feat(analytics): cross-filter hover between chart, countries, and files

[alukach]

Hovering any of the three product-analytics panels narrows the other two to that slice, and clicking pins a slice for deeper interrogation:

• Hover a chart day → stats row, country list, and files table show that UTC day's values.
• Hover a country (incl. the "others" row) → stats row shows that country's window totals, the chart shows its daily series, and the files table shows its per-file values.
• Hover a file → stats row shows that file's totals (incl. its distinct-country count), the chart shows its daily series, and the country list shows its per-country values.
• Click to pin — one pin per dimension. Clicking a country row, a file row, or a chart bar pins that value; pins compose into an intersection filter (country ∩ file ∩ day, all served by the cross/cube data). Hovering substitutes for its own dimension's pin while the cursor is there, so you can sweep siblings without dropping the other pins (e.g. pin a country and a file, then sweep the chart to read that pair's downloads by date). Clicking a pinned value again unpins it.
• While a slice is active, the country/file lists re-rank descending by the shown values — but a list never re-sorts on its own hover, so rows can't shuffle under the cursor. Rows stay pinned to the window's top 5 countries / top 10 files; the chart caption names the active slice.

How

• getProductBreakdowns runs a second query wave after the window ranking, scoped to the top entries with IN (…) — bounded row counts, no 10k-cap risk: per-day series (requests + bytes) for countries/others/files, a single country×file cross query (≤ 5×10 rows) serving both hover directions, and an others-per-file aggregate. Window queries also gain per-country bytes and per-file COUNT(DISTINCT blob6) so the stats row can follow non-day slices.
• Per-day values are keyed by the day's ISO timestamp (UsagePoint.date) rather than array index, so the independently cached usage grid and breakdowns can never misalign.
• ProductAnalyticsView holds one hover state (day | country | file) plus a pinned slice; each panel derives its shown values from them. HoverCaption gains an optional filterLabel.

Testing

• Data-layer test extended: mocks all five second-wave queries, asserts byDay/byCountry/otherCountries construction and the quoted IN/NOT IN clauses.
• tsc --noEmit, lint, and all analytics suites green (29 tests).
• Worth a spin on the Vercel preview: the new IN-list SQL follows AE's documented syntax but couldn't be run against live AE locally.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-cooperative	Ready	Preview, Comment	Jul 29, 2026 5:12pm

[claude]

Claude finished @alukach's task in 4m 46s —— View job

---

Review of PR #465

• Gather context (diff, changed files, CLAUDE.md)
• Review src/lib/clients/analytics/index.ts
• Review src/components/features/analytics/ProductAnalyticsView.tsx
• Review src/components/features/analytics/panels.tsx
• Review test file changes
• Post findings

✅ No blocking issues — safe to merge.

Traced the cross-filter/pin logic end-to-end (hover/pin state → entity/countryEntity/fileEntity derivation → byDay/byCountry lookups) against the new second-wave SQL, and it holds up:

• SQL injection: all dynamic IN (...) values (countryIn, fileIn) go through sqlQuote() (src/lib/clients/analytics/index.ts:471-472), which escapes backslashes/quotes/control chars — consistent with the rest of the file. Good, since blob3 (file path) is attacker-influenced (arbitrary object keys).
• Map-key construction for the day×country×file cube (`${file} ${country || "??"}`, index.ts:558-575) looks collision-prone at first glance since file paths can contain spaces, but country codes are always exactly 2 chars (ISO code or the "??" fallback), so the concatenation is actually unambiguous — no real collision risk.
• parseDateTime keys used to join UsagePoint.date (grid) with the breakdowns' byDay maps produce identical ISO strings on both sides (index.ts:211-213 vs index.ts:329-334), so lookups won't silently miss.
• All second-wave queries are correctly guarded by topCountries.length/rest.length/topFiles.length before firing, avoiding malformed empty IN () clauses.
• Front-end shown/shownCountries/entity branching in ProductAnalyticsView.tsx:76-120 correctly falls back to zeroEntry for missing cross entries and handles the "others" aggregate's window-only distinct-country count (NaN → "—") as documented.

Minor, non-blocking note: the new pin interactions (chart bar click, country row click, file row click) are mouse-only — no onKeyDown/role="button" — but this matches the existing pattern elsewhere in the codebase (e.g. DirectoryRow.tsx), so not a regression introduced by this PR.