[field123]

Closes #751. Part of #735.

Summary

Six admin SDKs ship a ./mcp export, set up the way catalogs and rule-promotions were.

Package	Tools	Tool list (chars)	Over a quarter of the package
application-keys	5	7,284	update_an_application_key 27.1%
currencies	5	5,834	create_a_currency 34.8%
settings	3	3,386	put_v2_settings 58.6%
merchant-realm-mapping	3	3,322	all three (26.6–44.7%)
permissions	9	11,567	none
personal-data	7	9,349	none

The over-a-quarter flags in the 3- and 5-tool packages come from small tool counts plus one write tool with a full body schema. None of them is the rule-promotions problem of a shared schema written out in full each time it appears.

 specs/config/redocly.yaml
+  <package>-standalone@v1      # root: the package's spec; one override file per operation
 packages/sdks/<package>/
   openapi-ts.config.ts         # input: ../specs/bundled/<package>_standalone.yaml, + mcpTools($, { api })
+  oas:build script, ./mcp export, src/mcp.ts, tests

Each package now generates from a bundle, and types.gen.ts, sdk.gen.ts and zod.gen.ts come out byte-identical. settings needed override/component-merge: off on its bundle. Without it, the global security-scheme merge adds a second bearer scheme and changes sdk.gen.ts.

Risk choices

• personal-data postErasureRequest → update. It's a POST that permanently erases a personal data record, the rest of its data set, and their logs.
• Left as create: CreateAnApplicationKey, createACurrency and CreateACustomAPIRolePolicy. Each adds a new record.
• No POST in these packages only reads.

Titles

• permissions CreateACustomAPIRolePolicy: "Create a Custom API Role Policy" (was "Create A Custom API Role Policy").
• personal-data get-erasure-requests: "List Personal Data Erasure Requests" (was "Get all Personal Data Erasure Request").

Credentials in responses

• application-keys CreateAnApplicationKey returns data.client_secret. The list, get and update operations return client_id only.
• No other tool returns a credential.
• personal-data logs return a delta holding personal data such as names and emails. That isn't a credential, but it's sensitive.

Spec problems found (not fixed here)

• settings put-v2-settings: the request body has no data wrapper, but the response and the 400 example do.
• merchant-realm-mapping: mapping_id is described as "The id of the Application Key".
• personal-data: three operations say their filter is required but declare required: false. get-erasure-request documents its 200 as "Created".
• currencies: the page[limit] and page[offset] parameters are typed string. They type-check here because the zod schemas agree.

Evidence

• Suites: application-keys 42, currencies 37, settings 38, merchant-realm-mapping 38, permissions 47, personal-data 45, all passing with no type errors. Each includes the generation test that regenerates twice and compares with the committed files.

• A second reviewer checked every description against its spec. Five claims the spec didn't support were rewritten.

• Live, read-only (approved store): every tool registered on a real McpServer, and these returned data through a real Client:

  • application_keys_list_application_keys (25), then get_an_application_key
  • currencies_get_all_currencies (3), then get_a_currency
  • settings_get_v2_settings
  • merchant_realm_mapping_get_merchant_realm_mappings
  • permissions_list_standard_user_roles (7), then get_a_standard_user_role, and list_custom_api_role_policies (2)
  • personal_data_get_logs_ttl, personal_data_get_erasure_requests

• Live writes, run by Robert (approved store, through a real Client):

  • currencies:
    • create_a_currency made XTS and get_a_currency read it back.
    • update_a_currency turned it off with enabled: false, a field the update schema doesn't declare, so the tool sent it as an extra body field and the API applied it.
    • delete_a_currency removed it, and a read afterwards returned 404.
  • application-keys:
    • create_an_application_key returned a client_secret.
    • get_an_application_key returned no secret, as the descriptions say.
    • update_an_application_key renamed it, and the new name came back.
    • delete_an_application_key removed it, and a read afterwards returned 404.
  • Nothing was left behind.

• Not run live: personal-data erasure and the settings and merchant-realm-mapping updates, because they change real data or store-wide settings. Unit tests cover their request wiring.

Merge Danger

Door: two-way

Blast Radius: small

New ./mcp subpaths and an optional peer; the main entries don't change. Merge order with #757: whichever lands second needs mcp-support.gen.ts re-copied and the generation tests rerun, because #757 changes that file. I'll do that on this branch if #757 lands first.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

6 Skipped Deployments

Project	Deployment	Actions	Updated
commerce-essentials	Ignored	Preview	Oct 19, 2026 11:33am UTC
composable-frontend-algolia	Ignored		Oct 19, 2026 11:33am UTC
composable-frontend-core	Ignored	Preview	Oct 19, 2026 11:33am UTC
composable-frontend-docs	Ignored	Preview	Oct 19, 2026 11:33am UTC
composable-frontend-simple	Ignored	Preview	Oct 19, 2026 11:33am UTC
composable-frontend-subscriptions	Ignored	Preview	Oct 19, 2026 11:33am UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 7c89160

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@epcc-sdk/sdks-application-keys	Minor
@epcc-sdk/sdks-currencies	Minor
@epcc-sdk/sdks-merchant-realm-mapping	Minor
@epcc-sdk/permissions	Minor
@epcc-sdk/personal-data	Minor
@epcc-sdk/settings	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR