@ductape/mcp 0.1.52 → 0.1.53

package/dist/index.js

@@ -2876,10 +2876,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -42,6 +42,7 @@ const safetyChecks = [
   ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
   ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
   ['frontend durable work prohibits persisted JWTs', /For delayed\/durable work, do not persist raw JWTs indefinitely/],
+  ['browser events use frontend client', /CLIENT-SIDE \(browser — publishable key\):[\s\S]*import \{ createClient \} from '@ductape\/client';[\s\S]*ductape\.brokers\.publish/],
   ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
   ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
   ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
@@ -55,4 +56,13 @@ for (const [name, pattern] of safetyChecks) {
   }
 }
 
+const clientEventsSection = source.match(
+  /CLIENT-SIDE \(browser — publishable key\):[\s\S]*?SCHEDULED DISPATCH \(background job\):/,
+)?.[0] ?? '';
+assert.doesNotMatch(
+  clientEventsSection,
+  /from '@ductape\/sdk'/,
+  'Browser Events guidance must not import the server SDK',
+);
+
 console.log(`MCP guidance: ${checks.length + 1 + safetyChecks.length} acceptance checks passed`);

package/src/index.ts

@@ -2963,10 +2963,20 @@ Import (register an EXISTING cloud resource):
     Only produce to topics whose schema is safe for client authorship.
     NEVER allow clients to produce to topics that trigger privileged server-side operations
     (payments, admin actions, state mutations) — those must go through a backend endpoint first.
-    import Ductape from '@ductape/sdk';
-    const ductape = new Ductape({ publishableKey: 'pk_...', env: 'prd', product: 'my-product' });
-    await ductape.events.produce({
-      event: "user-events:user-action",
+    import { createClient } from '@ductape/client';
+    // Equivalent supported import: import Ductape from '@ductape/client';
+    const ductape = createClient({
+      publishableKey: 'pk_...',
+      env: 'prd',
+      product: 'my-product',
+    });
+    await ductape.connect();
+    await ductape.brokers.connect({
+      broker: 'user-events',
+      session: 'user-session:eyJ...',
+    });
+    await ductape.brokers.publish({
+      topic: 'user-action',
       message: { action: "button-click", screen: "dashboard" },
       session: "user-session:eyJ...",  // REQUIRED for client-side produce
     });