@productmaker/mcp 3.0.0 → 3.0.2

package/dist/http.js

@@ -28,11 +28,11 @@ var ApiClient = class {
   static {
     __name(this, "ApiClient");
   }
-  baseUrl;
   apiKey;
+  baseUrl;
   constructor(baseUrl, apiKey) {
-    this.baseUrl = baseUrl;
     this.apiKey = apiKey;
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
   }
   authHeaders() {
     return {
@@ -48,6 +48,10 @@ var ApiClient = class {
   fingerprint() {
     return createHash("sha256").update(this.apiKey).digest("hex").slice(0, 32);
   }
+  publicUrl(path3) {
+    const normalizedPath = path3.startsWith("/") ? path3 : `/${path3}`;
+    return new URL(`${this.baseUrl}${normalizedPath}`).toString();
+  }
   async getJson(path3) {
     const res = await fetch(`${this.baseUrl}${path3}`, {
       headers: this.authHeaders()
@@ -157,7 +161,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "3.0.0";
+var MCP_VERSION = "3.0.2";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
@@ -167,12 +171,25 @@ var MEDIA_UPLOAD_APP_NAME = "ProductMaker media upload";
 var MEDIA_UPLOAD_APP_HTML_URL = new URL("./ui/meta-upload-app.html", import.meta.url);
 var MEDIA_UPLOAD_APP_CSP = {
   connectDomains: [
+    "https://api.productmaker.app",
     "https://productmaker.app",
     "https://www.productmaker.app",
     "https://*.r2.cloudflarestorage.com",
     "https://*.oaiusercontent.com"
   ]
 };
+function buildMediaUploadAppCsp(resolveEndpoint) {
+  const resolveOrigin = new URL(resolveEndpoint).origin;
+  return {
+    connectDomains: [
+      .../* @__PURE__ */ new Set([
+        ...MEDIA_UPLOAD_APP_CSP.connectDomains,
+        resolveOrigin
+      ])
+    ]
+  };
+}
+__name(buildMediaUploadAppCsp, "buildMediaUploadAppCsp");
 function readMediaUploadAppHtml(htmlUrl = MEDIA_UPLOAD_APP_HTML_URL) {
   try {
     return readFileSync(htmlUrl, "utf8");
@@ -182,14 +199,20 @@ function readMediaUploadAppHtml(htmlUrl = MEDIA_UPLOAD_APP_HTML_URL) {
   }
 }
 __name(readMediaUploadAppHtml, "readMediaUploadAppHtml");
-function registerMediaUploadAppResource(server) {
-  const html = readMediaUploadAppHtml();
+function renderMediaUploadAppHtml(resolveEndpoint) {
+  const encodedEndpoint = JSON.stringify(resolveEndpoint).slice(1, -1).replaceAll("<", "\\u003c");
+  return readMediaUploadAppHtml().replace("__PRODUCTMAKER_RESOLVE_ENDPOINT__", encodedEndpoint);
+}
+__name(renderMediaUploadAppHtml, "renderMediaUploadAppHtml");
+function registerMediaUploadAppResource(server, resolveEndpoint) {
+  const html = renderMediaUploadAppHtml(resolveEndpoint);
+  const csp = buildMediaUploadAppCsp(resolveEndpoint);
   registerAppResource(server, MEDIA_UPLOAD_APP_NAME, MEDIA_UPLOAD_APP_RESOURCE_URI, {
     title: "Upload media",
     mimeType: RESOURCE_MIME_TYPE,
     _meta: {
       ui: {
-        csp: MEDIA_UPLOAD_APP_CSP
+        csp
       }
     }
   }, async () => ({
@@ -200,7 +223,7 @@ function registerMediaUploadAppResource(server) {
         text: html,
         _meta: {
           ui: {
-            csp: MEDIA_UPLOAD_APP_CSP
+            csp
           }
         }
       }
@@ -8977,7 +9000,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "meta_upload_session"
   ], WHATSAPP_ONLY_CHANNEL_EXPOSURE),
-  defineCapability("request_media_upload", "794e9b279b49d0e818423fa4ae9f1a4a52689620abc3520380d7e86a3630380f", "none", "creative", [
+  defineCapability("request_media_upload", "d7ccfffe00f8563219fb3e036b07649ff59334e03fc52f6a2f3cb0823d4aa948", "none", "creative", [
     "state_change"
   ], [
     slot("media_kind", true, [
@@ -8986,6 +9009,9 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     slot("asset_role", false, [
       "assetRole"
     ], []),
+    slot("upload_purpose", false, [
+      "uploadPurpose"
+    ], []),
     slot("file_limit", false, [
       "maxFiles"
     ], []),
@@ -12324,6 +12350,11 @@ var UploadSessionInputBase = z54.object({
     "media",
     "thumbnail"
   ]).default("media").describe("Use media for the creative itself; thumbnail only for an image thumbnail."),
+  uploadPurpose: z54.enum([
+    "product_reference",
+    "creative",
+    "generic"
+  ]).default("generic").describe("The user's purpose for these files. Use product_reference for a product photo used by tasks or landings, creative for media that will become an ad or creative, and generic only when neither applies."),
   maxFiles: z54.number().int().min(1).max(10).optional().describe("Optional batch limit: image accepts 1-5, video exactly 1, and mixed 1-10.")
 });
 var OpenAiFileReference = z54.object({
@@ -12404,9 +12435,20 @@ var UniversalUploadStatusResponse = z54.discriminatedUnion("status", [
   })
 ]);
 var UniversalUploadStructuredResponse = UploadSessionResponse.extend({
+  uploadPurpose: z54.enum([
+    "product_reference",
+    "creative",
+    "generic"
+  ]),
   checkToolName: z54.literal("check_media_upload"),
-  resolveEndpoint: z54.literal("/api/upload-media/resolve")
+  resolveEndpoint: z54.string().url()
 });
+function contextualizeUploadPageUrl(uploadPageUrl, uploadPurpose) {
+  const url = new URL(uploadPageUrl);
+  url.searchParams.set("purpose", uploadPurpose);
+  return url.toString();
+}
+__name(contextualizeUploadPageUrl, "contextualizeUploadPageUrl");
 function uploadSessionText(result) {
   const mediaLabel = result.mediaKind === "mixed" ? "archivos" : result.mediaKind === "video" ? "video" : "imagen";
   return {
@@ -12424,10 +12466,14 @@ function uploadSessionText(result) {
   };
 }
 __name(uploadSessionText, "uploadSessionText");
+function resolveEndpointForSession(api) {
+  return api.publicUrl("/v1/uploaded-assets/sessions/resolve");
+}
+__name(resolveEndpointForSession, "resolveEndpointForSession");
 function registerMediaUploadTools(server, api) {
   registerAppTool(server, "request_media_upload", {
     title: "Subir archivos",
-    description: "Abre el selector universal de ProductMaker para im\xE1genes o videos del usuario. Ll\xE1malo autom\xE1ticamente cuando una petici\xF3n natural adjunte o mencione un archivo local, por ejemplo \u2018crea una landing con este producto\u2019, \u2018haz creativos con esta foto\u2019 o \u2018sube este video a Meta\u2019; no pidas una ruta local ni URL. Es la \xFAnica ruta de carga para create_product_task, generate_image_creatives, generate_video_creative, generate_free_video, generate_landing y publish_creatives_to_meta. Pasa las referencias opcionales de ChatGPT en files; si el host no puede transferirlas, el mismo App muestra el selector inline. Usa mediaKind=image para referencias de producto y landings; mixed solo cuando el consumidor acepte ambos tipos. Tras OK, reanuda la intenci\xF3n original usando \xFAnicamente assetId y mediaKind, sin pedir que vuelva a subir ni mostrar datos t\xE9cnicos. El enlace externo es fallback solo si el App inline falla. Esta herramienta no genera, publica ni consume cr\xE9ditos.",
+    description: "Abre el selector universal de ProductMaker para im\xE1genes o videos del usuario. Ll\xE1malo autom\xE1ticamente y antes de preguntar por campos faltantes cuando una petici\xF3n natural adjunte o mencione un archivo local, por ejemplo \u2018crea una landing con este producto\u2019, \u2018haz creativos con esta foto\u2019 o \u2018sube este video a Meta\u2019; hazlo aunque el usuario diga que todav\xEDa no generes ni publiques, porque esta herramienta solo prepara el archivo y no consume cr\xE9ditos, salvo que proh\xEDba expl\xEDcitamente subir, compartir o almacenar el archivo; no pidas una ruta local ni URL. Es la \xFAnica ruta de carga para create_product_task, generate_image_creatives, generate_video_creative, generate_free_video, generate_landing y publish_creatives_to_meta. Pasa las referencias opcionales de ChatGPT en files; si el host no puede transferirlas, el mismo App muestra el selector inline. Usa uploadPurpose=product_reference para fotos de producto y landings, creative para creativos o anuncios, y generic solo cuando ninguno aplique. Usa mediaKind=image para referencias de producto y landings; mixed solo cuando el consumidor acepte ambos tipos. Tras OK, reanuda la intenci\xF3n original usando \xFAnicamente assetId y mediaKind, sin pedir que vuelva a subir ni mostrar datos t\xE9cnicos. El enlace externo es fallback solo si el App inline falla. Esta herramienta no genera, publica ni consume cr\xE9ditos.",
     inputSchema: UploadSessionToolInputShape,
     outputSchema: UniversalUploadStructuredResponse.shape,
     _meta: {
@@ -12449,12 +12495,14 @@ function registerMediaUploadTools(server, api) {
   }, async (rawInput) => {
     try {
       const input = UploadSessionToolInput.parse(rawInput);
-      const { files: _files, ...sessionInput } = input;
+      const { files: _files, uploadPurpose, ...sessionInput } = input;
       const session = UploadSessionResponse.parse(await api.postJson("/v1/uploaded-assets/sessions", sessionInput));
       const result = UniversalUploadStructuredResponse.parse({
         ...session,
+        uploadPageUrl: contextualizeUploadPageUrl(session.uploadPageUrl, uploadPurpose),
+        uploadPurpose,
         checkToolName: "check_media_upload",
-        resolveEndpoint: "/api/upload-media/resolve"
+        resolveEndpoint: resolveEndpointForSession(api)
       });
       return {
         structuredContent: result,
@@ -13544,8 +13592,8 @@ __name(registerDropshippingProjectTools, "registerDropshippingProjectTools");
 // src/guidance/productmaker-guidance.ts
 var START_DROPSHIPPING_PROMPT_NAME = "start_dropshipping";
 var PRODUCTMAKER_SERVER_INSTRUCTIONS = [
-  "Understand the user's intent before choosing a ProductMaker tool.",
-  "When a ProductMaker request needs an image or video the user attached, pasted, or has locally and no reusable ProductMaker assetId is already available, call request_media_upload immediately. Treat natural requests such as 'create a landing with this product', 'make creatives with this photo', or 'upload this video to Meta' as upload intent; never require the user to name the uploader.",
+  "When a ProductMaker request needs an image or video the user attached, pasted, or has locally and no reusable ProductMaker assetId is already available, call request_media_upload immediately before asking for any missing business inputs. Do this even when the user says not to generate or publish yet: uploading only stages the file and does not generate, publish, or consume credits, unless the user explicitly says not to upload, share, or store the file. Treat natural requests such as 'create a landing with this product', 'make creatives with this photo', or 'upload this video to Meta' as upload intent; never require the user to name the uploader.",
+  "For requests that do not need a new media upload, understand the user's intent before choosing a ProductMaker tool.",
   "For remote MCP hosts, never ask for a local path, CDN URL, bytes, or base64. Pass supported host file references to request_media_upload; otherwise let its inline App open the file picker. The external upload page is fallback only.",
   "After the upload App sends its OK continuation, resume the original request with the verified assetId values, do not ask for another upload, and ask only for remaining business inputs in chat. The host-inserted continuation may contain opaque asset IDs; do not repeat them in narrative prose or expose session IDs, tokens, private URLs, file names, or JSON handoff payloads.",
   "Keep focused requests direct: creatives, landing pages, Shopify publication, Meta publication, and status checks do not require a DropshippingProject.",
@@ -13612,7 +13660,7 @@ function createServer(opts) {
   });
   const api = new ApiClient(apiBaseUrl, apiKey);
   registerProductMakerPrompts(server);
-  registerMediaUploadAppResource(server);
+  registerMediaUploadAppResource(server, api.publicUrl("/v1/uploaded-assets/sessions/resolve"));
   registerProductCostingTools(server);
   registerProductResearchTools(server, api);
   registerDropshippingProjectTools(server, api);
@@ -13647,6 +13695,9 @@ function assertSafePublicBaseUrl(envName, url) {
   if (u.protocol !== "https:") {
     throw new Error(`${envName} must use https (got ${u.protocol})`);
   }
+  if (u.username || u.password || u.search || u.hash) {
+    throw new Error(`${envName} must not contain credentials, query parameters, or fragments`);
+  }
   if (isPrivateHost(u.hostname)) {
     throw new Error(`${envName} must not point to a private/loopback host: ${u.hostname}`);
   }

package/dist/stdio.js

@@ -25,11 +25,11 @@ var ApiClient = class {
   static {
     __name(this, "ApiClient");
   }
-  baseUrl;
   apiKey;
+  baseUrl;
   constructor(baseUrl, apiKey) {
-    this.baseUrl = baseUrl;
     this.apiKey = apiKey;
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
   }
   authHeaders() {
     return {
@@ -45,6 +45,10 @@ var ApiClient = class {
   fingerprint() {
     return createHash("sha256").update(this.apiKey).digest("hex").slice(0, 32);
   }
+  publicUrl(path3) {
+    const normalizedPath = path3.startsWith("/") ? path3 : `/${path3}`;
+    return new URL(`${this.baseUrl}${normalizedPath}`).toString();
+  }
   async getJson(path3) {
     const res = await fetch(`${this.baseUrl}${path3}`, {
       headers: this.authHeaders()
@@ -154,7 +158,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "3.0.0";
+var MCP_VERSION = "3.0.2";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
@@ -164,12 +168,25 @@ var MEDIA_UPLOAD_APP_NAME = "ProductMaker media upload";
 var MEDIA_UPLOAD_APP_HTML_URL = new URL("./ui/meta-upload-app.html", import.meta.url);
 var MEDIA_UPLOAD_APP_CSP = {
   connectDomains: [
+    "https://api.productmaker.app",
     "https://productmaker.app",
     "https://www.productmaker.app",
     "https://*.r2.cloudflarestorage.com",
     "https://*.oaiusercontent.com"
   ]
 };
+function buildMediaUploadAppCsp(resolveEndpoint) {
+  const resolveOrigin = new URL(resolveEndpoint).origin;
+  return {
+    connectDomains: [
+      .../* @__PURE__ */ new Set([
+        ...MEDIA_UPLOAD_APP_CSP.connectDomains,
+        resolveOrigin
+      ])
+    ]
+  };
+}
+__name(buildMediaUploadAppCsp, "buildMediaUploadAppCsp");
 function readMediaUploadAppHtml(htmlUrl = MEDIA_UPLOAD_APP_HTML_URL) {
   try {
     return readFileSync(htmlUrl, "utf8");
@@ -179,14 +196,20 @@ function readMediaUploadAppHtml(htmlUrl = MEDIA_UPLOAD_APP_HTML_URL) {
   }
 }
 __name(readMediaUploadAppHtml, "readMediaUploadAppHtml");
-function registerMediaUploadAppResource(server) {
-  const html = readMediaUploadAppHtml();
+function renderMediaUploadAppHtml(resolveEndpoint) {
+  const encodedEndpoint = JSON.stringify(resolveEndpoint).slice(1, -1).replaceAll("<", "\\u003c");
+  return readMediaUploadAppHtml().replace("__PRODUCTMAKER_RESOLVE_ENDPOINT__", encodedEndpoint);
+}
+__name(renderMediaUploadAppHtml, "renderMediaUploadAppHtml");
+function registerMediaUploadAppResource(server, resolveEndpoint) {
+  const html = renderMediaUploadAppHtml(resolveEndpoint);
+  const csp = buildMediaUploadAppCsp(resolveEndpoint);
   registerAppResource(server, MEDIA_UPLOAD_APP_NAME, MEDIA_UPLOAD_APP_RESOURCE_URI, {
     title: "Upload media",
     mimeType: RESOURCE_MIME_TYPE,
     _meta: {
       ui: {
-        csp: MEDIA_UPLOAD_APP_CSP
+        csp
       }
     }
   }, async () => ({
@@ -197,7 +220,7 @@ function registerMediaUploadAppResource(server) {
         text: html,
         _meta: {
           ui: {
-            csp: MEDIA_UPLOAD_APP_CSP
+            csp
           }
         }
       }
@@ -8974,7 +8997,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "meta_upload_session"
   ], WHATSAPP_ONLY_CHANNEL_EXPOSURE),
-  defineCapability("request_media_upload", "794e9b279b49d0e818423fa4ae9f1a4a52689620abc3520380d7e86a3630380f", "none", "creative", [
+  defineCapability("request_media_upload", "d7ccfffe00f8563219fb3e036b07649ff59334e03fc52f6a2f3cb0823d4aa948", "none", "creative", [
     "state_change"
   ], [
     slot("media_kind", true, [
@@ -8983,6 +9006,9 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     slot("asset_role", false, [
       "assetRole"
     ], []),
+    slot("upload_purpose", false, [
+      "uploadPurpose"
+    ], []),
     slot("file_limit", false, [
       "maxFiles"
     ], []),
@@ -12280,6 +12306,11 @@ var UploadSessionInputBase = z54.object({
     "media",
     "thumbnail"
   ]).default("media").describe("Use media for the creative itself; thumbnail only for an image thumbnail."),
+  uploadPurpose: z54.enum([
+    "product_reference",
+    "creative",
+    "generic"
+  ]).default("generic").describe("The user's purpose for these files. Use product_reference for a product photo used by tasks or landings, creative for media that will become an ad or creative, and generic only when neither applies."),
   maxFiles: z54.number().int().min(1).max(10).optional().describe("Optional batch limit: image accepts 1-5, video exactly 1, and mixed 1-10.")
 });
 var OpenAiFileReference = z54.object({
@@ -12360,9 +12391,20 @@ var UniversalUploadStatusResponse = z54.discriminatedUnion("status", [
   })
 ]);
 var UniversalUploadStructuredResponse = UploadSessionResponse.extend({
+  uploadPurpose: z54.enum([
+    "product_reference",
+    "creative",
+    "generic"
+  ]),
   checkToolName: z54.literal("check_media_upload"),
-  resolveEndpoint: z54.literal("/api/upload-media/resolve")
+  resolveEndpoint: z54.string().url()
 });
+function contextualizeUploadPageUrl(uploadPageUrl, uploadPurpose) {
+  const url = new URL(uploadPageUrl);
+  url.searchParams.set("purpose", uploadPurpose);
+  return url.toString();
+}
+__name(contextualizeUploadPageUrl, "contextualizeUploadPageUrl");
 function uploadSessionText(result) {
   const mediaLabel = result.mediaKind === "mixed" ? "archivos" : result.mediaKind === "video" ? "video" : "imagen";
   return {
@@ -12380,10 +12422,14 @@ function uploadSessionText(result) {
   };
 }
 __name(uploadSessionText, "uploadSessionText");
+function resolveEndpointForSession(api) {
+  return api.publicUrl("/v1/uploaded-assets/sessions/resolve");
+}
+__name(resolveEndpointForSession, "resolveEndpointForSession");
 function registerMediaUploadTools(server, api) {
   registerAppTool(server, "request_media_upload", {
     title: "Subir archivos",
-    description: "Abre el selector universal de ProductMaker para im\xE1genes o videos del usuario. Ll\xE1malo autom\xE1ticamente cuando una petici\xF3n natural adjunte o mencione un archivo local, por ejemplo \u2018crea una landing con este producto\u2019, \u2018haz creativos con esta foto\u2019 o \u2018sube este video a Meta\u2019; no pidas una ruta local ni URL. Es la \xFAnica ruta de carga para create_product_task, generate_image_creatives, generate_video_creative, generate_free_video, generate_landing y publish_creatives_to_meta. Pasa las referencias opcionales de ChatGPT en files; si el host no puede transferirlas, el mismo App muestra el selector inline. Usa mediaKind=image para referencias de producto y landings; mixed solo cuando el consumidor acepte ambos tipos. Tras OK, reanuda la intenci\xF3n original usando \xFAnicamente assetId y mediaKind, sin pedir que vuelva a subir ni mostrar datos t\xE9cnicos. El enlace externo es fallback solo si el App inline falla. Esta herramienta no genera, publica ni consume cr\xE9ditos.",
+    description: "Abre el selector universal de ProductMaker para im\xE1genes o videos del usuario. Ll\xE1malo autom\xE1ticamente y antes de preguntar por campos faltantes cuando una petici\xF3n natural adjunte o mencione un archivo local, por ejemplo \u2018crea una landing con este producto\u2019, \u2018haz creativos con esta foto\u2019 o \u2018sube este video a Meta\u2019; hazlo aunque el usuario diga que todav\xEDa no generes ni publiques, porque esta herramienta solo prepara el archivo y no consume cr\xE9ditos, salvo que proh\xEDba expl\xEDcitamente subir, compartir o almacenar el archivo; no pidas una ruta local ni URL. Es la \xFAnica ruta de carga para create_product_task, generate_image_creatives, generate_video_creative, generate_free_video, generate_landing y publish_creatives_to_meta. Pasa las referencias opcionales de ChatGPT en files; si el host no puede transferirlas, el mismo App muestra el selector inline. Usa uploadPurpose=product_reference para fotos de producto y landings, creative para creativos o anuncios, y generic solo cuando ninguno aplique. Usa mediaKind=image para referencias de producto y landings; mixed solo cuando el consumidor acepte ambos tipos. Tras OK, reanuda la intenci\xF3n original usando \xFAnicamente assetId y mediaKind, sin pedir que vuelva a subir ni mostrar datos t\xE9cnicos. El enlace externo es fallback solo si el App inline falla. Esta herramienta no genera, publica ni consume cr\xE9ditos.",
     inputSchema: UploadSessionToolInputShape,
     outputSchema: UniversalUploadStructuredResponse.shape,
     _meta: {
@@ -12405,12 +12451,14 @@ function registerMediaUploadTools(server, api) {
   }, async (rawInput) => {
     try {
       const input = UploadSessionToolInput.parse(rawInput);
-      const { files: _files, ...sessionInput } = input;
+      const { files: _files, uploadPurpose, ...sessionInput } = input;
       const session = UploadSessionResponse.parse(await api.postJson("/v1/uploaded-assets/sessions", sessionInput));
       const result = UniversalUploadStructuredResponse.parse({
         ...session,
+        uploadPageUrl: contextualizeUploadPageUrl(session.uploadPageUrl, uploadPurpose),
+        uploadPurpose,
         checkToolName: "check_media_upload",
-        resolveEndpoint: "/api/upload-media/resolve"
+        resolveEndpoint: resolveEndpointForSession(api)
       });
       return {
         structuredContent: result,
@@ -13500,8 +13548,8 @@ __name(registerDropshippingProjectTools, "registerDropshippingProjectTools");
 // src/guidance/productmaker-guidance.ts
 var START_DROPSHIPPING_PROMPT_NAME = "start_dropshipping";
 var PRODUCTMAKER_SERVER_INSTRUCTIONS = [
-  "Understand the user's intent before choosing a ProductMaker tool.",
-  "When a ProductMaker request needs an image or video the user attached, pasted, or has locally and no reusable ProductMaker assetId is already available, call request_media_upload immediately. Treat natural requests such as 'create a landing with this product', 'make creatives with this photo', or 'upload this video to Meta' as upload intent; never require the user to name the uploader.",
+  "When a ProductMaker request needs an image or video the user attached, pasted, or has locally and no reusable ProductMaker assetId is already available, call request_media_upload immediately before asking for any missing business inputs. Do this even when the user says not to generate or publish yet: uploading only stages the file and does not generate, publish, or consume credits, unless the user explicitly says not to upload, share, or store the file. Treat natural requests such as 'create a landing with this product', 'make creatives with this photo', or 'upload this video to Meta' as upload intent; never require the user to name the uploader.",
+  "For requests that do not need a new media upload, understand the user's intent before choosing a ProductMaker tool.",
   "For remote MCP hosts, never ask for a local path, CDN URL, bytes, or base64. Pass supported host file references to request_media_upload; otherwise let its inline App open the file picker. The external upload page is fallback only.",
   "After the upload App sends its OK continuation, resume the original request with the verified assetId values, do not ask for another upload, and ask only for remaining business inputs in chat. The host-inserted continuation may contain opaque asset IDs; do not repeat them in narrative prose or expose session IDs, tokens, private URLs, file names, or JSON handoff payloads.",
   "Keep focused requests direct: creatives, landing pages, Shopify publication, Meta publication, and status checks do not require a DropshippingProject.",
@@ -13568,7 +13616,7 @@ function createServer(opts) {
   });
   const api = new ApiClient(apiBaseUrl, apiKey);
   registerProductMakerPrompts(server);
-  registerMediaUploadAppResource(server);
+  registerMediaUploadAppResource(server, api.publicUrl("/v1/uploaded-assets/sessions/resolve"));
   registerProductCostingTools(server);
   registerProductResearchTools(server, api);
   registerDropshippingProjectTools(server, api);
@@ -13603,6 +13651,9 @@ function assertSafePublicBaseUrl(envName, url) {
   if (u.protocol !== "https:") {
     throw new Error(`${envName} must use https (got ${u.protocol})`);
   }
+  if (u.username || u.password || u.search || u.hash) {
+    throw new Error(`${envName} must not contain credentials, query parameters, or fragments`);
+  }
   if (isPrivateHost(u.hostname)) {
     throw new Error(`${envName} must not point to a private/loopback host: ${u.hostname}`);
   }

package/dist/ui/meta-upload-app.html

@@ -147,6 +147,13 @@
         padding: 18px;
       }
 
+      .upload-prompt {
+        margin: 0 0 12px;
+        color: var(--pm-text);
+        font-size: 15px;
+        font-weight: 700;
+      }
+
       .media-grid {
         display: grid;
         grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));
@@ -435,6 +442,9 @@
     <main class="app" data-testid="meta-upload-root">
       <article class="card">
         <section class="section" aria-label="Upload media">
+          <p class="upload-prompt" data-testid="meta-upload-prompt">
+            Sube tus archivos
+          </p>
           <div class="media-grid">
             <div
               class="file-list"
@@ -535,7 +545,6 @@
         const MAX_FILES = 10;
         const MAX_FILE_SIZE_BYTES = 350 * 1024 * 1024;
         const MAX_VIDEO_DURATION_SECONDS = 180;
-        const MIN_DIMENSION = 600;
         const IMAGE_COMPRESSION_THRESHOLD_BYTES = 1.8 * 1024 * 1024;
         const IMAGE_COMPRESSION_MAX_BYTES = 1.8 * 1024 * 1024;
         const IMAGE_MAX_DIMENSION = 2048;
@@ -543,6 +552,7 @@
         const TOOL_RESULT_TEXT_LIMIT = 100000;
         const RPC_TIMEOUT_MS = 15000;
         const APP_PROTOCOL_VERSION = "2026-01-26";
+        const CONFIGURED_RESOLVE_ENDPOINT = "__PRODUCTMAKER_RESOLVE_ENDPOINT__";
 
         const elements = {
           root: document.querySelector('[data-testid="meta-upload-root"]'),
@@ -568,6 +578,9 @@
           completeButton: document.querySelector(
             '[data-testid="meta-upload-complete-btn"]',
           ),
+          uploadPrompt: document.querySelector(
+            '[data-testid="meta-upload-prompt"]',
+          ),
           fileList: document.querySelector(
             '[data-testid="meta-upload-file-list"]',
           ),
@@ -1156,6 +1169,7 @@
             }
           }
           state.session = session;
+          elements.uploadPrompt.textContent = uploadPromptForSession(session);
           elements.fallbackLink.href = session.uploadPageUrl;
           if (sessionExpired()) {
             requireFallback(
@@ -1178,6 +1192,7 @@
           const uploadPageUrl = boundedString(candidate.uploadPageUrl, 2000);
           const mediaKind = candidate.mediaKind;
           const assetRole = candidate.assetRole;
+          const uploadPurpose = candidate.uploadPurpose;
           const expiresAt = boundedString(candidate.expiresAt, 100);
           const checkToolName = "check_media_upload";
           const resolveEndpoint =
@@ -1189,7 +1204,10 @@
           if (!Number.isInteger(candidate.maxFiles) || !expiresAt) return null;
           try {
             const parsedUrl = new URL(uploadPageUrl);
-            if (!safeUploadPageUrl(parsedUrl)) return null;
+            const parsedResolveUrl = new URL(resolveEndpoint, parsedUrl.origin);
+            if (!safeResolveEndpointUrl(parsedResolveUrl, parsedUrl))
+              return null;
+            if (!safeUploadPageUrl(parsedUrl, parsedResolveUrl)) return null;
           } catch {
             return null;
           }
@@ -1198,6 +1216,11 @@
             uploadPageUrl,
             mediaKind,
             assetRole,
+            uploadPurpose:
+              uploadPurpose === "product_reference" ||
+              uploadPurpose === "creative"
+                ? uploadPurpose
+                : "generic",
             maxFiles: candidate.maxFiles,
             expiresAt,
             checkToolName,
@@ -1205,6 +1228,26 @@
           };
         }
 
+        function uploadPromptForSession(session) {
+          if (session.uploadPurpose === "product_reference") {
+            return session.mediaKind === "image"
+              ? "Sube la foto del producto"
+              : session.mediaKind === "video"
+                ? "Sube el video del producto"
+                : "Sube los archivos del producto";
+          }
+          if (session.uploadPurpose === "creative") {
+            return session.mediaKind === "video"
+              ? "Sube tu video creativo"
+              : "Sube tus creativos";
+          }
+          return session.mediaKind === "image"
+            ? "Sube tus imágenes"
+            : session.mediaKind === "video"
+              ? "Sube tu video"
+              : "Sube tus archivos";
+        }
+
         function mergeToolInput(input) {
           state.toolInput = { ...state.toolInput, ...input };
           void consumePendingBridgeFiles();
@@ -1630,15 +1673,6 @@
             mediaKind === "image"
               ? await inspectImage(file)
               : await inspectVideo(file);
-          if (
-            inspection.width < MIN_DIMENSION ||
-            inspection.height < MIN_DIMENSION
-          ) {
-            throw validationError(
-              "low_resolution",
-              "La resolución mínima es 600 × 600 px.",
-            );
-          }
           if (
             mediaKind === "video" &&
             inspection.durationSeconds > MAX_VIDEO_DURATION_SECONDS
@@ -1747,12 +1781,6 @@
             const canvas = document.createElement("canvas");
             canvas.width = Math.max(1, Math.round(inspection.width * scale));
             canvas.height = Math.max(1, Math.round(inspection.height * scale));
-            if (canvas.width < MIN_DIMENSION || canvas.height < MIN_DIMENSION) {
-              throw validationError(
-                "low_resolution",
-                "La resolución mínima final es 600 × 600 px.",
-              );
-            }
             const context = canvas.getContext("2d", {
               alpha: file.type !== "image/jpeg",
             });
@@ -1848,17 +1876,28 @@
           }
           const error = new Error("upload_failed");
           error.safeCode = "upload_failed";
-          error.safeMessage =
-            "La carga falló tras 3 intentos. Puedes reintentarla.";
           error.safeStage =
             lastError && lastError.safeStage ? lastError.safeStage : "upload";
+          error.safeMessage =
+            error.safeStage === "resolve"
+              ? "No pudimos preparar la carga. Reintenta o abre la carga segura."
+              : error.safeStage === "put"
+                ? "No pudimos enviar el archivo al almacenamiento. Reintenta o abre la carga segura."
+                : "La carga falló tras 3 intentos. Puedes reintentarla.";
           throw error;
         }
 
         async function resolveUpload(file, uploadId) {
           const uploadPage = new URL(state.session.uploadPageUrl);
-          if (!safeUploadPageUrl(uploadPage))
-            throw new Error("unsafe_upload_page");
+          const resolveUrl = new URL(
+            state.session.resolveEndpoint,
+            uploadPage.origin,
+          );
+          if (
+            !safeResolveEndpointUrl(resolveUrl, uploadPage) ||
+            !safeUploadPageUrl(uploadPage, resolveUrl)
+          )
+            throw new Error("unsafe_upload_session");
           const token =
             uploadPage.searchParams.get("token") ||
             new URLSearchParams(uploadPage.hash.slice(1)).get("token");
@@ -1867,10 +1906,6 @@
             error.safeStage = "resolve";
             throw error;
           }
-          const resolveUrl = new URL(
-            state.session.resolveEndpoint,
-            uploadPage.origin,
-          );
           const response = await fetch(resolveUrl.toString(), {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -1882,6 +1917,7 @@
               fileSize: file.size,
             }),
             credentials: "omit",
+            redirect: "error",
             signal: activeAbortSignal(),
           });
           if (!response.ok) {
@@ -1947,7 +1983,7 @@
           );
         }
 
-        function safeUploadPageUrl(url) {
+        function safeUploadPageUrl(url, resolveUrl) {
           if (url.username || url.password) return false;
           if (
             [
@@ -1957,11 +1993,38 @@
           )
             return true;
           return (
-            url.protocol === "http:" &&
-            ["localhost", "127.0.0.1", "::1"].includes(url.hostname)
+            (url.protocol === "http:" &&
+              ["localhost", "127.0.0.1", "::1"].includes(url.hostname)) ||
+            (url.protocol === "https:" &&
+              /^\/(?:[a-z]{2}\/)?upload-media\/?$/.test(url.pathname) &&
+              isConfiguredResolveEndpoint(resolveUrl))
+          );
+        }
+
+        function isConfiguredResolveEndpoint(url) {
+          return (
+            /^https?:\/\//.test(CONFIGURED_RESOLVE_ENDPOINT) &&
+            url.toString() === CONFIGURED_RESOLVE_ENDPOINT
           );
         }
 
+        function safeResolveEndpointUrl(url, uploadPageUrl) {
+          if (url.username || url.password) return false;
+          if (url.search || url.hash) return false;
+          const officialApi =
+            url.origin === "https://api.productmaker.app" &&
+            url.pathname === "/v1/uploaded-assets/sessions/resolve";
+          const sameOriginWebProxy =
+            url.origin === uploadPageUrl.origin &&
+            url.pathname === "/api/upload-media/resolve";
+          const localApi =
+            url.protocol === "http:" &&
+            ["localhost", "127.0.0.1", "::1"].includes(url.hostname) &&
+            url.pathname === "/v1/uploaded-assets/sessions/resolve";
+          const configuredApi = isConfiguredResolveEndpoint(url);
+          return officialApi || sameOriginWebProxy || localApi || configuredApi;
+        }
+
         function putFileWithProgress(url, file, onProgress) {
           return new Promise((resolve, reject) => {
             const request = new XMLHttpRequest();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productmaker/mcp",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "type": "module",
   "private": false,
   "description": "Product Maker MCP server — cost products, generate dropshipping landing pages, UGC videos, and ad creatives, and publish to Shopify and Meta Ads from Claude, ChatGPT, or Gemini.",
@@ -65,8 +65,8 @@
     "typescript": "^7.0.2",
     "vitest": "^2.1.9",
     "@packages/product-economics": "0.1.0",
-    "@packages/types": "0.1.0",
-    "@packages/product-research": "0.1.0"
+    "@packages/product-research": "0.1.0",
+    "@packages/types": "0.1.0"
   },
   "publishConfig": {
     "access": "public"