@fidacy/mcp 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.2.10
+
+### Patch Changes
+
+- 2e846a7: Funnel: move the strongest claim nudge before the activation wall, and make the
+  first-block nudge scary-but-true.
+
+  The proof-teaser nudge fired at decision 25, stranded behind the 20-decision
+  activation wall: once the firewall fails closed at 20, denied calls stop
+  advancing the counter, so 25 was never reached and the single strongest reason
+  to claim (the history you already built) never showed. It now fires at 15, five
+  decisions before the wall — carrot before stick, which is the highest-converting
+  moment the PLG research points to.
+
+  The first-deny nudge now cites the real $441,788 agent incident. Grounded fear,
+  never manufactured: for a company whose pitch is verify-don't-trust, a cited
+  fact converts and a fabricated panic would be self-refuting.
+
+## 0.2.9
+
+### Patch Changes
+
+- 1a3f504: Name the publisher in package metadata, and release through CI so the artifact
+  carries Sigstore provenance.
+
+  The `author` field was missing, which is why trust registries listed the packages
+  as authored by "Unknown". More importantly, every release so far went out as a
+  manual `npm publish` from a laptop, so no `@fidacy/*` package carried a
+  provenance attestation. Provenance is an OIDC statement from a CI runner about
+  which workflow built the artifact, so a laptop cannot produce one regardless of
+  flags. The Release workflow was already configured for it and simply had never
+  been used.
+
+  For a project whose entire claim is independently verifiable evidence, shipping
+  without supply-chain attestation was the wrong asymmetry.
+
 ## 0.2.5
 
 TypeScript declarations ship in the package. Every entrypoint (., ./assess,

package/dist/core.js

@@ -461,7 +461,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.10" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";

package/dist/index.js

@@ -490,7 +490,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.10" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -834,7 +834,7 @@ async function findArtifacts(sha2562, cfg) {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.10" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -927,13 +927,13 @@ function decisionNudge(status, violatedRule, upgradeToolName) {
     return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
+    return `Fidacy just blocked this payment before it moved. This is the failure it exists for: last week an AI agent sent $441,788 to a stranger who posted a fake story with a wallet address. Nothing was checking it. For your operator: ${claimPath}.`;
   }
   if (status === "ALLOW" && nudgeOnce("first_allow")) {
     return `Fidacy authorized this and signed the decision. For your operator: ${claimPath}.`;
   }
-  if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
+  if (count === 15 && nudgeOnce("proof_teaser")) {
+    return `Fidacy has now checked ${count} payments on this agent and stands between it and the wrong one, the prompt-injected payee, the duplicate, the over-limit charge. That protection pauses after 20 decisions without a free key. Keep the agent covered: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
     return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;
@@ -1264,7 +1264,7 @@ function renderAlertLine(alerts) {
 var state = ensureState();
 var core = makeCore();
 var subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
-var SERVER_VERSION = true ? "0.2.8" : "dev";
+var SERVER_VERSION = true ? "0.2.10" : "dev";
 var bootClaim = claimUrl();
 var server = new McpServer(
   { name: "fidacy", version: SERVER_VERSION },

package/dist/lib.js

@@ -613,7 +613,7 @@ function resolveMandateRules(cfg) {
 }
 
 // src/telemetry.ts
-var CLIENT_VERSION = true ? "0.2.8" : "dev";
+var CLIENT_VERSION = true ? "0.2.10" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -791,7 +791,7 @@ function requestUpgrade() {
 }
 
 // src/provision.ts
-var CLIENT_VERSION2 = true ? "0.2.8" : "dev";
+var CLIENT_VERSION2 = true ? "0.2.10" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -872,13 +872,13 @@ function decisionNudge(status, violatedRule, upgradeToolName) {
     return `That was a duplicate-invoice (BEC) catch, the #1 payment fraud. For your operator: ${claimPath}. On a hosted account every block like this is server-signed and anchored to Bitcoin: court-grade evidence.`;
   }
   if (status === "DENY" && nudgeOnce("first_deny")) {
-    return `Fidacy just blocked this for you. For your operator: ${claimPath}.`;
+    return `Fidacy just blocked this payment before it moved. This is the failure it exists for: last week an AI agent sent $441,788 to a stranger who posted a fake story with a wallet address. Nothing was checking it. For your operator: ${claimPath}.`;
   }
   if (status === "ALLOW" && nudgeOnce("first_allow")) {
     return `Fidacy authorized this and signed the decision. For your operator: ${claimPath}.`;
   }
-  if (count === 25 && nudgeOnce("proof_teaser")) {
-    return `Your local chain now holds ${count} decisions only you can read. Anchor them and anyone can verify at fidacy.com/verify, no account needed on their side. For your operator: ${claimPath}.`;
+  if (count === 15 && nudgeOnce("proof_teaser")) {
+    return `Fidacy has now checked ${count} payments on this agent and stands between it and the wrong one, the prompt-injected payee, the duplicate, the over-limit charge. That protection pauses after 20 decisions without a free key. Keep the agent covered: ${claimPath}.`;
   }
   if (count === 10 && nudgeOnce("milestone_10")) {
     return `That's 10 actions gated on this install. For your operator: ${claimPath}.`;

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
+  "author": "Fidacy (ZeepCode Group Technology LLC) <hello@fidacy.com> (https://fidacy.com)",
   "homepage": "https://fidacy.com",
   "keywords": [
     "mcp",
@@ -49,12 +50,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "node scripts/bundle.mjs",
-    "dev": "tsx watch src/index.ts",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
   "engines": {
     "node": ">=18"
   },
@@ -63,14 +58,19 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "@fidacy/firewall": "workspace:*",
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",
-    "typescript": "^5.7.2"
+    "typescript": "^5.7.2",
+    "@fidacy/firewall": "0.1.1"
   },
   "mcpName": "com.fidacy/mcp",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lucaslubi/fidacy-mcp.git"
+  },
+  "scripts": {
+    "build": "node scripts/bundle.mjs",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js"
   }
-}
+}