OAuth MCP and browser print workflow

Use the canonical origin https://edgevinyl.akwigglebutts.com. The assistant can prepare one single-image DTF job and save one unpaid draft. It never pays, places a binding order, dispatches production or arranges shipping. The owner completes hosted checkout. Tax and shipping are separate; quotes above $500 require staff review.

Connect and prepare

Add the remote MCP URL https://edgevinyl.akwigglebutts.com/api/agents/mcp using the host's supported connector setup. Transport is Streamable HTTP. The OAuth issuer is https://edgevinyl.akwigglebutts.com/api/agents/oauth; PKCE S256 and scope print:prepare are required. The owner signs into their original EdgeVinyl customer account and approves the connection. Credentials stay in the host's supported OAuth channel. Never copy tokens into chat, extract cookies or invent a credential bridge.

Connections last at most 30 minutes and depend on the original customer sign-in. Reconnect when expired. The original saved job remains reviewable in the signed-in account; check its state before starting any replacement. The assistant entrance links to this guidance. Common MCP support does not guarantee a host's connector setup or file-transfer capability. No live Dot, Claude, Grok or Gemini test is established by this document.

Prepare locally before connecting when possible. Follow the artwork rules and optional helper consent. Keep the earliest original, inspect the actual output, and save SHA-256, byte count, dimensions, source effective PPI and any enlargement warning. The API accepts one non-interlaced 8-bit RGB PNG with alpha at exactly 300 PPI of the requested design size, real transparency and visible artwork, at most 25 million pixels and 25 MiB. It performs no resizing. A packed sheet preview is not the individual design upload.

Tools and file transfer

1. Call get_print_catalog for live product IDs, SKU and required options.

2. Call create_print_job with a persisted UUID requestKey and spec: productId, skuRef, optionValueIds, artWidthIn, artHeightIn, copies, neededBy and notes. Copies means total design copies on ONE sheet (1–500), not sheet quantity. Dimensions must yield whole pixels at 300 PPI. neededBy is empty or YYYY-MM-DD. Notes are at most 1000 characters. Keep returned jobId and the same key through retries.

3. Transfer the exact approved prepared PNG using one supported route below. All routes verify its hash and format; a filename or a cloud path is not proof of matching bytes.

4. Call prepare_print_layout({jobId, artworkId}). It preserves size and orientation, uses 0.125-inch gaps and server safe insets, and refuses overflow. Ask the owner to choose a larger sheet if necessary; do not shrink copies to fit.

5. Call get_print_quote({jobId}) for the live nonbinding subtotal and quoteToken. Then call request_artwork_review({jobId}) and give its returned reviewUrl to the owner.

6. The owner signs into the same account and reviews the exact artwork, layout, current price and reproduction rights. Preserve any enlargement/source-PPI warning in that review. Assistant-provided approval booleans cannot replace the shop review. Changes to artwork, layout or price invalidate approval.

7. After owner review, call create_unpaid_draft({jobId, requestKey, quoteToken}) using one stable, persisted draft UUID. Only a returned authoritative draft reference confirms a saved unpaid draft. Give the returned reviewUrl to the owner for review and checkout.

Primary: supported host attachment handoff. Call import_artwork_file with jobId, expectedSha256 and file:{download_url,file_id,mime_type?,file_name?}. The tool advertises openai/fileParams:["file"] for hosts supporting that attachment protocol. Pass the actual supported owner-provided prepared file. Never fabricate download URLs, file IDs or private attachment routes. Read the returned artworkId.

Owner upload when the host cannot transfer the attachment. Call request_owner_upload({jobId,filename,sha256,sizeBytes}). Give the returned uploadUrl to the owner and retain artworkId. The owner opens it in the same customer account and selects the exact prepared PNG; the shop checks its bytes against the requested hash and size. After the page displays Artwork verified, return to the assistant and call finalize_artwork_upload({jobId,artworkId}) with the retained artworkId before preparing layout. Use get_print_job to recover job/draft state; it does not by itself establish that a newly uploaded file is verified. This is a file-selection step; it does not approve artwork, price or rights.

Secondary: signed PUT for hosts with supported file/HTTP access. Call reserve_artwork_upload({jobId,filename,sha256,sizeBytes}). Follow its returned state and uploadId. For a reserved upload, PUT the exact bytes to the returned signedUrl using Content-Type image/png and no account Authorization header. Do not follow redirects or substitute upload services. Then call finalize_artwork_upload({jobId,artworkId:uploadId}). A reservation alone is not accepted artwork. Reuse the same hash/bytes on retry; never replace a conflicting reservation.

Library materialization and host/browser file access are separate boundaries. Preserve required provider provenance metadata. A provider failure such as unsupported Windows os.setxattr is a transfer compatibility issue; do not skip metadata, invent sidecars or use guessed routes. Use supported attachment handoff or have the owner download/select the original exact file. The public non-uploading preflight verifies local browser selection and hash only; it transfers no file between pages and grants no print approval.

Recovery and browser fallback

After timeout, interruption, uncertain submission or expired quote, call get_print_job({jobId}) first. Retain the original jobId and request keys. A pending/preparing result is not a draft confirmation. Get a fresh quote and repeat owner review when required; never create a new job/key to bypass uncertainty or review errors. After connection expiry, reconnect with the original customer account and review the original saved job. Do not claim that reconnection automatically restores authorization for an old job; follow the returned recovery action or use its owner review link.

The browser workspace remains available for supported single-image DTF jobs. The owner reviews the job specification and connection in visible controls. Browser grants last at most 30 minutes and stay in a job-scoped HttpOnly, Secure, SameSite=Strict cookie requiring the same approving customer and session. Select the prepared PNG through the supported file chooser. Prefer supported site tools blue_moose_print_status, blue_moose_print_upload, blue_moose_print_layout, blue_moose_print_quote and blue_moose_print_draft; each takes {}. Accessible page controls use the same handlers. Only the owner confirms artwork/rights and checkout.

The browser saves the draft request UUID before writing, and status recovers confirmed drafts across tabs. Preserve returned saved-job review links after grant expiry. Legacy, multiple or closed drafts require owner/staff review; do not create new connections to bypass them. Existing authenticated Bearer integrations need their own verified secure credential channel; this package provides none. For unsupported work or unresolved recovery, use shop help. Installation, an upload, a quote or a checkout redirect alone is not an order receipt.