@ductape/mcp 0.1.51 → 0.1.53

package/dist/index.js

@@ -2259,10 +2259,12 @@ DUCTAPE FRONTEND PRODUCT ANALYTICS AND SESSION ACTIVITY
 Frontend analytics and backend session attribution are complementary; neither replaces the other.
 
 BACKEND OPERATION ATTRIBUTION
-  Pass the original full Ductape session token to every user-initiated database, Event, Feature,
-  notification, storage, graph, vector, action, and other runtime operation that accepts session.
-  This attributes server work to the authenticated actor. Durable work should retain the initiating
-  session; intentional system/background work should remain sessionless.
+  Immediate user-initiated backend work should pass the original full Ductape session token to every
+  database, Event, Feature, notification, storage, graph, vector, action, and other runtime operation
+  that accepts session. This attributes immediate server work to the authenticated actor.
+  For delayed/durable work, do not persist raw JWTs indefinitely. Use system context, or an approved
+  delegated actor design with immutable non-secret actor metadata. Actor metadata supports audit and
+  correlation; it is not authorization. Intentional system/background work should remain sessionless.
 
 FRONTEND PRODUCT ANALYTICS
   Use the browser Analytics service for anonymous visits, authenticated page views, navigation,
@@ -2874,10 +2876,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -41,6 +41,8 @@ const safetyChecks = [
   ['request actor context documented', /AsyncLocalStorage[\s\S]*ActorContext/],
   ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
   ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
+  ['frontend durable work prohibits persisted JWTs', /For delayed\/durable work, do not persist raw JWTs indefinitely/],
+  ['browser events use frontend client', /CLIENT-SIDE \(browser — publishable key\):[\s\S]*import \{ createClient \} from '@ductape\/client';[\s\S]*ductape\.brokers\.publish/],
   ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
   ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
   ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
@@ -54,4 +56,13 @@ for (const [name, pattern] of safetyChecks) {
   }
 }
 
+const clientEventsSection = source.match(
+  /CLIENT-SIDE \(browser — publishable key\):[\s\S]*?SCHEDULED DISPATCH \(background job\):/,
+)?.[0] ?? '';
+assert.doesNotMatch(
+  clientEventsSection,
+  /from '@ductape\/sdk'/,
+  'Browser Events guidance must not import the server SDK',
+);
+
 console.log(`MCP guidance: ${checks.length + 1 + safetyChecks.length} acceptance checks passed`);

package/src/index.ts

@@ -2344,10 +2344,12 @@ DUCTAPE FRONTEND PRODUCT ANALYTICS AND SESSION ACTIVITY
 Frontend analytics and backend session attribution are complementary; neither replaces the other.
 
 BACKEND OPERATION ATTRIBUTION
-  Pass the original full Ductape session token to every user-initiated database, Event, Feature,
-  notification, storage, graph, vector, action, and other runtime operation that accepts session.
-  This attributes server work to the authenticated actor. Durable work should retain the initiating
-  session; intentional system/background work should remain sessionless.
+  Immediate user-initiated backend work should pass the original full Ductape session token to every
+  database, Event, Feature, notification, storage, graph, vector, action, and other runtime operation
+  that accepts session. This attributes immediate server work to the authenticated actor.
+  For delayed/durable work, do not persist raw JWTs indefinitely. Use system context, or an approved
+  delegated actor design with immutable non-secret actor metadata. Actor metadata supports audit and
+  correlation; it is not authorization. Intentional system/background work should remain sessionless.
 
 FRONTEND PRODUCT ANALYTICS
   Use the browser Analytics service for anonymous visits, authenticated page views, navigation,
@@ -2961,10 +2963,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });