@unchainedshop/api 4.5.0 → 4.6.1

package/README.md

@@ -149,6 +149,210 @@ import { createMCPServer } from '@unchainedshop/api/mcp';
 const mcpServer = createMCPServer(unchainedCore);
 ```
 
+## Security
+
+The API layer implements comprehensive security controls.
+
+### Access Control
+
+- **128+ permission actions** covering all API operations
+- **Role-Based Access Control (RBAC)** with built-in and custom roles
+- **ACL enforcement** on all GraphQL mutations
+- **Ownership validation** ensuring users can only access their resources
+
+### Session Security
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `UNCHAINED_TOKEN_SECRET` | Session encryption (min 32 chars) | Required |
+| `UNCHAINED_COOKIE_NAME` | Cookie name | `unchained_token` |
+| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `none` |
+| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag | `false` |
+
+Cookies are `httpOnly` and `secure` by default.
+
+### Error Handling
+
+Errors are designed to prevent information leakage:
+- Generic authentication error messages
+- No distinction between "invalid" vs "expired" tokens
+- Permission errors don't reveal action details
+
+### CORS Configuration
+
+CORS behavior depends on `NODE_ENV`:
+
+| Environment | Default Behavior |
+|-------------|------------------|
+| `development` | Permissive CORS (reflects any origin) + trust proxy headers |
+| `production` | No CORS headers (reverse proxy should handle it) |
+
+#### Environment Variable
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `UNCHAINED_CORS_ORIGINS` | Allowed CORS origins | Auto (see above) |
+
+#### Programmatic Configuration
+
+```typescript
+// Auto behavior (recommended) - permissive in dev, none in prod
+connect(app, { graphqlHandler, db, unchainedAPI });
+
+// Explicit whitelist (production)
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+// Force permissive (not recommended in production)
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: true,
+});
+
+// Disable CORS entirely
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: false,
+});
+```
+
+### Deployment Scenarios
+
+#### Scenario 1: Direct TLS (No Reverse Proxy)
+
+For simple deployments where the Node.js server handles TLS directly:
+
+```typescript
+import express from 'express';
+import https from 'https';
+import fs from 'fs';
+import { connect } from '@unchainedshop/api/express';
+
+const app = express();
+
+// Configure CORS for your frontend origins
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+// Create HTTPS server with your certificates
+https.createServer({
+  key: fs.readFileSync('/path/to/privkey.pem'),
+  cert: fs.readFileSync('/path/to/fullchain.pem'),
+}, app).listen(443);
+```
+
+Environment:
+```bash
+NODE_ENV=production
+UNCHAINED_CORS_ORIGINS=https://shop.example.com,https://admin.example.com
+UNCHAINED_TOKEN_SECRET=your-32-char-secret-here
+```
+
+#### Scenario 2: Behind Reverse Proxy (Recommended)
+
+For production deployments behind nginx, Caddy, or a cloud load balancer:
+
+```typescript
+import express from 'express';
+import { connect } from '@unchainedshop/api/express';
+
+const app = express();
+
+// Trust the reverse proxy for client IP headers
+app.set('trust proxy', 1);
+
+// Let the proxy handle CORS, or configure here
+connect(app, { graphqlHandler, db, unchainedAPI }, {
+  corsOrigins: "https://shop.example.com,https://admin.example.com",
+});
+
+app.listen(4010); // Internal port, not exposed
+```
+
+**Nginx configuration:**
+```nginx
+server {
+  listen 443 ssl http2;
+  server_name api.example.com;
+
+  ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
+
+  location / {
+    # Pass client IP to the app
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Host $host;
+
+    proxy_pass http://localhost:4010;
+  }
+}
+```
+
+**Caddy configuration:**
+```caddyfile
+api.example.com {
+  reverse_proxy localhost:4010
+}
+```
+
+#### Scenario 3: Proxy Handles CORS
+
+For complex multi-origin setups, let the reverse proxy manage CORS:
+
+```typescript
+// Don't set corsOrigins - let proxy handle it
+app.set('trust proxy', 1);
+connect(app, { graphqlHandler, db, unchainedAPI });
+```
+
+**Nginx with CORS:**
+```nginx
+location / {
+  proxy_set_header X-Real-IP $remote_addr;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+
+  # CORS whitelist
+  set $cors "";
+  if ($http_origin ~* "^https://(shop|admin)\.example\.com$") {
+    set $cors $http_origin;
+  }
+  add_header 'Access-Control-Allow-Origin' $cors always;
+  add_header 'Access-Control-Allow-Credentials' 'true' always;
+  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
+  add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type' always;
+
+  if ($request_method = 'OPTIONS') { return 204; }
+
+  proxy_pass http://localhost:4010;
+}
+```
+
+### Trust Proxy
+
+In development mode (`NODE_ENV=development`), trust proxy is automatically enabled.
+
+In production, configure it on your Express/Fastify app before calling `connect()`:
+
+```typescript
+// Express
+app.set('trust proxy', 1);  // Trust first hop
+app.set('trust proxy', 'loopback');  // Trust loopback addresses
+app.set('trust proxy', '10.0.0.0/8');  // Trust specific CIDR
+
+// Fastify
+const fastify = Fastify({ trustProxy: true });
+```
+
+**SECURITY**: Only enable trust proxy if your reverse proxy:
+1. Strips incoming `X-Real-IP` and `X-Forwarded-For` headers from clients
+2. Sets `X-Real-IP` to the actual client IP
+3. Is the only way to reach your API server
+
+See [SECURITY.md](../../SECURITY.md) for complete security documentation including FIPS 140-3 mode.
+
 ## License
 
 EUPL-1.2

package/lib/chat/generateImageHandler.d.ts

@@ -2,5 +2,11 @@ import type * as aiTypes from 'ai';
 declare const generateImageHandler: (req: any) => ({ model, uploadUrl, }: {
     model: aiTypes.ImageModel;
     uploadUrl?: string;
-}) => aiTypes.Tool<never, any>;
+}) => aiTypes.Tool<{
+    prompt: string;
+    size?: "512x512" | "768x768" | "1024x1024" | "512x896" | "640x1120" | "768x1344" | "1024x1792" | "896x512" | "1120x640" | "1344x768" | "1792x1024" | undefined;
+}, string | {
+    imageUrl: any;
+    prompt: string;
+}>;
 export default generateImageHandler;

package/lib/chat/generateImageHandler.js

@@ -2,12 +2,12 @@ import { z } from 'zod';
 import mime from 'mime/lite';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:mcp');
-let experimental_generateImage;
+let generateImage;
 let tool;
 try {
     const aiTools = await import('ai');
     tool = aiTools.tool;
-    experimental_generateImage = aiTools.experimental_generateImage;
+    generateImage = aiTools.generateImage;
 }
 catch {
 }
@@ -33,11 +33,10 @@ const inputSchema = z.object({
 const generateImageHandler = (req) => ({ model, uploadUrl = `${process.env.ROOT_URL}/temp-upload`, }) => {
     return tool({
         description: 'Generate an image based on the prompt',
-        inputSchema: inputSchema,
-        name: 'generate_image',
+        inputSchema,
         execute: async ({ prompt, size = '1024x1024' }) => {
             try {
-                const { image } = await experimental_generateImage({
+                const { image } = await generateImage({
                     model,
                     prompt,
                     size: size,

package/lib/express/chatHandler.js

@@ -21,7 +21,7 @@ try {
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
-    createMCPClient = mcpTools.experimental_createMCPClient;
+    createMCPClient = mcpTools.createMCPClient;
 }
 catch {
     logger.warn(`optional peer npm packages 'ai', '@ai-sdk/mcp' and '@modelcontextprotocol/sdk' not installed, chat will not work`);
@@ -76,7 +76,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                             }
                         }
                         catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}:`, e);
+                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
                         }
                         return null;
                     }));
@@ -85,7 +85,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 }
             }
             catch (e) {
-                logger.error('Failed to fetch MCP resources:', e);
+                logger.error(`Failed to fetch MCP resources: ${e.message}`);
             }
             const tools = {
                 ...defaultUnchainedTools,
@@ -111,7 +111,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     anthropic: { cacheControl: { type: 'ephemeral' } },
                 },
             };
-            const normalizedMessages = convertToModelMessages(messages, { tools: cacheControlledTools });
+            const normalizedMessages = await convertToModelMessages(messages, { tools: cacheControlledTools });
             if (normalizedMessages.length > 0) {
                 const lastIndex = normalizedMessages.length - 1;
                 normalizedMessages[lastIndex] = {

package/lib/express/createERCMetadataMiddleware.js

@@ -1,6 +1,5 @@
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:erc-metadata');
-const { ROOT_URL = 'http://localhost:4010' } = process.env;
 const methodWrongHandler = (res) => {
     logger.error('Method not supported, return 404');
     res.status(404).end();
@@ -11,6 +10,7 @@ const ercMetadataMiddleware = async (req, res) => {
         if (req.method !== 'GET') {
             return methodWrongHandler(res);
         }
+        const { ROOT_URL = 'http://localhost:4010' } = process.env;
         const { services, modules, loaders, locale } = req.unchainedContext;
         const url = new URL(req.url, ROOT_URL);
         const pathname = url.pathname;

package/lib/express/index.js

@@ -64,19 +64,33 @@ const addContext = async function middlewareWithContext(req, res, next) {
             const { user } = req;
             if (!user)
                 return false;
+            const currentSessionId = req.sessionID;
+            const targetSessionId = sessionId || currentSessionId;
             const tokenObject = {
-                _id: sessionId || req.sessionID,
+                _id: targetSessionId,
                 userId: user._id,
             };
-            await new Promise((resolve, reject) => {
-                req.logout((error, result) => {
-                    if (error) {
-                        return reject(error);
-                    }
-                    req.session.impersonatorId = null;
-                    return resolve(result);
+            if (sessionId && sessionId !== currentSessionId) {
+                await new Promise((resolve, reject) => {
+                    req.sessionStore.destroy(sessionId, (error) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        return resolve();
+                    });
                 });
-            });
+            }
+            else {
+                await new Promise((resolve, reject) => {
+                    req.logout((error, result) => {
+                        if (error) {
+                            return reject(error);
+                        }
+                        req.session.impersonatorId = null;
+                        return resolve(result);
+                    });
+                });
+            }
             await emit(API_EVENTS.API_LOGOUT, tokenObject);
             return true;
         };

package/lib/fastify/chatHandler.js

@@ -20,7 +20,7 @@ try {
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
-    createMCPClient = mcpTools.experimental_createMCPClient;
+    createMCPClient = mcpTools.createMCPClient;
 }
 catch {
     logger.warn(`optional peer npm packages 'ai' and '@ai-sdk/mcp' not installed, chat will not work`);
@@ -73,7 +73,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                             }
                         }
                         catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}:`, e);
+                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
                         }
                         return null;
                     }));
@@ -82,7 +82,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 }
             }
             catch (e) {
-                logger.error('Failed to fetch MCP resources:', e);
+                logger.error(`Failed to fetch MCP resources: ${e.message}`);
             }
             const tools = {
                 ...defaultUnchainedTools,
@@ -107,7 +107,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     anthropic: { cacheControl: { type: 'ephemeral' } },
                 },
             };
-            const normalizedMessages = convertToModelMessages(messages, { tools: cacheControlledTools });
+            const normalizedMessages = await convertToModelMessages(messages, { tools: cacheControlledTools });
             if (normalizedMessages.length > 0) {
                 const lastIndex = normalizedMessages.length - 1;
                 normalizedMessages[lastIndex] = {

package/lib/fastify/ercMetadataHandler.js

@@ -1,7 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { ProductContractStandard } from '@unchainedshop/core-products';
 const logger = createLogger('unchained:api:erc-metadata');
-const { ROOT_URL = 'http://localhost:4010' } = process.env;
 const notFoundHandler = (res) => {
     logger.error('Method not supported, return 404');
     res.status(404);
@@ -9,6 +8,7 @@ const notFoundHandler = (res) => {
 };
 const ercMetadataHandler = async (req, res) => {
     try {
+        const { ROOT_URL = 'http://localhost:4010' } = process.env;
         const { services, modules, locale, loaders } = req.unchainedContext;
         const url = new URL(req.url, ROOT_URL);
         if (!url.pathname.toLowerCase().endsWith('.json'))

package/lib/mcp/tools/assortment/handlers/addAssortmentFilter.d.ts

@@ -14,7 +14,6 @@ export default function addAssortmentFilter(context: Context, params: Params<'AD
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/addAssortmentLink.d.ts

@@ -14,7 +14,6 @@ export default function addAssortmentLink(context: Context, params: Params<'ADD_
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/addAssortmentMedia.d.ts

@@ -14,7 +14,6 @@ export default function addAssortmentMedia(context: Context, params: Params<'ADD
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/addAssortmentProduct.d.ts

@@ -14,7 +14,6 @@ export default function addAssortmentProduct(context: Context, params: Params<'A
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/createAssortment.d.ts

@@ -15,7 +15,6 @@ export default function createAssortment(context: Context, params: Params<'CREAT
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/getAssortment.d.ts

@@ -14,7 +14,6 @@ export default function getAssortment(context: Context, params: Params<'GET'>):
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/getAssortmentChildren.d.ts

@@ -14,7 +14,6 @@ export default function getAssortmentChildren(context: Context, params: Params<'
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;
@@ -28,7 +27,6 @@ export default function getAssortmentChildren(context: Context, params: Params<'
     children: {
         _id: string;
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/getAssortmentFilters.d.ts

@@ -14,7 +14,6 @@ export default function getAssortmentFilters(context: Context, params: Params<'G
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/getAssortmentLinks.d.ts

@@ -14,7 +14,6 @@ export default function getAssortmentLinks(context: Context, params: Params<'GET
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;
@@ -47,7 +46,6 @@ export default function getAssortmentLinks(context: Context, params: Params<'GET
         links?: import("@unchainedshop/core-assortments").AssortmentLink[] | undefined;
         products?: import("@unchainedshop/core-assortments").AssortmentProduct[] | undefined;
         isActive?: boolean | undefined;
-        isBase?: boolean | undefined;
         isRoot?: boolean | undefined;
         sequence?: number | undefined;
         slugs?: string[];

package/lib/mcp/tools/assortment/handlers/getAssortmentMedia.d.ts

@@ -14,7 +14,6 @@ export default function getAssortmentMedia(context: Context, params: Params<'GET
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/getAssortmentProducts.d.ts

@@ -14,7 +14,6 @@ export default function getAssortmentProducts(context: Context, params: Params<'
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/index.d.ts

@@ -23,7 +23,6 @@ import removeAssortmentLink from './removeAssortmentLink.ts';
 import getAssortmentLinks from './getAssortmentLinks.ts';
 import reorderAssortmentLinks from './reorderAssortmentLinks.ts';
 import getAssortmentChildren from './getAssortmentChildren.ts';
-import setAssortmentBase from './setAssortmentBase.ts';
 import searchAssortmentProducts from './searchAssortmentProducts.ts';
 import getAssortmentTexts from './getAssortmentTexts.ts';
 import getAssortmentMediaTexts from './getAssortmentMediaTexts.ts';
@@ -53,7 +52,6 @@ declare const _default: {
     GET_LINKS: typeof getAssortmentLinks;
     REORDER_LINKS: typeof reorderAssortmentLinks;
     GET_CHILDREN: typeof getAssortmentChildren;
-    SET_BASE: typeof setAssortmentBase;
     SEARCH_PRODUCTS: typeof searchAssortmentProducts;
     GET_TEXTS: typeof getAssortmentTexts;
     GET_MEDIA_TEXTS: typeof getAssortmentMediaTexts;

package/lib/mcp/tools/assortment/handlers/index.js

@@ -23,7 +23,6 @@ import removeAssortmentLink from "./removeAssortmentLink.js";
 import getAssortmentLinks from "./getAssortmentLinks.js";
 import reorderAssortmentLinks from "./reorderAssortmentLinks.js";
 import getAssortmentChildren from "./getAssortmentChildren.js";
-import setAssortmentBase from "./setAssortmentBase.js";
 import searchAssortmentProducts from "./searchAssortmentProducts.js";
 import getAssortmentTexts from "./getAssortmentTexts.js";
 import getAssortmentMediaTexts from "./getAssortmentMediaTexts.js";
@@ -53,7 +52,6 @@ export default {
     GET_LINKS: getAssortmentLinks,
     REORDER_LINKS: reorderAssortmentLinks,
     GET_CHILDREN: getAssortmentChildren,
-    SET_BASE: setAssortmentBase,
     SEARCH_PRODUCTS: searchAssortmentProducts,
     GET_TEXTS: getAssortmentTexts,
     GET_MEDIA_TEXTS: getAssortmentMediaTexts,

package/lib/mcp/tools/assortment/handlers/listAssortments.d.ts

@@ -14,7 +14,6 @@ export default function listAssortments(context: Context, params: Params<'LIST'>
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/reorderAssortmentLinks.d.ts

@@ -23,7 +23,6 @@ export default function reorderAssortmentLinks(context: Context, params: Params<
         links?: import("@unchainedshop/core-assortments").AssortmentLink[] | undefined;
         products?: import("@unchainedshop/core-assortments").AssortmentProduct[] | undefined;
         isActive?: boolean | undefined;
-        isBase?: boolean | undefined;
         isRoot?: boolean | undefined;
         sequence?: number | undefined;
         slugs?: string[];

package/lib/mcp/tools/assortment/handlers/searchAssortmentProducts.d.ts

@@ -14,7 +14,6 @@ export default function searchAssortmentProducts(context: Context, params: Param
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/updateAssortment.d.ts

@@ -14,7 +14,6 @@ export default function updateAssortment(context: Context, params: Params<'UPDAT
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/handlers/updateAssortmentStatus.d.ts

@@ -14,7 +14,6 @@ export default function updateAssortmentStatus(context: Context, params: Params<
         links: import("@unchainedshop/core-assortments").AssortmentLink[];
         products: import("@unchainedshop/core-assortments").AssortmentProduct[];
         isActive: boolean;
-        isBase: boolean;
         isRoot: boolean;
         meta?: any;
         sequence: number;

package/lib/mcp/tools/assortment/schemas.d.ts

@@ -165,9 +165,6 @@ export declare const actionValidators: {
         assortmentId: z.ZodString;
         includeInactive: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
-    readonly SET_BASE: z.ZodObject<{
-        assortmentId: z.ZodString;
-    }, z.core.$strip>;
     readonly SEARCH_PRODUCTS: z.ZodObject<{
         queryString: z.ZodOptional<z.ZodString>;
         includeInactive: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -223,7 +220,6 @@ export declare const AssortmentManagementSchema: {
         GET_LINKS: "GET_LINKS";
         REORDER_LINKS: "REORDER_LINKS";
         GET_CHILDREN: "GET_CHILDREN";
-        SET_BASE: "SET_BASE";
         SEARCH_PRODUCTS: "SEARCH_PRODUCTS";
     }>;
     assortmentId: z.ZodOptional<z.ZodString>;
@@ -316,7 +312,6 @@ export declare const AssortmentManagementZodSchema: z.ZodObject<{
         GET_LINKS: "GET_LINKS";
         REORDER_LINKS: "REORDER_LINKS";
         GET_CHILDREN: "GET_CHILDREN";
-        SET_BASE: "SET_BASE";
         SEARCH_PRODUCTS: "SEARCH_PRODUCTS";
     }>;
     assortmentId: z.ZodOptional<z.ZodString>;

package/lib/mcp/tools/assortment/schemas.js

@@ -154,9 +154,6 @@ export const actionValidators = {
         assortmentId: z.string().min(1).describe('Assortment ID (optional for root-level)'),
         includeInactive: z.boolean().optional().describe('Include inactive children'),
     }),
-    SET_BASE: z.object({
-        assortmentId: z.string().min(1).describe('Assortment ID to set as base'),
-    }),
     SEARCH_PRODUCTS: z.object({
         assortmentId: z.string().min(1).describe('Assortment ID'),
         ...PaginationSchema,
@@ -197,7 +194,6 @@ export const AssortmentManagementSchema = {
         'GET_LINKS',
         'REORDER_LINKS',
         'GET_CHILDREN',
-        'SET_BASE',
         'SEARCH_PRODUCTS',
         'GET_TEXTS',
         'GET_MEDIA_TEXTS',

package/lib/mcp/tools/order/handlers/confirmOrder.d.ts

@@ -76,7 +76,7 @@ export default function confirmOrder(context: Context, params: Params<'CONFIRM_O
         countryCode: string;
         currencyCode: string;
         deliveryId?: string;
-        fullfilled?: Date;
+        fulfilled?: Date;
         ordered?: Date;
         orderNumber?: string;
         originEnrollmentId?: string;