate parser: detectLab(), parseWise(), parseProportionsWise()
• Wise-specific fields: growth process, country of origin, inscription
• Update main dispatcher to route Wise certs through new parser

cert parser 500 on Vercel — switch from pdf-parse to pdfjs-dist

• Replace pdf-parse (requires worker file at filesystem path) with pdfjs-dist/legacy/build/pdf.mjs (runs in main thread, no worker needed)
• Eliminates the GlobalWorkerOptions.workerSrc error on Vercel
• Remove pdf-parse dependency, add pdfjs-dist as direct dependency
• Add pdfjs-dist to serverExternalPackages in next.config.ts
• Tested with both IGI and GIA certificate PDFs