@fidacy/mcp 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -112,3 +112,15 @@ semantic versioning.
   on next boot (losing all dedup state). A torn trailing line is now recognized,
   the intact prefix is salvaged, and the tail truncated. Mid-file damage still
   quarantines the file as before.
+
+## 0.1.13 — 2026-07-03
+
+- MCP handshake now reports the real package version (was hardcoded "0.1.0"
+  through 0.1.12 — same class as the client_version telemetry bug, same fix:
+  injected from package.json at build time).
+
+## 0.1.14 — 2026-07-03
+
+- Granular block-type telemetry: DENY reasons now split into lookalike (BEC),
+  duplicate-invoice, payee, cap, window and invalid, so the public threat page
+  can count blocks by attack class. Still zero PII (an enum, never the rule text).

package/dist/core.js

@@ -423,7 +423,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.12" : "dev";
+var CLIENT_VERSION = true ? "0.1.14" : "dev";
 var currentShell = "mcp";
 function telemetryEnabled() {
   const v = (process.env.FIDACY_DISABLE_TELEMETRY ?? "").trim().toLowerCase();
@@ -444,8 +444,13 @@ var flushTimer = null;
 function resultOf(status, violatedRule) {
   if (status === "ALLOW") return "allow";
   const r = violatedRule ?? "";
-  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("payee_lookalike")) return "deny_lookalike";
   if (r.startsWith("payee_not_in_allowlist")) return "deny_payee";
+  if (r.startsWith("duplicate_invoice")) return "deny_duplicate";
+  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("mandate_revoked") || r.startsWith("before_mandate") || r.startsWith("after_mandate"))
+    return "deny_window";
+  if (r.startsWith("non_positive_amount") || r.startsWith("invalid_")) return "deny_invalid";
   return "deny_scope";
 }
 function record(type, result) {

package/dist/index.js

@@ -452,7 +452,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.12" : "dev";
+var CLIENT_VERSION = true ? "0.1.14" : "dev";
 var currentShell = "mcp";
 function telemetryEnabled() {
   const v = (process.env.FIDACY_DISABLE_TELEMETRY ?? "").trim().toLowerCase();
@@ -473,8 +473,13 @@ var flushTimer = null;
 function resultOf(status, violatedRule) {
   if (status === "ALLOW") return "allow";
   const r = violatedRule ?? "";
-  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("payee_lookalike")) return "deny_lookalike";
   if (r.startsWith("payee_not_in_allowlist")) return "deny_payee";
+  if (r.startsWith("duplicate_invoice")) return "deny_duplicate";
+  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("mandate_revoked") || r.startsWith("before_mandate") || r.startsWith("after_mandate"))
+    return "deny_window";
+  if (r.startsWith("non_positive_amount") || r.startsWith("invalid_")) return "deny_invalid";
   return "deny_scope";
 }
 function record(type, result) {
@@ -676,7 +681,7 @@ async function postOnce(fetchImpl, url, headers, payload, timeoutMs) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.12" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.14" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -776,7 +781,8 @@ function weekOneBootNudge(upgradeToolName) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var server = new McpServer({ name: "fidacy", version: "0.1.0" });
+var SERVER_VERSION = true ? "0.1.14" : "dev";
+var server = new McpServer({ name: "fidacy", version: SERVER_VERSION });
 server.registerTool(
   "request_payment",
   {

package/dist/lib.js

@@ -571,7 +571,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.1.12" : "dev";
+var CLIENT_VERSION = true ? "0.1.14" : "dev";
 var currentShell = "mcp";
 function setTelemetryShell(shell) {
   currentShell = shell;
@@ -595,8 +595,13 @@ var flushTimer = null;
 function resultOf(status, violatedRule) {
   if (status === "ALLOW") return "allow";
   const r = violatedRule ?? "";
-  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("payee_lookalike")) return "deny_lookalike";
   if (r.startsWith("payee_not_in_allowlist")) return "deny_payee";
+  if (r.startsWith("duplicate_invoice")) return "deny_duplicate";
+  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("mandate_revoked") || r.startsWith("before_mandate") || r.startsWith("after_mandate"))
+    return "deny_window";
+  if (r.startsWith("non_positive_amount") || r.startsWith("invalid_")) return "deny_invalid";
   return "deny_scope";
 }
 function record(type, result) {
@@ -694,7 +699,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.1.12" : "dev";
+var CLIENT_VERSION2 = true ? "0.1.14" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",