askell-mcp 0.4.4 → 0.4.6

package/README.md

@@ -127,7 +127,7 @@ Typical agent workflow:
 
 - **v1** — legacy paths like `/customers/`, `/subscriptions/` (no `/v2` prefix)
 - **v2** — current model: catalogs, quotes, checkouts, contracts, billing runs under `/v2/`
-- **v2 discounts** — coupons: `GET/POST /v2/subscription-contracts/{id}/discount|apply-code|remove-discount` (one active). Quotes take `promotion_code` and, for an existing buyer, `customer` (id) so combo discounts + promo restrictions apply. Totals already include both. Recurring `finalize` needs a verified payment method even when due-now is 0. Not the v1 `discount` 0–100 field.
+- **v2 discounts** — coupons: `GET/POST /v2/subscription-contracts/{id}/discount|apply-code|remove-discount` (one active). Quotes take `promotion_code` and, for an existing buyer, `customer` (id) so combo discounts + promo restrictions apply. First-period totals already include coupon + combo; `quote.recurring_*` include combo but not the coupon (`discount.recurring_final_amount` while the coupon is active). Recurring `finalize` needs a verified payment method even when due-now is 0. Not the v1 `discount` 0–100 field.
 - Paths use **trailing slashes**
 - Prefer **v2** for new integrations; v1 remains for existing ones
 - Docs: [docs.askell.is](https://docs.askell.is/) · OpenAPI: [v1](https://askell.is/api/swagger/swagger.json) · [v2](https://askell.is/api/swagger/v2/swagger.json)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "askell-mcp",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "MCP server for the Askell payment and subscription API (Bun + stdio)",
   "author": "Neschadin Oleksandr",
   "license": "MIT",
@@ -67,6 +67,6 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "zod": "4.6.1"
+    "zod": "4.6.2"
   }
 }

package/spec/openapi-v2.json

@@ -3088,6 +3088,10 @@
               "shipping": {
                 "$ref": "#/components/schemas/V2ShippingSelectionInput",
                 "description": "The shipping option the customer chose. Required when the offer contains physical products and the account has active shipping options."
+              },
+              "allowed_origin": {
+                "type": "string",
+                "description": "Origin allowed to embed the hosted card form for this checkout in an iframe, for example `https://shop.example`. A single http(s) origin with no path; http is accepted only for `localhost` and loopback addresses (`127.0.0.0/8`, `[::1]`). When set it replaces the account-level checkout origins in the hosted page's `frame-ancestors` policy. Not accepted on checkout-session endpoints, where the sales channel's allowed origins apply."
               }
             }
           }
@@ -3638,6 +3642,10 @@
           },
           "metadata": {
             "$ref": "#/components/schemas/V2Metadata"
+          },
+          "allowed_origin": {
+            "type": "string",
+            "description": "Origin allowed to embed this hosted card form in an iframe, for example `https://shop.example`. A single http(s) origin with no path; http is accepted only for `localhost` and loopback addresses (`127.0.0.0/8`, `[::1]`). Defaults to the checkout's `allowed_origin`, and when set it replaces the account-level checkout origins in the hosted page's `frame-ancestors` policy. Not accepted on checkout-session endpoints, where the sales channel's allowed origins apply."
           }
         }
       },
@@ -3690,6 +3698,10 @@
           "metadata": {
             "$ref": "#/components/schemas/V2Metadata"
           },
+          "allowed_origin": {
+            "type": "string",
+            "description": "Origin allowed to embed this hosted card form, or an empty string when the account-level checkout origins apply."
+          },
           "error_message": {
             "type": "string"
           },
@@ -3767,6 +3779,10 @@
           "metadata": {
             "$ref": "#/components/schemas/V2Metadata"
           },
+          "allowed_origin": {
+            "type": "string",
+            "description": "Origin allowed to embed hosted pages for this checkout, or an empty string when the account-level checkout origins apply."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"
@@ -3998,6 +4014,21 @@
               "original_total_amount": {
                 "type": "string",
                 "format": "decimal"
+              },
+              "recurring_original_amount": {
+                "type": "string",
+                "format": "decimal",
+                "description": "What a renewal bills without the coupon. The recurring_* totals of the quote do not include the promotion code discount."
+              },
+              "recurring_discount_amount": {
+                "type": "string",
+                "format": "decimal",
+                "description": "The coupon's discount applied to a renewal's recurring lines. Computed regardless of duration: a once coupon lapses after the first payment and a repeating coupon after duration_in_months, so only treat this as the renewal discount while the coupon is active."
+              },
+              "recurring_final_amount": {
+                "type": "string",
+                "format": "decimal",
+                "description": "What a renewal bills with the coupon's discount applied. Only meaningful while the coupon is still active (see duration and duration_in_months)."
               }
             }
           },
@@ -4915,6 +4946,13 @@
           "metadata": {
             "$ref": "#/components/schemas/V2Metadata"
           },
+          "subscriber_page": {
+            "type": "string",
+            "format": "uri",
+            "nullable": true,
+            "readOnly": true,
+            "description": "Absolute URL of the customer-facing subscription management page for this contract."
+          },
           "created_at": {
             "type": "string",
             "format": "date-time"

package/src/server.ts

@@ -49,12 +49,14 @@ API layout:
 
 V2 discounts — two systems, not v1 Subscription.discount (0-100 on a PlanVariant; never send that to v2):
 - Coupons: one active per contract. GET /v2/subscription-contracts/{id}/discount/ (also nested as contract.discount). Apply with POST .../apply-code/ {promotion_code}. Remove with POST .../remove-discount/.
-- Quotes (POST /v2/subscription-offer-quotes/): pass promotion_code for coupons. When quoting an existing customer, pass customer (numeric id) or combo discounts from their other active contracts and promo-code customer restrictions are skipped. Quoted totals already include coupon + combo; do not subtract again. combo_discounts[] is on the quote response (askell_describe_operation omits response schemas). Combo is automatic, not apply-code.
+- Quotes (POST /v2/subscription-offer-quotes/): pass promotion_code for coupons. When quoting an existing customer, pass customer (numeric id) or combo discounts from their other active contracts and promo-code customer restrictions are skipped. First-period subtotal/tax/total already include coupon + combo. quote.recurring_* include combo, not the coupon — renewal-with-coupon is discount.recurring_final_amount, and only while duration still applies (once → after first payment use recurring_*). combo_discounts[] and discount.recurring_* are on the quote response (askell_describe_operation omits response schemas). Combo is automatic, not apply-code.
 
 V2 checkout notes:
 - checkout_url on V2 checkouts points to the API object URL, not a hosted payment page.
+- GET contract.subscriber_page is the customer-facing subscription management URL (readOnly, nullable). Not checkout_url, not v1 /public/payments/{id}/ (hosted signup). Do not send it on create/patch.
 - finalize: a recurring offer needs a verified payment method even when due-now/total is 0 (trial or fully discounted first period). Only a free one-time purchase finalizes without one. Live docs still say "unless 0 ISK" — ignore that; bundled OpenAPI is right.
 - Hosted POST /v2/checkouts/: shipping {option, location_id?} is required when the offer has physical products and the account has active shipping options. No shipping-options list in OpenAPI (ids are account config). Pickup options need location_id. Snapshot is contract.shipping_selection, not on V2Checkout.
+- Hosted iframe (not askell.js): POST /v2/checkouts/ and POST .../payment-method-registrations/ take allowed_origin (one origin, no path; http only localhost/loopback). Replaces account-level frame-ancestors; GET empty string = account-level. Rejected on /v2/checkout-sessions/ (sales-channel allowed_origins[]).
 - Embedded checkout uses POST /v2/checkout-sessions/ plus browser session-token sub-paths (widget collects address/shipping; see docs, not all in OpenAPI).
 
 Auth:

package/src/tools/analysis.ts

@@ -141,7 +141,7 @@ export function registerAnalysisTools(
     {
       title: 'Subscription contract overview (v2)',
       description:
-        'Fetch a v2 subscription contract and recent billing runs filtered by contract id. The contract payload includes `discount` (active coupon) when one is applied, and `shipping_selection` when shipping was chosen at checkout.',
+        'Fetch a v2 subscription contract and recent billing runs filtered by contract id. The contract payload includes `discount` (active coupon) when one is applied, `shipping_selection` when shipping was chosen at checkout, and `subscriber_page` (customer-facing management URL, read-only).',
       inputSchema: z.object({
         contractId: z
           .union([z.string().min(1), z.int()])