mcp-scraper 0.83.5 → 0.84.0

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.84.0] - 2026-09-01
+
+### Added
+
+- Added authoritative SaaS revenue connections with one primary source per outcome family, canonical outcome keys, replay-safe reconciliation, value restatements, and observation-only comparison sources that cannot create duplicate revenue.
+- Added versioned post-purchase surveys and an opt-in Observed + Reported impact report that keeps customer answers separate from deterministic touches, requires explicit weights, and conserves attribution credit and revenue per currency.
+- Added ten operation-specific X-Ray MCP tools plus methodology and revenue-setup Resources for revenue setup, survey lifecycle, impact reporting, and provider-backed view availability.
+- Added a governed Stripe subscription connector for account readiness and bounded outcome reconciliation; credentials continue to move through the authorized connection flow rather than tool input.
+
+### Changed
+
+- Expanded SaaS setup into one evidence-derived sequence covering the global tag, advertising, lifecycle channels, revenue authority, calls and demos, currency and timezone, consent, and a server-confirmed outcome test.
+- View-through attribution now reports unavailable or unproven unless an eligible event-level provider receipt can join to a consented subject; aggregate impression reports remain comparison evidence only.
+- Advanced the X-Ray install protocol to 2.1.0 and expanded the generated analytics REST contract to cover revenue, surveys, methodology, reported impact, and view-evidence status.
+
+### Security
+
+- Added privacy lifecycle coverage for revenue authorities, provider customer bindings, immutable outcome versions, survey invitations and answers, reported influences, and provider-view receipts.
+- Survey delivery uses opaque single-use invitations, a server-issued session cookie, strict origin controls, bounded structured answers, and no contact fields, free text, raw invitation tokens, or provider credentials in analytics records.
+
+### Migration
+
+- Advance the analytics schema before enabling SaaS revenue authorities or post-purchase surveys. Survey publication remains gated until approved disclosure copy is configured, and provider-backed view reporting remains unavailable until lawful event-level evidence is proven.
+
 ## [0.83.5] - 2026-09-01
 
 ### Fixed
@@ -1612,7 +1636,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.3...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.84.0...HEAD
+[0.84.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.5...v0.84.0
 [0.83.5]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.4...v0.83.5
 [0.83.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.3...v0.83.4
 [0.83.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.2...v0.83.3

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.83.5`, SHA-256 `ab7a2b9e1fb1d2020e7eeda5ef010279ce6a74effdb7399aff2f748c3ac06022`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.84.0`, SHA-256 `488d73bb3e41439c6b3676a25850ab4e9b883c29986b59732474ac3bfd48f79b`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -337,7 +337,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 363 tools: 262 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 101 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, attribution, CRM policy and receipt, campaign, export, and scheduled-report tools. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 373 tools: 272 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 101 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, attribution, authoritative SaaS revenue, post-purchase surveys, reported impact, view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
 

package/dist/{analytics-repository-GA6P5S5J.js → analytics-repository-4VZQ4TKW.js}

@@ -18,6 +18,7 @@ import {
   analyticsOverview,
   analyticsPaths,
   analyticsTimeseries,
+  appendAnalyticsAuthoritativeOutcomeVersion,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
   backfillAnalyticsConfirmedHistory,
@@ -26,6 +27,7 @@ import {
   closeAnalyticsPool,
   completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
+  consumeAnalyticsSurveyInvite,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
   createAnalyticsConversion,
@@ -44,6 +46,7 @@ import {
   getPublicAnalyticsForm,
   identityHmac,
   ingestAnalyticsEvents,
+  insertAnalyticsRevenueSetupRevision,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   linkAnalyticsIdentityInTransaction,
@@ -63,6 +66,7 @@ import {
   normalizeObservedHostname,
   pollAnalyticsActivationDiagnostics,
   prepareAnalyticsLinkerIssue,
+  projectAnalyticsAuthoritativeConversion,
   projectAnalyticsPixelEventConsent,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,
@@ -85,7 +89,7 @@ import {
   updateAnalyticsPixel,
   upsertAnalyticsAdSpend,
   upsertAnalyticsHostGroup
-} from "./chunk-CNAJWRJT.js";
+} from "./chunk-TLRJV4SL.js";
 import "./chunk-C5Z4OFKW.js";
 import "./chunk-YXNDOQXN.js";
 export {
@@ -108,6 +112,7 @@ export {
   analyticsOverview,
   analyticsPaths,
   analyticsTimeseries,
+  appendAnalyticsAuthoritativeOutcomeVersion,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
   backfillAnalyticsConfirmedHistory,
@@ -116,6 +121,7 @@ export {
   closeAnalyticsPool,
   completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
+  consumeAnalyticsSurveyInvite,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
   createAnalyticsConversion,
@@ -134,6 +140,7 @@ export {
   getPublicAnalyticsForm,
   identityHmac,
   ingestAnalyticsEvents,
+  insertAnalyticsRevenueSetupRevision,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   linkAnalyticsIdentityInTransaction,
@@ -153,6 +160,7 @@ export {
   normalizeObservedHostname,
   pollAnalyticsActivationDiagnostics,
   prepareAnalyticsLinkerIssue,
+  projectAnalyticsAuthoritativeConversion,
   projectAnalyticsPixelEventConsent,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,

package/dist/bin/api-server.js

@@ -17,8 +17,8 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app, personalAssistantProductionStartup }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-2E4YF6TY.js"),
-    import("../worker-FM3ZRDY4.js"),
+    import("../server-3F3JMHBF.js"),
+    import("../worker-VTFGHWZL.js"),
     import("../db-Z34LPZNR.js")
   ]);
   const PORT = parseInt(process.env.PORT ?? "3001");
@@ -26,7 +26,7 @@ async function main() {
     await personalAssistantProductionStartup;
     await migrate();
     if (process.env.ANALYTICS_DATABASE_URL) {
-      const { migrateAnalytics } = await import("../analytics-repository-GA6P5S5J.js");
+      const { migrateAnalytics } = await import("../analytics-repository-4VZQ4TKW.js");
       await migrateAnalytics();
     }
     startWorker();

package/dist/bin/mcp-scraper-cli.js

@@ -6,7 +6,7 @@ import {
   openWorkflowReport,
   runWorkflow,
   workflowOutputBaseDir
-} from "../chunk-ACDNW7TG.js";
+} from "../chunk-LHIWX7RM.js";
 import "../chunk-RJ7JVYKU.js";
 import "../chunk-OWF2JJKN.js";
 import {
@@ -15,11 +15,11 @@ import {
   XRAY_INSTALL_PROTOCOL_VERSION,
   renderXraySetupPrompt,
   xrayHostRecipe
-} from "../chunk-BGD7U3AE.js";
+} from "../chunk-4S6HPHPB.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-2B636U7P.js";
+} from "../chunk-OUTE3755.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-core.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-VJHMPJR7.js";
-import "../chunk-2BOBOKFQ.js";
+} from "../chunk-WDWWCNMW.js";
+import "../chunk-U77X4NIR.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-4NZ6JFK5.js";
+import "../chunk-UM7DCY6W.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UXVT7FWW.js";
-import "../chunk-BGD7U3AE.js";
+import "../chunk-NLWBM55O.js";
+import "../chunk-4S6HPHPB.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-2B636U7P.js";
+import "../chunk-OUTE3755.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/mcp/thorbit-restricted-tool-surface.ts

package/dist/bin/mcp-scraper-install.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   renderInstallTerminal
-} from "../chunk-UXVT7FWW.js";
+} from "../chunk-NLWBM55O.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-2B636U7P.js";
+} from "../chunk-OUTE3755.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-VJHMPJR7.js";
-import "../chunk-2BOBOKFQ.js";
+} from "../chunk-WDWWCNMW.js";
+import "../chunk-U77X4NIR.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-4NZ6JFK5.js";
+import "../chunk-UM7DCY6W.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UXVT7FWW.js";
-import "../chunk-BGD7U3AE.js";
+import "../chunk-NLWBM55O.js";
+import "../chunk-4S6HPHPB.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-2B636U7P.js";
+import "../chunk-OUTE3755.js";
 import "../chunk-YXNDOQXN.js";
 
 // bin/mcp-stdio-server.ts

package/dist/{chunk-ZHPGPVJJ.js → chunk-4KFD2WXG.js}

@@ -19,7 +19,7 @@ import {
   LedgerOperation,
   MC_PER_CREDIT,
   calculateConnectedUsageCharge
-} from "./chunk-4NZ6JFK5.js";
+} from "./chunk-UM7DCY6W.js";
 import {
   recordVendorUsage,
   runWithCostContext

package/dist/{chunk-BGD7U3AE.js → chunk-4S6HPHPB.js}

@@ -147,8 +147,9 @@ function extractContactEvidence(html, pageUrl) {
 
 // src/mcp/xray-install-contract.ts
 import { createHash } from "crypto";
-var XRAY_INSTALL_PROTOCOL_VERSION = "2.0.0";
+var XRAY_INSTALL_PROTOCOL_VERSION = "2.1.0";
 var XRAY_SETUP_TOOL = "analytics_setup_site";
+var XRAY_REVENUE_SETUP_TOOL = "analytics_setup_revenue_source";
 var XRAY_TRIGGER_PHRASE = "Install X-Ray";
 var XRAY_CANONICAL_GOAL = "Install X-Ray and tell me what drives customers";
 var CONTINUATION = `Call ${XRAY_SETUP_TOOL} with { "startUrl": "<site URL>", "goal": "${XRAY_CANONICAL_GOAL}" }; on every later call, reuse the returned setupId and revision.`;
@@ -178,8 +179,10 @@ var XRAY_INSTALL_CONTRACT_PAYLOAD = {
   },
   facade: {
     tool: XRAY_SETUP_TOOL,
+    saasRevenueTool: XRAY_REVENUE_SETUP_TOOL,
     initialCall: { startUrl: "<site URL>", goal: XRAY_CANONICAL_GOAL },
-    continuationRule: "Treat setupId plus revision as the durable continuation handle. Reuse both after approval, runtime publication, verification, retry, or return."
+    continuationRule: "Treat setupId plus revision as the durable continuation handle. Reuse both after approval, runtime publication, verification, retry, or return.",
+    saasContinuationRule: `When the Site setup reaches outcome_connection_required for SaaS, continue through ${XRAY_REVENUE_SETUP_TOOL} with an already-authorized connection reference. Never request or accept provider credentials.`
   },
   topologies: {
     local_stdio: {
@@ -291,6 +294,10 @@ var XRAY_INSTALL_CONTRACT_PAYLOAD = {
     "Infer the business model and customer outcome, then propose one privacy-safe measurement plan.",
     "If the Pixel is absent, return the canonical one-time tag and exact uncovered surfaces; do not claim ongoing control there.",
     "Publish an approved measurement revision as a digest-bound runtime manifest; source or repository access is not required.",
+    `For SaaS, continue outcome readiness through ${XRAY_REVENUE_SETUP_TOOL}: prepare an authorized connection, apply one exact revision, and verify a non-customer provider receipt.`,
+    "Optionally publish a structured post-purchase survey after approved disclosure evidence; reported influence remains separate from deterministic touches.",
+    "Compare observed attribution with customer-reported influence only with explicit weights totaling 1,000,000 micros and a named methodology version.",
+    "Keep view-through reporting unavailable until event-level provider evidence can join to an eligible X-Ray subject; aggregate impressions never qualify.",
     "Verify route coverage, consent, PageViews, manifest convergence, bounded rule matches, and persisted definition/version evidence.",
     "Require a separate exact-revision approval before any canary or real-visitor experiment activation.",
     "Return first customer-journey answers when sufficient, or exact evidence-readiness thresholds when not.",
@@ -302,7 +309,9 @@ var XRAY_INSTALL_CONTRACT_PAYLOAD = {
     "Never call ad platforms directly or silently activate events, definitions, funnels, or delivery destinations.",
     "Never treat a CTA click as a customer, sale, or revenue event without verified outcome evidence.",
     "Never claim full-domain installation while an in-scope route or renderer is missing, excluded without approval, or unverifiable.",
-    "Never treat event-name presence as verification; require persisted definition ID and version evidence."
+    "Never treat event-name presence as verification; require persisted definition ID and version evidence.",
+    "Never accept payment-provider credentials, survey invitation tokens, or exchange codes through MCP inputs or prompts.",
+    "Never treat customer-reported influence as identity, CRM mutation authority, ad-activation evidence, or a deterministic touch."
   ],
   terminalStates: ["complete", "tag_required", "input_required", "approval_required", "runtime_convergence_required", "outcome_connection_required", "not_ready", "error"]
 };
@@ -334,7 +343,7 @@ function renderXraySetupPrompt() {
     "",
     `Use ${XRAY_SETUP_TOOL} as the single conversational setup facade. Ask for the target site URL if it is missing, then call it with the goal \u201C${XRAY_CANONICAL_GOAL}\u201D.`,
     "",
-    "Continue the same setup with its setupId and revision. Confirm one global Pixel across all public rendering surfaces; present one measurement plan; publish it as a digest-bound runtime manifest after exact-revision approval; verify manifest and rule versions; then return first customer-journey answers or explicit readiness thresholds. GitHub or repository access is not required after the tag is installed.",
+    `Continue the same setup with its setupId and revision. Confirm one global Pixel across all public rendering surfaces; present one measurement plan; publish it as a digest-bound runtime manifest after exact-revision approval; verify manifest and rule versions; then return first customer-journey answers or explicit readiness thresholds. For SaaS outcome readiness, continue through ${XRAY_REVENUE_SETUP_TOOL} with an already-authorized provider connection and verify a non-customer receipt. GitHub or repository access is not required after the tag is installed.`,
     "",
     "Do not request pasted credentials, invent tracking code, silently activate measurement, call ad platforms directly, or claim customers/revenue from CTA clicks."
   ].join("\n");

package/dist/{chunk-ACDNW7TG.js → chunk-LHIWX7RM.js}

@@ -11,7 +11,7 @@ import {
   extractContactEvidence,
   extractSerpEmailEvidence,
   selectPrimaryEmail
-} from "./chunk-BGD7U3AE.js";
+} from "./chunk-4S6HPHPB.js";
 
 // src/lib/slugify.ts
 function slugify(s) {

package/dist/{chunk-UXVT7FWW.js → chunk-NLWBM55O.js}

@@ -1,6 +1,6 @@
 // release-message.json
 var release_message_default = {
-  message: "Install X-Ray in one conversation: audit every public renderer, infer privacy-safe CTA semantics, keep durable setup revisions, and return verified zero-credit readiness and first-answer receipts."
+  message: "Connect authoritative subscription outcomes, keep customer-reported influence separate from observed attribution, and complete the evidence-governed SaaS setup through dashboard or MCP."
 };
 
 // src/install-terminal.ts
@@ -55,7 +55,7 @@ function renderInstallTerminal(options) {
     "1/1 install surfaces ready",
     colorize(`Newest in v${options.version}: ${release_message_default.message}`, "lime", color),
     "",
-    `${colorize("Tools", "cyan", color)}  ${colorize("(363 MCP tools)", "muted", color)}`,
+    `${colorize("Tools", "cyan", color)}  ${colorize("(373 MCP tools)", "muted", color)}`,
     toolRow("search", ["harvest_paa", "search_serp", "maps_search", "maps_place_intel"], color),
     toolRow("extract", ["extract_url", "map_site_urls", "extract_site", "audit_site", "directory_workflow"], color),
     toolRow("build", ["create_editorial_reading_room", "rank_tracker_workflow", "portable HTML"], color),

package/dist/{chunk-2B636U7P.js → chunk-OUTE3755.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.83.5";
+var PACKAGE_VERSION = "0.84.0";
 
 export {
   PACKAGE_VERSION