@productmaker/mcp 3.1.0 → 3.1.1

package/dist/stdio.js

@@ -5,11 +5,88 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 // src/stdio.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/auth/downstream-credential.ts
+import { createHash } from "crypto";
+var StaticApiKeyCredential = class {
+  static {
+    __name(this, "StaticApiKeyCredential");
+  }
+  apiKey;
+  constructor(apiKey) {
+    this.apiKey = apiKey;
+  }
+  async getAccessToken() {
+    return this.apiKey;
+  }
+  fingerprint() {
+    return createHash("sha256").update(this.apiKey).digest("hex").slice(0, 32);
+  }
+};
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
+// src/response-body.ts
+var ResponseBodyTooLargeError = class extends Error {
+  static {
+    __name(this, "ResponseBodyTooLargeError");
+  }
+  maxBytes;
+  constructor(maxBytes) {
+    super(`Response body exceeds the ${maxBytes}-byte limit`), this.maxBytes = maxBytes;
+    this.name = "ResponseBodyTooLargeError";
+  }
+};
+function cancelResponseBody(response) {
+  if (!response.body) return;
+  void response.body.cancel().catch(() => void 0);
+}
+__name(cancelResponseBody, "cancelResponseBody");
+async function readResponseBytes(response, maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError("maxBytes must be a positive safe integer");
+  }
+  if (!response.body) return new Uint8Array();
+  const contentLength = response.headers.get("content-length");
+  const declaredLength = contentLength === null ? NaN : Number(contentLength);
+  if (Number.isSafeInteger(declaredLength) && declaredLength > maxBytes) {
+    cancelResponseBody(response);
+    throw new ResponseBodyTooLargeError(maxBytes);
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        throw new ResponseBodyTooLargeError(maxBytes);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+__name(readResponseBytes, "readResponseBytes");
+async function readResponseText(response, maxBytes) {
+  return new TextDecoder().decode(await readResponseBytes(response, maxBytes));
+}
+__name(readResponseText, "readResponseText");
+
 // src/api-client.ts
-import { createHash } from "crypto";
+var DOWNSTREAM_REQUEST_TIMEOUT_MS = 3e4;
+var MAX_DOWNSTREAM_RESPONSE_BYTES = 1048576;
 var ApiHttpError = class extends Error {
   static {
     __name(this, "ApiHttpError");
@@ -25,88 +102,95 @@ var ApiClient = class {
   static {
     __name(this, "ApiClient");
   }
-  apiKey;
   baseUrl;
-  constructor(baseUrl, apiKey) {
-    this.apiKey = apiKey;
+  credential;
+  signal;
+  requestTimeoutMs;
+  constructor(baseUrl, credential, options = {}) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.credential = credential;
+    this.signal = options.signal;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DOWNSTREAM_REQUEST_TIMEOUT_MS;
   }
-  authHeaders() {
+  async authHeaders() {
     return {
-      Authorization: `Bearer ${this.apiKey}`
+      Authorization: `Bearer ${await this.credential.getAccessToken()}`
     };
   }
   /**
-  * Stable per-key identifier. The MCP never sees the userId — the API key is
-  * the only per-user handle it holds — so this stands in as the user
-  * component of derived idempotency keys. Never log or return it raw to a
-  * caller: it is derived from a secret.
+  * Stable per-credential identifier. The MCP never sees the userId, so this
+  * stands in as the user component of derived idempotency keys. Never log or
+  * return the raw credential material to a caller: implementations hash or
+  * otherwise derive a safe fingerprint.
   */
   fingerprint() {
-    return createHash("sha256").update(this.apiKey).digest("hex").slice(0, 32);
+    return this.credential.fingerprint();
   }
   publicUrl(path3) {
     const normalizedPath = path3.startsWith("/") ? path3 : `/${path3}`;
     return new URL(`${this.baseUrl}${normalizedPath}`).toString();
   }
-  async getJson(path3) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
-      headers: this.authHeaders()
-    });
+  async getJson(path3, options) {
+    const res = await this.request(`${this.baseUrl}${path3}`, {
+      headers: await this.authHeaders()
+    }, options);
     return this.parse(res);
   }
-  async postJson(path3, body) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async postJson(path3, body, options) {
+    const authHeaders = await this.authHeaders();
+    const res = await this.request(`${this.baseUrl}${path3}`, {
       method: "POST",
       headers: {
-        ...this.authHeaders(),
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify(body)
-    });
+    }, options);
     return this.parse(res);
   }
-  async patchJson(path3, body) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async patchJson(path3, body, options) {
+    const authHeaders = await this.authHeaders();
+    const res = await this.request(`${this.baseUrl}${path3}`, {
       method: "PATCH",
       headers: {
-        ...this.authHeaders(),
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify(body)
-    });
+    }, options);
     return this.parse(res);
   }
-  async putJson(path3, body) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async putJson(path3, body, options) {
+    const authHeaders = await this.authHeaders();
+    const res = await this.request(`${this.baseUrl}${path3}`, {
       method: "PUT",
       headers: {
-        ...this.authHeaders(),
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify(body)
-    });
+    }, options);
     return this.parse(res);
   }
-  async deleteJson(path3) {
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+  async deleteJson(path3, options) {
+    const res = await this.request(`${this.baseUrl}${path3}`, {
       method: "DELETE",
-      headers: this.authHeaders()
-    });
+      headers: await this.authHeaders()
+    }, options);
     return this.parse(res);
   }
   /** Upload bytes to a presigned URL; the URL itself does not need API auth. */
-  async putBytes(url, body, contentType) {
-    const res = await fetch(url, {
+  async putBytes(url, body, contentType, options) {
+    const res = await this.request(url, {
       method: "PUT",
       headers: {
         "Content-Type": contentType,
         "Content-Length": String(body.byteLength)
       },
       body: new Uint8Array(body)
-    });
+    }, options);
     if (!res.ok) {
-      throw new ApiHttpError(res.status, await res.text().catch(() => ""), `HTTP ${res.status} uploading media`);
+      throw new ApiHttpError(res.status, await readResponseText(res, MAX_DOWNSTREAM_RESPONSE_BYTES).catch(() => ""), `HTTP ${res.status} uploading media`);
     }
   }
   async postMultipart(path3, files, fields, options) {
@@ -131,39 +215,62 @@ var ApiClient = class {
         form.append(k, v);
       }
     }
-    const res = await fetch(`${this.baseUrl}${path3}`, {
+    const authHeaders = await this.authHeaders();
+    const res = await this.request(`${this.baseUrl}${path3}`, {
       method: "POST",
       headers: {
-        ...this.authHeaders(),
+        ...authHeaders,
         ...options?.idempotencyKey ? {
           "Idempotency-Key": options.idempotencyKey
         } : {}
       },
       body: form
-    });
+    }, options);
     return this.parse(res);
   }
+  request(input, init, options) {
+    const signals = [
+      AbortSignal.timeout(this.requestTimeoutMs),
+      this.signal,
+      options?.signal
+    ].filter((signal2) => signal2 !== void 0);
+    const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    return fetch(input, {
+      ...init,
+      signal
+    });
+  }
   async parse(res) {
+    let bodyText;
+    try {
+      bodyText = await readResponseText(res, MAX_DOWNSTREAM_RESPONSE_BYTES);
+    } catch (error) {
+      if (!res.ok) {
+        throw new ApiHttpError(res.status, "[response body unavailable]", `HTTP ${res.status} from ${res.url}`);
+      }
+      throw error;
+    }
     if (!res.ok) {
       let body;
       try {
-        body = await res.json();
+        body = JSON.parse(bodyText);
       } catch {
-        body = await res.text().catch(() => "");
+        body = bodyText;
       }
       throw new ApiHttpError(res.status, body, `HTTP ${res.status} from ${res.url}`);
     }
-    return await res.json();
+    return JSON.parse(bodyText);
   }
 };
 
 // src/index.ts
-var MCP_VERSION = "3.1.0";
+var MCP_VERSION = "3.1.1";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
 import { registerAppResource, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
 var MEDIA_UPLOAD_APP_RESOURCE_URI = "ui://media-upload/v1.html";
+var MEDIA_UPLOAD_APP_DOMAIN = "https://productmaker.app";
 var MEDIA_UPLOAD_APP_NAME = "ProductMaker media upload";
 var MEDIA_UPLOAD_APP_HTML_URL = new URL("./ui/meta-upload-app.html", import.meta.url);
 var MEDIA_UPLOAD_APP_CSP = {
@@ -209,6 +316,7 @@ function registerMediaUploadAppResource(server, resolveEndpoint) {
     mimeType: RESOURCE_MIME_TYPE,
     _meta: {
       ui: {
+        domain: MEDIA_UPLOAD_APP_DOMAIN,
         csp
       }
     }
@@ -220,6 +328,7 @@ function registerMediaUploadAppResource(server, resolveEndpoint) {
         text: html,
         _meta: {
           ui: {
+            domain: MEDIA_UPLOAD_APP_DOMAIN,
             csp
           }
         }
@@ -425,8 +534,15 @@ async function resolveImageUrl(rawUrl) {
   }
   const ct = (res.headers.get("content-type") ?? "").split(";")[0]?.trim() ?? "";
   if (!ALLOWED_MIMES.has(ct)) throw new ResolveImageError("IMAGE_TYPE_UNSUPPORTED", `content-type ${ct}`);
-  const buf = Buffer.from(await res.arrayBuffer());
-  if (buf.length > MAX_BYTES) throw new ResolveImageError("IMAGE_TOO_LARGE", `${buf.length} bytes`);
+  let buf;
+  try {
+    buf = Buffer.from(await readResponseBytes(res, MAX_BYTES));
+  } catch (error) {
+    if (error instanceof ResponseBodyTooLargeError) {
+      throw new ResolveImageError("IMAGE_TOO_LARGE", `image URL exceeds ${MAX_BYTES} bytes`);
+    }
+    throw new ResolveImageError("IMAGE_DOWNLOAD_FAILED", "image response could not be read");
+  }
   const sniffed = sniffMime(buf);
   if (!sniffed || sniffed !== ct) {
     throw new ResolveImageError("IMAGE_TYPE_UNSUPPORTED", `magic bytes (${sniffed ?? "unknown"}) do not match content-type (${ct})`);
@@ -6871,6 +6987,16 @@ var DEFAULT_PRICING = {
     ourCostCents: 0.15,
     userPriceCents: 0.3
   },
+  // ⚠️ Both call sites below moved from gemini-3-flash-preview to gemini-3.7-flash on
+  // 2026-08-15 (#1418) and these rates predate that. They are NOT re-measured, and the
+  // numbers are LEFT UNCHANGED by the same owner decision that governs the whole table
+  // (launch pricing is expected to rise; real user billing derives from actual
+  // usage.cost, so these only feed the estimator and the pre-flight quote ceiling).
+  //   - product-accuracy: ZERO calls in the last 20 days of prod billing, so there is no
+  //     measurement to compare against and the gate may not be reachable at all.
+  //   - wearable-product-semantics: measured 0.4303¢/call over 121 prod calls (4,970
+  //     prompt tokens) on flash-preview — this 0.11¢ fallback already UNDER-quotes by
+  //     ~4x, independently of the model move. Re-measure after #1418 is deployed.
   "openrouter:product-accuracy": {
     ourCostCents: 0.15,
     userPriceCents: 0.3
@@ -9182,13 +9308,21 @@ var WHATSAPP_ONLY_CHANNEL_EXPOSURE = {
   mcp: "unavailable",
   whatsapp: "adapted"
 };
-function defineCapability(name, schemaHash, confirmation, routingDomain, effects, inputSlots, consumes, produces, channelExposure = SHARED_CHANNEL_EXPOSURE) {
+function defineCapability(name, schemaHash, confirmation, routingDomain, effects, inputSlots, consumes, produces, channelExposure = SHARED_CHANNEL_EXPOSURE, conversationInputs) {
   return {
     name,
     schemaHash,
     confirmation,
     routingDomain,
     inputSlots,
+    conversation: {
+      inputs: conversationInputs ?? inputSlots.map((input) => ({
+        slot: input.name,
+        askBeforePaidExecution: input.required,
+        explicitOmissionAllowed: !input.required,
+        fieldCompletion: "any"
+      }))
+    },
     effects,
     artifacts: {
       consumes,
@@ -9686,6 +9820,11 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
       "compareAtPrice",
       "offer",
       "paymentMethods"
+    ], [
+      "price",
+      "offer",
+      "compareAtPrice",
+      "paymentMethods"
     ]),
     slot("product_context", false, [
       "productContext",
@@ -9707,6 +9846,25 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     "product_reference"
   ], [
     "landing"
+  ], SHARED_CHANNEL_EXPOSURE, [
+    {
+      slot: "product_reference",
+      askBeforePaidExecution: true,
+      explicitOmissionAllowed: false,
+      fieldCompletion: "any"
+    },
+    {
+      slot: "locale",
+      askBeforePaidExecution: true,
+      explicitOmissionAllowed: false,
+      fieldCompletion: "all"
+    },
+    {
+      slot: "commercial_offer",
+      askBeforePaidExecution: true,
+      explicitOmissionAllowed: true,
+      fieldCompletion: "all"
+    }
   ]),
   defineCapability("generate_video_creative", "6bcd073df66023f8108a671b3027e1f35e9596cf9481ddf13a0282b4c56f5f34", "credit_consuming", "creative", [
     "credit_consuming",
@@ -10081,7 +10239,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "meta_upload_session"
   ], WHATSAPP_ONLY_CHANNEL_EXPOSURE),
-  defineCapability("request_media_upload", "d7ccfffe00f8563219fb3e036b07649ff59334e03fc52f6a2f3cb0823d4aa948", "none", "creative", [
+  defineCapability("request_media_upload", "e91cda1b2d9e44cecf28990b8018ce535ae4e9e6594fa80f503a1bf69d7146ee", "none", "creative", [
     "state_change"
   ], [
     slot("media_kind", true, [
@@ -10389,7 +10547,7 @@ async function readResponseWithCap(response) {
       if (next.done) break;
       total += next.value.byteLength;
       if (total > MAX_MEDIA_BYTES) {
-        await reader.cancel();
+        void reader.cancel().catch(() => void 0);
         throw new ResolveMediaError("MEDIA_TOO_LARGE", `media URL exceeds ${MAX_MEDIA_BYTES} bytes`);
       }
       chunks.push(Buffer.from(next.value));
@@ -10537,6 +10695,7 @@ async function resolveMediaRef(ref, opts) {
   if (!response.ok) throw new ResolveMediaError("MEDIA_URL_UNAVAILABLE", `media URL returned HTTP ${response.status}`);
   const contentLength = Number(response.headers.get("content-length") ?? 0);
   if (contentLength > MAX_MEDIA_BYTES) {
+    void response.body?.cancel().catch(() => void 0);
     throw new ResolveMediaError("MEDIA_TOO_LARGE", `media URL exceeds ${MAX_MEDIA_BYTES} bytes`);
   }
   const buffer = await readResponseWithCap(response);
@@ -11450,8 +11609,8 @@ function sanitizeFilename(s) {
   return s.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 64) || "asset";
 }
 __name(sanitizeFilename, "sanitizeFilename");
-async function fetchTaskOutputs(api, taskId) {
-  const raw = await api.getJson(`/v1/results/${encodeURIComponent(taskId)}?signedUrls=true`);
+async function fetchTaskOutputs(api, taskId, options) {
+  const raw = await api.getJson(`/v1/results/${encodeURIComponent(taskId)}?signedUrls=true`, options);
   const videos = (raw.videoGenerators ?? []).map((vg) => {
     const variants2 = (vg.variants ?? []).filter((v) => Boolean(v.kind) && Boolean(v.url)).map((v) => ({
       kind: v.kind,
@@ -11952,12 +12111,16 @@ function registerTaskTools(server, api, { proxyBaseUrl = null, transport = "http
   });
   server.tool("get_task_status", "Devuelve el estado y URLs de outputs de una tarea. Si waitSeconds>0, hace polling hasta que cambie la fase, aparezca `pendingUserAction`, o llegue al timeout (max 120s). Cuando la tarea queda en `done`, incluye enlaces a sus outputs.\n\nSi aparece `pendingUserAction`, el pipeline est\xE1 PARADO: muestra el draft y llama `resolve_pending_action` repitiendo el mismo `kind`. Kinds: `product_reference_set_approval`, `product_reference_confirmation`, `angle_review_approval`, `service_angle_approval` y `service_script_approval`.", GetTaskStatusInput.shape, async (input, extra) => {
     try {
-      const fetcher = /* @__PURE__ */ __name(() => api.getJson(`/v1/status/${encodeURIComponent(input.taskId)}`), "fetcher");
       const signal = extra?.signal;
+      const fetcher = /* @__PURE__ */ __name(() => api.getJson(`/v1/status/${encodeURIComponent(input.taskId)}`, {
+        signal
+      }), "fetcher");
       const snapshot = await pollStatus(fetcher, input.waitSeconds ?? 0, signal);
       if (snapshot.status !== "done") return asText(snapshot);
       if (snapshot.kind === "service") {
-        const result = await api.getJson(`/v1/tasks/${encodeURIComponent(input.taskId)}/service-result`);
+        const result = await api.getJson(`/v1/tasks/${encodeURIComponent(input.taskId)}/service-result`, {
+          signal
+        });
         return {
           content: [
             {
@@ -11977,7 +12140,9 @@ function registerTaskTools(server, api, { proxyBaseUrl = null, transport = "http
         };
       }
       try {
-        const rawOutputs = await fetchTaskOutputs(api, input.taskId);
+        const rawOutputs = await fetchTaskOutputs(api, input.taskId, {
+          signal
+        });
         const outputs = proxifyOutputs(rawOutputs, proxyBaseUrl);
         return {
           content: [
@@ -13513,11 +13678,11 @@ var UploadSessionInputBase = z55.object({
   maxFiles: z55.number().int().min(1).max(10).optional().describe("Optional batch limit: image accepts 1-5, video exactly 1, and mixed 1-10.")
 });
 var OpenAiFileReference = z55.object({
-  download_url: z55.string().url(),
+  download_url: z55.string().url().optional().describe("Optional host-provided download URL. The App prefers getFileDownloadUrl(file_id) and the server never fetches this URL."),
   file_id: z55.string().min(1),
   mime_type: z55.string().min(1).optional(),
   file_name: z55.string().min(1).optional()
-}).strict();
+});
 var UploadSessionToolInputShape = {
   ...UploadSessionInputBase.shape,
   files: z55.array(OpenAiFileReference).max(10).optional().describe("Optional OpenAI-hosted file references provided by ChatGPT. They are only metadata for the UI bridge and are never forwarded to ProductMaker.")
@@ -14800,7 +14965,7 @@ __name(registerProductMakerPrompts, "registerProductMakerPrompts");
 
 // src/server.ts
 function createServer(opts) {
-  const { apiKey, apiBaseUrl, proxyBaseUrl = null, transport = "http" } = opts;
+  const { apiBaseUrl, proxyBaseUrl = null, transport = "http", instructions = PRODUCTMAKER_SERVER_INSTRUCTIONS } = opts;
   const server = new McpServer({
     name: "productmaker",
     version: MCP_VERSION
@@ -14811,9 +14976,11 @@ function createServer(opts) {
       },
       logging: {}
     },
-    instructions: PRODUCTMAKER_SERVER_INSTRUCTIONS
+    instructions
+  });
+  const api = new ApiClient(apiBaseUrl, opts.credential, {
+    signal: opts.abortSignal
   });
-  const api = new ApiClient(apiBaseUrl, apiKey);
   registerProductMakerPrompts(server);
   registerMediaUploadAppResource(server, api.publicUrl("/v1/uploaded-assets/sessions/resolve"));
   registerProductCostingTools(server);
@@ -14878,7 +15045,7 @@ async function main() {
     process.exit(1);
   }
   const server = createServer({
-    apiKey,
+    credential: new StaticApiKeyCredential(apiKey),
     apiBaseUrl,
     transport: "stdio"
   });

package/dist/ui/meta-upload-app.html

@@ -2273,19 +2273,27 @@
               status.status === "pending" ||
               (state.items.length > 0 &&
                 status.assets.length < state.items.length);
+            const canContinueInChat = canMessageHost();
             if (partial) {
               requireFallback(
                 "Carga parcial verificada. Puedes continuar desde el enlace seguro si algún archivo no terminó.",
                 "warning",
               );
+            } else if (!canContinueInChat) {
+              requireFallback(
+                "Carga completada. Este chat no puede continuar desde el widget. Abre el enlace seguro para seguir.",
+                "warning",
+              );
             } else {
               setFallbackVisibility(state.fallbackRequired);
             }
             setSessionStatus(
               partial
                 ? "Carga parcial verificada. Continuaremos solo con los assets listos."
-                : "Carga completada.",
-              partial ? "warning" : "success",
+                : canContinueInChat
+                  ? "Carga completada."
+                  : "Carga completada. Abre el enlace seguro para seguir.",
+              partial || !canContinueInChat ? "warning" : "success",
             );
           } catch (error) {
             const expired =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productmaker/mcp",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "type": "module",
   "private": false,
   "description": "Product Maker MCP server — cost products, generate dropshipping landing pages, UGC videos, and ad creatives, and publish to Shopify and Meta Ads from Claude, ChatGPT, or Gemini.",
@@ -53,7 +53,9 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "express": "^4.19.2",
     "express-rate-limit": "^7.4.0",
+    "jose": "^5.2.0",
     "pino": "^9.0.0",
+    "posthog-node": "^5.24.11",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -64,8 +66,8 @@
     "tsx": "^4.16.0",
     "typescript": "^7.0.2",
     "vitest": "^2.1.9",
-    "@packages/product-research": "0.1.0",
     "@packages/product-economics": "0.1.0",
+    "@packages/product-research": "0.1.0",
     "@packages/types": "0.1.0"
   },
   "publishConfig": {