@withpica/mcp-sdk 3.23.0 → 3.23.1

package/dist/index.js

@@ -245,13 +245,20 @@ class BaseResource {
      * for routes that stream a generated file (e.g. `text/csv`) rather than
      * `{success, data}`. `request()` unconditionally calls `response.json()`,
      * which throws a SyntaxError parsing CSV text; every such route needs this
-     * method instead (see `ImportResource.getTemplate()` for the prior
-     * precedent this generalises).
+     * method instead (`ImportResource.getTemplate()`, `ExportResource.catalogCsv()`).
      *
      * `fetchWithRetry` already throws `ApiError` for non-2xx responses (reading
      * the body as text), so reaching here means `response.ok`. Still guard
      * against a 2xx JSON error envelope (`{success:false}`) via content-type,
      * since a route can commit to status 200 before a later validation step.
+     *
+     * An HTML page is refused. Neither route that uses this
+     * (`/admin/import/template`, `/admin/works/export` CSV formats) answers
+     * `text/html`, so one means something in front of PICA answered (on a
+     * protected Vercel preview, a missing bypass header ends on Vercel's
+     * login page with status 200). Returning that page as the file read as a
+     * success (2026-10-06, pica_import_template). Locked by
+     * `mcp-server/src/__tests__/sdk-request-text-and-bare-fetch.test.ts`.
      */
     async requestText(method, path) {
         const url = `${this.baseUrl}${path}`;
@@ -275,6 +282,9 @@ class BaseResource {
             }
             return typeof data === "string" ? data : JSON.stringify(data);
         }
+        if (contentType.includes("text/html")) {
+            throw new ApiError(`Expected a file from ${path} but got an HTML page; the request did not reach PICA`, response.status, false);
+        }
         return response.text();
     }
     /**
@@ -2548,7 +2558,7 @@ class ExportResource extends BaseResource {
         // request() unconditionally calls response.json(), which throws parsing
         // a CSV body — every pro/distributor/nro call 500'd with INTERNAL_ERROR
         // (pica_export_catalog_csv: 5/5 prod errors, ops audit 2026-07-04).
-        // requestText() mirrors the ImportResource.getTemplate() precedent for
+        // requestText() serves ImportResource.getTemplate() too, for
         // the same response shape.
         if (params.format === "sync-pdf") {
             return this.request("GET", path);
@@ -2847,14 +2857,10 @@ class ImportResource extends BaseResource {
         });
     }
     async getTemplate(domain) {
-        // Template route returns CSV as text/csv — use raw fetch
-        const url = `${this.baseUrl}/admin/import/template?domain=${domain}`;
-        const response = await fetch(url, {
-            headers: { Authorization: `Bearer ${this.apiKey}` },
-        });
-        if (!response.ok)
-            throw new Error(`Template fetch failed: ${response.status}`);
-        return response.text();
+        // The route answers text/csv, so requestText(), not request(). It was a
+        // bare fetch() with no preview-protection bypass header, so on a Vercel
+        // preview it never reached the route (2026-10-06).
+        return this.requestText("GET", `/admin/import/template?domain=${encodeURIComponent(domain)}`);
     }
     /**
      * Emails that reached the organisation's forwarding address, newest first,
@@ -4346,24 +4352,15 @@ export class PicaClient {
     // Registration Integrity Floor (spec 2026-07-09, Task 8).
     integrity;
     async catalogStats(params) {
-        const baseUrl = this.works["baseUrl"];
-        const apiKey = this.works["apiKey"];
         const qp = new URLSearchParams();
         if (params?.entity)
             qp.set("entity", params.entity);
         if (params?.group_by)
             qp.set("group_by", params.group_by);
         const suffix = qp.toString() ? `?${qp.toString()}` : "";
-        const res = await fetch(`${baseUrl}/admin/catalog/stats${suffix}`, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-        });
-        if (!res.ok)
-            throw new Error(`Catalog stats failed: ${res.status}`);
-        const json = (await res.json());
-        return (json.data || json);
+        // Through the shared request path (bypass header, timeout, retry, typed
+        // errors) rather than a bare fetch() that skipped all four (2026-10-06).
+        return this.works["request"]("GET", `/admin/catalog/stats${suffix}`);
     }
     constructor(config) {
         if (!config.apiKey) {