mcp-scraper 0.83.5 → 0.85.0

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.85.0] - 2026-09-01
+
+### Changed
+
+- Corrected X-Ray's public contract to a provider-neutral measurement foundation: the Pixel, seven observed attribution models, structured post-purchase surveys, explicit Observed + Reported impact, privacy lifecycle, and truthful unavailable view-evidence states remain supported.
+- Advanced the X-Ray install protocol to 3.0.0 and removed provider authorization and revenue-source continuations from generated install guidance.
+
+### Removed
+
+- Removed the four revenue-source setup MCP tools, five REST operations, revenue-setup ResourceTemplate, Stripe dashboard workflow, and deployable Stripe, Salesforce, and Pipedrive Nango registrations until each provider has complete production receipts.
+
+### Fixed
+
+- Routed the public X-Ray product page and nested attribution and SaaS guides through the canonical `mcpscraper.dev` host instead of leaving the successfully deployed web routes unreachable behind the API project.
+
+## [0.84.0] - 2026-09-01
+
+### Added
+
+- Added authoritative SaaS revenue connections with one primary source per outcome family, canonical outcome keys, replay-safe reconciliation, value restatements, and observation-only comparison sources that cannot create duplicate revenue.
+- Added versioned post-purchase surveys and an opt-in Observed + Reported impact report that keeps customer answers separate from deterministic touches, requires explicit weights, and conserves attribution credit and revenue per currency.
+- Added ten operation-specific X-Ray MCP tools plus methodology and revenue-setup Resources for revenue setup, survey lifecycle, impact reporting, and provider-backed view availability.
+- Added a governed Stripe subscription connector for account readiness and bounded outcome reconciliation; credentials continue to move through the authorized connection flow rather than tool input.
+
+### Changed
+
+- Expanded SaaS setup into one evidence-derived sequence covering the global tag, advertising, lifecycle channels, revenue authority, calls and demos, currency and timezone, consent, and a server-confirmed outcome test.
+- View-through attribution now reports unavailable or unproven unless an eligible event-level provider receipt can join to a consented subject; aggregate impression reports remain comparison evidence only.
+- Advanced the X-Ray install protocol to 2.1.0 and expanded the generated analytics REST contract to cover revenue, surveys, methodology, reported impact, and view-evidence status.
+
+### Security
+
+- Added privacy lifecycle coverage for revenue authorities, provider customer bindings, immutable outcome versions, survey invitations and answers, reported influences, and provider-view receipts.
+- Survey delivery uses opaque single-use invitations, a server-issued session cookie, strict origin controls, bounded structured answers, and no contact fields, free text, raw invitation tokens, or provider credentials in analytics records.
+
+### Migration
+
+- Advance the analytics schema before enabling SaaS revenue authorities or post-purchase surveys. Survey publication remains gated until approved disclosure copy is configured, and provider-backed view reporting remains unavailable until lawful event-level evidence is proven.
+
 ## [0.83.5] - 2026-09-01
 
 ### Fixed
@@ -1612,7 +1651,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.3...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.84.0...HEAD
+[0.84.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.5...v0.84.0
 [0.83.5]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.4...v0.83.5
 [0.83.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.3...v0.83.4
 [0.83.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.2...v0.83.3

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.83.5`, SHA-256 `ab7a2b9e1fb1d2020e7eeda5ef010279ce6a74effdb7399aff2f748c3ac06022`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.85.0`, SHA-256 `2410fb6216af649dba24e62df9fa438b85e02c5ed2d3610f9e630314c0a0c2fb`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -337,7 +337,7 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 363 tools: 262 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 101 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, attribution, CRM policy and receipt, campaign, export, and scheduled-report tools. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 369 tools: 268 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 101 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
 

package/dist/{analytics-repository-GA6P5S5J.js → analytics-repository-4VZQ4TKW.js}

@@ -18,6 +18,7 @@ import {
   analyticsOverview,
   analyticsPaths,
   analyticsTimeseries,
+  appendAnalyticsAuthoritativeOutcomeVersion,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
   backfillAnalyticsConfirmedHistory,
@@ -26,6 +27,7 @@ import {
   closeAnalyticsPool,
   completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
+  consumeAnalyticsSurveyInvite,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
   createAnalyticsConversion,
@@ -44,6 +46,7 @@ import {
   getPublicAnalyticsForm,
   identityHmac,
   ingestAnalyticsEvents,
+  insertAnalyticsRevenueSetupRevision,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   linkAnalyticsIdentityInTransaction,
@@ -63,6 +66,7 @@ import {
   normalizeObservedHostname,
   pollAnalyticsActivationDiagnostics,
   prepareAnalyticsLinkerIssue,
+  projectAnalyticsAuthoritativeConversion,
   projectAnalyticsPixelEventConsent,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,
@@ -85,7 +89,7 @@ import {
   updateAnalyticsPixel,
   upsertAnalyticsAdSpend,
   upsertAnalyticsHostGroup
-} from "./chunk-CNAJWRJT.js";
+} from "./chunk-TLRJV4SL.js";
 import "./chunk-C5Z4OFKW.js";
 import "./chunk-YXNDOQXN.js";
 export {
@@ -108,6 +112,7 @@ export {
   analyticsOverview,
   analyticsPaths,
   analyticsTimeseries,
+  appendAnalyticsAuthoritativeOutcomeVersion,
   archiveAnalyticsActivationDestination,
   archiveAnalyticsCampaignLink,
   backfillAnalyticsConfirmedHistory,
@@ -116,6 +121,7 @@ export {
   closeAnalyticsPool,
   completeAnalyticsCrmImportRow,
   completeAnalyticsFormDelivery,
+  consumeAnalyticsSurveyInvite,
   createAnalyticsActivationDestination,
   createAnalyticsCampaignLink,
   createAnalyticsConversion,
@@ -134,6 +140,7 @@ export {
   getPublicAnalyticsForm,
   identityHmac,
   ingestAnalyticsEvents,
+  insertAnalyticsRevenueSetupRevision,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   linkAnalyticsIdentityInTransaction,
@@ -153,6 +160,7 @@ export {
   normalizeObservedHostname,
   pollAnalyticsActivationDiagnostics,
   prepareAnalyticsLinkerIssue,
+  projectAnalyticsAuthoritativeConversion,
   projectAnalyticsPixelEventConsent,
   queueAnalyticsActivation,
   queueAnalyticsFormDelivery,

package/dist/bin/api-server.js

@@ -17,8 +17,8 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app, personalAssistantProductionStartup }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-2E4YF6TY.js"),
-    import("../worker-FM3ZRDY4.js"),
+    import("../server-EOPETL7Q.js"),
+    import("../worker-5A375BGN.js"),
     import("../db-Z34LPZNR.js")
   ]);
   const PORT = parseInt(process.env.PORT ?? "3001");
@@ -26,7 +26,7 @@ async function main() {
     await personalAssistantProductionStartup;
     await migrate();
     if (process.env.ANALYTICS_DATABASE_URL) {
-      const { migrateAnalytics } = await import("../analytics-repository-GA6P5S5J.js");
+      const { migrateAnalytics } = await import("../analytics-repository-4VZQ4TKW.js");
       await migrateAnalytics();
     }
     startWorker();

package/dist/bin/mcp-scraper-cli.js

@@ -6,7 +6,7 @@ import {
   openWorkflowReport,
   runWorkflow,
   workflowOutputBaseDir
-} from "../chunk-ACDNW7TG.js";
+} from "../chunk-6IOGTFNS.js";
 import "../chunk-RJ7JVYKU.js";
 import "../chunk-OWF2JJKN.js";
 import {
@@ -15,11 +15,11 @@ import {
   XRAY_INSTALL_PROTOCOL_VERSION,
   renderXraySetupPrompt,
   xrayHostRecipe
-} from "../chunk-BGD7U3AE.js";
+} from "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-2B636U7P.js";
+} from "../chunk-RHAOKXQK.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-core.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-VJHMPJR7.js";
-import "../chunk-2BOBOKFQ.js";
+} from "../chunk-2ZDYUTOZ.js";
+import "../chunk-W4IY6CB4.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-4NZ6JFK5.js";
+import "../chunk-X5HRAAQM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UXVT7FWW.js";
-import "../chunk-BGD7U3AE.js";
+import "../chunk-WN7N4ESQ.js";
+import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-2B636U7P.js";
+import "../chunk-RHAOKXQK.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/mcp/thorbit-restricted-tool-surface.ts

package/dist/bin/mcp-scraper-install.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   renderInstallTerminal
-} from "../chunk-UXVT7FWW.js";
+} from "../chunk-WN7N4ESQ.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-2B636U7P.js";
+} from "../chunk-RHAOKXQK.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-VJHMPJR7.js";
-import "../chunk-2BOBOKFQ.js";
+} from "../chunk-2ZDYUTOZ.js";
+import "../chunk-W4IY6CB4.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-4NZ6JFK5.js";
+import "../chunk-X5HRAAQM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UXVT7FWW.js";
-import "../chunk-BGD7U3AE.js";
+import "../chunk-WN7N4ESQ.js";
+import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-2B636U7P.js";
+import "../chunk-RHAOKXQK.js";
 import "../chunk-YXNDOQXN.js";
 
 // bin/mcp-stdio-server.ts

package/dist/{chunk-VJHMPJR7.js → chunk-2ZDYUTOZ.js}

@@ -12,13 +12,13 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "./chunk-2BOBOKFQ.js";
+} from "./chunk-W4IY6CB4.js";
 import {
   renderInstallTerminal
-} from "./chunk-UXVT7FWW.js";
+} from "./chunk-WN7N4ESQ.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-2B636U7P.js";
+} from "./chunk-RHAOKXQK.js";
 
 // src/mcp/stdio-runtime.ts
 import { readFileSync } from "fs";

package/dist/{chunk-ACDNW7TG.js → chunk-6IOGTFNS.js}

@@ -11,7 +11,7 @@ import {
   extractContactEvidence,
   extractSerpEmailEvidence,
   selectPrimaryEmail
-} from "./chunk-BGD7U3AE.js";
+} from "./chunk-P7FWOMU7.js";
 
 // src/lib/slugify.ts
 function slugify(s) {

package/dist/{chunk-HGJJQY24.js → chunk-C7OKENCR.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-DNM65UCK.js";
 import {
   LedgerOperation
-} from "./chunk-4NZ6JFK5.js";
+} from "./chunk-X5HRAAQM.js";
 import {
   CREDIT_LOT_TTL,
   getDb,

package/dist/{chunk-BGD7U3AE.js → chunk-P7FWOMU7.js}

@@ -147,7 +147,7 @@ function extractContactEvidence(html, pageUrl) {
 
 // src/mcp/xray-install-contract.ts
 import { createHash } from "crypto";
-var XRAY_INSTALL_PROTOCOL_VERSION = "2.0.0";
+var XRAY_INSTALL_PROTOCOL_VERSION = "3.0.0";
 var XRAY_SETUP_TOOL = "analytics_setup_site";
 var XRAY_TRIGGER_PHRASE = "Install X-Ray";
 var XRAY_CANONICAL_GOAL = "Install X-Ray and tell me what drives customers";
@@ -291,6 +291,10 @@ var XRAY_INSTALL_CONTRACT_PAYLOAD = {
     "Infer the business model and customer outcome, then propose one privacy-safe measurement plan.",
     "If the Pixel is absent, return the canonical one-time tag and exact uncovered surfaces; do not claim ongoing control there.",
     "Publish an approved measurement revision as a digest-bound runtime manifest; source or repository access is not required.",
+    "For SaaS, verify the measurement foundation: global tag coverage, ad-source capture, lifecycle events, currency and timezone, consent, and observed outcome events.",
+    "Optionally publish a structured post-purchase survey after approved disclosure evidence; reported influence remains separate from deterministic touches.",
+    "Compare observed attribution with customer-reported influence only with explicit weights totaling 1,000,000 micros and a named methodology version.",
+    "Keep view-through reporting unavailable until event-level provider evidence can join to an eligible X-Ray subject; aggregate impressions never qualify.",
     "Verify route coverage, consent, PageViews, manifest convergence, bounded rule matches, and persisted definition/version evidence.",
     "Require a separate exact-revision approval before any canary or real-visitor experiment activation.",
     "Return first customer-journey answers when sufficient, or exact evidence-readiness thresholds when not.",
@@ -302,9 +306,11 @@ var XRAY_INSTALL_CONTRACT_PAYLOAD = {
     "Never call ad platforms directly or silently activate events, definitions, funnels, or delivery destinations.",
     "Never treat a CTA click as a customer, sale, or revenue event without verified outcome evidence.",
     "Never claim full-domain installation while an in-scope route or renderer is missing, excluded without approval, or unverifiable.",
-    "Never treat event-name presence as verification; require persisted definition ID and version evidence."
+    "Never treat event-name presence as verification; require persisted definition ID and version evidence.",
+    "Never accept survey invitation tokens or exchange codes through MCP inputs or prompts.",
+    "Never treat customer-reported influence as identity, CRM mutation authority, ad-activation evidence, or a deterministic touch."
   ],
-  terminalStates: ["complete", "tag_required", "input_required", "approval_required", "runtime_convergence_required", "outcome_connection_required", "not_ready", "error"]
+  terminalStates: ["complete", "tag_required", "input_required", "approval_required", "runtime_convergence_required", "not_ready", "error"]
 };
 function canonicalJson(value) {
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
@@ -334,7 +340,7 @@ function renderXraySetupPrompt() {
     "",
     `Use ${XRAY_SETUP_TOOL} as the single conversational setup facade. Ask for the target site URL if it is missing, then call it with the goal \u201C${XRAY_CANONICAL_GOAL}\u201D.`,
     "",
-    "Continue the same setup with its setupId and revision. Confirm one global Pixel across all public rendering surfaces; present one measurement plan; publish it as a digest-bound runtime manifest after exact-revision approval; verify manifest and rule versions; then return first customer-journey answers or explicit readiness thresholds. GitHub or repository access is not required after the tag is installed.",
+    "Continue the same setup with its setupId and revision. Confirm one global Pixel across all public rendering surfaces; present one measurement plan; publish it as a digest-bound runtime manifest after exact-revision approval; verify manifest and rule versions; then return first customer-journey answers or explicit readiness thresholds. For SaaS, verify the provider-neutral measurement foundation. Browser events never prove paid revenue. GitHub or repository access is not required after the tag is installed.",
     "",
     "Do not request pasted credentials, invent tracking code, silently activate measurement, call ad platforms directly, or claim customers/revenue from CTA clicks."
   ].join("\n");

package/dist/{chunk-2B636U7P.js → chunk-RHAOKXQK.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.83.5";
+var PACKAGE_VERSION = "0.85.0";
 
 export {
   PACKAGE_VERSION