spec.yaml

name: pagliacci
display_name: Pagliacci Pizza
description: |-
  CLI for the Pagliacci Pizza ordering API. Browse stores, menus, and
  available slices; manage your cart, place orders, and track delivery
  windows; manage saved addresses, rewards, stored coupons, credit, and
  gifts. Backed by Pagliacci's Azure-hosted REST API and authenticated
  via Chrome cookies (composed PagliacciAuth header).
version: "3.0.0"
cli_description: "Order Seattle's Pagliacci Pizza from the terminal — half-and-half pies, small-party planner, slice rotation, and rewards stacking."
base_url: https://pag-api.azurewebsites.net/api

auth:
  type: composed
  header: Authorization
  format: "PagliacciAuth {customerId}|{authToken}"
  cookie_domain: pagliacci.com
  cookies:
    - customerId
    - authToken

# Pagliacci endpoints discovered via browser-sniff (with authenticated session)
# and JS bundle extraction from main.BPDM6VAU.js. Auth flag below indicates
# whether cookies are required (true) or the endpoint works anonymously.

resources:
  system:
    description: System information and announcements
    endpoints:
      version:
        method: GET
        path: /Version
        no_auth: true
        description: Get the current API version

      site_wide_message:
        method: GET
        path: /SiteWideMessage
        no_auth: true
        description: Get site-wide announcement banner text (closures, holiday hours, etc.)

  store:
    description: Pagliacci store locations, hours, and quote info
    endpoints:
      list:
        method: GET
        path: /Store
        no_auth: true
        description: List all Pagliacci store locations with addresses, hours, GPS, amenities, and available slices

      get:
        method: GET
        path: /Store/{storeId}
        no_auth: true
        description: Get a single store by its numeric ID

      list_quotes:
        method: GET
        path: /QuoteStore
        no_auth: true
        description: List quote-store metadata (delivery fee, drone status, pickup wait) for all stores

      get_quote:
        method: GET
        path: /QuoteStore/{storeId}
        no_auth: true
        description: Get quote-store metadata (delivery fee, drone status, pickup wait time) for a single store

      compute_quote:
        method: POST
        path: /QuoteStore/{storeId}
        no_auth: true
        description: Compute a quote for a specific store with cart contents (returns Delivery, Drone, Pickup wait values)

  menu:
    description: Menus, slices, and product pricing
    endpoints:
      top:
        method: GET
        path: /MenuTop/{storeId}
        no_auth: true
        description: Get featured top-of-menu items for a store

      cache:
        method: GET
        path: /MenuCache/{storeId}
        no_auth: true
        description: Get the full menu (categories, products, prices, descriptions, images) for a store

      slices:
        method: GET
        path: /MenuSlices
        no_auth: true
        description: Get available slices across all stores for the current day (perishable, rotates daily)

      product_price:
        method: POST
        path: /ProductPrice
        no_auth: true
        description: Calculate the price for a customized product (size, toppings, modifiers)

  scheduling:
    description: Delivery and pickup time windows
    endpoints:
      window_days:
        method: GET
        path: /TimeWindowDays/{storeId}/{serviceType}
        no_auth: true
        description: List available delivery or pickup days for a store. serviceType is DEL (delivery) or PICK (pickup)

      slot_list:
        method: GET
        path: /TimeWindows/{storeId}/{serviceType}
        no_auth: true
        description: List available time-window slots for a store and service type

      slot_list_for_date:
        method: GET
        path: /TimeWindows/{storeId}/{serviceType}/{date}
        no_auth: true
        description: List allowed slot times for a specific delivery/pickup date (YYYYMMDD)

  address:
    description: Address validation and saved address book
    endpoints:
      lookup:
        method: POST
        path: /AddressInfo
        no_auth: true
        description: Validate an address and check delivery zone (returns store ID if deliverable)

      get_info:
        method: GET
        path: /AddressInfo/{id}
        no_auth: true
        description: Get address info by saved ID

      list:
        method: GET
        path: /AddressName
        description: List the authenticated user's saved addresses
        auth: required

      get:
        method: GET
        path: /AddressName/{id}
        description: Get a saved address by ID
        auth: required

      create:
        method: POST
        path: /AddressName
        description: Create a new saved address
        auth: required

      delete:
        method: DELETE
        path: /AddressName/{id}
        description: Delete a saved address
        auth: required

  account:
    description: Authentication and registration (no auth required for these endpoints)
    endpoints:
      login:
        method: POST
        path: /Login
        no_auth: true
        description: Authenticate with email/phone + password. Response sets customerId and authToken cookies.

      logout:
        method: POST
        path: /Logout
        description: Invalidate the current session

      register:
        method: POST
        path: /Register
        no_auth: true
        description: Create a new customer account

      password_forgot:
        method: POST
        path: /PasswordForgot
        no_auth: true
        description: Request a password reset email

      password_reset:
        method: POST
        path: /PasswordReset
        no_auth: true
        description: Reset a password using a token from PasswordForgot email

      confirm_email:
        method: GET
        path: /ConfirmEmail/{token}
        no_auth: true
        description: Confirm a new account by clicking the email-confirmation link's token

      create_token:
        method: POST
        path: /CreateToken
        description: Issue a session token (used internally by the SPA for token refresh)

  customer:
    description: Customer profile and devices
    endpoints:
      get:
        method: GET
        path: /Customer/{customerId}
        description: Get customer profile by ID
        auth: required

      access_devices_list:
        method: GET
        path: /AccessDevice
        description: List devices that have access to this account
        auth: required

      access_devices_delete:
        method: DELETE
        path: /AccessDevice/{deviceId}
        description: Revoke a device's access to the account
        auth: required

      migrate_question:
        method: POST
        path: /MigrateQuestion
        description: Submit a security/migration question (legacy account migration flow)
        auth: required

      migrate_answer:
        method: POST
        path: /MigrateAnswer
        description: Submit the answer to a migration question
        auth: required

  cart:
    description: Build and price an order before sending it
    endpoints:
      get_quote_building:
        method: GET
        path: /QuoteBuilding/{buildingId}
        description: Get the current cart/quote-building state by building ID
        auth: required

      update_quote_building:
        method: POST
        path: /QuoteBuilding/{buildingId}
        description: Update cart contents (add/remove/modify items)
        auth: required

      price_order:
        method: POST
        path: /OrderPrice
        no_auth: true
        description: Compute the total price for an order (cart contents, taxes, fees, delivery) before sending

      send_order:
        method: POST
        path: /OrderSend
        no_auth: true
        description: Submit an order. Requires payment information for guests; uses stored payment for authenticated users.

  orders:
    description: Order history and details
    endpoints:
      list:
        method: GET
        path: /OrderList/{page}/{pageSize}
        description: List the authenticated user's order history (paginated)
        auth: required

      get:
        method: GET
        path: /OrderListItem/{orderId}
        description: Get the full detail of a single past order (items, prices, store, time)
        auth: required

      list_pending:
        method: GET
        path: /OrderListPending
        description: List orders that are currently in flight (placed but not yet delivered/picked up)
        auth: required

      list_gift_cards:
        method: GET
        path: /OrderListGC
        description: List orders that purchased gift cards
        auth: required

      clone:
        method: GET
        path: /OrderClone/{orderId}
        description: Get order data shaped for re-ordering (transforms a past order into a new cart)
        auth: required

      suggestion:
        method: GET
        path: /OrderSuggestion/{customerId}
        description: Get personalized order suggestions for a customer
        auth: required

  rewards:
    description: Loyalty card, rewards history, and stored coupons
    endpoints:
      card:
        method: GET
        path: /RewardCard
        description: Get the authenticated user's reward card balance, points, and available rewards
        auth: required

      history:
        method: GET
        path: /RewardHistory/{customerId}/{count}
        description: Get reward earning/redemption history (most recent N entries)
        auth: required

      stored_coupons:
        method: GET
        path: /StoredCoupons
        description: List coupons saved to the authenticated user's account
        auth: required

      coupon_lookup:
        method: GET
        path: /CouponSerial/{serial}
        no_auth: true
        description: Look up a coupon by its serial number (validate before applying)

  credit:
    description: Account credit balance and entries
    endpoints:
      list:
        method: GET
        path: /StoredCredit
        description: List the authenticated user's account credit entries
        auth: required

      get:
        method: GET
        path: /StoredCredit/{id}
        description: Get a single credit entry
        auth: required

      delete:
        method: DELETE
        path: /StoredCredit/{id}
        description: Remove an account credit entry
        auth: required

  gifts:
    description: Stored gift cards, balance lookup, and transfer
    endpoints:
      list:
        method: GET
        path: /StoredGift
        description: List the authenticated user's stored gift cards
        auth: required

      get:
        method: GET
        path: /StoredGift/{id}
        description: Get a single stored gift card by ID
        auth: required

      delete:
        method: DELETE
        path: /StoredGift/{id}
        description: Remove a stored gift card from the account
        auth: required

      check:
        method: GET
        path: /CheckGift/{id}/{pin}
        no_auth: true
        description: Check the balance of a gift card by ID and PIN (no auth required to check)

      value:
        method: GET
        path: /GiftValue/{id}
        description: Get current value/balance of a saved gift card
        auth: required

      transfer:
        method: POST
        path: /TransferGift
        description: Transfer gift card balance to another account
        auth: required

  customer_feedback:
    description: Customer feedback submissions to Pagliacci
    endpoints:
      get:
        method: GET
        path: /Feedback/{id}
        description: Get a feedback submission by ID
        auth: required

      submit:
        method: POST
        path: /Feedback
        no_auth: true
        description: Submit customer feedback (guest or authenticated)

# Sync configuration: which endpoints feed the local SQLite store.
sync:
  cursor:
    type: time_window
    description: Menu changes weekly (cache OK). Slices change daily (re-sync each session). Stores rarely change.
  resources:
    - store
    - menu
    - rewards
    - orders

# Cache configuration: machine-owned freshness for read commands.
cache:
  enabled: true
  default_ttl_seconds: 300

# MCP configuration: Cloudflare pattern for >50-tool surfaces.
# - transport: stdio + http for remote agent hosts (Managed Agents, web clients)
# - orchestration: code emits a thin pagliacci_search + pagliacci_execute pair
#   that covers the full surface in ~1K tokens
# - endpoint_tools: hidden suppresses raw per-endpoint mirrors so agents only
#   see the orchestration pair
mcp:
  transport:
    - stdio
    - http
  orchestration: code
  endpoint_tools: hidden