@hanna84/mcp-writing 1.11.7 → 1.12.0

package/CHANGELOG.md

@@ -4,11 +4,31 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v1.12.0](https://github.com/hannasdev/mcp-writing.git
+/compare/v1.11.8...v1.12.0)
+
+- feat(scrivener-direct): ownership enforcement (PR-3a) [`#68`](https://github.com/hannasdev/mcp-writing.git
+/pull/68)
+
+#### [v1.11.8](https://github.com/hannasdev/mcp-writing.git
+/compare/v1.11.7...v1.11.8)
+
+> 24 April 2026
+
+- chore(deps): remove unused fast-xml-parser and bump @xmldom/xmldom [`#67`](https://github.com/hannasdev/mcp-writing.git
+/pull/67)
+- Release 1.11.8 [`7329eb4`](https://github.com/hannasdev/mcp-writing.git
+/commit/7329eb4107bb0ac1889d58446604381a47370133)
+
 #### [v1.11.7](https://github.com/hannasdev/mcp-writing.git
 /compare/v1.11.6...v1.11.7)
 
+> 24 April 2026
+
 - refactor: consolidate merge_scrivener_project_beta to async-only [`#66`](https://github.com/hannasdev/mcp-writing.git
 /pull/66)
+- Release 1.11.7 [`9e5e236`](https://github.com/hannasdev/mcp-writing.git
+/commit/9e5e236c576d5d4f4beba1845ea41ffa1d7c6950)
 
 #### [v1.11.6](https://github.com/hannasdev/mcp-writing.git
 /compare/v1.11.5...v1.11.6)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanna84/mcp-writing",
-  "version": "1.11.7",
+  "version": "1.12.0",
   "description": "MCP service for AI-assisted reasoning and editing on long-form fiction projects",
   "type": "module",
   "main": "index.js",
@@ -51,8 +51,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@xmldom/xmldom": "^0.9.9",
-    "fast-xml-parser": "^5.6.0",
+    "@xmldom/xmldom": "^0.9.10",
     "gray-matter": "^4.0.3",
     "js-yaml": "^4.1.1",
     "zod": "^4.3.6"

package/scrivener-direct.js

@@ -100,6 +100,21 @@ function moveFileIfNeeded(fromPath, toPath) {
   return { moved: true };
 }
 
+// Fields that are exclusively owned by the stable Scrivener sync-folder importer.
+// The beta merge must never write these fields, even additively, because the
+// importer derives them from the source filename and project structure in ways
+// the beta merge path cannot reliably replicate (e.g. scene_id slug, timeline
+// position from file sequence, external identity).
+export const IMPORTER_AUTHORITATIVE_FIELDS = Object.freeze([
+  "scene_id",
+  "external_source",
+  "external_id",
+  "title",
+  "timeline_position",
+]);
+
+const IMPORTER_AUTHORITATIVE_FIELD_SET = new Set(IMPORTER_AUTHORITATIVE_FIELDS);
+
 const KNOWN_CUSTOM_FIELD_IDS = new Set([
   "savethecat!",
   "causality",
@@ -222,8 +237,13 @@ function buildMergeDataFromProject(projectData, uuid) {
 export function mergeSidecarData(existing, mergeData) {
   const merged = { ...existing };
   const newKeys = [];
+  const blockedKeys = [];
 
   for (const [key, value] of Object.entries(mergeData)) {
+    if (IMPORTER_AUTHORITATIVE_FIELD_SET.has(key)) {
+      blockedKeys.push(key);
+      continue;
+    }
     if (!(key in merged)) {
       merged[key] = value;
       newKeys.push(key);
@@ -234,6 +254,7 @@ export function mergeSidecarData(existing, mergeData) {
     merged,
     changed: newKeys.length > 0,
     newKeys,
+    blockedKeys,
   };
 }