@iann29/rastro 0.1.0-alpha.0 → 0.1.0-alpha.10

package/agent/manifest.json

@@ -0,0 +1,187 @@
+{
+  "$schema": "https://www.amagerastro.com/agent/manifest.schema.json",
+  "name": "amage-rastro",
+  "title": "Amage Rastro",
+  "description": "Privacy-first, real-time web analytics for Convex with a read-only federated dashboard.",
+  "manifestVersion": "1.0.0",
+  "language": "en",
+  "canonicalBaseUrl": "https://www.amagerastro.com",
+  "documentation": {
+    "human": "https://www.amagerastro.com/docs/",
+    "agent": "https://www.amagerastro.com/agent/integration.md",
+    "llms": "https://www.amagerastro.com/llms.txt",
+    "protocol": "https://www.amagerastro.com/docs/reference/federation.md",
+    "setup": "https://www.amagerastro.com/docs/reference/federation-setup.md",
+    "upgrading": "https://www.amagerastro.com/docs/reference/upgrading.md",
+    "integrity": {
+      "algorithm": "sha256",
+      "agent": "b641b6cdecc0c23291e169bceef6308d1679392bec0b5c9e11715b6740be83b3",
+      "llms": "0dab84ee468ef3f22c7560bd0080957218f66d3014a660be0e93bbef1de0ccd5",
+      "protocol": "57fe1d40b81a872a027294945dc577b4a6346562620f2772074dc534c11c9190",
+      "setup": "5e7cd04a7b285a887404fe3cdae918a63374822e656395df2b50f57736e0fd54",
+      "upgrading": "c98d9773b8fe84b1b34bc3b8f35225ad65f7e23a7ce056ba0c2ce8bad979c127"
+    }
+  },
+  "controlPlane": {
+    "dashboardUrl": "https://www.amagerastro.com",
+    "functionsUrl": "https://api.amagerastro.com",
+    "httpActionsUrl": "https://site.api.amagerastro.com",
+    "issuer": "https://site.api.amagerastro.com/federation",
+    "discoveryUrl": "https://site.api.amagerastro.com/federation/.well-known/openid-configuration",
+    "jwksUrl": "https://site.api.amagerastro.com/federation/jwks.json",
+    "tokenAlgorithm": "RS256",
+    "tokenLifetimeSeconds": 600
+  },
+  "package": {
+    "name": "@iann29/rastro",
+    "distTag": "alpha",
+    "availability": "verify-exact-registry-artifact",
+    "requiredRuntimeExports": [
+      "exposeFederatedAnalyticsApi",
+      "FEDERATED_ANALYTICS_CONNECTOR_MANIFEST",
+      "FEDERATED_ANALYTICS_ERROR_CODES"
+    ],
+    "requiredTypeExports": [
+      "FederatedAnalyticsConnection",
+      "FederatedAnalyticsAuthorizerOptions",
+      "FederatedSiteSummary"
+    ],
+    "versionDiscoveryCommand": "npm view @iann29/rastro@alpha version",
+    "inspectionPolicy": "static-tarball-inspection-no-lifecycle-scripts",
+    "agentActionWhenUnavailable": "stop-and-request-eligible-release"
+  },
+  "connector": {
+    "protocol": "amage-rastro-analytics",
+    "protocolVersion": 1,
+    "moduleName": "rastroFederation",
+    "functions": {
+      "manifest": "manifest",
+      "connectionStatus": "connectionStatus",
+      "listSites": "listSites",
+      "overview": "overview",
+      "liveVisitors": "liveVisitors",
+      "listSessions": "listSessions",
+      "sessionJourney": "sessionJourney",
+      "listConversions": "listConversions",
+      "visitorJourney": "visitorJourney",
+      "goalsReport": "goalsReport",
+      "funnelsReport": "funnelsReport",
+      "affiliatesReport": "affiliatesReport",
+      "dataCoverage": "dataCoverage",
+      "vitalsReport": "vitalsReport",
+      "siteMap": "siteMap"
+    },
+    "capabilities": [
+      "siteSummaries",
+      "overview",
+      "liveVisitors",
+      "sessions",
+      "sessionJourney",
+      "conversions",
+      "visitorJourney",
+      "goals",
+      "funnels",
+      "affiliates",
+      "dataCoverage",
+      "vitals",
+      "siteMap"
+    ],
+    "limits": {
+      "maxSitesPerRequest": 10,
+      "maxSitesPerConnection": 10,
+      "maxReportRangeDays": 366,
+      "maxLiveVisitors": 500,
+      "maxJourneyEvents": 500
+    }
+  },
+  "authentication": {
+    "providerType": "customJwt",
+    "audience": "exact-normalized-customer-functions-url",
+    "permission": "analytics:read",
+    "claims": {
+      "connectionId": "rastro_connection_id",
+      "organizationId": "rastro_organization_id",
+      "permissions": "rastro_permissions"
+    },
+    "authoritativeScope": "customer-deployment-local-grant"
+  },
+  "querySemantics": {
+    "timeUnit": "unix-epoch-milliseconds",
+    "rangeBoundary": "inclusive",
+    "rangeTimezone": "UTC",
+    "overview": {
+      "hourlyMaxRangeHours": 24,
+      "dailyMaxRangeDays": 366,
+      "requiresCompleteUtcBuckets": true
+    },
+    "funnelsReport": {
+      "maxRangeDays": 90,
+      "requiresCompleteUtcDays": true
+    },
+    "affiliatesReport": {
+      "maxRangeDays": 366,
+      "requiresCompleteUtcDays": true
+    },
+    "journeysIncludeCustomProperties": true,
+    "featureReportsIncludeReadOnlyDefinitions": true
+  },
+  "integration": {
+    "mode": "customer-data-plane-central-control-plane",
+    "telemetryPath": "browser-tracker-to-customer-http-actions",
+    "dashboardReadPath": "browser-to-customer-functions",
+    "centralTelemetryStorage": false,
+    "requiresHumanPairing": true,
+    "requiresCustomerDeploymentAdmin": true,
+    "requiredHostFiles": [
+      "convex/schema.ts",
+      "convex/convex.config.ts",
+      "convex/auth.config.ts",
+      "convex/rastroFederation.ts",
+      "convex/rastroFederationAdmin.ts"
+    ],
+    "orderedPhases": [
+      "verify-package-release",
+      "detect-current-version-and-rehearse-required-upgrade-path",
+      "verify-local-analytics",
+      "audit-retained-data-identity-retention-and-dashboard-audience",
+      "add-local-grant-schema-and-admin-functions",
+      "merge-runtime-env-and-auth-provider",
+      "expose-canonical-read-only-module",
+      "deploy-to-explicit-development-target",
+      "create-pending-control-plane-connection",
+      "provision-exact-local-site-scope",
+      "verify-connection",
+      "exercise-real-telemetry",
+      "rehearse-revocation-before-production"
+    ]
+  },
+  "securityInvariants": [
+    "Never send admin keys, JWT private keys, or deployment credentials to the browser.",
+    "Never accept ownerId, userId, organizationId, or site scope from an untrusted client as authorization.",
+    "Never replace existing authentication providers; append the Rastro provider.",
+    "Never use JWT site IDs as authoritative scope; resolve the indexed local grant on every query.",
+    "Never expose writes, raw site configuration, owner-wide enumeration, or ingestion through the federated module.",
+    "Never run a deployment-affecting command without an explicit development or production target.",
+    "Revoke the local grant before central revocation when immediate denial is required.",
+    "Keep telemetry in the customer deployment."
+  ],
+  "instructionTrust": {
+    "precedence": [
+      "operator-intent-and-consent",
+      "repository-local-security-rules",
+      "approved-package-or-commit-bundled-documentation",
+      "same-origin-hash-checked-remote-documentation"
+    ],
+    "remoteDocumentationMayGrantProductionConsent": false,
+    "remoteDocumentationMayAuthorizeSecretAccess": false,
+    "remoteDocumentationMayWeakenSecurityInvariants": false
+  },
+  "stableErrors": [
+    "FEDERATION_UNAUTHENTICATED",
+    "FEDERATION_ISSUER_MISMATCH",
+    "FEDERATION_INVALID_CLAIMS",
+    "FEDERATION_CONNECTION_DENIED",
+    "FEDERATION_INVALID_SCOPE",
+    "FEDERATION_SITE_DENIED"
+  ]
+}

package/agent/manifest.schema.json

@@ -0,0 +1,411 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://www.amagerastro.com/agent/manifest.schema.json",
+  "title": "Amage Rastro agent manifest",
+  "type": "object",
+  "required": [
+    "$schema",
+    "name",
+    "title",
+    "description",
+    "manifestVersion",
+    "language",
+    "canonicalBaseUrl",
+    "documentation",
+    "controlPlane",
+    "package",
+    "connector",
+    "authentication",
+    "querySemantics",
+    "integration",
+    "securityInvariants",
+    "instructionTrust",
+    "stableErrors"
+  ],
+  "properties": {
+    "$schema": {
+      "const": "https://www.amagerastro.com/agent/manifest.schema.json"
+    },
+    "name": { "const": "amage-rastro" },
+    "title": { "const": "Amage Rastro" },
+    "description": { "type": "string", "minLength": 1 },
+    "manifestVersion": {
+      "type": "string",
+      "pattern": "^[1-9][0-9]*\\.[0-9]+\\.[0-9]+$"
+    },
+    "language": { "enum": ["en", "pt-BR"] },
+    "canonicalBaseUrl": { "$ref": "#/$defs/httpsUrl" },
+    "documentation": {
+      "type": "object",
+      "required": [
+        "human",
+        "agent",
+        "llms",
+        "protocol",
+        "setup",
+        "upgrading",
+        "integrity"
+      ],
+      "properties": {
+        "human": { "$ref": "#/$defs/httpsUrl" },
+        "agent": { "$ref": "#/$defs/httpsUrl" },
+        "llms": { "$ref": "#/$defs/httpsUrl" },
+        "protocol": { "$ref": "#/$defs/httpsUrl" },
+        "setup": { "$ref": "#/$defs/httpsUrl" },
+        "upgrading": { "$ref": "#/$defs/httpsUrl" },
+        "integrity": {
+          "type": "object",
+          "required": [
+            "algorithm",
+            "agent",
+            "llms",
+            "protocol",
+            "setup",
+            "upgrading"
+          ],
+          "properties": {
+            "algorithm": { "const": "sha256" },
+            "agent": { "$ref": "#/$defs/sha256" },
+            "llms": { "$ref": "#/$defs/sha256" },
+            "protocol": { "$ref": "#/$defs/sha256" },
+            "setup": { "$ref": "#/$defs/sha256" },
+            "upgrading": { "$ref": "#/$defs/sha256" }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "controlPlane": {
+      "type": "object",
+      "required": [
+        "dashboardUrl",
+        "functionsUrl",
+        "httpActionsUrl",
+        "issuer",
+        "discoveryUrl",
+        "jwksUrl",
+        "tokenAlgorithm",
+        "tokenLifetimeSeconds"
+      ],
+      "properties": {
+        "dashboardUrl": { "$ref": "#/$defs/httpsUrl" },
+        "functionsUrl": { "$ref": "#/$defs/httpsUrl" },
+        "httpActionsUrl": { "$ref": "#/$defs/httpsUrl" },
+        "issuer": { "$ref": "#/$defs/httpsUrl" },
+        "discoveryUrl": { "$ref": "#/$defs/httpsUrl" },
+        "jwksUrl": { "$ref": "#/$defs/httpsUrl" },
+        "tokenAlgorithm": { "const": "RS256" },
+        "tokenLifetimeSeconds": { "const": 600 }
+      },
+      "additionalProperties": false
+    },
+    "package": {
+      "type": "object",
+      "required": [
+        "name",
+        "distTag",
+        "availability",
+        "requiredRuntimeExports",
+        "requiredTypeExports",
+        "versionDiscoveryCommand",
+        "inspectionPolicy",
+        "agentActionWhenUnavailable"
+      ],
+      "properties": {
+        "name": { "const": "@iann29/rastro" },
+        "distTag": { "const": "alpha" },
+        "availability": { "const": "verify-exact-registry-artifact" },
+        "requiredRuntimeExports": {
+          "type": "array",
+          "minItems": 3,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "requiredTypeExports": {
+          "type": "array",
+          "minItems": 3,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "versionDiscoveryCommand": { "type": "string", "minLength": 1 },
+        "inspectionPolicy": {
+          "const": "static-tarball-inspection-no-lifecycle-scripts"
+        },
+        "agentActionWhenUnavailable": {
+          "const": "stop-and-request-eligible-release"
+        }
+      },
+      "additionalProperties": false
+    },
+    "connector": {
+      "type": "object",
+      "required": [
+        "protocol",
+        "protocolVersion",
+        "moduleName",
+        "functions",
+        "capabilities",
+        "limits"
+      ],
+      "properties": {
+        "protocol": { "const": "amage-rastro-analytics" },
+        "protocolVersion": { "const": 1 },
+        "moduleName": { "const": "rastroFederation" },
+        "functions": {
+          "type": "object",
+          "required": [
+            "manifest",
+            "connectionStatus",
+            "listSites",
+            "overview",
+            "liveVisitors",
+            "listSessions",
+            "sessionJourney",
+            "listConversions",
+            "visitorJourney",
+            "goalsReport",
+            "funnelsReport",
+            "affiliatesReport",
+            "dataCoverage",
+            "vitalsReport",
+            "siteMap"
+          ],
+          "properties": {
+            "manifest": { "const": "manifest" },
+            "connectionStatus": { "const": "connectionStatus" },
+            "listSites": { "const": "listSites" },
+            "overview": { "const": "overview" },
+            "liveVisitors": { "const": "liveVisitors" },
+            "listSessions": { "const": "listSessions" },
+            "sessionJourney": { "const": "sessionJourney" },
+            "listConversions": { "const": "listConversions" },
+            "visitorJourney": { "const": "visitorJourney" },
+            "goalsReport": { "const": "goalsReport" },
+            "funnelsReport": { "const": "funnelsReport" },
+            "affiliatesReport": { "const": "affiliatesReport" },
+            "dataCoverage": { "const": "dataCoverage" },
+            "vitalsReport": { "const": "vitalsReport" },
+            "siteMap": { "const": "siteMap" }
+          },
+          "additionalProperties": false
+        },
+        "capabilities": {
+          "type": "array",
+          "minItems": 13,
+          "maxItems": 13,
+          "uniqueItems": true,
+          "items": {
+            "enum": [
+              "siteSummaries",
+              "overview",
+              "liveVisitors",
+              "sessions",
+              "sessionJourney",
+              "conversions",
+              "visitorJourney",
+              "goals",
+              "funnels",
+              "affiliates",
+              "dataCoverage",
+              "vitals",
+              "siteMap"
+            ]
+          }
+        },
+        "limits": {
+          "type": "object",
+          "required": [
+            "maxSitesPerRequest",
+            "maxSitesPerConnection",
+            "maxReportRangeDays",
+            "maxLiveVisitors",
+            "maxJourneyEvents"
+          ],
+          "properties": {
+            "maxSitesPerRequest": { "const": 10 },
+            "maxSitesPerConnection": { "const": 10 },
+            "maxReportRangeDays": { "const": 366 },
+            "maxLiveVisitors": { "const": 500 },
+            "maxJourneyEvents": { "const": 500 }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "authentication": {
+      "type": "object",
+      "required": [
+        "providerType",
+        "audience",
+        "permission",
+        "claims",
+        "authoritativeScope"
+      ],
+      "properties": {
+        "providerType": { "const": "customJwt" },
+        "audience": { "const": "exact-normalized-customer-functions-url" },
+        "permission": { "const": "analytics:read" },
+        "claims": {
+          "type": "object",
+          "required": ["connectionId", "organizationId", "permissions"],
+          "properties": {
+            "connectionId": { "const": "rastro_connection_id" },
+            "organizationId": { "const": "rastro_organization_id" },
+            "permissions": { "const": "rastro_permissions" }
+          },
+          "additionalProperties": false
+        },
+        "authoritativeScope": { "const": "customer-deployment-local-grant" }
+      },
+      "additionalProperties": false
+    },
+    "querySemantics": {
+      "type": "object",
+      "required": [
+        "timeUnit",
+        "rangeBoundary",
+        "rangeTimezone",
+        "overview",
+        "funnelsReport",
+        "affiliatesReport",
+        "journeysIncludeCustomProperties",
+        "featureReportsIncludeReadOnlyDefinitions"
+      ],
+      "properties": {
+        "timeUnit": { "const": "unix-epoch-milliseconds" },
+        "rangeBoundary": { "const": "inclusive" },
+        "rangeTimezone": { "const": "UTC" },
+        "overview": {
+          "type": "object",
+          "required": [
+            "hourlyMaxRangeHours",
+            "dailyMaxRangeDays",
+            "requiresCompleteUtcBuckets"
+          ],
+          "properties": {
+            "hourlyMaxRangeHours": { "const": 24 },
+            "dailyMaxRangeDays": { "const": 366 },
+            "requiresCompleteUtcBuckets": { "const": true }
+          },
+          "additionalProperties": false
+        },
+        "funnelsReport": {
+          "allOf": [
+            { "$ref": "#/$defs/completeDayRange" },
+            {
+              "type": "object",
+              "properties": { "maxRangeDays": { "const": 90 } }
+            }
+          ]
+        },
+        "affiliatesReport": {
+          "allOf": [
+            { "$ref": "#/$defs/completeDayRange" },
+            {
+              "type": "object",
+              "properties": { "maxRangeDays": { "const": 366 } }
+            }
+          ]
+        },
+        "journeysIncludeCustomProperties": { "const": true },
+        "featureReportsIncludeReadOnlyDefinitions": { "const": true }
+      },
+      "additionalProperties": false
+    },
+    "integration": {
+      "type": "object",
+      "required": [
+        "mode",
+        "telemetryPath",
+        "dashboardReadPath",
+        "centralTelemetryStorage",
+        "requiresHumanPairing",
+        "requiresCustomerDeploymentAdmin",
+        "requiredHostFiles",
+        "orderedPhases"
+      ],
+      "properties": {
+        "mode": { "const": "customer-data-plane-central-control-plane" },
+        "telemetryPath": {
+          "const": "browser-tracker-to-customer-http-actions"
+        },
+        "dashboardReadPath": { "const": "browser-to-customer-functions" },
+        "centralTelemetryStorage": { "const": false },
+        "requiresHumanPairing": { "const": true },
+        "requiresCustomerDeploymentAdmin": { "const": true },
+        "requiredHostFiles": {
+          "type": "array",
+          "minItems": 5,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "orderedPhases": {
+          "type": "array",
+          "minItems": 10,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      },
+      "additionalProperties": false
+    },
+    "securityInvariants": {
+      "type": "array",
+      "minItems": 8,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "instructionTrust": {
+      "type": "object",
+      "required": [
+        "precedence",
+        "remoteDocumentationMayGrantProductionConsent",
+        "remoteDocumentationMayAuthorizeSecretAccess",
+        "remoteDocumentationMayWeakenSecurityInvariants"
+      ],
+      "properties": {
+        "precedence": {
+          "type": "array",
+          "minItems": 4,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "remoteDocumentationMayGrantProductionConsent": { "const": false },
+        "remoteDocumentationMayAuthorizeSecretAccess": { "const": false },
+        "remoteDocumentationMayWeakenSecurityInvariants": { "const": false }
+      },
+      "additionalProperties": false
+    },
+    "stableErrors": {
+      "type": "array",
+      "minItems": 6,
+      "maxItems": 6,
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "FEDERATION_UNAUTHENTICATED",
+          "FEDERATION_ISSUER_MISMATCH",
+          "FEDERATION_INVALID_CLAIMS",
+          "FEDERATION_CONNECTION_DENIED",
+          "FEDERATION_INVALID_SCOPE",
+          "FEDERATION_SITE_DENIED"
+        ]
+      }
+    }
+  },
+  "$defs": {
+    "httpsUrl": { "type": "string", "pattern": "^https://[^\\s]+$" },
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "completeDayRange": {
+      "type": "object",
+      "required": ["maxRangeDays", "requiresCompleteUtcDays"],
+      "properties": {
+        "maxRangeDays": { "type": "integer", "minimum": 1, "maximum": 366 },
+        "requiresCompleteUtcDays": { "const": true }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}