Can I vibe code Fathom Analytics?

Build a full-stack, privacy-focused, cookieless web analytics platform in TypeScript, Next.js (App Router), Tailwind CSS, and ClickHouse (via @clickhouse/client).

DATA MODEL (ClickHouse & PostgreSQL/Prisma):
1. PostgreSQL (Control Plane):
   - User (id, email, password_hash, created_at)
   - Site (id, public_tracking_id, user_id, domain, created_at)
   - CustomEvent (id, site_id, name, created_at)
   - APIKey (id, site_id, key_hash, rate_limit_per_hr)
2. ClickHouse (Telemetry Engine):
   - Table `pageviews`:
     `timestamp` DateTime64(3),
     `site_id` LowCardinality(String),
     `visitor_hash` FixedString(64),
     `pathname` String,
     `referrer_domain` String,
     `utm_source` LowCardinality(String),
     `utm_medium` LowCardinality(String),
     `utm_campaign` LowCardinality(String),
     `device_type` LowCardinality(String),
     `browser` LowCardinality(String),
     `country` LowCardinality(String),
     `duration` UInt32
   - Table `events`:
     `timestamp` DateTime64(3),
     `site_id` LowCardinality(String),
     `visitor_hash` FixedString(64),
     `event_name` String,
     `value` Float64,
     `currency` LowCardinality(String)

INGESTION API & PRIVACY PIPELINE (/api/v1/track):
- Create a lightweight endpoint accepting GET/POST payloads from a 1.2KB embedded client script.
- Anonymous Hash Generation: Generate `visitor_hash` using HMAC-SHA256(`IP_Address` + `User_Agent` + `Site_ID` + `Daily_Rotating_Salt`). Never write raw IP addresses or User Agents to disk or logs.
- Bot Filtering: Check `User-Agent` against a regex list of common crawlers/bots (Googlebot, Bingbot, headless Chrome, curl, python-requests). Drop bot events silently.
- Write hits asynchronously to a ClickHouse batching buffer (using memory buffer flush every 2 seconds or 1000 rows).

DASHBOARD & QUERYING:
- Implement a realtime dashboard using Next.js Server Components and Recharts.
- Provide time-range filters (24h, 7d, 30d, custom date range).
- Write optimized ClickHouse queries with `sumState`, `uniqExact`, and `topK` to output:
  1. Unique Visitors & Total Pageviews
  2. Bounce Rate & Average Time on Page
  3. Top Pages (Pathnames)
  4. Top Referrers & UTM Campaign breakdown
  5. Devices, Browsers, and Countries (via GeoIP lookup)
  6. Custom Event Totals & Ecommerce Conversion Revenue
- Dashboard views must support saving preset filters and sharing public read-only URLs via signed tokens.

OUT OF SCOPE:
- Full session replay or heatmap recording.
- Fingerprinting across multiple domains or persistent third-party cookies.
- Complex multi-touch linear/time-decay attribution models.

FAILURE MODES TO HANDLE:
- ClickHouse connection pooling exhaustion during high concurrency.
- Ingestion bottleneck when receiving burst traffic (must return 204 No Content fast without awaiting DB write).
- Handling OPTIONS preflight CORS requests cleanly for cross-origin tracking script execution.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs