migros-mcp 0.2.0 → 0.3.0

package/dist/auth/oauth.d.ts

@@ -0,0 +1,20 @@
+import type { AxiosInstance } from "axios";
+import type { Session } from "./cookies.js";
+export declare function client(): AxiosInstance;
+export declare function uaFor(host: string): string;
+export declare function uniformHeaders(host: string, session: Session, extra?: Record<string, string>): Record<string, string>;
+/**
+ * Run the silent OAuth flow against current SSO cookies and return a fresh
+ * access token. Mutates `session` in place (cookies + jwt + jwtExp).
+ *
+ * Throws if the SSO cookies are missing/expired (e.g., user logged out of
+ * migros.ch in their browser, or session.json is stale by weeks).
+ *
+ * Caller is responsible for persisting the session afterward.
+ */
+export declare function silentOAuth(session: Session): Promise<string>;
+/**
+ * Returns a usable JWT, refreshing via silent OAuth if the cached one is
+ * within `bufferSeconds` of expiring (or missing). Mutates `session`.
+ */
+export declare function getJwt(session: Session, bufferSeconds?: number): Promise<string>;

package/dist/auth/oauth.js

@@ -0,0 +1,116 @@
+import https from "node:https";
+import axios from "axios";
+import { cookieHeader, ingestSetCookie } from "./cookies.js";
+// IMPORTANT: per-host User-Agent. Akamai on www.migros.ch rejects Chrome but
+// accepts this Firefox/Linux UA (same approach as migros-api-wrapper). The login
+// origin uses Cloudflare which is more permissive and accepts Chrome.
+const UA_LOGIN = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
+const UA_WWW = "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0";
+const REDIRECT_URI = "https://www.migros.ch/m-login-silent-login-redirect.html";
+let _client = null;
+export function client() {
+    // Lazily build to avoid creating an https.Agent at module-load time.
+    if (_client)
+        return _client;
+    _client = axios.create({
+        httpsAgent: new https.Agent({ minVersion: "TLSv1.3" }),
+        validateStatus: () => true,
+        maxRedirects: 0,
+    });
+    return _client;
+}
+export function uaFor(host) {
+    return host === "www.migros.ch" ? UA_WWW : UA_LOGIN;
+}
+export function uniformHeaders(host, session, extra = {}) {
+    return {
+        "User-Agent": uaFor(host),
+        "Accept-Language": "en-US,en;q=0.9",
+        "Accept-Encoding": "gzip, deflate, br",
+        Cookie: cookieHeader(session, host),
+        ...extra,
+    };
+}
+function decodeJwtExp(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length !== 3)
+        throw new Error("malformed JWT");
+    const payload = JSON.parse(Buffer.from(parts[1], "base64").toString());
+    if (typeof payload.exp !== "number")
+        throw new Error("JWT has no exp claim");
+    return payload.exp;
+}
+/**
+ * Run the silent OAuth flow against current SSO cookies and return a fresh
+ * access token. Mutates `session` in place (cookies + jwt + jwtExp).
+ *
+ * Throws if the SSO cookies are missing/expired (e.g., user logged out of
+ * migros.ch in their browser, or session.json is stale by weeks).
+ *
+ * Caller is responsible for persisting the session afterward.
+ */
+export async function silentOAuth(session) {
+    // Step 1: ask www.migros.ch for the silent-SSO URL on login.migros.ch.
+    const authorizeUrl = "https://www.migros.ch/authentication/public/v1/api/oauth/authorize" +
+        "?redirectUri=" + encodeURIComponent(REDIRECT_URI) +
+        "&withLoginPrompt=false&claimType=LOGIN&authorizationNotRequired=true";
+    let r = await client().get(authorizeUrl, {
+        headers: uniformHeaders("www.migros.ch", session, { Accept: "application/json, text/plain, */*" }),
+    });
+    ingestSetCookie(session, "www.migros.ch", r.headers["set-cookie"]);
+    if (r.status !== 200)
+        throw new Error(`oauth/authorize -> ${r.status}`);
+    const data = typeof r.data === "string" ? JSON.parse(r.data) : r.data;
+    const ssoUrl = data?.url;
+    if (!ssoUrl)
+        throw new Error("oauth/authorize did not return a sso url");
+    // Step 2: hit login.migros.ch with our SSO cookies. With prompt=none, valid
+    // cookies redirect with ?code=...&state=...; expired cookies return an error.
+    r = await client().get(ssoUrl, {
+        headers: uniformHeaders("login.migros.ch", session, { Accept: "text/html" }),
+    });
+    ingestSetCookie(session, "login.migros.ch", r.headers["set-cookie"]);
+    const location = r.headers.location;
+    if (!location) {
+        throw new Error("silent SSO did not redirect — login.migros.ch session likely expired");
+    }
+    const u = new URL(location);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code || !state)
+        throw new Error("silent SSO redirected without code/state");
+    // Step 3: exchange the code for a JWT.
+    const successUrl = "https://www.migros.ch/authentication/public/v1/api/oauth/login-success" +
+        `?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}` +
+        "&redirectUri=" + encodeURIComponent(REDIRECT_URI) +
+        "&authorizationNotRequired=true";
+    r = await client().get(successUrl, {
+        headers: uniformHeaders("www.migros.ch", session, { Accept: "application/json" }),
+    });
+    ingestSetCookie(session, "www.migros.ch", r.headers["set-cookie"]);
+    if (r.status !== 200)
+        throw new Error(`oauth/login-success -> ${r.status}`);
+    const tokenBody = (typeof r.data === "string" ? JSON.parse(r.data) : r.data);
+    let token = (tokenBody.accessToken ?? tokenBody.access_token ?? tokenBody.token ?? null);
+    if (!token)
+        throw new Error("oauth/login-success did not return a token");
+    // Migros returns the token with a literal "Bearer " prefix in the JSON body.
+    // Strip so callers can safely set `Authorization: Bearer ${token}`.
+    if (/^bearer\s+/i.test(token))
+        token = token.replace(/^bearer\s+/i, "");
+    session.jwt = token;
+    session.jwtExp = decodeJwtExp(token);
+    return token;
+}
+/**
+ * Returns a usable JWT, refreshing via silent OAuth if the cached one is
+ * within `bufferSeconds` of expiring (or missing). Mutates `session`.
+ */
+export async function getJwt(session, bufferSeconds = 60) {
+    const now = Math.floor(Date.now() / 1000);
+    if (session.jwt && session.jwtExp && session.jwtExp - now > bufferSeconds) {
+        return session.jwt;
+    }
+    return silentOAuth(session);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE7D,6EAA6E;AAC7E,iFAAiF;AACjF,sEAAsE;AACtE,MAAM,QAAQ,GAAG,uHAAuH,CAAC;AACzI,MAAM,MAAM,GAAG,wEAAwE,CAAC;AAExF,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF,IAAI,OAAO,GAAyB,IAAI,CAAC;AACzC,MAAM,UAAU,MAAM;IACpB,qEAAqE;IACrE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QACrB,UAAU,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACtD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;QAC1B,YAAY,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAgB,EAAE,QAAgC,EAAE;IAC/F,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC;QACzB,iBAAiB,EAAE,gBAAgB;QACnC,iBAAiB,EAAE,mBAAmB;QACtC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC;QACnC,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAqB,CAAC;IAC3F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,uEAAuE;IACvE,MAAM,YAAY,GAChB,oEAAoE;QACpE,eAAe,GAAG,kBAAkB,CAAC,YAAY,CAAC;QAClD,sEAAsE,CAAC;IACzE,IAAI,CAAC,GAAkB,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE;QACtD,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;KACnG,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,MAAM,GAAuB,IAAI,EAAE,GAAG,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEzE,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAuB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEjF,uCAAuC;IACvC,MAAM,UAAU,GACd,wEAAwE;QACxE,SAAS,kBAAkB,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtE,eAAe,GAAG,kBAAkB,CAAC,YAAY,CAAC;QAClD,gCAAgC,CAAC;IACnC,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE;QACjC,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;KAClF,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAA4B,CAAC;IACxG,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,CAAkB,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAE1E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC;IACpB,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,aAAa,GAAG,EAAE;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,11 @@
+/**
+ * OS-appropriate user config directory for this MCP.
+ * Created lazily by callers; this function does not touch the filesystem.
+ *
+ * - macOS:   ~/Library/Application Support/migros-mcp
+ * - Linux:   $XDG_CONFIG_HOME/migros-mcp  (or ~/.config/migros-mcp)
+ * - Windows: %APPDATA%/migros-mcp
+ */
+export declare function configDir(): string;
+/** Path to the persisted session (cookies + cached JWT). */
+export declare function sessionFile(): string;

package/dist/auth/paths.js

@@ -0,0 +1,26 @@
+import os from "node:os";
+import path from "node:path";
+const APP = "migros-mcp";
+/**
+ * OS-appropriate user config directory for this MCP.
+ * Created lazily by callers; this function does not touch the filesystem.
+ *
+ * - macOS:   ~/Library/Application Support/migros-mcp
+ * - Linux:   $XDG_CONFIG_HOME/migros-mcp  (or ~/.config/migros-mcp)
+ * - Windows: %APPDATA%/migros-mcp
+ */
+export function configDir() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Application Support", APP);
+    }
+    if (process.platform === "win32") {
+        return path.join(process.env.APPDATA ?? home, APP);
+    }
+    return path.join(process.env.XDG_CONFIG_HOME ?? path.join(home, ".config"), APP);
+}
+/** Path to the persisted session (cookies + cached JWT). */
+export function sessionFile() {
+    return path.join(configDir(), "session.json");
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC"}

package/dist/auth-tools/_shared.d.ts

@@ -0,0 +1,6 @@
+import type { Credentials } from "../auth/index.js";
+/**
+ * Read credentials from env. Returns undefined if not all vars are set, in
+ * which case the auth layer falls back to a cached session if one exists.
+ */
+export declare function credsFromEnv(): Credentials | undefined;

package/dist/auth-tools/_shared.js

@@ -0,0 +1,12 @@
+/**
+ * Read credentials from env. Returns undefined if not all vars are set, in
+ * which case the auth layer falls back to a cached session if one exists.
+ */
+export function credsFromEnv() {
+    const email = process.env.MIGROS_EMAIL;
+    const password = process.env.MIGROS_PASSWORD;
+    if (!email || !password)
+        return undefined;
+    return { email, password, totpSecret: process.env.MIGROS_TOTP_SECRET };
+}
+//# sourceMappingURL=_shared.js.map

package/dist/auth-tools/_shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../src/auth-tools/_shared.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;AACzE,CAAC"}

package/dist/auth-tools/account.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Fetch the logged-in customer's profile. Returns formatted JSON for the LLM.
+ */
+export declare function getProfile(): Promise<string>;
+/**
+ * Fetch the user's saved addresses (delivery + billing). Filtered server-side
+ * by the deliveryOnly/billingOnly flags; we ask for both by default.
+ */
+export declare function getAddresses(): Promise<string>;

package/dist/auth-tools/account.js

@@ -0,0 +1,35 @@
+import { api } from "../auth/api.js";
+import { credsFromEnv } from "./_shared.js";
+/**
+ * Fetch the logged-in customer's profile. Returns formatted JSON for the LLM.
+ */
+export async function getProfile() {
+    const profile = (await api("GET", "/retentionapi/public/web/v1/customers/profile", undefined, { creds: credsFromEnv() }));
+    return JSON.stringify({
+        userId: profile.userId,
+        title: profile.title,
+        firstName: profile.firstName,
+        lastName: profile.lastName,
+        email: profile.email,
+        languageCode: profile.languageCode,
+        preferredCooperative: profile.preferredCooperative,
+    }, null, 2);
+}
+/**
+ * Fetch the user's saved addresses (delivery + billing). Filtered server-side
+ * by the deliveryOnly/billingOnly flags; we ask for both by default.
+ */
+export async function getAddresses() {
+    const list = (await api("GET", "/retentionapi/public/web/v1/customers/addresses?deliveryOnly=false&billingOnly=false", undefined, { creds: credsFromEnv() }));
+    return JSON.stringify(list.map((a) => ({
+        uid: a.uid,
+        name: [a.identity?.firstName, a.identity?.lastName].filter(Boolean).join(" "),
+        address: [a.postalAddress?.street, a.postalAddress?.streetNumber].filter(Boolean).join(" "),
+        city: [a.postalAddress?.zipCode, a.postalAddress?.city].filter(Boolean).join(" "),
+        country: a.postalAddress?.country,
+        delivery: !!a.isDelivery,
+        billing: !!a.isBilling,
+        default: !!a.default,
+    })), null, 2);
+}
+//# sourceMappingURL=account.js.map

package/dist/auth-tools/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../src/auth-tools/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkB5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CACxB,KAAK,EACL,+CAA+C,EAC/C,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAA4B,CAAC;IAE9B,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;KACnD,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,sFAAsF,EACtF,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAmB,CAAC;IAErB,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7E,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3F,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjF,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO;QACjC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;KACrB,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/auth-tools/cart.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Fetch the contents of a shopping list (basket). Returns a flat summary of
+ * items + totals. Product names are not returned by this endpoint — call
+ * get_product_details with the returned ids to enrich.
+ */
+export declare function getBasket(args?: {
+    shoppingListId?: number;
+}): Promise<string>;
+/**
+ * Add a product to the basket. Sets the target quantity (default 1). If the
+ * item is already present, the quantity is REPLACED, not incremented — the
+ * underlying API is upsert-to-target. Use update_basket_quantity to set an
+ * explicit total when you want increment-like semantics.
+ */
+export declare function addToBasket(args: {
+    productId: string;
+    quantity?: number;
+    shoppingListId?: number;
+}): Promise<string>;
+/** Set an item's exact target quantity. */
+export declare function updateBasketQuantity(args: {
+    productId: string;
+    quantity: number;
+    shoppingListId?: number;
+}): Promise<string>;
+/** Remove an item entirely (quantity 0). */
+export declare function removeFromBasket(args: {
+    productId: string;
+    shoppingListId?: number;
+}): Promise<string>;
+/**
+ * Returns the URL the user should open in their browser to review the basket
+ * and complete checkout. Order placement requires payment confirmation in a
+ * real browser (Datatrans 3DS / saved-card prompt), so we hand off rather than
+ * try to automate the money step. Includes a basket summary for the LLM.
+ */
+export declare function getCheckoutLink(): Promise<string>;

package/dist/auth-tools/cart.js

@@ -0,0 +1,118 @@
+import { api } from "../auth/api.js";
+import { credsFromEnv } from "./_shared.js";
+/**
+ * Resolve the user's primary shopping list id, calling /lists/overview if not
+ * provided. Most users have a single list named "Shopping list".
+ */
+async function resolveShoppingListId(provided) {
+    if (typeof provided === "number")
+        return provided;
+    const lists = (await api("GET", "/shopping-list/public/v1/lists/overview", undefined, { creds: credsFromEnv() }));
+    if (!lists?.length)
+        throw new Error("no shopping lists found for this account");
+    return lists[0].shoppingListId;
+}
+/**
+ * Format a basket response into the same flat shape get_basket returns.
+ * Used by both reads and writes since the v3/items endpoint returns the
+ * full updated basket on each call.
+ */
+function formatBasket(data) {
+    const items = (data.categories ?? []).flatMap((c) => (c.items ?? []).map((i) => ({
+        productId: i.id,
+        type: i.type,
+        quantity: i.quantity,
+        availability: i.ecomProductAvailability,
+        categoryId: c.id,
+    })));
+    return JSON.stringify({
+        shoppingListId: data.shoppingListId,
+        name: data.name,
+        itemCount: items.length,
+        totals: {
+            instore: data.totals?.instoreTotal,
+            online: data.totals?.onlineTotal?.estimatedTotal,
+            freeDelivery: data.totals?.onlineTotal?.freeDelivery,
+            firstOrder: data.totals?.onlineTotal?.firstOrder,
+            minimumOrderValueReached: data.totals?.onlineTotal?.minimumOrderValueReached,
+        },
+        items,
+        hint: items.length > 0
+            ? "Use get_product_details with productId to fetch each item's name, price, and other info."
+            : "Basket is empty.",
+    }, null, 2);
+}
+/**
+ * Fetch the contents of a shopping list (basket). Returns a flat summary of
+ * items + totals. Product names are not returned by this endpoint — call
+ * get_product_details with the returned ids to enrich.
+ */
+export async function getBasket(args = {}) {
+    const shoppingListId = await resolveShoppingListId(args.shoppingListId);
+    const data = (await api("GET", `/shopping-list/public/v2/list/details?shoppingListId=${shoppingListId}`, undefined, { creds: credsFromEnv() }));
+    return formatBasket(data);
+}
+/**
+ * Set an item's quantity in the basket. The Migros endpoint is upsert-with-
+ * target-quantity semantics: quantity=0 removes, quantity=N replaces (not
+ * increments). Used by add/update/remove tools below.
+ */
+async function setItemQuantity(productId, quantity, shoppingListId) {
+    const listId = await resolveShoppingListId(shoppingListId);
+    const data = (await api("PUT", "/shopping-list/public/v3/items", {
+        shoppingListId: listId,
+        items: [{ id: productId, quantity, type: "PRODUCT" }],
+    }, { creds: credsFromEnv() }));
+    return formatBasket(data);
+}
+/**
+ * Add a product to the basket. Sets the target quantity (default 1). If the
+ * item is already present, the quantity is REPLACED, not incremented — the
+ * underlying API is upsert-to-target. Use update_basket_quantity to set an
+ * explicit total when you want increment-like semantics.
+ */
+export async function addToBasket(args) {
+    const qty = args.quantity ?? 1;
+    if (qty < 1)
+        throw new Error("quantity must be >= 1 for add_to_basket; use remove_from_basket to delete");
+    return setItemQuantity(args.productId, qty, args.shoppingListId);
+}
+/** Set an item's exact target quantity. */
+export async function updateBasketQuantity(args) {
+    if (args.quantity < 0)
+        throw new Error("quantity must be >= 0");
+    return setItemQuantity(args.productId, args.quantity, args.shoppingListId);
+}
+/** Remove an item entirely (quantity 0). */
+export async function removeFromBasket(args) {
+    return setItemQuantity(args.productId, 0, args.shoppingListId);
+}
+/**
+ * Returns the URL the user should open in their browser to review the basket
+ * and complete checkout. Order placement requires payment confirmation in a
+ * real browser (Datatrans 3DS / saved-card prompt), so we hand off rather than
+ * try to automate the money step. Includes a basket summary for the LLM.
+ */
+export async function getCheckoutLink() {
+    const shoppingListId = await resolveShoppingListId();
+    const data = (await api("GET", `/shopping-list/public/v2/list/details?shoppingListId=${shoppingListId}`, undefined, { creds: credsFromEnv() }));
+    const items = (data.categories ?? []).flatMap((c) => c.items ?? []);
+    if (items.length === 0) {
+        return JSON.stringify({ ok: false, message: "Basket is empty. Add items with add_to_basket before checkout." }, null, 2);
+    }
+    const total = data.totals?.onlineTotal?.estimatedTotal;
+    const minOk = data.totals?.onlineTotal?.minimumOrderValueReached ?? true;
+    const freeDelivery = data.totals?.onlineTotal?.freeDelivery;
+    return JSON.stringify({
+        ok: true,
+        itemCount: items.length,
+        onlineTotal: total,
+        freeDelivery,
+        minimumOrderValueReached: minOk,
+        checkoutUrl: "https://www.migros.ch/en?context=ecommerce",
+        message: minOk
+            ? `Open the checkout URL in your browser to confirm address, delivery slot, and payment, then click "Place order".`
+            : `Basket below minimum online order value. Add more items, then re-run get_checkout_link.`,
+    }, null, 2);
+}
+//# sourceMappingURL=cart.js.map

package/dist/auth-tools/cart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cart.js","sourceRoot":"","sources":["../../src/auth-tools/cart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAqC5C;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,QAAiB;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CACtB,KAAK,EACL,yCAAyC,EACzC,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAA0B,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAoB;IACxC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAClD,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,uBAAuB;QACvC,UAAU,EAAE,CAAC,CAAC,EAAE;KACjB,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc;YAChD,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY;YACpD,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU;YAChD,wBAAwB,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,wBAAwB;SAC7E;QACD,KAAK;QACL,IAAI,EACF,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,0FAA0F;YAC5F,CAAC,CAAC,kBAAkB;KACzB,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAoC,EAAE;IACpE,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,wDAAwD,cAAc,EAAE,EACxE,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAmB,CAAC;IACrB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,QAAgB,EAChB,cAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,gCAAgC,EAChC;QACE,cAAc,EAAE,MAAM;QACtB,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACtD,EACD,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAmB,CAAC;IACrB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAIjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC1G,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnE,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAI1C;IACC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChE,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAGtC;IACC,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,cAAc,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,wDAAwD,cAAc,EAAE,EACxE,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAmB,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,SAAS,CACnB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gEAAgE,EAAE,EACxF,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,wBAAwB,IAAI,IAAI,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC;IAC5D,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,WAAW,EAAE,KAAK;QAClB,YAAY;QACZ,wBAAwB,EAAE,KAAK;QAC/B,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,KAAK;YACZ,CAAC,CAAC,iHAAiH;YACnH,CAAC,CAAC,yFAAyF;KAC9F,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/auth-tools/cumulus.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Cumulus card status: points balance, level, cardholder, lifetime savings.
+ * Useful as a "what's my Migros loyalty status" overview.
+ */
+export declare function getCumulusStatus(): Promise<string>;
+/**
+ * List in-store receipts (Kassenbons) over a date range. Default range: last
+ * 30 days. The supermarketOnly flag excludes online order invoices, so this
+ * tool answers "what did I buy at the physical store?".
+ */
+export declare function getInStoreReceipts(args?: {
+    startDate?: string;
+    endDate?: string;
+    limit?: number;
+}): Promise<string>;
+/**
+ * In-store receipt line items live on `account.migros.ch` behind a legacy
+ * CSRF-cookie auth flow that the modern Bearer JWT doesn't access. Rather
+ * than implement a parallel auth path, return the URL where the user can
+ * inspect the receipt in their browser. The list endpoint
+ * (get_in_store_receipts) already gives store, date, total, and points;
+ * line-by-line is rarely the deciding factor for LLM workflows.
+ */
+export declare function getReceiptDetails(args: {
+    receiptId: string | number;
+}): Promise<string>;
+/**
+ * Active Cumulus coupons targeted at the user. Migros personalises these based
+ * on shopping history — they typically expire after a few weeks.
+ */
+export declare function getCumulusCoupons(): Promise<string>;

package/dist/auth-tools/cumulus.js

@@ -0,0 +1,83 @@
+import { api } from "../auth/api.js";
+import { credsFromEnv } from "./_shared.js";
+/**
+ * Cumulus card status: points balance, level, cardholder, lifetime savings.
+ * Useful as a "what's my Migros loyalty status" overview.
+ */
+export async function getCumulusStatus() {
+    const data = (await api("GET", "/retentionapi/public/web/v1/customers/cumulus/details", undefined, { creds: credsFromEnv() }));
+    // The exact field set varies; surface the common ones the LLM will care about.
+    const owner = data.cumulusCardOwner;
+    return JSON.stringify({
+        cumulusId: data.cumulusId,
+        level: data.level ?? data.cumulusLevel,
+        pointsBalance: data.periodToDatePointsBalance ?? data.pointsBalance,
+        lifetimePoints: data.lifetimePoints ?? data.totalPoints,
+        cardholder: owner ? `${owner.firstName ?? ""} ${owner.lastName ?? ""}`.trim() : undefined,
+        cardholderTitle: owner?.title,
+        raw: data, // keep raw for the LLM in case it wants other fields
+    }, null, 2);
+}
+/**
+ * List in-store receipts (Kassenbons) over a date range. Default range: last
+ * 30 days. The supermarketOnly flag excludes online order invoices, so this
+ * tool answers "what did I buy at the physical store?".
+ */
+export async function getInStoreReceipts(args = {}) {
+    const today = new Date().toISOString().slice(0, 10);
+    const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 3600 * 1000).toISOString().slice(0, 10);
+    const startDate = args.startDate ?? thirtyDaysAgo;
+    const endDate = args.endDate ?? today;
+    const limit = args.limit ?? 50;
+    const url = `/retentionapi/public/web/v1/receipts?startDate=${encodeURIComponent(startDate)}` +
+        `&endDate=${encodeURIComponent(endDate)}` +
+        `&supermarketOnly=true&limit=${limit}`;
+    const data = await api("GET", url, undefined, { creds: credsFromEnv() });
+    // Response may be an array or an envelope; normalize.
+    const list = Array.isArray(data) ? data : data.receipts ?? [];
+    return JSON.stringify({
+        startDate,
+        endDate,
+        count: list.length,
+        receipts: list,
+        hint: list.length > 0
+            ? "Use get_receipt_details with a receipt id to inspect line items."
+            : `No in-store receipts in ${startDate} to ${endDate}.`,
+    }, null, 2);
+}
+/**
+ * In-store receipt line items live on `account.migros.ch` behind a legacy
+ * CSRF-cookie auth flow that the modern Bearer JWT doesn't access. Rather
+ * than implement a parallel auth path, return the URL where the user can
+ * inspect the receipt in their browser. The list endpoint
+ * (get_in_store_receipts) already gives store, date, total, and points;
+ * line-by-line is rarely the deciding factor for LLM workflows.
+ */
+export async function getReceiptDetails(args) {
+    const id = String(args.receiptId);
+    return JSON.stringify({
+        receiptId: id,
+        message: "Full line items aren't accessible via the public API used by this MCP. Open the URL below in your browser to view the receipt details directly.",
+        url: `https://account.migros.ch/purchases/receipts`,
+        hint: "The receipt list (get_in_store_receipts) returns store, date, amount, and Cumulus points which is enough for most spending-analysis queries.",
+    }, null, 2);
+}
+/**
+ * Active Cumulus coupons targeted at the user. Migros personalises these based
+ * on shopping history — they typically expire after a few weeks.
+ */
+export async function getCumulusCoupons() {
+    // The SPA calls cumulus-coupons with a deliveryRequestKey when in checkout
+    // context (filters to coupons valid for the active delivery). For a general
+    // "what coupons do I have" view, omit the key — the server returns all.
+    const data = await api("GET", "/retentionapi/public/web/v1/cumulus-coupons", undefined, { creds: credsFromEnv() });
+    const list = Array.isArray(data) ? data : data.coupons ?? [];
+    return JSON.stringify({
+        count: list.length,
+        coupons: list,
+        hint: list.length > 0
+            ? "Each coupon has an id, discount, eligible products / categories, and expiry."
+            : "No active personal coupons.",
+    }, null, 2);
+}
+//# sourceMappingURL=cumulus.js.map

package/dist/auth-tools/cumulus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cumulus.js","sourceRoot":"","sources":["../../src/auth-tools/cumulus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,uDAAuD,EACvD,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAA4B,CAAC;IAE9B,+EAA+E;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAuD,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY;QACtC,aAAa,EAAE,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,aAAa;QACnE,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW;QACvD,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACzF,eAAe,EAAE,KAAK,EAAE,KAAK;QAC7B,GAAG,EAAE,IAAI,EAAE,qDAAqD;KACjE,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAIrC,EAAE;IACJ,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAE/B,MAAM,GAAG,GACP,kDAAkD,kBAAkB,CAAC,SAAS,CAAC,EAAE;QACjF,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACzC,+BAA+B,KAAK,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAEzE,sDAAsD;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAiC,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,SAAS;QACT,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,2BAA2B,SAAS,OAAO,OAAO,GAAG;KAC5D,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,SAAS,EAAE,EAAE;QACb,OAAO,EACL,iJAAiJ;QACnJ,GAAG,EAAE,8CAA8C;QACnD,IAAI,EACF,8IAA8I;KACjJ,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,6CAA6C,EAC7C,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EACF,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,8EAA8E;YAChF,CAAC,CAAC,6BAA6B;KACpC,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/auth-tools/orders.d.ts

@@ -0,0 +1,15 @@
+type OrderStatus = "PENDING" | "DELIVERED" | "CANCELLED" | "ALL";
+/**
+ * Fetch the user's order history, paginated by status.
+ * - status: PENDING (open), DELIVERED, CANCELLED, or ALL. Default: ALL.
+ * - page: 0-based.
+ */
+export declare function getOrders(args?: {
+    status?: OrderStatus;
+    page?: number;
+}): Promise<string>;
+/** Fetch the full details of one order by its id (numeric, e.g. from get_orders). */
+export declare function getOrderDetails(args: {
+    orderId: string | number;
+}): Promise<string>;
+export {};

package/dist/auth-tools/orders.js

@@ -0,0 +1,32 @@
+import { api } from "../auth/api.js";
+import { credsFromEnv } from "./_shared.js";
+/**
+ * Fetch the user's order history, paginated by status.
+ * - status: PENDING (open), DELIVERED, CANCELLED, or ALL. Default: ALL.
+ * - page: 0-based.
+ */
+export async function getOrders(args = {}) {
+    const status = args.status ?? "ALL";
+    const page = args.page ?? 0;
+    const data = (await api("GET", `/ordergateway/public/web/v1/customers/customer-orders?status=${encodeURIComponent(status)}&page=${page}`, undefined, { creds: credsFromEnv() }));
+    // Endpoint may return either an envelope { orders, numberOfOrders, ... } or
+    // a bare array depending on backend version. Normalize.
+    const orders = Array.isArray(data) ? data : (data.orders ?? []);
+    return JSON.stringify({
+        status,
+        page,
+        orderCount: orders.length,
+        totalCount: Array.isArray(data) ? undefined : data.numberOfOrders,
+        totalPages: Array.isArray(data) ? undefined : data.totalPages,
+        orders,
+        hint: orders.length === 0
+            ? `No ${status === "ALL" ? "" : status.toLowerCase() + " "}orders on this page.`
+            : "Use get_order_details with an order id to inspect a specific order.",
+    }, null, 2);
+}
+/** Fetch the full details of one order by its id (numeric, e.g. from get_orders). */
+export async function getOrderDetails(args) {
+    const data = await api("GET", `/ordergateway/public/web/v1/orders/${encodeURIComponent(String(args.orderId))}`, undefined, { creds: credsFromEnv() });
+    return JSON.stringify(data, null, 2);
+}
+//# sourceMappingURL=orders.js.map

package/dist/auth-tools/orders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orders.js","sourceRoot":"","sources":["../../src/auth-tools/orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgD,EAAE;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,gEAAgE,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EACzG,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAA0G,CAAC;IAE5G,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;QACjE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;QAC7D,MAAM;QACN,IAAI,EACF,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,GAAG,sBAAsB;YAChF,CAAC,CAAC,qEAAqE;KAC5E,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAkC;IACtE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,sCAAsC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAChF,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC1B,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/auth-tools.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Barrel re-exports for the authenticated tool surface. The actual code is
+ * split by domain into ./auth-tools/{account,cart,orders,cumulus}.ts to
+ * keep each file focused and easy to scan.
+ */
+export { getProfile, getAddresses } from "./auth-tools/account.js";
+export { getBasket, addToBasket, updateBasketQuantity, removeFromBasket, getCheckoutLink, } from "./auth-tools/cart.js";
+export { getOrders, getOrderDetails } from "./auth-tools/orders.js";
+export { getCumulusStatus, getInStoreReceipts, getReceiptDetails, getCumulusCoupons, } from "./auth-tools/cumulus.js";

package/dist/auth-tools.js

@@ -0,0 +1,10 @@
+/**
+ * Barrel re-exports for the authenticated tool surface. The actual code is
+ * split by domain into ./auth-tools/{account,cart,orders,cumulus}.ts to
+ * keep each file focused and easy to scan.
+ */
+export { getProfile, getAddresses } from "./auth-tools/account.js";
+export { getBasket, addToBasket, updateBasketQuantity, removeFromBasket, getCheckoutLink, } from "./auth-tools/cart.js";
+export { getOrders, getOrderDetails } from "./auth-tools/orders.js";
+export { getCumulusStatus, getInStoreReceipts, getReceiptDetails, getCumulusCoupons, } from "./auth-tools/cumulus.js";
+//# sourceMappingURL=auth-tools.js.map

package/dist/auth-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tools.js","sourceRoot":"","sources":["../src/auth-tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,SAAS,EACT,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC"}