@hoststack.dev/mcp 0.16.1 → 0.17.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { HostStack } from "@hoststack.dev/sdk";
 
 // src/version.ts
-var MCP_VERSION = true ? "0.16.1" : "0.0.0-dev";
+var MCP_VERSION = true ? "0.17.0" : "0.0.0-dev";
 var USER_AGENT = `hoststack-mcp/${MCP_VERSION}`;
 
 // src/api-client.ts
@@ -621,7 +621,105 @@ defineTool({
 });
 
 // src/tools/databases.ts
+import { z as z6 } from "zod";
+
+// src/tools/machines.ts
 import { z as z5 } from "zod";
+var machineInput = z5.union([z5.number().int().positive(), z5.string()]).optional().describe(
+  `Run this on one of the team's OWN enrolled machines instead of HostStack compute \u2014 the machine's name (e.g. "desktop") or its numeric id. List them with list_machines. Omit for HostStack compute, which is the default and the right answer unless the user asked for their own hardware.`
+);
+async function resolveMachineId(ctx, teamId, machine) {
+  const { machines } = await ctx.hoststack.machines.list(teamId);
+  if (machines.length === 0) {
+    throw new Error(
+      "This team has no enrolled machines. Enrol one from the dashboard (Machines \u2192 Add machine) or with `hoststack machines add`, then run the install command it prints on that machine."
+    );
+  }
+  const known = machines.map((m) => `"${m.name}" (id ${m.id})`).join(", ");
+  if (typeof machine === "number") {
+    const byId = machines.find((m) => m.id === machine);
+    if (!byId) throw new Error(`No machine with id ${machine}. This team has: ${known}.`);
+    return byId.id;
+  }
+  const needle = machine.trim().toLowerCase();
+  const matches = machines.filter(
+    (m) => m.name.toLowerCase() === needle || m.hostname.toLowerCase() === needle
+  );
+  if (matches.length === 0) {
+    throw new Error(`No machine named "${machine}". This team has: ${known}.`);
+  }
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one machine is named "${machine}" (ids ${matches.map((m) => m.id).join(", ")}). Pass the numeric id.`
+    );
+  }
+  return matches[0].id;
+}
+function describeMachine(m) {
+  if (!m.enrolled) return `${m.name}: registered but never paired`;
+  if (m.status !== "active") return `${m.name}: offline`;
+  if (m.agentBuild === "from-source") return `${m.name}: online, agent running from source`;
+  if (m.agentBuild === "unknown") return `${m.name}: online, agent too old to report its build`;
+  return `${m.name}: online`;
+}
+defineTool({
+  name: "list_machines",
+  category: "machines",
+  description: [
+    "List the team's OWN enrolled machines \u2014 hardware they supply (a spare desktop, a home server, a VPS they already pay for) that HostStack runs work on. These are NOT HostStack's servers; you cannot enrol, resize or reboot them from here.",
+    "",
+    "When to use: before creating a service, database or dev box that the user wants on their own hardware (pass the machine name to create_service / create_database / create_standalone_dev_environment), or to explain why something pinned to a machine is down \u2014 a machine that is switched off takes everything on it with it.",
+    "",
+    "Inputs: none.",
+    "",
+    "Returns: { items: Machine[] } \u2014 each entry has id (pass this as `machine`), name, status (active|offline|provisioning), enrolled, agentBuild (current|behind|from-source|unknown), agentVersion, lastHeartbeatAt, totalMemoryMb, totalCpuCores, and workloads { devBoxes, services, databases }.",
+    "",
+    "Notes: a machine is only reachable while its owner has it switched on, and a database pinned to one is reachable ONLY from that same machine \u2014 put the app that queries it there too. Enrolment needs a person at the machine to run an installer, so there is no tool for it: point the user at the dashboard (Machines \u2192 Add machine) or `hoststack machines add`.",
+    "",
+    'Example: list_machines() \u2192 { items: [{ id: 12452, name: "desktop", status: "active", workloads: { devBoxes: 8, services: 0, databases: 2 } }] }'
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.hoststack.machines.list(teamId);
+    const data = shapeList(response, "machines", shape);
+    const summary = response.machines.length === 0 ? "This team has no enrolled machines. Everything runs on HostStack compute." : `${response.machines.length} machine${response.machines.length === 1 ? "" : "s"} \u2014 ${response.machines.map(describeMachine).join("; ")}.`;
+    return respond({ summary, data });
+  }
+});
+defineTool({
+  name: "get_machine",
+  category: "machines",
+  description: [
+    "One of the team's own enrolled machines, with what is actually running on it \u2014 rather than the counts list_machines carries.",
+    "",
+    'When to use: before advising the user to switch a machine off, move work off it, or remove it \u2014 `running` is the list of things that go away with the machine. Also the fastest answer to "what is on my desktop?".',
+    "",
+    "Inputs:",
+    '  - machine: the machine name (e.g. "desktop") or its numeric id.',
+    "",
+    'Returns: { machine: Machine, running: Workload[] } \u2014 each workload has kind ("dev_box" | "service" | "database"), name, status and projectId. The kinds differ in consequence: a dev box waits for its machine to come back, a service is down while it is off, and a database takes down everything reading from it.',
+    "",
+    'Example: get_machine({ machine: "desktop" }) \u2192 { machine: { name: "desktop", status: "active" }, running: [{ kind: "database", name: "postgres-58" }] }'
+  ].join("\n"),
+  input: {
+    machine: z5.union([z5.number().int().positive(), z5.string()]).describe('Machine name (e.g. "desktop") or numeric id. List them with list_machines.')
+  },
+  handler: async (args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const machineId = await resolveMachineId(ctx, teamId, args.machine);
+    const response = await ctx.hoststack.machines.get(teamId, machineId);
+    const data = {
+      machine: shape(response.machine),
+      running: shapeList({ running: response.running }, "running", shape).items
+    };
+    const running = response.running ?? [];
+    const summary = running.length === 0 ? `${describeMachine(response.machine)}. Nothing is running on it.` : `${describeMachine(response.machine)}. Running ${running.length} thing${running.length === 1 ? "" : "s"}: ${running.map((w) => `${w.name} (${w.kind})`).join(", ")}.`;
+    return respond({ summary, data });
+  }
+});
+
+// src/tools/databases.ts
 var DATABASE_VERSIONS = {
   postgres: { default: "18", supported: ["18", "17", "16", "15"] },
   redis: { default: "8", supported: ["8", "7", "6"] },
@@ -658,6 +756,7 @@ defineTool({
     "  - environment_id (optional): bind to a specific environment; defaults to the project Production env.",
     "  - postgis (optional): provision the PostGIS image variant so `CREATE EXTENSION postgis` works. Postgres only.",
     "  - pgvector (optional): provision the pgvector image variant so `CREATE EXTENSION vector` works. Postgres only, mutually exclusive with postgis.",
+    "  - machine (optional): put it on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. It costs nothing there and is still backed up off-site, but it is reachable ONLY from that same machine \u2014 the service that queries it has to run there too, and linking it to a service anywhere else is refused. No HA and no external access on a machine you own.",
     "",
     'Returns: { database: Database } \u2014 note BOTH `id` (numeric \u2014 this is what link_resource_to_service wants) and `publicId` ("db_\u2026" \u2014 what the other database tools want).',
     "",
@@ -666,16 +765,17 @@ defineTool({
     'Example: create_database({ project_id: "prj_abc", name: "app-db", engine: "postgres" }) \u2192 { database: { id: 42, publicId: "db_\u2026", status: "creating" } }'
   ].join("\n"),
   input: {
-    project_id: z5.union([z5.number().int().positive(), z5.string()]).describe('Target project \u2014 numeric id or publicId ("prj_\u2026").'),
-    name: z5.string().min(1).max(100).describe("Database name (1\u2013100 chars)."),
-    engine: z5.enum(DB_ENGINES).describe("Database engine."),
-    version: z5.string().max(20).optional().describe(`Engine version. ${VERSION_HELP}. Omit for the engine default.`),
-    plan: z5.enum(["micro", "starter", "standard", "pro"]).optional().describe('Plan tier (memory/CPU). Default "starter".'),
-    environment_id: z5.union([z5.number().int().positive(), z5.string()]).optional().describe("Environment to bind to. Defaults to the project Production env."),
-    postgis: z5.boolean().optional().describe("Postgres only \u2014 enable the PostGIS extension image."),
-    pgvector: z5.boolean().optional().describe(
+    project_id: z6.union([z6.number().int().positive(), z6.string()]).describe('Target project \u2014 numeric id or publicId ("prj_\u2026").'),
+    name: z6.string().min(1).max(100).describe("Database name (1\u2013100 chars)."),
+    engine: z6.enum(DB_ENGINES).describe("Database engine."),
+    version: z6.string().max(20).optional().describe(`Engine version. ${VERSION_HELP}. Omit for the engine default.`),
+    plan: z6.enum(["micro", "starter", "standard", "pro"]).optional().describe('Plan tier (memory/CPU). Default "starter".'),
+    environment_id: z6.union([z6.number().int().positive(), z6.string()]).optional().describe("Environment to bind to. Defaults to the project Production env."),
+    postgis: z6.boolean().optional().describe("Postgres only \u2014 enable the PostGIS extension image."),
+    pgvector: z6.boolean().optional().describe(
       "Postgres only \u2014 enable the pgvector extension image. Exclusive with postgis."
-    )
+    ),
+    machine: machineInput
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -698,6 +798,9 @@ defineTool({
     }
     if (args.postgis !== void 0) input.postgis = args.postgis;
     if (args.pgvector !== void 0) input.pgvector = args.pgvector;
+    if (args.machine !== void 0) {
+      input.machineId = await resolveMachineId(ctx, teamId, args.machine);
+    }
     const response = await ctx.hoststack.databases.create(teamId, input);
     const data = { database: shapeDatabase(response.database) };
     const db = response.database;
@@ -725,7 +828,7 @@ defineTool({
     'Example: delete_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to permanently delete.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to permanently delete.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -751,7 +854,7 @@ defineTool({
     'Example: suspend_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to suspend.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to suspend.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -777,7 +880,7 @@ defineTool({
     'Example: resume_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to resume.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to resume.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -803,7 +906,7 @@ defineTool({
     'Example: list_databases({ project_id: 12 }) \u2192 { items: [{ publicId: "db_\u2026", type: "postgres", status: "running", \u2026 }] }'
   ].join("\n"),
   input: {
-    project_id: z5.number().int().positive().describe("Numeric project ID (from list_projects).")
+    project_id: z6.number().int().positive().describe("Numeric project ID (from list_projects).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -832,10 +935,10 @@ defineTool({
     'Example: update_database({ database_id: "db_xyz", disk_size_gb: 50 }) \u2192 { database: { diskSizeGb: 50, \u2026 } }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_xyz)."),
-    name: z5.string().min(1).max(100).optional().describe("New database name."),
-    plan: z5.enum(["free", "micro", "starter", "standard", "pro"]).optional().describe("Plan tier (memory/CPU)."),
-    disk_size_gb: z5.number().int().min(1).max(1024).optional().describe("New disk size in GB. Must be \u2265 current.")
+    database_id: z6.string().describe("Database publicId (e.g. db_xyz)."),
+    name: z6.string().min(1).max(100).optional().describe("New database name."),
+    plan: z6.enum(["free", "micro", "starter", "standard", "pro"]).optional().describe("Plan tier (memory/CPU)."),
+    disk_size_gb: z6.number().int().min(1).max(1024).optional().describe("New disk size in GB. Must be \u2265 current.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -868,7 +971,7 @@ defineTool({
     'Example: get_database({ database_id: "db_xyz" }) \u2192 { database: { type: "postgres", version: "16", status: "running", \u2026 } }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_xyz).")
+    database_id: z6.string().describe("Database publicId (e.g. db_xyz).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -906,8 +1009,8 @@ defineTool({
     `  - query_database({ database_id: "db_abc", sql: "SELECT id, email FROM users WHERE created_at > now() - interval '1 day' LIMIT 50" })`
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc)."),
-    sql: z5.string().min(1).max(16384).describe(
+    database_id: z6.string().describe("Database publicId (e.g. db_abc)."),
+    sql: z6.string().min(1).max(16384).describe(
       "A single READ-ONLY SQL statement. No trailing `;`, no embedded `;`, no psql meta-commands."
     )
   },
@@ -936,7 +1039,7 @@ defineTool({
     'Example: upgrade_database_to_ha({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to upgrade to HA.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to upgrade to HA.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -965,8 +1068,8 @@ defineTool({
     'Example: upgrade_database_version({ database_id: "db_abc", version: "18" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to upgrade."),
-    version: z5.string().describe('Target engine version, e.g. "18" for postgres or "8" for redis.')
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to upgrade."),
+    version: z6.string().describe('Target engine version, e.g. "18" for postgres or "8" for redis.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -994,7 +1097,7 @@ defineTool({
     'Example: restart_database({ database_id: "db_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId (e.g. db_abc) to restart.")
+    database_id: z6.string().describe("Database publicId (e.g. db_abc) to restart.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1020,7 +1123,7 @@ defineTool({
     'Example: get_database_cluster({ database_id: "db_abc" }) \u2192 { members: [...5 live rows], failovers: [] }'
   ].join("\n"),
   input: {
-    database_id: z5.string().describe("Database publicId for the HA cluster.")
+    database_id: z6.string().describe("Database publicId for the HA cluster.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1032,7 +1135,7 @@ defineTool({
 });
 
 // src/tools/deploys.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 defineTool({
   name: "list_deploys",
   category: "deploys",
@@ -1049,7 +1152,7 @@ defineTool({
     'Example: list_deploys({ service_id: "svc_abc" }) \u2192 { items: [{ publicId: "dpl_\u2026", status: "live", commitMessage: "Fix login", \u2026 }, \u2026] }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z7.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1076,8 +1179,8 @@ defineTool({
     'Example: get_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { deploy: { status: "live", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId.")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1105,9 +1208,9 @@ defineTool({
     'Example: trigger_deploy({ service_id: "svc_abc" }) \u2192 { deploy: { publicId: "dpl_\u2026", status: "pending", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    commit_hash: z6.string().max(40).optional().describe("Specific commit to build (default: branch HEAD)."),
-    branch: z6.string().max(200).optional().describe("Branch to build (default: service configured branch).")
+    service_id: z7.string().describe("Service publicId."),
+    commit_hash: z7.string().max(40).optional().describe("Specific commit to build (default: branch HEAD)."),
+    branch: z7.string().max(200).optional().describe("Branch to build (default: service configured branch).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1140,8 +1243,8 @@ defineTool({
     'Example: cancel_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId.")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1169,10 +1272,10 @@ defineTool({
     'Example: get_deploy_logs({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 { logs: "Building\u2026\\nStep 1/8\u2026\\n\u2026", lineCount: 42, nextAfterId: 1234 }'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId."),
-    after_id: z6.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
-    limit: z6.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId."),
+    after_id: z7.number().int().optional().describe("Pagination cursor from a previous response\u2019s nextAfterId."),
+    limit: z7.number().int().min(1).max(5e3).optional().describe("Max log entries to fetch (default 500, hard cap 5000).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1212,10 +1315,10 @@ defineTool({
     'Example: diagnose_deploy({ service_id: "svc_abc", deploy_id: "dpl_xyz" }) \u2192 all three sections in one call.'
   ].join("\n"),
   input: {
-    service_id: z6.string().describe("Service publicId."),
-    deploy_id: z6.string().describe("Deploy publicId."),
-    build_log_lines: z6.number().int().min(1).max(2e3).optional().describe("Trailing build log lines. Default 200, max 2000."),
-    runtime_log_lines: z6.number().int().min(0).max(1e3).optional().describe(
+    service_id: z7.string().describe("Service publicId."),
+    deploy_id: z7.string().describe("Deploy publicId."),
+    build_log_lines: z7.number().int().min(1).max(2e3).optional().describe("Trailing build log lines. Default 200, max 2000."),
+    runtime_log_lines: z7.number().int().min(0).max(1e3).optional().describe(
       "Trailing runtime log lines since deploy start. Default 100, max 1000. 0 = skip."
     )
   },
@@ -1276,7 +1379,7 @@ defineTool({
 });
 
 // src/tools/dns-records.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var DNS_RECORD_TYPES = [
   "A",
   "AAAA",
@@ -1291,7 +1394,7 @@ var DNS_RECORD_TYPES = [
 async function resolveZonePublicId(hoststack, teamId, input) {
   if (input.zone_id) {
     const { zones: zones2 } = await hoststack.dns.listZones(teamId);
-    const match = zones2.find((z16) => z16.publicId === input.zone_id);
+    const match = zones2.find((z17) => z17.publicId === input.zone_id);
     if (!match) {
       throw new Error(`Zone ${input.zone_id} not found on this team.`);
     }
@@ -1305,7 +1408,7 @@ async function resolveZonePublicId(hoststack, teamId, input) {
   const labels = fqdn.split(".");
   for (let i = 0; i < labels.length - 1; i++) {
     const candidate = labels.slice(i).join(".");
-    const match = zones.find((z16) => z16.domainName.toLowerCase() === candidate);
+    const match = zones.find((z17) => z17.domainName.toLowerCase() === candidate);
     if (match && match.status !== "deleting") {
       return { publicId: match.publicId, domainName: match.domainName };
     }
@@ -1350,8 +1453,8 @@ defineTool({
     'Example: list_dns_records({ domain: "micci.dk" }) \u2192 { zone: { domainName: "micci.dk", \u2026 }, items: [{ type: "TXT", name: "@", value: "google-site-verification=\u2026", ttl: 300, \u2026 }] }'
   ].join("\n"),
   input: {
-    zone_id: z7.string().optional().describe('Zone publicId (e.g. "dnz_abc").'),
-    domain: z7.string().optional().describe("Apex or subdomain \u2014 resolves to the longest-matching hosted zone.")
+    zone_id: z8.string().optional().describe('Zone publicId (e.g. "dnz_abc").'),
+    domain: z8.string().optional().describe("Apex or subdomain \u2014 resolves to the longest-matching hosted zone.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1384,7 +1487,7 @@ defineTool({
     'Example: get_dns_record({ record_id: "dnr_abc" }) \u2192 { record: { type: "TXT", name: "@", value: "\u2026", status: "active", \u2026 } }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1430,13 +1533,13 @@ defineTool({
     'Example: create_dns_record({ domain: "micci.dk", type: "TXT", name: "@", content: "google-site-verification=C0V0scK48g2\u2026", ttl: 300 })'
   ].join("\n"),
   input: {
-    zone_id: z7.string().optional().describe("Zone publicId."),
-    domain: z7.string().optional().describe("Apex or subdomain to resolve a hosted zone."),
-    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
-    name: z7.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
-    content: z7.string().min(1).max(2e3).describe("Record value; TXT values are unquoted."),
-    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
-    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+    zone_id: z8.string().optional().describe("Zone publicId."),
+    domain: z8.string().optional().describe("Apex or subdomain to resolve a hosted zone."),
+    type: z8.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z8.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
+    content: z8.string().min(1).max(2e3).describe("Record value; TXT values are unquoted."),
+    ttl: z8.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z8.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
   },
   handler: async (args, ctx) => {
     if ((args.type === "MX" || args.type === "SRV") && args.priority === void 0) {
@@ -1482,12 +1585,12 @@ defineTool({
     'Example: update_dns_record({ record_id: "dnr_abc", type: "A", name: "api", content: "203.0.113.42", ttl: 300 })'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId."),
-    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
-    name: z7.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
-    content: z7.string().min(1).max(2e3).describe("Record value; TXT unquoted."),
-    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
-    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+    record_id: z8.string().describe("Record publicId."),
+    type: z8.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z8.string().min(1).max(253).describe('"@" for apex, or a bare label. Do NOT include the zone suffix.'),
+    content: z8.string().min(1).max(2e3).describe("Record value; TXT unquoted."),
+    ttl: z8.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z8.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
   },
   handler: async (args, ctx) => {
     if ((args.type === "MX" || args.type === "SRV") && args.priority === void 0) {
@@ -1541,7 +1644,7 @@ defineTool({
     'Example: delete_dns_record({ record_id: "dnr_abc" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1574,7 +1677,7 @@ defineTool({
     'Example: resync_dns_record({ record_id: "dnr_abc" }) \u2192 { record: { status: "active", ... } }'
   ].join("\n"),
   input: {
-    record_id: z7.string().describe("Record publicId.")
+    record_id: z8.string().describe("Record publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1612,7 +1715,7 @@ async function findRecordZone(hoststack, teamId, recordPublicId) {
 }
 
 // src/tools/domains.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 defineTool({
   name: "list_domains",
   category: "domains",
@@ -1652,9 +1755,9 @@ defineTool({
     'Example: add_domain({ hostname: "api.example.com", service_id: "svc_abc" }) \u2192 { domain: { hostname: "api.example.com", dnsTargets: [...], verified: false, \u2026 } }'
   ].join("\n"),
   input: {
-    hostname: z8.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
-    service_id: z8.string().describe("Service publicId to bind to."),
-    path_prefix: z8.string().optional().describe('Optional URL prefix for path-based routing (e.g. "/api").')
+    hostname: z9.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
+    service_id: z9.string().describe("Service publicId to bind to."),
+    path_prefix: z9.string().optional().describe('Optional URL prefix for path-based routing (e.g. "/api").')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1688,7 +1791,7 @@ defineTool({
     'Example: verify_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z8.string().describe("Domain publicId.")
+    domain_id: z9.string().describe("Domain publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1715,7 +1818,7 @@ defineTool({
     'Example: remove_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z8.string().describe("Domain publicId.")
+    domain_id: z9.string().describe("Domain publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1725,7 +1828,7 @@ defineTool({
 });
 
 // src/tools/env-vars.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 defineTool({
   name: "list_env_vars",
   category: "env-vars",
@@ -1742,7 +1845,7 @@ defineTool({
     'Example: list_env_vars({ service_id: "svc_abc" }) \u2192 { items: [{ key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", isSecret: true }, { key: "PORT", value: "3000", isSecret: false }] }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId.")
+    service_id: z10.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1772,11 +1875,11 @@ defineTool({
     'Example: set_env_var({ service_id: "svc_abc", key: "DATABASE_URL", value: "postgres://\u2026", is_secret: true }) \u2192 { envVar: { key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", \u2026 }, action: "updated" }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    key: z9.string().min(1).max(128).describe("Env-var key."),
-    value: z9.string().describe("New value."),
-    is_secret: z9.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
-    target: z9.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
+    service_id: z10.string().describe("Service publicId."),
+    key: z10.string().min(1).max(128).describe("Env-var key."),
+    value: z10.string().describe("New value."),
+    is_secret: z10.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true."),
+    target: z10.enum(["build", "runtime", "both"]).optional().describe("Injection target: build, runtime, or both. Default both.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1828,8 +1931,8 @@ defineTool({
     'Example: delete_env_var({ service_id: "svc_abc", key: "OLD_FLAG" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    key: z9.string().min(1).max(128).describe("Env-var key to delete.")
+    service_id: z10.string().describe("Service publicId."),
+    key: z10.string().min(1).max(128).describe("Env-var key to delete.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1865,13 +1968,13 @@ defineTool({
     'Example: bulk_set_env_vars({ service_id: "svc_abc", env_vars: [{ key: "PORT", value: "3000", is_secret: false }, { key: "DATABASE_URL", value: "\u2026", is_secret: true }] }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Service publicId."),
-    env_vars: z9.array(
-      z9.object({
-        key: z9.string().min(1).max(128),
-        value: z9.string(),
-        is_secret: z9.boolean().optional(),
-        target: z9.enum(["build", "runtime", "both"]).optional()
+    service_id: z10.string().describe("Service publicId."),
+    env_vars: z10.array(
+      z10.object({
+        key: z10.string().min(1).max(128),
+        value: z10.string(),
+        is_secret: z10.boolean().optional(),
+        target: z10.enum(["build", "runtime", "both"]).optional()
       })
     ).max(500).describe("Array of env-var rows. Hard cap 500.")
   },
@@ -1897,7 +2000,7 @@ defineTool({
 });
 
 // src/tools/environments.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 defineTool({
   name: "list_environments",
   category: "environments",
@@ -1918,7 +2021,7 @@ defineTool({
     'Example: list_environments({ project_id: "prj_abc" }) \u2192 { items: [{ name: "Production", type: "production", isDefault: true }, { name: "Staging", type: "staging" }] }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId.")
+    project_id: z11.string().describe("Project publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1952,13 +2055,13 @@ defineTool({
     'Example: create_environment({ project_id: "prj_abc", name: "Staging", type: "staging" }) \u2192 { environment: { id: 7, publicId: "env_\u2026", name: "Staging", type: "staging" } }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId."),
-    name: z10.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
-    type: z10.enum(["production", "staging", "development", "preview"]).describe(
+    project_id: z11.string().describe("Project publicId."),
+    name: z11.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
+    type: z11.enum(["production", "staging", "development", "preview"]).describe(
       // §2.1: "development" here is a project deployment env, NOT a cloud Dev Box.
       'Environment type \u2014 drives the hostname suffix. type="development" creates a PROJECT deployment environment (a -dev hostname suffix), NOT an agentic Dev Box \u2014 for a cloud dev box use create_dev_environment / create_standalone_dev_environment / spin_up_dev_environment.'
     ),
-    is_protected: z10.boolean().optional().describe("Require admin role for destructive actions. Default false.")
+    is_protected: z11.boolean().optional().describe("Require admin role for destructive actions. Default false.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1992,8 +2095,8 @@ defineTool({
     'Example: delete_environment({ project_id: "prj_abc", environment_id: "env_xyz" }) \u2192 { success: true }'
   ].join("\n"),
   input: {
-    project_id: z10.string().describe("Project publicId."),
-    environment_id: z10.union([z10.string(), z10.number()]).describe("Environment publicId or numeric id.")
+    project_id: z11.string().describe("Project publicId."),
+    environment_id: z11.union([z11.string(), z11.number()]).describe("Environment publicId or numeric id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2024,9 +2127,9 @@ defineTool({
     'Example: promote_deploy({ service_id: "svc_staging", deploy_id: "dpl_built", target_environment_id: "env_prod" }) \u2192 { deploy: { id: 99, status: "pending", trigger: "rollback", dockerImageId: "sha256:\u2026" } }'
   ].join("\n"),
   input: {
-    service_id: z10.string().describe("Source service publicId."),
-    deploy_id: z10.string().describe("Source deploy publicId (must have a built image)."),
-    target_environment_id: z10.union([z10.string(), z10.number()]).describe("Target environment publicId or numeric id.")
+    service_id: z11.string().describe("Source service publicId."),
+    deploy_id: z11.string().describe("Source deploy publicId (must have a built image)."),
+    target_environment_id: z11.union([z11.string(), z11.number()]).describe("Target environment publicId or numeric id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2155,7 +2258,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -2217,10 +2320,10 @@ defineTool({
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z11.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z11.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z11.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).describe(
+    type: z12.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z12.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z12.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z12.array(z12.enum(NOTIFICATION_EVENTS)).describe(
       "List of events the channel subscribes to. Empty list = subscribe to nothing."
     )
   },
@@ -2258,10 +2361,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z11.string().min(1).max(128).optional().describe("New label."),
-    active: z11.boolean().optional().describe("false silences without deleting."),
-    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z12.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z12.string().min(1).max(128).optional().describe("New label."),
+    active: z12.boolean().optional().describe("false silences without deleting."),
+    events: z12.array(z12.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2300,7 +2403,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id.")
+    channel_id: z12.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2327,7 +2430,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z11.number().int().positive().describe("Numeric channel id.")
+    channel_id: z12.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2342,7 +2445,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var AVAILABLE_REGION_IDS = ["eu-central-1"];
 defineTool({
   name: "list_projects",
@@ -2383,9 +2486,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "eu-central-1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z12.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z12.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z12.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
+    name: z13.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z13.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z13.enum(AVAILABLE_REGION_IDS).optional().describe("Region: eu-central-1 (Falkenstein) \u2014 currently the only available region.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2418,9 +2521,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z12.string().describe("Project publicId."),
-    name: z12.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z12.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z13.string().describe("Project publicId."),
+    name: z13.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z13.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args, ctx) => {
     if (args.name === void 0 && args.description === void 0) {
@@ -2454,7 +2557,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z12.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z13.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2466,7 +2569,7 @@ defineTool({
 });
 
 // src/tools/resource-links.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var RESOURCE_LINK_TYPES = [
   "database",
   "object_storage",
@@ -2527,7 +2630,7 @@ defineTool({
     'Example: list_service_resources({ service_id: "svc_abc" }) \u2192 { items: [{ id: 7, resourceType: "database", resourceId: 42, alias: "APP_DB" }] }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
+    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2564,10 +2667,10 @@ defineTool({
     'Example: link_resource_to_service({ service_id: "svc_abc", resource_type: "database", resource_id: 42, alias: "APP_DB" }) \u2192 { link: { id: 7, alias: "APP_DB" } }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    resource_type: z13.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
-    resource_id: z13.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
-    alias: z13.string().min(1).max(48).regex(
+    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Consuming service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    resource_type: z14.enum(RESOURCE_LINK_TYPES).describe("Kind of resource being linked."),
+    resource_id: z14.number().int().positive().describe("NUMERIC id of the resource (e.g. database.id) \u2014 not the publicId."),
+    alias: z14.string().min(1).max(48).regex(
       /^[A-Z][A-Z0-9_]*$/,
       "Alias must be uppercase letters, digits and underscores, starting with a letter."
     ).describe('Uppercase env-var prefix, e.g. "APP_DB". Unique within the service.')
@@ -2603,8 +2706,8 @@ defineTool({
     'Example: unlink_resource_from_service({ service_id: "svc_abc", link_id: 7 }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z13.union([z13.number().int().positive(), z13.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
-    link_id: z13.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
+    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe('Service \u2014 publicId ("svc_\u2026") or numeric id.'),
+    link_id: z14.number().int().positive().describe("Numeric linkId from list_service_resources (the link's own `id`).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2616,9 +2719,177 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
+
+// src/lib/app-templates.ts
+var MCP_APP_TEMPLATES = [
+  {
+    id: "node-express",
+    name: "Node.js Express",
+    description: "HTTP server with Express.js",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node index.js"
+  },
+  {
+    id: "python-fastapi",
+    name: "Python FastAPI",
+    description: "Modern Python API framework",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    startCommand: "uvicorn main:app --host 0.0.0.0 --port $PORT"
+  },
+  {
+    id: "go-api",
+    name: "Go HTTP Server",
+    description: "Lightweight Go web service",
+    type: "web_service",
+    runtime: "go",
+    installCommand: "go mod download",
+    buildCommand: "go build -o server .",
+    startCommand: "./server"
+  },
+  {
+    id: "bun-hono",
+    name: "Bun + Hono",
+    description: "Fast TypeScript API with Bun runtime",
+    type: "web_service",
+    runtime: "bun",
+    installCommand: "bun install",
+    startCommand: "bun run src/index.ts"
+  },
+  {
+    id: "nextjs-ssr",
+    name: "Next.js",
+    description: "Server-rendered Next.js started with next start",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "npm run start"
+  },
+  {
+    id: "react-router-ssr",
+    name: "React Router / Remix",
+    description: "Server build served by react-router-serve or remix-serve",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "npm run start"
+  },
+  {
+    id: "sveltekit-node",
+    name: "SvelteKit",
+    description: "SvelteKit server build produced by adapter-node",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "node build"
+  },
+  {
+    id: "nuxt",
+    name: "Nuxt",
+    description: "Nuxt server build running on the Nitro output",
+    type: "web_service",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    startCommand: "node .output/server/index.mjs"
+  },
+  {
+    id: "django",
+    name: "Django",
+    description: "Django project served by Gunicorn",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    buildCommand: "python manage.py collectstatic --noinput || true",
+    startCommand: "gunicorn --bind 0.0.0.0:$PORT --workers 2 $(ls */wsgi.py | head -n1 | cut -d/ -f1).wsgi:application"
+  },
+  {
+    id: "flask",
+    name: "Flask",
+    description: "Flask app served by Gunicorn",
+    type: "web_service",
+    runtime: "python",
+    installCommand: "pip install -r requirements.txt",
+    startCommand: "gunicorn --bind 0.0.0.0:$PORT --workers 2 app:app"
+  },
+  {
+    id: "spring-boot",
+    name: "Spring Boot",
+    description: "Spring Boot fat JAR built with Maven or Gradle",
+    type: "web_service",
+    runtime: "java",
+    // No install/build on purpose: the agent inspects the repo and picks
+    // Maven vs Gradle with the matching toolchain image. Sending either one
+    // here would break the other half of the split.
+    startCommand: "java -jar /app/app.jar --server.port=$PORT"
+  },
+  {
+    id: "static-react",
+    name: "React SPA",
+    description: "Single-page React application",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./dist"
+  },
+  {
+    id: "static-nextjs",
+    name: "Next.js Static",
+    description: "Next.js with static export",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./out"
+  },
+  {
+    id: "astro",
+    name: "Astro",
+    description: "Astro site built to Astro's default static output",
+    type: "static_site",
+    runtime: "node",
+    installCommand: "npm install",
+    buildCommand: "npm run build",
+    publishPath: "./dist"
+  },
+  {
+    id: "worker-bullmq",
+    name: "BullMQ Worker",
+    description: "Background job processor",
+    type: "worker",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node worker.js"
+  },
+  {
+    id: "cron-cleanup",
+    name: "Cleanup Cron",
+    description: "Daily maintenance task",
+    type: "cron_job",
+    runtime: "node",
+    installCommand: "npm install",
+    startCommand: "node cleanup.js",
+    cronSchedule: "0 3 * * *"
+  }
+];
+
+// src/tools/services.ts
 var DEV_ENV_IMAGE = "registry.hoststack.dev/hoststack/dev-env:latest";
 var DEV_ENV_VOLUME = { name: "workspace", mountPath: "/workspace", sizeGb: 10 };
+var DEV_BOX_INSIDE = [
+  "INSIDE the box (no Docker daemon \u2014 do not try `docker run`, and runtime `apt-get` is blocked too; it is all preinstalled):",
+  '  - Databases/engines via `dev-services up`: Postgres 17 (:5432, user "dev", trust auth), Redis (:6379), Meilisearch (:7700). MariaDB/MySQL (:3306, user "dev", no password, client `mariadb`) and MongoDB (:27017, client `mongosh`) are OPT-IN \u2014 `dev-services up mysql` / `dev-services up mongodb` \u2014 so a box does not pay RAM for engines it never uses. `dev-services createdb <name>` makes a Postgres role + database in one step. Data lives on /workspace, so it survives restarts.',
+  "  - Language runtimes: node, bun, python and php 8.3 are built in. go, java, ruby, rust, elixir and dotnet install on demand with `dev-runtime add <name>` (persisted to /workspace). Together that covers every runtime the platform itself deploys \u2014 a WordPress/Laravel/Rails stack runs in the box. elixir needs `dev-runtime add erlang` first: it is a BEAM distribution with no OTP of its own, and Ubuntu ships one too old to use, so mise builds a current one (takes a few minutes).",
+  "  - `hoststack-status` prints what is running, the box dev URL and agent login state at any time."
+].join("\n");
 var SERVICE_TYPES = [
   "web_service",
   "private_service",
@@ -2665,11 +2936,11 @@ defineTool({
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z14.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z14.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
-    dev_environment: z14.boolean().optional().describe(
+    project_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z15.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z15.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type."),
+    dev_environment: z15.boolean().optional().describe(
       "Include agentic Dev Boxes in the results (excluded by default; see list_dev_environments)."
     )
   },
@@ -2730,29 +3001,31 @@ defineTool({
     '  - plan (optional): service size (default "micro").',
     "  - environment_id (optional): bind to a specific environment; defaults to the project Production env.",
     "  - auto_deploy (optional, default true): trigger the first deploy immediately when a source is present.",
+    "  - machine (optional): run it on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. Pinned at creation and never moved afterwards, and the service is up only while that machine is.",
     "",
     "Returns: { service: Service, deployId: number | null }.",
     "",
     'Example: create_service({ project_id: "prj_abc", name: "api", type: "web_service", github_repo_id: 42 }) \u2192 { service: { publicId: "svc_\u2026" }, deployId: 1234 }'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z14.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
-    type: z14.enum(SERVICE_TYPES).describe("Service type."),
-    docker_image: z14.string().max(500).optional().describe(
+    project_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z15.string().min(1).max(100).describe("Service name (1\u2013100 chars)."),
+    type: z15.enum(SERVICE_TYPES).describe("Service type."),
+    docker_image: z15.string().max(500).optional().describe(
       "Pre-built APPLICATION image ref. Mutually exclusive with github_repo_id. Not for databases \u2014 use create_database for postgres/redis/mysql/mariadb/mongodb."
     ),
-    github_repo_id: z14.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
-    branch: z14.string().max(200).optional().describe('Git branch (default "main").'),
-    install_command: z14.string().max(1e3).optional().describe("Install shell command."),
-    build_command: z14.string().max(1e3).optional().describe("Build shell command."),
-    start_command: z14.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
-    cron_schedule: z14.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
-    publish_path: z14.string().max(500).optional().describe("Static-site output dir."),
-    runtime: z14.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
-    plan: z14.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
-    environment_id: z14.union([z14.number().int().positive(), z14.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
-    auto_deploy: z14.boolean().optional().describe("Trigger the first deploy immediately (default true).")
+    github_repo_id: z15.number().int().positive().optional().describe("Linked GitHub repo numeric id. Mutually exclusive with docker_image."),
+    branch: z15.string().max(200).optional().describe('Git branch (default "main").'),
+    install_command: z15.string().max(1e3).optional().describe("Install shell command."),
+    build_command: z15.string().max(1e3).optional().describe("Build shell command."),
+    start_command: z15.string().max(1e3).optional().describe("Start shell command (required for web/private services without an image)."),
+    cron_schedule: z15.string().max(100).optional().describe("Cron expression \u2014 required for cron_job."),
+    publish_path: z15.string().max(500).optional().describe("Static-site output dir."),
+    runtime: z15.string().max(50).optional().describe("Runtime hint (node/bun/python/\u2026)."),
+    plan: z15.enum(SERVICE_PLANS).optional().describe('Service size (default "micro").'),
+    environment_id: z15.union([z15.number().int().positive(), z15.string()]).optional().describe("Bind to a specific environment; defaults to Production."),
+    auto_deploy: z15.boolean().optional().describe("Trigger the first deploy immediately (default true)."),
+    machine: machineInput
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2782,6 +3055,9 @@ defineTool({
         teamId
       });
     }
+    if (args.machine !== void 0) {
+      input.machineId = await resolveMachineId(ctx, teamId, args.machine);
+    }
     const response = await ctx.hoststack.services.create(teamId, input);
     const data = {
       service: shapeService(response.service),
@@ -2805,28 +3081,31 @@ defineTool({
     '  - project_id: numeric id or publicId ("prj_\u2026") of the target project.',
     '  - name (optional): service name (default "dev-environment").',
     '  - plan (optional): box size. Defaults to "standard" (2 GB) \u2014 the OOM-safe floor (DEV_ENV_MIN_SIZE); a coding agent + build OOMs below it. A smaller plan is clamped up to "standard".',
-    "  - disk_gb (optional): /workspace volume size in GB (default 10, 1\u2013100).",
+    "  - disk_gb (optional): /workspace volume size in GB (default 10, min 10, max 10240).",
     "  - hoststack_api_key (optional): sets HOSTSTACK_API_KEY so the hoststack MCP works inside the container.",
     "  - poststack_api_key (optional): sets POSTSTACK_API_KEY so the poststack MCP works inside the container.",
     "  - repo_url (optional): clone this git URL into /workspace on first boot (with optional branch).",
     "",
+    DEV_BOX_INSIDE,
+    "",
     "Returns: { service: Service, volumeAttached: boolean, deployId: number | null }. Open the Terminal tab on the service (dashboard or phone) once it is running; log in once with `claude /login` inside the container.",
     "",
     'Example: create_dev_environment({ project_id: "prj_abc", name: "scratch", hoststack_api_key: "hs_live_\u2026" })'
   ].join("\n"),
   input: {
-    project_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Target project \u2014 numeric id or publicId."),
-    name: z14.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
-    plan: z14.enum(SERVICE_PLANS).optional().describe(
+    project_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Target project \u2014 numeric id or publicId."),
+    name: z15.string().min(1).max(100).optional().describe('Service name (default "dev-environment").'),
+    plan: z15.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB, the OOM-safe floor; a smaller plan is clamped up to "standard").'
     ),
-    disk_gb: z14.number().int().min(1).max(100).optional().describe("/workspace volume size in GB (default 10)."),
-    hoststack_api_key: z14.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
-    poststack_api_key: z14.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
-    repo_url: z14.string().max(500).optional().describe(
+    disk_gb: z15.number().int().min(10).max(10240).optional().describe("/workspace volume size in GB (default 10, min 10, max 10240)."),
+    hoststack_api_key: z15.string().optional().describe("Value for HOSTSTACK_API_KEY (enables the hoststack MCP in-container)."),
+    poststack_api_key: z15.string().optional().describe("Value for POSTSTACK_API_KEY (enables the poststack MCP in-container)."),
+    repo_url: z15.string().max(500).optional().describe(
       "Clone this git URL into /workspace on first boot (HTTPS, or SSH once a key is set)."
     ),
-    branch: z14.string().max(200).optional().describe("Branch to clone (with repo_url).")
+    branch: z15.string().max(200).optional().describe("Branch to clone (with repo_url)."),
+    machine: machineInput
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2845,6 +3124,9 @@ defineTool({
       autoDeploy: false,
       plan
     };
+    if (args.machine !== void 0) {
+      createInput.machineId = await resolveMachineId(ctx, teamId, args.machine);
+    }
     const created = await ctx.hoststack.services.create(teamId, createInput);
     const service = created.service;
     const rollback = async () => {
@@ -2932,14 +3214,16 @@ defineTool({
     "  - include_database_clone (optional): clone the linked database so the app runs on a copy of real data (default true).",
     '  - name (optional): dev box name (default "<source>-dev").',
     "",
+    DEV_BOX_INSIDE,
+    "",
     "Returns: { service, devUrl, deployId }. Once it is live: open the Terminal tab, run `claude`, start the dev server (it must bind $PORT), and view the app at https://<devUrl>. Tear it all down later with delete_dev_environment.",
     "",
     'Example: spin_up_dev_environment({ service_id: "svc_api" }) \u2192 a dev box running a clone of the api service (repo + env-vars + cloned DB) with a public dev URL.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
-    include_database_clone: z14.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
-    name: z14.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
+    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("Source service to debug \u2014 numeric id or publicId."),
+    include_database_clone: z15.boolean().optional().describe("Clone the linked database so the app runs on copied data (default true)."),
+    name: z15.string().min(1).max(100).optional().describe('Dev box name (default "<source>-dev").')
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2980,7 +3264,7 @@ defineTool({
     'Example: delete_dev_environment({ service_id: "svc_api_dev" }) \u2192 removes the dev box, its cloned database, and the /workspace volume.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
+    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("The dev box to tear down \u2014 numeric id or publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3016,8 +3300,8 @@ defineTool({
     'Example: resize_dev_environment({ service_id: "svc_skyskraber_dev", size: "large" }) \u2192 bumps the box to the large tier, applied live.'
   ].join("\n"),
   input: {
-    service_id: z14.union([z14.number().int().positive(), z14.string()]).describe("The box to resize \u2014 numeric id or publicId."),
-    size: z14.enum(SERVICE_PLANS).describe(
+    service_id: z15.union([z15.number().int().positive(), z15.string()]).describe("The box to resize \u2014 numeric id or publicId."),
+    size: z15.enum(SERVICE_PLANS).describe(
       'Target size tier (service catalog size, e.g. "standard", "large", "xlarge").'
     )
   },
@@ -3071,35 +3355,60 @@ defineTool({
   name: "list_templates",
   category: "services",
   description: [
-    "List the canonical Dev Box (AI dev environment) preset so an agent can see, without guessing, what a `create_standalone_dev_environment` / `create_dev_environment` actually provisions: the container image, the persistent /workspace volume (mount + default size), the OOM-safe size floor, and the companion database options.",
+    "List the app quickstart templates the dashboard New-Service wizard offers, plus the separate Dev Box preset. A template is a pre-filled install/build/start command set for a stack (Next.js, Django, SvelteKit, Spring Boot, \u2026) \u2014 pass its fields straight to `create_service` to get a service configured exactly like a hand-created one.",
     "",
-    "When to use: before creating a Dev Box, to confirm the image, the default /workspace size, the minimum plan, or which companion engines can be attached \u2014 instead of hand-duplicating those constants.",
+    'When to use: whenever asked to deploy a known stack ("deploy my Next.js app", "put this Django project on HostStack"), before hand-writing a start command; and before creating a Dev Box, to confirm the image, /workspace size, plan floor, and companion engines instead of duplicating those constants.',
     "",
-    'Returns: { templates: [{ id, name, image, volume: { name, mountPath, sizeGb }, minPlan, companions }] }. Today there is one preset ("dev-environment").',
+    "Returns: { templates: [{ id, name, description, type, runtime, installCommand?, buildCommand?, startCommand?, publishPath?, cronSchedule? }], devBox: { id, name, image, volume: { name, mountPath, sizeGb }, minPlan, createWith, companions, inBox } }. Every template is source-built from a Git repo \u2014 pair one with `github_repo_id`, not `docker_image`. The Dev Box is NOT in `templates`: it is created with create_standalone_dev_environment / create_dev_environment, never create_service. `companions` are SEPARATE managed databases you can attach; `inBox` is what the box already runs on its own (engines via `dev-services`, language runtimes via `dev-runtime`) \u2014 check it before concluding a box cannot run something.",
     "",
-    'Example: list_templates() \u2192 { templates: [{ id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] }] }'
+    'Example: list_templates() \u2192 { templates: [{ id: "nextjs-ssr", name: "Next.js", type: "web_service", runtime: "node", installCommand: "npm install", buildCommand: "npm run build", startCommand: "npm run start" }, \u2026], devBox: { id: "dev-environment", image: "registry.hoststack.dev/hoststack/dev-env:latest", volume: { mountPath: "/workspace", sizeGb: 10 }, minPlan: "standard", companions: ["postgres","redis","meilisearch"] } }'
   ].join("\n"),
   input: {},
   handler: async () => {
-    const templates = [
-      {
-        id: "dev-environment",
-        name: "AI Dev Environment",
-        image: DEV_ENV_IMAGE,
-        volume: {
-          name: DEV_ENV_VOLUME.name,
-          mountPath: DEV_ENV_VOLUME.mountPath,
-          sizeGb: DEV_ENV_VOLUME.sizeGb
+    const devBox = {
+      id: "dev-environment",
+      name: "AI Dev Environment",
+      image: DEV_ENV_IMAGE,
+      volume: {
+        name: DEV_ENV_VOLUME.name,
+        mountPath: DEV_ENV_VOLUME.mountPath,
+        sizeGb: DEV_ENV_VOLUME.sizeGb
+      },
+      /** OOM-safe plan floor — a coding agent + build needs at least this. */
+      minPlan: DEV_ENV_MIN_SIZE,
+      /** Create it with these, never create_service. */
+      createWith: ["create_standalone_dev_environment", "create_dev_environment"],
+      /** Companion engines you can attach (fresh + empty), like local `make db-up`. */
+      companions: ["postgres", "redis", "meilisearch"],
+      /**
+       * What the box can already run without attaching anything. Reported
+       * so an agent picking a template can see that "it needs MySQL" or
+       * "it's a PHP app" is already satisfied, instead of concluding the
+       * box is unsuitable and reaching for Docker (there is no daemon).
+       */
+      inBox: {
+        engines: {
+          default: ["postgres", "redis", "meilisearch"],
+          optIn: ["mysql", "mongodb"],
+          start: "dev-services up [mysql|mongodb]"
         },
-        /** OOM-safe plan floor — a coding agent + build needs at least this. */
-        minPlan: DEV_ENV_MIN_SIZE,
-        /** Companion engines you can attach (fresh + empty), like local `make db-up`. */
-        companions: ["postgres", "redis", "meilisearch"]
+        runtimes: {
+          builtin: ["node", "bun", "python", "php"],
+          // erlang is listed because elixir cannot run without it —
+          // see DEV_BOX_INSIDE. Ordering matters for a caller acting
+          // on this: add erlang, then elixir.
+          onDemand: ["go", "java", "ruby", "rust", "erlang", "elixir", "dotnet"],
+          install: "dev-runtime add <name>"
+        }
       }
-    ];
+    };
+    const templates = MCP_APP_TEMPLATES;
+    const byType = /* @__PURE__ */ new Map();
+    for (const t of templates) byType.set(t.type, (byType.get(t.type) ?? 0) + 1);
+    const breakdown = [...byType].map(([type, n]) => `${n} ${type}`).join(", ");
     return respond({
-      summary: `${templates.length} Dev Box template${templates.length === 1 ? "" : "s"} available (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}").`,
-      data: { templates }
+      summary: `${templates.length} app templates (${breakdown}) \u2014 pick one by id and pass its commands to create_service with a github_repo_id. Plus the Dev Box preset (image ${DEV_ENV_IMAGE}, /workspace ${DEV_ENV_VOLUME.sizeGb} GB, floor "${DEV_ENV_MIN_SIZE}"), which is created with create_standalone_dev_environment, not create_service.`,
+      data: { templates, devBox }
     });
   }
 });
@@ -3111,7 +3420,9 @@ defineTool({
     "",
     "This makes a cloud Dev Box, NOT a project deploy environment (create_environment \u2192 Production / Staging / Preview). It is a workspace you code in, not a deployment target.",
     "",
-    'Every Dev Box \u2014 with or without companions \u2014 also ships NATIVE Postgres 17, Redis and Meilisearch INSIDE the box, started with `dev-services up` (postgres :5432 as user "dev" with trust auth, redis :6379, meilisearch :7700). That is the no-Docker replacement for `make db-up` and is the right answer for local development inside the box; there is no Docker daemon available in there. The `companions` option is different \u2014 it attaches SEPARATE managed databases to the box\'s environment for when the box needs a real, persistent, backed-up datastore.',
+    DEV_BOX_INSIDE,
+    "",
+    "Those in-box engines are the no-Docker replacement for a local `make db-up`, and are the right answer for development inside the box. The `companions` option is a DIFFERENT thing: it attaches SEPARATE managed databases to the box's environment, for when the box needs a real, persistent, backed-up datastore rather than a scratch one.",
     "",
     'When to use: "create a dev environment for <repo>", "spin me up a cloud dev box with a Postgres". Distinct from spin_up_dev_environment (which clones an EXISTING service) and create_dev_environment (a bare box in a chosen project).',
     "",
@@ -3122,6 +3433,7 @@ defineTool({
     "  - clone_url (for url): an http(s) git clone URL.",
     "  - branch (optional): branch to clone.",
     '  - databases (optional): companion services to attach \u2014 any of "postgres", "redis", "meilisearch".',
+    "  - machine (optional): run the box on one of the team's OWN enrolled machines (name or id, see list_machines) instead of HostStack compute. /workspace then lives on that machine's disk, so the box is reachable only while it is switched on, and any companion databases are created there too.",
     '  - plan (optional): box size. Defaults to "standard" (2 GB) \u2014 the OOM-safe floor (DEV_ENV_MIN_SIZE); a smaller plan is floored up to "standard" server-side.',
     "  - agent_accounts (optional): bind specific saved agent logins by account id per provider. OMIT to auto-inherit the box owner's default logins (claude/codex/opencode), so `claude` is already authenticated on first boot \u2014 no manual login.",
     "",
@@ -3130,25 +3442,26 @@ defineTool({
     'Example: create_standalone_dev_environment({ name: "app-dev", source_kind: "github_repo", github_repo_id: 42, databases: ["postgres","redis"] })'
   ].join("\n"),
   input: {
-    name: z14.string().min(1).max(100).optional().describe(
+    name: z15.string().min(1).max(100).optional().describe(
       'Dev Box name. Omit to have it named after the source (the repo name, or "dev-box" for a blank one), de-duplicated against existing boxes.'
     ),
-    source_kind: z14.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
-    github_repo_id: z14.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
-    clone_url: z14.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
-    branch: z14.string().min(1).max(255).optional().describe("Branch to clone."),
-    databases: z14.array(z14.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
-    plan: z14.enum(SERVICE_PLANS).optional().describe(
+    source_kind: z15.enum(["github_repo", "url", "blank"]).describe("Where the code comes from."),
+    github_repo_id: z15.number().int().positive().optional().describe('Connected GitHub repo id (required when source_kind="github_repo").'),
+    clone_url: z15.string().url().optional().describe('http(s) git clone URL (required when source_kind="url").'),
+    branch: z15.string().min(1).max(255).optional().describe("Branch to clone."),
+    databases: z15.array(z15.enum(["postgres", "redis", "meilisearch"])).optional().describe("Companion services to attach (fresh + empty)."),
+    plan: z15.enum(SERVICE_PLANS).optional().describe(
       'Box size (default "standard" \u2014 2 GB; a smaller plan is floored to "standard").'
     ),
-    agent_accounts: z14.array(
-      z14.object({
-        provider: z14.enum(["claude", "codex", "opencode"]),
-        account_id: z14.number().int().positive()
+    agent_accounts: z15.array(
+      z15.object({
+        provider: z15.enum(["claude", "codex", "opencode"]),
+        account_id: z15.number().int().positive()
       })
     ).max(3).optional().describe(
       "Bind saved agent logins by account id per provider. Omit to inherit the box owner's default logins automatically."
-    )
+    ),
+    machine: machineInput
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3180,9 +3493,11 @@ defineTool({
     } else {
       source = { kind: "blank" };
     }
+    const machineId = args.machine !== void 0 ? await resolveMachineId(ctx, teamId, args.machine) : void 0;
     const input = {
       ...args.name ? { name: args.name } : {},
       source,
+      ...machineId !== void 0 ? { machineId } : {},
       ...args.databases ? { databases: args.databases } : {},
       ...args.plan ? { plan: args.plan } : {},
       ...args.agent_accounts && args.agent_accounts.length > 0 ? {
@@ -3219,7 +3534,7 @@ defineTool({
     'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z15.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3251,7 +3566,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z15.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3280,9 +3595,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    from: z14.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z14.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z15.string().describe("Service publicId."),
+    from: z15.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z15.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3326,8 +3641,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    name: z14.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z15.string().describe("Service publicId."),
+    name: z15.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3376,40 +3691,40 @@ defineTool({
     'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    install_command: z14.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z14.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z14.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z14.string().optional().describe("Git branch to track."),
-    root_directory: z14.string().optional().describe("Build context root."),
-    dockerfile_path: z14.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z14.boolean().optional().describe("Auto-deploy on push."),
-    health_check_path: z14.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
-    health_check_enabled: z14.boolean().optional().describe("Toggle health checking on/off."),
-    health_check_interval: z14.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
-    health_check_timeout: z14.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
-    health_check_grace_period_sec: z14.number().int().min(1).max(1800).optional().describe(
+    service_id: z15.string().describe("Service publicId."),
+    install_command: z15.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z15.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z15.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z15.string().optional().describe("Git branch to track."),
+    root_directory: z15.string().optional().describe("Build context root."),
+    dockerfile_path: z15.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z15.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z15.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z15.boolean().optional().describe("Toggle health checking on/off."),
+    health_check_interval: z15.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z15.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z15.number().int().min(1).max(1800).optional().describe(
       "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
     ),
-    memory_mb: z14.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
-    cpu_shares: z14.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
-    disk_size_gb: z14.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
-    port: z14.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
-    protocol: z14.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
-    restart_policy: z14.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
-    deploy_strategy: z14.enum(["rolling", "recreate"]).optional().describe(
+    memory_mb: z15.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z15.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z15.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z15.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z15.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z15.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    deploy_strategy: z15.enum(["rolling", "recreate"]).optional().describe(
       'How a deploy replaces the container. "rolling" (default) = start new, wait for healthy, switch traffic, stop old (zero downtime). "recreate" = stop old first, then start new (brief outage) \u2014 required for a container holding an exclusive lock on a mounted volume, which cannot deploy at all under rolling.'
     ),
-    pre_deploy_command: z14.string().optional().describe("Shell command run before the new release accepts traffic."),
-    instance_count: z14.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    min_instances: z14.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
-    max_instances: z14.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
-    scale_cpu_threshold: z14.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
-    scale_memory_threshold: z14.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
-    log_filter_rules: z14.array(
-      z14.object({
-        pattern: z14.string().min(1).max(200),
-        action: z14.enum(["drop", "downgrade"])
+    pre_deploy_command: z15.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z15.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z15.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z15.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z15.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z15.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    log_filter_rules: z15.array(
+      z15.object({
+        pattern: z15.string().min(1).max(200),
+        action: z15.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -3506,7 +3821,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z15.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3530,7 +3845,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z15.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3556,7 +3871,7 @@ defineTool({
     'Example: delete_service({ service_id: "svc_abandoned" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId.")
+    service_id: z15.string().describe("Service publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3593,16 +3908,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z14.string().describe("Service publicId."),
-    lines: z14.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z14.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z14.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z14.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z14.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z15.string().describe("Service publicId."),
+    lines: z15.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z15.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z15.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z15.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z15.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z14.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z14.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z15.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z15.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3651,14 +3966,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z14.array(z14.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z14.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z14.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z14.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z14.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z14.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z14.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z14.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z15.array(z15.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z15.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z15.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z15.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z15.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z15.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z15.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z15.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3704,7 +4019,7 @@ defineTool({
 });
 
 // src/tools/volumes.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var MIN_VOLUME_SIZE_GB = 10;
 defineTool({
   name: "list_volumes",
@@ -3722,7 +4037,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z16.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3751,15 +4066,15 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "pending" } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    name: z15.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z15.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    service_id: z16.string().describe("Service publicId."),
+    name: z16.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z16.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
     // 10 GB is the real floor: the block-storage backend rejects anything
     // smaller. Advertising 1 GB here (and defaulting to it) meant taking the
     // defaults produced a volume that provisioned with `Hetzner API error:
     // 422` on the NEXT deploy, with nothing tying the failure back to the
     // size. Reject it at the call instead.
-    size_gb: z15.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
+    size_gb: z16.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(
       `Disk size in GB (minimum ${MIN_VOLUME_SIZE_GB}, default ${MIN_VOLUME_SIZE_GB}, max 100 via MCP).`
     )
   },
@@ -3797,10 +4112,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    volume_id: z15.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z15.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z15.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
+    service_id: z16.string().describe("Service publicId."),
+    volume_id: z16.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z16.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z16.number().int().min(MIN_VOLUME_SIZE_GB).max(100).optional().describe(`New size in GB (minimum ${MIN_VOLUME_SIZE_GB}, grow-only).`)
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -3838,8 +4153,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z15.string().describe("Service publicId."),
-    volume_id: z15.string().describe("Volume publicId.")
+    service_id: z16.string().describe("Service publicId."),
+    volume_id: z16.string().describe("Volume publicId.")
   },
   handler: async (args, ctx) => {
     const teamId = await ctx.resolveTeamId();