Vizoalica v0.5.2 — Quality, simplicity, and one-command setup

Deployment support: fresh deployments only. An existing 0.5.1 database needs one manual ALTER TABLE statement first; see the changelog upgrade notes.

Compatibility: two breaking changes. The command line is now vizoalica (pnpm ops <command> becomes pnpm vizoalica <command>, and pnpm ops run becomes pnpm vizoalica console), and deleting a website or project is now permanent. Analytics and static-snippet contracts are unchanged. Ingest requests without a valid token now return 401 before any lookup, including for unknown source keys (previously 403).

Vizoalica 0.5.2 makes the first install one command. pnpm vizoalica install takes an empty Cloudflare account to a working console: it creates the database, storage bucket, and Worker, writes the configuration for you, generates your three secrets and shows them once, connects your computer as an operator console, and sends sample page views through your own backend so the console has something real to show. In two runs on a real account it took 113 and 102 seconds. backend, connect, demo, and rotate cover updating, adding another operator, sample data, and replacing a secret, and each explains what it will change before it changes it.

Website deployment is now a reusable GitHub Actions workflow: a push to a customer's website repository deploys the site and the Vizoalica Functions to Cloudflare Pages, with all analytics configuration coming from repository variables and secrets rather than committed source. The console leads with that path and shows whether the website's configuration endpoint is reachable.

Deleting a website or project is now permanent. New events are rejected at once and the next daily run removes its raw event batches and every database row, including audit entries; pnpm vizoalica purge-deleted does it immediately. Anything already soft-deleted is removed at the first daily run after you deploy, so export what you want to keep first.

The release also closes real defects: pnpm build failed on a fresh clone (and CI hid it), soft-deleted websites and projects kept accepting events, and the daily retention job could not keep up with steady traffic, letting D1 grow without bound. It adds an opt-in ingest rate limiter and rejects unauthenticated requests before any database read.

One risk is accepted rather than fixed: VIZOALICA_TOKEN_SECRET is shared by every website on a backend, so treat it like the administrator secret. See the security findings for the reasoning.

The release was validated with formatting, lint, type checking, a clean-tree production build, 589 unit and integration tests, 94.60% line and 90.70% branch coverage, all 11 Chromium responsive and accessibility scenarios, and a production dependency audit. Windows is not supported. It does not contain Cloudflare credentials and does not trigger deployment.

See the changelog, release operations, Cloudflare guide, and Pages guide.