@withpica/mcp-sdk 3.23.0 → 3.23.1

package/CHANGELOG.md

@@ -11,6 +11,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.23.1] - 2026-10-07
+
+### Fixed
+
+- `imports.getTemplate()` and `catalogStats()` go through the shared request
+  path. Both were bare `fetch()` calls without the
+  `x-vercel-protection-bypass` header, so on a protected Vercel preview they
+  never reached PICA: `getTemplate` returned Vercel's login page as the CSV
+  (or failed when that hop answered 500). They also skipped the timeout,
+  retry and typed errors.
+- `requestText()` refuses a `text/html` body instead of returning it as the
+  file.
+
 ## [3.23.0] - 2026-10-04
 
 ### Added

package/dist/index.d.ts

@@ -943,13 +943,20 @@ declare class BaseResource {
      * for routes that stream a generated file (e.g. `text/csv`) rather than
      * `{success, data}`. `request()` unconditionally calls `response.json()`,
      * which throws a SyntaxError parsing CSV text; every such route needs this
-     * method instead (see `ImportResource.getTemplate()` for the prior
-     * precedent this generalises).
+     * method instead (`ImportResource.getTemplate()`, `ExportResource.catalogCsv()`).
      *
      * `fetchWithRetry` already throws `ApiError` for non-2xx responses (reading
      * the body as text), so reaching here means `response.ok`. Still guard
      * against a 2xx JSON error envelope (`{success:false}`) via content-type,
      * since a route can commit to status 200 before a later validation step.
+     *
+     * An HTML page is refused. Neither route that uses this
+     * (`/admin/import/template`, `/admin/works/export` CSV formats) answers
+     * `text/html`, so one means something in front of PICA answered (on a
+     * protected Vercel preview, a missing bypass header ends on Vercel's
+     * login page with status 200). Returning that page as the file read as a
+     * success (2026-10-06, pica_import_template). Locked by
+     * `mcp-server/src/__tests__/sdk-request-text-and-bare-fetch.test.ts`.
      */
     protected requestText(method: string, path: string): Promise<string>;
     /**