@pinepaper.studio/mcp-server 1.6.11 → 1.6.13

package/dist/tools/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/tools/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAA6B,MAAM,oCAAoC,CAAC;AAgJ/F,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAG3B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,YAAY,EAA0C,MAAM,uBAAuB,CAAC;AAgC7F;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAOlD;AAaD,eAAO,MAAM,mBAAmB,aAAgD,CAAC;AAqDjF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBpG;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvD;AAsLD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAOhD;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C,oEAAoE;IACpE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sEAAsE;IACtE,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAsGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc,CAwBhB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC,CA4NzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAS1D;AAMD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACtC,MAAM,CASR;AAkFD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkBzB"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/tools/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAA6B,MAAM,oCAAoC,CAAC;AAgJ/F,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAG3B,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,YAAY,EAA0C,MAAM,uBAAuB,CAAC;AAgC7F;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAOlD;AAaD,eAAO,MAAM,mBAAmB,aAAgD,CAAC;AA6EjF,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBnG;AAoCD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BpG;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvD;AAsLD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAOhD;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C,oEAAoE;IACpE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sEAAsE;IACtE,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AA8HD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,OAAO,EACpB,OAAO,CAAC,EAAE,YAAY,GACrB,cAAc,CAoChB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,MAAM;AAChB;;;;GAIG;AACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,cAAc,CAAC,CA4NzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAS1D;AAMD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACtC,MAAM,CASR;AAkFD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkBzB"}

package/dist/tools/handlers.js

@@ -84,7 +84,13 @@ function getExportDir() {
 // minutes the schema allows is ~77 MB. Deliverable across the bridge, useless
 // pasted into a response.
 export const ALWAYS_SAVE_FORMATS = new Set(['mp4', 'webm', 'gif', 'pdf', 'wav']);
-const SAVE_THRESHOLD_BYTES = 500_000; // ~500KB base64 ≈ 375KB decoded
+// 500_000 was chosen against the bridge's limits, not the CALLER's. A pilot
+// session hit a 263K-character end_job result — comfortably under this, so it
+// was returned inline, and over the tool-result limit of the client reading
+// it, so the agent could not read its own verification step. A value that
+// lets a result through to be rejected downstream is the wrong value; saving
+// to a file and naming the path costs one line of text and always works.
+const SAVE_THRESHOLD_BYTES = 180_000; // ~180KB base64 ≈ 135KB decoded
 /**
  * Governor budget for the export run itself.
  *
@@ -131,10 +137,82 @@ const IMAGE_MIME = {
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif',
     '.webp': 'image/webp', '.svg': 'image/svg+xml', '.bmp': 'image/bmp', '.avif': 'image/avif',
 };
+/**
+ * THE PAGE CANNOT FETCH A THIRD-PARTY IMAGE. THIS PROCESS CAN.
+ *
+ * pinepaper.studio serves `connect-src 'self' https://cloud.pinepaper.studio`,
+ * so an in-page fetch() of ANY other host fails outright. `img-src` still
+ * allows https:, which is why the old path could LOAD a remote image — and
+ * tainted the canvas doing it, killing every later export. The taint fix
+ * replaced that load with a fetch, which is safe and, under this CSP, can
+ * never succeed: import by URL stopped being broken-and-dangerous and became
+ * simply impossible.
+ *
+ * Node has no CSP. Fetching here and handing the page a data: URL is the only
+ * shape that both works and cannot taint, so a URL is resolved BEFORE it
+ * reaches the browser. Verified end to end by the session that found it: a
+ * 157KB data: URL imports and exports cleanly.
+ */
+const MAX_REMOTE_IMAGE_BYTES = 32 * 1024 * 1024;
+export async function fetchImageAsDataUrl(url) {
+    let res;
+    try {
+        res = await fetch(url, { redirect: 'follow' });
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : 'network request failed';
+        return { error: `could not reach ${url} — ${why}. This fetch runs in the MCP server, not the page, so it is not a CSP problem: check the host resolves and any proxy is reachable.` };
+    }
+    if (!res.ok) {
+        return { error: `the server refused ${url} — HTTP ${res.status} ${res.statusText || ''}`.trim() };
+    }
+    const type = (res.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+    if (!type.startsWith('image/')) {
+        return { error: `${url} served "${type || 'no content-type'}", not an image. A URL that returns an HTML page around the image will do this — link the file itself.` };
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length > MAX_REMOTE_IMAGE_BYTES) {
+        return { error: `${url} is ${(buf.length / 1024 / 1024).toFixed(1)} MB, above the ${MAX_REMOTE_IMAGE_BYTES / 1024 / 1024} MB import cap.` };
+    }
+    return { src: `data:${type};base64,${buf.toString('base64')}` };
+}
+/**
+ * Resolve an SVG to a string with every remote <image> already inlined.
+ *
+ * The emitted code does this in the page as a backstop, and under
+ * pinepaper.studio's CSP that backstop can only ever DROP images — the page
+ * may not fetch a third-party host. Doing it here means the page receives a
+ * document with no remote references at all: nothing to fetch, nothing to
+ * taint, and the pictures actually arrive.
+ *
+ * An href that cannot be fetched is still removed rather than left in, on the
+ * same reasoning as the in-page pass: a missing picture is visible and
+ * recoverable, a tainted canvas is neither.
+ */
+async function inlineSvgImages(svg) {
+    const warnings = [];
+    const hrefs = [...new Set([...svg.matchAll(/(?:xlink:)?href\s*=\s*("|')(https?:\/\/[^"']+)\1/gi)].map((m) => m[2]))];
+    let out = svg;
+    for (const href of hrefs) {
+        const got = await fetchImageAsDataUrl(href);
+        if ('src' in got) {
+            out = out.split(href).join(got.src);
+            continue;
+        }
+        const esc = href.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        out = out
+            .replace(new RegExp(`<image\\b[^>]*${esc}[^>]*\\/?>`, 'gi'), '')
+            .replace(new RegExp(`<image\\b[^>]*${esc}[\\s\\S]*?<\\/image>`, 'gi'), '');
+        warnings.push({ url: href, action: 'removed', reason: 'unfetchable', message: got.error });
+    }
+    return { svg: out, warnings };
+}
 export async function resolveImageSource(input) {
     const raw = input.trim();
-    if (/^(https?:|data:)/i.test(raw))
+    if (/^data:/i.test(raw))
         return { src: raw };
+    if (/^https?:/i.test(raw))
+        return fetchImageAsDataUrl(raw);
     const path = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
     const ext = extname(path).toLowerCase();
     if (!IMAGE_EXTENSIONS.has(ext)) {
@@ -416,7 +494,44 @@ function screenshotResult(screenshot) {
         ],
     };
 }
-export function errorResult(code, message, details, context) {
+/**
+ * Swap a `code` field carrying the emitted script for a description of it.
+ *
+ * Only a long string is touched: a short `code` is usually a status or an
+ * error code, not a program, and stripping those would take information away.
+ */
+function redactGeneratedCode(details) {
+    if (process.env.PINEPAPER_ECHO_CODE === '1')
+        return details;
+    if (!details || typeof details !== 'object' || Array.isArray(details))
+        return details;
+    const d = details;
+    const script = d.code;
+    if (typeof script !== 'string' || script.length < 400)
+        return details;
+    const { code: _dropped, ...rest } = d;
+    return {
+        ...rest,
+        generatedCode: {
+            bytes: script.length,
+            lines: script.split('\n').length,
+            firstLine: script.split('\n').find((l) => l.trim()) ?? '',
+            hint: 'omitted — set PINEPAPER_ECHO_CODE=1 to return the generated script with the error',
+        },
+    };
+}
+export function errorResult(code, message, rawDetails, context) {
+    // THE GENERATED SCRIPT IS NOT THE ERROR.
+    //
+    // Most error paths pass the emitted code in `details` as evidence, and for a
+    // long script that is ~12KB of JavaScript in front of a one-line failure —
+    // measured from a pilot session. An agent reading the result pays for all of
+    // it and learns nothing the message does not already say, and on a big
+    // export it can crowd out the result entirely.
+    //
+    // Replaced with its shape and a way to get it back. PINEPAPER_ECHO_CODE=1
+    // returns the script in full, the same switch that governs it on success.
+    const details = redactGeneratedCode(rawDetails);
     // Build error object
     const errorObj = {
         success: false,
@@ -470,7 +585,13 @@ function handleValidationError(error, i18n) {
  *
  * Default is 'on_request' for optimal performance per best practices.
  */
-export async function executeOrGenerate(code, description, options, toolName) {
+export async function executeOrGenerate(code, description, options, toolName, 
+/**
+ * Values too large to live inside the generated code. Written to
+ * window.__ppStage before the run and read back by key — see
+ * ExecuteCodeOptions.stage for why inlining them breaks the governor.
+ */
+stage) {
     const { executeInBrowser, browserController, screenshotMode, executionMode } = options;
     const effectiveExecutionMode = executionMode ?? getExecutionMode();
     const effectiveScreenshotMode = screenshotMode ?? getScreenshotMode();
@@ -604,7 +725,7 @@ ${code}
     if (shouldTakeScreenshot) {
         tracker.startTimer(`${timerId}_screenshot`);
     }
-    const result = await controller.executeCode(code, shouldTakeScreenshot);
+    const result = await controller.executeCode(code, shouldTakeScreenshot, stage ? { stage } : {});
     const browserDuration = tracker.endTimer(`${timerId}_browser_execution`);
     tracker.recordMetric({
         toolName,
@@ -963,6 +1084,11 @@ async function handleToolCallInner(toolName, args, options, tracker, baseTimerId
             }
             case 'pinepaper_query_capabilities': {
                 const input = QueryCapabilitiesInputSchema.parse(args);
+                // `query` is what callers reach for on an action named 'find'; `key`
+                // is what the emitter reads. Accepted as an alias rather than left as
+                // a validation dead end.
+                if (!input.key && input.query)
+                    input.key = input.query;
                 const code = codeGenerator.generateQueryCapabilities(input);
                 return executeOrGenerate(code, `Capabilities: ${input.action || 'list'}`, options, 'pinepaper_query_capabilities');
             }
@@ -1148,7 +1274,12 @@ async function handleToolCallInner(toolName, args, options, tracker, baseTimerId
                 return executeOrGenerate(code, `Media: ${input.action}`, options, 'pinepaper_media');
             }
             case 'pinepaper_text_style': {
+                // 'list' is an alias for 'list_styles'. pinepaper_text_effect spells
+                // the same action 'list', so an agent moving between the two guesses
+                // wrong — and a rejected enum value is a dead end rather than a hint.
                 const input = TextStyleInputSchema.parse(args);
+                if (input.action === 'list')
+                    input.action = 'list_styles';
                 const code = codeGenerator.generateTextStyle(input);
                 return executeOrGenerate(code, `Text style: ${input.action}`, options, 'pinepaper_text_style');
             }
@@ -1468,8 +1599,39 @@ You can now start creating new items on a clean canvas.`,
             // -----------------------------------------------------------------------
             case 'pinepaper_import_svg': {
                 const input = ImportSVGInputSchema.parse(args);
-                const code = codeGenerator.generateImportSVG(input.svgString, input.url, input.position, input.scale, input.source);
-                const description = 'Imports SVG onto the canvas';
+                // Resolve the document HERE, so the page never has to fetch anything.
+                //
+                // Under pinepaper.studio's CSP (connect-src 'self' + the cloud origin)
+                // the page cannot fetch a third-party host at all, so the in-page
+                // inlining could only ever DROP remote images. Fetching the SVG and
+                // its images in this process means the browser receives a document
+                // with no remote references: nothing to fetch, nothing to taint, and
+                // the pictures arrive. The in-page pass stays as a backstop for an
+                // svgString handed straight to the generator elsewhere.
+                let svgText = input.svgString;
+                let svgWarnings = [];
+                if (input.url) {
+                    try {
+                        const res = await fetch(input.url, { redirect: 'follow' });
+                        if (!res.ok) {
+                            return errorResult(ErrorCodes.EXECUTION_ERROR, `the server refused ${input.url} — HTTP ${res.status} ${res.statusText || ''}`.trim());
+                        }
+                        svgText = await res.text();
+                    }
+                    catch (e) {
+                        const why = e instanceof Error ? e.message : 'network request failed';
+                        return errorResult(ErrorCodes.EXECUTION_ERROR, `could not reach ${input.url} — ${why}. This fetch runs in the MCP server rather than the page, so it is not a CSP problem.`);
+                    }
+                }
+                if (svgText && /(?:xlink:)?href\s*=\s*["']https?:/i.test(svgText)) {
+                    const inlined = await inlineSvgImages(svgText);
+                    svgText = inlined.svg;
+                    svgWarnings = inlined.warnings;
+                }
+                const code = codeGenerator.generateImportSVG(svgText, svgText ? undefined : input.url, input.position, input.scale, input.source);
+                const description = svgWarnings.length
+                    ? `Imports SVG onto the canvas (${svgWarnings.length} unreachable image(s) removed)`
+                    : 'Imports SVG onto the canvas';
                 return executeOrGenerate(code, description, options, 'pinepaper_import_svg');
             }
             case 'pinepaper_import_mermaid': {
@@ -1987,9 +2149,34 @@ You can now start creating new items on a clean canvas.`,
                         metadata = result.metadata;
                     }
                     else if (input.url) {
-                        // For URL imports, we'd need to fetch the SVG
-                        // For now, delegate to pinepaper_import_svg
-                        return errorResult(ErrorCodes.INVALID_PARAMS, 'URL imports not yet implemented - use pinepaper_import_svg with url parameter instead', { url: input.url });
+                        // IMPLEMENTED NOW, rather than redirected.
+                        //
+                        // This used to refuse with "URL imports not yet implemented" while
+                        // the agent guide documented the url parameter — the redirect
+                        // named a working alternative, which made it a good refusal, but
+                        // it was still a documented parameter that did nothing. The reason
+                        // it could not be done here was that fetching belonged to the
+                        // page; it does not any more, because the page cannot fetch a
+                        // third-party host under the studio's CSP and this process can.
+                        let res;
+                        try {
+                            res = await fetch(input.url, { redirect: 'follow' });
+                        }
+                        catch (e) {
+                            const why = e instanceof Error ? e.message : 'network request failed';
+                            return errorResult(ErrorCodes.EXECUTION_ERROR, `could not reach ${input.url} — ${why}. This fetch runs in the MCP server rather than the page, so it is not a CSP problem.`);
+                        }
+                        if (!res.ok) {
+                            return errorResult(ErrorCodes.EXECUTION_ERROR, `the server refused ${input.url} — HTTP ${res.status} ${res.statusText || ''}`.trim());
+                        }
+                        const body = await res.text();
+                        if (!/<svg[\s>]/i.test(body)) {
+                            const type = (res.headers.get('content-type') ?? '').split(';')[0].trim();
+                            return errorResult(ErrorCodes.INVALID_PARAMS, `${input.url} served "${type || 'no content-type'}" and its body is not SVG. `
+                                + 'For a raster image use pinepaper_import_image, which accepts a url and inlines it.');
+                        }
+                        svg = body;
+                        metadata = { source: 'url', url: input.url };
                     }
                     // Import the SVG onto canvas using existing import_svg tool
                     const code = codeGenerator.generateImportSVG(svg, undefined, input.position, input.scale);
@@ -2131,7 +2318,12 @@ You can now start creating new items on a clean canvas.`,
                         const previewScreenshot = await endJobController.takeScreenshot();
                         const content = [{
                                 type: 'text',
-                                text: `Executed PinePaper code:\n\n\`\`\`javascript\n${code}\n\`\`\`\n\nFull screenshot saved to: ${filePath} (${(fileSize / 1024).toFixed(1)} KB)\n\nResult: ${JSON.stringify(cleanResult, null, 2)}`,
+                                // The script is not part of the answer here either — same reason
+                                // errors no longer carry it. PINEPAPER_ECHO_CODE=1 brings it back.
+                                text: (process.env.PINEPAPER_ECHO_CODE === '1'
+                                    ? `Executed PinePaper code:\n\n\`\`\`javascript\n${code}\n\`\`\`\n\n`
+                                    : '')
+                                    + `Full screenshot saved to: ${filePath} (${(fileSize / 1024).toFixed(1)} KB)\n\nResult: ${JSON.stringify(cleanResult, null, 2)}`,
                             }];
                         if (previewScreenshot) {
                             content.push({
@@ -2638,8 +2830,22 @@ You can now start creating new items on a clean canvas.`,
                 if ('error' in resolved) {
                     return errorResult(ErrorCodes.INVALID_PARAMS, resolved.error, { url: parsed.url }, { toolName: 'pinepaper_import_image' });
                 }
-                const code = codeGenerator.generateImportImage({ ...parsed, url: resolved.src });
-                return executeOrGenerate(code, 'Imports image', options, 'pinepaper_import_image');
+                // THE BYTES GO BESIDE THE CODE, NOT INSIDE IT.
+                //
+                // Inlining the data: URL turned a 3000x800 photo into ~630KB of
+                // generated JavaScript. app.runGenerated rewrites what it runs, and its
+                // loop-guard transform bails at that size — "Loop-guard transform
+                // bailed (unusual syntax)" — after which the run reported
+                // itemsCreated: 0 and lost the return value, so the import answered
+                // success with no itemId. Smaller photos were fine, which is exactly
+                // what made it look like a registration bug rather than a size one.
+                const staged = resolved.src.startsWith('data:') && resolved.src.length > 64_000;
+                const stageKey = staged ? `img_${Date.now().toString(36)}` : undefined;
+                const code = codeGenerator.generateImportImage({
+                    ...parsed,
+                    url: staged ? `__ppStage:${stageKey}` : resolved.src,
+                });
+                return executeOrGenerate(code, 'Imports image', options, 'pinepaper_import_image', staged ? { [stageKey]: resolved.src } : undefined);
             }
             // -----------------------------------------------------------------------
             // ONTOLOGY TOOLS — extracted to src/tools/handlers/ontology.ts