{
  "openapi": "3.1.0",
  "info": {
    "title": "AlBasha Public Read-Only API",
    "version": "1.0.0",
    "summary": "Read-only discovery endpoints for the AlBasha restaurant menu, halal grocery catalog, store hours, and order tracking.",
    "description": "Public, read-only endpoints intended for AI agents and integrators. No endpoint in this description creates orders, modifies data, or processes payments. Ordering and payment happen only in the AlBasha web checkout at https://albasharestaurants.net/checkout.",
    "contact": {
      "name": "AlBasha",
      "url": "https://albasharestaurants.net/contact",
      "email": "contact@albasha.store"
    }
  },
  "servers": [
    {
      "url": "https://pqahnpxavbrylyyzekhf.supabase.co/functions/v1",
      "description": "AlBasha public function endpoints"
    }
  ],
  "paths": {
    "/mcp": {
      "post": {
        "operationId": "mcpJsonRpc",
        "summary": "Model Context Protocol endpoint (JSON-RPC 2.0)",
        "description": "Streamable HTTP MCP endpoint exposing read-only tools: get_store_hours, search_menu, search_grocery, get_order_status. Requests must send `Accept: application/json, text/event-stream`.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "jsonrpc": { "type": "string", "const": "2.0" },
                  "id": { "type": ["string", "number", "null"] },
                  "method": { "type": "string" },
                  "params": { "type": "object" }
                },
                "required": ["jsonrpc", "method"]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "JSON-RPC result",
            "content": { "application/json": { "schema": { "type": "object" } } }
          }
        }
      }
    },
    "/track-order": {
      "post": {
        "operationId": "trackOrder",
        "summary": "Look up the status of an existing order",
        "description": "Returns a privacy-sanitised status for an order given its order id (UUID). No full address, payment data, or contact details are returned.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "orderId": {
                    "type": "string",
                    "format": "uuid",
                    "description": "The order id shown on the confirmation page and in the confirmation email."
                  }
                },
                "required": ["orderId"]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Order status",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "success": { "type": "boolean" },
                    "order": {
                      "type": "object",
                      "properties": {
                        "id": { "type": "string" },
                        "order_type": { "type": "string" },
                        "status": { "type": "string" },
                        "delivery_city": { "type": ["string", "null"] },
                        "created_at": { "type": "string", "format": "date-time" }
                      }
                    }
                  }
                }
              }
            }
          },
          "404": { "description": "Order not found" }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "none": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Not-Required",
        "description": "The endpoints described here are public and require no credentials."
      }
    }
  }
}