mcp-scraper 0.67.1 → 0.69.0

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.69.0] - 2026-08-27
+
+### Added
+
+- Added production reporting for sessions, visitors, confirmed and candidate-assisted journeys, chronological timelines, lead-stage funnels, seven attribution models, ad-spend efficiency, lead scores, and evidence-gated predictions.
+- Added four-purpose consent receipts, GPC and withdrawal enforcement, purpose-specific retention, governed export and deletion, namespace isolation, and audited deterministic promotion of candidate associations.
+- Added guided setup and product-health evidence, configurable fixed or conditional event values, saved report views, privacy-safe support diagnostics, and scale/restore verification tooling.
+- Added documented and tenant-discovered CRM capability profiles for HubSpot, Salesforce, HighLevel, Zoho, Pipedrive, and Keap, including explicit field provisioning, person sync, journey activity, pipeline-event mapping, test writes, and incremental outcome reads where the provider supports them.
+- Added CallRail and Twilio reconciliation actions and expanded the unified public MCP catalog to 315 tools with 40 new production X-Ray operations.
+
+### Changed
+
+- X-Ray MCP operations now publish operation-specific input and output contracts, bounded redacted results, explicit destructive annotations, and persisted conflicting-idempotency-key rejection.
+- Candidate-assisted evidence remains a separately conserved reporting overlay and cannot activate ads, update CRM records, train predictions, or establish a confirmed identity without deterministic evidence.
+- CRM person sync is contact-only; deals are created or updated only through an approved, versioned pipeline-event mapping.
+- The Pixel now enforces independent site-analytics, enhanced-matching, and advertising-measurement purposes while retaining necessary-only consent receipts and deletion precedence.
+
+### Fixed
+
+- Activation readiness now persists accepted provider evidence without UUID/text casting failures and unwraps typed connected-service receipts before verification.
+- Public catalog mirrors, provider inventories, readiness guards, and release contracts now agree on the 315-tool and 329-action production surfaces.
+
+## [0.68.0] - 2026-08-26
+
+### Added
+
+- X-Ray now models explicit sessions, immutable attribution touches, deterministic people, canonical phone and CRM events, versioned conversion rules, signed webhook receipts, and full cross-system customer journeys.
+- Added signed webhook ingestion for CallRail, CallTrackingMetrics, Twilio, HubSpot, and HighLevel, plus durable encrypted CRM import and ad-activation delivery workers with bounded retries and dead-letter evidence.
+- Added X-Ray MCP tools for connection readiness, conversion rules, canonical server events, attribution coverage, and person journeys.
+- Added declarative page, click, phone-link, and same-origin form event definitions that existing Pixel installs load automatically, with matching REST and MCP controls.
+- Added direct activation mapping for Google, Meta, TikTok, and Reddit through verified connected-action tools, with per-conversion idempotency and provider receipt state.
+- Added an end-to-end X-Ray proof harness covering consented Google click attribution, phone and CRM stage events, conversion deduplication, verified activation, scheduled delivery, safe receipts, and journey readback.
+
+### Changed
+
+- Browser collection now retains consented first-party visitor continuity, explicit 30-minute sessions, first/last/ordered attribution touches, dwell time, scroll depth, expanded native click identifiers, and an explicit identify API without probabilistic fingerprinting.
+- Conversion persistence and eligible activation-job creation now commit atomically; configured-but-unverified destinations cannot receive conversion jobs.
+- Restricted contact and webhook payloads use purpose-bound encryption with scheduled expiry, while deterministic identity joins use keyed HMACs and provider match payloads use normalized hashes.
+- Public MCP catalog mirrors now report the canonical 275-tool inventory generated from the runtime contract.
+
+### Fixed
+
+- X-Ray Pixel now initializes when frameworks insert its script after hydration and sends credential-free beacons without a browser preflight, restoring collection for Next.js and other dynamically rendered sites.
+- Duplicate conversion submissions now return the persisted conversion ID instead of a newly generated non-existent ID.
+
 ## [0.67.1] - 2026-08-26
 
 ### Fixed
@@ -1141,7 +1186,9 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.67.1...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.69.0...HEAD
+[0.69.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.68.0...v0.69.0
+[0.68.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.67.1...v0.68.0
 [0.67.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.67.0...v0.67.1
 [0.67.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.7...v0.67.0
 [0.66.7]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.6...v0.66.7

package/README.md

@@ -159,7 +159,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.67.1`, SHA-256 `257eb19b72d228cc4aec4973778036cfc7c13419da6de35391ea7179ce629a03`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.69.0`, SHA-256 `052a9fc23beb72deae11e48c1e49978aaab6408a0cb1ce13415a17eec7508330`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -317,7 +317,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 259 tools: 158 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools. The scraper-side inventory includes rendered site-content similarity, governed Local Sourcebook tools, Transparent Commons entity, linkset, and publication tools, direct site-export text and image readers, the searchable News Publisher and Editorial Reading Room template workflow, and 24 X-Ray tools for pixel administration, reporting, attribution journeys, campaign links, exports, and scheduled reports. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 315 tools: 214 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools. The scraper-side inventory includes rendered site-content similarity, governed Local Sourcebook tools, Transparent Commons entity, linkset, and publication tools, direct site-export text and image readers, the searchable News Publisher and Editorial Reading Room template workflow, and 33 X-Ray tools for pixel administration, reporting, attribution journeys, campaign links, exports, and scheduled reports. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
 

package/dist/{analytics-repository-RUXBFSFX.js → analytics-repository-62CAZAIP.js}

@@ -17,8 +17,10 @@ import {
   analyticsTimeseries,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
+  claimAnalyticsCrmImportRows,
   claimAnalyticsFormDeliveryJobs,
   closeAnalyticsPool,
+  completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
@@ -28,18 +30,23 @@ import {
   createAnalyticsForm,
   createAnalyticsPixel,
   createAnalyticsSite,
+  deferAnalyticsCrmImportRow,
   deferAnalyticsFormDelivery,
   deleteAnalyticsSite,
+  getAnalyticsActivationDestinationConnectionRef,
   getAnalyticsPersonJourney,
   getAnalyticsPool,
   getPublicAnalyticsForm,
+  identityHmac,
   ingestAnalyticsEvents,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   listAnalyticsActivationDestinations,
+  listAnalyticsActivationReceipts,
   listAnalyticsCampaignLinks,
   listAnalyticsCrmImports,
   listAnalyticsForms,
+  listAnalyticsHostGroups,
   listAnalyticsPeople,
   listAnalyticsPixels,
   listAnalyticsSites,
@@ -48,19 +55,30 @@ import {
   normalizeAnalyticsUrl,
   normalizeContentOptions,
   normalizeObservedHostname,
+  pollAnalyticsActivationDiagnostics,
+  prepareAnalyticsLinkerIssue,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,
   recordAnalyticsFormSubmission,
+  redeemAnalyticsLinkerRecord,
   refreshAnalyticsDailyRollups,
   refreshAnalyticsDailyRollupsIfDue,
+  requireAnalyticsAccess,
+  requireAnalyticsEditor,
   resolveAnalyticsCampaignLink,
+  retryAnalyticsActivationJob,
   sanitizeAnalyticsProperties,
   sanitizeClickIds,
+  setAnalyticsActivationReadiness,
   setAnalyticsPixelDomainState,
+  sweepAnalyticsRestrictedRetention,
+  testAnalyticsActivationDestination,
   updateAnalyticsBusinessModel,
   updateAnalyticsPixel,
-  upsertAnalyticsAdSpend
-} from "./chunk-CNLLTD5B.js";
+  upsertAnalyticsAdSpend,
+  upsertAnalyticsHostGroup
+} from "./chunk-KO5CK5ZT.js";
+import "./chunk-65FTMB7G.js";
 export {
   ANALYTICS_CONTENT_SORTS,
   AnalyticsRepositoryError,
@@ -80,8 +98,10 @@ export {
   analyticsTimeseries,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
+  claimAnalyticsCrmImportRows,
   claimAnalyticsFormDeliveryJobs,
   closeAnalyticsPool,
+  completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
@@ -91,18 +111,23 @@ export {
   createAnalyticsForm,
   createAnalyticsPixel,
   createAnalyticsSite,
+  deferAnalyticsCrmImportRow,
   deferAnalyticsFormDelivery,
   deleteAnalyticsSite,
+  getAnalyticsActivationDestinationConnectionRef,
   getAnalyticsPersonJourney,
   getAnalyticsPool,
   getPublicAnalyticsForm,
+  identityHmac,
   ingestAnalyticsEvents,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   listAnalyticsActivationDestinations,
+  listAnalyticsActivationReceipts,
   listAnalyticsCampaignLinks,
   listAnalyticsCrmImports,
   listAnalyticsForms,
+  listAnalyticsHostGroups,
   listAnalyticsPeople,
   listAnalyticsPixels,
   listAnalyticsSites,
@@ -111,16 +136,26 @@ export {
   normalizeAnalyticsUrl,
   normalizeContentOptions,
   normalizeObservedHostname,
+  pollAnalyticsActivationDiagnostics,
+  prepareAnalyticsLinkerIssue,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,
   recordAnalyticsFormSubmission,
+  redeemAnalyticsLinkerRecord,
   refreshAnalyticsDailyRollups,
   refreshAnalyticsDailyRollupsIfDue,
+  requireAnalyticsAccess,
+  requireAnalyticsEditor,
   resolveAnalyticsCampaignLink,
+  retryAnalyticsActivationJob,
   sanitizeAnalyticsProperties,
   sanitizeClickIds,
+  setAnalyticsActivationReadiness,
   setAnalyticsPixelDomainState,
+  sweepAnalyticsRestrictedRetention,
+  testAnalyticsActivationDestination,
   updateAnalyticsBusinessModel,
   updateAnalyticsPixel,
-  upsertAnalyticsAdSpend
+  upsertAnalyticsAdSpend,
+  upsertAnalyticsHostGroup
 };