mcp-scraper 0.83.4 → 0.84.0

package/dist/{site-extract-repository-Y5WQFSQW.js → site-extract-repository-3WC3VB5Y.js}

@@ -30,9 +30,9 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-HGJJQY24.js";
+} from "./chunk-ZB55UMMF.js";
 import "./chunk-DNM65UCK.js";
-import "./chunk-4NZ6JFK5.js";
+import "./chunk-UM7DCY6W.js";
 import "./chunk-YXNDOQXN.js";
 export {
   XRAY_ENTITLED_EXTRACT_BILLING_CLASS,

package/dist/{worker-FM3ZRDY4.js → worker-VTFGHWZL.js}

@@ -17,7 +17,7 @@ import {
 import {
   MC_COSTS,
   serpActualCostMc
-} from "./chunk-4NZ6JFK5.js";
+} from "./chunk-UM7DCY6W.js";
 import {
   browserServiceApiKey
 } from "./chunk-OM7HVEJ3.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scraper",
-  "version": "0.83.4",
+  "version": "0.84.0",
   "description": "MCP server for MCP Scraper web intelligence tools",
   "type": "module",
   "main": "./dist/index.cjs",

package/public/.well-known/xray-install.json

@@ -1,6 +1,6 @@
 {
   "schema": "https://mcpscraper.dev/schemas/xray-install-contract-v1.json",
-  "protocolVersion": "2.0.0",
+  "protocolVersion": "2.1.0",
   "product": "Thorbit X-Ray",
   "triggerPhrases": [
     "Install X-Ray",
@@ -13,11 +13,13 @@
   },
   "facade": {
     "tool": "analytics_setup_site",
+    "saasRevenueTool": "analytics_setup_revenue_source",
     "initialCall": {
       "startUrl": "<site URL>",
       "goal": "Install X-Ray and tell me what drives customers"
     },
-    "continuationRule": "Treat setupId plus revision as the durable continuation handle. Reuse both after approval, runtime publication, verification, retry, or return."
+    "continuationRule": "Treat setupId plus revision as the durable continuation handle. Reuse both after approval, runtime publication, verification, retry, or return.",
+    "saasContinuationRule": "When the Site setup reaches outcome_connection_required for SaaS, continue through analytics_setup_revenue_source with an already-authorized connection reference. Never request or accept provider credentials."
   },
   "topologies": {
     "local_stdio": {
@@ -151,6 +153,10 @@
     "Infer the business model and customer outcome, then propose one privacy-safe measurement plan.",
     "If the Pixel is absent, return the canonical one-time tag and exact uncovered surfaces; do not claim ongoing control there.",
     "Publish an approved measurement revision as a digest-bound runtime manifest; source or repository access is not required.",
+    "For SaaS, continue outcome readiness through analytics_setup_revenue_source: prepare an authorized connection, apply one exact revision, and verify a non-customer provider receipt.",
+    "Optionally publish a structured post-purchase survey after approved disclosure evidence; reported influence remains separate from deterministic touches.",
+    "Compare observed attribution with customer-reported influence only with explicit weights totaling 1,000,000 micros and a named methodology version.",
+    "Keep view-through reporting unavailable until event-level provider evidence can join to an eligible X-Ray subject; aggregate impressions never qualify.",
     "Verify route coverage, consent, PageViews, manifest convergence, bounded rule matches, and persisted definition/version evidence.",
     "Require a separate exact-revision approval before any canary or real-visitor experiment activation.",
     "Return first customer-journey answers when sufficient, or exact evidence-readiness thresholds when not.",
@@ -162,7 +168,9 @@
     "Never call ad platforms directly or silently activate events, definitions, funnels, or delivery destinations.",
     "Never treat a CTA click as a customer, sale, or revenue event without verified outcome evidence.",
     "Never claim full-domain installation while an in-scope route or renderer is missing, excluded without approval, or unverifiable.",
-    "Never treat event-name presence as verification; require persisted definition ID and version evidence."
+    "Never treat event-name presence as verification; require persisted definition ID and version evidence.",
+    "Never accept payment-provider credentials, survey invitation tokens, or exchange codes through MCP inputs or prompts.",
+    "Never treat customer-reported influence as identity, CRM mutation authority, ad-activation evidence, or a deterministic touch."
   ],
   "terminalStates": [
     "complete",
@@ -174,5 +182,5 @@
     "not_ready",
     "error"
   ],
-  "protocolDigest": "sha256:8f2f59ecfa074c1b9a1aba042c43b1de7cd18ebb2354e1911ad8c8e4a936ea3e"
+  "protocolDigest": "sha256:92039babc806f6f552d2b2a8ec4780cb50edfcc12bf39da9d70a9155a9b9c791"
 }

package/public/agent-install.md

@@ -1,7 +1,7 @@
 # Install Thorbit X-Ray
 
-Protocol version: 2.0.0
-Protocol digest: sha256:8f2f59ecfa074c1b9a1aba042c43b1de7cd18ebb2354e1911ad8c8e4a936ea3e
+Protocol version: 2.1.0
+Protocol digest: sha256:92039babc806f6f552d2b2a8ec4780cb50edfcc12bf39da9d70a9155a9b9c791
 
 Say **“Install X-Ray”** or **“Install X-Ray on this site and tell me what drives customers.”**
 
@@ -177,11 +177,19 @@ Rollback: Disconnect MCP Scraper from the host. Pixel removal remains an owner-c
 1. Infer the business model and customer outcome, then propose one privacy-safe measurement plan.
 1. If the Pixel is absent, return the canonical one-time tag and exact uncovered surfaces; do not claim ongoing control there.
 1. Publish an approved measurement revision as a digest-bound runtime manifest; source or repository access is not required.
+1. For SaaS, continue outcome readiness through analytics_setup_revenue_source: prepare an authorized connection, apply one exact revision, and verify a non-customer provider receipt.
+1. Optionally publish a structured post-purchase survey after approved disclosure evidence; reported influence remains separate from deterministic touches.
+1. Compare observed attribution with customer-reported influence only with explicit weights totaling 1,000,000 micros and a named methodology version.
+1. Keep view-through reporting unavailable until event-level provider evidence can join to an eligible X-Ray subject; aggregate impressions never qualify.
 1. Verify route coverage, consent, PageViews, manifest convergence, bounded rule matches, and persisted definition/version evidence.
 1. Require a separate exact-revision approval before any canary or real-visitor experiment activation.
 1. Return first customer-journey answers when sufficient, or exact evidence-readiness thresholds when not.
 1. On “improve”, propose one highest-value uncovered outcome, require approval when needed, and reverify.
 
+## SaaS revenue continuation
+
+After tag and measurement readiness reaches `outcome_connection_required`, call `analytics_setup_revenue_source`. When the Site setup reaches outcome_connection_required for SaaS, continue through analytics_setup_revenue_source with an already-authorized connection reference. Never request or accept provider credentials.
+
 ## Safety contract
 
 - Never invent or hand-author tracking code; use the canonical product-authored Pixel snippet returned by analytics_setup_site.
@@ -190,5 +198,7 @@ Rollback: Disconnect MCP Scraper from the host. Pixel removal remains an owner-c
 - Never treat a CTA click as a customer, sale, or revenue event without verified outcome evidence.
 - Never claim full-domain installation while an in-scope route or renderer is missing, excluded without approval, or unverifiable.
 - Never treat event-name presence as verification; require persisted definition ID and version evidence.
+- Never accept payment-provider credentials, survey invitation tokens, or exchange codes through MCP inputs or prompts.
+- Never treat customer-reported influence as identity, CRM mutation authority, ad-activation evidence, or a deterministic touch.
 
 Machine-readable contract: https://mcpscraper.dev/.well-known/xray-install.json