Build a full supplement storefront in Lovable — on OK Capsule's MCP.

Build a supplement storefront that runs entirely on the OK Capsule MCP.

## The integration surface

- MCP endpoint: https://storefront.okcapsule.app/mcp
- OAuth discovery: https://storefront.okcapsule.app/.well-known/oauth-authorization-server
- Auth: OAuth 2.1 authorization-code + PKCE (S256 required), dynamic client registration, public client (no client secret), email one-time-code sign-in for staff users.
- Transport: JSON-RPC over Streamable HTTP. Send "Accept: application/json, text/event-stream" on every request and cache the Mcp-Session-Id header the server returns, replaying it on subsequent calls.

## Non-negotiable architecture

1. All MCP calls live in a SERVER-ONLY module. Never call the MCP from the browser and never ship tokens to the client.
2. Implement the OAuth flow with a dedicated admin sign-in route. One team member completes the email-OTP sign-in once.
3. Store tokens server-side (a secrets store or a private table). The refresh token is single-use and rotating: always persist the NEWEST refresh token returned by a refresh call.
4. Auto-refresh before expiry (access tokens live one hour). On a 401, route an admin back through the sign-in route — do not retry silently forever.
5. Re-prompt for sign-in when the 30-day refresh window lapses.
6. Discover the tool surface at runtime via tools/list. Do not hardcode tool schemas.

## Scopes

Request read scopes by default: catalog:read, consumers:read, consumers:write, orders:read, fulfillments:read, workspace:read.
Only request orders:write (and orders:cancel if the storefront ever cancels) when the storefront creates orders directly through the MCP — that is the direct-API commerce path. If checkout is handed off to Shopify, do not request write scopes for orders.

## Core tools to wire

- Session / infra: okc_authenticate, okc_debug_ping, okc_confirm_pending_action
- Catalog: okc_list_brands, okc_list_products, okc_get_catalog, okc_get_product_intelligence, okc_render_pack_builder, okc_pack_builder_url
- Recommendations & documents: okc_validate_recommendation, okc_generate_supplement_facts_pdf, okc_list_statuses
- Consumers: okc_get_consumer, okc_list_consumers, okc_upsert_consumer, okc_delete_consumer
- Orders (only where scopes allow): okc_list_orders, okc_get_order, okc_get_order_by_client_id, okc_list_order_transaction_logs, okc_render_order_status, okc_create_order, okc_update_order, okc_cancel_order
- Fulfillments: okc_list_fulfillments, okc_get_fulfillment, okc_get_shipping_label

## Commerce path

Ask me which path this storefront uses before generating checkout code:
- Shopify hand-off (live today): build the pack, then send the customer to the Shopify checkout URL returned by the pack-builder tool.
- Direct API: create the order through okc_create_order and show order + fulfillment status in an account view.

## Required pages

- Home with an AI concierge chat that answers from the live catalog and proposes packs.
- Manual pack builder with pill-count, timing (AM/PM), and allergen/restriction validation.
- Catalog browse plus a product detail view with dosing and an aggregate Supplement Facts panel.
- Static how-it-works, about, FAQ, and a supplement disclaimer page.

## Tone and compliance rules

- Clean, doctor-formulated, lifestyle and traditional-use language.
- No medical claims, no disease claims, no "treats/cures/prevents".
- Any structure/function claim ("supports healthy ...") must carry the FDA disclaimer: "These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease."
- Never invent product data — every product fact comes from the MCP.