@iann29/rastro 0.2.0 → 0.4.0

package/dist/component/identity.js

@@ -1,5 +1,6 @@
 import { v } from "convex/values";
 import { DAY_MS } from "./constants.js";
+import { parseIpv6 } from "./geo.js";
 import { internalMutation, internalQuery } from "./_generated/server.js";
 /**
  * Anonymous visitors (no host-supplied id) are counted through a salted hash of
@@ -47,8 +48,35 @@ export function randomSecret() {
     return hex(crypto.getRandomValues(new Uint8Array(32)));
 }
 export async function deriveVisitorKey(input) {
-    const dayStart = Math.floor(input.now / DAY_MS) * DAY_MS;
-    const material = new TextEncoder().encode([input.secret, dayStart, input.siteId, input.ip, input.userAgent].join(" "));
+    return saltedDailyKey(input.secret, input.now, [
+        input.siteId,
+        input.ip,
+        input.userAgent,
+    ]);
+}
+/**
+ * The per-client ingest budget's key: the same salted daily hash, over the
+ * client's network instead of its device — the IPv4 address, or the /64 of an
+ * IPv6 address, the block one subscriber gets and could otherwise walk through
+ * one address per request.
+ */
+export async function deriveClientKey(input) {
+    const groups = parseIpv6(input.ip.toLowerCase());
+    const network = groups
+        ? `${groups
+            .slice(0, 4)
+            .map((group) => group.toString(16))
+            .join(":")}::/64`
+        : input.ip;
+    return saltedDailyKey(input.secret, input.now, [
+        "client",
+        input.siteId,
+        network,
+    ]);
+}
+async function saltedDailyKey(secret, now, parts) {
+    const dayStart = Math.floor(now / DAY_MS) * DAY_MS;
+    const material = new TextEncoder().encode([secret, dayStart, ...parts].join(" "));
     const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", material));
     return hex(digest).slice(0, KEY_HEX_LENGTH);
 }

package/dist/component/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/component/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;IAClC,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,gBAAgB,CAAC;aACvB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC1D,MAAM,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;IAC3C,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,gBAAgB,CAAC;aACvB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC1D,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACpC,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,IAAI,CAAC,SAAS;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY;IAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAMtC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAChD,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/component/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;IAClC,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,gBAAgB,CAAC;aACvB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC1D,MAAM,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;IAC3C,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,gBAAgB,CAAC;aACvB,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC1D,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACpC,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,IAAI,CAAC,SAAS;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY;IAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAMtC;IACC,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE;QAC7C,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,EAAE;QACR,KAAK,CAAC,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAKrC;IACC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,GAAG,MAAM;aACN,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAClC,IAAI,CAAC,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACb,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE;QAC7C,QAAQ;QACR,KAAK,CAAC,MAAM;QACZ,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,GAAW,EACX,KAAe;IAEf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACvC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAChD,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC"}

package/dist/component/ingest.d.ts

@@ -1,4 +1,29 @@
+import type { Doc, Id } from "./_generated/dataModel.js";
+import type { MutationCtx } from "./_generated/server.js";
+import { type VisitorSketch } from "./cardinality.js";
+type AggregateDelta = {
+    siteId: Id<"sites">;
+    granularity: "hour" | "day" | "localDay";
+    bucketStart: number;
+    shard: number;
+    events: number;
+    pageviews: number;
+    clicks: number;
+    customEvents: number;
+    outboundClicks: number;
+    sessions: number;
+    visitors: number;
+    visitorSketch: VisitorSketch;
+    conversions: number;
+    revenueCents: number;
+    dimensions: Doc<"aggregateBuckets">["dimensions"];
+    durationMs: number;
+    continuedSessions: number;
+    newVisitors: number;
+};
+export type AggregateDeltas = Map<string, AggregateDelta>;
 export declare const ingestBatch: import("convex/server").RegisteredMutation<"public", {
+    clientKey?: string | undefined;
     context?: {
         browser?: string | undefined;
         city?: string | undefined;
@@ -50,4 +75,13 @@ export declare const trackConversion: import("convex/server").RegisteredMutation
     duplicates: number;
     rejected: number;
 }>>;
+/**
+ * Folds session duration growth without telemetry: a departure's final
+ * interval, or the heartbeat time of a visitor the live sweep retired. The
+ * shard follows `shardKey`: the session for a departure, the site for a
+ * sweep.
+ */
+export declare function foldSessionDuration(aggregateDeltas: AggregateDeltas, siteId: Id<"sites">, shardKey: string, timestamp: number, durationDeltaMs: number, timezone?: string): void;
+export declare function flushAggregates(ctx: MutationCtx, aggregateDeltas: AggregateDeltas): Promise<void>;
+export {};
 //# sourceMappingURL=ingest.d.ts.map

package/dist/component/ingest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../src/component/ingest.ts"],"names":[],"mappings":"AAkNA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2VtB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;GA+H1B,CAAC"}
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../src/component/ingest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AA2B1D,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAyE1B,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAqF1D,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwXtB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;GA+H1B,CAAC;AA2uDH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,CAAC,EAAE,MAAM,QAgClB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,eAAe,EAAE,eAAe,iBAyEjC"}

package/dist/component/ingest.js

@@ -1,7 +1,7 @@
 import { v } from "convex/values";
 import { mutation } from "./_generated/server.js";
 import { internal } from "./_generated/api.js";
-import { AGGREGATE_SHARDS, MAX_BATCH_EVENT_GROUPS, DAY_MS, HOURLY_AGGREGATE_SHARDS, DIMENSION_SLOTS, HOUR_MS, LIVE_LEAVE_GRACE_MS, LIVE_SESSION_TTL_MS, LIVE_SWEEP_INTERVAL_MS, MAX_BATCH_EVENTS, MAX_SITE_BYTES_PER_SHARD_WINDOW, MAX_SITE_EVENTS_PER_SHARD_WINDOW, MAX_BYTES_PER_SESSION_WINDOW, MAX_EVENTS_PER_SESSION_WINDOW, MAX_FUNNELS_PER_SITE, MAX_GOALS_PER_SITE, RATE_LIMIT_WINDOW_MS, REPORT_ROLLUP_SHARDS, SECONDARY_AGGREGATE_SHARDS, SITE_INGEST_SHARDS, } from "./constants.js";
+import { AGGREGATE_SHARDS, MAX_BATCH_EVENT_GROUPS, DAY_MS, HOURLY_AGGREGATE_SHARDS, DIMENSION_SLOTS, HOUR_MS, LIVE_LEAVE_GRACE_MS, LIVE_SESSION_TTL_MS, LIVE_SWEEP_INTERVAL_MS, MAX_BATCH_EVENTS, MAX_BYTES_PER_CLIENT_WINDOW, MAX_EVENTS_PER_CLIENT_WINDOW, MAX_SITE_BYTES_PER_SHARD_WINDOW, MAX_SITE_EVENTS_PER_SHARD_WINDOW, MAX_BYTES_PER_SESSION_WINDOW, MAX_EVENTS_PER_SESSION_WINDOW, MAX_FUNNELS_PER_SITE, MAX_GOALS_PER_SITE, RATE_LIMIT_WINDOW_MS, REPORT_ROLLUP_SHARDS, SECONDARY_AGGREGATE_SHARDS, SITE_INGEST_SHARDS, } from "./constants.js";
 import { addVisitor, createVisitorSketch, unionVisitorSketches, } from "./cardinality.js";
 import { addToVitalHistogram, emptyVitalHistogram, vitalDevice, VITAL_ALL, } from "./vitals.js";
 import { fail } from "./errors.js";
@@ -26,6 +26,8 @@ export const ingestBatch = mutation({
         origin: v.string(),
         events: v.array(trackerEventValidator),
         context: v.optional(ingestContextValidator),
+        // The HTTP action's salted daily client-network key (see identity.ts).
+        clientKey: v.optional(v.string()),
     },
     returns: ingestResultValidator,
     handler: async (ctx, args) => {
@@ -51,6 +53,9 @@ export const ingestBatch = mutation({
         }
         const now = Date.now();
         await ensureAnalyticsControl(ctx, args.siteId, now);
+        if (args.clientKey !== undefined) {
+            await consumeClientRateLimit(ctx, args.siteId, args.clientKey, eventByteCounts, now);
+        }
         await consumeSiteRateLimit(ctx, args.siteId, args.events, eventByteCounts, now);
         const context = sanitizeContext(args.context);
         const timezone = localDayTimezone(site.timezone);
@@ -155,19 +160,16 @@ export const ingestBatch = mutation({
                     rejected += 1;
                     continue;
                 }
-                const durationDeltaMs = await accountHeartbeat(ctx, args.siteId, existingSession, event, context, now, batchState);
-                // A heartbeat is presence, not telemetry, but it is what keeps a
-                // session's duration honest while the visitor reads: the growth is
-                // folded into the buckets the heartbeat landed in.
-                foldSessionDuration(aggregateDeltas, args.siteId, event, durationDeltaMs, timezone);
+                // A heartbeat is presence, not telemetry: it moves the session's
+                // lastSeenAt and live row only. The time it proves reaches the
+                // duration counters once, when the visitor departs (live.ts).
+                await accountHeartbeat(ctx, args.siteId, existingSession, event, context, now, batchState);
                 accepted += 1;
                 continue;
             }
             if (event.type === "leave") {
-                // A departure only shortens live presence: it stores no telemetry,
-                // touches no aggregates, and never extends anything, so a replayed
-                // or late leave is inert. The read side filters by expiresAt and the
-                // sweep deletes the row, so the dashboard sees the exit in seconds.
+                // A departure closes the final duration interval without telemetry
+                // or new presence. Older departures cannot retire a bfcache return.
                 if (!existingSession) {
                     rejected += 1;
                     continue;
@@ -178,7 +180,22 @@ export const ingestBatch = mutation({
                 }
                 const liveState = await loadLiveSession(ctx, args.siteId, event.sessionId, batchState);
                 const liveSession = liveState.current;
-                if (liveSession) {
+                if (liveSession && event.timestamp >= liveSession.lastSeenAt) {
+                    // Only the still-covered tail is trusted; a delayed departure
+                    // cannot lengthen an expired visit or move its start backwards.
+                    if (event.timestamp > existingSession.lastSeenAt &&
+                        event.timestamp >= now - LIVE_SESSION_TTL_MS &&
+                        event.timestamp <= liveSession.expiresAt) {
+                        const durationMs = Math.max(existingSession.durationMs, event.timestamp - existingSession.startedAt);
+                        sessionRow.current = {
+                            ...existingSession,
+                            lastSeenAt: event.timestamp,
+                            exitPath: event.path,
+                            durationMs,
+                        };
+                        sessionRow.dirty = true;
+                        foldSessionDuration(aggregateDeltas, args.siteId, event.sessionId, event.timestamp, durationMs - existingSession.durationMs, timezone);
+                    }
                     const expiresAt = Math.min(liveSession.expiresAt, now + LIVE_LEAVE_GRACE_MS);
                     if (expiresAt < liveSession.expiresAt) {
                         await ctx.db.patch("liveSessions", liveSession._id, { expiresAt });
@@ -855,6 +872,12 @@ async function attributionForEvent(ctx, siteId, event, existingSession, batchSta
         affiliateExpiresAt: expiresAt,
     };
 }
+/**
+ * Moves the session's lastSeenAt and its live row. `durationMs` stays: it is
+ * what the duration counters already hold, and the time a heartbeat proves
+ * is counted when the visitor departs (live.ts), so an idle tab never
+ * rewrites an aggregate bucket.
+ */
 async function accountHeartbeat(ctx, siteId, session, event, context, now, batchState) {
     const startedAt = Math.min(session.startedAt, event.timestamp);
     const lastSeenAt = Math.max(session.lastSeenAt, event.timestamp);
@@ -862,7 +885,6 @@ async function accountHeartbeat(ctx, siteId, session, event, context, now, batch
         startedAt,
         lastSeenAt,
         exitPath: event.timestamp >= session.lastSeenAt ? event.path : session.exitPath,
-        durationMs: Math.max(0, lastSeenAt - startedAt),
         ...(context.country ? { country: context.country } : {}),
         ...(context.city ? { city: context.city } : {}),
         ...(context.latitude !== undefined ? { latitude: context.latitude } : {}),
@@ -883,7 +905,6 @@ async function accountHeartbeat(ctx, siteId, session, event, context, now, batch
     else {
         await ctx.db.patch("sessions", session._id, updates);
     }
-    const durationDeltaMs = Math.max(0, updates.durationMs - session.durationMs);
     await updateLiveSession(ctx, siteId, event, context, {
         isNewSession: false,
         isNewVisitorHour: false,
@@ -905,7 +926,42 @@ async function accountHeartbeat(ctx, siteId, session, event, context, now, batch
         conversionCount: session.conversionCount,
         newVisitor: session.newVisitor,
     }, now, batchState);
-    return durationDeltaMs;
+}
+/**
+ * One client network's budget per site and minute, kept in the session
+ * windows' table under `~client:<key>`, a key no sanitized session ID can take.
+ * The key is the salted daily hash the HTTP action derived; the address never
+ * reaches this mutation. It is one row per client, so only that client's own
+ * concurrent requests contend on it.
+ */
+async function consumeClientRateLimit(ctx, siteId, clientKey, eventByteCounts, now) {
+    const windowStart = Math.floor(now / RATE_LIMIT_WINDOW_MS) * RATE_LIMIT_WINDOW_MS;
+    const sessionId = `~client:${clientKey}`;
+    const rows = await ctx.db
+        .query("ingestWindows")
+        .withIndex("by_siteId_and_sessionId_and_windowStart", (range) => range.eq("siteId", siteId).eq("sessionId", sessionId))
+        .order("desc")
+        .take(1);
+    const window = rows[0] ?? null;
+    const current = window?.windowStart === windowStart ? window : null;
+    const eventCount = (current?.eventCount ?? 0) + eventByteCounts.length;
+    const byteCount = (current?.byteCount ?? 0) +
+        eventByteCounts.reduce((total, bytes) => total + bytes, 0);
+    if (eventCount > MAX_EVENTS_PER_CLIENT_WINDOW ||
+        byteCount > MAX_BYTES_PER_CLIENT_WINDOW) {
+        fail("RATE_LIMITED", "client ingest budget exceeded", {
+            windowMs: RATE_LIMIT_WINDOW_MS,
+            eventLimitPerClient: MAX_EVENTS_PER_CLIENT_WINDOW,
+            byteLimitPerClient: MAX_BYTES_PER_CLIENT_WINDOW,
+        });
+    }
+    const fields = { windowStart, eventCount, byteCount, updatedAt: now };
+    if (window) {
+        await ctx.db.patch("ingestWindows", window._id, fields);
+    }
+    else {
+        await ctx.db.insert("ingestWindows", { siteId, sessionId, ...fields });
+    }
 }
 async function consumeSiteRateLimit(ctx, siteId, events, eventByteCounts, now) {
     const windowStart = Math.floor(now / RATE_LIMIT_WINDOW_MS) * RATE_LIMIT_WINDOW_MS;
@@ -1214,9 +1270,11 @@ async function advanceFunnel(ctx, siteId, funnel, event, reportRollupDeltas, bat
         foldFunnelRollup(reportRollupDeltas, siteId, funnel._id, event, 0, false);
         return { funnelId: funnel._id, step: 1, steps: funnel.steps.length };
     }
-    if (progress.completedAt !== undefined ||
-        event.timestamp < progress.lastStepAt)
+    if (event.timestamp < progress.lastStepAt)
         return;
+    // An expired window restarts on a first-step event even after a completion,
+    // so a returning buyer can complete again; inside the window a completed
+    // funnel stays done.
     if (event.timestamp - progress.startedAt > funnel.conversionWindowMs) {
         if (!matchesFirst)
             return;
@@ -1245,6 +1303,8 @@ async function advanceFunnel(ctx, siteId, funnel, event, reportRollupDeltas, bat
         foldFunnelRollup(reportRollupDeltas, siteId, funnel._id, event, 0, false);
         return { funnelId: funnel._id, step: 1, steps: funnel.steps.length };
     }
+    if (progress.completedAt !== undefined)
+        return;
     const nextStep = funnel.steps[progress.currentStep];
     if (!nextStep || !stepMatches(nextStep, event))
         return;
@@ -1595,14 +1655,19 @@ function aggregateBucketStart(granularity, timestamp, timezone) {
     const interval = granularity === "hour" ? HOUR_MS : DAY_MS;
     return Math.floor(timestamp / interval) * interval;
 }
-/** Folds only session duration growth, for heartbeats. */
-function foldSessionDuration(aggregateDeltas, siteId, event, durationDeltaMs, timezone) {
+/**
+ * Folds session duration growth without telemetry: a departure's final
+ * interval, or the heartbeat time of a visitor the live sweep retired. The
+ * shard follows `shardKey`: the session for a departure, the site for a
+ * sweep.
+ */
+export function foldSessionDuration(aggregateDeltas, siteId, shardKey, timestamp, durationDeltaMs, timezone) {
     if (durationDeltaMs <= 0)
         return;
     for (const granularity of aggregateGranularities(timezone)) {
-        const shard = stableHash(event.sessionId) %
+        const shard = stableHash(shardKey) %
             (granularity === "hour" ? HOURLY_AGGREGATE_SHARDS : AGGREGATE_SHARDS);
-        const bucketStart = aggregateBucketStart(granularity, event.timestamp, timezone);
+        const bucketStart = aggregateBucketStart(granularity, timestamp, timezone);
         const key = `${siteId}:${granularity}:${bucketStart}:${shard}`;
         const delta = aggregateDeltas.get(key) ?? {
             siteId,
@@ -1628,7 +1693,7 @@ function foldSessionDuration(aggregateDeltas, siteId, event, durationDeltaMs, ti
         aggregateDeltas.set(key, delta);
     }
 }
-async function flushAggregates(ctx, aggregateDeltas) {
+export async function flushAggregates(ctx, aggregateDeltas) {
     for (const delta of aggregateDeltas.values()) {
         const bucket = await ctx.db
             .query("aggregateBuckets")