@ductape/mcp 0.3.4 → 0.3.6

package/dist/frontend-analytics-validator.d.ts

@@ -4,6 +4,7 @@ interface AnalyticsDecision {
     rationale?: string;
     autoCapture?: 'disabled' | 'reviewed';
     privacyReviewed?: boolean;
+    settingsContractsReviewed?: boolean;
 }
 export interface FrontendAnalyticsValidationResult {
     valid: boolean;
@@ -18,6 +19,7 @@ export interface FrontendAnalyticsValidationResult {
         framework: 'react' | 'vue' | 'client';
         decision?: AnalyticsDecision;
         signals: Record<string, boolean>;
+        evidence: Record<string, string[]>;
         errors: string[];
         warnings: string[];
     }>;

package/dist/frontend-analytics-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-analytics-validator.d.ts","sourceRoot":"","sources":["../src/frontend-analytics-validator.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5E,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAMD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA0DD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,iCAAiC,CAkGnC"}
+{"version":3,"file":"frontend-analytics-validator.d.ts","sourceRoot":"","sources":["../src/frontend-analytics-validator.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5E,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAMD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA0DD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,iCAAiC,CAyInC"}

package/dist/frontend-analytics-validator.js

@@ -47,17 +47,18 @@ function packageFramework(manifest) {
         return 'client';
     return undefined;
 }
-function scanSource(applicationRoot) {
+function scanSource(projectRoot, roots) {
     const chunks = [];
-    walk(applicationRoot, (file) => {
-        if (!SOURCE_EXTENSIONS.has(path.extname(file)))
-            return;
-        const stats = fs.statSync(file);
-        if (stats.size > MAX_SOURCE_BYTES)
-            return;
-        chunks.push(fs.readFileSync(file, 'utf8'));
-    });
-    return chunks.join('\n');
+    for (const sourceRoot of roots)
+        walk(sourceRoot, (file) => {
+            if (!SOURCE_EXTENSIONS.has(path.extname(file)))
+                return;
+            const stats = fs.statSync(file);
+            if (stats.size > MAX_SOURCE_BYTES)
+                return;
+            chunks.push({ file: normalizedRelative(projectRoot, file), source: fs.readFileSync(file, 'utf8') });
+        });
+    return chunks;
 }
 function normalizedRelative(root, target) {
     return path.relative(root, target).split(path.sep).join('/') || '.';
@@ -87,6 +88,15 @@ export function validateFrontendAnalyticsProject(projectDir) {
         if (path.basename(file) === 'package.json')
             packageFiles.push(file);
     });
+    const packages = new Map();
+    for (const manifestFile of packageFiles) {
+        try {
+            const manifest = readJson(manifestFile);
+            if (typeof manifest.name === 'string')
+                packages.set(manifest.name, { root: path.dirname(manifestFile), manifest });
+        }
+        catch { /* Invalid manifests are ignored as application candidates below. */ }
+    }
     const applications = packageFiles.flatMap((manifestFile) => {
         let manifest;
         try {
@@ -100,19 +110,45 @@ export function validateFrontendAnalyticsProject(projectDir) {
             return [];
         const applicationRoot = path.dirname(manifestFile);
         const applicationPath = normalizedRelative(root, applicationRoot);
-        const source = scanSource(applicationRoot);
+        const sourceRoots = [applicationRoot];
+        const visited = new Set([applicationRoot]);
+        for (let index = 0; index < sourceRoots.length; index += 1) {
+            const currentRoot = sourceRoots[index];
+            const current = index === 0
+                ? manifest
+                : [...packages.values()].find((entry) => entry.root === currentRoot)?.manifest;
+            if (!current)
+                continue;
+            const dependencies = { ...(current.dependencies ?? {}), ...(current.devDependencies ?? {}) };
+            const directSource = scanSource(root, [currentRoot]).map((item) => item.source).join('\n');
+            for (const dependencyName of Object.keys(dependencies)) {
+                const dependency = packages.get(dependencyName);
+                if (!dependency || visited.has(dependency.root))
+                    continue;
+                const escaped = dependencyName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                if (!new RegExp(`['\"]${escaped}(?:/[^'\"]*)?['\"]`).test(directSource))
+                    continue;
+                visited.add(dependency.root);
+                sourceRoots.push(dependency.root);
+            }
+        }
+        const files = scanSource(root, sourceRoots);
         const decision = decisions.applications?.[applicationPath];
-        const signals = {
-            provider: /DuctapeProvider/.test(source),
-            authenticatedSessions: /useSession|\.sessions\.|sessionToken|refreshToken/.test(source),
-            analytics: /useAnalytics|\.analytics\./.test(source),
-            identify: /(?:analytics\.)?identify\s*\(/.test(source),
-            clearSession: /(?:analytics\.)?clearSession\s*\(/.test(source),
-            pageview: /(?:analytics\.)?pageview\s*\(/.test(source),
-            namedEvents: /(?:analytics\.)?track\s*\(/.test(source),
-            autoCapture: /enableAutoCapture\s*\(/.test(source),
-            clientFailure: /client[_\-. ]error|frontend[_\-. ]error|error_boundary|unhandledrejection/i.test(source),
+        const patterns = {
+            provider: /DuctapeProvider/, authenticatedSessions: /useSession|\.sessions\.|sessionToken|refreshToken/,
+            analytics: /useAnalytics|\.analytics\./, identify: /(?:analytics\.)?identify\s*\(/,
+            clearSession: /(?:analytics\.)?clearSession\s*\(/, pageview: /(?:analytics\.)?pageview\s*\(/,
+            namedEvents: /(?:analytics\.)?track\s*\(/, autoCapture: /enableAutoCapture\s*\(/,
+            clientFailure: /client[_\-. ]error|frontend[_\-. ]error|error_boundary|unhandledrejection/i,
+            settingsSurface: /settings|preferences|notificationpreferences/i,
+            settingsLiveRead: /\b(?:get|load|fetch|request)\s*[:=(]|method\s*:\s*['"]GET['"]/i,
+            settingsLiveWrite: /\b(?:update|save|mutate|request)\s*[:=(]|method\s*:\s*['"](?:POST|PUT|PATCH)['"]/i,
+            settingsLoading: /\b(?:loading|isLoading|pending|isPending)\b/i,
+            settingsFailure: /\b(?:error|failure|failed)\b/i,
+            settingsRetry: /\b(?:retry|refetch|reload|tryAgain)\b/i,
         };
+        const evidence = Object.fromEntries(Object.entries(patterns).map(([name, pattern]) => [name, files.filter((item) => pattern.test(item.source)).map((item) => item.file)]));
+        const signals = Object.fromEntries(Object.entries(evidence).map(([name, matches]) => [name, matches.length > 0]));
         const errors = [];
         const warnings = [];
         if (decisionError)
@@ -147,8 +183,22 @@ export function validateFrontendAnalyticsProject(projectDir) {
             if (!signals.clientFailure) {
                 warnings.push('No sanitized client-failure analytics signal was detected; review error boundaries and unhandled failures.');
             }
+            if (signals.settingsSurface) {
+                if (!signals.settingsLiveRead)
+                    errors.push('A settings surface was found without a statically discoverable canonical read path.');
+                if (!signals.settingsLiveWrite)
+                    errors.push('A settings surface was found without a statically discoverable persisted mutation path.');
+                if (!signals.settingsLoading)
+                    errors.push('A settings surface was found without a loading/pending state.');
+                if (!signals.settingsFailure)
+                    errors.push('A settings surface was found without a failure state.');
+                if (!signals.settingsRetry)
+                    errors.push('A settings surface was found without a retry/refetch path.');
+                if (!decision.settingsContractsReviewed)
+                    errors.push('Settings payload keys must be reviewed against the current registered Feature input schema; record settingsContractsReviewed: true after that review.');
+            }
         }
-        return [{ path: applicationPath, framework, decision, signals, errors, warnings }];
+        return [{ path: applicationPath, framework, decision, signals, evidence, errors, warnings }];
     });
     const errors = applications.reduce((count, app) => count + app.errors.length, 0);
     const warnings = applications.reduce((count, app) => count + app.warnings.length, 0);

package/dist/index.js

@@ -1723,6 +1723,9 @@ const featuresProjectValidationInputSchema = z.object({
 const frontendAnalyticsProjectValidationInputSchema = z.object({
     project_dir: z.string().describe('Absolute path to a frontend project or monorepo. The validator is read-only and never modifies application code.'),
 });
+const sessionProjectValidationInputSchema = z.object({
+    project_dir: z.string().describe('Absolute path to the project. Performs a read-only SDK session-propagation audit.'),
+});
 const readOnlyLocalAnnotations = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -2388,6 +2391,23 @@ PRODUCT ANALYTICS
   failures, privacy masking, hidden-state safety, and trace correlation. Keep auto-capture off until
   consent, selectors, masking, and sensitive states have been reviewed.
 
+LIVE SETTINGS AND FEATURE CONTRACTS
+  A settings screen is incomplete if it renders static/mock values, mutates only local state, or
+  sends independently invented payload keys. Before declaring any persisted preference/settings
+  requirement complete:
+  1. Identify the owning registered Feature and inspect its exact current input schema. Do not
+     infer the schema from UI labels, old examples, TypeScript names, or domain expectations.
+  2. Generate or consume the frontend input type from that Feature contract. Literal payload keys
+     must be a subset of declared properties and every required property must be supplied.
+  3. Use the session-aware Ductape client path (directly or through a reviewed application API),
+     load canonical state on entry, persist every mutation, and render loading, failure, and retry.
+  4. Verify a real read-after-write round trip in the target environment. A successful animation,
+     toast, local state change, mock response, or TypeScript compilation is not persistence proof.
+  5. For notification preferences, distinguish channel consent (email, sms, push) from event-category
+     subscriptions. Never submit category labels where the Feature contract accepts channel keys.
+  Completion review MUST reject static/mock settings, missing read or write paths, absent failure/retry
+  states, and payload keys that were not checked against the registered Feature schema.
+
 AUTHENTICATION AND SECURITY
   - Use publishableKey in browser applications. Never ship workspace private keys or privileged
     access keys in frontend bundles.
@@ -6106,6 +6126,10 @@ const frontendAnalyticsProjectValidationHandler = async (args) => {
         };
     }
 };
+const sessionProjectValidationHandler = async (args) => {
+    const result = runCli('sessions validate --json', args.project_dir);
+    return { content: [{ type: 'text', text: result.output || '(no output)' }], ...(result.success ? {} : { isError: true }) };
+};
 const cliInputSchema = z.object({
     command: z.string().describe('The ductape CLI command to run, without the leading "ductape" word. ' +
         'Examples: "products list", "products create --name \\"My Product\\" --tag my-product", ' +
@@ -6966,6 +6990,12 @@ async function main() {
             inputSchema: frontendAnalyticsProjectValidationInputSchema,
             annotations: readOnlyLocalAnnotations,
         }, frontendAnalyticsProjectValidationHandler);
+        server.registerTool('ductape_sessions_validate_project', {
+            title: 'Validate Ductape Session Propagation',
+            description: 'Read-only project-wide audit. Every supported SDK call must explicitly pass a session, inherit it from Feature context, or carry a reasoned delegated/system marker.',
+            inputSchema: sessionProjectValidationInputSchema,
+            annotations: readOnlyLocalAnnotations,
+        }, sessionProjectValidationHandler);
         server.registerTool('ductape_function_setup', {
             title: 'Ductape Portable Function Setup',
             description: 'Read-only: generate (without applying) the mandatory secure local + remote runtime setup for application functions used by Features. ' +
@@ -7217,6 +7247,7 @@ async function main() {
         server.tool('ductape_events_validate_project', eventsProjectValidationInputSchema.shape, readOnlyLocalAnnotations, eventsProjectValidationHandler);
         server.tool('ductape_features_validate_project', featuresProjectValidationInputSchema.shape, readOnlyLocalAnnotations, featuresProjectValidationHandler);
         server.tool('ductape_frontend_analytics_validate_project', frontendAnalyticsProjectValidationInputSchema.shape, readOnlyLocalAnnotations, frontendAnalyticsProjectValidationHandler);
+        server.tool('ductape_sessions_validate_project', sessionProjectValidationInputSchema.shape, readOnlyLocalAnnotations, sessionProjectValidationHandler);
         server.tool('ductape_function_setup', portableFunctionSetupInputSchema.shape, portableFunctionSetupAnnotations, portableFunctionSetupHandler);
         server.tool('ductape_redis_setup', redisSetupInputSchema.shape, redisSetupHandler);
         server.tool('ductape_migration_plan', migrationInputSchema.shape, migrationHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",