@productmaker/mcp 8.2.0 → 8.3.0

package/README.md

@@ -64,7 +64,7 @@ their connector immediately. New connections should always use OAuth; once the
 client supports it, replace the saved connection with the clean URL above.
 
 In claude.ai: _Settings → Integrations → Add MCP server_.
-In ChatGPT: _Settings → Connectors → Add custom connector_.
+In ChatGPT: _Plugins (sidebar) → Add → Create MCP app_ (OAuth).
 In Claude Desktop: _Settings → Connectors → Add custom connector_.
 
 If your saved connection still uses an API key, it continues to use the latest
@@ -268,6 +268,11 @@ The `base64` field was removed. MCP JSON-RPC transports truncate large tool argu
 
 ## Version history
 
+### 8.3.0 — Idempotencia de tools pagadas + refresh OAuth
+
+- Tools pagadas (`create_product_task`, `create_service_video`, `generate_video_creative`, `generate_free_video`, `generate_image_creatives`, `generate_landing`, `create_creative_variant`): envían un `Idempotency-Key` derivado de los argumentos semánticos (ventana de 15 min). Un reintento con los mismos argumentos devuelve la misma tarea (`replayed: true`) sin segundo cargo; una tarea en `error` sí se reintenta.
+- OAuth alojado: se anuncia `offline_access` + grant `refresh_token`; un token a punto de expirar responde `401` + `WWW-Authenticate` para que el host refresque en silencio (`MCP_SUBJECT_TOKEN_REAUTH_WINDOW_MS`, por defecto 180000; `0` lo desactiva).
+
 ### 8.2.0 — Fase 3 (modelos)
 
 - Imagen: `generate_image_creatives` (setup guiado) acepta `image:1k` / `image:2k`; `gpt-image-2-5:*` y `gpt-image-2:*` se siguen aceptando.

package/dist/http.js

@@ -1830,6 +1830,9 @@ var VideoCreativeJobStatus = z14.object({
 var VideoCreativeJobPayload = z14.object({
   jobId: z14.string().optional(),
   status: VideoCreativeJobStatusEnum.optional(),
+  /** True when the submission replayed an existing task instead of billing
+  *  new work — callers surface the twin verbatim. Omitted on fresh creates. */
+  replayed: z14.boolean().optional(),
   videoStructure: VideoStructure.optional(),
   videoQuality: VideoQuality.optional(),
   videoRouteId: VideoRouteId.optional(),
@@ -1923,7 +1926,8 @@ var ImageCreativeJobStatus = z14.object({
 });
 var ImageCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: ImageCreativeJobStatusEnum
+  status: ImageCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var ImageCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -1950,7 +1954,8 @@ var LandingCreativeJobStatus = z14.object({
 });
 var LandingCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: LandingCreativeJobStatusEnum
+  status: LandingCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var LandingCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -5621,6 +5626,10 @@ var CreateShopifySubscriptionRequest = z28.object({
 var CreateShopifyBillingChargeRequest = z28.object({
   packId: z28.string().min(1)
 });
+var ShopifyBillingCallbackQuery = z28.object({
+  charge_id: z28.string().regex(/^\d+$/),
+  transactionId: z28.string().uuid()
+});
 var CancelShopifySubscriptionRequest = z28.object({
   subscriptionId: z28.string().min(1)
 });
@@ -10848,6 +10857,7 @@ var MixSceneResult = z48.object({
   index: z48.number().int().positive(),
   status: z48.enum([
     "queued",
+    "submitting",
     "submitted",
     "done",
     "failed"
@@ -13446,7 +13456,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "product_costing"
   ]),
-  defineCapability("create_creative_variant", "6a777fbe7ad17966d16502e8872e15e4db2dcfacdfd2992d24853340d4f22a00", "credit_consuming", "creative", [
+  defineCapability("create_creative_variant", "3e02399a7785df328f1c4d63cfbb6d7481abaac9f91d4a5cf51d410e657d63aa", "credit_consuming", "creative", [
     "credit_consuming",
     "state_change"
   ], [
@@ -13696,7 +13706,9 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     // MCP 7.0.0 (Task 11, .agent/plans/2026-09-15-model-agnostic-video-routes.md):
     // `freeProModel` retired in favor of `modelId` (registry ids). Recomputed
     // from `pnpm --filter @productmaker/mcp test` printing the real digest.
-    "ead1f563a1915452157628d023ba203ecfa8f502a48259a5b5b15be4c84bf768",
+    // Re-baselined 2026-09-26: `idempotencyKey` field description corrected —
+    // paid tools ignore caller-provided keys and derive their own semantic key.
+    "35616a32a42a0bc062218fdfbb4cc7f4ecfa814571fb86b4f11ef9e4184855e1",
     "credit_consuming",
     "creative",
     [
@@ -16195,6 +16207,9 @@ function buildProxyUrl(opts) {
 }
 __name(buildProxyUrl, "buildProxyUrl");
 
+// src/http.ts
+import { getOAuthProtectedResourceMetadataUrl as getOAuthProtectedResourceMetadataUrl2 } from "@modelcontextprotocol/sdk/server/auth/router.js";
+
 // src/auth/http-oauth.ts
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
@@ -16604,6 +16619,7 @@ import { createRemoteJWKSet as createRemoteJWKSet2, jwtVerify as jwtVerify2 } fr
 import { z as z73 } from "zod";
 var MCP_RESOURCE = new URL("https://mcp.productmaker.app/mcp");
 var MCP_SCOPE = "mcp:access";
+var REFRESH_SCOPE = "offline_access";
 var STATIC_CLIENT_ISSUER = new URL(MCP_RESOURCE.origin);
 var oauthEnvSchema = z73.object({
   MCP_REMOTE_AUTH_MODE: z73.literal("oauth"),
@@ -16987,13 +17003,10 @@ function createOAuthProxyRouter(options) {
       });
       return;
     }
+    body.set("client_secret", options.staticClient.clientSecret);
     const headers = {
       "content-type": "application/x-www-form-urlencoded"
     };
-    const authorization = req.headers.authorization;
-    if (typeof authorization === "string") {
-      headers.authorization = authorization;
-    }
     let upstream;
     let payload;
     try {
@@ -17026,11 +17039,12 @@ var REGISTRATION_RATE_LIMIT = {
   windowMs: 6e4,
   max: 120
 };
+var PUBLIC_CLIENT_SECRET_PLACEHOLDER = "pm-public-client";
 function buildStaticClientInformation(staticClient, requested) {
   return {
     client_id: staticClient.clientId,
-    client_secret: staticClient.clientSecret,
-    // 0 = never expires (RFC 7591 §3.2.1); the secret is Auth0's, not ours.
+    client_secret: PUBLIC_CLIENT_SECRET_PLACEHOLDER,
+    // 0 = never expires (RFC 7591 §3.2.1); the placeholder is a constant.
     client_secret_expires_at: 0,
     token_endpoint_auth_method: "client_secret_post",
     redirect_uris: requested.redirect_uris,
@@ -17041,7 +17055,12 @@ function buildStaticClientInformation(staticClient, requested) {
     response_types: [
       "code"
     ],
-    scope: requested.scope ?? MCP_SCOPE,
+    // Clients that defer scope choice to the server get the full intended
+    // set: `mcp:access` for the resource plus `offline_access` so the session
+    // can refresh instead of dying an interactive re-auth every 900s access
+    // token (the auth loop seen in production). A client that names its own
+    // scope list is echoed verbatim — its choice wins.
+    scope: requested.scope ?? `${MCP_SCOPE} ${REFRESH_SCOPE}`,
     ...requested.client_name !== void 0 ? {
       client_name: requested.client_name
     } : {}
@@ -17088,8 +17107,12 @@ function buildStaticClientAuthorizationServerMetadata(auth0Metadata) {
     token_endpoint_auth_methods_supported: [
       "client_secret_post"
     ],
+    // `offline_access` is what lets a client ASK for a refresh token; without
+    // it in scopes_supported, conforming clients never request it and every
+    // 900s access-token expiry becomes an interactive re-auth loop.
     scopes_supported: [
-      MCP_SCOPE
+      MCP_SCOPE,
+      REFRESH_SCOPE
     ],
     service_documentation: "https://productmaker.app/"
   };
@@ -17601,7 +17624,10 @@ var ApiClient = class {
       method: "POST",
       headers: {
         ...authHeaders,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...options?.idempotencyKey ? {
+          "Idempotency-Key": options.idempotencyKey
+        } : {}
       },
       body: JSON.stringify(body)
     }, options);
@@ -17723,7 +17749,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "8.2.0";
+var MCP_VERSION = "8.3.0";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
@@ -18707,8 +18733,13 @@ async function submitCreative(api, opts) {
   const taskId = r.taskId ?? r.jobId;
   return asText({
     taskId,
-    status: "queued",
-    estimatedSeconds: opts.estimatedSeconds
+    // Replay-aware: a keyed retry may land on a task that is already
+    // processing/done — report the real status, not a hopeful "queued".
+    status: r.status ?? "queued",
+    estimatedSeconds: opts.estimatedSeconds,
+    ...r.replayed === true ? {
+      replayed: true
+    } : {}
   });
 }
 __name(submitCreative, "submitCreative");
@@ -20072,6 +20103,170 @@ ${summary}`,
 }
 __name(requirePaidCreativeConfirmation, "requirePaidCreativeConfirmation");
 
+// src/tools/stable-uuid.ts
+import { createHash as createHash3 } from "crypto";
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
+    key,
+    canonicalize(record[key])
+  ]));
+}
+__name(canonicalize, "canonicalize");
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+__name(canonicalJson, "canonicalJson");
+function deriveUuidV5(name, namespace) {
+  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
+  const digest = createHash3("sha1").update(namespaceBytes).update(name, "utf8").digest();
+  const bytes = Buffer.from(digest.subarray(0, 16));
+  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
+  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+  const hex = bytes.toString("hex");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+__name(deriveUuidV5, "deriveUuidV5");
+
+// src/tools/request-key.ts
+var PAID_REQUEST_KEY_WINDOW_MS = 15 * 60 * 1e3;
+var PAID_REQUEST_KEY_NAMESPACE = "8f3d6b1c-2a47-4e5b-9c0d-6e7f8a9b0c1d";
+var PARAPHRASE_PRONE_FIELDS = /* @__PURE__ */ new Set([
+  "additionalContext",
+  "productContext",
+  "scriptNotes",
+  "creativeDirection",
+  "buyerPersona",
+  "actorDescription",
+  "description",
+  "idempotencyKey",
+  "clientRequestId"
+]);
+var URL_FIELDS = /* @__PURE__ */ new Set([
+  "landingUrl",
+  "productUrl",
+  "url",
+  "serviceLandingUrl"
+]);
+var TRACKING_PARAM_PATTERN = /^(utm_\w+|fbclid|gclid|msclkid|mc_cid|mc_eid|igshid)$/;
+var LANGUAGE_FIELDS = /* @__PURE__ */ new Set([
+  "language",
+  "lang"
+]);
+var CASE_FOLD_FIELDS = /* @__PURE__ */ new Set([
+  "country",
+  "language",
+  "lang"
+]);
+var ORDER_INSIGNIFICANT_ARRAY_FIELDS = /* @__PURE__ */ new Set([
+  "outputs",
+  "selectedOutputs",
+  "features"
+]);
+function sortCanonical(items) {
+  return [
+    ...items
+  ].sort((a, b) => {
+    const ka = canonicalJson(a);
+    const kb = canonicalJson(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+}
+__name(sortCanonical, "sortCanonical");
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord3, "isRecord");
+function collectLanguageCodes(value, out) {
+  if (Array.isArray(value)) {
+    const items = value;
+    for (const item of items) collectLanguageCodes(item, out);
+    return out;
+  }
+  if (!isRecord3(value)) return out;
+  for (const [key, entry] of Object.entries(value)) {
+    if (LANGUAGE_FIELDS.has(key) && typeof entry === "string") {
+      const base = entry.trim().split(/[-_]/)[0]?.toLowerCase();
+      if (base) out.add(base);
+    }
+    collectLanguageCodes(entry, out);
+  }
+  return out;
+}
+__name(collectLanguageCodes, "collectLanguageCodes");
+function normalizeSearchForKey(search) {
+  if (!search) return "";
+  const params = [
+    ...new URLSearchParams(search).entries()
+  ].filter(([key]) => !TRACKING_PARAM_PATTERN.test(key.toLowerCase())).sort(([ka, va], [kb, vb]) => ka === kb ? va < vb ? -1 : va > vb ? 1 : 0 : ka < kb ? -1 : 1);
+  if (!params.length) return "";
+  const out = new URLSearchParams();
+  for (const [key, value] of params) out.append(key, value);
+  return `?${out.toString()}`;
+}
+__name(normalizeSearchForKey, "normalizeSearchForKey");
+function normalizeUrlForKey(value, languages) {
+  const trimmed = value.trim();
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return trimmed.toLowerCase();
+  }
+  const host = url.hostname.toLowerCase().replace(/^www\./, "");
+  const port = url.port ? `:${url.port}` : "";
+  const segments = url.pathname.split("/").filter(Boolean);
+  const soleSegment = segments.length === 1 ? segments[0] : void 0;
+  if (soleSegment !== void 0 && languages.has(soleSegment.toLowerCase())) {
+    segments.pop();
+  }
+  const path3 = segments.length ? `/${segments.join("/")}` : "";
+  return host + port + path3 + normalizeSearchForKey(url.search);
+}
+__name(normalizeUrlForKey, "normalizeUrlForKey");
+function normalizeForKey(value, languages) {
+  if (Array.isArray(value)) {
+    const items = value;
+    return items.map((item) => normalizeForKey(item, languages));
+  }
+  if (!isRecord3(value)) return value;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (PARAPHRASE_PRONE_FIELDS.has(key)) {
+      if (key === "description" && value.mode === "described") {
+        out[key] = normalizeForKey(entry, languages);
+      }
+      continue;
+    }
+    out[key] = URL_FIELDS.has(key) && typeof entry === "string" ? normalizeUrlForKey(entry, languages) : CASE_FOLD_FIELDS.has(key) && typeof entry === "string" ? (
+      // separator too or a host alternating between them splits the key.
+      entry.trim().toLowerCase().replace(/_/g, "-")
+    ) : ORDER_INSIGNIFICANT_ARRAY_FIELDS.has(key) && Array.isArray(entry) ? sortCanonical(entry.map((item) => normalizeForKey(item, languages))) : normalizeForKey(entry, languages);
+  }
+  return out;
+}
+__name(normalizeForKey, "normalizeForKey");
+function derivePaidRequestKey(args) {
+  const languages = collectLanguageCodes(args.input, /* @__PURE__ */ new Set());
+  const semanticInput = normalizeForKey(args.input, languages);
+  const bucket = Math.floor(args.nowMs / PAID_REQUEST_KEY_WINDOW_MS);
+  return deriveUuidV5(canonicalJson({
+    user: args.fingerprint,
+    tool: args.tool,
+    input: semanticInput,
+    bucket
+  }), PAID_REQUEST_KEY_NAMESPACE);
+}
+__name(derivePaidRequestKey, "derivePaidRequestKey");
+
 // src/tools/winning-product-image.ts
 import { z as z76 } from "zod";
 var WinnerReferenceInput = z76.object({
@@ -20608,10 +20803,25 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
       };
       const r = await api.postMultipart("/v1/ingest", {
         images: parts
-      }, fields);
+      }, fields, {
+        // LLM hosts retry paid tools with rephrased arguments — the API's
+        // byte-fingerprint can't see the duplicate, this key can. Derived
+        // from the semantic inputs, not the wire fields, for the same
+        // reason (see request-key.ts, which also canonicalizes the
+        // order-insignificant `outputs` set).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_product_task",
+          input,
+          nowMs: Date.now()
+        })
+      });
       return asText({
         taskId: r.taskId,
-        status: "queued",
+        status: r.status ?? "queued",
+        ...r.replayed ? {
+          replayed: true
+        } : {},
         estimatedSeconds: 300,
         outputs: selectedOutputs,
         outputMode: "single_task",
@@ -20648,26 +20858,56 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
           assets: []
         },
         appDemoVideos: []
+      }, {
+        // The 2026-09-25 incident: four retries of this exact tool created
+        // four charged service tasks because the host rephrased
+        // `additionalContext` and flipped the landing between `/` and
+        // `/es`. The derived key is stable across both rewrites (see
+        // request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_service_video",
+          input,
+          nowMs: Date.now()
+        })
       });
       const angles = await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles`, {});
       const first = angles[0];
+      const replayed = created.replayed === true;
       if (input.reviewMode === "automatic") {
         if (!first) throw new Error("ProductMaker no pudo crear un concepto para este servicio.");
-        await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
-          angleIds: [
-            first.id
-          ]
-        });
+        if (!(replayed && created.status !== "queued")) {
+          await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
+            angleIds: [
+              first.id
+            ]
+          });
+        }
         return asText({
           taskId: created.taskId,
-          status: "processing",
+          status: replayed ? created.status ?? "processing" : "processing",
+          ...replayed ? {
+            replayed: true
+          } : {},
           reviewMode: input.reviewMode,
           selectedConcept: first
         });
       }
+      if (replayed && created.status !== "queued") {
+        return asText({
+          taskId: created.taskId,
+          status: created.status,
+          replayed: true,
+          reviewMode: input.reviewMode,
+          angles
+        });
+      }
       return asText({
         taskId: created.taskId,
         status: "waiting_for_user",
+        ...replayed ? {
+          replayed: true
+        } : {},
         reviewMode: input.reviewMode,
         pendingUserAction: {
           kind: "service_angle_approval",
@@ -21243,7 +21483,6 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
 __name(registerTaskTools, "registerTaskTools");
 
 // src/tools/creatives.ts
-import { randomUUID } from "crypto";
 import { z as z78 } from "zod";
 var generateFreeVideoGuidance = getProductMakerCapabilityModelGuidance("generate_free_video");
 var generateVideoCreativeGuidance = getProductMakerCapabilityModelGuidance("generate_video_creative");
@@ -21364,7 +21603,7 @@ var FreeVideoInput = z78.object({
   videoResolution: VideoResolutionEnum.describe("Resoluci\xF3n del video: 480p o 720p."),
   generateAiMusic: z78.boolean().default(false).describe("Opcional. Agrega m\xFAsica instrumental IA debajo del audio nativo. Default false."),
   addSubtitles: z78.boolean().default(false).describe("Opcional. Quema subt\xEDtulos usando el rawPrompt exacto. Default false."),
-  idempotencyKey: z78.string().uuid().optional().describe("Opcional. UUID para reintentar exactamente esta misma solicitud sin crear ni cobrar otro video. Reutiliza el mismo valor si el cliente no recibi\xF3 la respuesta.")
+  idempotencyKey: z78.string().uuid().optional().describe("Opcional. Se acepta por compatibilidad pero se ignora: la identidad del reintento se deriva autom\xE1ticamente de los argumentos sem\xE1nticos, as\xED que un retry con los mismos argumentos ya es idempotente sin este campo.")
 }).strict();
 var imageStyleList = ImageCreativeStyleEnum.options.join(" | ");
 var ImageCreativeSetup = z78.discriminatedUnion("mode", [
@@ -21586,7 +21825,16 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
           addSubtitles: input.addSubtitles
         },
         allowEmptyImages: true,
-        idempotencyKey: input.idempotencyKey ?? randomUUID(),
+        // Always derived — never `input.idempotencyKey ??`: a host that
+        // mints a fresh UUID per retry would defeat the dedupe entirely.
+        // The semantic key is also a strictly better retry identity: a
+        // reused caller key still lands on it (see request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_free_video",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21651,6 +21899,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
         path: "/v1/creatives/videos",
         estimatedSeconds: 300,
         input: wirePayload,
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_video_creative",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21685,6 +21939,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_image_creatives",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21728,6 +21988,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_landing",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21859,7 +22125,7 @@ var CreateCreativeVariantInputBase = z79.object({
   sourceTaskId: z79.string().uuid().describe("ID de la tarea original completada."),
   kind: CreativeVariantKindEnum,
   confirm: z79.literal(true).describe("Confirmaci\xF3n expl\xEDcita del usuario despu\xE9s de mostrarle el estimado de cr\xE9ditos."),
-  clientRequestId: z79.string().uuid().describe("UUID estable y obligatorio para esta intenci\xF3n. Reutil\xEDzalo ante timeouts o transporte ambiguo. Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n y un UUID nuevo."),
+  clientRequestId: z79.string().uuid().describe("UUID estable para esta intenci\xF3n (obligatorio por compatibilidad de contrato; el servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo en un retry NO crea una variante duplicada). Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n."),
   angle: z79.string().trim().min(1).max(500).optional().describe("\xC1ngulo nuevo para video o imagen."),
   buyerPersona: z79.string().trim().min(1).max(360).optional().describe("Buyer persona coherente con el \xE1ngulo."),
   scriptNotes: z79.string().trim().min(1).max(2e3).optional().describe("Direcci\xF3n breve del guion para una variante de video."),
@@ -21981,7 +22247,7 @@ function registerCreativeVariantTools(server, api) {
       throw translateError(error);
     }
   });
-  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio: genera un UUID por intenci\xF3n y reutiliza el mismo ante timeouts o transporte ambiguo. Si recibes status=error, pide confirmaci\xF3n para un intento nuevo y usa otro UUID. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
+  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio por contrato: genera un UUID por intenci\xF3n. El servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo NO desbloquea un intento distinto \u2014 si recibes status=error, pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
     try {
       const validatedInput = parseVariantInput(CreateCreativeVariantInput, input);
       const estimateInput = EstimateCreativeVariantInput.parse({
@@ -22008,8 +22274,16 @@ function registerCreativeVariantTools(server, api) {
         });
         sectionKey = LandingSectionKeyEnum.parse(recommendation.value);
       }
+      const derivedClientRequestId = derivePaidRequestKey({
+        fingerprint: api.fingerprint(),
+        tool: "create_creative_variant",
+        input: {
+          ...validatedInput
+        },
+        nowMs: Date.now()
+      });
       const payload = {
-        clientRequestId: validatedInput.clientRequestId,
+        clientRequestId: derivedClientRequestId,
         kind: validatedInput.kind,
         ...validatedInput.kind !== "landing" ? {
           angle: validatedInput.angle,
@@ -22035,7 +22309,7 @@ function registerCreativeVariantTools(server, api) {
       };
       const created = await api.postJson(`/v1/tasks/${encodeURIComponent(validatedInput.sourceTaskId)}/creative-variants`, payload);
       if (created.status === "error") {
-        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n para un intento nuevo y usa otro clientRequestId.", {
+        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos para un intento nuevo.", {
           variantTaskId: created.variantTaskId
         });
       }
@@ -22250,39 +22524,6 @@ __name(registerActorTools, "registerActorTools");
 // src/tools/publish.ts
 import { z as z83 } from "zod";
 
-// src/tools/stable-uuid.ts
-import { createHash as createHash3 } from "crypto";
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
-    key,
-    canonicalize(record[key])
-  ]));
-}
-__name(canonicalize, "canonicalize");
-function canonicalJson(value) {
-  return JSON.stringify(canonicalize(value));
-}
-__name(canonicalJson, "canonicalJson");
-function deriveUuidV5(name, namespace) {
-  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
-  const digest = createHash3("sha1").update(namespaceBytes).update(name, "utf8").digest();
-  const bytes = Buffer.from(digest.subarray(0, 16));
-  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
-  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-  const hex = bytes.toString("hex");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20)
-  ].join("-");
-}
-__name(deriveUuidV5, "deriveUuidV5");
-
 // src/tools/meta-publish-attempt-id.ts
 var META_PUBLISH_NAMESPACE = "7b19c9ac-b4eb-4db1-970e-c2f24ce30b98";
 function deriveMetaPublishAttemptId(input) {
@@ -24931,6 +25172,16 @@ function firstHeader(value) {
 }
 __name(firstHeader, "firstHeader");
 var PROXY_FETCH_TIMEOUT_MS = 3e4;
+var DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS = 18e4;
+function subjectTokenReauthWindowMs(env) {
+  const raw = env.MCP_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+}
+__name(subjectTokenReauthWindowMs, "subjectTokenReauthWindowMs");
 var INLINE_RENDERABLE_MIMES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -25061,7 +25312,8 @@ function resolveDownstreamAuth(req, opts, oauthAnalytics) {
     credential,
     subject,
     clientId,
-    isLegacy: false
+    isLegacy: false,
+    subjectExpiresAt: expiresAt
   };
 }
 __name(resolveDownstreamAuth, "resolveDownstreamAuth");
@@ -25085,6 +25337,14 @@ function createAuthenticatedMcpHandler(opts, oauthAnalytics) {
       return;
     }
     const { credential, subject, clientId, isLegacy } = authContext;
+    const reauthWindowMs = subjectTokenReauthWindowMs(process.env);
+    if (reauthWindowMs > 0 && !isLegacy && typeof authContext.subjectExpiresAt === "number" && authContext.subjectExpiresAt * 1e3 <= Date.now() + reauthWindowMs) {
+      res.status(401).set("WWW-Authenticate", `Bearer error="invalid_token", error_description="Access token expired or expiring soon", scope="${MCP_SCOPE}", resource_metadata="${getOAuthProtectedResourceMetadataUrl2(MCP_RESOURCE)}"`).json({
+        error: "invalid_token",
+        error_description: "Access token expired or expiring soon; refresh or re-authenticate."
+      });
+      return;
+    }
     const abortController = new AbortController();
     const abortRequest = /* @__PURE__ */ __name(() => abortController.abort(), "abortRequest");
     req.once("aborted", abortRequest);

package/dist/stdio.js

@@ -1852,6 +1852,9 @@ var VideoCreativeJobStatus = z14.object({
 var VideoCreativeJobPayload = z14.object({
   jobId: z14.string().optional(),
   status: VideoCreativeJobStatusEnum.optional(),
+  /** True when the submission replayed an existing task instead of billing
+  *  new work — callers surface the twin verbatim. Omitted on fresh creates. */
+  replayed: z14.boolean().optional(),
   videoStructure: VideoStructure.optional(),
   videoQuality: VideoQuality.optional(),
   videoRouteId: VideoRouteId.optional(),
@@ -1945,7 +1948,8 @@ var ImageCreativeJobStatus = z14.object({
 });
 var ImageCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: ImageCreativeJobStatusEnum
+  status: ImageCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var ImageCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -1972,7 +1976,8 @@ var LandingCreativeJobStatus = z14.object({
 });
 var LandingCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: LandingCreativeJobStatusEnum
+  status: LandingCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var LandingCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -5643,6 +5648,10 @@ var CreateShopifySubscriptionRequest = z28.object({
 var CreateShopifyBillingChargeRequest = z28.object({
   packId: z28.string().min(1)
 });
+var ShopifyBillingCallbackQuery = z28.object({
+  charge_id: z28.string().regex(/^\d+$/),
+  transactionId: z28.string().uuid()
+});
 var CancelShopifySubscriptionRequest = z28.object({
   subscriptionId: z28.string().min(1)
 });
@@ -10870,6 +10879,7 @@ var MixSceneResult = z48.object({
   index: z48.number().int().positive(),
   status: z48.enum([
     "queued",
+    "submitting",
     "submitted",
     "done",
     "failed"
@@ -13468,7 +13478,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "product_costing"
   ]),
-  defineCapability("create_creative_variant", "6a777fbe7ad17966d16502e8872e15e4db2dcfacdfd2992d24853340d4f22a00", "credit_consuming", "creative", [
+  defineCapability("create_creative_variant", "3e02399a7785df328f1c4d63cfbb6d7481abaac9f91d4a5cf51d410e657d63aa", "credit_consuming", "creative", [
     "credit_consuming",
     "state_change"
   ], [
@@ -13718,7 +13728,9 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     // MCP 7.0.0 (Task 11, .agent/plans/2026-09-15-model-agnostic-video-routes.md):
     // `freeProModel` retired in favor of `modelId` (registry ids). Recomputed
     // from `pnpm --filter @productmaker/mcp test` printing the real digest.
-    "ead1f563a1915452157628d023ba203ecfa8f502a48259a5b5b15be4c84bf768",
+    // Re-baselined 2026-09-26: `idempotencyKey` field description corrected —
+    // paid tools ignore caller-provided keys and derive their own semantic key.
+    "35616a32a42a0bc062218fdfbb4cc7f4ecfa814571fb86b4f11ef9e4184855e1",
     "credit_consuming",
     "creative",
     [
@@ -15980,7 +15992,10 @@ var ApiClient = class {
       method: "POST",
       headers: {
         ...authHeaders,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...options?.idempotencyKey ? {
+          "Idempotency-Key": options.idempotencyKey
+        } : {}
       },
       body: JSON.stringify(body)
     }, options);
@@ -16102,7 +16117,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "8.2.0";
+var MCP_VERSION = "8.3.0";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
@@ -17086,8 +17101,13 @@ async function submitCreative(api, opts) {
   const taskId = r.taskId ?? r.jobId;
   return asText({
     taskId,
-    status: "queued",
-    estimatedSeconds: opts.estimatedSeconds
+    // Replay-aware: a keyed retry may land on a task that is already
+    // processing/done — report the real status, not a hopeful "queued".
+    status: r.status ?? "queued",
+    estimatedSeconds: opts.estimatedSeconds,
+    ...r.replayed === true ? {
+      replayed: true
+    } : {}
   });
 }
 __name(submitCreative, "submitCreative");
@@ -18504,6 +18524,170 @@ ${summary}`,
 }
 __name(requirePaidCreativeConfirmation, "requirePaidCreativeConfirmation");
 
+// src/tools/stable-uuid.ts
+import { createHash as createHash2 } from "crypto";
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
+    key,
+    canonicalize(record[key])
+  ]));
+}
+__name(canonicalize, "canonicalize");
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+__name(canonicalJson, "canonicalJson");
+function deriveUuidV5(name, namespace) {
+  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
+  const digest = createHash2("sha1").update(namespaceBytes).update(name, "utf8").digest();
+  const bytes = Buffer.from(digest.subarray(0, 16));
+  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
+  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+  const hex = bytes.toString("hex");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+__name(deriveUuidV5, "deriveUuidV5");
+
+// src/tools/request-key.ts
+var PAID_REQUEST_KEY_WINDOW_MS = 15 * 60 * 1e3;
+var PAID_REQUEST_KEY_NAMESPACE = "8f3d6b1c-2a47-4e5b-9c0d-6e7f8a9b0c1d";
+var PARAPHRASE_PRONE_FIELDS = /* @__PURE__ */ new Set([
+  "additionalContext",
+  "productContext",
+  "scriptNotes",
+  "creativeDirection",
+  "buyerPersona",
+  "actorDescription",
+  "description",
+  "idempotencyKey",
+  "clientRequestId"
+]);
+var URL_FIELDS = /* @__PURE__ */ new Set([
+  "landingUrl",
+  "productUrl",
+  "url",
+  "serviceLandingUrl"
+]);
+var TRACKING_PARAM_PATTERN = /^(utm_\w+|fbclid|gclid|msclkid|mc_cid|mc_eid|igshid)$/;
+var LANGUAGE_FIELDS = /* @__PURE__ */ new Set([
+  "language",
+  "lang"
+]);
+var CASE_FOLD_FIELDS = /* @__PURE__ */ new Set([
+  "country",
+  "language",
+  "lang"
+]);
+var ORDER_INSIGNIFICANT_ARRAY_FIELDS = /* @__PURE__ */ new Set([
+  "outputs",
+  "selectedOutputs",
+  "features"
+]);
+function sortCanonical(items) {
+  return [
+    ...items
+  ].sort((a, b) => {
+    const ka = canonicalJson(a);
+    const kb = canonicalJson(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+}
+__name(sortCanonical, "sortCanonical");
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord3, "isRecord");
+function collectLanguageCodes(value, out) {
+  if (Array.isArray(value)) {
+    const items = value;
+    for (const item of items) collectLanguageCodes(item, out);
+    return out;
+  }
+  if (!isRecord3(value)) return out;
+  for (const [key, entry] of Object.entries(value)) {
+    if (LANGUAGE_FIELDS.has(key) && typeof entry === "string") {
+      const base = entry.trim().split(/[-_]/)[0]?.toLowerCase();
+      if (base) out.add(base);
+    }
+    collectLanguageCodes(entry, out);
+  }
+  return out;
+}
+__name(collectLanguageCodes, "collectLanguageCodes");
+function normalizeSearchForKey(search) {
+  if (!search) return "";
+  const params = [
+    ...new URLSearchParams(search).entries()
+  ].filter(([key]) => !TRACKING_PARAM_PATTERN.test(key.toLowerCase())).sort(([ka, va], [kb, vb]) => ka === kb ? va < vb ? -1 : va > vb ? 1 : 0 : ka < kb ? -1 : 1);
+  if (!params.length) return "";
+  const out = new URLSearchParams();
+  for (const [key, value] of params) out.append(key, value);
+  return `?${out.toString()}`;
+}
+__name(normalizeSearchForKey, "normalizeSearchForKey");
+function normalizeUrlForKey(value, languages) {
+  const trimmed = value.trim();
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return trimmed.toLowerCase();
+  }
+  const host = url.hostname.toLowerCase().replace(/^www\./, "");
+  const port = url.port ? `:${url.port}` : "";
+  const segments = url.pathname.split("/").filter(Boolean);
+  const soleSegment = segments.length === 1 ? segments[0] : void 0;
+  if (soleSegment !== void 0 && languages.has(soleSegment.toLowerCase())) {
+    segments.pop();
+  }
+  const path3 = segments.length ? `/${segments.join("/")}` : "";
+  return host + port + path3 + normalizeSearchForKey(url.search);
+}
+__name(normalizeUrlForKey, "normalizeUrlForKey");
+function normalizeForKey(value, languages) {
+  if (Array.isArray(value)) {
+    const items = value;
+    return items.map((item) => normalizeForKey(item, languages));
+  }
+  if (!isRecord3(value)) return value;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (PARAPHRASE_PRONE_FIELDS.has(key)) {
+      if (key === "description" && value.mode === "described") {
+        out[key] = normalizeForKey(entry, languages);
+      }
+      continue;
+    }
+    out[key] = URL_FIELDS.has(key) && typeof entry === "string" ? normalizeUrlForKey(entry, languages) : CASE_FOLD_FIELDS.has(key) && typeof entry === "string" ? (
+      // separator too or a host alternating between them splits the key.
+      entry.trim().toLowerCase().replace(/_/g, "-")
+    ) : ORDER_INSIGNIFICANT_ARRAY_FIELDS.has(key) && Array.isArray(entry) ? sortCanonical(entry.map((item) => normalizeForKey(item, languages))) : normalizeForKey(entry, languages);
+  }
+  return out;
+}
+__name(normalizeForKey, "normalizeForKey");
+function derivePaidRequestKey(args) {
+  const languages = collectLanguageCodes(args.input, /* @__PURE__ */ new Set());
+  const semanticInput = normalizeForKey(args.input, languages);
+  const bucket = Math.floor(args.nowMs / PAID_REQUEST_KEY_WINDOW_MS);
+  return deriveUuidV5(canonicalJson({
+    user: args.fingerprint,
+    tool: args.tool,
+    input: semanticInput,
+    bucket
+  }), PAID_REQUEST_KEY_NAMESPACE);
+}
+__name(derivePaidRequestKey, "derivePaidRequestKey");
+
 // src/tools/winning-product-image.ts
 import { z as z75 } from "zod";
 var WinnerReferenceInput = z75.object({
@@ -19040,10 +19224,25 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
       };
       const r = await api.postMultipart("/v1/ingest", {
         images: parts
-      }, fields);
+      }, fields, {
+        // LLM hosts retry paid tools with rephrased arguments — the API's
+        // byte-fingerprint can't see the duplicate, this key can. Derived
+        // from the semantic inputs, not the wire fields, for the same
+        // reason (see request-key.ts, which also canonicalizes the
+        // order-insignificant `outputs` set).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_product_task",
+          input,
+          nowMs: Date.now()
+        })
+      });
       return asText({
         taskId: r.taskId,
-        status: "queued",
+        status: r.status ?? "queued",
+        ...r.replayed ? {
+          replayed: true
+        } : {},
         estimatedSeconds: 300,
         outputs: selectedOutputs,
         outputMode: "single_task",
@@ -19080,26 +19279,56 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
           assets: []
         },
         appDemoVideos: []
+      }, {
+        // The 2026-09-25 incident: four retries of this exact tool created
+        // four charged service tasks because the host rephrased
+        // `additionalContext` and flipped the landing between `/` and
+        // `/es`. The derived key is stable across both rewrites (see
+        // request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_service_video",
+          input,
+          nowMs: Date.now()
+        })
       });
       const angles = await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles`, {});
       const first = angles[0];
+      const replayed = created.replayed === true;
       if (input.reviewMode === "automatic") {
         if (!first) throw new Error("ProductMaker no pudo crear un concepto para este servicio.");
-        await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
-          angleIds: [
-            first.id
-          ]
-        });
+        if (!(replayed && created.status !== "queued")) {
+          await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
+            angleIds: [
+              first.id
+            ]
+          });
+        }
         return asText({
           taskId: created.taskId,
-          status: "processing",
+          status: replayed ? created.status ?? "processing" : "processing",
+          ...replayed ? {
+            replayed: true
+          } : {},
           reviewMode: input.reviewMode,
           selectedConcept: first
         });
       }
+      if (replayed && created.status !== "queued") {
+        return asText({
+          taskId: created.taskId,
+          status: created.status,
+          replayed: true,
+          reviewMode: input.reviewMode,
+          angles
+        });
+      }
       return asText({
         taskId: created.taskId,
         status: "waiting_for_user",
+        ...replayed ? {
+          replayed: true
+        } : {},
         reviewMode: input.reviewMode,
         pendingUserAction: {
           kind: "service_angle_approval",
@@ -19675,7 +19904,6 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
 __name(registerTaskTools, "registerTaskTools");
 
 // src/tools/creatives.ts
-import { randomUUID } from "crypto";
 import { z as z77 } from "zod";
 var generateFreeVideoGuidance = getProductMakerCapabilityModelGuidance("generate_free_video");
 var generateVideoCreativeGuidance = getProductMakerCapabilityModelGuidance("generate_video_creative");
@@ -19796,7 +20024,7 @@ var FreeVideoInput = z77.object({
   videoResolution: VideoResolutionEnum.describe("Resoluci\xF3n del video: 480p o 720p."),
   generateAiMusic: z77.boolean().default(false).describe("Opcional. Agrega m\xFAsica instrumental IA debajo del audio nativo. Default false."),
   addSubtitles: z77.boolean().default(false).describe("Opcional. Quema subt\xEDtulos usando el rawPrompt exacto. Default false."),
-  idempotencyKey: z77.string().uuid().optional().describe("Opcional. UUID para reintentar exactamente esta misma solicitud sin crear ni cobrar otro video. Reutiliza el mismo valor si el cliente no recibi\xF3 la respuesta.")
+  idempotencyKey: z77.string().uuid().optional().describe("Opcional. Se acepta por compatibilidad pero se ignora: la identidad del reintento se deriva autom\xE1ticamente de los argumentos sem\xE1nticos, as\xED que un retry con los mismos argumentos ya es idempotente sin este campo.")
 }).strict();
 var imageStyleList = ImageCreativeStyleEnum.options.join(" | ");
 var ImageCreativeSetup = z77.discriminatedUnion("mode", [
@@ -20018,7 +20246,16 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
           addSubtitles: input.addSubtitles
         },
         allowEmptyImages: true,
-        idempotencyKey: input.idempotencyKey ?? randomUUID(),
+        // Always derived — never `input.idempotencyKey ??`: a host that
+        // mints a fresh UUID per retry would defeat the dedupe entirely.
+        // The semantic key is also a strictly better retry identity: a
+        // reused caller key still lands on it (see request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_free_video",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -20083,6 +20320,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
         path: "/v1/creatives/videos",
         estimatedSeconds: 300,
         input: wirePayload,
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_video_creative",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -20117,6 +20360,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_image_creatives",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -20160,6 +20409,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_landing",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -20291,7 +20546,7 @@ var CreateCreativeVariantInputBase = z78.object({
   sourceTaskId: z78.string().uuid().describe("ID de la tarea original completada."),
   kind: CreativeVariantKindEnum,
   confirm: z78.literal(true).describe("Confirmaci\xF3n expl\xEDcita del usuario despu\xE9s de mostrarle el estimado de cr\xE9ditos."),
-  clientRequestId: z78.string().uuid().describe("UUID estable y obligatorio para esta intenci\xF3n. Reutil\xEDzalo ante timeouts o transporte ambiguo. Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n y un UUID nuevo."),
+  clientRequestId: z78.string().uuid().describe("UUID estable para esta intenci\xF3n (obligatorio por compatibilidad de contrato; el servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo en un retry NO crea una variante duplicada). Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n."),
   angle: z78.string().trim().min(1).max(500).optional().describe("\xC1ngulo nuevo para video o imagen."),
   buyerPersona: z78.string().trim().min(1).max(360).optional().describe("Buyer persona coherente con el \xE1ngulo."),
   scriptNotes: z78.string().trim().min(1).max(2e3).optional().describe("Direcci\xF3n breve del guion para una variante de video."),
@@ -20413,7 +20668,7 @@ function registerCreativeVariantTools(server, api) {
       throw translateError(error);
     }
   });
-  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio: genera un UUID por intenci\xF3n y reutiliza el mismo ante timeouts o transporte ambiguo. Si recibes status=error, pide confirmaci\xF3n para un intento nuevo y usa otro UUID. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
+  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio por contrato: genera un UUID por intenci\xF3n. El servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo NO desbloquea un intento distinto \u2014 si recibes status=error, pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
     try {
       const validatedInput = parseVariantInput(CreateCreativeVariantInput, input);
       const estimateInput = EstimateCreativeVariantInput.parse({
@@ -20440,8 +20695,16 @@ function registerCreativeVariantTools(server, api) {
         });
         sectionKey = LandingSectionKeyEnum.parse(recommendation.value);
       }
+      const derivedClientRequestId = derivePaidRequestKey({
+        fingerprint: api.fingerprint(),
+        tool: "create_creative_variant",
+        input: {
+          ...validatedInput
+        },
+        nowMs: Date.now()
+      });
       const payload = {
-        clientRequestId: validatedInput.clientRequestId,
+        clientRequestId: derivedClientRequestId,
         kind: validatedInput.kind,
         ...validatedInput.kind !== "landing" ? {
           angle: validatedInput.angle,
@@ -20467,7 +20730,7 @@ function registerCreativeVariantTools(server, api) {
       };
       const created = await api.postJson(`/v1/tasks/${encodeURIComponent(validatedInput.sourceTaskId)}/creative-variants`, payload);
       if (created.status === "error") {
-        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n para un intento nuevo y usa otro clientRequestId.", {
+        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos para un intento nuevo.", {
           variantTaskId: created.variantTaskId
         });
       }
@@ -20682,39 +20945,6 @@ __name(registerActorTools, "registerActorTools");
 // src/tools/publish.ts
 import { z as z82 } from "zod";
 
-// src/tools/stable-uuid.ts
-import { createHash as createHash2 } from "crypto";
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
-    key,
-    canonicalize(record[key])
-  ]));
-}
-__name(canonicalize, "canonicalize");
-function canonicalJson(value) {
-  return JSON.stringify(canonicalize(value));
-}
-__name(canonicalJson, "canonicalJson");
-function deriveUuidV5(name, namespace) {
-  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
-  const digest = createHash2("sha1").update(namespaceBytes).update(name, "utf8").digest();
-  const bytes = Buffer.from(digest.subarray(0, 16));
-  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
-  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-  const hex = bytes.toString("hex");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20)
-  ].join("-");
-}
-__name(deriveUuidV5, "deriveUuidV5");
-
 // src/tools/meta-publish-attempt-id.ts
 var META_PUBLISH_NAMESPACE = "7b19c9ac-b4eb-4db1-970e-c2f24ce30b98";
 function deriveMetaPublishAttemptId(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productmaker/mcp",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "type": "module",
   "private": false,
   "description": "ProductMaker MCP server — cost products, generate landing pages, UGC videos, and ad creatives, and publish to Shopify, Meta Ads, and TikTok Ads.",