@ductape/mcp 0.3.5 → 0.3.6

package/dist/frontend-analytics-validator.d.ts

@@ -4,6 +4,7 @@ interface AnalyticsDecision {
     rationale?: string;
     autoCapture?: 'disabled' | 'reviewed';
     privacyReviewed?: boolean;
+    settingsContractsReviewed?: boolean;
 }
 export interface FrontendAnalyticsValidationResult {
     valid: boolean;

package/dist/frontend-analytics-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-analytics-validator.d.ts","sourceRoot":"","sources":["../src/frontend-analytics-validator.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5E,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAMD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA0DD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,iCAAiC,CA2HnC"}
+{"version":3,"file":"frontend-analytics-validator.d.ts","sourceRoot":"","sources":["../src/frontend-analytics-validator.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;AAE5E,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAMD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA0DD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,iCAAiC,CAyInC"}

package/dist/frontend-analytics-validator.js

@@ -140,6 +140,12 @@ export function validateFrontendAnalyticsProject(projectDir) {
             clearSession: /(?:analytics\.)?clearSession\s*\(/, pageview: /(?:analytics\.)?pageview\s*\(/,
             namedEvents: /(?:analytics\.)?track\s*\(/, autoCapture: /enableAutoCapture\s*\(/,
             clientFailure: /client[_\-. ]error|frontend[_\-. ]error|error_boundary|unhandledrejection/i,
+            settingsSurface: /settings|preferences|notificationpreferences/i,
+            settingsLiveRead: /\b(?:get|load|fetch|request)\s*[:=(]|method\s*:\s*['"]GET['"]/i,
+            settingsLiveWrite: /\b(?:update|save|mutate|request)\s*[:=(]|method\s*:\s*['"](?:POST|PUT|PATCH)['"]/i,
+            settingsLoading: /\b(?:loading|isLoading|pending|isPending)\b/i,
+            settingsFailure: /\b(?:error|failure|failed)\b/i,
+            settingsRetry: /\b(?:retry|refetch|reload|tryAgain)\b/i,
         };
         const evidence = Object.fromEntries(Object.entries(patterns).map(([name, pattern]) => [name, files.filter((item) => pattern.test(item.source)).map((item) => item.file)]));
         const signals = Object.fromEntries(Object.entries(evidence).map(([name, matches]) => [name, matches.length > 0]));
@@ -177,6 +183,20 @@ export function validateFrontendAnalyticsProject(projectDir) {
             if (!signals.clientFailure) {
                 warnings.push('No sanitized client-failure analytics signal was detected; review error boundaries and unhandled failures.');
             }
+            if (signals.settingsSurface) {
+                if (!signals.settingsLiveRead)
+                    errors.push('A settings surface was found without a statically discoverable canonical read path.');
+                if (!signals.settingsLiveWrite)
+                    errors.push('A settings surface was found without a statically discoverable persisted mutation path.');
+                if (!signals.settingsLoading)
+                    errors.push('A settings surface was found without a loading/pending state.');
+                if (!signals.settingsFailure)
+                    errors.push('A settings surface was found without a failure state.');
+                if (!signals.settingsRetry)
+                    errors.push('A settings surface was found without a retry/refetch path.');
+                if (!decision.settingsContractsReviewed)
+                    errors.push('Settings payload keys must be reviewed against the current registered Feature input schema; record settingsContractsReviewed: true after that review.');
+            }
         }
         return [{ path: applicationPath, framework, decision, signals, evidence, errors, warnings }];
     });

package/dist/index.js

@@ -2391,6 +2391,23 @@ PRODUCT ANALYTICS
   failures, privacy masking, hidden-state safety, and trace correlation. Keep auto-capture off until
   consent, selectors, masking, and sensitive states have been reviewed.
 
+LIVE SETTINGS AND FEATURE CONTRACTS
+  A settings screen is incomplete if it renders static/mock values, mutates only local state, or
+  sends independently invented payload keys. Before declaring any persisted preference/settings
+  requirement complete:
+  1. Identify the owning registered Feature and inspect its exact current input schema. Do not
+     infer the schema from UI labels, old examples, TypeScript names, or domain expectations.
+  2. Generate or consume the frontend input type from that Feature contract. Literal payload keys
+     must be a subset of declared properties and every required property must be supplied.
+  3. Use the session-aware Ductape client path (directly or through a reviewed application API),
+     load canonical state on entry, persist every mutation, and render loading, failure, and retry.
+  4. Verify a real read-after-write round trip in the target environment. A successful animation,
+     toast, local state change, mock response, or TypeScript compilation is not persistence proof.
+  5. For notification preferences, distinguish channel consent (email, sms, push) from event-category
+     subscriptions. Never submit category labels where the Feature contract accepts channel keys.
+  Completion review MUST reject static/mock settings, missing read or write paths, absent failure/retry
+  states, and payload keys that were not checked against the registered Feature schema.
+
 AUTHENTICATION AND SECURITY
   - Use publishableKey in browser applications. Never ship workspace private keys or privileged
     access keys in frontend bundles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",