Agent-Ready Storefront

Use this guide when making a storefront useful to crawlers, LLMs, and shopping agents.

Prerequisites

• Product pages render visible product, price, availability, and variant state.
• ProductStructuredData.astro is copied or implemented for JSON-LD.
• The host can serve root llms.txt and /.well-known/mika-agent.json.
• Protected tool surfaces are not public until host auth, confirmation, idempotency, and provider policy exist.

Start with public metadata:

• visible HTML product content;
• matching Product or ProductGroup JSON-LD;
• accurate price, availability, variants, and seller identity;
• root llms.txt;
• /.well-known/mika-agent.json with public descriptors only.

For live browser shopping, the 0.2.0 target supplies opt-in WebMCP tools and independent annotation previews. They use the host session and protected Astro Actions, not this public manifest. OAuth where needed, policy, confirmations, payment credentials, payment rails, request signatures, webhooks, settlement, tax, shipping, compliance, and final production services are host-owned.

Public Metadata Checklist

• Product HTML, JSON-LD, and visible availability agree.
• llms.txt describes public reads and protected boundaries.
• /.well-known/mika-agent.json includes public descriptors only.
• Protected cart, checkout, account, admin, and payment flows are summaries, not runnable public tools.
• Any ACP, MCP, OpenAPI, UCP, AP2, MPP, or x402 surface is mounted by host-owned infrastructure.

Public Agent Manifest

Serve /.well-known/mika-agent.json from the public descriptors only:

src/pages/.well-known/mika-agent.json.ts

import { createMikaAgentManifest } from "@bnomei/emdash-mika/agent";
import type { APIRoute } from "astro";

export const GET: APIRoute = () =>
  Response.json(createMikaAgentManifest({ include: ["public"] }));

createMikaAgentManifest() is a descriptor source, not a tool server: it does not publish protected mutation routes, validate OAuth, verify AP2 mandates, run MCP, or process payments. Public agent reads are only catalog.sellables and stock.availability; trusted projections like cart.quote and checkout.preview stay behind host auth. The ⓐ copyable Astro manifest endpoint also adds routeBasePath and protectedFlowSummaries to the response.

Verify

Validate the public endpoint with a browser or curl before publishing:

curl http://localhost:4321/.well-known/mika-agent.json
curl http://localhost:4321/llms.txt

The manifest should list public read routes and summaries of protected flows, not runnable checkout/account/admin tools.

llms.txt

The copied storefront src/pages/llms.txt.ts returns a plain-text surface index: public reads, browser mutations through host-owned Astro Actions rather than public plugin JSON routes, and host-owned auth/session policy and provider wiring. WebMCP’s session-bound JSON Actions are not public plugin endpoints and do not require a hosted OAuth issuer from Mika. Keep JSON-LD, llms.txt, and the manifest in agreement with the visible catalog.

Trusted Projections

For protected agent integrations, treat Mika descriptors as source material. cart.quote, checkout.preview, and order.invoice are good early candidates because they can be placed behind host auth and confirmation before any payment handoff.

Protected protocol projections remain host-owned. Mika supplies descriptors, ACP helpers, optional provider adapters, and the opt-in browser/server storefront integration. Use its explicit tool allowlist rather than registering every trusted descriptor; account tools default off and confirmation is never an agent tool.

Next: Product JSON-LD shows the structured-data copy path. LLMs And Manifest shows the public metadata files. Agent Manifest lists exact manifest helpers.

Source Anchors

• ⓐ ../emdash-mika/src/templates/astro/examples/agent-ready-storefront.md
• ⓟ ../emdash-mika/src/agent.ts
• ⓟ ../emdash-mika/src/acp.ts
• ⓐ ../emdash-mika/src/templates/astro/pages/.well-known/mika-agent.json.ts
• ⓐ ../emdash-mika/src/templates/astro/pages/llms.txt.ts