@iann29/rastro 0.1.0-alpha.1 → 0.1.0-alpha.11

package/src/component/rollups.ts

@@ -0,0 +1,82 @@
+import { v } from "convex/values";
+import { internal } from "./_generated/api.js";
+import { internalMutation } from "./_generated/server.js";
+import {
+  ROLLUP_FOLD_BATCH_DOCS,
+  ROLLUP_FOLD_LEASE_MS,
+  ROLLUP_FOLD_MAX_ROWS,
+} from "./constants.js";
+import {
+  countReportRollupRows,
+  createReportRollupDeltas,
+  flushReportRollups,
+  mergeQueuedRollups,
+} from "./rollupStore.js";
+
+/**
+ * Folds a site's queued report rollup deltas into the rollup rows. Exactly
+ * one chain runs per site: ingestion starts one when no lease is held, every
+ * run carries the token of the lease it belongs to, and a run whose token is
+ * no longer current exits without touching anything. A run that finds more
+ * queued documents than it could take continues at once; a run that drains
+ * the queue releases the lease. A batch that lands while a run is draining
+ * is never stranded: the run read the queue range the batch inserted into
+ * and the batch read the lease the run released, so one of the two retries
+ * and sees the other's work.
+ */
+export const fold = internalMutation({
+  args: { siteId: v.id("sites"), token: v.string() },
+  returns: v.object({
+    folded: v.number(),
+    remaining: v.boolean(),
+    stale: v.boolean(),
+  }),
+  handler: async (ctx, args) => {
+    const state = await ctx.db
+      .query("rollupFoldStates")
+      .withIndex("by_siteId", (range) => range.eq("siteId", args.siteId))
+      .unique();
+    if (!state || state.token !== args.token) {
+      return { folded: 0, remaining: false, stale: true };
+    }
+    const now = Date.now();
+    const queued = await ctx.db
+      .query("reportRollupQueue")
+      .withIndex("by_siteId_and_createdAt", (range) =>
+        range.eq("siteId", args.siteId),
+      )
+      .order("asc")
+      .take(ROLLUP_FOLD_BATCH_DOCS + 1);
+    if (queued.length === 0) {
+      if (state.leaseUntil > now) {
+        await ctx.db.patch("rollupFoldStates", state._id, { leaseUntil: now });
+      }
+      return { folded: 0, remaining: false, stale: false };
+    }
+    const deltas = createReportRollupDeltas();
+    let taken = 0;
+    for (const document of queued.slice(0, ROLLUP_FOLD_BATCH_DOCS)) {
+      mergeQueuedRollups(deltas, document);
+      taken += 1;
+      if (countReportRollupRows(deltas) >= ROLLUP_FOLD_MAX_ROWS) break;
+    }
+    await flushReportRollups(ctx, deltas);
+    for (const document of queued.slice(0, taken)) {
+      await ctx.db.delete("reportRollupQueue", document._id);
+    }
+    const remaining = queued.length > taken;
+    if (remaining) {
+      // Renew only when the lease is halfway gone, so the state document is
+      // rewritten about twice a minute under load rather than on every run.
+      if (state.leaseUntil - now < ROLLUP_FOLD_LEASE_MS / 2) {
+        await ctx.db.patch("rollupFoldStates", state._id, {
+          leaseUntil: now + ROLLUP_FOLD_LEASE_MS,
+        });
+      }
+      await ctx.scheduler.runAfter(0, internal.rollups.fold, args);
+    } else {
+      await ctx.db.patch("rollupFoldStates", state._id, { leaseUntil: now });
+    }
+    return { folded: taken, remaining, stale: false };
+  },
+});

package/src/component/sanitize.ts

@@ -1,4 +1,5 @@
 import {
+  CLOCK_SKEW_TOLERANCE_MS,
   MAX_BATCH_BYTES,
   MAX_PROPERTIES,
   MAX_SITE_DOMAINS,
@@ -8,6 +9,7 @@ import type {
   IngestContext,
   TrackerEvent,
 } from "./validators.js";
+import { isValidVitalValue, isVitalMetric } from "./vitals.js";
 
 const HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const SAFE_KEY = /^[A-Za-z][A-Za-z0-9_.-]{0,39}$/;
@@ -62,9 +64,10 @@ export function sanitizePath(value: string): string {
   const input = requireString(value, "path", 2048);
   let path: string;
   try {
-    path = input.startsWith("http://") || input.startsWith("https://")
-      ? new URL(input).pathname
-      : input.split(/[?#]/, 1)[0];
+    path =
+      input.startsWith("http://") || input.startsWith("https://")
+        ? new URL(input).pathname
+        : input.split(/[?#]/, 1)[0];
   } catch {
     throw new Error("path is invalid");
   }
@@ -73,6 +76,37 @@ export function sanitizePath(value: string): string {
   return cleaned || "/";
 }
 
+const ROUTE_ID = ":id";
+const NUMERIC_SEGMENT = /^\d+$/;
+const UUID_SEGMENT =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HEX_SEGMENT = /^[0-9a-f]{16,}$/i;
+
+/**
+ * Collapses the identifiers that unmistakably vary per record — numbers,
+ * UUIDs, and long hexadecimal tokens — into `:id`, so `/blog/42` and
+ * `/blog/43` roll up as one route in the site map. Slugs are pages of their
+ * own and stay as they are. A trailing slash is dropped because both
+ * spellings serve the same page. Only the map uses this; every other report
+ * keeps the sanitized path exactly as the tracker sent it.
+ */
+export function normalizeRoute(path: string): string {
+  const trimmed =
+    path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+  const segments = trimmed.split("/");
+  for (let index = 1; index < segments.length; index += 1) {
+    const segment = segments[index] ?? "";
+    if (
+      NUMERIC_SEGMENT.test(segment) ||
+      UUID_SEGMENT.test(segment) ||
+      HEX_SEGMENT.test(segment)
+    ) {
+      segments[index] = ROUTE_ID;
+    }
+  }
+  return segments.join("/") || "/";
+}
+
 export function sanitizePublicUrl(value: string): string | undefined {
   const input = cleanString(value, 2048);
   if (!input) return undefined;
@@ -111,15 +145,42 @@ export function sanitizeProperties(
   return Object.keys(result).length > 0 ? result : undefined;
 }
 
+/**
+ * Re-anchors a batch whose sender's clock disagrees with ours. `sentAt` is the
+ * sender's clock at flush time, so `now - sentAt` is the clock offset alone: an
+ * event queued long before the flush keeps its age, and nothing is inferred
+ * from the events themselves. Offsets inside the tolerance are latency or a
+ * slightly drifted clock and leave the batch untouched, so a well-set client's
+ * timestamps stay exactly as sent.
+ */
+export function alignClock<T extends { timestamp: number }>(
+  events: T[],
+  sentAt: number | undefined,
+  now: number,
+): T[] {
+  if (sentAt === undefined || !Number.isFinite(sentAt)) return events;
+  const offset = now - sentAt;
+  if (Math.abs(offset) <= CLOCK_SKEW_TOLERANCE_MS) return events;
+  return events.map((event) => ({
+    ...event,
+    timestamp: event.timestamp + offset,
+  }));
+}
+
 export function sanitizeEvent(event: TrackerEvent, now: number): TrackerEvent {
-  if (!Number.isFinite(event.timestamp)) throw new Error("timestamp is invalid");
+  if (!Number.isFinite(event.timestamp))
+    throw new Error("timestamp is invalid");
   if (
     event.timestamp < now - MAX_EVENT_AGE_MS ||
     event.timestamp > now + MAX_FUTURE_SKEW_MS
   ) {
     throw new Error("timestamp is outside the accepted window");
   }
-  if (!Number.isSafeInteger(event.sequence) || event.sequence < 0 || event.sequence > 1_000_000_000) {
+  if (
+    !Number.isSafeInteger(event.sequence) ||
+    event.sequence < 0 ||
+    event.sequence > 1_000_000_000
+  ) {
     throw new Error("sequence is out of range");
   }
   if (event.revenueCents !== undefined && !isValidMoney(event.revenueCents)) {
@@ -130,9 +191,20 @@ export function sanitizeEvent(event: TrackerEvent, now: number): TrackerEvent {
     throw new Error("name is required for custom events");
   }
   if (event.type === "conversion" && !name) name = "conversion";
-  const currency = event.currency === undefined
-    ? event.type === "conversion" ? "USD" : undefined
-    : sanitizeCurrency(event.currency);
+  if (event.type === "vital") {
+    if (!name || !isVitalMetric(name)) {
+      throw new Error("vital name must be a Web Vitals metric");
+    }
+    if (event.value === undefined || !isValidVitalValue(event.value)) {
+      throw new Error("vital value is out of range");
+    }
+  }
+  const currency =
+    event.currency === undefined
+      ? event.type === "conversion"
+        ? "USD"
+        : undefined
+      : sanitizeCurrency(event.currency);
   return {
     eventId: sanitizeOpaqueId(event.eventId, "eventId"),
     sessionId: sanitizeOpaqueId(event.sessionId, "sessionId"),
@@ -140,19 +212,26 @@ export function sanitizeEvent(event: TrackerEvent, now: number): TrackerEvent {
     type: event.type,
     name,
     path: sanitizePath(event.path),
-    referrer: event.referrer === undefined
-      ? undefined
-      : sanitizePublicUrl(event.referrer),
+    referrer:
+      event.referrer === undefined
+        ? undefined
+        : sanitizePublicUrl(event.referrer),
     timestamp: Math.trunc(event.timestamp),
     sequence: event.sequence,
-    target: event.target === undefined
-      ? undefined
-      : cleanString(event.target, 160) || undefined,
+    target:
+      event.target === undefined
+        ? undefined
+        : cleanString(event.target.replace(/\s+/g, " "), 160) || undefined,
     href: event.href === undefined ? undefined : sanitizePublicUrl(event.href),
     properties: sanitizeProperties(event.properties),
     revenueCents: event.revenueCents,
     currency,
     affiliateSlug: optionalAffiliateSlug(event.affiliateSlug),
+    // Only measurements keep a value; a stray number on any other type is noise.
+    value:
+      event.type === "vital" && event.value !== undefined
+        ? Math.round(event.value)
+        : undefined,
   };
 }
 
@@ -167,7 +246,9 @@ function optionalAffiliateSlug(value: string | undefined): string | undefined {
 
 export function normalizeDomains(domains: string[]): string[] {
   if (domains.length === 0 || domains.length > MAX_SITE_DOMAINS) {
-    throw new Error(`domains must contain between 1 and ${MAX_SITE_DOMAINS} entries`);
+    throw new Error(
+      `domains must contain between 1 and ${MAX_SITE_DOMAINS} entries`,
+    );
   }
   const normalized = domains.map(normalizeDomainPattern);
   return [...new Set(normalized)].sort();
@@ -185,7 +266,11 @@ export function normalizeDomainPattern(value: string): string {
       throw new Error("domains cannot include paths or query strings");
     }
     hostname = url.hostname;
-  } else if (hostInput.includes("/") || hostInput.includes("?") || hostInput.includes("#")) {
+  } else if (
+    hostInput.includes("/") ||
+    hostInput.includes("?") ||
+    hostInput.includes("#")
+  ) {
     throw new Error("domain is invalid");
   }
   hostname = hostname.replace(/\.$/, "");
@@ -214,7 +299,9 @@ export function originAllowed(origin: string, domains: string[]): boolean {
   });
 }
 
-export function validateTimezone(value: string | undefined): string | undefined {
+export function validateTimezone(
+  value: string | undefined,
+): string | undefined {
   if (value === undefined || value.trim() === "") return undefined;
   const timezone = cleanString(value, 80);
   try {
@@ -225,17 +312,33 @@ export function validateTimezone(value: string | undefined): string | undefined
   }
 }
 
-export function sanitizeContext(context: IngestContext | undefined): IngestContext {
+export function sanitizeContext(
+  context: IngestContext | undefined,
+): IngestContext {
   const latitude = finiteCoordinate(context?.latitude, -90, 90);
   const longitude = finiteCoordinate(context?.longitude, -180, 180);
   return {
-    country: context?.country ? cleanString(context.country.toUpperCase(), 2) || undefined : undefined,
-    city: context?.city ? cleanString(context.city, 80) || undefined : undefined,
-    latitude: latitude === undefined ? undefined : Math.round(latitude * 10) / 10,
-    longitude: longitude === undefined ? undefined : Math.round(longitude * 10) / 10,
-    browser: context?.browser ? cleanString(context.browser, 32) || undefined : undefined,
+    country: context?.country
+      ? cleanString(context.country.toUpperCase(), 2) || undefined
+      : undefined,
+    city: context?.city
+      ? cleanString(context.city, 80) || undefined
+      : undefined,
+    latitude:
+      latitude === undefined ? undefined : Math.round(latitude * 10) / 10,
+    longitude:
+      longitude === undefined ? undefined : Math.round(longitude * 10) / 10,
+    browser: context?.browser
+      ? cleanString(context.browser, 32) || undefined
+      : undefined,
     os: context?.os ? cleanString(context.os, 32) || undefined : undefined,
-    device: context?.device ? cleanString(context.device, 24) || undefined : undefined,
+    device: context?.device
+      ? cleanString(context.device, 24) || undefined
+      : undefined,
+    visitorKey:
+      context?.visitorKey && SAFE_OPAQUE_ID.test(context.visitorKey)
+        ? cleanString(context.visitorKey, 128) || undefined
+        : undefined,
   };
 }
 
@@ -249,10 +352,21 @@ export function isValidMoney(value: number): boolean {
   return Number.isSafeInteger(value) && value >= 0 && value <= 1_000_000_000;
 }
 
-export function ensureBatchBytes(value: unknown): number {
-  const bytes = new TextEncoder().encode(JSON.stringify(value)).byteLength;
-  if (bytes > MAX_BATCH_BYTES) throw new Error("batch exceeds 64 KiB");
-  return bytes;
+export function measureBatchBytes(
+  siteId: string,
+  events: TrackerEvent[],
+): { batchBytes: number; eventByteCounts: number[] } {
+  const encoder = new TextEncoder();
+  const eventByteCounts = events.map(
+    (event) => encoder.encode(JSON.stringify(event)).byteLength,
+  );
+  // The empty envelope already includes both array brackets; only commas remain.
+  const batchBytes =
+    encoder.encode(JSON.stringify({ siteId, events: [] })).byteLength +
+    eventByteCounts.reduce((total, byteCount) => total + byteCount, 0) +
+    Math.max(0, events.length - 1);
+  if (batchBytes > MAX_BATCH_BYTES) throw new Error("batch exceeds 64 KiB");
+  return { batchBytes, eventByteCounts };
 }
 
 export function sourceFromReferrer(referrer: string | undefined): string {
@@ -280,6 +394,7 @@ function finiteCoordinate(
   maximum: number,
 ): number | undefined {
   if (value === undefined) return undefined;
-  if (!Number.isFinite(value) || value < minimum || value > maximum) return undefined;
+  if (!Number.isFinite(value) || value < minimum || value > maximum)
+    return undefined;
   return value;
 }

package/src/component/schema.ts

@@ -3,13 +3,18 @@ import { v } from "convex/values";
 import {
   affiliateFieldsValidator,
   aggregateFieldsValidator,
-  storedEventFieldsValidator,
+  batchedEventValidator,
   funnelFieldsValidator,
   goalFieldsValidator,
   sessionFieldsValidator,
   siteFieldsValidator,
-  trackerEventValidator,
+  visitorSketchValidator,
+  vitalMetricValidator,
 } from "./validators.js";
+import {
+  reportRollupQueueFields,
+  rollupFoldStateFields,
+} from "./rollupStore.js";
 
 export default defineSchema({
   sites: defineTable(siteFieldsValidator)
@@ -17,7 +22,12 @@ export default defineSchema({
     .index("by_ownerId_and_name", ["ownerId", "name"])
     .index("by_networkId", ["networkId"]),
 
-  sessions: defineTable(sessionFieldsValidator)
+  sessions: defineTable(
+    sessionFieldsValidator.extend({
+      geoLookupAttemptedAt: v.optional(v.number()),
+      lastPageviewAt: v.optional(v.number()),
+    }),
+  )
     .index("by_siteId_and_sessionId", ["siteId", "sessionId"])
     .index("by_siteId_and_lastSeenAt", ["siteId", "lastSeenAt"])
     .index("by_siteId_and_startedAt", ["siteId", "startedAt"])
@@ -48,6 +58,8 @@ export default defineSchema({
     lastHeartbeatEventId: v.optional(v.string()),
     recentHeartbeatEventIds: v.optional(v.array(v.string())),
     eventCount: v.number(),
+    previousPath: v.optional(v.string()),
+    movedAt: v.optional(v.number()),
   })
     .index("by_siteId_and_sessionId", ["siteId", "sessionId"])
     .index("by_siteId_and_expiresAt", ["siteId", "expiresAt"])
@@ -59,25 +71,19 @@ export default defineSchema({
     scheduledAt: v.number(),
   }).index("by_siteId", ["siteId"]),
 
-  events: defineTable(storedEventFieldsValidator)
-    .index("by_siteId_and_eventId", ["siteId", "eventId"])
-    .index("by_siteId_and_timestamp", ["siteId", "timestamp"])
-    .index("by_siteId_and_sessionId_and_timestamp", [
-      "siteId",
-      "sessionId",
-      "timestamp",
-    ])
-    .index("by_siteId_and_visitorId_and_timestamp", {
-      fields: ["siteId", "visitorId", "timestamp"],
-      staged: true,
-    }),
+  geoLookupBudgets: defineTable({
+    siteId: v.id("sites"),
+    dayStart: v.number(),
+    count: v.number(),
+  }).index("by_siteId", ["siteId"]),
 
   eventBatches: defineTable({
     siteId: v.id("sites"),
     sessionId: v.string(),
     visitorId: v.string(),
     bucketStart: v.number(),
-    events: v.array(trackerEventValidator),
+    events: v.array(batchedEventValidator),
+    migrationVersion: v.optional(v.literal(1)),
   })
     .index("by_siteId_and_sessionId_and_bucketStart", [
       "siteId",
@@ -85,10 +91,11 @@ export default defineSchema({
       "bucketStart",
     ])
     .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"])
-    .index("by_siteId_and_visitorId_and_bucketStart", {
-      fields: ["siteId", "visitorId", "bucketStart"],
-      staged: true,
-    }),
+    .index("by_siteId_and_visitorId_and_bucketStart", [
+      "siteId",
+      "visitorId",
+      "bucketStart",
+    ]),
 
   aggregateBuckets: defineTable(aggregateFieldsValidator)
     .index("by_siteId_and_granularity_and_bucketStart_and_shard", [
@@ -103,6 +110,176 @@ export default defineSchema({
       "bucketStart",
     ]),
 
+  routeDailyRollups: defineTable({
+    siteId: v.id("sites"),
+    bucketStart: v.number(),
+    shard: v.number(),
+    generation: v.literal(1),
+    route: v.string(),
+    pageviews: v.number(),
+    entries: v.number(),
+    continued: v.number(),
+    dwellMs: v.number(),
+    dwellSamples: v.number(),
+    visitorSketch: visitorSketchValidator,
+    outgoing: v.array(v.object({ route: v.string(), count: v.number() })),
+  })
+    .index("by_siteId_and_route_and_bucketStart_and_shard", [
+      "siteId",
+      "route",
+      "bucketStart",
+      "shard",
+    ])
+    .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"]),
+
+  goalDailyRollups: defineTable({
+    siteId: v.id("sites"),
+    goalId: v.id("goals"),
+    bucketStart: v.number(),
+    shard: v.number(),
+    generation: v.literal(1),
+    goalKey: v.string(),
+    completions: v.number(),
+    valueCents: v.number(),
+  })
+    .index("by_siteId_and_goalId_and_bucketStart_and_shard", [
+      "siteId",
+      "goalId",
+      "bucketStart",
+      "shard",
+    ])
+    .index("by_siteId_and_goalId_and_bucketStart", [
+      "siteId",
+      "goalId",
+      "bucketStart",
+    ])
+    .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"]),
+
+  funnelDailyRollups: defineTable({
+    siteId: v.id("sites"),
+    funnelId: v.id("funnels"),
+    bucketStart: v.number(),
+    shard: v.number(),
+    generation: v.literal(1),
+    steps: v.array(
+      v.object({
+        step: v.number(),
+        entrants: v.number(),
+        completions: v.number(),
+      }),
+    ),
+  })
+    .index("by_siteId_and_funnelId_and_bucketStart_and_shard", [
+      "siteId",
+      "funnelId",
+      "bucketStart",
+      "shard",
+    ])
+    .index("by_siteId_and_funnelId_and_bucketStart", [
+      "siteId",
+      "funnelId",
+      "bucketStart",
+    ])
+    .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"]),
+
+  // Field Web Vitals. One row per site/day/shard and either a page (device
+  // "(all)") or a device class (page "(all)"); the row folds every metric's
+  // histogram together so a report reads five metrics for one document. Pages
+  // are bounded like dimension slots: at most VITAL_PAGE_SLOTS distinct pages
+  // per day, then "(other)".
+  vitalRollups: defineTable({
+    siteId: v.id("sites"),
+    bucketStart: v.number(),
+    device: v.string(),
+    page: v.string(),
+    shard: v.number(),
+    metrics: v.array(
+      v.object({
+        metric: vitalMetricValidator,
+        count: v.number(),
+        sum: v.number(),
+        histogram: v.array(v.number()),
+      }),
+    ),
+  })
+    .index("by_key", ["siteId", "bucketStart", "device", "page", "shard"])
+    .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"]),
+
+  affiliateDailyRollups: defineTable({
+    siteId: v.id("sites"),
+    affiliateId: v.id("affiliates"),
+    bucketStart: v.number(),
+    shard: v.number(),
+    generation: v.literal(1),
+    affiliateSlug: v.string(),
+    visits: v.number(),
+    visitorSketch: visitorSketchValidator,
+    conversions: v.number(),
+    revenueCents: v.number(),
+    commissionCents: v.number(),
+  })
+    .index("by_siteId_and_affiliateId_and_bucketStart_and_shard", [
+      "siteId",
+      "affiliateId",
+      "bucketStart",
+      "shard",
+    ])
+    .index("by_siteId_and_affiliateId_and_bucketStart", [
+      "siteId",
+      "affiliateId",
+      "bucketStart",
+    ])
+    .index("by_siteId_and_bucketStart", ["siteId", "bucketStart"]),
+
+  // Rollup deltas wait here between ingestion and the fold job; see
+  // rollupStore.ts. Rows are deleted as they are folded.
+  reportRollupQueue: defineTable(reportRollupQueueFields).index(
+    "by_siteId_and_createdAt",
+    ["siteId", "createdAt"],
+  ),
+
+  rollupFoldStates: defineTable(rollupFoldStateFields).index("by_siteId", [
+    "siteId",
+  ]),
+
+  analyticsCoverage: defineTable({
+    siteId: v.id("sites"),
+    generation: v.literal(1),
+    rollupCompleteFrom: v.number(),
+    siteMapSince: v.optional(v.number()),
+    countersSince: v.optional(v.number()),
+    localDaySince: v.optional(v.number()),
+    retained: v.array(v.object({ dataset: v.string(), before: v.number() })),
+    updatedAt: v.number(),
+  }).index("by_siteId", ["siteId"]),
+
+  retentionPolicies: defineTable({
+    siteId: v.id("sites"),
+    eventsDays: v.number(),
+    sessionsDays: v.number(),
+    conversionsDays: v.number(),
+    aggregatesDays: v.number(),
+    reportsDays: v.number(),
+    updatedAt: v.number(),
+  }).index("by_siteId", ["siteId"]),
+
+  retentionStates: defineTable({
+    siteId: v.id("sites"),
+    kind: v.string(),
+    before: v.number(),
+    status: v.union(
+      v.literal("pending"),
+      v.literal("running"),
+      v.literal("complete"),
+    ),
+    generation: v.number(),
+    attempt: v.number(),
+    leaseExpiresAt: v.optional(v.number()),
+    scheduledAt: v.optional(v.number()),
+    deleted: v.number(),
+    updatedAt: v.number(),
+  }).index("by_siteId_and_kind", ["siteId", "kind"]),
+
   goals: defineTable(goalFieldsValidator)
     .index("by_siteId", ["siteId"])
     .index("by_siteId_and_key", ["siteId", "key"]),
@@ -119,7 +296,11 @@ export default defineSchema({
     valueCents: v.number(),
   })
     .index("by_siteId_and_goalId_and_eventId", ["siteId", "goalId", "eventId"])
-    .index("by_siteId_and_goalId_and_timestamp", ["siteId", "goalId", "timestamp"])
+    .index("by_siteId_and_goalId_and_timestamp", [
+      "siteId",
+      "goalId",
+      "timestamp",
+    ])
     .index("by_siteId_and_timestamp", ["siteId", "timestamp"]),
 
   funnels: defineTable(funnelFieldsValidator)
@@ -171,6 +352,21 @@ export default defineSchema({
     .index("by_siteId", ["siteId"])
     .index("by_siteId_and_slug", ["siteId", "slug"]),
 
+  visitorSecrets: defineTable({
+    key: v.literal("current"),
+    value: v.string(),
+    createdAt: v.number(),
+  }).index("by_key", ["key"]),
+
+  visitorAliases: defineTable({
+    siteId: v.id("sites"),
+    visitorId: v.string(),
+    previousVisitorId: v.string(),
+    linkedAt: v.number(),
+  })
+    .index("by_siteId_and_visitorId", ["siteId", "visitorId"])
+    .index("by_siteId_and_previousVisitorId", ["siteId", "previousVisitorId"]),
+
   visitorAttributions: defineTable({
     siteId: v.id("sites"),
     visitorId: v.string(),