@hartl-services/medusa-contracts 1.6.0 → 1.7.0

package/README.md

@@ -77,7 +77,12 @@ The order assistant (`order-assistant`) is not a JSON REST route: `paths` holds
 the MCP endpoint (`/mcp`), `schemas` the input and output schemas of its four
 tools, the tool names and the order metadata keys the assistant writes, and
 `types` their inferred types. A storefront never calls it; the consumer is an
-MCP client (an AI chatbot) and the base's own tests.
+MCP client (an AI chatbot) and the base's own tests. Since 1.7.0 the same
+subpaths also hold the assistant's OAuth sign-in: `paths.oauth` (discovery,
+registration, authorization, token), `paths.admin` and `paths.adminPages`
+(consent page and connected chatbots in the Admin), the request and response
+schemas of those endpoints, `ORDER_ASSISTANT_FEATURES` and
+`ORDER_ASSISTANT_OAUTH` (scope and lifetimes).
 
 File Gateway responses are binary and have no JSON response DTO. Public paths
 come from `paths/files`. Private gateway URLs are opaque, signed server results

package/dist/esm/order-assistant/paths.mjs

@@ -1,7 +1,33 @@
 /**
  * The shop's MCP endpoint for the order assistant (Streamable HTTP,
  * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
  */
 export const orderAssistantPaths = {
     mcp: "/mcp",
+    oauth: {
+        protectedResourceMetadata: "/.well-known/oauth-protected-resource",
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp",
+        authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+        register: "/mcp/oauth/register",
+        authorize: "/mcp/oauth/authorize",
+        token: "/mcp/oauth/token",
+    },
+    admin: {
+        authorization: (authorizationId) => `/admin/order-assistant/authorizations/${encodeURIComponent(authorizationId)}`,
+        connections: "/admin/order-assistant/connections",
+        connection: (connectionId) => `/admin/order-assistant/connections/${encodeURIComponent(connectionId)}`,
+    },
+    adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        authorize: (authorizationId) => `/order-assistant/authorize/${encodeURIComponent(authorizationId)}`,
+    },
 };

package/dist/esm/order-assistant/schemas.mjs

@@ -1,5 +1,5 @@
 import { z } from "@medusajs/framework/zod";
-import { NonEmptyStringSchema } from "../shared/primitives.mjs";
+import { NonEmptyStringSchema, WireDateSchema } from "../shared/primitives.mjs";
 /** Plugin key and container key of the order assistant in the base. */
 export const ORDER_ASSISTANT_PLUGIN_KEY = "order_assistant";
 /** Tool names as the MCP client sees them. */
@@ -181,3 +181,205 @@ export const CreateDraftOrderOutputSchema = z.object({
     /** Path of the draft in the Admin, relative to the backend URL. */
     admin_path: z.string(),
 });
+// --- Anmeldung per OAuth (MCP authorization, OAuth 2.1) --------------------
+/** Feature keys of the order assistant's plugin toggles. */
+export const ORDER_ASSISTANT_FEATURES = {
+    oauth: "oauth",
+};
+export const ORDER_ASSISTANT_OAUTH = {
+    /** The one scope: use the assistant's tools as the signed-in Admin user. */
+    scope: "order_assistant",
+    accessTokenTtlSeconds: 3600,
+    /** A connection ends when its refresh token stays unused this long. */
+    connectionIdleDays: 30,
+    /** How long the consent page may stay open. */
+    authorizationRequestTtlSeconds: 600,
+    /** How long the client has to redeem the code after the consent. */
+    authorizationCodeTtlSeconds: 120,
+    maxRedirectUris: 10,
+    maxUriLength: 2000,
+    maxClientNameLength: 120,
+    maxStateLength: 2000,
+};
+const OAUTH_LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/** `http://localhost`, `http://127.0.0.1` or `http://[::1]`, any port. */
+export const isOAuthLoopbackRedirectUri = (value) => {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "http:" && OAUTH_LOOPBACK_HOSTS.includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * A redirect URI a client may register: https, or http on a loopback address
+ * (native clients such as Claude Code), without credentials or fragment.
+ */
+export const OAuthRedirectUriSchema = z
+    .string()
+    .max(ORDER_ASSISTANT_OAUTH.maxUriLength)
+    .refine((value) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash || url.username || url.password) {
+        return false;
+    }
+    return url.protocol === "https:" || isOAuthLoopbackRedirectUri(value);
+}, {
+    message: "A redirect URI must use https, or http on a loopback address, and carry no fragment.",
+});
+/**
+ * Dynamic client registration request (RFC 7591). Unknown metadata is
+ * ignored; the requested authentication method, grant and response types are
+ * accepted as sent and answered with what the server actually supports.
+ */
+export const OAuthClientRegistrationRequestSchema = z.object({
+    redirect_uris: z
+        .array(OAuthRedirectUriSchema)
+        .min(1)
+        .max(ORDER_ASSISTANT_OAUTH.maxRedirectUris),
+    client_name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(ORDER_ASSISTANT_OAUTH.maxClientNameLength)
+        .optional(),
+});
+export const OAuthClientRegistrationResponseSchema = z.object({
+    client_id: z.string(),
+    /** Seconds since the epoch. */
+    client_id_issued_at: z.number(),
+    client_name: z.string().optional(),
+    redirect_uris: z.array(z.string()),
+    /** Public clients only: PKCE instead of a client secret. */
+    token_endpoint_auth_method: z.literal("none"),
+    grant_types: z.array(z.string()),
+    response_types: z.array(z.string()),
+    scope: z.string(),
+});
+/** Query of the authorization endpoint, before the client is looked up. */
+export const OAuthAuthorizeQuerySchema = z.object({
+    client_id: z.string().min(1).max(200),
+    redirect_uri: z.string().min(1).max(ORDER_ASSISTANT_OAUTH.maxUriLength),
+    response_type: z.string().max(100).optional(),
+    code_challenge: z.string().max(200).optional(),
+    code_challenge_method: z.string().max(20).optional(),
+    state: z.string().max(ORDER_ASSISTANT_OAUTH.maxStateLength).optional(),
+    scope: z.string().max(1000).optional(),
+    resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+});
+/** Body of the token endpoint (`application/x-www-form-urlencoded`). */
+export const OAuthTokenRequestSchema = z.discriminatedUnion("grant_type", [
+    z.object({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().min(1).max(200),
+        /** RFC 7636: 43 to 128 unreserved characters. */
+        code_verifier: z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/),
+        client_id: z.string().min(1).max(200),
+        redirect_uri: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+        resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+    z.object({
+        grant_type: z.literal("refresh_token"),
+        refresh_token: z.string().min(1).max(200),
+        client_id: z.string().min(1).max(200),
+        resource: z.string().max(ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+]);
+export const OAuthTokenResponseSchema = z.object({
+    access_token: z.string(),
+    token_type: z.literal("Bearer"),
+    /** Seconds until the access token expires. */
+    expires_in: z.number(),
+    /** Replaces the refresh token that was sent; the old one stops working. */
+    refresh_token: z.string(),
+    scope: z.string(),
+});
+export const OAuthErrorCodeSchema = z.enum([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "invalid_target",
+    "invalid_client_metadata",
+    "invalid_redirect_uri",
+    "unsupported_grant_type",
+    "unsupported_response_type",
+    "access_denied",
+    "temporarily_unavailable",
+]);
+/** Error body of the registration and token endpoints (RFC 6749, RFC 7591). */
+export const OAuthErrorResponseSchema = z.object({
+    error: OAuthErrorCodeSchema,
+    error_description: z.string(),
+});
+/** RFC 9728: where the MCP endpoint's authorization server is. */
+export const OAuthProtectedResourceMetadataSchema = z.object({
+    resource: z.string(),
+    authorization_servers: z.array(z.string()),
+    bearer_methods_supported: z.array(z.string()),
+    scopes_supported: z.array(z.string()),
+    resource_name: z.string(),
+});
+/** RFC 8414: the authorization server's endpoints and capabilities. */
+export const OAuthAuthorizationServerMetadataSchema = z.object({
+    issuer: z.string(),
+    authorization_endpoint: z.string(),
+    token_endpoint: z.string(),
+    registration_endpoint: z.string(),
+    response_types_supported: z.array(z.string()),
+    grant_types_supported: z.array(z.string()),
+    code_challenge_methods_supported: z.array(z.string()),
+    token_endpoint_auth_methods_supported: z.array(z.string()),
+    scopes_supported: z.array(z.string()),
+    /** RFC 9207: every authorization response carries `iss`. */
+    authorization_response_iss_parameter_supported: z.boolean(),
+});
+/** What the consent page shows about a pending sign-in request. */
+export const AdminOrderAssistantAuthorizationSchema = z.object({
+    id: z.string(),
+    /** Name the chatbot registered with; `null` when it gave none. */
+    client_name: z.string().nullable(),
+    /** Host the browser is sent back to after the decision. */
+    redirect_host: z.string(),
+    /** True when the chatbot runs on this computer (loopback redirect). */
+    redirect_is_loopback: z.boolean(),
+    /** True when the host belongs to a chatbot service the shop knows. */
+    redirect_is_known: z.boolean(),
+    expires_at: WireDateSchema,
+});
+export const AdminOrderAssistantAuthorizationResponseSchema = z.object({
+    authorization: AdminOrderAssistantAuthorizationSchema,
+});
+export const DecideOrderAssistantAuthorizationSchema = z
+    .object({ approve: z.boolean() })
+    .strict();
+export const DecideOrderAssistantAuthorizationResponseSchema = z.object({
+    /** Where the browser must go next: the chatbot's redirect URI. */
+    redirect_to: z.string(),
+});
+/** One chatbot an Admin user connected through OAuth. */
+export const AdminOrderAssistantConnectionSchema = z.object({
+    id: z.string(),
+    client_name: z.string().nullable(),
+    redirect_host: z.string(),
+    user_id: z.string(),
+    /** `null` when the Admin user no longer exists. */
+    user_email: z.string().nullable(),
+    created_at: WireDateSchema,
+    last_used_at: WireDateSchema.nullable(),
+    /** When the connection ends unless the chatbot uses it before. */
+    expires_at: WireDateSchema,
+});
+export const AdminOrderAssistantConnectionsResponseSchema = z.object({
+    connections: z.array(AdminOrderAssistantConnectionSchema),
+});
+export const DeleteOrderAssistantConnectionResponseSchema = z.object({
+    id: z.string(),
+    deleted: z.literal(true),
+});

package/dist/order-assistant/paths.d.ts

@@ -1,7 +1,33 @@
 /**
  * The shop's MCP endpoint for the order assistant (Streamable HTTP,
  * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
  */
 export declare const orderAssistantPaths: {
     readonly mcp: "/mcp";
+    readonly oauth: {
+        readonly protectedResourceMetadata: "/.well-known/oauth-protected-resource";
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        readonly protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp";
+        readonly authorizationServerMetadata: "/.well-known/oauth-authorization-server";
+        readonly register: "/mcp/oauth/register";
+        readonly authorize: "/mcp/oauth/authorize";
+        readonly token: "/mcp/oauth/token";
+    };
+    readonly admin: {
+        readonly authorization: (authorizationId: string) => string;
+        readonly connections: "/admin/order-assistant/connections";
+        readonly connection: (connectionId: string) => string;
+    };
+    readonly adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        readonly authorize: (authorizationId: string) => string;
+    };
 };

package/dist/order-assistant/paths.js

@@ -4,7 +4,33 @@ exports.orderAssistantPaths = void 0;
 /**
  * The shop's MCP endpoint for the order assistant (Streamable HTTP,
  * stateless). Outside `/admin` and `/store`: it authenticates on its own.
+ *
+ * `oauth`: the OAuth 2.1 endpoints an MCP client (claude.ai, ChatGPT) uses
+ * to sign an Admin user in; the well-known paths are fixed by RFC 9728 and
+ * RFC 8414. `admin`: the Admin API behind the consent page and the list of
+ * connected chatbots. `adminPages`: Admin pages, relative to the Admin root.
  */
 exports.orderAssistantPaths = {
     mcp: "/mcp",
+    oauth: {
+        protectedResourceMetadata: "/.well-known/oauth-protected-resource",
+        /** Same document; clients probe the path of the MCP endpoint first. */
+        protectedResourceMetadataForMcp: "/.well-known/oauth-protected-resource/mcp",
+        authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+        register: "/mcp/oauth/register",
+        authorize: "/mcp/oauth/authorize",
+        token: "/mcp/oauth/token",
+    },
+    admin: {
+        authorization: (authorizationId) => `/admin/order-assistant/authorizations/${encodeURIComponent(authorizationId)}`,
+        connections: "/admin/order-assistant/connections",
+        connection: (connectionId) => `/admin/order-assistant/connections/${encodeURIComponent(connectionId)}`,
+    },
+    adminPages: {
+        /**
+         * The request id is a path segment on purpose: the Admin login returns
+         * to the path it came from and drops the query string.
+         */
+        authorize: (authorizationId) => `/order-assistant/authorize/${encodeURIComponent(authorizationId)}`,
+    },
 };

package/dist/order-assistant/schemas.d.ts

@@ -211,3 +211,181 @@ export declare const CreateDraftOrderOutputSchema: z.ZodObject<{
     total: z.ZodNumber;
     admin_path: z.ZodString;
 }, z.core.$strip>;
+/** Feature keys of the order assistant's plugin toggles. */
+export declare const ORDER_ASSISTANT_FEATURES: {
+    readonly oauth: "oauth";
+};
+export declare const ORDER_ASSISTANT_OAUTH: {
+    /** The one scope: use the assistant's tools as the signed-in Admin user. */
+    readonly scope: "order_assistant";
+    readonly accessTokenTtlSeconds: 3600;
+    /** A connection ends when its refresh token stays unused this long. */
+    readonly connectionIdleDays: 30;
+    /** How long the consent page may stay open. */
+    readonly authorizationRequestTtlSeconds: 600;
+    /** How long the client has to redeem the code after the consent. */
+    readonly authorizationCodeTtlSeconds: 120;
+    readonly maxRedirectUris: 10;
+    readonly maxUriLength: 2000;
+    readonly maxClientNameLength: 120;
+    readonly maxStateLength: 2000;
+};
+/** `http://localhost`, `http://127.0.0.1` or `http://[::1]`, any port. */
+export declare const isOAuthLoopbackRedirectUri: (value: string) => boolean;
+/**
+ * A redirect URI a client may register: https, or http on a loopback address
+ * (native clients such as Claude Code), without credentials or fragment.
+ */
+export declare const OAuthRedirectUriSchema: z.ZodString;
+/**
+ * Dynamic client registration request (RFC 7591). Unknown metadata is
+ * ignored; the requested authentication method, grant and response types are
+ * accepted as sent and answered with what the server actually supports.
+ */
+export declare const OAuthClientRegistrationRequestSchema: z.ZodObject<{
+    redirect_uris: z.ZodArray<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const OAuthClientRegistrationResponseSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_id_issued_at: z.ZodNumber;
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    token_endpoint_auth_method: z.ZodLiteral<"none">;
+    grant_types: z.ZodArray<z.ZodString>;
+    response_types: z.ZodArray<z.ZodString>;
+    scope: z.ZodString;
+}, z.core.$strip>;
+/** Query of the authorization endpoint, before the client is looked up. */
+export declare const OAuthAuthorizeQuerySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    response_type: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Body of the token endpoint (`application/x-www-form-urlencoded`). */
+export declare const OAuthTokenRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    code_verifier: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    client_id: z.ZodString;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">;
+export declare const OAuthTokenResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+    expires_in: z.ZodNumber;
+    refresh_token: z.ZodString;
+    scope: z.ZodString;
+}, z.core.$strip>;
+export declare const OAuthErrorCodeSchema: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    invalid_client: "invalid_client";
+    invalid_grant: "invalid_grant";
+    invalid_target: "invalid_target";
+    invalid_client_metadata: "invalid_client_metadata";
+    invalid_redirect_uri: "invalid_redirect_uri";
+    unsupported_grant_type: "unsupported_grant_type";
+    unsupported_response_type: "unsupported_response_type";
+    access_denied: "access_denied";
+    temporarily_unavailable: "temporarily_unavailable";
+}>;
+/** Error body of the registration and token endpoints (RFC 6749, RFC 7591). */
+export declare const OAuthErrorResponseSchema: z.ZodObject<{
+    error: z.ZodEnum<{
+        invalid_request: "invalid_request";
+        invalid_client: "invalid_client";
+        invalid_grant: "invalid_grant";
+        invalid_target: "invalid_target";
+        invalid_client_metadata: "invalid_client_metadata";
+        invalid_redirect_uri: "invalid_redirect_uri";
+        unsupported_grant_type: "unsupported_grant_type";
+        unsupported_response_type: "unsupported_response_type";
+        access_denied: "access_denied";
+        temporarily_unavailable: "temporarily_unavailable";
+    }>;
+    error_description: z.ZodString;
+}, z.core.$strip>;
+/** RFC 9728: where the MCP endpoint's authorization server is. */
+export declare const OAuthProtectedResourceMetadataSchema: z.ZodObject<{
+    resource: z.ZodString;
+    authorization_servers: z.ZodArray<z.ZodString>;
+    bearer_methods_supported: z.ZodArray<z.ZodString>;
+    scopes_supported: z.ZodArray<z.ZodString>;
+    resource_name: z.ZodString;
+}, z.core.$strip>;
+/** RFC 8414: the authorization server's endpoints and capabilities. */
+export declare const OAuthAuthorizationServerMetadataSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    registration_endpoint: z.ZodString;
+    response_types_supported: z.ZodArray<z.ZodString>;
+    grant_types_supported: z.ZodArray<z.ZodString>;
+    code_challenge_methods_supported: z.ZodArray<z.ZodString>;
+    token_endpoint_auth_methods_supported: z.ZodArray<z.ZodString>;
+    scopes_supported: z.ZodArray<z.ZodString>;
+    authorization_response_iss_parameter_supported: z.ZodBoolean;
+}, z.core.$strip>;
+/** What the consent page shows about a pending sign-in request. */
+export declare const AdminOrderAssistantAuthorizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    client_name: z.ZodNullable<z.ZodString>;
+    redirect_host: z.ZodString;
+    redirect_is_loopback: z.ZodBoolean;
+    redirect_is_known: z.ZodBoolean;
+    expires_at: z.ZodString;
+}, z.core.$strip>;
+export declare const AdminOrderAssistantAuthorizationResponseSchema: z.ZodObject<{
+    authorization: z.ZodObject<{
+        id: z.ZodString;
+        client_name: z.ZodNullable<z.ZodString>;
+        redirect_host: z.ZodString;
+        redirect_is_loopback: z.ZodBoolean;
+        redirect_is_known: z.ZodBoolean;
+        expires_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const DecideOrderAssistantAuthorizationSchema: z.ZodObject<{
+    approve: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const DecideOrderAssistantAuthorizationResponseSchema: z.ZodObject<{
+    redirect_to: z.ZodString;
+}, z.core.$strip>;
+/** One chatbot an Admin user connected through OAuth. */
+export declare const AdminOrderAssistantConnectionSchema: z.ZodObject<{
+    id: z.ZodString;
+    client_name: z.ZodNullable<z.ZodString>;
+    redirect_host: z.ZodString;
+    user_id: z.ZodString;
+    user_email: z.ZodNullable<z.ZodString>;
+    created_at: z.ZodString;
+    last_used_at: z.ZodNullable<z.ZodString>;
+    expires_at: z.ZodString;
+}, z.core.$strip>;
+export declare const AdminOrderAssistantConnectionsResponseSchema: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        client_name: z.ZodNullable<z.ZodString>;
+        redirect_host: z.ZodString;
+        user_id: z.ZodString;
+        user_email: z.ZodNullable<z.ZodString>;
+        created_at: z.ZodString;
+        last_used_at: z.ZodNullable<z.ZodString>;
+        expires_at: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const DeleteOrderAssistantConnectionResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    deleted: z.ZodLiteral<true>;
+}, z.core.$strip>;

package/dist/order-assistant/schemas.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreateDraftOrderOutputSchema = exports.OrderAssistantDraftItemSchema = exports.CreateDraftOrderInputSchema = exports.OrderAssistantNewCustomerSchema = exports.ListShippingOptionsOutputSchema = exports.OrderAssistantShippingOptionSchema = exports.ListShippingOptionsInputSchema = exports.SearchProductsOutputSchema = exports.OrderAssistantVariantSchema = exports.SearchProductsInputSchema = exports.SearchCustomersOutputSchema = exports.OrderAssistantCustomerSchema = exports.OrderAssistantCustomerAddressSchema = exports.SearchCustomersInputSchema = exports.OrderAssistantAddressSchema = exports.ORDER_ASSISTANT_LIMITS = exports.ORDER_ASSISTANT_METADATA = exports.OrderAssistantSourceSchema = exports.ORDER_ASSISTANT_TOOLS = exports.ORDER_ASSISTANT_PLUGIN_KEY = void 0;
+exports.DeleteOrderAssistantConnectionResponseSchema = exports.AdminOrderAssistantConnectionsResponseSchema = exports.AdminOrderAssistantConnectionSchema = exports.DecideOrderAssistantAuthorizationResponseSchema = exports.DecideOrderAssistantAuthorizationSchema = exports.AdminOrderAssistantAuthorizationResponseSchema = exports.AdminOrderAssistantAuthorizationSchema = exports.OAuthAuthorizationServerMetadataSchema = exports.OAuthProtectedResourceMetadataSchema = exports.OAuthErrorResponseSchema = exports.OAuthErrorCodeSchema = exports.OAuthTokenResponseSchema = exports.OAuthTokenRequestSchema = exports.OAuthAuthorizeQuerySchema = exports.OAuthClientRegistrationResponseSchema = exports.OAuthClientRegistrationRequestSchema = exports.OAuthRedirectUriSchema = exports.isOAuthLoopbackRedirectUri = exports.ORDER_ASSISTANT_OAUTH = exports.ORDER_ASSISTANT_FEATURES = exports.CreateDraftOrderOutputSchema = exports.OrderAssistantDraftItemSchema = exports.CreateDraftOrderInputSchema = exports.OrderAssistantNewCustomerSchema = exports.ListShippingOptionsOutputSchema = exports.OrderAssistantShippingOptionSchema = exports.ListShippingOptionsInputSchema = exports.SearchProductsOutputSchema = exports.OrderAssistantVariantSchema = exports.SearchProductsInputSchema = exports.SearchCustomersOutputSchema = exports.OrderAssistantCustomerSchema = exports.OrderAssistantCustomerAddressSchema = exports.SearchCustomersInputSchema = exports.OrderAssistantAddressSchema = exports.ORDER_ASSISTANT_LIMITS = exports.ORDER_ASSISTANT_METADATA = exports.OrderAssistantSourceSchema = exports.ORDER_ASSISTANT_TOOLS = exports.ORDER_ASSISTANT_PLUGIN_KEY = void 0;
 const zod_1 = require("@medusajs/framework/zod");
 const primitives_1 = require("../shared/primitives");
 /** Plugin key and container key of the order assistant in the base. */
@@ -184,3 +184,206 @@ exports.CreateDraftOrderOutputSchema = zod_1.z.object({
     /** Path of the draft in the Admin, relative to the backend URL. */
     admin_path: zod_1.z.string(),
 });
+// --- Anmeldung per OAuth (MCP authorization, OAuth 2.1) --------------------
+/** Feature keys of the order assistant's plugin toggles. */
+exports.ORDER_ASSISTANT_FEATURES = {
+    oauth: "oauth",
+};
+exports.ORDER_ASSISTANT_OAUTH = {
+    /** The one scope: use the assistant's tools as the signed-in Admin user. */
+    scope: "order_assistant",
+    accessTokenTtlSeconds: 3600,
+    /** A connection ends when its refresh token stays unused this long. */
+    connectionIdleDays: 30,
+    /** How long the consent page may stay open. */
+    authorizationRequestTtlSeconds: 600,
+    /** How long the client has to redeem the code after the consent. */
+    authorizationCodeTtlSeconds: 120,
+    maxRedirectUris: 10,
+    maxUriLength: 2000,
+    maxClientNameLength: 120,
+    maxStateLength: 2000,
+};
+const OAUTH_LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/** `http://localhost`, `http://127.0.0.1` or `http://[::1]`, any port. */
+const isOAuthLoopbackRedirectUri = (value) => {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "http:" && OAUTH_LOOPBACK_HOSTS.includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+exports.isOAuthLoopbackRedirectUri = isOAuthLoopbackRedirectUri;
+/**
+ * A redirect URI a client may register: https, or http on a loopback address
+ * (native clients such as Claude Code), without credentials or fragment.
+ */
+exports.OAuthRedirectUriSchema = zod_1.z
+    .string()
+    .max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength)
+    .refine((value) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash || url.username || url.password) {
+        return false;
+    }
+    return url.protocol === "https:" || (0, exports.isOAuthLoopbackRedirectUri)(value);
+}, {
+    message: "A redirect URI must use https, or http on a loopback address, and carry no fragment.",
+});
+/**
+ * Dynamic client registration request (RFC 7591). Unknown metadata is
+ * ignored; the requested authentication method, grant and response types are
+ * accepted as sent and answered with what the server actually supports.
+ */
+exports.OAuthClientRegistrationRequestSchema = zod_1.z.object({
+    redirect_uris: zod_1.z
+        .array(exports.OAuthRedirectUriSchema)
+        .min(1)
+        .max(exports.ORDER_ASSISTANT_OAUTH.maxRedirectUris),
+    client_name: zod_1.z
+        .string()
+        .trim()
+        .min(1)
+        .max(exports.ORDER_ASSISTANT_OAUTH.maxClientNameLength)
+        .optional(),
+});
+exports.OAuthClientRegistrationResponseSchema = zod_1.z.object({
+    client_id: zod_1.z.string(),
+    /** Seconds since the epoch. */
+    client_id_issued_at: zod_1.z.number(),
+    client_name: zod_1.z.string().optional(),
+    redirect_uris: zod_1.z.array(zod_1.z.string()),
+    /** Public clients only: PKCE instead of a client secret. */
+    token_endpoint_auth_method: zod_1.z.literal("none"),
+    grant_types: zod_1.z.array(zod_1.z.string()),
+    response_types: zod_1.z.array(zod_1.z.string()),
+    scope: zod_1.z.string(),
+});
+/** Query of the authorization endpoint, before the client is looked up. */
+exports.OAuthAuthorizeQuerySchema = zod_1.z.object({
+    client_id: zod_1.z.string().min(1).max(200),
+    redirect_uri: zod_1.z.string().min(1).max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength),
+    response_type: zod_1.z.string().max(100).optional(),
+    code_challenge: zod_1.z.string().max(200).optional(),
+    code_challenge_method: zod_1.z.string().max(20).optional(),
+    state: zod_1.z.string().max(exports.ORDER_ASSISTANT_OAUTH.maxStateLength).optional(),
+    scope: zod_1.z.string().max(1000).optional(),
+    resource: zod_1.z.string().max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+});
+/** Body of the token endpoint (`application/x-www-form-urlencoded`). */
+exports.OAuthTokenRequestSchema = zod_1.z.discriminatedUnion("grant_type", [
+    zod_1.z.object({
+        grant_type: zod_1.z.literal("authorization_code"),
+        code: zod_1.z.string().min(1).max(200),
+        /** RFC 7636: 43 to 128 unreserved characters. */
+        code_verifier: zod_1.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/),
+        client_id: zod_1.z.string().min(1).max(200),
+        redirect_uri: zod_1.z.string().max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+        resource: zod_1.z.string().max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+    zod_1.z.object({
+        grant_type: zod_1.z.literal("refresh_token"),
+        refresh_token: zod_1.z.string().min(1).max(200),
+        client_id: zod_1.z.string().min(1).max(200),
+        resource: zod_1.z.string().max(exports.ORDER_ASSISTANT_OAUTH.maxUriLength).optional(),
+    }),
+]);
+exports.OAuthTokenResponseSchema = zod_1.z.object({
+    access_token: zod_1.z.string(),
+    token_type: zod_1.z.literal("Bearer"),
+    /** Seconds until the access token expires. */
+    expires_in: zod_1.z.number(),
+    /** Replaces the refresh token that was sent; the old one stops working. */
+    refresh_token: zod_1.z.string(),
+    scope: zod_1.z.string(),
+});
+exports.OAuthErrorCodeSchema = zod_1.z.enum([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "invalid_target",
+    "invalid_client_metadata",
+    "invalid_redirect_uri",
+    "unsupported_grant_type",
+    "unsupported_response_type",
+    "access_denied",
+    "temporarily_unavailable",
+]);
+/** Error body of the registration and token endpoints (RFC 6749, RFC 7591). */
+exports.OAuthErrorResponseSchema = zod_1.z.object({
+    error: exports.OAuthErrorCodeSchema,
+    error_description: zod_1.z.string(),
+});
+/** RFC 9728: where the MCP endpoint's authorization server is. */
+exports.OAuthProtectedResourceMetadataSchema = zod_1.z.object({
+    resource: zod_1.z.string(),
+    authorization_servers: zod_1.z.array(zod_1.z.string()),
+    bearer_methods_supported: zod_1.z.array(zod_1.z.string()),
+    scopes_supported: zod_1.z.array(zod_1.z.string()),
+    resource_name: zod_1.z.string(),
+});
+/** RFC 8414: the authorization server's endpoints and capabilities. */
+exports.OAuthAuthorizationServerMetadataSchema = zod_1.z.object({
+    issuer: zod_1.z.string(),
+    authorization_endpoint: zod_1.z.string(),
+    token_endpoint: zod_1.z.string(),
+    registration_endpoint: zod_1.z.string(),
+    response_types_supported: zod_1.z.array(zod_1.z.string()),
+    grant_types_supported: zod_1.z.array(zod_1.z.string()),
+    code_challenge_methods_supported: zod_1.z.array(zod_1.z.string()),
+    token_endpoint_auth_methods_supported: zod_1.z.array(zod_1.z.string()),
+    scopes_supported: zod_1.z.array(zod_1.z.string()),
+    /** RFC 9207: every authorization response carries `iss`. */
+    authorization_response_iss_parameter_supported: zod_1.z.boolean(),
+});
+/** What the consent page shows about a pending sign-in request. */
+exports.AdminOrderAssistantAuthorizationSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    /** Name the chatbot registered with; `null` when it gave none. */
+    client_name: zod_1.z.string().nullable(),
+    /** Host the browser is sent back to after the decision. */
+    redirect_host: zod_1.z.string(),
+    /** True when the chatbot runs on this computer (loopback redirect). */
+    redirect_is_loopback: zod_1.z.boolean(),
+    /** True when the host belongs to a chatbot service the shop knows. */
+    redirect_is_known: zod_1.z.boolean(),
+    expires_at: primitives_1.WireDateSchema,
+});
+exports.AdminOrderAssistantAuthorizationResponseSchema = zod_1.z.object({
+    authorization: exports.AdminOrderAssistantAuthorizationSchema,
+});
+exports.DecideOrderAssistantAuthorizationSchema = zod_1.z
+    .object({ approve: zod_1.z.boolean() })
+    .strict();
+exports.DecideOrderAssistantAuthorizationResponseSchema = zod_1.z.object({
+    /** Where the browser must go next: the chatbot's redirect URI. */
+    redirect_to: zod_1.z.string(),
+});
+/** One chatbot an Admin user connected through OAuth. */
+exports.AdminOrderAssistantConnectionSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    client_name: zod_1.z.string().nullable(),
+    redirect_host: zod_1.z.string(),
+    user_id: zod_1.z.string(),
+    /** `null` when the Admin user no longer exists. */
+    user_email: zod_1.z.string().nullable(),
+    created_at: primitives_1.WireDateSchema,
+    last_used_at: primitives_1.WireDateSchema.nullable(),
+    /** When the connection ends unless the chatbot uses it before. */
+    expires_at: primitives_1.WireDateSchema,
+});
+exports.AdminOrderAssistantConnectionsResponseSchema = zod_1.z.object({
+    connections: zod_1.z.array(exports.AdminOrderAssistantConnectionSchema),
+});
+exports.DeleteOrderAssistantConnectionResponseSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    deleted: zod_1.z.literal(true),
+});

package/dist/order-assistant/types.d.ts

@@ -1,5 +1,5 @@
 import type { z } from "@medusajs/framework/zod";
-import type { CreateDraftOrderInputSchema, CreateDraftOrderOutputSchema, ListShippingOptionsInputSchema, ListShippingOptionsOutputSchema, OrderAssistantAddressSchema, OrderAssistantCustomerSchema, OrderAssistantShippingOptionSchema, OrderAssistantSourceSchema, OrderAssistantVariantSchema, SearchCustomersInputSchema, SearchCustomersOutputSchema, SearchProductsInputSchema, SearchProductsOutputSchema } from "./schemas";
+import type { AdminOrderAssistantAuthorizationResponseSchema, AdminOrderAssistantAuthorizationSchema, AdminOrderAssistantConnectionSchema, AdminOrderAssistantConnectionsResponseSchema, CreateDraftOrderInputSchema, CreateDraftOrderOutputSchema, DecideOrderAssistantAuthorizationResponseSchema, DecideOrderAssistantAuthorizationSchema, DeleteOrderAssistantConnectionResponseSchema, ListShippingOptionsInputSchema, ListShippingOptionsOutputSchema, OAuthAuthorizationServerMetadataSchema, OAuthAuthorizeQuerySchema, OAuthClientRegistrationRequestSchema, OAuthClientRegistrationResponseSchema, OAuthErrorCodeSchema, OAuthErrorResponseSchema, OAuthProtectedResourceMetadataSchema, OAuthTokenRequestSchema, OAuthTokenResponseSchema, OrderAssistantAddressSchema, OrderAssistantCustomerSchema, OrderAssistantShippingOptionSchema, OrderAssistantSourceSchema, OrderAssistantVariantSchema, SearchCustomersInputSchema, SearchCustomersOutputSchema, SearchProductsInputSchema, SearchProductsOutputSchema } from "./schemas";
 export type OrderAssistantSource = z.infer<typeof OrderAssistantSourceSchema>;
 export type OrderAssistantAddress = z.infer<typeof OrderAssistantAddressSchema>;
 export type OrderAssistantCustomer = z.infer<typeof OrderAssistantCustomerSchema>;
@@ -13,3 +13,19 @@ export type ListShippingOptionsInput = z.infer<typeof ListShippingOptionsInputSc
 export type ListShippingOptionsOutput = z.infer<typeof ListShippingOptionsOutputSchema>;
 export type CreateDraftOrderInput = z.infer<typeof CreateDraftOrderInputSchema>;
 export type CreateDraftOrderOutput = z.infer<typeof CreateDraftOrderOutputSchema>;
+export type OAuthClientRegistrationRequest = z.infer<typeof OAuthClientRegistrationRequestSchema>;
+export type OAuthClientRegistrationResponse = z.infer<typeof OAuthClientRegistrationResponseSchema>;
+export type OAuthAuthorizeQuery = z.infer<typeof OAuthAuthorizeQuerySchema>;
+export type OAuthTokenRequest = z.infer<typeof OAuthTokenRequestSchema>;
+export type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;
+export type OAuthErrorCode = z.infer<typeof OAuthErrorCodeSchema>;
+export type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;
+export type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;
+export type OAuthAuthorizationServerMetadata = z.infer<typeof OAuthAuthorizationServerMetadataSchema>;
+export type AdminOrderAssistantAuthorization = z.infer<typeof AdminOrderAssistantAuthorizationSchema>;
+export type AdminOrderAssistantAuthorizationResponse = z.infer<typeof AdminOrderAssistantAuthorizationResponseSchema>;
+export type DecideOrderAssistantAuthorizationRequest = z.infer<typeof DecideOrderAssistantAuthorizationSchema>;
+export type DecideOrderAssistantAuthorizationResponse = z.infer<typeof DecideOrderAssistantAuthorizationResponseSchema>;
+export type AdminOrderAssistantConnection = z.infer<typeof AdminOrderAssistantConnectionSchema>;
+export type AdminOrderAssistantConnectionsResponse = z.infer<typeof AdminOrderAssistantConnectionsResponseSchema>;
+export type DeleteOrderAssistantConnectionResponse = z.infer<typeof DeleteOrderAssistantConnectionResponseSchema>;

package/dist/plugin-features/schemas.d.ts

@@ -49,9 +49,9 @@ export declare const PluginSettingTypeSchema: z.ZodEnum<{
 /** Where a setting's current value comes from. */
 export declare const PluginSettingSourceSchema: z.ZodEnum<{
     default: "default";
+    none: "none";
     stored: "stored";
     config: "config";
-    none: "none";
 }>;
 export declare const PluginSettingValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
 /**
@@ -68,9 +68,9 @@ export declare const AdminPluginSecretSettingSchema: z.ZodObject<{
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -102,9 +102,9 @@ export declare const AdminPluginSelectSettingSchema: z.ZodObject<{
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -136,9 +136,9 @@ export declare const AdminPluginOrderedListSettingSchema: z.ZodObject<{
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -164,9 +164,9 @@ export declare const AdminPluginNumberSettingSchema: z.ZodObject<{
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -196,9 +196,9 @@ export declare const AdminPluginPlainSettingSchema: z.ZodObject<{
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -219,9 +219,9 @@ export declare const AdminPluginSettingSchema: z.ZodUnion<readonly [z.ZodObject<
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -247,9 +247,9 @@ export declare const AdminPluginSettingSchema: z.ZodUnion<readonly [z.ZodObject<
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -275,9 +275,9 @@ export declare const AdminPluginSettingSchema: z.ZodUnion<readonly [z.ZodObject<
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -302,9 +302,9 @@ export declare const AdminPluginSettingSchema: z.ZodUnion<readonly [z.ZodObject<
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -333,9 +333,9 @@ export declare const AdminPluginSettingSchema: z.ZodUnion<readonly [z.ZodObject<
     is_set: z.ZodBoolean;
     source: z.ZodEnum<{
         default: "default";
+        none: "none";
         stored: "stored";
         config: "config";
-        none: "none";
     }>;
     invalidates: z.ZodArray<z.ZodString>;
     hint: z.ZodNullable<z.ZodString>;
@@ -375,9 +375,9 @@ export declare const AdminPluginSettingsSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -403,9 +403,9 @@ export declare const AdminPluginSettingsSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -431,9 +431,9 @@ export declare const AdminPluginSettingsSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -458,9 +458,9 @@ export declare const AdminPluginSettingsSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -489,9 +489,9 @@ export declare const AdminPluginSettingsSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -544,9 +544,9 @@ export declare const AdminPluginFeaturesSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -572,9 +572,9 @@ export declare const AdminPluginFeaturesSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -600,9 +600,9 @@ export declare const AdminPluginFeaturesSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -627,9 +627,9 @@ export declare const AdminPluginFeaturesSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -658,9 +658,9 @@ export declare const AdminPluginFeaturesSchema: z.ZodObject<{
         is_set: z.ZodBoolean;
         source: z.ZodEnum<{
             default: "default";
+            none: "none";
             stored: "stored";
             config: "config";
-            none: "none";
         }>;
         invalidates: z.ZodArray<z.ZodString>;
         hint: z.ZodNullable<z.ZodString>;
@@ -735,9 +735,9 @@ export declare const AdminPluginFeaturesListResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -763,9 +763,9 @@ export declare const AdminPluginFeaturesListResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -791,9 +791,9 @@ export declare const AdminPluginFeaturesListResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -818,9 +818,9 @@ export declare const AdminPluginFeaturesListResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -849,9 +849,9 @@ export declare const AdminPluginFeaturesListResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -927,9 +927,9 @@ export declare const AdminPluginFeaturesResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -955,9 +955,9 @@ export declare const AdminPluginFeaturesResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -983,9 +983,9 @@ export declare const AdminPluginFeaturesResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1010,9 +1010,9 @@ export declare const AdminPluginFeaturesResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1041,9 +1041,9 @@ export declare const AdminPluginFeaturesResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1113,9 +1113,9 @@ export declare const AdminPluginSettingsResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1141,9 +1141,9 @@ export declare const AdminPluginSettingsResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1169,9 +1169,9 @@ export declare const AdminPluginSettingsResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1196,9 +1196,9 @@ export declare const AdminPluginSettingsResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;
@@ -1227,9 +1227,9 @@ export declare const AdminPluginSettingsResponseSchema: z.ZodObject<{
             is_set: z.ZodBoolean;
             source: z.ZodEnum<{
                 default: "default";
+                none: "none";
                 stored: "stored";
                 config: "config";
-                none: "none";
             }>;
             invalidates: z.ZodArray<z.ZodString>;
             hint: z.ZodNullable<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hartl-services/medusa-contracts",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "private": false,
   "sideEffects": false,
   "files": [