@productmaker/mcp 12.2.7 → 12.3.0

package/README.md

@@ -207,7 +207,7 @@ its service-page editor, including its generation progress.
 | `import_orders_file`            | Read the provider's spreadsheet from an ABSOLUTE path on the caller's machine and store its orders. **stdio only** — on the hosted server a path points at OUR disk, so it fails closed. Start with `dryRun: true` and tell the seller what it contains (how many orders, between which dates, which rows could not be read) before writing anything. No column with buyer data is ever read                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `create_operation`              | Create the business of one country. The currency is derived from the country, never asked. Needed before anything else about the month: with no operation there is nothing for `get_finances` to assemble. Someone selling in a single country has one and never hears the word again                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `merge_products`                | Merge two records of the same product into one. The two ids come from `get_product_control` — never invent them. The source DISAPPEARS and its orders move to the target, so confirm by NAME which one stays. It cannot be undone                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `get_finances`                  | Read-only monthly P&L: gross and delivered sales, freight, merchandise cost, gross profit, ad spend, fixed costs and NET profit **before taxes**, plus each rate against its target. Grouped on purpose: a model that needs six calls to answer "how am I doing?" assembles the picture itself between trips, and that is where it invents. `adSpendKnown: false` means ad spend could not be read and the profit is INCOMPLETE; `adSpendSource: "user"` means she corrected it by hand; `unconfirmedExpenses > 0` is inherited from last month and unreviewed. With one operation the server resolves it; with several it returns `operation_ambiguous` with the list                                                                                                                                                                                                    |
+| `get_finances`                  | Read-only monthly P&L before taxes: sales, costs, advertising, fixed costs and net profit. Unknown actual costs or advertising leave confirmed profit INCOMPLETE. Optional `costEstimate` uses current configured product costs: label it an ESTIMATE, never confirmed historical costs. Null/absent means no estimate. `adSpendSource: "user"` identifies manual correction; `unconfirmedExpenses > 0` flags inherited expenses. The server resolves a single operation or returns `operation_ambiguous`.                                                                                                                                                                                                                                                                                                                                                                |
 | `set_monthly_expense`           | Save one FIXED cost of the month (rent, salaries, accountant). Writing the same label again REPLACES the amount — it does not add a second expense. Without fixed costs written, the month's profit always reads HIGHER than it is. Not for ad spend: that is `set_ad_spend`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `set_ad_spend`                  | Correct by hand what was spent on ads that month. `amount: 0` ASSERTS "I did not advertise"; `null` WITHDRAWS the correction and gives the campaigns back the say. They are not the same                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `prepare_winning_product_image` | Prepare and show the exact photo of a user-selected winning-product candidate for free; securely stages it before the next photo choice.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
@@ -371,6 +371,20 @@ out on purpose: the integration key is a secret pasted in Integrations. All
 nine are MCP-only (`whatsapp: "unavailable"`) and behind the `financial-control`
 admin feature.
 
+### 12.2.8 — Result-viewer origin and correction delivery (unreleased)
+
+- Declare the shared OpenAI component origin on listed and readable result-viewer
+  resources, matching the uploader. Keep the standard host-selected origin and
+  fail-closed media CSP unchanged for other MCP Apps hosts.
+- SDK transport tests verify both metadata placements. Native acceptance and the
+  cause of a browser sandbox cancellation remain separate checks.
+- Deliver published image corrections from `get_image_edit_status` through the
+  same read-only task viewer and protected asset proxy. Preserve operation status,
+  degradation and error; queued/processing stay pending and failed stays error.
+  Missing or invalid proxy/media configuration stays empty, with no raw storage
+  URL or storage key in model-facing content. The original task being done never
+  makes an unfinished correction ready. No generation or paid action is added.
+
 ### 12.2.7 — Upload reliability and media transport hardening (unreleased)
 
 - Correct public landing/Shopify publication and Meta creative URL/temporary-asset

package/dist/http.js

@@ -3021,7 +3021,7 @@ var LlmPricingSnapshotSchema = z3.discriminatedUnion("source", [
 });
 function nativeOutputTokenCeiling(target) {
   if (target.nativeOwnedOutputPolicy) return target.nativeOwnedOutputPolicy.verifiedMaxOutputTokens;
-  return target.transport === "google" || target.id === "gemini-3.1-pro-openrouter" ? 65536 : 1e5;
+  return target.transport === "google" || target.id === "gemini-flash-runware" || target.id === "gemini-3.1-pro-openrouter" ? 65536 : 1e5;
 }
 __name(nativeOutputTokenCeiling, "nativeOutputTokenCeiling");
 var LlmRouteTargetSchema = z3.object({
@@ -8288,6 +8288,12 @@ var CodeLandingAuthorEnvelopeSchema = z23.object({
   */
   variantFacts: z23.array(LandingVariantFactSchema).max(16).optional()
 });
+var CODE_LANDING_DEFERRED_AUTHOR_PROVIDER_RESULT_KIND = "code_landing_deferred_author_provider_v1";
+var CodeLandingDeferredAuthorProviderResultSchema = z23.object({
+  kind: z23.literal(CODE_LANDING_DEFERRED_AUTHOR_PROVIDER_RESULT_KIND),
+  stepKey: z23.string().min(1),
+  providerResult: z23.record(z23.string(), z23.unknown())
+});
 var CodeLandingCommerceChangeSchema = z23.object({
   price: z23.string().trim().min(1).max(40).optional(),
   compareAtPrice: z23.string().trim().min(1).max(40).nullable().optional(),
@@ -10818,6 +10824,8 @@ var role = z38.object({
   provider: id2,
   model: id2,
   bindingId: id2,
+  /** Immutable shared-router chain for fresh recipes; absent preserves legacy custody. */
+  routeSnapshot: LlmRouteSnapshotSchema.optional(),
   /** null explicitly omits effort on OpenRouter; undefined is a historical recipe. */
   reasoning: CreativeEngineRoleReasoningSchema.nullable().optional(),
   /** Server-owned output ceiling; omitted historical recipes keep their old stage cap. */
@@ -10837,7 +10845,13 @@ var CreativeEngineRecipeSchema = z38.object({
   roles: z38.object({
     director: role,
     reviewer: role,
-    executor: role.nullable()
+    executor: role.nullable(),
+    /**
+     * Independent reviewer of the assembled final video only (owner
+     * decision 2026-10-26). Absent on historical recipes: their final
+     * review keeps the frozen `reviewer`, unchanged hash and identity.
+     */
+    finalReviewer: role.optional()
   }).strict(),
   capabilities: z38.object({
     videoModels: z38.array(id2).min(1),
@@ -10847,6 +10861,8 @@ var CreativeEngineRecipeSchema = z38.object({
       "silent_sfx"
     ])).min(1),
     imageBackendAvailable: z38.boolean(),
+    /** New journals may overlap independent accepted media under one coordinator. */
+    mediaScheduling: z38.literal("bounded_parallel_v1").optional(),
     /** New server recipes require journaled speech QA; old receipts remain readable. */
     speechAssessment: z38.literal("whisper_v1").optional(),
     /** Frozen server review envelope; legacy readers retain their 48-frame limit. */
@@ -10856,9 +10872,14 @@ var CreativeEngineRecipeSchema = z38.object({
     /** New recipes reserve an explicit native failover; historical calls stay single-route. */
     modelFallbackPolicy: z38.literal("anthropic_conclusive_v1").optional(),
     /** New reviewer/executor calls use the shared same-model native provider router. */
-    centralModelRouting: z38.literal("native_owned_same_model_v1").optional(),
+    centralModelRouting: z38.enum([
+      "native_owned_same_model_v1",
+      "shared_role_chain_v1"
+    ]).optional(),
     /** Skip only a redundant global review of a deterministically frozen scene repair. */
     repairPlanReviewPolicy: z38.literal("frozen_contract_v1").optional(),
+    /** Root-only visual patch wire contract; absent preserves historic full-plan recovery. */
+    repairAuthoring: z38.literal("scene_patch_v1").optional(),
     /** New requests maximize output inside model and measured input headroom. */
     outputTokenPolicy: z38.literal("model_max_v1").optional(),
     /**
@@ -10878,6 +10899,8 @@ var CreativeEngineRecipeSchema = z38.object({
     explicitCastingPolicy: z38.literal("seller_explicit_v1").optional(),
     /** Frozen reviewer-only read model; absent keeps historical full request context. */
     reviewerContextPolicy: z38.literal("selected_commercial_v1").optional(),
+    /** New final reviews explicitly account for selected critical technical findings. */
+    finalReviewContextPolicy: z38.literal("selected_candidate_findings_v1").optional(),
     /** New voice requests after localized lengthening override stale timing only. */
     voiceLengthenDirectionPolicy: z38.literal("slot_duration_v1").optional(),
     /**
@@ -11010,6 +11033,8 @@ var CreativeEngineSceneSchema = z38.object({
     }).strict()
   ]),
   dependsOn: z38.array(id2),
+  /** Subset of dependsOn consumed only as an approved human opening, never a final frame. */
+  openingDependencies: z38.array(id2).optional(),
   visibleSpeaker: z38.enum([
     "human",
     "product",
@@ -11094,7 +11119,10 @@ var reviewUnavailabilityReason = z38.enum([
   "invalid_output",
   "reviewer_declined",
   /** #22: the gate's technical evidence could not be assembled after spend. */
-  "evidence_unavailable"
+  "evidence_unavailable",
+  /** No new purchase is allowed; an owned, verified final can still be delivered. */
+  "cost_budget_exhausted",
+  "post_budget_exhausted"
 ]);
 var CreativeEngineReviewSchema = z38.object({
   id: id2,
@@ -11319,6 +11347,7 @@ var CreativeEngineCandidateSchema = z38.object({
   qualityScore: z38.number().min(0).max(100)
 }).strict();
 var CreativeEngineCostBasisSchema = z38.enum([
+  "reused",
   "provider_reported",
   "provider_credits_conversion",
   "catalogue_estimate"
@@ -11619,6 +11648,15 @@ var CreativeEngineEventSchema = z38.discriminatedUnion("type", [
     }).strict(),
     plan: CreativeEnginePlanSchema
   }).strict(),
+  z38.object({
+    type: z38.literal("accepted_author_output_revalidated"),
+    operationId: id2,
+    acceptedId: id2,
+    context: CreativeEngineContextBindingSchema,
+    outputSha256: hash,
+    validationRevision: z38.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
+    plan: CreativeEnginePlanSchema
+  }).strict(),
   z38.object({
     type: z38.literal("plan_recorded"),
     plan: CreativeEnginePlanSchema
@@ -13110,7 +13148,9 @@ var SERVICE_MODES = [
 ];
 var ServiceModeSchema = z46.enum(SERVICE_MODES);
 var AppFeaturesSchema = z46.object({
-  serviceMotionGraphics: z46.boolean()
+  serviceMotionGraphics: z46.boolean(),
+  /** GIF authoring controls; absent on older APIs means hidden. */
+  landingGif: z46.boolean().default(false)
 });
 var MOTION_GRAPHICS_FORMATS = [
   "vertical",
@@ -22276,6 +22316,7 @@ var MonthlyExpensesQuerySchema = z97.object({
 
 // ../../packages/types/src/product-alias.ts
 import { z as z98 } from "zod";
+var PRODUCT_ALIAS_LABEL_MAX_LENGTH = 200;
 var PRODUCT_ALIAS_PROVIDERS = [
   "shopify",
   "dropi",
@@ -22292,12 +22333,12 @@ var ProductAliasSchema = z98.object({
    */
   externalId: z98.string().trim().min(1).max(64),
   /** El nombre con el que el archivo lo llamó, para que la persona lo reconozca. */
-  label: z98.string().trim().max(200).optional()
+  label: z98.string().trim().max(PRODUCT_ALIAS_LABEL_MAX_LENGTH).optional()
 }).strict();
 var ResolveUnmatchedProductSchema = z98.object({
   provider: z98.enum(PRODUCT_ALIAS_PROVIDERS),
   externalId: z98.string().trim().min(1).max(64),
-  label: z98.string().trim().min(1).max(200),
+  label: z98.string().trim().min(1).max(PRODUCT_ALIAS_LABEL_MAX_LENGTH),
   operationId: z98.string().uuid(),
   /** Presente ⇒ es el producto al que pertenece. Ausente ⇒ es uno nuevo. */
   productControlId: z98.string().uuid().optional()
@@ -22429,6 +22470,15 @@ var SyncShopifyOrdersSchema = z99.object({
 
 // ../../packages/types/src/product-control.ts
 import { z as z100 } from "zod";
+var MonthlyCostEstimateSchema = z100.object({
+  source: z100.literal("product_costing"),
+  linesEstimated: z100.number().int().positive(),
+  merchandiseCost: z100.number().finite().nonnegative(),
+  freightCost: z100.number().finite().nonnegative(),
+  grossProfit: z100.number().finite(),
+  netProfit: z100.number().finite(),
+  netMarginOnDelivered: z100.number().finite().nullable()
+});
 var ProductControlDailyCountsSchema = z100.object({
   date: z100.string().regex(/^\d{4}-\d{2}-\d{2}$/),
   orders: z100.number().int().nullable(),
@@ -30873,11 +30923,12 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "12.2.7";
+var MCP_VERSION = "12.3.0";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
 import { z as z132 } from "zod";
+import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 
 // src/public-https.ts
 import { lookup } from "dns/promises";
@@ -31337,11 +31388,12 @@ function assertSafePublicBaseUrl(envName, url2) {
 }
 __name(assertSafePublicBaseUrl, "assertSafePublicBaseUrl");
 
+// src/app-origin.ts
+var PRODUCTMAKER_APP_ORIGIN = "https://productmaker.app";
+
 // src/meta-upload-app.ts
-import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 var MEDIA_UPLOAD_APP_RESOURCE_URI = "ui://media-upload/v1.html";
 var MEDIA_UPLOAD_APP_NAME = "ProductMaker media upload";
-var PRODUCTMAKER_APP_ORIGIN = "https://productmaker.app";
 var MEDIA_UPLOAD_APP_HTML_URL = new URL("./ui/meta-upload-app.html", import.meta.url);
 var PRODUCTMAKER_UPLOAD_STORAGE_ORIGIN = "https://825805a8113ddb98b68b9b0ddbb5d72a.r2.cloudflarestorage.com";
 var MEDIA_UPLOAD_CONNECT_DOMAINS = [
@@ -31541,6 +31593,7 @@ function registerTaskResultsAppResource(server, proxyBaseUrl) {
         connectDomains: []
       }
     },
+    "openai/widgetDomain": PRODUCTMAKER_APP_ORIGIN,
     "openai/widgetCSP": {
       resource_domains: resourceDomains,
       connect_domains: []
@@ -37271,7 +37324,7 @@ function resolveLandingSetup(setup) {
   };
 }
 __name(resolveLandingSetup, "resolveLandingSetup");
-function registerCreativeTools(server, api, { transport = "http" } = {}) {
+function registerCreativeTools(server, api, { transport = "http", proxyBaseUrl = null } = {}) {
   server.registerTool("generate_free_video", {
     title: "Custom-script video",
     description: generateFreeVideoGuidance.summary + ' Si el usuario adjunta o menciona una imagen local, llama primero request_media_upload con mediaKind=image y usa el assetId devuelto; no pidas path ni URL. Devuelve un taskId y procesa el job de forma as\xEDncrona.\n\nREQUERIDOS: rawPrompt, quality, durationSeconds y videoResolution.\n\nCALIDAD: "economy" = Econ\xF3mico, "medium" = Medio o "pro" = Pro (Wan). Economy admite 6/8/10/15s; Medium admite cualquier duraci\xF3n entera de 4 a 15s; Pro admite enteros de 2 a 30s y audio natural. `freeProModel` se elimin\xF3 \u2014 usa `modelId` (ver su descripci\xF3n); Seedance 2.5 est\xE1 inactivo y se rechaza con un error claro.\n\nSUBT\xCDTULOS: si addSubtitles=true, el rawPrompt completo se usa como texto exacto de subt\xEDtulos y debe tener m\xE1ximo 500 caracteres; no existe una pregunta adicional de transcripci\xF3n.\n\nPara videos normales con narrativa/\xE1ngulo usa generate_video_creative. Para tareas combinadas de producto usa create_product_task.',
@@ -37489,10 +37542,43 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
       taskId: z142.string().uuid(),
       operationId: z142.string().uuid()
     },
-    annotations: READS_INTERNAL
+    annotations: READS_INTERNAL,
+    _meta: taskResultsToolMeta()
   }, async (input) => {
     try {
-      return asText(await api.getJson(`/v1/creatives/images/${encodeURIComponent(input.taskId)}/operations/${encodeURIComponent(input.operationId)}`));
+      const { assetUrl, assetKey: _assetKey, ...operation } = ImageCreativeEditStatusResponse.parse(await api.getJson(`/v1/creatives/images/${encodeURIComponent(input.taskId)}/operations/${encodeURIComponent(input.operationId)}`));
+      const imageExtension = assetUrl ? new URL(assetUrl).pathname.match(/\.(png|jpe?g|webp)$/i)?.[0]?.toLowerCase() : void 0;
+      const proxyUrl = operation.status === "published" && assetUrl ? buildProxyUrl({
+        r2Url: assetUrl,
+        filename: `image-edit-${operation.variantIndex + 1}${imageExtension ?? ".bin"}`,
+        proxyBaseUrl
+      }) : null;
+      const view = buildTaskResultsView({
+        images: proxyUrl ? [
+          {
+            url: proxyUrl,
+            alt: `Corrected image ${operation.variantIndex + 1}`
+          }
+        ] : [],
+        videos: [],
+        links: []
+      }, proxyBaseUrl);
+      if (operation.status === "failed") view.state = "error";
+      else if (operation.status !== "published") view.state = "pending";
+      const deliveredUrl = view.images[0]?.url;
+      const response = {
+        ...operation,
+        ...deliveredUrl ? {
+          assetUrl: deliveredUrl
+        } : {}
+      };
+      return {
+        ...asText(response),
+        structuredContent: response,
+        _meta: {
+          taskResults: view
+        }
+      };
     } catch (error) {
       throw translateError(error);
     }
@@ -40932,7 +41018,7 @@ function registerProductControlTools(server, api, { transport = "http" } = {}) {
     }
   });
   server.registerTool("get_finances", {
-    description: getFinancesGuidance.summary + ' Contesta la pregunta que de verdad importa --- \xABeste negocio gana plata?\xBB --- con el mes armado: ventas totales y entregadas, fletes, costo de los productos, utilidad bruta, publicidad, gastos fijos y utilidad NETA. Esa utilidad es ANTES de impuestos y hay que decirlo asi: el contador es un gasto mas, no un calculo nuestro. Trae tambien los porcentajes contra sus metas. Si `deliveredSalesKnown` no es true, faltan importes de ventas entregadas: la utilidad y los m\xE1rgenes no est\xE1n completos. `grossSalesKnown` distinto de true indica ventas totales parciales. Si `costsKnown` viene en `false`, esos pedidos llegaron de una fuente que NO sabe cuanto costaron \u2014la tienda, o la API del proveedor\u2014 y la utilidad BRUTA esta incompleta: no es que el producto salga gratis. Si `adSpendKnown` viene en `false`, la publicidad NO se pudo leer y la utilidad esta INCOMPLETA: dilo antes de que alguien celebre un mes que perdio plata. `adSpendSource: "user"` significa que ella corrigio la cifra a mano, y eso se revisa distinto de una leida. Si `unconfirmedExpenses` es mayor que cero, ese monto viene heredado del mes pasado y ella no lo ha revisado. Es READ-ONLY: nunca pausa ni modifica una campana.',
+    description: getFinancesGuidance.summary + ' Contesta la pregunta que de verdad importa --- \xABeste negocio gana plata?\xBB --- con el mes armado: ventas totales y entregadas, fletes, costo de los productos, utilidad bruta, publicidad, gastos fijos y utilidad NETA. Esa utilidad es ANTES de impuestos y hay que decirlo asi: el contador es un gasto mas, no un calculo nuestro. Trae tambien los porcentajes contra sus metas. Si `deliveredSalesKnown` no es true, faltan importes de ventas entregadas: la utilidad y los m\xE1rgenes no est\xE1n completos. `grossSalesKnown` distinto de true indica ventas totales parciales. Si `costsKnown` viene en `false`, esos pedidos llegaron de una fuente que NO sabe cuanto costaron \u2014la tienda, o la API del proveedor\u2014 y la utilidad BRUTA esta incompleta: no es que el producto salga gratis. Si `adSpendKnown` viene en `false`, la publicidad NO se pudo leer y la utilidad esta INCOMPLETA: dilo antes de que alguien celebre un mes que perdio plata. `adSpendSource: "user"` significa que ella corrigio la cifra a mano, y eso se revisa distinto de una leida. Si `unconfirmedExpenses` es mayor que cero, ese monto viene heredado del mes pasado y ella no lo ha revisado. Es READ-ONLY: nunca pausa ni modifica una campana. Si viene `costEstimate` con `source: "product_costing"`, presenta sus importes como ESTIMACI\xD3N antes de impuestos, usando los costos actuales configurados del producto: no son costos reales confirmados de esos pedidos. Conserva el aviso de `costsKnown: false` y distingue esta estimaci\xF3n de los importes reales del libro. `linesEstimated` indica cu\xE1ntas l\xEDneas usan costos configurados. La API s\xF3lo ofrece esta estimaci\xF3n cuando cubre todos los costos faltantes con perfiles asociados del mismo pa\xEDs y moneda, y conoce ventas entregadas, publicidad y gastos revisados. Si `costEstimate` es null o no existe, no inventes una estimaci\xF3n ni completes importes faltantes.',
     inputSchema: GetFinancesInput.shape,
     annotations: READS_INTERNAL
   }, async (input) => {
@@ -41413,6 +41499,7 @@ function createServer(opts) {
   registerServiceImageTools(server, api);
   registerAnimatedVideoTools(server, api);
   registerCreativeTools(server, api, {
+    proxyBaseUrl,
     transport
   });
   registerCreativeVariantTools(server, api);

package/dist/stdio.js

@@ -2796,7 +2796,7 @@ var LlmPricingSnapshotSchema = z3.discriminatedUnion("source", [
 });
 function nativeOutputTokenCeiling(target) {
   if (target.nativeOwnedOutputPolicy) return target.nativeOwnedOutputPolicy.verifiedMaxOutputTokens;
-  return target.transport === "google" || target.id === "gemini-3.1-pro-openrouter" ? 65536 : 1e5;
+  return target.transport === "google" || target.id === "gemini-flash-runware" || target.id === "gemini-3.1-pro-openrouter" ? 65536 : 1e5;
 }
 __name(nativeOutputTokenCeiling, "nativeOutputTokenCeiling");
 var LlmRouteTargetSchema = z3.object({
@@ -8063,6 +8063,12 @@ var CodeLandingAuthorEnvelopeSchema = z23.object({
   */
   variantFacts: z23.array(LandingVariantFactSchema).max(16).optional()
 });
+var CODE_LANDING_DEFERRED_AUTHOR_PROVIDER_RESULT_KIND = "code_landing_deferred_author_provider_v1";
+var CodeLandingDeferredAuthorProviderResultSchema = z23.object({
+  kind: z23.literal(CODE_LANDING_DEFERRED_AUTHOR_PROVIDER_RESULT_KIND),
+  stepKey: z23.string().min(1),
+  providerResult: z23.record(z23.string(), z23.unknown())
+});
 var CodeLandingCommerceChangeSchema = z23.object({
   price: z23.string().trim().min(1).max(40).optional(),
   compareAtPrice: z23.string().trim().min(1).max(40).nullable().optional(),
@@ -10593,6 +10599,8 @@ var role = z38.object({
   provider: id2,
   model: id2,
   bindingId: id2,
+  /** Immutable shared-router chain for fresh recipes; absent preserves legacy custody. */
+  routeSnapshot: LlmRouteSnapshotSchema.optional(),
   /** null explicitly omits effort on OpenRouter; undefined is a historical recipe. */
   reasoning: CreativeEngineRoleReasoningSchema.nullable().optional(),
   /** Server-owned output ceiling; omitted historical recipes keep their old stage cap. */
@@ -10612,7 +10620,13 @@ var CreativeEngineRecipeSchema = z38.object({
   roles: z38.object({
     director: role,
     reviewer: role,
-    executor: role.nullable()
+    executor: role.nullable(),
+    /**
+     * Independent reviewer of the assembled final video only (owner
+     * decision 2026-10-26). Absent on historical recipes: their final
+     * review keeps the frozen `reviewer`, unchanged hash and identity.
+     */
+    finalReviewer: role.optional()
   }).strict(),
   capabilities: z38.object({
     videoModels: z38.array(id2).min(1),
@@ -10622,6 +10636,8 @@ var CreativeEngineRecipeSchema = z38.object({
       "silent_sfx"
     ])).min(1),
     imageBackendAvailable: z38.boolean(),
+    /** New journals may overlap independent accepted media under one coordinator. */
+    mediaScheduling: z38.literal("bounded_parallel_v1").optional(),
     /** New server recipes require journaled speech QA; old receipts remain readable. */
     speechAssessment: z38.literal("whisper_v1").optional(),
     /** Frozen server review envelope; legacy readers retain their 48-frame limit. */
@@ -10631,9 +10647,14 @@ var CreativeEngineRecipeSchema = z38.object({
     /** New recipes reserve an explicit native failover; historical calls stay single-route. */
     modelFallbackPolicy: z38.literal("anthropic_conclusive_v1").optional(),
     /** New reviewer/executor calls use the shared same-model native provider router. */
-    centralModelRouting: z38.literal("native_owned_same_model_v1").optional(),
+    centralModelRouting: z38.enum([
+      "native_owned_same_model_v1",
+      "shared_role_chain_v1"
+    ]).optional(),
     /** Skip only a redundant global review of a deterministically frozen scene repair. */
     repairPlanReviewPolicy: z38.literal("frozen_contract_v1").optional(),
+    /** Root-only visual patch wire contract; absent preserves historic full-plan recovery. */
+    repairAuthoring: z38.literal("scene_patch_v1").optional(),
     /** New requests maximize output inside model and measured input headroom. */
     outputTokenPolicy: z38.literal("model_max_v1").optional(),
     /**
@@ -10653,6 +10674,8 @@ var CreativeEngineRecipeSchema = z38.object({
     explicitCastingPolicy: z38.literal("seller_explicit_v1").optional(),
     /** Frozen reviewer-only read model; absent keeps historical full request context. */
     reviewerContextPolicy: z38.literal("selected_commercial_v1").optional(),
+    /** New final reviews explicitly account for selected critical technical findings. */
+    finalReviewContextPolicy: z38.literal("selected_candidate_findings_v1").optional(),
     /** New voice requests after localized lengthening override stale timing only. */
     voiceLengthenDirectionPolicy: z38.literal("slot_duration_v1").optional(),
     /**
@@ -10785,6 +10808,8 @@ var CreativeEngineSceneSchema = z38.object({
     }).strict()
   ]),
   dependsOn: z38.array(id2),
+  /** Subset of dependsOn consumed only as an approved human opening, never a final frame. */
+  openingDependencies: z38.array(id2).optional(),
   visibleSpeaker: z38.enum([
     "human",
     "product",
@@ -10869,7 +10894,10 @@ var reviewUnavailabilityReason = z38.enum([
   "invalid_output",
   "reviewer_declined",
   /** #22: the gate's technical evidence could not be assembled after spend. */
-  "evidence_unavailable"
+  "evidence_unavailable",
+  /** No new purchase is allowed; an owned, verified final can still be delivered. */
+  "cost_budget_exhausted",
+  "post_budget_exhausted"
 ]);
 var CreativeEngineReviewSchema = z38.object({
   id: id2,
@@ -11094,6 +11122,7 @@ var CreativeEngineCandidateSchema = z38.object({
   qualityScore: z38.number().min(0).max(100)
 }).strict();
 var CreativeEngineCostBasisSchema = z38.enum([
+  "reused",
   "provider_reported",
   "provider_credits_conversion",
   "catalogue_estimate"
@@ -11394,6 +11423,15 @@ var CreativeEngineEventSchema = z38.discriminatedUnion("type", [
     }).strict(),
     plan: CreativeEnginePlanSchema
   }).strict(),
+  z38.object({
+    type: z38.literal("accepted_author_output_revalidated"),
+    operationId: id2,
+    acceptedId: id2,
+    context: CreativeEngineContextBindingSchema,
+    outputSha256: hash,
+    validationRevision: z38.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
+    plan: CreativeEnginePlanSchema
+  }).strict(),
   z38.object({
     type: z38.literal("plan_recorded"),
     plan: CreativeEnginePlanSchema
@@ -12885,7 +12923,9 @@ var SERVICE_MODES = [
 ];
 var ServiceModeSchema = z46.enum(SERVICE_MODES);
 var AppFeaturesSchema = z46.object({
-  serviceMotionGraphics: z46.boolean()
+  serviceMotionGraphics: z46.boolean(),
+  /** GIF authoring controls; absent on older APIs means hidden. */
+  landingGif: z46.boolean().default(false)
 });
 var MOTION_GRAPHICS_FORMATS = [
   "vertical",
@@ -22051,6 +22091,7 @@ var MonthlyExpensesQuerySchema = z97.object({
 
 // ../../packages/types/src/product-alias.ts
 import { z as z98 } from "zod";
+var PRODUCT_ALIAS_LABEL_MAX_LENGTH = 200;
 var PRODUCT_ALIAS_PROVIDERS = [
   "shopify",
   "dropi",
@@ -22067,12 +22108,12 @@ var ProductAliasSchema = z98.object({
    */
   externalId: z98.string().trim().min(1).max(64),
   /** El nombre con el que el archivo lo llamó, para que la persona lo reconozca. */
-  label: z98.string().trim().max(200).optional()
+  label: z98.string().trim().max(PRODUCT_ALIAS_LABEL_MAX_LENGTH).optional()
 }).strict();
 var ResolveUnmatchedProductSchema = z98.object({
   provider: z98.enum(PRODUCT_ALIAS_PROVIDERS),
   externalId: z98.string().trim().min(1).max(64),
-  label: z98.string().trim().min(1).max(200),
+  label: z98.string().trim().min(1).max(PRODUCT_ALIAS_LABEL_MAX_LENGTH),
   operationId: z98.string().uuid(),
   /** Presente ⇒ es el producto al que pertenece. Ausente ⇒ es uno nuevo. */
   productControlId: z98.string().uuid().optional()
@@ -22204,6 +22245,15 @@ var SyncShopifyOrdersSchema = z99.object({
 
 // ../../packages/types/src/product-control.ts
 import { z as z100 } from "zod";
+var MonthlyCostEstimateSchema = z100.object({
+  source: z100.literal("product_costing"),
+  linesEstimated: z100.number().int().positive(),
+  merchandiseCost: z100.number().finite().nonnegative(),
+  freightCost: z100.number().finite().nonnegative(),
+  grossProfit: z100.number().finite(),
+  netProfit: z100.number().finite(),
+  netMarginOnDelivered: z100.number().finite().nullable()
+});
 var ProductControlDailyCountsSchema = z100.object({
   date: z100.string().regex(/^\d{4}-\d{2}-\d{2}$/),
   orders: z100.number().int().nullable(),
@@ -29200,11 +29250,12 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "12.2.7";
+var MCP_VERSION = "12.3.0";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
 import { z as z131 } from "zod";
+import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 
 // src/public-https.ts
 import { lookup } from "dns/promises";
@@ -29668,11 +29719,12 @@ function assertSafeApiBaseUrl(url2) {
 }
 __name(assertSafeApiBaseUrl, "assertSafeApiBaseUrl");
 
+// src/app-origin.ts
+var PRODUCTMAKER_APP_ORIGIN = "https://productmaker.app";
+
 // src/meta-upload-app.ts
-import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 var MEDIA_UPLOAD_APP_RESOURCE_URI = "ui://media-upload/v1.html";
 var MEDIA_UPLOAD_APP_NAME = "ProductMaker media upload";
-var PRODUCTMAKER_APP_ORIGIN = "https://productmaker.app";
 var MEDIA_UPLOAD_APP_HTML_URL = new URL("./ui/meta-upload-app.html", import.meta.url);
 var PRODUCTMAKER_UPLOAD_STORAGE_ORIGIN = "https://825805a8113ddb98b68b9b0ddbb5d72a.r2.cloudflarestorage.com";
 var MEDIA_UPLOAD_CONNECT_DOMAINS = [
@@ -29872,6 +29924,7 @@ function registerTaskResultsAppResource(server, proxyBaseUrl) {
         connectDomains: []
       }
     },
+    "openai/widgetDomain": PRODUCTMAKER_APP_ORIGIN,
     "openai/widgetCSP": {
       resource_domains: resourceDomains,
       connect_domains: []
@@ -35756,7 +35809,7 @@ function resolveLandingSetup(setup) {
   };
 }
 __name(resolveLandingSetup, "resolveLandingSetup");
-function registerCreativeTools(server, api, { transport = "http" } = {}) {
+function registerCreativeTools(server, api, { transport = "http", proxyBaseUrl = null } = {}) {
   server.registerTool("generate_free_video", {
     title: "Custom-script video",
     description: generateFreeVideoGuidance.summary + ' Si el usuario adjunta o menciona una imagen local, llama primero request_media_upload con mediaKind=image y usa el assetId devuelto; no pidas path ni URL. Devuelve un taskId y procesa el job de forma as\xEDncrona.\n\nREQUERIDOS: rawPrompt, quality, durationSeconds y videoResolution.\n\nCALIDAD: "economy" = Econ\xF3mico, "medium" = Medio o "pro" = Pro (Wan). Economy admite 6/8/10/15s; Medium admite cualquier duraci\xF3n entera de 4 a 15s; Pro admite enteros de 2 a 30s y audio natural. `freeProModel` se elimin\xF3 \u2014 usa `modelId` (ver su descripci\xF3n); Seedance 2.5 est\xE1 inactivo y se rechaza con un error claro.\n\nSUBT\xCDTULOS: si addSubtitles=true, el rawPrompt completo se usa como texto exacto de subt\xEDtulos y debe tener m\xE1ximo 500 caracteres; no existe una pregunta adicional de transcripci\xF3n.\n\nPara videos normales con narrativa/\xE1ngulo usa generate_video_creative. Para tareas combinadas de producto usa create_product_task.',
@@ -35974,10 +36027,43 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
       taskId: z141.string().uuid(),
       operationId: z141.string().uuid()
     },
-    annotations: READS_INTERNAL
+    annotations: READS_INTERNAL,
+    _meta: taskResultsToolMeta()
   }, async (input) => {
     try {
-      return asText(await api.getJson(`/v1/creatives/images/${encodeURIComponent(input.taskId)}/operations/${encodeURIComponent(input.operationId)}`));
+      const { assetUrl, assetKey: _assetKey, ...operation } = ImageCreativeEditStatusResponse.parse(await api.getJson(`/v1/creatives/images/${encodeURIComponent(input.taskId)}/operations/${encodeURIComponent(input.operationId)}`));
+      const imageExtension = assetUrl ? new URL(assetUrl).pathname.match(/\.(png|jpe?g|webp)$/i)?.[0]?.toLowerCase() : void 0;
+      const proxyUrl = operation.status === "published" && assetUrl ? buildProxyUrl({
+        r2Url: assetUrl,
+        filename: `image-edit-${operation.variantIndex + 1}${imageExtension ?? ".bin"}`,
+        proxyBaseUrl
+      }) : null;
+      const view = buildTaskResultsView({
+        images: proxyUrl ? [
+          {
+            url: proxyUrl,
+            alt: `Corrected image ${operation.variantIndex + 1}`
+          }
+        ] : [],
+        videos: [],
+        links: []
+      }, proxyBaseUrl);
+      if (operation.status === "failed") view.state = "error";
+      else if (operation.status !== "published") view.state = "pending";
+      const deliveredUrl = view.images[0]?.url;
+      const response = {
+        ...operation,
+        ...deliveredUrl ? {
+          assetUrl: deliveredUrl
+        } : {}
+      };
+      return {
+        ...asText(response),
+        structuredContent: response,
+        _meta: {
+          taskResults: view
+        }
+      };
     } catch (error) {
       throw translateError(error);
     }
@@ -39417,7 +39503,7 @@ function registerProductControlTools(server, api, { transport = "http" } = {}) {
     }
   });
   server.registerTool("get_finances", {
-    description: getFinancesGuidance.summary + ' Contesta la pregunta que de verdad importa --- \xABeste negocio gana plata?\xBB --- con el mes armado: ventas totales y entregadas, fletes, costo de los productos, utilidad bruta, publicidad, gastos fijos y utilidad NETA. Esa utilidad es ANTES de impuestos y hay que decirlo asi: el contador es un gasto mas, no un calculo nuestro. Trae tambien los porcentajes contra sus metas. Si `deliveredSalesKnown` no es true, faltan importes de ventas entregadas: la utilidad y los m\xE1rgenes no est\xE1n completos. `grossSalesKnown` distinto de true indica ventas totales parciales. Si `costsKnown` viene en `false`, esos pedidos llegaron de una fuente que NO sabe cuanto costaron \u2014la tienda, o la API del proveedor\u2014 y la utilidad BRUTA esta incompleta: no es que el producto salga gratis. Si `adSpendKnown` viene en `false`, la publicidad NO se pudo leer y la utilidad esta INCOMPLETA: dilo antes de que alguien celebre un mes que perdio plata. `adSpendSource: "user"` significa que ella corrigio la cifra a mano, y eso se revisa distinto de una leida. Si `unconfirmedExpenses` es mayor que cero, ese monto viene heredado del mes pasado y ella no lo ha revisado. Es READ-ONLY: nunca pausa ni modifica una campana.',
+    description: getFinancesGuidance.summary + ' Contesta la pregunta que de verdad importa --- \xABeste negocio gana plata?\xBB --- con el mes armado: ventas totales y entregadas, fletes, costo de los productos, utilidad bruta, publicidad, gastos fijos y utilidad NETA. Esa utilidad es ANTES de impuestos y hay que decirlo asi: el contador es un gasto mas, no un calculo nuestro. Trae tambien los porcentajes contra sus metas. Si `deliveredSalesKnown` no es true, faltan importes de ventas entregadas: la utilidad y los m\xE1rgenes no est\xE1n completos. `grossSalesKnown` distinto de true indica ventas totales parciales. Si `costsKnown` viene en `false`, esos pedidos llegaron de una fuente que NO sabe cuanto costaron \u2014la tienda, o la API del proveedor\u2014 y la utilidad BRUTA esta incompleta: no es que el producto salga gratis. Si `adSpendKnown` viene en `false`, la publicidad NO se pudo leer y la utilidad esta INCOMPLETA: dilo antes de que alguien celebre un mes que perdio plata. `adSpendSource: "user"` significa que ella corrigio la cifra a mano, y eso se revisa distinto de una leida. Si `unconfirmedExpenses` es mayor que cero, ese monto viene heredado del mes pasado y ella no lo ha revisado. Es READ-ONLY: nunca pausa ni modifica una campana. Si viene `costEstimate` con `source: "product_costing"`, presenta sus importes como ESTIMACI\xD3N antes de impuestos, usando los costos actuales configurados del producto: no son costos reales confirmados de esos pedidos. Conserva el aviso de `costsKnown: false` y distingue esta estimaci\xF3n de los importes reales del libro. `linesEstimated` indica cu\xE1ntas l\xEDneas usan costos configurados. La API s\xF3lo ofrece esta estimaci\xF3n cuando cubre todos los costos faltantes con perfiles asociados del mismo pa\xEDs y moneda, y conoce ventas entregadas, publicidad y gastos revisados. Si `costEstimate` es null o no existe, no inventes una estimaci\xF3n ni completes importes faltantes.',
     inputSchema: GetFinancesInput.shape,
     annotations: READS_INTERNAL
   }, async (input) => {
@@ -39958,6 +40044,7 @@ function createServer(opts) {
   registerServiceImageTools(server, api);
   registerAnimatedVideoTools(server, api);
   registerCreativeTools(server, api, {
+    proxyBaseUrl,
     transport
   });
   registerCreativeVariantTools(server, api);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productmaker/mcp",
-  "version": "12.2.7",
+  "version": "12.3.0",
   "type": "module",
   "private": false,
   "description": "ProductMaker MCP server — cost products, generate landing pages, UGC videos, and ad creatives, and publish to Shopify, Meta Ads, and TikTok Ads.",
@@ -67,8 +67,8 @@
     "typescript": "^7.0.2",
     "vitest": "5.0.3",
     "@packages/product-economics": "0.1.0",
-    "@packages/types": "0.1.0",
-    "@packages/utils": "0.1.0"
+    "@packages/utils": "0.1.0",
+    "@packages/types": "0.1.0"
   },
   "publishConfig": {
     "access": "public"