@withpica/mcp-server 2.5.4 → 2.6.0

package/dist/apps/shared.js

@@ -246,6 +246,174 @@ export const PICA_APP_JS = `
 })();
 `;
 // ---------------------------------------------------------------------------
+// Upload manager — reusable per-file state machine for card file uploads.
+// Exposed as an ES5 JS string snippet that cards embed in their own script
+// block. Instantiate with createUploadManager({ accept, onStateChange, app }).
+//
+// State machine per file: pending -> uploading -> uploaded | failed | network_error
+// Routes audio uploads through pica_audio_presigned_upload + pica_audio_complete_upload;
+// all other types go through pica_upload_file + pica_upload_complete.
+//
+// Methods returned: addFiles(FileList), removeFile(id), retryFile(id), getFiles()
+// ---------------------------------------------------------------------------
+export const PICA_UPLOAD_MANAGER_JS = `
+function createUploadManager(config) {
+  config = config || {};
+  var accept = config.accept || "any";
+  var onStateChange = config.onStateChange || function () {};
+  var app = config.app;
+
+  var files = [];
+  var idCounter = 0;
+
+  function notify() {
+    try { onStateChange(files.slice()); } catch (_) {}
+  }
+
+  function findFile(id) {
+    for (var i = 0; i < files.length; i++) {
+      if (files[i].id === id) return files[i];
+    }
+    return null;
+  }
+
+  function setState(id, state, extra) {
+    var f = findFile(id);
+    if (!f) return;
+    f.state = state;
+    if (extra && extra.url) f.url = extra.url;
+    if (extra && extra.meta) {
+      f.mime_type = extra.meta.mime_type;
+      f.size = extra.meta.size;
+      f.uploaded_at = extra.meta.uploaded_at;
+      f.upload_id = extra.meta.upload_id;
+    }
+    if (extra && extra.error) f.error = extra.error;
+    notify();
+  }
+
+  function doUpload(fileRecord) {
+    var file = fileRecord.file;
+    var id = fileRecord.id;
+    var isAudio = accept === "audio";
+    var presignTool = isAudio ? "pica_audio_presigned_upload" : "pica_upload_file";
+    var completeTool = isAudio ? "pica_audio_complete_upload" : "pica_upload_complete";
+
+    app.callServerTool({
+      name: presignTool,
+      arguments: {
+        filename: file.name,
+        content_type: file.type,
+        file_size: file.size,
+      },
+    }).then(function (presignResult) {
+      if (presignResult && presignResult.isError) throw new Error("presign failed");
+      var presign;
+      try {
+        presign = JSON.parse(presignResult.content[0].text);
+      } catch (_) {
+        throw new Error("presign parse failed");
+      }
+      var presignData = presign.data || presign;
+
+      return fetch(presignData.upload_url, { method: "PUT", body: file })
+        .then(function (res) {
+          if (!res.ok) throw new Error("upload failed: " + res.status);
+          return presignData;
+        })
+        .catch(function (netErr) {
+          setState(id, "network_error", { error: netErr && netErr.message });
+          throw new Error("__network_error__");
+        });
+    }).then(function (presignData) {
+      return app.callServerTool({
+        name: completeTool,
+        arguments: {
+          upload_id: presignData.upload_id,
+          key: presignData.key,
+          bucket: presignData.bucket,
+          storage_category: presignData.storage_category,
+          filename: file.name,
+          content_type: file.type,
+          file_size: file.size,
+        },
+      });
+    }).then(function (completeResult) {
+      if (completeResult && completeResult.isError) throw new Error("complete failed");
+      var completed;
+      try {
+        completed = JSON.parse(completeResult.content[0].text);
+      } catch (_) {
+        throw new Error("complete parse failed");
+      }
+      var completedData = completed.data || completed;
+      setState(id, "uploaded", {
+        url: completedData.url,
+        meta: {
+          mime_type: file.type,
+          size: file.size,
+          uploaded_at: new Date().toISOString(),
+          upload_id: completedData.id || completedData.upload_id || null,
+        },
+      });
+    }).catch(function (err) {
+      if (err && err.message === "__network_error__") return;
+      setState(id, "failed", { error: err && err.message });
+    });
+  }
+
+  function addFiles(fileList) {
+    var added = [];
+    for (var i = 0; i < fileList.length; i++) {
+      var file = fileList[i];
+      var id = "f-" + (++idCounter);
+      var record = {
+        id: id,
+        state: "pending",
+        file: file,
+        filename: file.name,
+        mime_type: file.type,
+        size: file.size,
+        url: null,
+      };
+      files.push(record);
+      added.push(record);
+    }
+    notify();
+    added.forEach(function (r) {
+      r.state = "uploading";
+      notify();
+      doUpload(r);
+    });
+  }
+
+  function removeFile(id) {
+    files = files.filter(function (f) { return f.id !== id; });
+    notify();
+  }
+
+  function retryFile(id) {
+    var f = findFile(id);
+    if (!f || !f.file) return;
+    f.state = "uploading";
+    f.error = null;
+    notify();
+    doUpload(f);
+  }
+
+  function getFiles() {
+    return files.slice();
+  }
+
+  return {
+    addFiles: addFiles,
+    removeFile: removeFile,
+    retryFile: retryFile,
+    getFiles: getFiles,
+  };
+}
+`;
+// ---------------------------------------------------------------------------
 // HTML builder — assembles a complete iframe document
 // ---------------------------------------------------------------------------
 export function buildAppHtml(title, bodyHtml, appJs) {
@@ -261,8 +429,52 @@ export function buildAppHtml(title, bodyHtml, appJs) {
 ${bodyHtml}
 <script>${APP_BRIDGE_JS}</script>
 <script>${PICA_APP_JS}</script>
+<script>${PICA_UPLOAD_MANAGER_JS}</script>
 <script>${appJs}</script>
 </body>
 </html>`;
 }
+/**
+ * CSP connect-src allowlist for MCP App cards that upload files to storage.
+ * Covers PICA-hosted media buckets and common BYOC (bring your own cloud)
+ * providers: AWS S3, Cloudflare R2, Wasabi, Backblaze B2.
+ *
+ * Hosts that honor wildcard entries get broader coverage. Hosts that don't
+ * still work for PICA defaults (exact entries first) and specific BYOC regions.
+ * Users on unlisted endpoints see a graceful "use web dashboard" fallback.
+ */
+export const PICA_STORAGE_CONNECT_DOMAINS = [
+    // PICA-hosted media bucket
+    "https://withpica-media-production.s3.amazonaws.com",
+    "https://withpica-media-production.s3.us-east-1.amazonaws.com",
+    "https://withpica-media-production.s3.eu-north-1.amazonaws.com",
+    // AWS S3 BYOC — common region endpoints (virtual-hosted style)
+    "https://*.s3.amazonaws.com",
+    "https://*.s3.us-east-1.amazonaws.com",
+    "https://*.s3.us-east-2.amazonaws.com",
+    "https://*.s3.us-west-1.amazonaws.com",
+    "https://*.s3.us-west-2.amazonaws.com",
+    "https://*.s3.eu-west-1.amazonaws.com",
+    "https://*.s3.eu-west-2.amazonaws.com",
+    "https://*.s3.eu-central-1.amazonaws.com",
+    "https://*.s3.eu-north-1.amazonaws.com",
+    "https://*.s3.ap-southeast-1.amazonaws.com",
+    "https://*.s3.ap-southeast-2.amazonaws.com",
+    "https://*.s3.ap-northeast-1.amazonaws.com",
+    // Cloudflare R2
+    "https://*.r2.cloudflarestorage.com",
+    // Wasabi
+    "https://s3.wasabisys.com",
+    "https://s3.us-east-1.wasabisys.com",
+    "https://s3.us-east-2.wasabisys.com",
+    "https://s3.us-west-1.wasabisys.com",
+    "https://s3.eu-central-1.wasabisys.com",
+    "https://s3.ap-northeast-1.wasabisys.com",
+    // Backblaze B2 S3-compatible
+    "https://s3.us-west-000.backblazeb2.com",
+    "https://s3.us-west-001.backblazeb2.com",
+    "https://s3.us-west-002.backblazeb2.com",
+    "https://s3.us-west-004.backblazeb2.com",
+    "https://s3.eu-central-003.backblazeb2.com",
+];
 //# sourceMappingURL=shared.js.map

package/dist/apps/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/apps/shared.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;qCAMS,+BAA+B;;;;;;qCAM/B,8BAA8B;;;;;;qCAM9B,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6K3D,CAAC;AAEF,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C1B,CAAC;AAEF,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,OAAO;;;;;WAKE,KAAK;WACL,YAAY;;;EAGrB,QAAQ;UACA,aAAa;UACb,WAAW;UACX,KAAK;;QAEP,CAAC;AACT,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/apps/shared.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,uBAAuB,EACvB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;qCAMS,+BAA+B;;;;;;qCAM/B,8BAA8B;;;;;;qCAM9B,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6K3D,CAAC;AAEF,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C1B,CAAC;AAEF,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AACF,oFAAoF;AACpF,yFAAyF;AACzF,sEAAsE;AACtE,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JrC,CAAC;AAEF,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,OAAO;;;;;WAKE,KAAK;WACL,YAAY;;;EAGrB,QAAQ;UACA,aAAa;UACb,WAAW;UACX,sBAAsB;UACtB,KAAK;;QAEP,CAAC;AACT,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAa;IACpD,2BAA2B;IAC3B,oDAAoD;IACpD,8DAA8D;IAC9D,+DAA+D;IAE/D,+DAA+D;IAC/D,4BAA4B;IAC5B,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,yCAAyC;IACzC,uCAAuC;IACvC,2CAA2C;IAC3C,2CAA2C;IAC3C,2CAA2C;IAE3C,gBAAgB;IAChB,oCAAoC;IAEpC,SAAS;IACT,0BAA0B;IAC1B,oCAAoC;IACpC,oCAAoC;IACpC,oCAAoC;IACpC,uCAAuC;IACvC,yCAAyC;IAEzC,6BAA6B;IAC7B,wCAAwC;IACxC,wCAAwC;IACxC,wCAAwC;IACxC,wCAAwC;IACxC,2CAA2C;CAC5C,CAAC"}

package/dist/apps/upload.d.ts

@@ -0,0 +1,2 @@
+export declare const UPLOAD_HTML: string;
+//# sourceMappingURL=upload.d.ts.map

package/dist/apps/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/apps/upload.ts"],"names":[],"mappings":"AA2RA,eAAO,MAAM,WAAW,QAIvB,CAAC"}

package/dist/apps/upload.js

@@ -0,0 +1,280 @@
+// Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
+/**
+ * pica_upload MCP App card — generic drop zone.
+ *
+ * Renders a drop zone + file input, instantiates createUploadManager() from
+ * shared.ts, and reports uploaded file metadata back to the agent via
+ * app.updateModelContext() once all files have settled.
+ *
+ * DOM API only — never innerHTML.
+ */
+import { buildAppHtml } from "./shared.js";
+const UPLOAD_BODY = `
+<div class="stack gap-6">
+  <header>
+    <h1 class="heading heading-lg" id="up-title">upload files</h1>
+    <p class="text-secondary" id="up-subtitle">drop files here or click to browse</p>
+  </header>
+
+  <section>
+    <div id="up-dropzone" class="up-dropzone">
+      <p class="text-secondary" id="up-dropzone-label">drop files here or click to browse</p>
+      <input type="file" id="up-input" multiple style="display: none;" />
+    </div>
+    <div id="up-thumbnails" class="up-thumbnails"></div>
+    <p class="text-tertiary" id="up-max-msg" style="margin-top: 8px; display: none;"></p>
+    <p class="text-tertiary" id="up-status" style="margin-top: 12px; display: none;"></p>
+  </section>
+</div>
+
+<style>
+.up-dropzone {
+  background: rgba(255,255,255,0.03);
+  border: 1px dashed rgba(255,255,255,0.15);
+  border-radius: 12px;
+  padding: 64px 24px;
+  text-align: center;
+  cursor: pointer;
+  transition: background 0.15s, border-color 0.15s;
+}
+.up-dropzone.dragover {
+  background: rgba(184,115,51,0.05);
+  border-color: var(--accent);
+}
+.up-thumbnails {
+  display: flex;
+  gap: 12px;
+  flex-wrap: wrap;
+  margin-top: 16px;
+}
+.up-thumb {
+  position: relative;
+  min-width: 120px;
+  max-width: 180px;
+  padding: 12px;
+  border-radius: 8px;
+  border: 1px solid var(--card-border);
+  background: rgba(255,255,255,0.03);
+  font-size: 12px;
+}
+.up-thumb-filename {
+  color: var(--text-primary);
+  word-break: break-all;
+  margin-bottom: 4px;
+}
+.up-thumb-state {
+  color: var(--text-tertiary);
+  font-size: 11px;
+}
+.up-thumb-state-failed { border-color: rgba(255,80,80,0.5); }
+.up-thumb-state-network_error { border-color: rgba(255,165,0,0.4); }
+.up-thumb-state-uploaded { border-color: rgba(135,169,107,0.5); }
+.up-thumb-remove {
+  position: absolute; top: 4px; right: 4px;
+  width: 18px; height: 18px; border-radius: 50%;
+  background: rgba(0,0,0,0.6);
+  color: white; font-size: 11px; border: none; cursor: pointer;
+  display: flex; align-items: center; justify-content: center;
+}
+@media (max-width: 600px) {
+  .up-dropzone { padding: 40px 16px; }
+}
+</style>
+`;
+const UPLOAD_JS = `
+var upState = {
+  config: { accept: "any", purpose: null, max_files: null },
+  manager: null,
+  reported: false,
+};
+
+function upAcceptToAttr(accept) {
+  switch (accept) {
+    case "image": return "image/*";
+    case "audio": return "audio/*";
+    case "video": return "video/*";
+    case "document": return ".pdf,.doc,.docx,.txt,.csv,.xls,.xlsx,.rtf,.md";
+    default: return "";
+  }
+}
+
+function upRender(files) {
+  var container = document.getElementById("up-thumbnails");
+  if (!container) return;
+  container.textContent = "";
+
+  files.forEach(function (f) {
+    var thumb = document.createElement("div");
+    thumb.className = "up-thumb up-thumb-state-" + f.state;
+
+    var name = document.createElement("div");
+    name.className = "up-thumb-filename";
+    name.textContent = f.filename;
+    thumb.appendChild(name);
+
+    var stateEl = document.createElement("div");
+    stateEl.className = "up-thumb-state";
+    if (f.state === "uploading") stateEl.textContent = "uploading...";
+    else if (f.state === "uploaded") stateEl.textContent = "uploaded";
+    else if (f.state === "failed") stateEl.textContent = "failed — click to retry";
+    else if (f.state === "network_error") stateEl.textContent = "network error — check connection or use web dashboard";
+    else stateEl.textContent = f.state;
+    thumb.appendChild(stateEl);
+
+    if (f.state === "failed") {
+      thumb.style.cursor = "pointer";
+      thumb.onclick = function () { upState.manager.retryFile(f.id); };
+    }
+
+    var removeBtn = document.createElement("button");
+    removeBtn.className = "up-thumb-remove";
+    removeBtn.textContent = "\\u00D7";
+    removeBtn.onclick = function (e) {
+      e.stopPropagation();
+      upState.manager.removeFile(f.id);
+    };
+    thumb.appendChild(removeBtn);
+
+    container.appendChild(thumb);
+  });
+
+  upMaybeReport(files);
+}
+
+function upMaybeReport(files) {
+  if (upState.reported) return;
+  if (files.length === 0) return;
+  var settled = files.every(function (f) {
+    return f.state === "uploaded" || f.state === "failed" || f.state === "network_error";
+  });
+  if (!settled) return;
+
+  var uploaded = files
+    .filter(function (f) { return f.state === "uploaded"; })
+    .map(function (f) {
+      return {
+        id: f.upload_id || null,
+        url: f.url,
+        mime_type: f.mime_type,
+        size: f.size,
+        filename: f.filename,
+        uploaded_at: f.uploaded_at,
+      };
+    });
+
+  upState.reported = true;
+
+  var status = document.getElementById("up-status");
+  if (status) {
+    status.style.display = "block";
+    status.textContent = uploaded.length + " file(s) uploaded — returning to agent";
+  }
+
+  if (app && typeof app.updateModelContext === "function") {
+    try {
+      app.updateModelContext({
+        context: [{
+          type: "text",
+          text: JSON.stringify({ uploaded: uploaded }),
+        }],
+      });
+    } catch (err) {
+      console.warn("[pica_upload] updateModelContext failed:", err);
+    }
+  }
+}
+
+function upEnforceMaxFiles(incoming) {
+  var maxMsgEl = document.getElementById("up-max-msg");
+  if (maxMsgEl) {
+    maxMsgEl.style.display = "none";
+    maxMsgEl.textContent = "";
+  }
+  var max = upState.config.max_files;
+  if (!max || !upState.manager) return incoming;
+  var currentCount = upState.manager.getFiles().length;
+  var remaining = max - currentCount;
+  if (remaining <= 0) {
+    if (maxMsgEl) {
+      maxMsgEl.textContent = "max " + max + " files — extras ignored";
+      maxMsgEl.style.display = "block";
+    }
+    return [];
+  }
+  if (incoming.length > remaining) {
+    if (maxMsgEl) {
+      maxMsgEl.textContent = "max " + max + " files — extras ignored";
+      maxMsgEl.style.display = "block";
+    }
+    return Array.prototype.slice.call(incoming, 0, remaining);
+  }
+  return incoming;
+}
+
+function upSetup() {
+  var dz = document.getElementById("up-dropzone");
+  var input = document.getElementById("up-input");
+  var title = document.getElementById("up-title");
+  var subtitle = document.getElementById("up-subtitle");
+  var dzLabel = document.getElementById("up-dropzone-label");
+
+  if (upState.config.purpose && title) {
+    title.textContent = "upload: " + upState.config.purpose;
+  }
+  if (upState.config.accept && upState.config.accept !== "any" && subtitle) {
+    subtitle.textContent = "drop " + upState.config.accept + " files here or click to browse";
+    if (dzLabel) dzLabel.textContent = "drop " + upState.config.accept + " files here";
+  }
+
+  if (input) {
+    input.accept = upAcceptToAttr(upState.config.accept);
+  }
+  if (!dz || !input) return;
+
+  dz.addEventListener("click", function () { input.click(); });
+  input.addEventListener("change", function (e) {
+    if (e.target.files && e.target.files.length) {
+      var allowed = upEnforceMaxFiles(e.target.files);
+      if (allowed.length) {
+        upState.reported = false;
+        upState.manager.addFiles(allowed);
+      }
+    }
+    input.value = "";
+  });
+  dz.addEventListener("dragover", function (e) {
+    e.preventDefault();
+    dz.classList.add("dragover");
+  });
+  dz.addEventListener("dragleave", function () { dz.classList.remove("dragover"); });
+  dz.addEventListener("drop", function (e) {
+    e.preventDefault();
+    dz.classList.remove("dragover");
+    if (e.dataTransfer && e.dataTransfer.files && e.dataTransfer.files.length) {
+      var allowed = upEnforceMaxFiles(e.dataTransfer.files);
+      if (allowed.length) {
+        upState.reported = false;
+        upState.manager.addFiles(allowed);
+      }
+    }
+  });
+}
+
+window.onPicaToolResult = function (data) {
+  if (data && data.config) {
+    upState.config = {
+      accept: data.config.accept || "any",
+      purpose: data.config.purpose || null,
+      max_files: data.config.max_files || null,
+    };
+  }
+  upState.manager = createUploadManager({
+    accept: upState.config.accept,
+    onStateChange: upRender,
+    app: app,
+  });
+  upSetup();
+};
+`;
+export const UPLOAD_HTML = buildAppHtml("pica \u2014 upload", UPLOAD_BODY, UPLOAD_JS);
+//# sourceMappingURL=upload.js.map

package/dist/apps/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../src/apps/upload.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuEnB,CAAC;AAEF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkMjB,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CACrC,oBAAoB,EACpB,WAAW,EACX,SAAS,CACV,CAAC"}

package/dist/config.d.ts

@@ -6,6 +6,7 @@ export interface ServerConfig {
     debug: boolean;
     lobbyMode: boolean;
     credentialsPath: string;
+    discoveryMode: boolean;
 }
 export declare function loadConfig(): ServerConfig;
 export declare function validateConfig(config: ServerConfig): void;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,IAAI,YAAY,CAkCzC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAWzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,UAAU,IAAI,YAAY,CAwCzC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAWzD"}

package/dist/config.js

@@ -2,7 +2,7 @@
 /**
  * MCP Server Configuration
  */
-import { readCredentials, getDefaultCredentialsPath, } from "./utils/credentials.js";
+import { readCredentials, getDefaultCredentialsPath, } from "@withpica/mcp-utils";
 export function loadConfig() {
     const credentialsPath = process.env.PICA_CREDENTIALS_PATH || getDefaultCredentialsPath();
     const debug = process.env.DEBUG === "true" || process.env.DEBUG === "1";
@@ -19,9 +19,13 @@ export function loadConfig() {
         }
     }
     const lobbyMode = !picaApiKey;
+    const discoveryMode = process.env.MCP_LAYERED_DISCOVERY === "1";
     if (lobbyMode && debug) {
         console.error("[MCP Server] No API key found — starting in lobby mode");
     }
+    if (discoveryMode && debug) {
+        console.error("[MCP Server] Layered discovery mode enabled");
+    }
     return {
         picaApiKey,
         picaApiUrl: process.env.PICA_API_URL || "https://withpica.com/api",
@@ -30,6 +34,7 @@ export function loadConfig() {
         debug,
         lobbyMode,
         credentialsPath,
+        discoveryMode,
     };
 }
 export function validateConfig(config) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAYhC,MAAM,UAAU,UAAU;IACxB,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC;IAExE,sBAAsB;IACtB,IAAI,UAAU,GAAkB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IAEjE,+BAA+B;IAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,uCAAuC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC;IAE9B,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B;QAClE,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,SAAS;QACT,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IACE,CAAC,MAAM,CAAC,SAAS;QACjB,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAa7B,MAAM,UAAU,UAAU;IACxB,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC;IAExE,sBAAsB;IACtB,IAAI,UAAU,GAAkB,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IAEjE,+BAA+B;IAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,uCAAuC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC;IAEhE,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B;QAClE,UAAU,EAAE,iBAAiB;QAC7B,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,SAAS;QACT,eAAe;QACf,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IACE,CAAC,MAAM,CAAC,SAAS;QACjB,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/resources/index.d.ts

@@ -2,7 +2,7 @@
  * Resource Registry for MCP Server
  * Manages read-only data resources that AI assistants can access
  */
-import { PicaClient } from "../pica-sdk.js";
+import { PicaClient } from "@withpica/mcp-sdk";
 import { ServerConfig } from "../config.js";
 export interface ResourceDefinition {
     uri: string;

package/dist/resources/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAO5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC;AAEjC,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAoB;IAChC,OAAO,CAAC,MAAM,CAAC,CAAe;gBAElB,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,YAAY;IAK1D;;OAEG;IACH,aAAa,IAAI,kBAAkB,EAAE;IAuFrC;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAqF7C;;OAEG;IACH,OAAO,CAAC,cAAc;IA6BtB;;OAEG;YACW,YAAY;IA4B1B;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,iBAAiB;IA2B/B;;OAEG;YACW,eAAe;IAoD7B;;OAEG;YACW,gBAAgB;IAc9B;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,eAAe;CAa9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC;AAEjC,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAoB;IAChC,OAAO,CAAC,MAAM,CAAC,CAAe;gBAElB,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,YAAY;IAK1D;;OAEG;IACH,aAAa,IAAI,kBAAkB,EAAE;IA8FrC;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IA8G7C;;OAEG;IACH,OAAO,CAAC,cAAc;IA6BtB;;OAEG;YACW,YAAY;IA4B1B;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,iBAAiB;IA2B/B;;OAEG;YACW,eAAe;IAoD7B;;OAEG;YACW,gBAAgB;IAc9B;;OAEG;YACW,mBAAmB;IAcjC;;OAEG;YACW,eAAe;CAa9B"}

package/dist/resources/index.js

@@ -1,9 +1,11 @@
 // Copyright (c) 2024-2026 Withpica Ltd. All rights reserved.
-import { ResourceError } from "../utils/errors.js";
+import { ResourceError } from "@withpica/mcp-utils";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { WITHPICA_PRIMER } from "./llms-primer.js";
-import { BRIEFING_HTML } from "../apps/briefing.js";
+import { UPLOAD_HTML } from "../apps/upload.js";
+import { DOWNLOAD_HTML } from "../apps/download.js";
+import { PICA_STORAGE_CONNECT_DOMAINS } from "../apps/shared.js";
 export class ResourceRegistry {
     pica;
     config;
@@ -72,9 +74,14 @@ export class ResourceRegistry {
             description: "OpenAPI 3.1 spec for the top 20 PICA API endpoints — works, people, recordings, agreements, credits, search, health",
             mimeType: "text/yaml",
         }, {
-            uri: "ui://pica/briefing",
-            name: "Daily Briefing",
-            description: "Interactive daily briefing card — catalog health, attention items, activity",
+            uri: "ui://pica/upload",
+            name: "Upload Files",
+            description: "Generic file upload card — drop zone for audio, photos, documents, anything",
+            mimeType: "text/html;profile=mcp-app",
+        }, {
+            uri: "ui://pica/download",
+            name: "Download File",
+            description: "File download card — shows file metadata and a download button",
             mimeType: "text/html;profile=mcp-app",
         });
         return resources;
@@ -138,13 +145,37 @@ export class ResourceRegistry {
                 return await this.getRecentEvents();
             case "api://openapi":
                 return this.getOpenAPISpec();
-            case "ui://pica/briefing":
+            case "ui://pica/upload":
+                return {
+                    contents: [
+                        {
+                            uri: "ui://pica/upload",
+                            mimeType: "text/html;profile=mcp-app",
+                            text: UPLOAD_HTML,
+                            _meta: {
+                                ui: {
+                                    csp: {
+                                        connectDomains: PICA_STORAGE_CONNECT_DOMAINS,
+                                    },
+                                },
+                            },
+                        },
+                    ],
+                };
+            case "ui://pica/download":
                 return {
                     contents: [
                         {
-                            uri: "ui://pica/briefing",
+                            uri: "ui://pica/download",
                             mimeType: "text/html;profile=mcp-app",
-                            text: BRIEFING_HTML,
+                            text: DOWNLOAD_HTML,
+                            _meta: {
+                                ui: {
+                                    csp: {
+                                        connectDomains: PICA_STORAGE_CONNECT_DOMAINS,
+                                    },
+                                },
+                            },
                         },
                     ],
                 };