@productmaker/mcp 12.2.5 → 12.2.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +80 -14
- package/dist/http.js +2147 -1124
- package/dist/stdio.js +2150 -1129
- package/dist/ui/meta-upload-app.html +221 -80
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -216,6 +216,15 @@ its service-page editor, including its generation progress.
|
|
|
216
216
|
| `import_product_controls` | Add selected store products to financial control. They remain `no_costing` until their real costs are saved. |
|
|
217
217
|
| `set_product_costing` | Save seller-provided supplier cost, freight and estimated cancellation/return rates; store price stays canonical and missing costs cannot be invented. |
|
|
218
218
|
| `report_product_counts` | Save only seller-observed daily counts as the final override. Omitted counts remain unmeasured; zero is an explicit observation. |
|
|
219
|
+
| `get_dropi_status` | Read whether the seller's Dropi account is connected and how far its order read got. Connecting or disconnecting is NOT done here — the Dropi key is pasted in Integrations, and saying so is part of the answer when `connected: false` comes back |
|
|
220
|
+
| `sync_dropi_orders` | Pull real orders from the seller's connected Dropi account into the ledger. Idempotent: re-reading the same window updates lines instead of duplicating them. If the answer stays `pending`, the read continues in the background — say so and offer `get_dropi_status` again instead of claiming a total that has not finished |
|
|
221
|
+
| `create_manual_product` | Create a product by hand in financial control: no store, no file, no task. Ask for ALL the data first — supplier cost and freight without inventing (a zero would make it infinitely profitable); the two rates are 0–1 proportions and the seller's estimate. Retrying with the same data returns the same product; the derived `requestId` never duplicates |
|
|
222
|
+
| `list_unmatched_products` | Read the products an import brought that still have no owner in the ledger. Their orders are already stored — this lists who needs `resolve_unmatched_product` next |
|
|
223
|
+
| `resolve_unmatched_product` | Give an owner to an unrecognized imported product: with `productControlId` the alias hangs off that record and its orders move there; without it a new record is created under `label`. Neither path discards orders — there is no "not mine" route because the information already came in |
|
|
224
|
+
| `list_linkable_campaigns` | Read the Meta/TikTok campaigns available to tie to a product, so identifiers never have to be typed. Empty means the ad account is not connected or has no campaigns — connecting happens in Integrations, not here |
|
|
225
|
+
| `link_product_campaign` | Tie an ad campaign to a product in financial control; its spend then feeds the product's cost-per-sale. The identifiers come from `list_linkable_campaigns` — never invent them. The product is said ONE way: `productControlId`, or `shopDomain` + `shopifyProductId` |
|
|
226
|
+
| `delete_monthly_expense` | Delete one fixed expense of the month by month + label. To change the amount do NOT delete — `set_monthly_expense` with the new value is the correction |
|
|
227
|
+
| `remove_product_control` | Remove a product from financial control together with its costs and its linked campaign. The id comes from `get_product_control` — confirm by NAME which product leaves |
|
|
219
228
|
| `get_actor_voice_capabilities` | Read whether custom voice cloning is enabled for an actor and which countries/presentations the draft may use. Read-only, free — call before `quote_actor_voice` |
|
|
220
229
|
| `quote_actor_voice` | Quote the paid custom-voice preview for an actor from a voice `draft` (prompt, country, presentation, tone…). Read-only, free |
|
|
221
230
|
| `generate_actor_voice_preview` | Start the paid contextual voice preview for a quoted draft (Gemini TTS reference → voice clone). Requires the fresh `acceptedQuoteId` and a unique `requestKey` for retry safety. Costs credits |
|
|
@@ -311,23 +320,80 @@ The `base64` field was removed. MCP JSON-RPC transports truncate large tool argu
|
|
|
311
320
|
|
|
312
321
|
## Environment variables
|
|
313
322
|
|
|
314
|
-
| Var
|
|
315
|
-
|
|
|
316
|
-
| `PM_API_KEY`
|
|
317
|
-
| `PM_API_URL`
|
|
318
|
-
| `
|
|
319
|
-
| `
|
|
320
|
-
| `
|
|
321
|
-
| `
|
|
322
|
-
| `
|
|
323
|
-
| `
|
|
324
|
-
| `
|
|
325
|
-
| `
|
|
326
|
-
| `
|
|
327
|
-
| `
|
|
323
|
+
| Var | Runtime default | Configuration requirement |
|
|
324
|
+
| --------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------------- |
|
|
325
|
+
| `PM_API_KEY` | — | required for stdio/local/direct API only |
|
|
326
|
+
| `PM_API_URL` | `https://api.productmaker.app` | optional for both |
|
|
327
|
+
| `PM_MEDIA_UPLOAD_STORAGE_ORIGINS` | official ProductMaker R2 account for the default API | optional JSON array of exact public HTTPS upload origins; configure for custom storage |
|
|
328
|
+
| `PORT` | `8080` | optional for HTTP |
|
|
329
|
+
| `MCP_PROXY_BASE_URL` | `https://mcp.productmaker.app` | optional for HTTP |
|
|
330
|
+
| `PM_PROXY_SECRET` | — | optional for HTTP; 32+ chars enables asset proxy |
|
|
331
|
+
| `MCP_REMOTE_AUTH_MODE` | — | required for hosted HTTP; must be `oauth` |
|
|
332
|
+
| `MCP_AUTH0_ISSUER` | — | required for hosted HTTP OAuth |
|
|
333
|
+
| `MCP_AUTH0_AUDIENCE` | — | required; set to `https://mcp.productmaker.app/mcp` |
|
|
334
|
+
| `MCP_AUTH0_CLIENT_ID` | — | required for hosted HTTP OAuth |
|
|
335
|
+
| `MCP_AUTH0_CLIENT_SECRET` | — | required for hosted HTTP OAuth |
|
|
336
|
+
| `AUTH0_AUDIENCE` | — | required for hosted HTTP OAuth |
|
|
337
|
+
| `PM_API_AUDIENCE` | — | required for hosted HTTP OAuth |
|
|
338
|
+
|
|
339
|
+
### Custom upload storage
|
|
340
|
+
|
|
341
|
+
The inline uploader allows only the exact production R2 account origin when using
|
|
342
|
+
`https://api.productmaker.app`. Custom API/storage operators must configure
|
|
343
|
+
`PM_MEDIA_UPLOAD_STORAGE_ORIGINS`, for example
|
|
344
|
+
`["https://storage.example.com:9443"]`, on their HTTP or stdio process. The value
|
|
345
|
+
replaces the default storage allowance; `[]` adds no storage destinations. Origins
|
|
346
|
+
must be public HTTPS URLs with no wildcard, credentials, path, query or fragment.
|
|
347
|
+
Malformed configuration stops startup without logging the supplied value. Set the
|
|
348
|
+
same public JSON value in the `PM_MEDIA_UPLOAD_STORAGE_ORIGINS` GitHub repository
|
|
349
|
+
variable for managed deployments, or export it for `deploy_mcp.sh`. Both deployment
|
|
350
|
+
paths preserve JSON commas and apply the explicit official account when unset.
|
|
351
|
+
Tool results and user files cannot expand this operator-controlled policy.
|
|
352
|
+
|
|
353
|
+
The uploader has no remote static assets and declares `resourceDomains: []`.
|
|
354
|
+
ProductMaker API/web proxy origins and the configured API resolver remain allowed.
|
|
355
|
+
The ChatGPT file bridge temporarily retains `https://*.oaiusercontent.com` because
|
|
356
|
+
its documented download helper supplies temporary URLs without a published exact
|
|
357
|
+
hostname contract. Narrowing that scope awaits a real attached-file/library flow;
|
|
358
|
+
this change does not claim the portal finding has cleared. The server emits the
|
|
359
|
+
standard CSP and matching legacy ChatGPT compatibility metadata. It does not set
|
|
360
|
+
a shared `ui.domain`, which breaks hosts with different sandbox-domain rules.
|
|
328
361
|
|
|
329
362
|
## Version history
|
|
330
363
|
|
|
364
|
+
### 12.2.0 — Financial-control surfaces for chat
|
|
365
|
+
|
|
366
|
+
Nine financial-control tools open to chat: Dropi status and idempotent order
|
|
367
|
+
sync, manual product creation with a content-derived `requestId` (a retry
|
|
368
|
+
never duplicates), unmatched-product listing/resolution, campaign linking,
|
|
369
|
+
monthly-expense deletion and product removal. Dropi connect/disconnect stays
|
|
370
|
+
out on purpose: the integration key is a secret pasted in Integrations. All
|
|
371
|
+
nine are MCP-only (`whatsapp: "unavailable"`) and behind the `financial-control`
|
|
372
|
+
admin feature.
|
|
373
|
+
|
|
374
|
+
### 12.2.7 — Upload reliability and media transport hardening (unreleased)
|
|
375
|
+
|
|
376
|
+
- Correct public landing/Shopify publication and Meta creative URL/temporary-asset
|
|
377
|
+
annotations. Keep the legacy video API identifier while labeling its display
|
|
378
|
+
title and canonical summary as custom-script generation using paid credits.
|
|
379
|
+
- Keep host ping/unknown requests separate from matching initialization and
|
|
380
|
+
tool-call responses, even when both directions use the same numeric ID.
|
|
381
|
+
- Retain upload-session identity across asynchronous work; stop obsolete batches,
|
|
382
|
+
settle aborted PUTs and release reservations using their original credentials.
|
|
383
|
+
- Retry transient resolve throttles/timeouts within the existing limit and reject
|
|
384
|
+
oversized signed upload URLs without truncating them.
|
|
385
|
+
- Pin validated public media DNS destinations in the actual HTTPS connection,
|
|
386
|
+
including redirects; keep bounded transfer and cleanup behavior.
|
|
387
|
+
- Restrict upload CSP to the production R2 account or explicit operator storage
|
|
388
|
+
origins, declare the empty static-resource policy, and retain the pending
|
|
389
|
+
ChatGPT file-bridge origin verification described above.
|
|
390
|
+
- Describe upload preparation and status without prescribing host tool timing or
|
|
391
|
+
permission decisions. Preserve private staging, explicit upload refusal and
|
|
392
|
+
separate generation/publication consent; the App never sends a user chat turn.
|
|
393
|
+
- Local protocol, transport and CSP tests remain separate from deployment,
|
|
394
|
+
production acceptance and the portal's current scan result. The earlier
|
|
395
|
+
serialized-browser rendering symptom is not evidence of a ChatGPT outage.
|
|
396
|
+
|
|
331
397
|
### 12.1.7 — Service website challenge recognition
|
|
332
398
|
|
|
333
399
|
- Recognize SiteGround robot challenge pages before accepting service website source content.
|