@iann29/rastro 0.4.0 → 0.6.0

package/README.md

@@ -2,9 +2,9 @@
 
 [![CI](https://github.com/amageweb/amage-rastro/actions/workflows/ci.yml/badge.svg)](https://github.com/amageweb/amage-rastro/actions/workflows/ci.yml)
 
-Privacy-first, real-time web analytics built as an isolated Convex component.
+Real-time product and web analytics built as an isolated Convex component.
 
-Amage Rastro combines a 1.1 KB gzip browser tracker with reactive traffic
+Amage Rastro combines a lightweight browser tracker with reactive traffic
 metrics, a live visitor atlas, journey timelines, trusted payment attribution,
 goals, funnels, affiliates, and multi-site reports. Data and functions stay
 inside your Convex deployment.
@@ -55,7 +55,7 @@ capacity claim.
 | Auto-captured clicks        | Anchors, buttons, and `data-rastro-event` controls with a bounded visible label; outbound origin+path     |
 | Bot filtering               | Self-declared crawlers, unfurlers, monitors, HTTP libraries, and headless browsers rejected at ingestion  |
 | Cookieless mode             | No cookies: pseudonymous visitor id in `localStorage`; sessions end after 30 idle minutes or a sign-in    |
-| Tiny tracker                | 2,407 bytes raw, 1,278 bytes gzip; the test suite enforces `< 1,280` bytes gzip                           |
+| Tiny tracker                | 2,999 bytes raw, 1,565 bytes gzip; the test suite enforces `< 1,700` bytes gzip                           |
 
 ## Quickstart
 
@@ -82,7 +82,7 @@ Never append `/rastro/tracker.js` to the functions URL.
 npm install @iann29/rastro
 ```
 
-The untagged npm `latest` channel is `0.4.0`. Pin the exact version in the host;
+The untagged npm `latest` channel is `0.6.0`. Pin the exact version in the host;
 the changelog and the upgrading guide say what each release changes.
 
 ### 2. Mount the component
@@ -237,8 +237,9 @@ until it reloads.
 
 The tracker sends no client identification. Ingestion derives `browser`, `os`,
 and `device` from headers the browser attaches itself, and persists only those
-three normalized values; the raw `User-Agent` never reaches a mutation or a
-component table.
+three normalized values; it also reads the in-app browser's platform id
+(`instagram`, `facebook`, `tiktok`…) for the session's origin, below. The raw
+`User-Agent` never reaches a mutation or a component table.
 
 Chromium attaches the low-entropy `Sec-CH-UA`, `Sec-CH-UA-Mobile`, and
 `Sec-CH-UA-Platform` client hints to cross-origin requests from secure origins,
@@ -499,10 +500,11 @@ export function Analytics({ siteId, siteUrl, analyticsId }) {
 }
 ```
 
-`visitorId` must be pseudonymous and supplied before the first pageview. Reuse
-the same value on authorized sites to connect their journeys. Amage Rastro
-intentionally has no mutable post-load `identify` command: changing identity
-after a session starts would make the session ambiguous.
+Supply a server-issued `visitorId` before the first pageview when available. For
+login after tracking starts, use the `identify` command described in the
+[identity guide](docs/identity.md); it closes the previous session before
+switching IDs. Call `reset` on logout. Released 0.5.x trackers require a reload
+to change the initial ID.
 
 ### 5. Verify ingestion
 
@@ -577,19 +579,132 @@ payload-bound by the site's financial ledger.
 The tracker reads `utm_source`, `utm_medium`, `utm_campaign`, `utm_term`, and
 `utm_content` from the landing URL, keeps them in `sessionStorage` for the rest
 of the tab — a later session the tab opens after a sign-in or 30 idle minutes
-keeps them too — and sends them as properties of every pageview; no other query
-parameter ever leaves the page. A session's `source` is the lowercase
-`utm_source` when present and the referrer host otherwise, so campaign traffic
-no longer reads as `direct`. `utmSource`, `utmMedium`, and `utmCampaign` stay on
-the session for journeys; `overview.topCampaigns` ranks `utm_campaign` and
-`overview.topMediums` the lowercase `utm_medium` next to `topSources`, by
-sessions once the range is covered by the counters. `overview.topOutbound` ranks
-the hosts outbound clicks reached — the host alone, never the path or query — by
-clicks. Both lists are recorded from `metadata.dimensionsSince` (each site's
-first ingest on 0.1.0 plus the rollup delay); a range that starts earlier ranks
-them from partial data, and the dashboard says so.
-
-## Identify visitors after signup
+keeps them too — and sends them as properties of every pageview. Besides those
+five, the only thing the landing URL ever yields is the **name** of a click-ID
+key it carried (below); no other query parameter, and no query value at all,
+ever leaves the page. A session's `source` is the lowercase `utm_source` when
+present and the referrer host otherwise, so campaign traffic no longer reads as
+`direct`. `utmSource`, `utmMedium`, and `utmCampaign` stay on the session for
+journeys; `overview.topCampaigns` ranks `utm_campaign` and `overview.topMediums`
+the lowercase `utm_medium` next to `topSources`, by sessions once the range is
+covered by the counters. `overview.topOutbound` ranks the hosts outbound clicks
+reached — the host alone, never the path or query — by clicks. Both lists are
+recorded from `metadata.dimensionsSince` (each site's first ingest on 0.1.0 plus
+the rollup delay); a range that starts earlier ranks them from partial data, and
+the dashboard says so.
+
+A session also keeps where it came from, classified once on its first touch and
+never guessed: `platform` (an id from a closed, versioned table of about forty —
+`instagram`, `google`, `whatsapp`, `chatgpt` — or `unknown` for a host or
+`utm_source` outside it, or `none`), `channel` (`direct`, `organic_search`,
+`paid_search`, `organic_social`, `paid_social`, `messaging`, `email`,
+`affiliate`, `ai`, `display`, `referral`, `offline`), and `evidence`, the rule
+that decided it. One rule decides and the next only runs when it did not:
+`utm_source` through the alias table, then click-ID names, then the referrer
+host by registrable domain, then the in-app browser, then an affiliate `ref`,
+which sets the channel and keeps the platform an earlier rule found. Hosts match
+by whole label, never by substring, so `l.instagram.com`, `instagram.com` and
+`com.instagram.android` are one platform while `docs.google.com` is not Google;
+`utm_medium` picks the channel from a closed table that also accepts the channel
+ids themselves, which is what a tracked link (below) emits, `offline` included.
+Nothing at all is `direct`, the only way to be direct, and a referrer on the
+site's own domains is an internal hop, never an origin. `overview.topPlatforms`,
+`topChannels` and `topEvidence` rank them beside `topSources`; a `topPlatforms`
+value is the platform id alone when the session arrived by that platform's
+default channel and `platform@channel` when it did not (`google@paid_search`),
+so one platform ranks once per channel it was reached by —
+`splitPlatformDimension` reads the pair back. `dataCoverage`'s `origin` dataset
+says from when a site carries them; sessions older than that are classified on
+read and marked `evidence: "legacy"`. `source` keeps the raw `utm_source` or
+host for the drill-down, exactly as before.
+
+The tracker reads the click-ID keys of its landing URL and sends them in `clid`:
+their **names** only (`fbclid`, `gclid`, `ttclid`, `mc_cid`…), never their
+values, so no advertising identifier leaves the page. It matches the same
+allowlist the server does, in the same ranking order, and sends at most eight;
+ingestion drops any name outside the allowlist and keeps at most eight of what
+is left. The referrer it sends is scheme and host, so a referrer of the form
+`android-app://<package>` keeps the package alone and the app that opened the
+link is a platform (`com.google.android.gm` is Gmail) instead of nothing.
+
+## Tracked links
+
+Some traffic arrives with nothing to read. A link tapped inside WhatsApp,
+Telegram, an SMS or a native e-mail app, or scanned from a QR code, opens with
+no referrer and no campaign, and any analytics tool files it as `direct`. A
+tracked link closes that gap: the dashboard's **Links** tab (or the host API)
+creates `/rastro/l/<slug>` for one place the link will be published, and every
+click lands on the site with that place in its `utm_*`.
+
+`GET /rastro/l/<slug>` answers `302` with `Cache-Control: no-store` to the
+link's destination, after appending:
+
+| Parameter      | Value                                                                                                               |
+| -------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `utm_source`   | the platform: `instagram`, `whatsapp`, `qr`, or any id of 2–24 lowercase letters, digits or underscores             |
+| `utm_medium`   | the channel: `organic_social`, `paid_social`, `messaging`, `email`, `affiliate`, `display`, `referral` or `offline` |
+| `utm_campaign` | the campaign, or the slug when the link has none                                                                    |
+| `utm_content`  | the slug                                                                                                            |
+
+The destination's own query stays exactly as it was, and a `utm_*` key it
+already carries is never overridden. Unknown and disabled slugs answer `404` in
+plain text. The tracker needs nothing new: the landing reads the `utm_*` like
+any campaign link.
+
+- **Clicks and bots.** Each click lands in a daily counter spread over four
+  shards, so a link that goes viral never serializes on one document. A
+  self-declared bot, including the WhatsApp, Facebook and Telegram link
+  previews, is still redirected but counted under `bots`, never `clicks`.
+  `listTrackedLinks` reports both, all time and over the 30 UTC days ending on
+  the day of the `now` it is given.
+- **No open redirect.** A destination must be an absolute `http(s)` URL without
+  credentials on one of the site's domains (exact, or a `*.` pattern for
+  subdomains). The rule is checked when a link is created or changed and again
+  on every click, so a domain removed from the site stops redirecting at once.
+- **Slugs** are 3–32 lowercase letters, digits or hyphens, starting and ending
+  with a letter or digit, and unique across the deployment because the route
+  names no site. A site keeps at most 200 links. Deleting a link frees its slug
+  and removes its counters; disabling it keeps both.
+- **A short domain.** The route lives on the deployment's HTTP origin
+  (`https://<deployment>.convex.site/rastro/l/promo`). A host that wants a
+  presentable link serves that origin under a short domain of its own, such as
+  `go.example.com/rastro/l/promo`; nothing in the component changes.
+
+```ts
+await analytics.createTrackedLink(ctx, {
+  siteId,
+  slug: "bio-instagram",
+  destination: "https://www.example.com/promo",
+  platform: "instagram",
+  channel: "organic_social",
+  campaign: "spring-sale",
+  createdBy: userId, // an opaque id, never an e-mail address
+});
+```
+
+A federated dashboard reaches the same functions once the host re-exports
+`listTrackedLinks`, `createTrackedLink`, `updateTrackedLink`, and
+`deleteTrackedLink` from `convex/rastroFederation.ts`. The connection then
+advertises the `trackedLinks` capability: any reader lists the links, and
+changing them needs `analytics:configure`, like goals and affiliates.
+
+## Identify people with any authentication
+
+Rastro connects names and emails to visits, actions and conversions. Use
+`identifyVisitorMutation` with your backend's authenticated-user resolver for
+Better Auth, custom auth or another Convex JWT provider. Other backends use
+`identifyVisitorHttpAction` over authenticated HTTP. No auth provider is a
+runtime requirement of the SDK.
+
+See the [identity integration guide](docs/identity.md) for the complete
+server/browser flow, login/logout behavior, profile updates, and examples. The
+dashboard presents profiles in Ao vivo and Jornadas, and the Pessoas directory
+searches all profiles by name, email, ID or an exact typed attribute. Attributes
+are optional strings, numbers and booleans defined by your project. Each person
+opens a history scoped to their site and the selected period. These additions
+require 0.6.0 or later; see [upgrade notes](docs/upgrading.md).
+
+### Link existing visitor IDs
 
 Anonymous sessions carry a random `visitorId` until the host supplies a
 pseudonymous one through `data-visitor` or the `RastroScript` `visitorId` prop.
@@ -754,6 +869,8 @@ The `Rastro` class wraps the component boundary for host functions:
 - Configuration: `upsertGoal`, `listGoals`, `removeGoal`, `upsertFunnel`,
   `listFunnels`, `removeFunnel`, `upsertAffiliate`, `listAffiliates`,
   `removeAffiliate`
+- Tracked links: `createTrackedLink`, `updateTrackedLink`, `deleteTrackedLink`,
+  `listTrackedLinks`
 - Retention: `cleanup`, `setRetentionPolicy`, `disableRetentionPolicy`,
   `runRetentionPolicy`, `retentionStatus`
 
@@ -1049,7 +1166,12 @@ Amage Rastro's default tracker:
   clicked link or button (at most 64 characters, replaced by `data-rastro-label`
   when present), and outbound link origins and pathnames (the overview ranks
   destinations by host alone);
-- strips query strings and fragments from stored paths and links.
+- strips query strings and fragments from stored paths and links; of the landing
+  query it keeps the five `utm_*` values and the bare **names** of the
+  advertising click-ID keys it recognizes (`fbclid`, `gclid`…), never a click-ID
+  value, and never any other parameter;
+- sends the referrer as scheme and host only — an `android-app://<package>`
+  included — never its path or query.
 
 The optional Web Vitals module inherits this contract: it reports at most five
 timing numbers per page load (milliseconds, or CLS scaled by 1000) against the

package/agent/integration.md

@@ -494,6 +494,8 @@ export const {
   overview,
   liveVisitors,
   getSession,
+  getVisitorProfile,
+  listPeople,
   revenueSummary,
   listSessions,
   sessionJourney,
@@ -519,21 +521,25 @@ export const {
   retentionStatus,
   setRetentionPolicy,
   disableRetentionPolicy,
+  listTrackedLinks,
+  createTrackedLink,
+  updateTrackedLink,
+  deleteTrackedLink,
 } = federated;
 ```
 
 `manifest` is public static metadata. Every report function is read-only and
 requires both a valid JWT and a matching, non-revoked local grant. The functions
-from `siteSettings` down form the configure scope (optional capability
-`configure`, hosts from `alpha.11`): they additionally require
-`analytics:configure` on the token — the control plane claims it only for
-organization owners and admins — and in the grant's `permissions`, and fail with
-`FEDERATION_CONFIGURE_FORBIDDEN` otherwise. Export them even when every grant
-stays read only, so a later opt-in needs no host deploy; the dashboard never
-calls them for a read-only connection. The issuer falls back to the production
-control plane so the module compiles and pushes before the environment variable
-exists; tokens are still rejected until `auth.config.ts` trusts the same issuer,
-which needs both variables set and a push afterwards.
+from `siteSettings` to `disableRetentionPolicy` form the configure scope
+(optional capability `configure`, hosts from `alpha.11`): they additionally
+require `analytics:configure` on the token — the control plane claims it only
+for organization owners and admins — and in the grant's `permissions`, and fail
+with `FEDERATION_CONFIGURE_FORBIDDEN` otherwise. Export them even when every
+grant stays read only, so a later opt-in needs no host deploy; the dashboard
+never calls them for a read-only connection. The issuer falls back to the
+production control plane so the module compiles and pushes before the
+environment variable exists; tokens are still rejected until `auth.config.ts`
+trusts the same issuer, which needs both variables set and a push afterwards.
 
 A public link's token carries `analytics:public` instead of `analytics:read` and
 `rastro_site_ids` naming the link's sites. It runs only `manifest`,
@@ -547,25 +553,27 @@ permission rejects the token with `FEDERATION_INVALID_CLAIMS`.
 
 ## Function contract
 
-| Function           | Input summary                                           | Important output/behavior                                             |
-| ------------------ | ------------------------------------------------------- | --------------------------------------------------------------------- |
-| `manifest`         | `{}`                                                    | Static protocol, capabilities, names, and limits; no auth             |
-| `connectionStatus` | `{}`                                                    | Redacted status, protocol version, capabilities, site count           |
-| `listSites`        | `{}`                                                    | Only `siteId`, `name`, `currency`, `timezone`, `cookieless`           |
-| `overview`         | `siteIds`, `from`, `to`, optional hour/day interval     | Aggregate metrics and time series                                     |
-| `liveVisitors`     | `siteIds`, `now`, optional limit                        | At most 500 visitors seen in the last five minutes, with intent facts |
-| `getSession`       | one `siteId`, `sessionId`                               | Selected session metadata, or null when no retained session exists    |
-| `revenueSummary`   | `siteIds`, inclusive `from`/`to`                        | Period commissions; pair with overview totals/currency                |
-| `listSessions`     | one `siteId`, range, `{numItems,cursor}` keyset options | Paginated sessions                                                    |
-| `sessionJourney`   | one site/session, range, `{numItems,cursor}` options    | Paginated bounded events                                              |
-| `listConversions`  | one site, range, `{numItems,cursor}` options            | Paginated trusted server-side conversion ledger                       |
-| `visitorJourney`   | site IDs, visitor ID, range, optional limit             | Cross-site journey inside the grant only                              |
-| `goalsReport`      | one site and range                                      | Read-only goal definitions plus aggregates                            |
-| `funnelsReport`    | one site and complete UTC-day range                     | Read-only definitions/steps plus aggregates; max 90 days              |
-| `affiliatesReport` | one site and complete UTC-day range                     | Read-only affiliate definitions plus aggregates                       |
-| `vitalsReport`     | one site and complete UTC-day range                     | Web Vitals p75/ratings per metric, page, and device; max 90 days      |
-| `siteMap`          | site IDs and complete UTC-day range                     | Routes with derived exits/bounces plus transitions; max 90 days       |
-| `dataCoverage`     | one site and inclusive integer range                    | Coverage metadata; echoes site ID, no event/visitor/session IDs       |
+| Function            | Input summary                                           | Important output/behavior                                                                               |
+| ------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `manifest`          | `{}`                                                    | Static protocol, capabilities, names, and limits; no auth                                               |
+| `connectionStatus`  | `{}`                                                    | Redacted status, protocol version, capabilities, site count                                             |
+| `listSites`         | `{}`                                                    | Only `siteId`, `name`, `currency`, `timezone`, `cookieless`                                             |
+| `overview`          | `siteIds`, `from`, `to`, optional hour/day interval     | Aggregate metrics and time series                                                                       |
+| `liveVisitors`      | `siteIds`, `now`, optional limit                        | At most 500 visitors seen in the last five minutes, with intent facts                                   |
+| `getSession`        | one `siteId`, `sessionId`                               | Selected session metadata, or null when no retained session exists                                      |
+| `getVisitorProfile` | one `siteId`, `visitorId`                               | Identified profile through the optional `visitorProfiles` capability; reader permission required        |
+| `listPeople`        | one `siteId`, optional `filter`, `paginationOpts`       | Indexed profile directory through optional `people`; reader permission required; up to 50 rows per page |
+| `revenueSummary`    | `siteIds`, inclusive `from`/`to`                        | Period commissions; pair with overview totals/currency                                                  |
+| `listSessions`      | one `siteId`, range, `{numItems,cursor}` keyset options | Paginated sessions                                                                                      |
+| `sessionJourney`    | one site/session, range, `{numItems,cursor}` options    | Paginated bounded events                                                                                |
+| `listConversions`   | one site, range, `{numItems,cursor}` options            | Paginated trusted server-side conversion ledger                                                         |
+| `visitorJourney`    | site IDs, visitor ID, range, optional limit             | Cross-site journey inside the grant only                                                                |
+| `goalsReport`       | one site and range                                      | Read-only goal definitions plus aggregates                                                              |
+| `funnelsReport`     | one site and complete UTC-day range                     | Read-only definitions/steps plus aggregates; max 90 days                                                |
+| `affiliatesReport`  | one site and complete UTC-day range                     | Read-only affiliate definitions plus aggregates                                                         |
+| `vitalsReport`      | one site and complete UTC-day range                     | Web Vitals p75/ratings per metric, page, and device; max 90 days                                        |
+| `siteMap`           | site IDs and complete UTC-day range                     | Routes with derived exits/bounces plus transitions; max 90 days                                         |
+| `dataCoverage`      | one site and inclusive integer range                    | Coverage metadata; echoes site ID, no event/visitor/session IDs                                         |
 
 The configure scope, every function of which requires `analytics:configure` on
 the token and in the grant:
@@ -587,6 +595,18 @@ the token and in the grant:
 | `setRetentionPolicy`     | `siteId` and five day counts between 1 and 3650              | Starts the recurring cleanup chains                                 |
 | `disableRetentionPolicy` | one `siteId`                                                 | Stops automatic cleanup; nothing is restored                        |
 
+Tracked links, behind the optional `trackedLinks` capability. Listing needs only
+a reader; the three writes require `analytics:configure` like the configure
+scope above. A host serves them by re-exporting the four functions; one that
+does not keeps working and advertises no `trackedLinks` capability.
+
+| Function            | Input summary                                                                   | Important output/behavior                                                 |
+| ------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
+| `listTrackedLinks`  | one `siteId` and `now`                                                          | Definitions with clicks and bot hits, all time and over 30 UTC days       |
+| `createTrackedLink` | `siteId`, slug, destination, platform, channel, campaign, `createdBy`           | Returns the link ID; the destination must be on one of the site's domains |
+| `updateTrackedLink` | `siteId`, `linkId`, optional destination, platform, channel, campaign, disabled | Changes everything but the slug; a disabled link answers 404              |
+| `deleteTrackedLink` | `siteId`, `linkId`                                                              | Deletes the link, frees its slug, and purges its click counters           |
+
 The federated surface deliberately excludes ingestion, owner IDs, network IDs,
 and arbitrary host functions, and shows a site's domains only through
 `siteSettings` to a connection allowed to change them. Goal, funnel, and
@@ -821,3 +841,20 @@ Production changes performed: yes/no
 
 Do not include private keys, admin keys, session cookies, JWTs, or raw customer
 telemetry in the report.
+
+## Identified people
+
+Follow
+[the identity guide](https://www.amagerastro.com/docs/reference/identity.md) to
+integrate Better Auth, custom authentication or an external backend. The host
+owns authenticated-user resolution and site authorization. Use
+`Rastro.identifyVisitorMutation` for the current user, `identifyVisitor` from
+trusted server code, and `identifyVisitorHttpAction` for authenticated
+server-to-server HTTP. Attributes are optional, project-defined strings, numbers
+and booleans; no user-table shape or business field is required. Re-export
+`getVisitorProfile` and `listPeople` for the optional `visitorProfiles` and
+`people` capabilities. Existing profiles need the bounded, owner-authorized
+`backfillVisitorProfiles` upgrade before name/email search; see the identity
+guide. Live/session reports may carry `profile`; public live reports remove it.
+Apply the server-returned visitor ID in the tracker, and reset the tracker on
+logout.

package/agent/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://www.amagerastro.com/agent/manifest.schema.json",
   "name": "amage-rastro",
   "title": "Amage Rastro",
-  "description": "Privacy-first, real-time web analytics for Convex with a federated dashboard that reads every granted site and configures only those whose host opts in.",
+  "description": "Real-time product and web analytics with identified people, journeys and conversions; profiles and telemetry stay in each product deployment.",
   "manifestVersion": "1.0.0",
   "language": "en",
   "canonicalBaseUrl": "https://www.amagerastro.com",
@@ -15,12 +15,14 @@
     "upgrading": "https://www.amagerastro.com/docs/reference/upgrading.md",
     "integrity": {
       "algorithm": "sha256",
-      "agent": "e26de56729dd0b474669d2b40292afb314224200da4e70f6dabd407ce7aea6e7",
-      "llms": "2072c0c06b5ec130c59edc269d66665ffd042053a9f7238a16811431a9251c19",
-      "protocol": "f2be7e3db250824d0c1293eb31b2e4514ebed8b21fe4974d4f4797fd86abe04f",
+      "agent": "35d1c2d73eef8c5266368453dd4eb1343ecc70650e0c0b1d6e7dfcae4b5ecdcc",
+      "llms": "71be7d69dec942407cbe08db75490de50e2b3b399cdd611049cfb6d99b551e13",
+      "protocol": "d56dd4dca8c11a4d00303c48abfbcde4ed7cee6f415b2c96b971ba9efff2467c",
       "setup": "bf2509a87a8eab9c047276b813f029bb2c9ddd58c0e54754432e3fef7891f3c9",
-      "upgrading": "fee72acf124487309a739f8344dc507346712c68d11a957c7068d4838aa79f6b"
-    }
+      "upgrading": "4b72c250839e159b07c345ef7c71f2fdfe16a50470790fa5154cb6eaa6b72300",
+      "identity": "2d23399ae4e469b505790d9c7cc8a2012da96a49bd2e776a8118b51b52c8390e"
+    },
+    "identity": "https://www.amagerastro.com/docs/reference/identity.md"
   },
   "controlPlane": {
     "dashboardUrl": "https://www.amagerastro.com",
@@ -85,7 +87,13 @@
       "removeAffiliate": "removeAffiliate",
       "retentionStatus": "retentionStatus",
       "setRetentionPolicy": "setRetentionPolicy",
-      "disableRetentionPolicy": "disableRetentionPolicy"
+      "disableRetentionPolicy": "disableRetentionPolicy",
+      "listTrackedLinks": "listTrackedLinks",
+      "createTrackedLink": "createTrackedLink",
+      "updateTrackedLink": "updateTrackedLink",
+      "deleteTrackedLink": "deleteTrackedLink",
+      "getVisitorProfile": "getVisitorProfile",
+      "listPeople": "listPeople"
     },
     "capabilities": [
       "siteSummaries",
@@ -100,11 +108,14 @@
       "affiliates",
       "dataCoverage",
       "sessionDetails",
+      "visitorProfiles",
+      "people",
       "revenueSummary",
       "vitals",
       "siteMap",
       "localDays",
-      "configure"
+      "configure",
+      "trackedLinks"
     ],
     "limits": {
       "maxSitesPerRequest": 10,

package/agent/manifest.schema.json

@@ -44,7 +44,8 @@
         "protocol",
         "setup",
         "upgrading",
-        "integrity"
+        "integrity",
+        "identity"
       ],
       "properties": {
         "human": { "$ref": "#/$defs/httpsUrl" },
@@ -61,7 +62,8 @@
             "llms",
             "protocol",
             "setup",
-            "upgrading"
+            "upgrading",
+            "identity"
           ],
           "properties": {
             "algorithm": { "const": "sha256" },
@@ -69,10 +71,12 @@
             "llms": { "$ref": "#/$defs/sha256" },
             "protocol": { "$ref": "#/$defs/sha256" },
             "setup": { "$ref": "#/$defs/sha256" },
-            "upgrading": { "$ref": "#/$defs/sha256" }
+            "upgrading": { "$ref": "#/$defs/sha256" },
+            "identity": { "$ref": "#/$defs/sha256" }
           },
           "additionalProperties": false
-        }
+        },
+        "identity": { "$ref": "#/$defs/httpsUrl" }
       },
       "additionalProperties": false
     },
@@ -185,7 +189,13 @@
             "removeAffiliate",
             "retentionStatus",
             "setRetentionPolicy",
-            "disableRetentionPolicy"
+            "disableRetentionPolicy",
+            "listTrackedLinks",
+            "createTrackedLink",
+            "updateTrackedLink",
+            "deleteTrackedLink",
+            "getVisitorProfile",
+            "listPeople"
           ],
           "properties": {
             "manifest": { "const": "manifest" },
@@ -218,14 +228,20 @@
             "removeAffiliate": { "const": "removeAffiliate" },
             "retentionStatus": { "const": "retentionStatus" },
             "setRetentionPolicy": { "const": "setRetentionPolicy" },
-            "disableRetentionPolicy": { "const": "disableRetentionPolicy" }
+            "disableRetentionPolicy": { "const": "disableRetentionPolicy" },
+            "listTrackedLinks": { "const": "listTrackedLinks" },
+            "createTrackedLink": { "const": "createTrackedLink" },
+            "updateTrackedLink": { "const": "updateTrackedLink" },
+            "deleteTrackedLink": { "const": "deleteTrackedLink" },
+            "getVisitorProfile": { "const": "getVisitorProfile" },
+            "listPeople": { "const": "listPeople" }
           },
           "additionalProperties": false
         },
         "capabilities": {
           "type": "array",
-          "minItems": 15,
-          "maxItems": 17,
+          "minItems": 16,
+          "maxItems": 20,
           "uniqueItems": true,
           "items": {
             "enum": [
@@ -245,7 +261,10 @@
               "vitals",
               "siteMap",
               "localDays",
-              "configure"
+              "configure",
+              "trackedLinks",
+              "visitorProfiles",
+              "people"
             ]
           }
         },