@iann29/rastro 0.10.8 → 0.11.0

package/docs/federation.md

@@ -77,6 +77,11 @@ The exact generated surface is:
 - the Meta reads (opt-in capability `metaAds`, hosts from `0.10.0` that pass
   `metaAds: true`): `metaStatus` and `metaConversions`; see
   [Leads and Meta ads](#leads-and-meta-ads)
+- the Lead Ads reads (opt-in capability `metaLeads`, unreleased hosts that pass
+  `metaLeads: true` beside `metaAds: true`; alone it throws at setup):
+  `metaPages`, `metaForms`, `metaFormRules`, `simulateMetaFormRules`,
+  `metaFormsReport` and `metaLinkedPages`; see
+  [Leads and Meta ads](#leads-and-meta-ads)
 
 Hosts from `alpha.11` also advertise the optional capability `localDays`: their
 `overview` answers a daily range that covers whole calendar days in the site's
@@ -84,6 +89,11 @@ timezone from buckets kept in that zone, and `listSites` says per site which
 zone that is and since when the days are complete. Dashboards must not require
 the capability.
 
+Unreleased hosts that pass `leads: true` also advertise `leadsPaid`. It is not
+an opt-in: it says their `leadsDaily` takes `origin: "paid"` (every paid origin,
+instant forms included), so a dashboard asks for it on any such host, whether or
+not it advertises `metaLeads`.
+
 There are no ingestion, owner-wide enumeration, or arbitrary host functions in
 this surface, and no write runs with a read-only token: every function of the
 configure scope requires the `analytics:configure` permission on the token
@@ -460,6 +470,15 @@ tracker sees. The host turns each on in `exposeFederatedAnalyticsApi`:
 - `metaAds: true` (hosts from `0.10.0`) advertises `metaAds` and serves
   `metaStatus` and `metaConversions`: the Meta ad accounts and pixel each site
   links, and the conversions sent to the pixel.
+- `metaLeads: true` beside `metaAds: true` (unreleased; alone it throws at
+  setup) advertises `metaLeads` and serves the Lead Ads reads: each owner's
+  Facebook Pages, the instant forms of a site's linked Pages with their rules, a
+  rules simulation, the per-form report, and `metaLinkedPages`, the Page
+  registry the dashboard's control plane routes Meta's lead webhooks by. Its
+  writes (`linkMetaPage`, `unlinkMetaPage`, `refreshMetaForms`,
+  `setMetaFormRules`, `returnMetaFormLead`) need `analytics:configure` and never
+  touch what another owner of the host linked or set. A lead's personal data
+  never crosses the surface.
 
 Without the option a host refuses those functions with
 `FEDERATION_INVALID_SCOPE` before it examines the connection, and its manifest