@ductape/mcp 0.1.51 → 0.1.52

package/dist/index.js

@@ -2259,10 +2259,12 @@ DUCTAPE FRONTEND PRODUCT ANALYTICS AND SESSION ACTIVITY
 Frontend analytics and backend session attribution are complementary; neither replaces the other.
 
 BACKEND OPERATION ATTRIBUTION
-  Pass the original full Ductape session token to every user-initiated database, Event, Feature,
-  notification, storage, graph, vector, action, and other runtime operation that accepts session.
-  This attributes server work to the authenticated actor. Durable work should retain the initiating
-  session; intentional system/background work should remain sessionless.
+  Immediate user-initiated backend work should pass the original full Ductape session token to every
+  database, Event, Feature, notification, storage, graph, vector, action, and other runtime operation
+  that accepts session. This attributes immediate server work to the authenticated actor.
+  For delayed/durable work, do not persist raw JWTs indefinitely. Use system context, or an approved
+  delegated actor design with immutable non-secret actor metadata. Actor metadata supports audit and
+  correlation; it is not authorization. Intentional system/background work should remain sessionless.
 
 FRONTEND PRODUCT ANALYTICS
   Use the browser Analytics service for anonymous visits, authenticated page views, navigation,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.51",
+  "version": "0.1.52",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -41,6 +41,7 @@ const safetyChecks = [
   ['request actor context documented', /AsyncLocalStorage[\s\S]*ActorContext/],
   ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
   ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
+  ['frontend durable work prohibits persisted JWTs', /For delayed\/durable work, do not persist raw JWTs indefinitely/],
   ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
   ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
   ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],

package/src/index.ts

@@ -2344,10 +2344,12 @@ DUCTAPE FRONTEND PRODUCT ANALYTICS AND SESSION ACTIVITY
 Frontend analytics and backend session attribution are complementary; neither replaces the other.
 
 BACKEND OPERATION ATTRIBUTION
-  Pass the original full Ductape session token to every user-initiated database, Event, Feature,
-  notification, storage, graph, vector, action, and other runtime operation that accepts session.
-  This attributes server work to the authenticated actor. Durable work should retain the initiating
-  session; intentional system/background work should remain sessionless.
+  Immediate user-initiated backend work should pass the original full Ductape session token to every
+  database, Event, Feature, notification, storage, graph, vector, action, and other runtime operation
+  that accepts session. This attributes immediate server work to the authenticated actor.
+  For delayed/durable work, do not persist raw JWTs indefinitely. Use system context, or an approved
+  delegated actor design with immutable non-secret actor metadata. Actor metadata supports audit and
+  correlation; it is not authorization. Intentional system/background work should remain sessionless.
 
 FRONTEND PRODUCT ANALYTICS
   Use the browser Analytics service for anonymous visits, authenticated page views, navigation,