@womp/mcp-ui 0.1.7 → 0.1.9

package/README.md

@@ -17,6 +17,8 @@ add_to_cart     ──► ui://womp/cart-<version>.html    (260 KB) cart rows +
 view_cart       ──► ui://womp/cart-<version>.html    (self-fills thumbnails via app-callable view_cart)
 get_print_order ──► ui://womp/order-<version>.html   (258 KB) status chips, tracking, diff-charge strip
 list_print_orders ─► ui://womp/order-<version>.html
+create_upload   ──► ui://womp/upload-<version>.html  (266 KB) drop zone: the user's mesh file goes to the ticket URL from the chat
+get_upload      ──► ui://womp/upload-<version>.html  (app-callable — the card polls it)
 ```
 
 ## What it exports
@@ -30,6 +32,7 @@ const {
   PRINT_APP_URI, PRINT_APP_CSP, PRINT_APP_HTML,
   CART_APP_URI,  CART_APP_CSP,  CART_APP_HTML,
   ORDER_APP_URI, ORDER_APP_CSP, ORDER_APP_HTML,
+  UPLOAD_APP_URI, UPLOAD_APP_CSP, UPLOAD_APP_HTML,
   APP_MIME_TYPE,
 } = require("@womp/mcp-ui");
 ```
@@ -229,6 +232,40 @@ The stub takes three switches for the states a default account never shows:
 `FAKE_ENTERPRISE=1` (Enterprise materials orderable), `FAKE_PRO=1` (hollow
 priced as available), `FAKE_REPAIRED=1` (the repaired / non-manifold callouts).
 
+### The upload card sends bytes from inside the iframe
+
+`src/upload/` exists because MCP has no client→server file channel and a chat
+host's sandbox usually cannot reach Womp — so a file the user had just attached
+to the chat could only reach the print pipeline via a womp.com page. The card
+is that page, in the conversation: drop zone + picker, XHR `PUT` of the raw file
+to the ticket URL swan-backend minted (`create_upload`), progress, the server's
+own refusal text on 4xx, 409/410 terminal. It never touches the model: the
+bytes go disk → API.
+
+Two things outside this repo make that PUT possible, and both fail as a bare
+network error inside the card if missing (the status line names that layer,
+since there is no console in the sandbox):
+
+- **`connectDomains` must name the API origin**, and the origin differs per
+  environment — so `bake-html.mjs` bakes `{}` for this card and swan-backend
+  completes the CSP with its own origin at read time. The dev stub does the
+  same with `http://localhost:3001`.
+- **The backend answers with open CORS on `/mcp/v1/uploads`** because a
+  sandboxed iframe's origin is opaque (`Origin: null`). The ticket in the URL is
+  the security boundary, not the origin.
+
+While pending the card polls the app-callable `get_upload`, so a file the agent
+pushed itself (`curl -T` from a shell that has it) flips the card to done
+instead of leaving a drop zone for a file that already landed.
+
+There is **no link out to an upload page**. swan-frontend had one at
+`/upload/<token>` before this card existed; it was removed 2026-09-15 (Anuj)
+so there is exactly one place a user sends a file from. The recovery for a
+blocked PUT is the agent's own `curl -T`, which its tool text gives it. The dev stub
+(`dev/server.mjs`) carries `create_upload` / `get_upload` and a `PUT
+/mcp/v1/uploads/:token` sink with the GLB-magic sniff, so the refusal strip is
+reachable locally too.
+
 ## Development
 
 **Do not iterate through Claude.** A card change reaches a connector only after

package/dist/index.d.ts

@@ -26,3 +26,7 @@ export declare const CART_APP_HTML: string;
 export declare const ORDER_APP_URI: string;
 export declare const ORDER_APP_CSP: AppCsp;
 export declare const ORDER_APP_HTML: string;
+
+export declare const UPLOAD_APP_URI: string;
+export declare const UPLOAD_APP_CSP: AppCsp;
+export declare const UPLOAD_APP_HTML: string;