@iann29/rastro 0.1.0-alpha.8 → 0.1.0

package/dist/tracker/tracker.js

@@ -32,7 +32,18 @@
         sessionId = createId();
         affiliate = referral;
     }
-    const visitorId = script.dataset.visitor || sessionId;
+    // The identity, in order: the host's signed-in id, the persistent
+    // pseudonymous id (one random id per browser and site origin, kept in
+    // localStorage), and, when storage is blocked, the per-tab session id —
+    // which the server then counts through its salted daily hash.
+    let visitorId = script.dataset.visitor;
+    try {
+        visitorId ||= localStorage._rv ||= createId();
+    }
+    catch {
+        // Blocked storage never breaks the page; the session still counts.
+    }
+    visitorId ||= sessionId;
     let sequence = 0;
     let flushTimer;
     const queue = [];
@@ -124,7 +135,18 @@
     wrapHistory("pushState");
     wrapHistory("replaceState");
     addEventListener("popstate", pageview);
-    addEventListener("pagehide", () => flush(true));
+    addEventListener("pagehide", () => {
+        emit("leave");
+        flush(true);
+    });
+    addEventListener("pageshow", (event) => {
+        // Back from the bfcache: the leave above already shortened this session's
+        // live presence, so revive it immediately instead of waiting a beat.
+        if (event.persisted) {
+            emit("heartbeat");
+            flush(true);
+        }
+    });
     setInterval(() => {
         emit("heartbeat");
         flush();

package/dist/tracker/tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../src/tracker/tracker.ts"],"names":[],"mappings":";AAoCA,CAAC,GAAG,EAAE;IACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAyC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;IACpC,MAAM,QAAQ,GACZ,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEjC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,gFAAgF;IAChF,IAAI,GAAiC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;QAC9B,SAAS,GAAG,QAAQ,IAAI,cAAc,CAAC,EAAE,CAAC;QAC1C,IAAI,SAAS;YAAE,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;QAC7C,GAAG,KAAK,cAAc,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG;YAAE,cAAc,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,QAAQ,EAAE,CAAC;QACvB,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAqD,CAAC;IAC1D,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ;QAChC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM;QACnC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,KAAK,GAAG,CAAC,MAAgB,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAC3B,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACrD,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CACnE,GAAG,EAAE;gBACH,mEAAmE;YACrE,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CACX,IAAqB,EACrB,IAAa,EACb,KAA4B,EAC5B,EAAE;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE;YAC7D,SAAS;YACT,SAAS;YACT,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,QAAQ,EAAE;YACpB,aAAa,EAAE,SAAS;YACxB,GAAG,KAAK;SACT,CAAC,CAAC;QACH,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,IAAI,QAA4B,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IACD,MAAuB,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC3D,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,CACF,QAAQ,EACR,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAClC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,MAAM;gBACtD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,CACnB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,gBAAgB,CACvB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,OAAO,GAAI,KAAK,CAAC,MAAyB,EAAE,OAAO,CACvD,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;QACjD,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAoB,CAAC;QACvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE;YAC5D,MAAM,EAAE,CACN,OAAO,CAAC,OAAO,CAAC,WAAW;gBAC3B,OAAO,CAAC,SAAS;gBACjB,OAAO,CAAC,OAAO,CAChB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,EAAE,GAAG;gBACP,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC/D,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC,EACD,IAAI,CACL,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,MAAoC,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,UAAU,GAAG,IAAI;YACjC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,WAAW,CAAC,WAAW,CAAC,CAAC;IACzB,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5B,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,WAAW,CAAC,GAAG,EAAE;QACf,IAAI,CAAC,WAAW,CAAC,CAAC;QAClB,KAAK,EAAE,CAAC;IACV,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,QAAQ,EAAE,CAAC;AACb,CAAC,CAAC,EAAE,CAAC"}
+{"version":3,"file":"tracker.js","sourceRoot":"","sources":["../../src/tracker/tracker.ts"],"names":[],"mappings":";AA0CA,CAAC,GAAG,EAAE;IACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAyC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;IACpC,MAAM,QAAQ,GACZ,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEjC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,gFAAgF;IAChF,IAAI,GAAiC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;QAC9B,SAAS,GAAG,QAAQ,IAAI,cAAc,CAAC,EAAE,CAAC;QAC1C,IAAI,SAAS;YAAE,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;QAC7C,GAAG,KAAK,cAAc,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG;YAAE,cAAc,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,QAAQ,EAAE,CAAC;QACvB,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,KAAK,YAAY,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,SAAS,KAAK,SAAS,CAAC;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAqD,CAAC;IAC1D,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ;QAChC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM;QACnC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,KAAK,GAAG,CAAC,MAAgB,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAC3B,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACrD,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CACnE,GAAG,EAAE;gBACH,mEAAmE;YACrE,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CACX,IAAqB,EACrB,IAAa,EACb,KAA4B,EAC5B,EAAE;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE;YAC7D,SAAS;YACT,SAAS;YACT,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,QAAQ,EAAE;YACpB,aAAa,EAAE,SAAS;YACxB,GAAG,KAAK;SACT,CAAC,CAAC;QACH,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,IAAI,QAA4B,CAAC;IACjC,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IACD,MAAuB,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC/D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC3D,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,CACF,QAAQ,EACR,GAAG,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAClC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,MAAM;gBACtD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,CACnB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,gBAAgB,CACvB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,OAAO,GAAI,KAAK,CAAC,MAAyB,EAAE,OAAO,CACvD,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QACzC,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;QACjD,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAoB,CAAC;QACvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,QAAkB,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE;YAC5D,MAAM,EAAE,CACN,OAAO,CAAC,OAAO,CAAC,WAAW;gBAC3B,OAAO,CAAC,SAAS;gBACjB,OAAO,CAAC,OAAO,CAChB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,EAAE,GAAG;gBACP,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC/D,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC,EACD,IAAI,CACL,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,MAAoC,EAAE,EAAE;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,UAAU,GAAG,IAAI;YACjC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,WAAW,CAAC,WAAW,CAAC,CAAC;IACzB,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5B,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE;QAChC,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,gBAAgB,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QACrC,0EAA0E;QAC1E,qEAAqE;QACrE,IAAK,KAA6B,CAAC,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,EAAE;QACf,IAAI,CAAC,WAAW,CAAC,CAAC;QAClB,KAAK,EAAE,CAAC;IACV,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,QAAQ,EAAE,CAAC;AACb,CAAC,CAAC,EAAE,CAAC"}

package/dist/tracker.min.js

@@ -1 +1 @@
-(()=>{const e=document.currentScript,t=e?.dataset.site,s=e?.dataset.endpoint||e?.src&&new URL("events",e.src).href;if(!t||!s)return;const o=()=>crypto.randomUUID?.()||Math.random()+"",n=new URLSearchParams(location.search),r=n.get("ref")?.slice(0,64);let a,i,c;for(const e of["source","medium","campaign","term","content"]){const t=n.get("utm_"+e)?.slice(0,64);t&&((a??={})["utm_"+e]=t)}try{i=sessionStorage._r||o(),sessionStorage._r=i,c=r||sessionStorage._a,c&&(sessionStorage._a=c),a||=sessionStorage._u&&JSON.parse(sessionStorage._u),a&&(sessionStorage._u=JSON.stringify(a))}catch{i=o(),c=r}const d=e.dataset.visitor||i;let l,p=0;const g=[],u=document.referrer?new URL(document.referrer).origin:void 0,h=e=>{const o=g.splice(0,50);if(!o.length)return;const n=()=>new Blob([JSON.stringify({siteId:t,events:o,sentAt:Date.now()})]);let r=n();for(;r.size>64e3&&o.length>1;)g.unshift(o.pop()),r=n();e&&navigator.sendBeacon(s,r)||fetch(s,{method:"POST",body:r,keepalive:1}).catch(()=>{}),g.length&&h(e)},m=(e,t,s)=>{const o=Date.now();g.push({eventId:`${i}.${o.toString(36)}.${p}`,sessionId:i,visitorId:d,type:e,name:t,path:location.pathname.slice(0,256),referrer:u,timestamp:o,sequence:p++,affiliateSlug:c,...s}),clearTimeout(l),l=setTimeout(h,1200)};let f;const v=()=>{const e=location.pathname;e!==f&&(f=e,m("pageview",void 0,a&&{properties:a}))};window.rastro=(e,t,s)=>{if("context"===e)return{sessionId:i,visitorId:d};"event"===e&&m("custom",`${t||"event"}`.slice(0,80),s&&JSON.stringify(s).length>2e4?void 0:{properties:s})},document.addEventListener("click",e=>{const t=e.target?.closest("a,button,[data-rastro-event]");if(!t)return;const s=t.dataset.rastroEvent,o=t.href,n=o&&new URL(o),r=/^https?:$/.test(n?.protocol),a=r&&n.origin!==location.origin;m(s?"custom":a?"outbound":"click",s,{target:(t.dataset.rastroLabel||t.innerText||t.tagName).slice(0,64),href:r?((a?n.origin:"")+n.pathname).slice(0,256):void 0})},1);const S=e=>{const t=history[e];history[e]=(...e)=>{t.apply(history,e),v()}};S("pushState"),S("replaceState"),addEventListener("popstate",v),addEventListener("pagehide",()=>h(1)),setInterval(()=>{m("heartbeat"),h()},2e4),v()})();
+(()=>{const e=document.currentScript,t=e?.dataset.site,s=e?.dataset.endpoint||e?.src&&new URL("events",e.src).href;if(!t||!s)return;const o=()=>crypto.randomUUID?.()||Math.random()+"",n=new URLSearchParams(location.search),r=n.get("ref")?.slice(0,64);let a,i,c;for(const e of["source","medium","campaign","term","content"]){const t=n.get("utm_"+e)?.slice(0,64);t&&((a??={})["utm_"+e]=t)}try{i=sessionStorage._r||o(),sessionStorage._r=i,c=r||sessionStorage._a,c&&(sessionStorage._a=c),a||=sessionStorage._u&&JSON.parse(sessionStorage._u),a&&(sessionStorage._u=JSON.stringify(a))}catch{i=o(),c=r}let d=e.dataset.visitor;try{d||=localStorage._rv||=o()}catch{}d||=i;let l,p=0;const g=[],h=document.referrer?new URL(document.referrer).origin:void 0,u=e=>{const o=g.splice(0,50);if(!o.length)return;const n=()=>new Blob([JSON.stringify({siteId:t,events:o,sentAt:Date.now()})]);let r=n();for(;r.size>64e3&&o.length>1;)g.unshift(o.pop()),r=n();e&&navigator.sendBeacon(s,r)||fetch(s,{method:"POST",body:r,keepalive:1}).catch(()=>{}),g.length&&u(e)},m=(e,t,s)=>{const o=Date.now();g.push({eventId:`${i}.${o.toString(36)}.${p}`,sessionId:i,visitorId:d,type:e,name:t,path:location.pathname.slice(0,256),referrer:h,timestamp:o,sequence:p++,affiliateSlug:c,...s}),clearTimeout(l),l=setTimeout(u,1200)};let v;const f=()=>{const e=location.pathname;e!==v&&(v=e,m("pageview",void 0,a&&{properties:a}))};window.rastro=(e,t,s)=>{if("context"===e)return{sessionId:i,visitorId:d};"event"===e&&m("custom",`${t||"event"}`.slice(0,80),s&&JSON.stringify(s).length>2e4?void 0:{properties:s})},document.addEventListener("click",e=>{const t=e.target?.closest("a,button,[data-rastro-event]");if(!t)return;const s=t.dataset.rastroEvent,o=t.href,n=o&&new URL(o),r=/^https?:$/.test(n?.protocol),a=r&&n.origin!==location.origin;m(s?"custom":a?"outbound":"click",s,{target:(t.dataset.rastroLabel||t.innerText||t.tagName).slice(0,64),href:r?((a?n.origin:"")+n.pathname).slice(0,256):void 0})},1);const S=e=>{const t=history[e];history[e]=(...e)=>{t.apply(history,e),f()}};S("pushState"),S("replaceState"),addEventListener("popstate",f),addEventListener("pagehide",()=>{m("leave"),u(1)}),addEventListener("pageshow",e=>{e.persisted&&(m("heartbeat"),u(1))}),setInterval(()=>{m("heartbeat"),u()},2e4),f()})();

package/docs/federation-setup.md

@@ -10,7 +10,7 @@ Do not infer federation availability from this website, a dist-tag, or a source
 checkout. Discover the current tag without changing the host:
 
 ```bash
-npm view @iann29/rastro@alpha version
+npm view @iann29/rastro version
 ```
 
 After the operator approves that exact version, execute the complete static
@@ -37,7 +37,10 @@ Do not configure federation until the customer deployment already has:
 - at least one site with the correct allowed browser domains;
 - a tracker using the deployment's HTTP-actions URL;
 - an accepted `POST /rastro/events` request;
-- a protected local report returning that site's telemetry.
+- a protected local report returning that site's telemetry — `liveVisitors` or
+  `sessionJourney` reflect an accepted request immediately, while `listSessions`
+  and the bucketed `overview` can trail it by seconds, so an empty result from
+  those two right after the first request is not a failure;
 - an audit through authorized local reports of retained routes, visitor/session
   IDs, live location, campaigns, affiliates, conversions, and custom properties,
   proving that no unexpected personal data, credentials, secrets, or form values
@@ -95,19 +98,24 @@ rastroFederationGrants: defineTable({
   connectionId: v.string(),
   organizationId: v.string(),
   siteIds: v.array(v.string()),
+  // Absent means read only. "analytics:configure" lets the dashboard's
+  // owners and admins manage goals, funnels, affiliates, site settings and
+  // retention for the granted sites; "analytics:public" lets them publish a
+  // read-only public link of those sites.
+  permissions: v.optional(v.array(v.string())),
   revokedAt: v.optional(v.number()),
   createdAt: v.number(),
   updatedAt: v.number(),
 }).index("by_connectionId", ["connectionId"]),
 ```
 
-The grant, not the JWT, owns the allowed `siteIds`. Add operator-only
-provisioning functions:
+The grant, not the JWT, owns the allowed `siteIds` and the permissions the host
+honors. Add operator-only provisioning functions:
 
 ```ts
 // convex/rastroFederationAdmin.ts
 import { ConvexError, v } from "convex/values";
-import { Rastro } from "@iann29/rastro";
+import { federatedAnalyticsPermissionValidator, Rastro } from "@iann29/rastro";
 import { components } from "./_generated/api";
 import { internalMutation } from "./_generated/server";
 
@@ -119,10 +127,12 @@ export const provisionConnection = internalMutation({
     organizationId: v.string(),
     ownerId: v.string(),
     siteIds: v.array(v.string()),
+    permissions: v.optional(v.array(federatedAnalyticsPermissionValidator)),
   },
   returns: v.null(),
   handler: async (ctx, args) => {
     const siteIds = [...new Set(args.siteIds)];
+    const permissions = [...new Set(args.permissions ?? [])];
     if (
       args.connectionId.length === 0 ||
       args.connectionId.length > 128 ||
@@ -153,6 +163,7 @@ export const provisionConnection = internalMutation({
       connectionId: args.connectionId,
       organizationId: args.organizationId,
       siteIds,
+      permissions: permissions.length ? permissions : undefined,
       revokedAt: undefined,
       updatedAt: now,
     };
@@ -198,6 +209,22 @@ only with deployment administrator credentials. A host that needs self-service
 pairing may wrap equivalent logic in its own authenticated owner/admin mutation;
 never accept an owner or user ID from an untrusted caller.
 
+`permissions` is the opt-in for the configure scope. Leave it out for a
+read-only connection: the dashboard then shows every configuration form but ends
+each one in the code the host runs itself. Pass `["analytics:configure"]` to let
+the dashboard organization's owners and admins create and change goals, funnels,
+affiliates, the site's name, domains and timezone, and the retention policy for
+the granted sites; members of the organization stay read only whatever the grant
+says, because the control plane never puts the configure claim in their tokens.
+
+Add `"analytics:public"` to let the organization's owners and admins create
+public links: a page at `https://www.amagerastro.com/#/p/<slug>` that anyone
+opens without a sign-in and that shows only the overview — without revenue,
+conversions, goals, campaigns, or custom events — and the live visitors —
+without visitor identities — of the sites a link names. The dashboard offers the
+form only after a verification records the permission, and removing it from the
+grant silences every link at its next token.
+
 ## 5. Trust the federation issuer
 
 The displayed issuer must exactly equal the independently verified production
@@ -231,10 +258,16 @@ Insert only these two properties into the pilot project's existing
 changing any other `defineApp` option. Do not add a second Rastro mount:
 
 ```ts
-RASTRO_FEDERATION_ISSUER: v.string(),
-RASTRO_FEDERATION_AUDIENCE: v.string(),
+RASTRO_FEDERATION_ISSUER: v.optional(v.string()),
+RASTRO_FEDERATION_AUDIENCE: v.optional(v.string()),
 ```
 
+Declare them optional, as the [example host](../example/convex/convex.config.ts)
+does. A required `v.string()` makes the push fail on a deployment where the
+values are not set yet — including every deployment that pushes the code before
+pairing. Set both values first and push afterwards: `auth.config.ts` reads them
+at deploy time, so values set after a push take effect only on the next push.
+
 Insert this conditional spread into the existing `providers` array; never
 replace the array or its current entries:
 
@@ -258,7 +291,7 @@ const audience = process.env.RASTRO_FEDERATION_AUDIENCE;
 An exact issuer mismatch is rejected even when the JWT signature is otherwise
 valid. Convex discovers keys from `<issuer>/.well-known/openid-configuration`.
 
-## 6. Expose the read-only host module
+## 6. Expose the host module
 
 Create the canonical module with this exact filename:
 
@@ -267,12 +300,21 @@ Create the canonical module with this exact filename:
 import {
   exposeFederatedAnalyticsApi,
   type FederatedAnalyticsConnection,
+  type FederatedAnalyticsPermission,
 } from "@iann29/rastro";
 import { components } from "./_generated/api";
 import { env, type QueryCtx } from "./_generated/server";
 
+/** The production Amage Rastro OIDC issuer; override with RASTRO_FEDERATION_ISSUER. */
+export const DEFAULT_FEDERATION_ISSUER =
+  "https://site.api.amagerastro.com/federation";
+
+export const federationIssuer = (
+  env.RASTRO_FEDERATION_ISSUER ?? DEFAULT_FEDERATION_ISSUER
+).replace(/\/$/, "");
+
 const federated = exposeFederatedAnalyticsApi(components.rastroAnalytics, {
-  issuer: env.RASTRO_FEDERATION_ISSUER.replace(/\/$/, ""),
+  issuer: federationIssuer,
   resolveConnection: async (ctx, identity) => {
     const db = ctx.db as unknown as QueryCtx["db"];
     const grant = await db
@@ -286,6 +328,7 @@ const federated = exposeFederatedAnalyticsApi(components.rastroAnalytics, {
       connectionId: grant.connectionId,
       organizationId: grant.organizationId,
       siteIds: grant.siteIds,
+      permissions: grant.permissions as FederatedAnalyticsPermission[],
       revokedAt: grant.revokedAt,
     } satisfies FederatedAnalyticsConnection;
   },
@@ -307,11 +350,33 @@ export const {
   vitalsReport,
   siteMap,
   dataCoverage,
+  siteSettings,
+  updateSite,
+  listGoals,
+  upsertGoal,
+  removeGoal,
+  listFunnels,
+  upsertFunnel,
+  removeFunnel,
+  listAffiliates,
+  upsertAffiliate,
+  removeAffiliate,
+  retentionStatus,
+  setRetentionPolicy,
+  disableRetentionPolicy,
 } = federated;
 ```
 
-The manifest is public static metadata. Every other function is read-only and
-requires both a valid JWT and a matching non-revoked local grant.
+The manifest is public static metadata. Every report function is read-only and
+requires both a valid JWT and a matching non-revoked local grant. The functions
+from `siteSettings` down are the configure scope: they also require
+`analytics:configure` on the token and in the grant, and fail with
+`FEDERATION_CONFIGURE_FORBIDDEN` otherwise. A host that keeps every grant
+read-only may omit them from the export; the dashboard never calls them for a
+read-only connection. The issuer falls back to the production control plane so
+the module compiles and pushes before the environment variable exists; tokens
+are still rejected until `auth.config.ts` trusts the same issuer, which requires
+both variables to be set and the deployment pushed afterwards.
 
 ## 7. Deploy and provision
 
@@ -339,7 +404,10 @@ synapse convex --dev run rastroFederationAdmin:provisionConnection \
 ```
 
 Use the corresponding explicit production target only after rehearsing DEV. The
-command is idempotent for one `connectionId` and replaces its site scope.
+command is idempotent for one `connectionId` and replaces its site scope and
+permissions. To opt into the configure scope, add
+`"permissions":["analytics:configure"]` to the same JSON; run the command again
+without it to return the connection to read only.
 
 ## 8. Verify in order
 
@@ -351,9 +419,15 @@ command is idempotent for one `connectionId` and replaces its site scope.
 6. Trigger one real browser pageview and confirm Ao vivo updates reactively.
 7. Check Metas/Afiliados with a complete UTC-day range when those features are
    configured.
-
-The central verification signs a short-lived RS256 token, calls authenticated
-`connectionStatus` and `listSites`, and refuses incompatible manifests or
+8. Confirm the connection card in **Conexões** reads "Somente leitura" or
+   "Leitura e configuração" as the grant intends. When it reads "Leitura e
+   configuração", create a goal from **Metas** as an owner or admin and confirm
+   it appears in the host's `listGoals`; then sign in as a member and confirm
+   the same form only offers the code.
+
+The central verification signs a short-lived RS256 token with the verifying
+admin's permissions, calls authenticated `connectionStatus` and `listSites`,
+records the permissions the host honors, and refuses incompatible manifests or
 inconsistent site counts.
 
 ## 9. Revoke safely
@@ -380,18 +454,21 @@ the local step, an existing token remains usable until its ten-minute expiry.
 
 ## Troubleshooting
 
-| Symptom or code                | Check                                                                         |
-| ------------------------------ | ----------------------------------------------------------------------------- |
-| Manifest not found             | File must be `convex/rastroFederation.ts`; deploy/codegen must have completed |
-| `FEDERATION_UNAUTHENTICATED`   | Federation provider missing, token absent, or deployment not redeployed       |
-| `FEDERATION_ISSUER_MISMATCH`   | `auth.config.ts` domain and helper issuer differ, often by a trailing slash   |
-| JWT audience failure           | `RASTRO_FEDERATION_AUDIENCE` must equal the functions URL, not the HTTP URL   |
-| `FEDERATION_CONNECTION_DENIED` | Grant missing, organization mismatched, empty, malformed, or revoked          |
-| `FEDERATION_SITE_DENIED`       | Dashboard requested a site outside the local grant                            |
-| Tracker 404                    | Tracker uses the functions URL instead of the HTTP-actions URL                |
-| `ORIGIN_NOT_ALLOWED`           | Browser host is absent from the site's exact/wildcard domains                 |
-| `REPORT_INCOMPLETE`            | Use complete UTC buckets or reduce a range that exceeds a bounded read budget |
-| `UNTRUSTED_DEPLOYMENT_HOST`    | Ask the control-plane operator to allow the exact custom functions origin     |
+| Symptom or code                  | Check                                                                         |
+| -------------------------------- | ----------------------------------------------------------------------------- |
+| Manifest not found               | File must be `convex/rastroFederation.ts`; deploy/codegen must have completed |
+| `FEDERATION_UNAUTHENTICATED`     | Federation provider missing, token absent, or deployment not redeployed       |
+| `FEDERATION_ISSUER_MISMATCH`     | `auth.config.ts` domain and helper issuer differ, often by a trailing slash   |
+| JWT audience failure             | `RASTRO_FEDERATION_AUDIENCE` must equal the functions URL, not the HTTP URL   |
+| `FEDERATION_CONNECTION_DENIED`   | Grant missing, organization mismatched, empty, malformed, or revoked          |
+| `FEDERATION_SITE_DENIED`         | Dashboard requested a site outside the local grant                            |
+| `FEDERATION_CONFIGURE_FORBIDDEN` | Grant lacks `analytics:configure`, or the viewer is not an owner or admin     |
+| `FEDERATION_PUBLIC_FORBIDDEN`    | Grant lacks `analytics:public`, or a public link asked beyond its surface     |
+| Missing function on configure    | Host upgraded the package but did not re-export the configure functions       |
+| Tracker 404                      | Tracker uses the functions URL instead of the HTTP-actions URL                |
+| `ORIGIN_NOT_ALLOWED`             | Browser host is absent from the site's exact/wildcard domains                 |
+| `REPORT_INCOMPLETE`              | Use complete UTC buckets or reduce a range that exceeds a bounded read budget |
+| `UNTRUSTED_DEPLOYMENT_HOST`      | Ask the control-plane operator to allow the exact custom functions origin     |
 
 Do not fix authorization errors by weakening the resolver, copying site IDs into
 JWT claims, or exposing a permissive report API.

package/docs/federation.md

@@ -31,7 +31,10 @@ v1 contract:
 The host module must be `convex/rastroFederation.ts`, so its public references
 match the function names advertised by the manifest. The generated `manifest`
 query is public because it contains only static protocol metadata. It does not
-resolve a connection or expose customer data.
+resolve a connection or expose customer data. Compare a served manifest with
+`agent/manifest.json`'s `connector` object structurally, never as serialized
+text: the two are the same value with different key order, and a byte-for-byte
+comparison fails on a correct host.
 
 The exact generated surface is:
 
@@ -50,9 +53,23 @@ The exact generated surface is:
 - `dataCoverage`
 - `vitalsReport` (optional capability `vitals`, hosts from `alpha.6`)
 - `siteMap` (optional capability `siteMap`, hosts from `alpha.8`)
-
-There are no ingestion, configuration-write, retention-write, raw-site, or site
-mutation functions in this surface. The read-only goal, funnel, and affiliate
+- the configure scope (optional capability `configure`, hosts from `alpha.11`):
+  `siteSettings`, `updateSite`, `listGoals`, `upsertGoal`, `removeGoal`,
+  `listFunnels`, `upsertFunnel`, `removeFunnel`, `listAffiliates`,
+  `upsertAffiliate`, `removeAffiliate`, `retentionStatus`, `setRetentionPolicy`,
+  and `disableRetentionPolicy`
+
+Hosts from `alpha.11` also advertise the optional capability `localDays`: their
+`overview` answers a daily range that covers whole calendar days in the site's
+timezone from buckets kept in that zone, and `listSites` says per site which
+zone that is and since when the days are complete. Dashboards must not require
+the capability.
+
+There are no ingestion, owner-wide enumeration, or arbitrary host functions in
+this surface, and no write runs with a read-only token: every function of the
+configure scope requires the `analytics:configure` permission on the token
+**and** on the host's local grant, as described under
+[Configure scope](#configure-scope). The read-only goal, funnel, and affiliate
 reports include their bounded definitions, and `listConversions` returns only
 the trusted server-side conversion ledger. Browser `conversion` telemetry
 remains untrusted journey data and never enters that ledger. Journey events
@@ -62,13 +79,87 @@ host `AnalyticsAuthorizer`.
 
 `connectionStatus` authenticates and resolves the authoritative connection on
 every call. Its response is deliberately redacted to status, protocol version,
-capabilities, and site count. It does not return connection IDs, organization
-IDs, identity claims, or site IDs.
+capabilities, the effective permissions, and site count. It does not return
+connection IDs, organization IDs, identity claims, or site IDs.
 
 `listSites` takes no arguments. It loads sites only from the `siteIds` in the
 validated local connection and returns `FederatedSiteSummary` values containing
-only `siteId`, `name`, `currency`, `timezone`, and `cookieless`. In particular,
-it never returns `ownerId`, `domains`, or `networkId`.
+only `siteId`, `name`, `currency`, `timezone`, `cookieless`, and (hosts from
+`alpha.11`) `localDays` — `{ timezone, since }` when the host keeps the site's
+calendar days, `null` otherwise. In particular, it never returns `ownerId`,
+`domains`, or `networkId`.
+
+## Configure scope
+
+Hosts from `alpha.11` advertise the optional `configure` capability. Behind it,
+the dashboard's organization owners and admins can manage goals, funnels,
+affiliates, site settings, and the retention policy of the granted sites without
+a host deploy. The scope is off unless the host opts in:
+
+- The control plane mints `rastro_permissions: ["analytics:read"]` for every
+  member and adds `"analytics:configure"` only for members whose organization
+  role is `owner` or `admin`.
+- The host's local grant lists the permissions it honors. A grant without
+  `permissions`, or without `analytics:configure` in it, is read only whatever
+  the token claims.
+- A configure function runs only when both agree; otherwise it fails with
+  `FEDERATION_CONFIGURE_FORBIDDEN` before the site scope is examined, so a
+  read-only token learns nothing about the grant by probing. `connectionStatus`
+  reports the effective permissions, and the dashboard renders forms only when
+  they include the configure scope; otherwise every form ends in the code the
+  host runs itself.
+
+The scope is bounded to configuration: `upsertGoal`, `removeGoal`,
+`upsertFunnel`, `removeFunnel`, `upsertAffiliate`, and `removeAffiliate` mirror
+the `Rastro` class, `listGoals`, `listFunnels`, and `listAffiliates` return the
+definitions, `setRetentionPolicy` and `disableRetentionPolicy` manage the
+recurring cleanup that `retentionStatus` reports, and `updateSite` changes only
+`name`, `domains`, and `timezone` — the currency is fixed by the ledger and
+`cookieless`, `networkId`, and `ownerId` stay outside the protocol.
+`siteSettings` is the one place the surface shows a site's `domains`, because a
+connection allowed to change them must see them; `listSites` stays redacted for
+every reader. Nothing in the scope ingests telemetry or enumerates sites beyond
+the grant. The constants `FEDERATED_ANALYTICS_CONFIGURE_PERMISSION`,
+`FEDERATED_ANALYTICS_PERMISSIONS`, `FEDERATED_ANALYTICS_CONFIGURE_FUNCTIONS`,
+the `federatedAnalyticsPermissionValidator`, and `effectiveFederatedPermissions`
+are exported for hosts and connector clients.
+
+## Public links
+
+Hosts from `0.1.0` honor a third permission, `analytics:public`, which the
+control plane claims for a **public link**: a read-only page at
+`https://www.amagerastro.com/#/p/<slug>` that anyone holding the address opens
+without a sign-in. Its token carries `rastro_permissions: ["analytics:public"]`
+— never `analytics:read` — and `rastro_site_ids`, the sites the link was created
+for. The host decides twice:
+
+- A grant that does not list `analytics:public` refuses the token whole with
+  `FEDERATION_PUBLIC_FORBIDDEN`, `connectionStatus` included, so an organization
+  cannot publish a host that never agreed. A host from before the permission
+  fails the token with `FEDERATION_INVALID_CLAIMS`, which is the safe failure.
+- A public token runs only `manifest`, `connectionStatus`, `listSites`,
+  `overview`, `liveVisitors`, and `dataCoverage`
+  (`FEDERATED_ANALYTICS_PUBLIC_FUNCTIONS`); every other function, sessions and
+  journeys first, fails with `FEDERATION_PUBLIC_FORBIDDEN` before the site scope
+  is examined. `overview` answers it with traffic alone — `conversions` and
+  `revenueCents` are zero on the totals, the series, and every item, and
+  `topCampaigns`, `topMediums`, `topEvents`, and `topGoals` are empty — and
+  `liveVisitors` replaces `visitorId` with the session id, since the host may
+  have linked the visitor to its own signed-in user id, and drops the intent
+  fields (`entryPath`, `returning`, `utmCampaign`, `affiliateSlug`,
+  `conversionCount`, `funnel`).
+- `rastro_site_ids` narrows every token kind, a reader's included: the scope is
+  the grant's sites the claim also names, `listSites` returns only those, and a
+  claim naming none of them is denied with `FEDERATION_SITE_DENIED`.
+
+`connectionStatus` reports `permissions: ["analytics:public"]` for such a token.
+The control plane creates links only for organization owners and admins, only on
+a connection whose last verification recorded the host's permission, and revokes
+them without a host deploy; the host's grant remains the authority, so removing
+`analytics:public` from it silences every link at the next token. The permission
+ladder — public below read below configure — is exported as
+`federatedPermissionSatisfies`, with `FEDERATED_ANALYTICS_PUBLIC_PERMISSION`,
+`FEDERATED_ANALYTICS_PUBLIC_FUNCTIONS`, and `isPublicFederatedAccess` alongside.
 
 ## Authentication contract
 
@@ -76,14 +167,17 @@ The customer host must configure Convex authentication to trust the Amage Rastro
 OIDC issuer. Convex validates the JWT signature, issuer, audience, and expiry
 before any host function runs. The helper then requires these custom claims:
 
-| Claim                    | Value                            |
-| ------------------------ | -------------------------------- |
-| `rastro_connection_id`   | The paired deployment connection |
-| `rastro_organization_id` | The Amage Rastro organization    |
-| `rastro_permissions`     | Must include `analytics:read`    |
+| Claim                    | Value                                                                                                                              |
+| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `rastro_connection_id`   | The paired deployment connection                                                                                                   |
+| `rastro_organization_id` | The Amage Rastro organization                                                                                                      |
+| `rastro_permissions`     | Must include `analytics:read`; owners and admins add `analytics:configure`. A public link's token carries `analytics:public` alone |
+| `rastro_site_ids`        | Optional: the sites the token may read, a subset of the grant; a public link's token names the sites it was created for            |
 
-Claim names and the permission constant are exported as
-`FEDERATED_ANALYTICS_CLAIMS` and `FEDERATED_ANALYTICS_READ_PERMISSION`.
+Claim names and the permission constants are exported as
+`FEDERATED_ANALYTICS_CLAIMS`, `FEDERATED_ANALYTICS_READ_PERMISSION`,
+`FEDERATED_ANALYTICS_CONFIGURE_PERMISSION`, and
+`FEDERATED_ANALYTICS_PUBLIC_PERMISSION`.
 
 The audience is the customer's normalized Convex deployment URL, for example
 `https://product-123.convex.cloud`. It is stable across connections to that
@@ -131,6 +225,9 @@ export default defineSchema({
     connectionId: v.string(),
     organizationId: v.string(),
     siteIds: v.array(v.string()),
+    // Absent means read only; "analytics:configure" opts into the scope and
+    // "analytics:public" lets the organization's public links answer.
+    permissions: v.optional(v.array(v.string())),
     createdAt: v.number(),
     updatedAt: v.number(),
     revokedAt: v.optional(v.number()),
@@ -140,7 +237,8 @@ export default defineSchema({
 
 Pairing and revocation mutations belong to the host application and must use its
 existing administrator authorization. The Rastro component cannot inspect host
-authentication state.
+authentication state. The grant's `permissions`, like its `siteIds`, are the
+host's decision: a token cannot grant itself the configure scope.
 
 ## Host API
 
@@ -149,12 +247,19 @@ authentication state.
 import {
   exposeFederatedAnalyticsApi,
   type FederatedAnalyticsConnection,
+  type FederatedAnalyticsPermission,
 } from "@iann29/rastro";
 import { components } from "./_generated/api";
 import { env, type QueryCtx } from "./_generated/server";
 
+// RASTRO_FEDERATION_ISSUER is declared optional in convex.config.ts so a push
+// never depends on it; the production issuer is the default.
+const issuer = (
+  env.RASTRO_FEDERATION_ISSUER ?? "https://site.api.amagerastro.com/federation"
+).replace(/\/$/, "");
+
 const federated = exposeFederatedAnalyticsApi(components.rastroAnalytics, {
-  issuer: env.RASTRO_FEDERATION_ISSUER.replace(/\/$/, ""),
+  issuer,
   resolveConnection: async (ctx, identity) => {
     const db = ctx.db as unknown as QueryCtx["db"];
     const grant = await db
@@ -169,6 +274,7 @@ const federated = exposeFederatedAnalyticsApi(components.rastroAnalytics, {
       connectionId: grant.connectionId,
       organizationId: grant.organizationId,
       siteIds: grant.siteIds,
+      permissions: grant.permissions as FederatedAnalyticsPermission[],
       revokedAt: grant.revokedAt,
     } satisfies FederatedAnalyticsConnection;
   },
@@ -190,40 +296,65 @@ export const {
   vitalsReport,
   siteMap,
   dataCoverage,
+  siteSettings,
+  updateSite,
+  listGoals,
+  upsertGoal,
+  removeGoal,
+  listFunnels,
+  upsertFunnel,
+  removeFunnel,
+  listAffiliates,
+  upsertAffiliate,
+  removeAffiliate,
+  retentionStatus,
+  setRetentionPolicy,
+  disableRetentionPolicy,
 } = federated;
 ```
 
 The resolver receives the authenticated `UserIdentity` as well as the parsed
 connection and organization IDs, so a host may enforce additional local rules.
 It must use an indexed, authoritative host lookup rather than token-provided
-site IDs.
+site IDs. A host that never lists `analytics:configure` in a grant may leave the
+configure functions out of the export; the manifest still advertises them, and
+the dashboard never calls them for a read-only connection.
 
 ## Stable errors
 
 `FEDERATED_ANALYTICS_ERROR_CODES` exports all protocol v1 authorization codes:
 
-| Code                           | Meaning                                      |
-| ------------------------------ | -------------------------------------------- |
-| `FEDERATION_UNAUTHENTICATED`   | No authenticated identity                    |
-| `FEDERATION_ISSUER_MISMATCH`   | Identity came from another issuer            |
-| `FEDERATION_INVALID_CLAIMS`    | Required bounded claims or permission absent |
-| `FEDERATION_CONNECTION_DENIED` | Connection missing, revoked, or malformed    |
-| `FEDERATION_INVALID_SCOPE`     | Requested site list violates public limits   |
-| `FEDERATION_SITE_DENIED`       | Requested site is outside the connection     |
+| Code                             | Meaning                                                             |
+| -------------------------------- | ------------------------------------------------------------------- |
+| `FEDERATION_UNAUTHENTICATED`     | No authenticated identity                                           |
+| `FEDERATION_ISSUER_MISMATCH`     | Identity came from another issuer                                   |
+| `FEDERATION_INVALID_CLAIMS`      | Required bounded claims or permission absent                        |
+| `FEDERATION_CONNECTION_DENIED`   | Connection missing, revoked, or malformed                           |
+| `FEDERATION_INVALID_SCOPE`       | Requested site list violates public limits                          |
+| `FEDERATION_SITE_DENIED`         | Requested site is outside the connection                            |
+| `FEDERATION_CONFIGURE_FORBIDDEN` | Token or grant lacks `analytics:configure`                          |
+| `FEDERATION_PUBLIC_FORBIDDEN`    | Public token outside its surface, or grant lacks `analytics:public` |
 
 Consumers should branch on `ConvexError.data.code`, not human-readable messages.
 
 ## Enforced invariants
 
 - The identity issuer must match exactly.
-- The token must include the read permission.
+- The token must include the read permission, or the public permission alone.
+- A configure function runs only when the token and the grant both carry
+  `analytics:configure`; a grant listing an unknown permission is denied whole.
+- A public token runs only the public surface, and only when the grant lists
+  `analytics:public`; `rastro_site_ids` narrows every token to the granted sites
+  it names.
 - Report queries must request one through ten unique, bounded site IDs.
 - The resolved connection ID and organization must match the token.
 - Revoked, missing, malformed, empty, or duplicate-site connections are denied.
 - The resolved connection may authorize at most 10 unique site IDs.
 - Every report site must exist in the local connection scope.
 - Site discovery trusts only the resolved connection, never caller arguments.
-- Owner-wide enumeration, raw site configuration, and every write are absent.
+- Owner-wide enumeration, ingestion, and arbitrary host functions are absent;
+  the only writes are the configure scope's, and `listSites` never returns
+  `ownerId`, `domains`, or `networkId`.
 - `dataCoverage` is read-only and uses the same connection-scoped site
   authorization.
 
@@ -244,9 +375,15 @@ either overview dataset.
 
 The production control plane at `https://www.amagerastro.com` and its reference
 implementation under `control-plane/` provide Better Auth sessions,
-organization-scoped connections, OIDC discovery, JWKS, ten-minute RS256 tokens,
-manifest verification, redacted site discovery, audit records, revocation of new
-token issuance, and dynamic browser subscriptions to active deployments.
+organization-scoped connections, OIDC discovery, JWKS, ten-minute RS256 tokens
+whose permissions follow the member's organization role, manifest verification,
+redacted site discovery, audit records, revocation of new token issuance, and
+dynamic browser subscriptions to active deployments. Verification records the
+permissions the host honors for an admin token, so **Conexões** shows whether a
+connection is read only, reads and configures, and whether it lets the
+organization publish public links; those links mint `analytics:public` tokens
+for anyone holding the address, without a sign-in and under their own rate
+limits.
 
 Do not assume that a dist-tag or source checkout contains this protocol. Inspect
 an operator-approved exact npm registry artifact outside the host, without