@hartl-services/medusa-contracts 1.5.0 → 1.7.0

package/README.md

@@ -28,6 +28,7 @@ Consumer subpaths:
 - `@hartl-services/medusa-contracts/types/plugin-features-store`
 - `@hartl-services/medusa-contracts/types/plugin-features-admin`
 - `@hartl-services/medusa-contracts/types/tax-compliance-store`
+- `@hartl-services/medusa-contracts/types/order-assistant`
 - `@hartl-services/medusa-contracts/schemas/affiliate`
 - `@hartl-services/medusa-contracts/schemas/batch-management`
 - `@hartl-services/medusa-contracts/schemas/documents`
@@ -39,6 +40,7 @@ Consumer subpaths:
 - `@hartl-services/medusa-contracts/schemas/checkout`
 - `@hartl-services/medusa-contracts/schemas/plugin-features`
 - `@hartl-services/medusa-contracts/schemas/tax-compliance`
+- `@hartl-services/medusa-contracts/schemas/order-assistant`
 - `@hartl-services/medusa-contracts/paths/affiliate`
 - `@hartl-services/medusa-contracts/paths/batch-management`
 - `@hartl-services/medusa-contracts/paths/documents`
@@ -49,6 +51,7 @@ Consumer subpaths:
 - `@hartl-services/medusa-contracts/paths/checkout`
 - `@hartl-services/medusa-contracts/paths/plugin-features`
 - `@hartl-services/medusa-contracts/paths/tax-compliance`
+- `@hartl-services/medusa-contracts/paths/order-assistant`
 
 Server-only event subpaths (see "Server-only event contracts" below):
 
@@ -70,6 +73,17 @@ Packing-list DTOs are exported only from `types/documents-admin`. Use
 `packingListsPaths` from `paths/documents` with the consuming Admin's configured
 Medusa SDK; there is deliberately no packing-list Store contract or client.
 
+The order assistant (`order-assistant`) is not a JSON REST route: `paths` holds
+the MCP endpoint (`/mcp`), `schemas` the input and output schemas of its four
+tools, the tool names and the order metadata keys the assistant writes, and
+`types` their inferred types. A storefront never calls it; the consumer is an
+MCP client (an AI chatbot) and the base's own tests. Since 1.7.0 the same
+subpaths also hold the assistant's OAuth sign-in: `paths.oauth` (discovery,
+registration, authorization, token), `paths.admin` and `paths.adminPages`
+(consent page and connected chatbots in the Admin), the request and response
+schemas of those endpoints, `ORDER_ASSISTANT_FEATURES` and
+`ORDER_ASSISTANT_OAUTH` (scope and lifetimes).
+
 File Gateway responses are binary and have no JSON response DTO. Public paths
 come from `paths/files`. Private gateway URLs are opaque, signed server results
 and must not be assembled by a consumer.

package/dist/email/schemas.d.ts

@@ -40,6 +40,7 @@ export declare const EmailSafeStatusCodeSchema: z.ZodEnum<{
     connection_failed: "connection_failed";
     invalid_content: "invalid_content";
     lease_expired: "lease_expired";
+    no_recipient: "no_recipient";
     not_configured: "not_configured";
     notifications_disabled: "notifications_disabled";
     outcome_unknown: "outcome_unknown";
@@ -179,6 +180,7 @@ export declare const AdminEmailMessageSchema: z.ZodObject<{
         connection_failed: "connection_failed";
         invalid_content: "invalid_content";
         lease_expired: "lease_expired";
+        no_recipient: "no_recipient";
         not_configured: "not_configured";
         notifications_disabled: "notifications_disabled";
         outcome_unknown: "outcome_unknown";
@@ -217,6 +219,7 @@ export declare const AdminEmailAttemptSchema: z.ZodObject<{
         connection_failed: "connection_failed";
         invalid_content: "invalid_content";
         lease_expired: "lease_expired";
+        no_recipient: "no_recipient";
         not_configured: "not_configured";
         notifications_disabled: "notifications_disabled";
         outcome_unknown: "outcome_unknown";
@@ -312,6 +315,7 @@ export declare const ListAdminEmailMessagesResponseSchema: z.ZodObject<{
             connection_failed: "connection_failed";
             invalid_content: "invalid_content";
             lease_expired: "lease_expired";
+            no_recipient: "no_recipient";
             not_configured: "not_configured";
             notifications_disabled: "notifications_disabled";
             outcome_unknown: "outcome_unknown";
@@ -382,6 +386,7 @@ export declare const GetAdminEmailMessageResponseSchema: z.ZodObject<{
             connection_failed: "connection_failed";
             invalid_content: "invalid_content";
             lease_expired: "lease_expired";
+            no_recipient: "no_recipient";
             not_configured: "not_configured";
             notifications_disabled: "notifications_disabled";
             outcome_unknown: "outcome_unknown";
@@ -420,6 +425,7 @@ export declare const GetAdminEmailMessageResponseSchema: z.ZodObject<{
             connection_failed: "connection_failed";
             invalid_content: "invalid_content";
             lease_expired: "lease_expired";
+            no_recipient: "no_recipient";
             not_configured: "not_configured";
             notifications_disabled: "notifications_disabled";
             outcome_unknown: "outcome_unknown";
@@ -486,6 +492,7 @@ export declare const ResendAdminEmailMessageResponseSchema: z.ZodObject<{
             connection_failed: "connection_failed";
             invalid_content: "invalid_content";
             lease_expired: "lease_expired";
+            no_recipient: "no_recipient";
             not_configured: "not_configured";
             notifications_disabled: "notifications_disabled";
             outcome_unknown: "outcome_unknown";

package/dist/email/schemas.js

@@ -44,6 +44,7 @@ exports.EmailSafeStatusCodeSchema = zod_1.z.enum([
     "connection_failed",
     "invalid_content",
     "lease_expired",
+    "no_recipient",
     "not_configured",
     "notifications_disabled",
     "outcome_unknown",

package/dist/esm/email/schemas.mjs

@@ -41,6 +41,7 @@ export const EmailSafeStatusCodeSchema = z.enum([
     "connection_failed",
     "invalid_content",
     "lease_expired",
+    "no_recipient",
     "not_configured",
     "notifications_disabled",
     "outcome_unknown",

package/dist/esm/order-assistant/paths.mjs

@@ -0,0 +1,33 @@
+/**
+ * The shop's MCP endpoint for the order assistant (Streamable HTTP,
+ * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
+ */
+export const orderAssistantPaths = {
+    mcp: "/mcp",
+    oauth: {
+        protectedResourceMetadata: "/.well-known/oauth-protected-resource",
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp",
+        authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+        register: "/mcp/oauth/register",
+        authorize: "/mcp/oauth/authorize",
+        token: "/mcp/oauth/token",
+    },
+    admin: {
+        authorization: (authorizationId) => `/admin/order-assistant/authorizations/${encodeURIComponent(authorizationId)}`,
+        connections: "/admin/order-assistant/connections",
+        connection: (connectionId) => `/admin/order-assistant/connections/${encodeURIComponent(connectionId)}`,
+    },
+    adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        authorize: (authorizationId) => `/order-assistant/authorize/${encodeURIComponent(authorizationId)}`,
+    },
+};

package/dist/esm/order-assistant/schemas.mjs

@@ -0,0 +1,385 @@
+import { z } from "@medusajs/framework/zod";
+import { NonEmptyStringSchema, WireDateSchema } from "../shared/primitives.mjs";
+/** Plugin key and container key of the order assistant in the base. */
+export const ORDER_ASSISTANT_PLUGIN_KEY = "order_assistant";
+/** Tool names as the MCP client sees them. */
+export const ORDER_ASSISTANT_TOOLS = {
+    searchCustomers: "kunden_suchen",
+    searchProducts: "produkte_suchen",
+    listShippingOptions: "versandarten_auflisten",
+    createDraftOrder: "bestellentwurf_anlegen",
+};
+/** How the order reached the shop; stored in the order metadata. */
+export const OrderAssistantSourceSchema = z.enum(["fax", "telefon"]);
+/** Order metadata keys the assistant writes. */
+export const ORDER_ASSISTANT_METADATA = {
+    source: "order_source",
+    note: "order_note",
+};
+export const ORDER_ASSISTANT_LIMITS = {
+    customers: 10,
+    variants: 20,
+    items: 50,
+    noteLength: 2000,
+};
+const CountryCodeSchema = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .regex(/^[a-z]{2}$/)
+    .describe("Land als ISO-3166-1-alpha-2-Code, z. B. at oder de.");
+const OptionalTextSchema = z.string().trim().min(1).max(255).optional();
+export const OrderAssistantAddressSchema = z
+    .object({
+    first_name: NonEmptyStringSchema.max(255),
+    last_name: NonEmptyStringSchema.max(255),
+    company: OptionalTextSchema.describe("Firma oder Praxis, falls angegeben."),
+    address_1: NonEmptyStringSchema.max(255).describe("Straße und Hausnummer."),
+    address_2: OptionalTextSchema.describe("Adresszusatz."),
+    postal_code: NonEmptyStringSchema.max(20),
+    city: NonEmptyStringSchema.max(255),
+    country_code: CountryCodeSchema,
+    phone: OptionalTextSchema,
+})
+    .strict();
+export const SearchCustomersInputSchema = z
+    .object({
+    query: OptionalTextSchema.describe("Name, Firma, Telefonnummer oder E-Mail-Adresse (auch Teile davon)."),
+    postal_code: OptionalTextSchema.describe("PLZ einer Adresse der Person."),
+    city: OptionalTextSchema.describe("Ort einer Adresse der Person."),
+})
+    .strict()
+    .refine((value) => Boolean(value.query ?? value.postal_code ?? value.city), { message: "Mindestens ein Suchfeld ist nötig." });
+export const OrderAssistantCustomerAddressSchema = z.object({
+    first_name: z.string().nullable(),
+    last_name: z.string().nullable(),
+    company: z.string().nullable(),
+    address_1: z.string().nullable(),
+    address_2: z.string().nullable(),
+    postal_code: z.string().nullable(),
+    city: z.string().nullable(),
+    country_code: z.string().nullable(),
+    phone: z.string().nullable(),
+});
+export const OrderAssistantCustomerSchema = z.object({
+    id: z.string(),
+    first_name: z.string().nullable(),
+    last_name: z.string().nullable(),
+    company_name: z.string().nullable(),
+    email: z.string().nullable(),
+    phone: z.string().nullable(),
+    /** Registered shop account (true) or a customer record without login. */
+    has_account: z.boolean(),
+    addresses: z.array(OrderAssistantCustomerAddressSchema),
+});
+export const SearchCustomersOutputSchema = z.object({
+    customers: z.array(OrderAssistantCustomerSchema),
+});
+export const SearchProductsInputSchema = z
+    .object({
+    query: NonEmptyStringSchema.max(255).describe("Produktname oder Artikelnummer (auch Teile davon)."),
+    country_code: CountryCodeSchema.describe("Lieferland als ISO-Code; bestimmt Preis und Währung."),
+})
+    .strict();
+export const OrderAssistantVariantSchema = z.object({
+    variant_id: z.string(),
+    product_title: z.string(),
+    variant_title: z.string().nullable(),
+    sku: z.string().nullable(),
+    /** Price per unit in major currency units (33.5 = 33,50); null without a price. */
+    unit_price: z.number().nullable(),
+    currency_code: z.string(),
+    /** Available quantity; null when the variant's stock is not managed. */
+    available_quantity: z.number().nullable(),
+    /** False when the variant cannot be ordered (no price or no stock). */
+    orderable: z.boolean(),
+});
+export const SearchProductsOutputSchema = z.object({
+    variants: z.array(OrderAssistantVariantSchema),
+});
+export const ListShippingOptionsInputSchema = z
+    .object({
+    country_code: CountryCodeSchema.describe("Lieferland als ISO-Code."),
+})
+    .strict();
+export const OrderAssistantShippingOptionSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    /** Flat price in major currency units; null when none is set for the currency. */
+    amount: z.number().nullable(),
+    currency_code: z.string(),
+});
+export const ListShippingOptionsOutputSchema = z.object({
+    shipping_options: z.array(OrderAssistantShippingOptionSchema),
+});
+export const OrderAssistantNewCustomerSchema = z
+    .object({
+    first_name: NonEmptyStringSchema.max(255),
+    last_name: NonEmptyStringSchema.max(255),
+    company_name: OptionalTextSchema,
+    email: z
+        .string()
+        .trim()
+        .toLowerCase()
+        .email()
+        .max(255)
+        .optional()
+        .describe("Nur angeben, wenn eine E-Mail-Adresse bekannt ist."),
+    phone: OptionalTextSchema,
+})
+    .strict();
+export const CreateDraftOrderInputSchema = z
+    .object({
+    customer_id: z
+        .string()
+        .trim()
+        .min(1)
+        .optional()
+        .describe("ID einer bestehenden Kund:in aus kunden_suchen."),
+    new_customer: OrderAssistantNewCustomerSchema.optional().describe("Neue Kund:in ohne Konto; nur wenn kunden_suchen niemanden findet."),
+    shipping_address: OrderAssistantAddressSchema,
+    billing_address: OrderAssistantAddressSchema.optional().describe("Rechnungsadresse; ohne Angabe gilt die Lieferadresse."),
+    items: z
+        .array(z
+        .object({
+        variant_id: NonEmptyStringSchema.describe("ID der Variante aus produkte_suchen."),
+        quantity: z.number().int().positive().max(9999),
+    })
+        .strict())
+        .min(1)
+        .max(ORDER_ASSISTANT_LIMITS.items),
+    shipping_option_id: NonEmptyStringSchema.describe("ID der Versandart aus versandarten_auflisten."),
+    source: OrderAssistantSourceSchema.describe("Wie die Bestellung eingegangen ist."),
+    note: z
+        .string()
+        .trim()
+        .min(1)
+        .max(ORDER_ASSISTANT_LIMITS.noteLength)
+        .optional()
+        .describe("Interne Notiz, z. B. Unklarheiten auf dem Fax."),
+})
+    .strict()
+    .refine((value) => Boolean(value.customer_id) !== Boolean(value.new_customer), { message: "Genau eines von customer_id und new_customer ist nötig." });
+export const OrderAssistantDraftItemSchema = z.object({
+    title: z.string(),
+    sku: z.string().nullable(),
+    quantity: z.number(),
+    unit_price: z.number(),
+    total: z.number(),
+});
+export const CreateDraftOrderOutputSchema = z.object({
+    draft_order_id: z.string(),
+    display_id: z.number().nullable(),
+    customer_id: z.string(),
+    /** True when the assistant created the customer record for this draft. */
+    customer_created: z.boolean(),
+    currency_code: z.string(),
+    items: z.array(OrderAssistantDraftItemSchema),
+    shipping_total: z.number(),
+    tax_total: z.number(),
+    total: z.number(),
+    /** Path of the draft in the Admin, relative to the backend URL. */
+    admin_path: z.string(),
+});
+// --- Anmeldung per OAuth (MCP authorization, OAuth 2.1) --------------------
+/** Feature keys of the order assistant's plugin toggles. */
+export const ORDER_ASSISTANT_FEATURES = {
+    oauth: "oauth",
+};
+export const ORDER_ASSISTANT_OAUTH = {
+    /** The one scope: use the assistant's tools as the signed-in Admin user. */
+    scope: "order_assistant",
+    accessTokenTtlSeconds: 3600,
+    /** A connection ends when its refresh token stays unused this long. */
+    connectionIdleDays: 30,
+    /** How long the consent page may stay open. */
+    authorizationRequestTtlSeconds: 600,
+    /** How long the client has to redeem the code after the consent. */
+    authorizationCodeTtlSeconds: 120,
+    maxRedirectUris: 10,
+    maxUriLength: 2000,
+    maxClientNameLength: 120,
+    maxStateLength: 2000,
+};
+const OAUTH_LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/** `http://localhost`, `http://127.0.0.1` or `http://[::1]`, any port. */
+export const isOAuthLoopbackRedirectUri = (value) => {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "http:" && OAUTH_LOOPBACK_HOSTS.includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * A redirect URI a client may register: https, or http on a loopback address
+ * (native clients such as Claude Code), without credentials or fragment.
+ */
+export const OAuthRedirectUriSchema = z
+    .string()
+    .max(ORDER_ASSISTANT_OAUTH.maxUriLength)
+    .refine((value) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash || url.username || url.password) {
+        return false;
+    }
+    return url.protocol === "https:" || isOAuthLoopbackRedirectUri(value);
+}, {
+    message: "A redirect URI must use https, or http on a loopback address, and carry no fragment.",
+});
+/**
+ * Dynamic client registration request (RFC 7591). Unknown metadata is
+ * ignored; the requested authentication method, grant and response types are
+ * accepted as sent and answered with what the server actually supports.
+ */
+export const OAuthClientRegistrationRequestSchema = z.object({
+    redirect_uris: z
+        .array(OAuthRedirectUriSchema)
+        .min(1)
+        .max(ORDER_ASSISTANT_OAUTH.maxRedirectUris),
+    client_name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(ORDER_ASSISTANT_OAUTH.maxClientNameLength)
+        .optional(),
+});
+export const OAuthClientRegistrationResponseSchema = z.object({
+    client_id: z.string(),
+    /** Seconds since the epoch. */
+    client_id_issued_at: z.number(),
+    client_name: z.string().optional(),
+    redirect_uris: z.array(z.string()),
+    /** Public clients only: PKCE instead of a client secret. */
+    token_endpoint_auth_method: z.literal("none"),
+    grant_types: z.array(z.string()),
+    response_types: z.array(z.string()),
+    scope: z.string(),
+});
+/** Query of the authorization endpoint, before the client is looked up. */
+export const OAuthAuthorizeQuerySchema = z.object({
+    client_id: z.string().min(1).max(200),
+    redirect_uri: z.string().min(1).max(ORDER_ASSISTANT_OAUTH.maxUriLength),
+    response_type: z.string().max(100).optional(),
+    code_challenge: z.string().max(200).optional(),
+    code_challenge_method: z.string().max(20).optional(),
+    state: z.string().max(ORDER_ASSISTANT_OAUTH.maxStateLength).optional(),
+    scope: z.string().max(1000).optional(),
+    resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+});
+/** Body of the token endpoint (`application/x-www-form-urlencoded`). */
+export const OAuthTokenRequestSchema = z.discriminatedUnion("grant_type", [
+    z.object({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().min(1).max(200),
+        /** RFC 7636: 43 to 128 unreserved characters. */
+        code_verifier: z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/),
+        client_id: z.string().min(1).max(200),
+        redirect_uri: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+        resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+    z.object({
+        grant_type: z.literal("refresh_token"),
+        refresh_token: z.string().min(1).max(200),
+        client_id: z.string().min(1).max(200),
+        resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+]);
+export const OAuthTokenResponseSchema = z.object({
+    access_token: z.string(),
+    token_type: z.literal("Bearer"),
+    /** Seconds until the access token expires. */
+    expires_in: z.number(),
+    /** Replaces the refresh token that was sent; the old one stops working. */
+    refresh_token: z.string(),
+    scope: z.string(),
+});
+export const OAuthErrorCodeSchema = z.enum([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "invalid_target",
+    "invalid_client_metadata",
+    "invalid_redirect_uri",
+    "unsupported_grant_type",
+    "unsupported_response_type",
+    "access_denied",
+    "temporarily_unavailable",
+]);
+/** Error body of the registration and token endpoints (RFC 6749, RFC 7591). */
+export const OAuthErrorResponseSchema = z.object({
+    error: OAuthErrorCodeSchema,
+    error_description: z.string(),
+});
+/** RFC 9728: where the MCP endpoint's authorization server is. */
+export const OAuthProtectedResourceMetadataSchema = z.object({
+    resource: z.string(),
+    authorization_servers: z.array(z.string()),
+    bearer_methods_supported: z.array(z.string()),
+    scopes_supported: z.array(z.string()),
+    resource_name: z.string(),
+});
+/** RFC 8414: the authorization server's endpoints and capabilities. */
+export const OAuthAuthorizationServerMetadataSchema = z.object({
+    issuer: z.string(),
+    authorization_endpoint: z.string(),
+    token_endpoint: z.string(),
+    registration_endpoint: z.string(),
+    response_types_supported: z.array(z.string()),
+    grant_types_supported: z.array(z.string()),
+    code_challenge_methods_supported: z.array(z.string()),
+    token_endpoint_auth_methods_supported: z.array(z.string()),
+    scopes_supported: z.array(z.string()),
+    /** RFC 9207: every authorization response carries `iss`. */
+    authorization_response_iss_parameter_supported: z.boolean(),
+});
+/** What the consent page shows about a pending sign-in request. */
+export const AdminOrderAssistantAuthorizationSchema = z.object({
+    id: z.string(),
+    /** Name the chatbot registered with; `null` when it gave none. */
+    client_name: z.string().nullable(),
+    /** Host the browser is sent back to after the decision. */
+    redirect_host: z.string(),
+    /** True when the chatbot runs on this computer (loopback redirect). */
+    redirect_is_loopback: z.boolean(),
+    /** True when the host belongs to a chatbot service the shop knows. */
+    redirect_is_known: z.boolean(),
+    expires_at: WireDateSchema,
+});
+export const AdminOrderAssistantAuthorizationResponseSchema = z.object({
+    authorization: AdminOrderAssistantAuthorizationSchema,
+});
+export const DecideOrderAssistantAuthorizationSchema = z
+    .object({ approve: z.boolean() })
+    .strict();
+export const DecideOrderAssistantAuthorizationResponseSchema = z.object({
+    /** Where the browser must go next: the chatbot's redirect URI. */
+    redirect_to: z.string(),
+});
+/** One chatbot an Admin user connected through OAuth. */
+export const AdminOrderAssistantConnectionSchema = z.object({
+    id: z.string(),
+    client_name: z.string().nullable(),
+    redirect_host: z.string(),
+    user_id: z.string(),
+    /** `null` when the Admin user no longer exists. */
+    user_email: z.string().nullable(),
+    created_at: WireDateSchema,
+    last_used_at: WireDateSchema.nullable(),
+    /** When the connection ends unless the chatbot uses it before. */
+    expires_at: WireDateSchema,
+});
+export const AdminOrderAssistantConnectionsResponseSchema = z.object({
+    connections: z.array(AdminOrderAssistantConnectionSchema),
+});
+export const DeleteOrderAssistantConnectionResponseSchema = z.object({
+    id: z.string(),
+    deleted: z.literal(true),
+});

package/dist/esm/order-assistant/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/order-assistant/paths.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The shop's MCP endpoint for the order assistant (Streamable HTTP,
+ * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
+ */
+export declare const orderAssistantPaths: {
+    readonly mcp: "/mcp";
+    readonly oauth: {
+        readonly protectedResourceMetadata: "/.well-known/oauth-protected-resource";
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        readonly protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp";
+        readonly authorizationServerMetadata: "/.well-known/oauth-authorization-server";
+        readonly register: "/mcp/oauth/register";
+        readonly authorize: "/mcp/oauth/authorize";
+        readonly token: "/mcp/oauth/token";
+    };
+    readonly admin: {
+        readonly authorization: (authorizationId: string) => string;
+        readonly connections: "/admin/order-assistant/connections";
+        readonly connection: (connectionId: string) => string;
+    };
+    readonly adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        readonly authorize: (authorizationId: string) => string;
+    };
+};

package/dist/order-assistant/paths.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orderAssistantPaths = void 0;
+/**
+ * The shop's MCP endpoint for the order assistant (Streamable HTTP,
+ * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
+ */
+exports.orderAssistantPaths = {
+    mcp: "/mcp",
+    oauth: {
+        protectedResourceMetadata: "/.well-known/oauth-protected-resource",
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp",
+        authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+        register: "/mcp/oauth/register",
+        authorize: "/mcp/oauth/authorize",
+        token: "/mcp/oauth/token",
+    },
+    admin: {
+        authorization: (authorizationId) => `/admin/order-assistant/authorizations/${encodeURIComponent(authorizationId)}`,
+        connections: "/admin/order-assistant/connections",
+        connection: (connectionId) => `/admin/order-assistant/connections/${encodeURIComponent(connectionId)}`,
+    },
+    adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        authorize: (authorizationId) => `/order-assistant/authorize/${encodeURIComponent(authorizationId)}`,
+    },
+};