@ductape/mcp 0.1.60 → 0.2.0

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.60",
+  "version": "0.2.0",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
     "ductape-mcp": "dist/index.js"
   },
+  "files": [
+    "dist",
+    "docs",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "build": "tsc",
     "test": "node scripts/check-frontend-analytics-guidance.mjs",

package/scripts/check-frontend-analytics-guidance.mjs

@@ -1,88 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, resolve } from 'node:path';
-
-const here = dirname(fileURLToPath(import.meta.url));
-const source = readFileSync(resolve(here, '../src/index.ts'), 'utf8');
-
-const checks = [
-  ['dedicated docs topic', /'frontend-analytics': `/],
-  ['anonymous analytics without an invented session', /Before login:[\s\S]*do not invent a session/i],
-  ['identify after authentication', /After login\/registration:[\s\S]*identify\(fullSessionToken\)/i],
-  ['identify after refresh', /After refresh:[\s\S]*identify\(newSessionToken\)/i],
-  ['clear identity on logout and account switching', /LOGOUT \/ ACCOUNT SWITCHING[\s\S]*clearSession\(\)/],
-  ['SPA route pageviews', /location\.pathname[\s\S]*analytics\.pageview/],
-  ['pageviews and custom events', /CUSTOM EVENTS[\s\S]*PAGE VIEWS/],
-  ['analytics is non-authoritative', /Analytics is never an authoritative order/],
-  ['tokens excluded from properties', /session\/refresh tokens in event[\s\S]*properties/],
-  ['hidden multiplayer state warning', /HIDDEN AND SENSITIVE DATA/],
-  ['masking review before auto-capture', /AUTO-CAPTURE — OPT IN ONLY AFTER A PRIVACY AUDIT/],
-  ['visitor ID is not authentication', /visitor ID is anonymous analytics identity, not authentication/i],
-  ['trace correlation', /traceId\s*= correlation/],
-  ['dashboard troubleshooting covers both tracks', /Investigate both tracks before blaming the SDK/],
-  ['installed exports take precedence', /Installed package types and exports determine what can be called now/],
-];
-
-for (const [name, pattern] of checks) {
-  assert.match(source, pattern, `Missing frontend analytics guidance: ${name}`);
-}
-
-assert.doesNotMatch(
-  source,
-  /analytics\.identify\(\{\s*userId/,
-  'MCP guidance must not use the obsolete identify({ userId, traits }) signature',
-);
-
-const safetyChecks = [
-  ['admin execute calls removed', /ductape_execute\("[^"\n]*(?:create|update)/],
-  ['obsolete NestJS consumer removed', /events\.consume in onModuleInit/],
-  ['canonical NestJS consumer present', /@Events\.Consumer\(\{ event:/],
-  ['request actor context documented', /AsyncLocalStorage[\s\S]*ActorContext/],
-  ['raw token logging prohibited', /Never log,[\s\S]*raw session\/refresh token/],
-  ['durable token expiry semantics documented', /does not expose an immutable[\s\S]*expired-token attribution contract/],
-  ['frontend durable work prohibits persisted JWTs', /For delayed\/durable work, do not persist raw JWTs indefinitely/],
-  ['browser events use frontend client', /CLIENT-SIDE \(browser — publishable key\):[\s\S]*import \{ createClient \} from '@ductape\/client';[\s\S]*ductape\.brokers\.publish/],
-  ['resilience decision matrix present', /DECISION MATRIX[\s\S]*Database atomicity/],
-  ['payload session-awareness metadata present', /session_awareness:[\s\S]*accepts_session/],
-  ['execute blocks administrative mutations', /Administrative operation.*is blocked in ductape_execute/],
-  ['CLI auth is remotely validated', /ductape workspaces list --json/],
-  ['CLI 401 triggers login-required state', /authentication expired or was revoked \(HTTP 401\)[\s\S]*ductape login/],
-  ['CLI distinguishes endpoint 401 from expired login', /session and active workspace are authenticated[\s\S]*Do not ask the user to log in again/],
-  ['CLI auth guidance does not request secrets', /Never ask the user to paste their password/],
-  ['notification CLI administration documented', /resources notifications create[\s\S]*notifications messages create/],
-  ['notification command allowed by MCP', /ADMIN_SUBCOMMANDS[\s\S]*'notifications'/],
-  ['notification template uses SDK shape', /push_notification\?: \{ title: string, body: string[\s\S]*email\?: \{ subject: string, template: string/],
-  ['notification declarations require array shape', /file MUST be a top-level JSON array/],
-  ['external CLI login is re-read', /authState === 'unknown' \|\| authState === 'none'/],
-  ['compact product inventory documented', /products components list --tag <tag> --json/],
-  ['features use installed events context', /ctx\.events\.produce inside a Feature/],
-  ['features are code-first rather than Workbench-created', /Features have no CLI (?:create|creation)\s+command because (?:their )?definitions are code-first/],
-  ['Firebase GCP cloud connection documented', /FIREBASE THROUGH A GCP CLOUD CONNECTION[\s\S]*authMode.*cloud_connection/],
-  ['Slack and Discord sends documented', /notifications\.slack\.send[\s\S]*notifications\.discord\.send/],
-];
-
-for (const [name, pattern] of safetyChecks) {
-  if (name === 'admin execute calls removed' || name === 'obsolete NestJS consumer removed') {
-    assert.doesNotMatch(source, pattern, `Unsafe MCP guidance remains: ${name}`);
-  } else {
-    assert.match(source, pattern, `Missing MCP safety guidance: ${name}`);
-  }
-}
-
-const clientEventsSection = source.match(
-  /CLIENT-SIDE \(browser — publishable key\):[\s\S]*?SCHEDULED DISPATCH \(background job\):/,
-)?.[0] ?? '';
-assert.doesNotMatch(
-  clientEventsSection,
-  /from '@ductape\/sdk'/,
-  'Browser Events guidance must not import the server SDK',
-);
-
-assert.doesNotMatch(
-  source,
-  /ctx\.messaging\.produce/,
-  'Feature guidance must use the installed ctx.events API, not a nonexistent ctx.messaging alias',
-);
-
-console.log(`MCP guidance: ${checks.length + 1 + safetyChecks.length} acceptance checks passed`);