@productmaker/mcp 8.2.0 → 8.3.1

package/dist/http.js

@@ -1830,6 +1830,9 @@ var VideoCreativeJobStatus = z14.object({
 var VideoCreativeJobPayload = z14.object({
   jobId: z14.string().optional(),
   status: VideoCreativeJobStatusEnum.optional(),
+  /** True when the submission replayed an existing task instead of billing
+  *  new work — callers surface the twin verbatim. Omitted on fresh creates. */
+  replayed: z14.boolean().optional(),
   videoStructure: VideoStructure.optional(),
   videoQuality: VideoQuality.optional(),
   videoRouteId: VideoRouteId.optional(),
@@ -1923,7 +1926,8 @@ var ImageCreativeJobStatus = z14.object({
 });
 var ImageCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: ImageCreativeJobStatusEnum
+  status: ImageCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var ImageCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -1950,7 +1954,8 @@ var LandingCreativeJobStatus = z14.object({
 });
 var LandingCreativeJobPayload = z14.object({
   jobId: z14.string().uuid(),
-  status: LandingCreativeJobStatusEnum
+  status: LandingCreativeJobStatusEnum,
+  replayed: z14.boolean().optional()
 });
 var LandingCreativeHistoryEntry = z14.object({
   id: z14.string().uuid(),
@@ -5621,6 +5626,10 @@ var CreateShopifySubscriptionRequest = z28.object({
 var CreateShopifyBillingChargeRequest = z28.object({
   packId: z28.string().min(1)
 });
+var ShopifyBillingCallbackQuery = z28.object({
+  charge_id: z28.string().regex(/^\d+$/),
+  transactionId: z28.string().uuid()
+});
 var CancelShopifySubscriptionRequest = z28.object({
   subscriptionId: z28.string().min(1)
 });
@@ -10848,6 +10857,7 @@ var MixSceneResult = z48.object({
   index: z48.number().int().positive(),
   status: z48.enum([
     "queued",
+    "submitting",
     "submitted",
     "done",
     "failed"
@@ -13446,7 +13456,7 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
   ], [
     "product_costing"
   ]),
-  defineCapability("create_creative_variant", "6a777fbe7ad17966d16502e8872e15e4db2dcfacdfd2992d24853340d4f22a00", "credit_consuming", "creative", [
+  defineCapability("create_creative_variant", "3e02399a7785df328f1c4d63cfbb6d7481abaac9f91d4a5cf51d410e657d63aa", "credit_consuming", "creative", [
     "credit_consuming",
     "state_change"
   ], [
@@ -13696,7 +13706,9 @@ var PRODUCTMAKER_CAPABILITY_REGISTRY = deepFreeze([
     // MCP 7.0.0 (Task 11, .agent/plans/2026-09-15-model-agnostic-video-routes.md):
     // `freeProModel` retired in favor of `modelId` (registry ids). Recomputed
     // from `pnpm --filter @productmaker/mcp test` printing the real digest.
-    "ead1f563a1915452157628d023ba203ecfa8f502a48259a5b5b15be4c84bf768",
+    // Re-baselined 2026-09-26: `idempotencyKey` field description corrected —
+    // paid tools ignore caller-provided keys and derive their own semantic key.
+    "35616a32a42a0bc062218fdfbb4cc7f4ecfa814571fb86b4f11ef9e4184855e1",
     "credit_consuming",
     "creative",
     [
@@ -16195,6 +16207,9 @@ function buildProxyUrl(opts) {
 }
 __name(buildProxyUrl, "buildProxyUrl");
 
+// src/http.ts
+import { getOAuthProtectedResourceMetadataUrl as getOAuthProtectedResourceMetadataUrl2 } from "@modelcontextprotocol/sdk/server/auth/router.js";
+
 // src/auth/http-oauth.ts
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
@@ -16604,6 +16619,7 @@ import { createRemoteJWKSet as createRemoteJWKSet2, jwtVerify as jwtVerify2 } fr
 import { z as z73 } from "zod";
 var MCP_RESOURCE = new URL("https://mcp.productmaker.app/mcp");
 var MCP_SCOPE = "mcp:access";
+var REFRESH_SCOPE = "offline_access";
 var STATIC_CLIENT_ISSUER = new URL(MCP_RESOURCE.origin);
 var oauthEnvSchema = z73.object({
   MCP_REMOTE_AUTH_MODE: z73.literal("oauth"),
@@ -16799,6 +16815,121 @@ var Auth0TokenVerifier = class {
   }
 };
 
+// src/oauth-analytics.ts
+import { PostHog } from "posthog-node";
+var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "token",
+  "authorization",
+  "apikey",
+  "clientsecret",
+  "subjecttoken",
+  "accesstoken",
+  "refreshtoken",
+  "idtoken",
+  "code",
+  "secret",
+  "password"
+]);
+var SENSITIVE_ASSIGNMENT_PATTERN = /(\b(?:access[_-]?token|authorization|client[_-]?secret|subject[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password|code)\b\s*[:=]\s*)(?:(bearer)\s+)?(?:(['"])(.*?)\3|([^\s,;&}"']+))/gi;
+var BEARER_TOKEN_PATTERN = /\b(bearer\s+)([A-Za-z0-9._~+/=-]+)/gi;
+var client = null;
+var KNOWN_MCP_OAUTH_ANALYTICS_EVENTS = [
+  MCP_OAUTH_ANALYTICS_EVENTS.STARTED,
+  MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED,
+  MCP_OAUTH_ANALYTICS_EVENTS.FAILED,
+  MCP_OAUTH_ANALYTICS_EVENTS.SAFE_VARIANT
+];
+function getPostHogClient() {
+  if (client) return client;
+  const apiKey = process.env.POSTHOG_API_KEY;
+  if (!apiKey) return null;
+  client = new PostHog(apiKey, {
+    host: process.env.POSTHOG_HOST || DEFAULT_POSTHOG_HOST,
+    flushAt: 20,
+    flushInterval: 1e4
+  });
+  return client;
+}
+__name(getPostHogClient, "getPostHogClient");
+function normalizeKey(key) {
+  return key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+}
+__name(normalizeKey, "normalizeKey");
+function isSensitiveKey(key) {
+  const normalizedKey = normalizeKey(key);
+  return SENSITIVE_KEYS.has(normalizedKey) || normalizedKey.endsWith("token") || normalizedKey.endsWith("secret");
+}
+__name(isSensitiveKey, "isSensitiveKey");
+function sanitizeUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return value;
+    }
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return value;
+  }
+}
+__name(sanitizeUrl, "sanitizeUrl");
+function sanitizeString(value) {
+  const redacted = value.replace(SENSITIVE_ASSIGNMENT_PATTERN, (_match, prefix, scheme, quote) => {
+    const replacement = quote ? `${quote}${REDACTED}${quote}` : REDACTED;
+    return `${prefix}${scheme ? `${scheme} ` : ""}${replacement}`;
+  }).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED}`);
+  const sanitizedUrl = sanitizeUrl(redacted);
+  if (sanitizedUrl !== redacted) return sanitizedUrl;
+  return redacted.replace(/https?:\/\/[^\s"'<>]+/gi, sanitizeUrl);
+}
+__name(sanitizeString, "sanitizeString");
+function sanitizeValue(value) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => sanitizeValue(entry));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
+      if (isSensitiveKey(key)) {
+        return [
+          key,
+          REDACTED
+        ];
+      }
+      return [
+        key,
+        sanitizeValue(entry)
+      ];
+    }));
+  }
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  return value;
+}
+__name(sanitizeValue, "sanitizeValue");
+var OAuthAnalytics = class {
+  static {
+    __name(this, "OAuthAnalytics");
+  }
+  capture(event, subject, properties) {
+    const posthog = getPostHogClient();
+    if (!posthog) return;
+    try {
+      posthog.capture({
+        distinctId: subject ?? "mcp_oauth_aggregate",
+        event,
+        properties: sanitizeValue(properties)
+      });
+    } catch {
+    }
+  }
+};
+
 // src/auth/oauth-proxy.ts
 import { createHmac as createHmac2, hkdfSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import express from "express";
@@ -16885,6 +17016,15 @@ var OAUTH_PROXY_PATHS = {
   token: "/oauth/token"
 };
 var PROXY_CALLBACK_URL = new URL(OAUTH_PROXY_PATHS.callback.slice(1), STATIC_CLIENT_ISSUER).href;
+function responseIssuesRefreshToken(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    return typeof parsed === "object" && parsed !== null && "refresh_token" in parsed && typeof parsed.refresh_token === "string" && parsed.refresh_token !== "";
+  } catch {
+    return false;
+  }
+}
+__name(responseIssuesRefreshToken, "responseIssuesRefreshToken");
 function firstQueryValue(value) {
   if (typeof value === "string") return value;
   if (Array.isArray(value) && typeof value[0] === "string") return value[0];
@@ -16898,6 +17038,12 @@ function badRequest(res, description) {
   });
 }
 __name(badRequest, "badRequest");
+function withRefreshScope(requested) {
+  const scopes = (requested?.trim() ? requested : MCP_SCOPE).split(/\s+/).filter(Boolean);
+  if (!scopes.includes(REFRESH_SCOPE)) scopes.push(REFRESH_SCOPE);
+  return scopes.join(" ");
+}
+__name(withRefreshScope, "withRefreshScope");
 function createOAuthProxyRouter(options) {
   const router = express.Router();
   const stateKey3 = deriveStateKey(options.staticClient.clientSecret);
@@ -16921,13 +17067,14 @@ function createOAuthProxyRouter(options) {
     }
     const upstream = new URL(options.authorizationEndpoint);
     for (const [key, value] of Object.entries(req.query)) {
-      if (key === "redirect_uri" || key === "state") continue;
+      if (key === "redirect_uri" || key === "state" || key === "scope") continue;
       for (const v of Array.isArray(value) ? value : [
         value
       ]) {
         if (typeof v === "string") upstream.searchParams.append(key, v);
       }
     }
+    upstream.searchParams.set("scope", withRefreshScope(firstQueryValue(req.query.scope)));
     upstream.searchParams.set("redirect_uri", PROXY_CALLBACK_URL);
     upstream.searchParams.set("state", sealState(stateKey3, {
       redirectUri,
@@ -16987,13 +17134,10 @@ function createOAuthProxyRouter(options) {
       });
       return;
     }
+    body.set("client_secret", options.staticClient.clientSecret);
     const headers = {
       "content-type": "application/x-www-form-urlencoded"
     };
-    const authorization = req.headers.authorization;
-    if (typeof authorization === "string") {
-      headers.authorization = authorization;
-    }
     let upstream;
     let payload;
     try {
@@ -17010,6 +17154,14 @@ function createOAuthProxyRouter(options) {
       });
       return;
     }
+    try {
+      options.onTokenExchange?.({
+        grantType,
+        status: upstream.status,
+        refreshTokenIssued: responseIssuesRefreshToken(payload)
+      });
+    } catch {
+    }
     res.status(upstream.status).type(upstream.headers.get("content-type") ?? "application/json").send(payload);
   });
   return router;
@@ -17026,11 +17178,12 @@ var REGISTRATION_RATE_LIMIT = {
   windowMs: 6e4,
   max: 120
 };
+var PUBLIC_CLIENT_SECRET_PLACEHOLDER = "pm-public-client";
 function buildStaticClientInformation(staticClient, requested) {
   return {
     client_id: staticClient.clientId,
-    client_secret: staticClient.clientSecret,
-    // 0 = never expires (RFC 7591 §3.2.1); the secret is Auth0's, not ours.
+    client_secret: PUBLIC_CLIENT_SECRET_PLACEHOLDER,
+    // 0 = never expires (RFC 7591 §3.2.1); the placeholder is a constant.
     client_secret_expires_at: 0,
     token_endpoint_auth_method: "client_secret_post",
     redirect_uris: requested.redirect_uris,
@@ -17041,7 +17194,12 @@ function buildStaticClientInformation(staticClient, requested) {
     response_types: [
       "code"
     ],
-    scope: requested.scope ?? MCP_SCOPE,
+    // Clients that defer scope choice to the server get the full intended
+    // set: `mcp:access` for the resource plus `offline_access` so the session
+    // can refresh instead of dying an interactive re-auth every 900s access
+    // token (the auth loop seen in production). A client that names its own
+    // scope list is echoed verbatim — its choice wins.
+    scope: requested.scope ?? `${MCP_SCOPE} ${REFRESH_SCOPE}`,
     ...requested.client_name !== void 0 ? {
       client_name: requested.client_name
     } : {}
@@ -17088,8 +17246,12 @@ function buildStaticClientAuthorizationServerMetadata(auth0Metadata) {
     token_endpoint_auth_methods_supported: [
       "client_secret_post"
     ],
+    // `offline_access` is what lets a client ASK for a refresh token; without
+    // it in scopes_supported, conforming clients never request it and every
+    // 900s access-token expiry becomes an interactive re-auth loop.
     scopes_supported: [
-      MCP_SCOPE
+      MCP_SCOPE,
+      REFRESH_SCOPE
     ],
     service_documentation: "https://productmaker.app/"
   };
@@ -17141,11 +17303,23 @@ function createMetadataRouter(config, metadata, fetchFn) {
     staticClient: config.staticClient,
     authorizationEndpoint: metadata.authorization_endpoint,
     tokenEndpoint: metadata.token_endpoint,
-    fetchFn
+    fetchFn,
+    onTokenExchange: captureTokenExchange
   }));
   return router;
 }
 __name(createMetadataRouter, "createMetadataRouter");
+var tokenExchangeAnalytics = new OAuthAnalytics();
+function captureTokenExchange(outcome) {
+  const ok = outcome.status >= 200 && outcome.status < 300;
+  tokenExchangeAnalytics.capture(ok ? MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED : MCP_OAUTH_ANALYTICS_EVENTS.FAILED, null, {
+    stage: "token_exchange",
+    grantType: outcome.grantType,
+    status: outcome.status,
+    refreshTokenIssued: outcome.refreshTokenIssued
+  });
+}
+__name(captureTokenExchange, "captureTokenExchange");
 function createHttpOAuth(config, metadata, fetchFn) {
   const verifier = new Auth0TokenVerifier(config, metadata.jwks_uri);
   const oboClient = new Auth0OboClient(config, {
@@ -17424,121 +17598,6 @@ function registerProductMakerPrompts(server) {
 }
 __name(registerProductMakerPrompts, "registerProductMakerPrompts");
 
-// src/oauth-analytics.ts
-import { PostHog } from "posthog-node";
-var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
-var REDACTED = "[REDACTED]";
-var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
-  "token",
-  "authorization",
-  "apikey",
-  "clientsecret",
-  "subjecttoken",
-  "accesstoken",
-  "refreshtoken",
-  "idtoken",
-  "code",
-  "secret",
-  "password"
-]);
-var SENSITIVE_ASSIGNMENT_PATTERN = /(\b(?:access[_-]?token|authorization|client[_-]?secret|subject[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password|code)\b\s*[:=]\s*)(?:(bearer)\s+)?(?:(['"])(.*?)\3|([^\s,;&}"']+))/gi;
-var BEARER_TOKEN_PATTERN = /\b(bearer\s+)([A-Za-z0-9._~+/=-]+)/gi;
-var client = null;
-var KNOWN_MCP_OAUTH_ANALYTICS_EVENTS = [
-  MCP_OAUTH_ANALYTICS_EVENTS.STARTED,
-  MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED,
-  MCP_OAUTH_ANALYTICS_EVENTS.FAILED,
-  MCP_OAUTH_ANALYTICS_EVENTS.SAFE_VARIANT
-];
-function getPostHogClient() {
-  if (client) return client;
-  const apiKey = process.env.POSTHOG_API_KEY;
-  if (!apiKey) return null;
-  client = new PostHog(apiKey, {
-    host: process.env.POSTHOG_HOST || DEFAULT_POSTHOG_HOST,
-    flushAt: 20,
-    flushInterval: 1e4
-  });
-  return client;
-}
-__name(getPostHogClient, "getPostHogClient");
-function normalizeKey(key) {
-  return key.replace(/[^a-z0-9]/gi, "").toLowerCase();
-}
-__name(normalizeKey, "normalizeKey");
-function isSensitiveKey(key) {
-  const normalizedKey = normalizeKey(key);
-  return SENSITIVE_KEYS.has(normalizedKey) || normalizedKey.endsWith("token") || normalizedKey.endsWith("secret");
-}
-__name(isSensitiveKey, "isSensitiveKey");
-function sanitizeUrl(value) {
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return value;
-    }
-    parsed.username = "";
-    parsed.password = "";
-    parsed.search = "";
-    parsed.hash = "";
-    return parsed.toString();
-  } catch {
-    return value;
-  }
-}
-__name(sanitizeUrl, "sanitizeUrl");
-function sanitizeString(value) {
-  const redacted = value.replace(SENSITIVE_ASSIGNMENT_PATTERN, (_match, prefix, scheme, quote) => {
-    const replacement = quote ? `${quote}${REDACTED}${quote}` : REDACTED;
-    return `${prefix}${scheme ? `${scheme} ` : ""}${replacement}`;
-  }).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED}`);
-  const sanitizedUrl = sanitizeUrl(redacted);
-  if (sanitizedUrl !== redacted) return sanitizedUrl;
-  return redacted.replace(/https?:\/\/[^\s"'<>]+/gi, sanitizeUrl);
-}
-__name(sanitizeString, "sanitizeString");
-function sanitizeValue(value) {
-  if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeValue(entry));
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
-      if (isSensitiveKey(key)) {
-        return [
-          key,
-          REDACTED
-        ];
-      }
-      return [
-        key,
-        sanitizeValue(entry)
-      ];
-    }));
-  }
-  if (typeof value === "string") {
-    return sanitizeString(value);
-  }
-  return value;
-}
-__name(sanitizeValue, "sanitizeValue");
-var OAuthAnalytics = class {
-  static {
-    __name(this, "OAuthAnalytics");
-  }
-  capture(event, subject, properties) {
-    const posthog = getPostHogClient();
-    if (!posthog) return;
-    try {
-      posthog.capture({
-        distinctId: subject ?? "mcp_oauth_aggregate",
-        event,
-        properties: sanitizeValue(properties)
-      });
-    } catch {
-    }
-  }
-};
-
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -17601,7 +17660,10 @@ var ApiClient = class {
       method: "POST",
       headers: {
         ...authHeaders,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...options?.idempotencyKey ? {
+          "Idempotency-Key": options.idempotencyKey
+        } : {}
       },
       body: JSON.stringify(body)
     }, options);
@@ -17723,7 +17785,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "8.2.0";
+var MCP_VERSION = "8.3.1";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";
@@ -18707,8 +18769,13 @@ async function submitCreative(api, opts) {
   const taskId = r.taskId ?? r.jobId;
   return asText({
     taskId,
-    status: "queued",
-    estimatedSeconds: opts.estimatedSeconds
+    // Replay-aware: a keyed retry may land on a task that is already
+    // processing/done — report the real status, not a hopeful "queued".
+    status: r.status ?? "queued",
+    estimatedSeconds: opts.estimatedSeconds,
+    ...r.replayed === true ? {
+      replayed: true
+    } : {}
   });
 }
 __name(submitCreative, "submitCreative");
@@ -20072,6 +20139,170 @@ ${summary}`,
 }
 __name(requirePaidCreativeConfirmation, "requirePaidCreativeConfirmation");
 
+// src/tools/stable-uuid.ts
+import { createHash as createHash3 } from "crypto";
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
+    key,
+    canonicalize(record[key])
+  ]));
+}
+__name(canonicalize, "canonicalize");
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+__name(canonicalJson, "canonicalJson");
+function deriveUuidV5(name, namespace) {
+  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
+  const digest = createHash3("sha1").update(namespaceBytes).update(name, "utf8").digest();
+  const bytes = Buffer.from(digest.subarray(0, 16));
+  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
+  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+  const hex = bytes.toString("hex");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20)
+  ].join("-");
+}
+__name(deriveUuidV5, "deriveUuidV5");
+
+// src/tools/request-key.ts
+var PAID_REQUEST_KEY_WINDOW_MS = 15 * 60 * 1e3;
+var PAID_REQUEST_KEY_NAMESPACE = "8f3d6b1c-2a47-4e5b-9c0d-6e7f8a9b0c1d";
+var PARAPHRASE_PRONE_FIELDS = /* @__PURE__ */ new Set([
+  "additionalContext",
+  "productContext",
+  "scriptNotes",
+  "creativeDirection",
+  "buyerPersona",
+  "actorDescription",
+  "description",
+  "idempotencyKey",
+  "clientRequestId"
+]);
+var URL_FIELDS = /* @__PURE__ */ new Set([
+  "landingUrl",
+  "productUrl",
+  "url",
+  "serviceLandingUrl"
+]);
+var TRACKING_PARAM_PATTERN = /^(utm_\w+|fbclid|gclid|msclkid|mc_cid|mc_eid|igshid)$/;
+var LANGUAGE_FIELDS = /* @__PURE__ */ new Set([
+  "language",
+  "lang"
+]);
+var CASE_FOLD_FIELDS = /* @__PURE__ */ new Set([
+  "country",
+  "language",
+  "lang"
+]);
+var ORDER_INSIGNIFICANT_ARRAY_FIELDS = /* @__PURE__ */ new Set([
+  "outputs",
+  "selectedOutputs",
+  "features"
+]);
+function sortCanonical(items) {
+  return [
+    ...items
+  ].sort((a, b) => {
+    const ka = canonicalJson(a);
+    const kb = canonicalJson(b);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+}
+__name(sortCanonical, "sortCanonical");
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord3, "isRecord");
+function collectLanguageCodes(value, out) {
+  if (Array.isArray(value)) {
+    const items = value;
+    for (const item of items) collectLanguageCodes(item, out);
+    return out;
+  }
+  if (!isRecord3(value)) return out;
+  for (const [key, entry] of Object.entries(value)) {
+    if (LANGUAGE_FIELDS.has(key) && typeof entry === "string") {
+      const base = entry.trim().split(/[-_]/)[0]?.toLowerCase();
+      if (base) out.add(base);
+    }
+    collectLanguageCodes(entry, out);
+  }
+  return out;
+}
+__name(collectLanguageCodes, "collectLanguageCodes");
+function normalizeSearchForKey(search) {
+  if (!search) return "";
+  const params = [
+    ...new URLSearchParams(search).entries()
+  ].filter(([key]) => !TRACKING_PARAM_PATTERN.test(key.toLowerCase())).sort(([ka, va], [kb, vb]) => ka === kb ? va < vb ? -1 : va > vb ? 1 : 0 : ka < kb ? -1 : 1);
+  if (!params.length) return "";
+  const out = new URLSearchParams();
+  for (const [key, value] of params) out.append(key, value);
+  return `?${out.toString()}`;
+}
+__name(normalizeSearchForKey, "normalizeSearchForKey");
+function normalizeUrlForKey(value, languages) {
+  const trimmed = value.trim();
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return trimmed.toLowerCase();
+  }
+  const host = url.hostname.toLowerCase().replace(/^www\./, "");
+  const port = url.port ? `:${url.port}` : "";
+  const segments = url.pathname.split("/").filter(Boolean);
+  const soleSegment = segments.length === 1 ? segments[0] : void 0;
+  if (soleSegment !== void 0 && languages.has(soleSegment.toLowerCase())) {
+    segments.pop();
+  }
+  const path3 = segments.length ? `/${segments.join("/")}` : "";
+  return host + port + path3 + normalizeSearchForKey(url.search);
+}
+__name(normalizeUrlForKey, "normalizeUrlForKey");
+function normalizeForKey(value, languages) {
+  if (Array.isArray(value)) {
+    const items = value;
+    return items.map((item) => normalizeForKey(item, languages));
+  }
+  if (!isRecord3(value)) return value;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (PARAPHRASE_PRONE_FIELDS.has(key)) {
+      if (key === "description" && value.mode === "described") {
+        out[key] = normalizeForKey(entry, languages);
+      }
+      continue;
+    }
+    out[key] = URL_FIELDS.has(key) && typeof entry === "string" ? normalizeUrlForKey(entry, languages) : CASE_FOLD_FIELDS.has(key) && typeof entry === "string" ? (
+      // separator too or a host alternating between them splits the key.
+      entry.trim().toLowerCase().replace(/_/g, "-")
+    ) : ORDER_INSIGNIFICANT_ARRAY_FIELDS.has(key) && Array.isArray(entry) ? sortCanonical(entry.map((item) => normalizeForKey(item, languages))) : normalizeForKey(entry, languages);
+  }
+  return out;
+}
+__name(normalizeForKey, "normalizeForKey");
+function derivePaidRequestKey(args) {
+  const languages = collectLanguageCodes(args.input, /* @__PURE__ */ new Set());
+  const semanticInput = normalizeForKey(args.input, languages);
+  const bucket = Math.floor(args.nowMs / PAID_REQUEST_KEY_WINDOW_MS);
+  return deriveUuidV5(canonicalJson({
+    user: args.fingerprint,
+    tool: args.tool,
+    input: semanticInput,
+    bucket
+  }), PAID_REQUEST_KEY_NAMESPACE);
+}
+__name(derivePaidRequestKey, "derivePaidRequestKey");
+
 // src/tools/winning-product-image.ts
 import { z as z76 } from "zod";
 var WinnerReferenceInput = z76.object({
@@ -20608,10 +20839,25 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
       };
       const r = await api.postMultipart("/v1/ingest", {
         images: parts
-      }, fields);
+      }, fields, {
+        // LLM hosts retry paid tools with rephrased arguments — the API's
+        // byte-fingerprint can't see the duplicate, this key can. Derived
+        // from the semantic inputs, not the wire fields, for the same
+        // reason (see request-key.ts, which also canonicalizes the
+        // order-insignificant `outputs` set).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_product_task",
+          input,
+          nowMs: Date.now()
+        })
+      });
       return asText({
         taskId: r.taskId,
-        status: "queued",
+        status: r.status ?? "queued",
+        ...r.replayed ? {
+          replayed: true
+        } : {},
         estimatedSeconds: 300,
         outputs: selectedOutputs,
         outputMode: "single_task",
@@ -20648,26 +20894,56 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
           assets: []
         },
         appDemoVideos: []
+      }, {
+        // The 2026-09-25 incident: four retries of this exact tool created
+        // four charged service tasks because the host rephrased
+        // `additionalContext` and flipped the landing between `/` and
+        // `/es`. The derived key is stable across both rewrites (see
+        // request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "create_service_video",
+          input,
+          nowMs: Date.now()
+        })
       });
       const angles = await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles`, {});
       const first = angles[0];
+      const replayed = created.replayed === true;
       if (input.reviewMode === "automatic") {
         if (!first) throw new Error("ProductMaker no pudo crear un concepto para este servicio.");
-        await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
-          angleIds: [
-            first.id
-          ]
-        });
+        if (!(replayed && created.status !== "queued")) {
+          await api.postJson(`/v1/tasks/${encodeURIComponent(created.taskId)}/service-angles/select`, {
+            angleIds: [
+              first.id
+            ]
+          });
+        }
         return asText({
           taskId: created.taskId,
-          status: "processing",
+          status: replayed ? created.status ?? "processing" : "processing",
+          ...replayed ? {
+            replayed: true
+          } : {},
           reviewMode: input.reviewMode,
           selectedConcept: first
         });
       }
+      if (replayed && created.status !== "queued") {
+        return asText({
+          taskId: created.taskId,
+          status: created.status,
+          replayed: true,
+          reviewMode: input.reviewMode,
+          angles
+        });
+      }
       return asText({
         taskId: created.taskId,
         status: "waiting_for_user",
+        ...replayed ? {
+          replayed: true
+        } : {},
         reviewMode: input.reviewMode,
         pendingUserAction: {
           kind: "service_angle_approval",
@@ -21243,7 +21519,6 @@ ANTES de invocar, resume outputs, cantidad de videos y datos comerciales, explic
 __name(registerTaskTools, "registerTaskTools");
 
 // src/tools/creatives.ts
-import { randomUUID } from "crypto";
 import { z as z78 } from "zod";
 var generateFreeVideoGuidance = getProductMakerCapabilityModelGuidance("generate_free_video");
 var generateVideoCreativeGuidance = getProductMakerCapabilityModelGuidance("generate_video_creative");
@@ -21364,7 +21639,7 @@ var FreeVideoInput = z78.object({
   videoResolution: VideoResolutionEnum.describe("Resoluci\xF3n del video: 480p o 720p."),
   generateAiMusic: z78.boolean().default(false).describe("Opcional. Agrega m\xFAsica instrumental IA debajo del audio nativo. Default false."),
   addSubtitles: z78.boolean().default(false).describe("Opcional. Quema subt\xEDtulos usando el rawPrompt exacto. Default false."),
-  idempotencyKey: z78.string().uuid().optional().describe("Opcional. UUID para reintentar exactamente esta misma solicitud sin crear ni cobrar otro video. Reutiliza el mismo valor si el cliente no recibi\xF3 la respuesta.")
+  idempotencyKey: z78.string().uuid().optional().describe("Opcional. Se acepta por compatibilidad pero se ignora: la identidad del reintento se deriva autom\xE1ticamente de los argumentos sem\xE1nticos, as\xED que un retry con los mismos argumentos ya es idempotente sin este campo.")
 }).strict();
 var imageStyleList = ImageCreativeStyleEnum.options.join(" | ");
 var ImageCreativeSetup = z78.discriminatedUnion("mode", [
@@ -21586,7 +21861,16 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
           addSubtitles: input.addSubtitles
         },
         allowEmptyImages: true,
-        idempotencyKey: input.idempotencyKey ?? randomUUID(),
+        // Always derived — never `input.idempotencyKey ??`: a host that
+        // mints a fresh UUID per retry would defeat the dedupe entirely.
+        // The semantic key is also a strictly better retry identity: a
+        // reused caller key still lands on it (see request-key.ts).
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_free_video",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21651,6 +21935,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
         path: "/v1/creatives/videos",
         estimatedSeconds: 300,
         input: wirePayload,
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_video_creative",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21685,6 +21975,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_image_creatives",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21728,6 +22024,12 @@ function registerCreativeTools(server, api, { transport = "http" } = {}) {
             pauseForAngleReview: true
           }
         },
+        idempotencyKey: derivePaidRequestKey({
+          fingerprint: api.fingerprint(),
+          tool: "generate_landing",
+          input,
+          nowMs: Date.now()
+        }),
         transport
       });
     } catch (e) {
@@ -21859,7 +22161,7 @@ var CreateCreativeVariantInputBase = z79.object({
   sourceTaskId: z79.string().uuid().describe("ID de la tarea original completada."),
   kind: CreativeVariantKindEnum,
   confirm: z79.literal(true).describe("Confirmaci\xF3n expl\xEDcita del usuario despu\xE9s de mostrarle el estimado de cr\xE9ditos."),
-  clientRequestId: z79.string().uuid().describe("UUID estable y obligatorio para esta intenci\xF3n. Reutil\xEDzalo ante timeouts o transporte ambiguo. Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n y un UUID nuevo."),
+  clientRequestId: z79.string().uuid().describe("UUID estable para esta intenci\xF3n (obligatorio por compatibilidad de contrato; el servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo en un retry NO crea una variante duplicada). Si la API devuelve status=error, una nueva generaci\xF3n exige otra confirmaci\xF3n."),
   angle: z79.string().trim().min(1).max(500).optional().describe("\xC1ngulo nuevo para video o imagen."),
   buyerPersona: z79.string().trim().min(1).max(360).optional().describe("Buyer persona coherente con el \xE1ngulo."),
   scriptNotes: z79.string().trim().min(1).max(2e3).optional().describe("Direcci\xF3n breve del guion para una variante de video."),
@@ -21981,7 +22283,7 @@ function registerCreativeVariantTools(server, api) {
       throw translateError(error);
     }
   });
-  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio: genera un UUID por intenci\xF3n y reutiliza el mismo ante timeouts o transporte ambiguo. Si recibes status=error, pide confirmaci\xF3n para un intento nuevo y usa otro UUID. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
+  server.tool("create_creative_variant", createCreativeVariantGuidance.summary + " ES UNA ACCI\xD3N DE PAGO: primero llama estimate_creative_variant, muestra el rango de cr\xE9ditos al usuario y solo despu\xE9s invoca este tool con confirm=true. Las recomendaciones IA tambi\xE9n son acciones pagas a 2x del costo real. clientRequestId es obligatorio por contrato: genera un UUID por intenci\xF3n. El servidor deriva la identidad real del request desde los argumentos sem\xE1nticos, as\xED que un UUID nuevo NO desbloquea un intento distinto \u2014 si recibes status=error, pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos. Reutiliza el producto y referencias del task origen; crea un child task independiente y devuelve variantTaskId. Para landing puedes enviar instructions en texto libre y omitir sectionKey: el backend lo clasifica con IA. No expone ni permite cambiar videoModel, videoTier, videoStyle o narrativeStyle; esos valores se heredan del task origen.", CreateCreativeVariantInputBase.shape, CREATES_PAID, async (input) => {
     try {
       const validatedInput = parseVariantInput(CreateCreativeVariantInput, input);
       const estimateInput = EstimateCreativeVariantInput.parse({
@@ -22008,8 +22310,16 @@ function registerCreativeVariantTools(server, api) {
         });
         sectionKey = LandingSectionKeyEnum.parse(recommendation.value);
       }
+      const derivedClientRequestId = derivePaidRequestKey({
+        fingerprint: api.fingerprint(),
+        tool: "create_creative_variant",
+        input: {
+          ...validatedInput
+        },
+        nowMs: Date.now()
+      });
       const payload = {
-        clientRequestId: validatedInput.clientRequestId,
+        clientRequestId: derivedClientRequestId,
         kind: validatedInput.kind,
         ...validatedInput.kind !== "landing" ? {
           angle: validatedInput.angle,
@@ -22035,7 +22345,7 @@ function registerCreativeVariantTools(server, api) {
       };
       const created = await api.postJson(`/v1/tasks/${encodeURIComponent(validatedInput.sourceTaskId)}/creative-variants`, payload);
       if (created.status === "error") {
-        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n para un intento nuevo y usa otro clientRequestId.", {
+        throw mcp(McpErrorCode.CREATIVE_VARIANT_FAILED, "La variante anterior termin\xF3 con error. Pide confirmaci\xF3n al usuario y reinvoca con los mismos argumentos para un intento nuevo.", {
           variantTaskId: created.variantTaskId
         });
       }
@@ -22250,39 +22560,6 @@ __name(registerActorTools, "registerActorTools");
 // src/tools/publish.ts
 import { z as z83 } from "zod";
 
-// src/tools/stable-uuid.ts
-import { createHash as createHash3 } from "crypto";
-function canonicalize(value) {
-  if (Array.isArray(value)) return value.map(canonicalize);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [
-    key,
-    canonicalize(record[key])
-  ]));
-}
-__name(canonicalize, "canonicalize");
-function canonicalJson(value) {
-  return JSON.stringify(canonicalize(value));
-}
-__name(canonicalJson, "canonicalJson");
-function deriveUuidV5(name, namespace) {
-  const namespaceBytes = Buffer.from(namespace.replaceAll("-", ""), "hex");
-  const digest = createHash3("sha1").update(namespaceBytes).update(name, "utf8").digest();
-  const bytes = Buffer.from(digest.subarray(0, 16));
-  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
-  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-  const hex = bytes.toString("hex");
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20)
-  ].join("-");
-}
-__name(deriveUuidV5, "deriveUuidV5");
-
 // src/tools/meta-publish-attempt-id.ts
 var META_PUBLISH_NAMESPACE = "7b19c9ac-b4eb-4db1-970e-c2f24ce30b98";
 function deriveMetaPublishAttemptId(input) {
@@ -24931,6 +25208,16 @@ function firstHeader(value) {
 }
 __name(firstHeader, "firstHeader");
 var PROXY_FETCH_TIMEOUT_MS = 3e4;
+var DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS = 18e4;
+function subjectTokenReauthWindowMs(env) {
+  const raw = env.MCP_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+  if (raw === void 0 || raw.trim() === "") {
+    return DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_SUBJECT_TOKEN_REAUTH_WINDOW_MS;
+}
+__name(subjectTokenReauthWindowMs, "subjectTokenReauthWindowMs");
 var INLINE_RENDERABLE_MIMES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -25061,7 +25348,8 @@ function resolveDownstreamAuth(req, opts, oauthAnalytics) {
     credential,
     subject,
     clientId,
-    isLegacy: false
+    isLegacy: false,
+    subjectExpiresAt: expiresAt
   };
 }
 __name(resolveDownstreamAuth, "resolveDownstreamAuth");
@@ -25085,6 +25373,14 @@ function createAuthenticatedMcpHandler(opts, oauthAnalytics) {
       return;
     }
     const { credential, subject, clientId, isLegacy } = authContext;
+    const reauthWindowMs = subjectTokenReauthWindowMs(process.env);
+    if (reauthWindowMs > 0 && !isLegacy && typeof authContext.subjectExpiresAt === "number" && authContext.subjectExpiresAt * 1e3 <= Date.now() + reauthWindowMs) {
+      res.status(401).set("WWW-Authenticate", `Bearer error="invalid_token", error_description="Access token expired or expiring soon", scope="${MCP_SCOPE}", resource_metadata="${getOAuthProtectedResourceMetadataUrl2(MCP_RESOURCE)}"`).json({
+        error: "invalid_token",
+        error_description: "Access token expired or expiring soon; refresh or re-authenticate."
+      });
+      return;
+    }
     const abortController = new AbortController();
     const abortRequest = /* @__PURE__ */ __name(() => abortController.abort(), "abortRequest");
     req.once("aborted", abortRequest);