askell-mcp 0.4.7 → 0.4.12

package/README.md

@@ -126,9 +126,8 @@ Typical agent workflow:
 ## API notes (short)
 
 - **v1** — legacy paths like `/customers/`, `/subscriptions/` (no `/v2` prefix)
-- **v2** — current model: catalogs, quotes, checkouts, contracts, billing runs under `/v2/`
+- **v2** — current model: catalogs, quotes, checkouts, contracts, billing runs, fulfillment orders under `/v2/`
 - **v2 discounts** — coupons: `GET/POST /v2/subscription-contracts/{id}/discount|apply-code|remove-discount` (one active). Quotes take `promotion_code` and, for an existing buyer, `customer` (id) so combo discounts + promo restrictions apply. First-period totals already include coupon + combo; `quote.recurring_*` include combo but not the coupon (`discount.recurring_final_amount` while the coupon is active). Recurring `finalize` needs a verified payment method even when due-now is 0. Not the v1 `discount` 0–100 field.
-- **v2 fulfilment** — British spelling: `GET /v2/fulfilment-orders/` (read-only). Path param is order `id`, not `number`. List `403` if shipping is off. Quote/checkout `shipping_fee` is already in totals.
 - Paths use **trailing slashes**
 - Prefer **v2** for new integrations; v1 remains for existing ones
 - Docs: [docs.askell.is](https://docs.askell.is/) · OpenAPI: [v1](https://askell.is/api/swagger/swagger.json) · [v2](https://askell.is/api/swagger/v2/swagger.json)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "askell-mcp",
-  "version": "0.4.7",
+  "version": "0.4.12",
   "description": "MCP server for the Askell payment and subscription API (Bun + stdio)",
   "author": "Neschadin Oleksandr",
   "license": "MIT",

package/spec/openapi-v2.json

@@ -57,8 +57,8 @@
       "description": "Subscription V2 billing-run read and retry APIs, requires secret api key."
     },
     {
-      "name": "V2 Fulfilment",
-      "description": "Subscription V2 fulfilment order read APIs for warehouse integrations, requires secret api key."
+      "name": "V2 Fulfillment",
+      "description": "Subscription V2 fulfillment order read APIs for warehouse integrations, requires secret api key."
     }
   ],
   "paths": {
@@ -1677,13 +1677,13 @@
         ]
       }
     },
-    "/v2/fulfilment-orders/": {
+    "/v2/fulfillment-orders/": {
       "get": {
         "tags": [
-          "V2 Fulfilment"
+          "V2 Fulfillment"
         ],
-        "summary": "List fulfilment orders",
-        "description": "Returns the authenticated account's fulfilment orders, newest first, with the same body the `fulfilment_order.*` webhooks carry. Intended for backfill and for polling-based reconciliation after a missed webhook delivery. Read-only. Requires a secret key, that the account uses subscription contracts, and that shipping is enabled for the account.",
+        "summary": "List fulfillment orders",
+        "description": "Returns the authenticated account's fulfillment orders, newest first, with the same body the `fulfillment_order.*` webhooks carry. Intended for backfill and for polling-based reconciliation after a missed webhook delivery. Read-only. Requires a secret key, that the account uses subscription contracts, and that shipping is enabled for the account.",
         "parameters": [
           {
             "in": "query",
@@ -1697,7 +1697,7 @@
                 "cancelled"
               ]
             },
-            "description": "Filter by fulfilment status."
+            "description": "Filter by fulfillment status."
           },
           {
             "in": "query",
@@ -1747,7 +1747,7 @@
         ],
         "responses": {
           "200": {
-            "$ref": "#/components/responses/V2FulfilmentOrderList"
+            "$ref": "#/components/responses/V2FulfillmentOrderList"
           },
           "403": {
             "$ref": "#/components/responses/V2PermissionDenied"
@@ -1760,21 +1760,21 @@
         ]
       }
     },
-    "/v2/fulfilment-orders/{fulfilmentOrderId}/": {
+    "/v2/fulfillment-orders/{fulfillmentOrderId}/": {
       "get": {
         "tags": [
-          "V2 Fulfilment"
+          "V2 Fulfillment"
         ],
-        "summary": "Get a fulfilment order",
-        "description": "Returns one fulfilment order belonging to the authenticated account, with its lines, delivery address, shipping selection and booked shipments. Orders belonging to another account return `404`. Read-only. Requires a secret key.",
+        "summary": "Get a fulfillment order",
+        "description": "Returns one fulfillment order belonging to the authenticated account, with its lines, delivery address, shipping selection and booked shipments. Orders belonging to another account return `404`. Read-only. Requires a secret key.",
         "parameters": [
           {
-            "$ref": "#/components/parameters/V2FulfilmentOrderId"
+            "$ref": "#/components/parameters/V2FulfillmentOrderId"
           }
         ],
         "responses": {
           "200": {
-            "$ref": "#/components/responses/V2FulfilmentOrder"
+            "$ref": "#/components/responses/V2FulfillmentOrder"
           },
           "403": {
             "$ref": "#/components/responses/V2PermissionDenied"
@@ -3222,7 +3222,7 @@
         "properties": {
           "option": {
             "type": "integer",
-            "description": "Id of one of the account's active shipping options."
+            "description": "Id of one of the account's active shipping options. An option with a rate table is priced for the delivery address's zip code (the request's `delivery_address`, else the customer's address) and the weight of the goods; when the table has no rate for that delivery the request fails with `400`, `shipping` describing why and `shipping_code` `shipping_not_available`."
           },
           "location_id": {
             "type": "string",
@@ -3281,6 +3281,14 @@
           "currency": {
             "type": "string"
           },
+          "zone_name": {
+            "type": "string",
+            "description": "The shipping zone that priced the selection, or an empty string when the option is flat-priced or the rate applied to every zip code."
+          },
+          "weight_band": {
+            "type": "string",
+            "description": "The weight band that priced the selection as `min-max` in grams (`max` empty for an open-ended band), or an empty string for a flat-priced option."
+          },
           "location_id": {
             "type": "string"
           },
@@ -3298,7 +3306,7 @@
       "V2PickupLocation": {
         "type": "object",
         "nullable": true,
-        "description": "The chosen pickup location as a structured block an external fulfilment system can book against, or null when the selection has none (home delivery, freight, store pickup without an address). Derived from the shipping provider's own payload, with the flat `location_*` values as the fallback.",
+        "description": "The chosen pickup location as a structured block an external fulfillment system can book against, or null when the selection has none (home delivery, freight, store pickup without an address). Derived from the shipping provider's own payload, with the flat `location_*` values as the fallback.",
         "properties": {
           "id": {
             "type": "string",
@@ -4782,7 +4790,7 @@
           }
         }
       },
-      "V2FulfilmentAddress": {
+      "V2FulfillmentAddress": {
         "type": "object",
         "nullable": true,
         "description": "The delivery address as it stood when the order was created. This is the order's own snapshot, so editing the contract's address afterwards does not change it.",
@@ -4822,7 +4830,7 @@
           }
         }
       },
-      "V2FulfilmentOrderLine": {
+      "V2FulfillmentOrderLine": {
         "type": "object",
         "properties": {
           "id": {
@@ -4850,7 +4858,7 @@
           }
         }
       },
-      "V2Fulfilment": {
+      "V2Fulfillment": {
         "type": "object",
         "description": "A shipment booked for (part of) an order.",
         "properties": {
@@ -4910,9 +4918,9 @@
           }
         }
       },
-      "V2FulfilmentOrder": {
+      "V2FulfillmentOrder": {
         "type": "object",
-        "description": "A physical order generated by a paid billing run. This is also the body of the `fulfilment_order.*` webhooks.",
+        "description": "A physical order generated by a paid billing run. This is also the body of the `fulfillment_order.*` webhooks.",
         "properties": {
           "id": {
             "type": "integer"
@@ -4951,7 +4959,7 @@
             "nullable": true
           },
           "delivery_address": {
-            "$ref": "#/components/schemas/V2FulfilmentAddress"
+            "$ref": "#/components/schemas/V2FulfillmentAddress"
           },
           "shipping_selection": {
             "$ref": "#/components/schemas/V2ShippingSelection"
@@ -4959,14 +4967,14 @@
           "lines": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/V2FulfilmentOrderLine"
+              "$ref": "#/components/schemas/V2FulfillmentOrderLine"
             }
           },
-          "fulfilments": {
+          "fulfillments": {
             "type": "array",
             "description": "Shipments booked for this order. Empty until one is booked, and always empty for an account with no shipping providers configured.",
             "items": {
-              "$ref": "#/components/schemas/V2Fulfilment"
+              "$ref": "#/components/schemas/V2Fulfillment"
             }
           },
           "estimated_weight_grams": {
@@ -5513,10 +5521,10 @@
           "type": "integer"
         }
       },
-      "V2FulfilmentOrderId": {
-        "name": "fulfilmentOrderId",
+      "V2FulfillmentOrderId": {
+        "name": "fulfillmentOrderId",
         "in": "path",
-        "description": "Fulfilment order id. This is the order's `id`, not its per-account `number`.",
+        "description": "Fulfillment order id. This is the order's `id`, not its per-account `number`.",
         "required": true,
         "style": "simple",
         "explode": false,
@@ -5901,18 +5909,18 @@
           }
         }
       },
-      "V2FulfilmentOrder": {
-        "description": "V2 fulfilment order",
+      "V2FulfillmentOrder": {
+        "description": "V2 fulfillment order",
         "content": {
           "application/json": {
             "schema": {
-              "$ref": "#/components/schemas/V2FulfilmentOrder"
+              "$ref": "#/components/schemas/V2FulfillmentOrder"
             }
           }
         }
       },
-      "V2FulfilmentOrderList": {
-        "description": "V2 fulfilment order list",
+      "V2FulfillmentOrderList": {
+        "description": "V2 fulfillment order list",
         "content": {
           "application/json": {
             "schema": {
@@ -5920,7 +5928,7 @@
                 {
                   "type": "array",
                   "items": {
-                    "$ref": "#/components/schemas/V2FulfilmentOrder"
+                    "$ref": "#/components/schemas/V2FulfillmentOrder"
                   }
                 },
                 {
@@ -5940,7 +5948,7 @@
                     "results": {
                       "type": "array",
                       "items": {
-                        "$ref": "#/components/schemas/V2FulfilmentOrder"
+                        "$ref": "#/components/schemas/V2FulfillmentOrder"
                       }
                     }
                   }

package/src/client/paths.ts

@@ -1,29 +1,6 @@
-/**
- * Askell OpenAPI uses British "fulfilment"; agents (and Shopify/Stripe training)
- * type American "fulfillment". Fold to the British form Askell actually serves.
- */
-export function foldFulfilmentSpelling(text: string): string {
-  return text.replace(/fulfillment/gi, (match) => {
-    const first = match[0];
-    if (match === match.toUpperCase()) {
-      return 'FULFILMENT';
-    }
-    if (first !== undefined && first === first.toUpperCase()) {
-      return 'Fulfilment';
-    }
-    return 'fulfilment';
-  });
-}
-
-/** Lowercased text with American/British fulfilment spelling folded together. */
-export function canonicalSearchText(text: string): string {
-  return foldFulfilmentSpelling(text).toLowerCase();
-}
-
 /** Normalize Askell API paths: leading slash + trailing slash (OpenAPI convention). */
 export function normalizeApiPath(path: string): string {
-  let normalized = foldFulfilmentSpelling(path);
-  normalized = normalized.startsWith('/') ? normalized : `/${normalized}`;
+  let normalized = path.startsWith('/') ? path : `/${path}`;
 
   if (normalized !== '/' && !normalized.endsWith('/')) {
     normalized += '/';

package/src/openapi/registry.ts

@@ -1,10 +1,6 @@
 import v1Spec from '../../spec/openapi-v1.json';
 import v2Spec from '../../spec/openapi-v2.json';
 
-import {
-  canonicalSearchText,
-  foldFulfilmentSpelling,
-} from '../client/paths.ts';
 import type {
   ApiKeyKind,
   ApiOperation,
@@ -188,10 +184,7 @@ export class OperationRegistry {
   }
 
   getById(id: string): ApiOperation | undefined {
-    const folded = foldFulfilmentSpelling(id);
-    return this.operations.find(
-      (operation) => operation.id === id || operation.id === folded,
-    );
+    return this.operations.find((operation) => operation.id === id);
   }
 
   find(filters: {
@@ -213,13 +206,7 @@ export class OperationRegistry {
         return false;
       }
 
-      const tagFilter = filters.tag;
-      if (
-        tagFilter &&
-        !operation.tags.some(
-          (tag) => canonicalSearchText(tag) === canonicalSearchText(tagFilter),
-        )
-      ) {
+      if (filters.tag && !operation.tags.includes(filters.tag)) {
         return false;
       }
 
@@ -229,9 +216,7 @@ export class OperationRegistry {
 
       if (
         filters.pathPrefix &&
-        !canonicalSearchText(operation.path).startsWith(
-          canonicalSearchText(filters.pathPrefix),
-        )
+        !operation.path.startsWith(filters.pathPrefix)
       ) {
         return false;
       }
@@ -241,18 +226,17 @@ export class OperationRegistry {
       }
 
       if (search) {
-        const needle = canonicalSearchText(search);
-        const haystack = canonicalSearchText(
-          [
-            operation.id,
-            operation.path,
-            operation.summary,
-            operation.description ?? '',
-            operation.tags.join(' '),
-          ].join(' '),
-        );
-
-        if (!haystack.includes(needle)) {
+        const haystack = [
+          operation.id,
+          operation.path,
+          operation.summary,
+          operation.description ?? '',
+          operation.tags.join(' '),
+        ]
+          .join(' ')
+          .toLowerCase();
+
+        if (!haystack.includes(search)) {
           return false;
         }
       }

package/src/resources/register.ts

@@ -9,7 +9,7 @@ Askell POSTs signed JSON to each URL you register. Verify \`Hook-HMAC\` before p
 Headers:
 - Hook-HMAC: base64 HMAC-SHA512 of the **raw body** (secret = \`hmac_secret\` from webhook create)
 - Hook-Event: event type (\`subscription.renewed\`, \`payment.changed\`, or a family wildcard \`subscription.*\`)
-- Hook-API-Version: \`v1\` for plan/subscription/customer/payment/checkout, \`v2\` for subscription_contract / billing_run / fulfilment_order
+- Hook-API-Version: \`v1\` for plan/subscription/customer/payment/checkout, \`v2\` for subscription_contract / billing_run / fulfillment_order
 
 ## Body shape
 
@@ -17,7 +17,7 @@ JSON body **is the event object**. It is **not** \`{ event, data }\`.
 
 Upstream swagger used to document a dummy \`POST /your-webhook-url/\` with \`SubscriptionMultiLite\` (\`{ customer, subscriptions[] }\`). \`sync-specs\` strips that path.
 
-Most inbound payloads are still undocumented in OpenAPI — this resource is the overlay. Exception: \`fulfilment_order.*\` is \`V2FulfilmentOrder\` (same body as \`GET /v2/fulfilment-orders/\` / \`GET /v2/fulfilment-orders/{id}/\`). Live webhook docs omit this family; bundled spec is right. Spelling is British \`fulfilment_order.*\`, not American \`fulfillment_order.*\`. Specific verbs beyond the wildcard are not listed — do not invent \`created\`/\`shipped\`/….
+Most inbound families are still undocumented in OpenAPI — this resource is the overlay. Exception: \`fulfillment_order.*\` body **is** \`V2FulfillmentOrder\` (same as \`GET /v2/fulfillment-orders/{id}/\`). Live https://docs.askell.is/en/api/webhooks.html does not list this family yet.
 
 Rare historical payloads used \`{ event, data, ref?, sender? }\`. If both \`event\` and \`data\` are objects, use \`data\`.
 
@@ -62,10 +62,12 @@ V2 migration: \`subscription.*\` is **not** aliased onto the new contract (paylo
 ### checkout.* (v1)
 \`created\`, \`changed\` — \`token\`, \`checkout_url\`, \`status\`.
 
-### fulfilment_order.* (v2)
-Family wildcard only in OpenAPI (\`fulfilment_order.*\`). Not American \`fulfillment_order.*\`. Live docs omit this family.
+### fulfillment_order.* (v2)
+Family wildcard \`fulfillment_order.*\`. Concrete event names beyond the family are not listed in swagger or live webhook docs — do not invent \`created\`/\`changed\`.
 
-Body is \`V2FulfilmentOrder\`: \`id\` (path param; not per-account \`number\`), \`number\`, \`status\` (\`open\` | \`partially_fulfilled\` | \`fulfilled\` | \`cancelled\`), \`contract_id\`, \`billing_run_id\` (successful run that generated the order; at most one order per run), \`customer_id\`, \`customer_reference\`, \`customer_name\`, \`customer_email\`, \`delivery_address\` (snapshot; later contract address edits do not change it), \`shipping_selection\` (includes structured \`location\` plus flat \`location_*\` fallback), \`lines[]\` (\`product_id\`, \`product_reference\` SKU, \`product_name\`, \`quantity\`, \`quantity_fulfilled\`), \`fulfilments[]\` (booked shipments; empty until booked / if no shipping provider), \`estimated_weight_grams\` (null if any line lacks weight — never a partial total), \`metadata\`, \`created_at\`, \`updated_at\`.
+Body = \`V2FulfillmentOrder\` = \`GET /v2/fulfillment-orders/{fulfillmentOrderId}/\` (list items are the same object). Physical order from a paid billing run (\`billing_run_id\`; at most one order per run). \`delivery_address\` is a snapshot (later contract address edits do not change it). \`shipping_selection\` is the checkout snapshot. \`fulfillments[]\` are booked shipments (empty until booked / if no shipping providers). Status: \`open\` | \`partially_fulfilled\` | \`fulfilled\` | \`cancelled\`.
+
+Register \`fulfillment_order.*\` on \`POST /webhooks/\`. REST backfill: \`GET /v2/fulfillment-orders/?updated_since=\` (secret; newest first; \`403\` if the account has no subscription contracts or shipping is disabled). Read-only — no mark-shipped mutate.
 `;
 
 export function registerResources(server: McpServer): void {

package/src/server.ts

@@ -37,7 +37,7 @@ Workflow:
 
 API models:
 - v1 (legacy): PlanVariant + Subscription at paths like /subscriptions/, /customers/. Still supported for existing integrations.
-- v2 (current): Catalog, bundles, quotes, checkouts, subscription contracts, billing runs under /v2/. Prefer v2 for new integrations.
+- v2 (current): Catalog, bundles, quotes, checkouts, subscription contracts, billing runs, fulfillment orders under /v2/. Prefer v2 for new integrations.
 - Prose docs at https://docs.askell.is/api/ may describe flows (embedded checkout, 3D Secure, wallet passes) not fully listed in OpenAPI.
 
 API layout:
@@ -47,13 +47,6 @@ API layout:
 - V2 list endpoints paginate only when page_size is provided (default 10, max 1000).
 - GET /v2/customer-entitlements/ requires customer_reference query param.
 
-V2 fulfilment (British spelling on the wire — not American fulfillment):
-- Read-only GET /v2/fulfilment-orders/ and GET /v2/fulfilment-orders/{fulfilmentOrderId}/. No POST/PATCH in OpenAPI. Path param is the order's id, not per-account number.
-- List 403 = account does not use V2 contracts or shipping is disabled (not a bad API key). GET 404 = missing or other-account.
-- Reconciliation: poll list with updated_since = updated_at of the last order you processed. Filter by contract, customer, customer_reference, status.
-- Webhook family fulfilment_order.* (not fulfillment_order.*). Body is V2FulfilmentOrder, same as GET. Live webhook docs omit this family; bundled spec is right. Do not invent event verbs beyond the wildcard until Askell lists them.
-- Quote and checkout shipping_fee is already in totals; do not add it again (askell_describe_operation omits response schemas). shipping_selection.location is the structured pickup block; flat location_* are fallback.
-
 V2 discounts — two systems, not v1 Subscription.discount (0-100 on a PlanVariant; never send that to v2):
 - Coupons: one active per contract. GET /v2/subscription-contracts/{id}/discount/ (also nested as contract.discount). Apply with POST .../apply-code/ {promotion_code}. Remove with POST .../remove-discount/.
 - Quotes (POST /v2/subscription-offer-quotes/): pass promotion_code for coupons. When quoting an existing customer, pass customer (numeric id) or combo discounts from their other active contracts and promo-code customer restrictions are skipped. First-period subtotal/tax/total already include coupon + combo. quote.recurring_* include combo, not the coupon — renewal-with-coupon is discount.recurring_final_amount, and only while duration still applies (once → after first payment use recurring_*). combo_discounts[] and discount.recurring_* are on the quote response (askell_describe_operation omits response schemas). Combo is automatic, not apply-code.
@@ -62,10 +55,13 @@ V2 checkout notes:
 - checkout_url on V2 checkouts points to the API object URL, not a hosted payment page.
 - GET contract.subscriber_page is the customer-facing subscription management URL (readOnly, nullable). Not checkout_url, not v1 /public/payments/{id}/ (hosted signup). Do not send it on create/patch.
 - finalize: a recurring offer needs a verified payment method even when due-now/total is 0 (trial or fully discounted first period). Only a free one-time purchase finalizes without one. Live docs still say "unless 0 ISK" — ignore that; bundled OpenAPI is right.
-- Hosted POST /v2/checkouts/: shipping {option, location_id?} is required when the offer has physical products and the account has active shipping options. No shipping-options list in OpenAPI (ids are account config). Pickup options need location_id. Snapshot is contract.shipping_selection, not on V2Checkout.
+- Hosted POST /v2/checkouts/: shipping {option, location_id?} is required when the offer has physical products and the account has active shipping options. No shipping-options list in OpenAPI (ids are account config). Pickup options need location_id. Snapshot is contract.shipping_selection (plus location / zone_name / weight_band), not on V2Checkout. Rate-table option with no zip/weight rate: 400, shipping_code shipping_not_available. Quote/checkout totals already include shipping_fee when present.
 - Hosted iframe (not askell.js): POST /v2/checkouts/ and POST .../payment-method-registrations/ take allowed_origin (one origin, no path; http only localhost/loopback). Replaces account-level frame-ancestors; GET empty string = account-level. Rejected on /v2/checkout-sessions/ (sales-channel allowed_origins[]).
 - Embedded checkout uses POST /v2/checkout-sessions/ plus browser session-token sub-paths (widget collects address/shipping; see docs, not all in OpenAPI).
 
+V2 fulfillment (warehouse, read-only):
+- GET /v2/fulfillment-orders/ and GET /v2/fulfillment-orders/{id}/. Same body as fulfillment_order.* webhooks (V2FulfillmentOrder). Secret key. 403 if the account has no subscription contracts or shipping is disabled. Poll updated_since after a missed webhook (newest first). No POST/PATCH — cannot mark shipped via the API.
+
 Auth:
 - Most endpoints need the secret API key.
 - Only temporary payment method and checkout status endpoints use the public key.
@@ -78,7 +74,7 @@ Safety:
 
 Resources:
 - askell://spec/v1 and askell://spec/v2 — bundled OpenAPI
-- askell://docs/webhook-events — inbound webhook payloads (most not in OpenAPI; fulfilment_order.* is V2FulfilmentOrder), HMAC-SHA512, /webhooks/ hmac_secret`;
+- askell://docs/webhook-events — inbound webhook payloads (most families not in OpenAPI; fulfillment_order.* is V2FulfillmentOrder), HMAC-SHA512, /webhooks/ hmac_secret`;
 }
 
 export function createServer(config: AppConfig): McpServer {

package/src/tools/analysis.ts

@@ -141,7 +141,7 @@ export function registerAnalysisTools(
     {
       title: 'Subscription contract overview (v2)',
       description:
-        'Fetch a v2 subscription contract and recent billing runs filtered by contract id. The contract payload includes `discount` (active coupon) when one is applied, `shipping_selection` when shipping was chosen at checkout, and `subscriber_page` (customer-facing management URL, read-only). Physical shipping: GET /v2/fulfilment-orders/?contract= (read-only; 403 if shipping is disabled — do not treat as a bad API key).',
+        'Fetch a v2 subscription contract and recent billing runs filtered by contract id. The contract payload includes `discount` (active coupon) when one is applied, `shipping_selection` when shipping was chosen at checkout, and `subscriber_page` (customer-facing management URL, read-only).',
       inputSchema: z.object({
         contractId: z
           .union([z.string().min(1), z.int()])

package/src/tools/discovery.ts

@@ -21,7 +21,7 @@ const listInputSchema = z.object({
     .string()
     .optional()
     .describe(
-      'Case-insensitive search in id, path, summary, description, tags. American "fulfillment" matches British "fulfilment" (Askell paths use the latter).',
+      'Case-insensitive search in id, path, summary, description, tags',
     ),
   apiKeyKind: z
     .enum(['secret', 'public'])