@ductape/mcp 0.1.49 → 0.1.51

package/dist/proxy-client.d.ts

@@ -15,6 +15,7 @@ export interface IGenerateExecutablePayloadRequest {
     method: string;
     targets?: Record<string, unknown>;
     include_session?: boolean;
+    execution_context?: 'user' | 'delegated' | 'system';
     include_cache?: boolean;
     schema_mode?: 'strict' | 'best_effort';
     input_hint?: Record<string, unknown>;

package/dist/proxy-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-client.d.ts","sourceRoot":"","sources":["../src/proxy-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,4BAA4B,CAAC;AAEtD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,KAAK,GACL,WAAW,GACX,OAAO,GACP,UAAU,GACV,eAAe,GACf,gBAAgB,GAChB,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,SAAS,GACT,UAAU,GACV,MAAM,GACN,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,SAAS,CAAC;AAUd;;GAEG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,EAAO,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AASD,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvE;AA4BD,wBAAsB,yBAAyB,CAAC,CAAC,GAAG,kCAAkC,EACpF,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,CAAC,CAAC,CAwBZ"}
+{"version":3,"file":"proxy-client.d.ts","sourceRoot":"","sources":["../src/proxy-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,4BAA4B,CAAC;AAEtD,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,KAAK,GACL,WAAW,GACX,OAAO,GACP,UAAU,GACV,eAAe,GACf,gBAAgB,GAChB,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,SAAS,GACT,UAAU,GACV,MAAM,GACN,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,SAAS,CAAC;AAUd;;GAEG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,EAAO,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AASD,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvE;AA4BD,wBAAsB,yBAAyB,CAAC,CAAC,GAAG,kCAAkC,EACpF,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "build": "tsc",
+    "test": "node scripts/check-frontend-analytics-guidance.mjs",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts"
   },

package/scripts/check-frontend-analytics-guidance.mjs

@@ -0,0 +1,57 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const source = readFileSync(resolve(here, '../src/index.ts'), 'utf8');
+
+const checks = [
+  ['dedicated docs topic', /'frontend-analytics': `/],
+  ['anonymous analytics without an invented session', /Before login:[\s\S]*do not invent a session/i],
+  ['identify after authentication', /After login\/registration:[\s\S]*identify\(fullSessionToken\)/i],
+  ['identify after refresh', /After refresh:[\s\S]*identify\(newSessionToken\)/i],
+  ['clear identity on logout and account switching', /LOGOUT \/ ACCOUNT SWITCHING[\s\S]*clearSession\(\)/],
+  ['SPA route pageviews', /location\.pathname[\s\S]*analytics\.pageview/],
+  ['pageviews and custom events', /CUSTOM EVENTS[\s\S]*PAGE VIEWS/],
+  ['analytics is non-authoritative', /Analytics is never an authoritative order/],
+  ['tokens excluded from properties', /session\/refresh tokens in event[\s\S]*properties/],
+  ['hidden multiplayer state warning', /HIDDEN AND SENSITIVE DATA/],
+  ['masking review before auto-capture', /AUTO-CAPTURE — OPT IN ONLY AFTER A PRIVACY AUDIT/],
+  ['visitor ID is not authentication', /visitor ID is anonymous analytics identity, not authentication/i],
+  ['trace correlation', /traceId\s*= correlation/],
+  ['dashboard troubleshooting covers both tracks', /Investigate both tracks before blaming the SDK/],
+  ['installed exports take precedence', /Installed package types and exports determine what can be called now/],
+];
+
+for (const [name, pattern] of checks) {
+  assert.match(source, pattern, `Missing frontend analytics guidance: ${name}`);
+}
+
+assert.doesNotMatch(
+  source,
+  /analytics\.identify\(\{\s*userId/,
+  'MCP guidance must not use the obsolete identify({ userId, traits }) signature',
+);
+
+const safetyChecks = [
+  ['admin execute calls removed', /ductape_execute\("[^"\n]*(?:create|update)/],
+  ['obsolete NestJS consumer removed', /events\.consume in onModuleInit/],
+  ['canonical NestJS consumer present', /@Events\.Consumer\(\{ event:/],
+  ['request actor context documented', /AsyncLocalStorage[\s\S]*ActorContext/],
+  ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
+  ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
+  ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
+  ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
+  ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
+];
+
+for (const [name, pattern] of safetyChecks) {
+  if (name === 'admin execute calls removed' || name === 'obsolete NestJS consumer removed') {
+    assert.doesNotMatch(source, pattern, `Unsafe MCP guidance remains: ${name}`);
+  } else {
+    assert.match(source, pattern, `Missing MCP safety guidance: ${name}`);
+  }
+}
+
+console.log(`MCP guidance: ${checks.length + 1 + safetyChecks.length} acceptance checks passed`);