@hoststack.dev/mcp 0.5.0 → 0.6.1

package/dist/hoststack-mcp.js

@@ -46,6 +46,14 @@ var ApiClient = class {
     });
     return this.handle(res);
   }
+  async put(path, body) {
+    const res = await fetch(`${this.baseUrl}${path}`, {
+      method: "PUT",
+      headers: this.headers,
+      body: JSON.stringify(body)
+    });
+    return this.handle(res);
+  }
   async delete(path) {
     const res = await fetch(`${this.baseUrl}${path}`, {
       method: "DELETE",
@@ -902,8 +910,297 @@ defineTool({
   }
 });
 
-// src/tools/domains.ts
+// src/tools/dns-records.ts
 import { z as z7 } from "zod";
+var DNS_RECORD_TYPES = ["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV", "CAA", "ALIAS"];
+async function resolveZonePublicId(api, teamId, input) {
+  if (input.zone_id) {
+    const { zones: zones2 } = await api.get(`/api/dns-zones/${teamId}`);
+    const match = zones2.find((z15) => z15.publicId === input.zone_id);
+    if (!match) {
+      throw new Error(`Zone ${input.zone_id} not found on this team.`);
+    }
+    return { publicId: match.publicId, domainName: match.domainName };
+  }
+  if (!input.domain) {
+    throw new Error("Provide either zone_id or domain.");
+  }
+  const { zones } = await api.get(`/api/dns-zones/${teamId}`);
+  const fqdn = input.domain.toLowerCase().replace(/\.$/, "");
+  const labels = fqdn.split(".");
+  for (let i = 0; i < labels.length - 1; i++) {
+    const candidate = labels.slice(i).join(".");
+    const match = zones.find((z15) => z15.domainName.toLowerCase() === candidate);
+    if (match && match.status !== "deleting") {
+      return { publicId: match.publicId, domainName: match.domainName };
+    }
+  }
+  throw new Error(
+    `No hosted zone matches ${input.domain}. Create the zone in the dashboard (Domains \u2192 DNS) first, then retry.`
+  );
+}
+defineTool({
+  name: "list_dns_zones",
+  category: "dns",
+  description: [
+    "List authoritative DNS zones the team owns on HostStack's PowerDNS infrastructure. Each zone is the apex domain (e.g. example.com) under which DNS records live.",
+    "",
+    "When to use: discover which apex domains support record management before calling create_dns_record / list_dns_records. The dashboard equivalent is Domains \u2192 DNS.",
+    "",
+    'Returns: { items: Zone[] } \u2014 each zone exposes publicId, domainName, status ("active" | "syncing" | "failed" | "deleting"), nsRecords (the nameservers the parent registry must delegate to), provider, createdAt.',
+    "",
+    'Example: list_dns_zones() \u2192 { items: [{ publicId: "dnz_abc", domainName: "micci.dk", status: "active", nsRecords: ["ns1.hoststack.dev","ns2.hoststack.dev"] }] }'
+  ].join("\n"),
+  input: {},
+  handler: async (_args, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const response = await ctx.api.get(`/api/dns-zones/${teamId}`);
+    const items = Array.isArray(response.zones) ? response.zones.map(shape) : [];
+    const summary = items.length === 0 ? "No DNS zones hosted on this team. Create one in the dashboard (Domains \u2192 DNS)." : `Found ${items.length} hosted DNS zone${items.length === 1 ? "" : "s"}.`;
+    return respond({ summary, data: { items } });
+  }
+});
+defineTool({
+  name: "list_dns_records",
+  category: "dns",
+  description: [
+    "List every active record in a hosted DNS zone. Records are addressed by their type + name + value tuple; PowerDNS gathers records with the same (name, type) into an RRset on the wire.",
+    "",
+    "When to use: audit what is currently published for a zone before editing, verify a recently-created record landed, or read existing TXT verification strings.",
+    "",
+    'Provide EITHER zone_id (the zone publicId, e.g. "dnz_abc") OR domain (an apex or subdomain \u2014 the longest-matching hosted apex wins; "app.example.com" matches a hosted "example.com" zone).',
+    "",
+    'Returns: { zone: { publicId, domainName }, items: Record[] } \u2014 each record includes publicId, type, name ("@" for apex, or label), value, ttl, priority?, status ("active" | "syncing" | "failed"), managedBy ("user" | "hoststack" | "poststack"), createdAt.',
+    "",
+    'Example: list_dns_records({ domain: "micci.dk" }) \u2192 { zone: { domainName: "micci.dk", \u2026 }, items: [{ type: "TXT", name: "@", value: "google-site-verification=\u2026", ttl: 300, \u2026 }] }'
+  ].join("\n"),
+  input: {
+    zone_id: z7.string().optional().describe('Zone publicId (e.g. "dnz_abc").'),
+    domain: z7.string().optional().describe("Apex or subdomain \u2014 resolves to the longest-matching hosted zone.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const zoneInput = {};
+    if (args2.zone_id !== void 0) zoneInput.zone_id = args2.zone_id;
+    if (args2.domain !== void 0) zoneInput.domain = args2.domain;
+    const zone = await resolveZonePublicId(ctx.api, teamId, zoneInput);
+    const response = await ctx.api.get(
+      `/api/dns-zones/${teamId}/${zone.publicId}/records`
+    );
+    const items = Array.isArray(response.records) ? response.records.map(shape) : [];
+    const summary = items.length === 0 ? `Zone ${zone.domainName} has no records yet.` : `Returned ${items.length} record${items.length === 1 ? "" : "s"} for ${zone.domainName}.`;
+    return respond({
+      summary,
+      data: { zone: { publicId: zone.publicId, domainName: zone.domainName }, items }
+    });
+  }
+});
+defineTool({
+  name: "get_dns_record",
+  category: "dns",
+  description: [
+    'Fetch a single DNS record by its publicId. Useful for confirming the record landed after create_dns_record / update_dns_record (status transitions from "syncing" to "active" once PowerDNS acknowledges).',
+    "",
+    "When to use: verify a record exists, inspect its current ttl/value, or check the sync status of an in-flight write.",
+    "",
+    "Inputs:",
+    '  - record_id: record publicId (e.g. "dnr_abc"). Returned by list_dns_records and create_dns_record.',
+    "",
+    "Returns: { record: Record }. Mirrors the shape returned by list_dns_records.",
+    "",
+    'Example: get_dns_record({ record_id: "dnr_abc" }) \u2192 { record: { type: "TXT", name: "@", value: "\u2026", status: "active", \u2026 } }'
+  ].join("\n"),
+  input: {
+    record_id: z7.string().describe("Record publicId.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const { zones } = await ctx.api.get(`/api/dns-zones/${teamId}`);
+    for (const zone of zones) {
+      const { records } = await ctx.api.get(
+        `/api/dns-zones/${teamId}/${zone.publicId}/records`
+      );
+      const match = records.find((r) => r.publicId === args2.record_id);
+      if (match) {
+        return respond({
+          summary: `Record ${match.type} ${match.name} on ${zone.domainName}.`,
+          data: {
+            zone: { publicId: zone.publicId, domainName: zone.domainName },
+            record: shape(match)
+          }
+        });
+      }
+    }
+    return respondError(`Record ${args2.record_id} not found on any zone owned by this team.`);
+  }
+});
+defineTool({
+  name: "create_dns_record",
+  category: "dns",
+  description: [
+    'Create a DNS record on a hosted zone. Writes to the DB first, then mirrors to PowerDNS \u2014 record returns with status="syncing" until the provider acknowledges, then flips to "active". Re-creating the same (zone, type, name, value) tuple is idempotent and returns the existing row.',
+    "",
+    "When to use: add TXT verification records (Google Search Console, domain ownership challenges, DKIM), A/AAAA records pointing a subdomain at an IP, CNAME aliases, MX records, etc.",
+    "",
+    "Provide EITHER zone_id (zone publicId) OR domain (resolves via longest-suffix match against hosted zones).",
+    "",
+    "Inputs:",
+    '  - type: "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "NS" | "SRV" | "CAA" | "ALIAS".',
+    '  - name: "@" for the zone apex, or a subdomain label ("www", "api", "_acme-challenge").',
+    "  - content: the literal record value. For TXT pass the unquoted string \u2014 the PowerDNS layer handles quoting.",
+    "  - ttl (optional): 60\u201386400 seconds, default 3600.",
+    "  - priority (optional, required for MX and SRV): 0\u201365535.",
+    "",
+    "Returns: { record: Record } \u2014 see get_dns_record for the shape.",
+    "",
+    'Example: create_dns_record({ domain: "micci.dk", type: "TXT", name: "@", content: "google-site-verification=C0V0scK48g2\u2026", ttl: 300 })'
+  ].join("\n"),
+  input: {
+    zone_id: z7.string().optional().describe("Zone publicId."),
+    domain: z7.string().optional().describe("Apex or subdomain to resolve a hosted zone."),
+    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z7.string().min(1).max(253).describe('"@" for apex, or label (no trailing dot).'),
+    content: z7.string().min(1).max(2e3).describe("Record value; TXT values are unquoted."),
+    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+  },
+  handler: async (args2, ctx) => {
+    if ((args2.type === "MX" || args2.type === "SRV") && args2.priority === void 0) {
+      return respondError(`Priority is required for ${args2.type} records (0\u201365535).`);
+    }
+    const teamId = await ctx.resolveTeamId();
+    const zoneInput = {};
+    if (args2.zone_id !== void 0) zoneInput.zone_id = args2.zone_id;
+    if (args2.domain !== void 0) zoneInput.domain = args2.domain;
+    const zone = await resolveZonePublicId(ctx.api, teamId, zoneInput);
+    const body = {
+      type: args2.type,
+      name: args2.name,
+      value: args2.content
+    };
+    if (args2.ttl !== void 0) body.ttl = args2.ttl;
+    if (args2.priority !== void 0) body.priority = args2.priority;
+    const response = await ctx.api.post(
+      `/api/dns-zones/${teamId}/${zone.publicId}/records`,
+      body
+    );
+    return respond({
+      summary: `Created ${args2.type} ${args2.name} on ${zone.domainName}.`,
+      data: {
+        zone: { publicId: zone.publicId, domainName: zone.domainName },
+        record: shape(response.record)
+      }
+    });
+  }
+});
+defineTool({
+  name: "update_dns_record",
+  category: "dns",
+  description: [
+    "Update an existing DNS record by its publicId. Use this to change a TTL, swap a value, or move the record to a different (name, type) bucket. Full-record PUT semantics: every mutable field must be provided.",
+    "",
+    "When to use: rotate a DKIM key, repoint an A record at a new IP, bump TTL ahead of a planned change.",
+    "",
+    "Inputs:",
+    "  - record_id: record publicId.",
+    "  - type, name, content: the new values (the route is full-replace, not patch \u2014 fetch with get_dns_record first if you only want to tweak one field).",
+    "  - ttl (optional), priority (optional, required for MX / SRV).",
+    "",
+    "Returns: { record: Record } reflecting the new state.",
+    "",
+    'Example: update_dns_record({ record_id: "dnr_abc", type: "A", name: "api", content: "203.0.113.42", ttl: 300 })'
+  ].join("\n"),
+  input: {
+    record_id: z7.string().describe("Record publicId."),
+    type: z7.enum(DNS_RECORD_TYPES).describe("DNS record type."),
+    name: z7.string().min(1).max(253).describe('"@" for apex, or label.'),
+    content: z7.string().min(1).max(2e3).describe("Record value; TXT unquoted."),
+    ttl: z7.number().int().min(60).max(86400).optional().describe("TTL in seconds (default 3600)."),
+    priority: z7.number().int().min(0).max(65535).optional().describe("Required for MX / SRV.")
+  },
+  handler: async (args2, ctx) => {
+    if ((args2.type === "MX" || args2.type === "SRV") && args2.priority === void 0) {
+      return respondError(`Priority is required for ${args2.type} records (0\u201365535).`);
+    }
+    const teamId = await ctx.resolveTeamId();
+    const target = await findRecordZone(ctx.api, teamId, args2.record_id);
+    if (!target) {
+      return respondError(
+        `Record ${args2.record_id} not found on any zone owned by this team.`
+      );
+    }
+    const body = {
+      type: args2.type,
+      name: args2.name,
+      value: args2.content
+    };
+    if (args2.ttl !== void 0) body.ttl = args2.ttl;
+    if (args2.priority !== void 0) body.priority = args2.priority;
+    const response = await ctx.api.put(
+      `/api/dns-zones/${teamId}/${target.zone.publicId}/records/${args2.record_id}`,
+      body
+    );
+    return respond({
+      summary: `Updated ${args2.type} ${args2.name} on ${target.zone.domainName}.`,
+      data: {
+        zone: {
+          publicId: target.zone.publicId,
+          domainName: target.zone.domainName
+        },
+        record: shape(response.record)
+      }
+    });
+  }
+});
+defineTool({
+  name: "delete_dns_record",
+  category: "dns",
+  description: [
+    "Soft-delete a DNS record and remove it from PowerDNS. DESTRUCTIVE: resolvers stop returning the value as soon as the change propagates. Same code path as the dashboard delete button \u2014 the row is marked deleted and the RRset is re-pushed without it.",
+    "",
+    "When to use: retire a TXT verification record once the challenge has been confirmed; drop an A record for a decommissioned subdomain.",
+    "",
+    "Inputs:",
+    "  - record_id: record publicId.",
+    "",
+    "Returns: { ok: true }.",
+    "",
+    'Example: delete_dns_record({ record_id: "dnr_abc" }) \u2192 { ok: true }'
+  ].join("\n"),
+  input: {
+    record_id: z7.string().describe("Record publicId.")
+  },
+  handler: async (args2, ctx) => {
+    const teamId = await ctx.resolveTeamId();
+    const target = await findRecordZone(ctx.api, teamId, args2.record_id);
+    if (!target) {
+      return respondError(
+        `Record ${args2.record_id} not found on any zone owned by this team.`
+      );
+    }
+    await ctx.api.delete(
+      `/api/dns-zones/${teamId}/${target.zone.publicId}/records/${args2.record_id}`
+    );
+    return respond({
+      summary: `Deleted record ${args2.record_id} from ${target.zone.domainName}.`,
+      data: { ok: true }
+    });
+  }
+});
+async function findRecordZone(api, teamId, recordPublicId) {
+  const { zones } = await api.get(`/api/dns-zones/${teamId}`);
+  for (const zone of zones) {
+    const { records } = await api.get(
+      `/api/dns-zones/${teamId}/${zone.publicId}/records`
+    );
+    const match = records.find((r) => r.publicId === recordPublicId);
+    if (match) return { zone, record: match };
+  }
+  return null;
+}
+
+// src/tools/domains.ts
+import { z as z8 } from "zod";
 defineTool({
   name: "list_domains",
   category: "domains",
@@ -942,8 +1239,8 @@ defineTool({
     'Example: add_domain({ hostname: "api.example.com", service_id: "svc_abc" }) \u2192 { domain: { hostname: "api.example.com", dnsTargets: [...], verified: false, \u2026 } }'
   ].join("\n"),
   input: {
-    hostname: z7.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
-    service_id: z7.string().optional().describe("Optional service publicId to bind to.")
+    hostname: z8.string().min(3).max(253).describe("Fully-qualified hostname (e.g. api.example.com)."),
+    service_id: z8.string().optional().describe("Optional service publicId to bind to.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -973,7 +1270,7 @@ defineTool({
     'Example: verify_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z7.string().describe("Domain publicId.")
+    domain_id: z8.string().describe("Domain publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1000,7 +1297,7 @@ defineTool({
     'Example: remove_domain({ domain_id: "dom_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    domain_id: z7.string().describe("Domain publicId.")
+    domain_id: z8.string().describe("Domain publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1010,7 +1307,7 @@ defineTool({
 });
 
 // src/tools/env-vars.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 defineTool({
   name: "list_env_vars",
   category: "env-vars",
@@ -1027,7 +1324,7 @@ defineTool({
     'Example: list_env_vars({ service_id: "svc_abc" }) \u2192 { items: [{ key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", isSecret: true }, { key: "PORT", value: "3000", isSecret: false }] }'
   ].join("\n"),
   input: {
-    service_id: z8.string().describe("Service publicId.")
+    service_id: z9.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1056,10 +1353,10 @@ defineTool({
     'Example: set_env_var({ service_id: "svc_abc", key: "DATABASE_URL", value: "postgres://\u2026", is_secret: true }) \u2192 { envVar: { key: "DATABASE_URL", value: "\u2022\u2022\u2022\u2022\u2022\u2022", \u2026 }, action: "updated" }'
   ].join("\n"),
   input: {
-    service_id: z8.string().describe("Service publicId."),
-    key: z8.string().min(1).max(128).describe("Env-var key."),
-    value: z8.string().describe("New value."),
-    is_secret: z8.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true.")
+    service_id: z9.string().describe("Service publicId."),
+    key: z9.string().min(1).max(128).describe("Env-var key."),
+    value: z9.string().describe("New value."),
+    is_secret: z9.boolean().optional().describe("Mark as secret (encrypted, masked on read). Default true.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1111,8 +1408,8 @@ defineTool({
     'Example: delete_env_var({ service_id: "svc_abc", key: "OLD_FLAG" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z8.string().describe("Service publicId."),
-    key: z8.string().min(1).max(128).describe("Env-var key to delete.")
+    service_id: z9.string().describe("Service publicId."),
+    key: z9.string().min(1).max(128).describe("Env-var key to delete.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1148,12 +1445,12 @@ defineTool({
     'Example: bulk_set_env_vars({ service_id: "svc_abc", env_vars: [{ key: "PORT", value: "3000", is_secret: false }, { key: "DATABASE_URL", value: "\u2026", is_secret: true }] }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z8.string().describe("Service publicId."),
-    env_vars: z8.array(
-      z8.object({
-        key: z8.string().min(1).max(128),
-        value: z8.string(),
-        is_secret: z8.boolean().optional()
+    service_id: z9.string().describe("Service publicId."),
+    env_vars: z9.array(
+      z9.object({
+        key: z9.string().min(1).max(128),
+        value: z9.string(),
+        is_secret: z9.boolean().optional()
       })
     ).max(500).describe("Array of env-var rows. Hard cap 500.")
   },
@@ -1178,7 +1475,7 @@ defineTool({
 });
 
 // src/tools/environments.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 defineTool({
   name: "list_environments",
   category: "environments",
@@ -1195,7 +1492,7 @@ defineTool({
     'Example: list_environments({ project_id: "prj_abc" }) \u2192 { items: [{ name: "Production", type: "production", isDefault: true }, { name: "Staging", type: "staging" }] }'
   ].join("\n"),
   input: {
-    project_id: z9.string().describe("Project publicId.")
+    project_id: z10.string().describe("Project publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1224,10 +1521,10 @@ defineTool({
     'Example: create_environment({ project_id: "prj_abc", name: "Staging", type: "staging" }) \u2192 { environment: { id: 7, publicId: "environment_\u2026", name: "Staging", type: "staging" } }'
   ].join("\n"),
   input: {
-    project_id: z9.string().describe("Project publicId."),
-    name: z9.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
-    type: z9.enum(["production", "staging", "development", "preview"]).describe("Environment type \u2014 drives the hostname suffix."),
-    is_protected: z9.boolean().optional().describe("Require admin role for destructive actions. Default false.")
+    project_id: z10.string().describe("Project publicId."),
+    name: z10.string().min(1).max(64).describe("Environment name (1\u201364 chars)."),
+    type: z10.enum(["production", "staging", "development", "preview"]).describe("Environment type \u2014 drives the hostname suffix."),
+    is_protected: z10.boolean().optional().describe("Require admin role for destructive actions. Default false.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1261,8 +1558,8 @@ defineTool({
     'Example: delete_environment({ project_id: "prj_abc", environment_id: "environment_xyz" }) \u2192 { success: true }'
   ].join("\n"),
   input: {
-    project_id: z9.string().describe("Project publicId."),
-    environment_id: z9.union([z9.string(), z9.number()]).describe("Environment publicId or numeric id.")
+    project_id: z10.string().describe("Project publicId."),
+    environment_id: z10.union([z10.string(), z10.number()]).describe("Environment publicId or numeric id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1293,9 +1590,9 @@ defineTool({
     'Example: promote_deploy({ service_id: "svc_staging", deploy_id: "dpl_built", target_environment_id: "environment_prod" }) \u2192 { deploy: { id: 99, status: "pending", trigger: "rollback", dockerImageId: "sha256:\u2026" } }'
   ].join("\n"),
   input: {
-    service_id: z9.string().describe("Source service publicId."),
-    deploy_id: z9.string().describe("Source deploy publicId (must have a built image)."),
-    target_environment_id: z9.union([z9.string(), z9.number()]).describe("Target environment publicId or numeric id.")
+    service_id: z10.string().describe("Source service publicId."),
+    deploy_id: z10.string().describe("Source deploy publicId (must have a built image)."),
+    target_environment_id: z10.union([z10.string(), z10.number()]).describe("Target environment publicId or numeric id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1344,7 +1641,7 @@ defineTool({
 });
 
 // src/tools/notifications.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var NOTIFICATION_EVENTS = [
   "deploy.started",
   "deploy.succeeded",
@@ -1403,10 +1700,10 @@ defineTool({
     "Example: create_notification_channel({ type: 'slack', name: 'eng-alerts', webhook_url: 'https://hooks.slack.com/\u2026', events: ['deploy.failed', 'git.auth_failed', 'service.restart_failed'] })"
   ].join("\n"),
   input: {
-    type: z10.enum(["slack", "discord", "email"]).describe("Channel type."),
-    name: z10.string().min(1).max(128).describe("Human-readable label."),
-    webhook_url: z10.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
-    events: z10.array(z10.enum(NOTIFICATION_EVENTS)).describe("List of events the channel subscribes to. Empty list = subscribe to nothing.")
+    type: z11.enum(["slack", "discord", "email"]).describe("Channel type."),
+    name: z11.string().min(1).max(128).describe("Human-readable label."),
+    webhook_url: z11.string().max(500).describe("Slack/Discord webhook URL or email address (when type=email)."),
+    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).describe("List of events the channel subscribes to. Empty list = subscribe to nothing.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1442,10 +1739,10 @@ defineTool({
     "Example: update_notification_channel({ channel_id: 3, events: ['deploy.failed', 'service.restart_failed', 'git.auth_failed'] })"
   ].join("\n"),
   input: {
-    channel_id: z10.number().int().positive().describe("Numeric channel id from list_notification_channels."),
-    name: z10.string().min(1).max(128).optional().describe("New label."),
-    active: z10.boolean().optional().describe("false silences without deleting."),
-    events: z10.array(z10.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
+    channel_id: z11.number().int().positive().describe("Numeric channel id from list_notification_channels."),
+    name: z11.string().min(1).max(128).optional().describe("New label."),
+    active: z11.boolean().optional().describe("false silences without deleting."),
+    events: z11.array(z11.enum(NOTIFICATION_EVENTS)).optional().describe("Replaces the full subscription list.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1484,7 +1781,7 @@ defineTool({
     "Example: delete_notification_channel({ channel_id: 3 }) \u2192 { ok: true }"
   ].join("\n"),
   input: {
-    channel_id: z10.number().int().positive().describe("Numeric channel id.")
+    channel_id: z11.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1511,7 +1808,7 @@ defineTool({
     "Example: test_notification_channel({ channel_id: 3 }) \u2192 { success: true }"
   ].join("\n"),
   input: {
-    channel_id: z10.number().int().positive().describe("Numeric channel id.")
+    channel_id: z11.number().int().positive().describe("Numeric channel id.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1526,7 +1823,7 @@ defineTool({
 });
 
 // src/tools/projects.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 defineTool({
   name: "list_projects",
   category: "projects",
@@ -1566,9 +1863,9 @@ defineTool({
     'Example: create_project({ name: "billing-api", description: "Stripe webhooks", region: "fsn1" }) \u2192 { project: { id: 12, publicId: "prj_\u2026", \u2026 } }'
   ].join("\n"),
   input: {
-    name: z11.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
-    description: z11.string().max(500).optional().describe("Short description (\u2264500 chars)."),
-    region: z11.enum(["fsn1", "nbg1", "hel1"]).optional().describe("Hetzner region: fsn1 | nbg1 | hel1.")
+    name: z12.string().min(1).max(60).describe("Project name (1\u201360 chars)."),
+    description: z12.string().max(500).optional().describe("Short description (\u2264500 chars)."),
+    region: z12.enum(["fsn1", "nbg1", "hel1"]).optional().describe("Hetzner region: fsn1 | nbg1 | hel1.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1599,9 +1896,9 @@ defineTool({
     'Example: update_project({ project_id: "prj_abc", name: "billing-prod" }) \u2192 { project: { name: "billing-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z11.string().describe("Project publicId."),
-    name: z11.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
-    description: z11.string().max(500).optional().describe("New description (\u2264500 chars).")
+    project_id: z12.string().describe("Project publicId."),
+    name: z12.string().min(1).max(60).optional().describe("New name (1\u201360 chars)."),
+    description: z12.string().max(500).optional().describe("New description (\u2264500 chars).")
   },
   handler: async (args2, ctx) => {
     if (args2.name === void 0 && args2.description === void 0) {
@@ -1635,7 +1932,7 @@ defineTool({
     'Example: get_project({ project_id: "prj_abc" }) \u2192 { project: { id: 12, name: "billing", \u2026 } }'
   ].join("\n"),
   input: {
-    project_id: z11.string().describe("Project publicId (e.g. prj_abc123).")
+    project_id: z12.string().describe("Project publicId (e.g. prj_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1647,7 +1944,7 @@ defineTool({
 });
 
 // src/tools/services.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 defineTool({
   name: "list_services",
   category: "services",
@@ -1667,10 +1964,10 @@ defineTool({
     'Example: list_services({ status: "failed" }) \u2192 only services that need attention.'
   ].join("\n"),
   input: {
-    project_id: z12.union([z12.number().int().positive(), z12.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
-    environment_id: z12.union([z12.number().int().positive(), z12.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
-    status: z12.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
-    type: z12.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type.")
+    project_id: z13.union([z13.number().int().positive(), z13.string()]).optional().describe("Project filter \u2014 numeric id or publicId."),
+    environment_id: z13.union([z13.number().int().positive(), z13.string()]).optional().describe("Environment filter \u2014 numeric id or publicId."),
+    status: z13.enum(["active", "deploying", "suspended", "failed", "not_deployed"]).optional().describe("Filter by current runtime status."),
+    type: z13.enum(["web_service", "private_service", "worker", "cron_job", "static_site"]).optional().describe("Filter by service type.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1707,24 +2004,30 @@ defineTool({
   name: "get_service",
   category: "services",
   description: [
-    "Fetch a single service by ID, including its current status and configuration summary.",
+    "Fetch a single service by ID with its current status AND its service_config row (resources, health-check tuning, scaling, restart policy).",
     "",
-    "When to use: drilling into a service after list_services, checking deploy/runtime status, or grabbing the repo+branch before triggering a deploy.",
+    "When to use: drilling into a service after list_services, checking deploy/runtime status, grabbing the repo+branch before triggering a deploy, or inspecting the health-check / autoscale knobs before tweaking them via update_service_config.",
     "",
     "Inputs:",
     '  - service_id: publicId of the service (e.g. "svc_abc123").',
     "",
-    "Returns: { service: Service } \u2014 type, status, runtime, repoUrl, branch, autoDeploy, region, plan, createdAt, updatedAt.",
+    "Returns: { service: Service, config: ServiceConfig } \u2014 service has type/status/runtime/repoUrl/branch/autoDeploy/region/plan/timestamps; config has memoryMb, cpuShares, diskSizeGb, port, protocol, healthCheckEnabled, healthCheckInterval, healthCheckTimeout, healthCheckGracePeriodSec, restartPolicy, preDeployCommand, min/maxInstances, scale thresholds.",
     "",
-    'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 } }'
+    'Example: get_service({ service_id: "svc_abc" }) \u2192 { service: { type: "web", status: "running", \u2026 }, config: { healthCheckGracePeriodSec: 120, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z13.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
-    const response = await ctx.hoststack.services.get(teamId, args2.service_id);
-    const data = { service: shapeService(response.service) };
+    const [serviceResponse, configResponse] = await Promise.all([
+      ctx.hoststack.services.get(teamId, args2.service_id),
+      ctx.hoststack.services.getConfig(teamId, args2.service_id)
+    ]);
+    const data = {
+      service: shapeService(serviceResponse.service),
+      config: shape(configResponse.config)
+    };
     const status = data.service && "status" in data.service ? data.service.status : "unknown";
     return respond({ summary: `Service ${args2.service_id} is ${status}.`, data });
   }
@@ -1745,7 +2048,7 @@ defineTool({
     'Example: get_service_metrics({ service_id: "svc_abc" }) \u2192 { metrics: { cpu: 0.42, memory: 0.71, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId.")
+    service_id: z13.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1774,9 +2077,9 @@ defineTool({
     'Example: get_service_metrics_history({ service_id: "svc_abc", from: "-1h" }) \u2192 60-ish points for the last hour.'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId."),
-    from: z12.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
-    to: z12.string().optional().describe("ISO-8601 upper bound; defaults to now.")
+    service_id: z13.string().describe("Service publicId."),
+    from: z13.string().optional().describe('ISO-8601 lower bound or relative offset (e.g. "-1h", "-2d").'),
+    to: z13.string().optional().describe("ISO-8601 upper bound; defaults to now.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1820,8 +2123,8 @@ defineTool({
     'Example: update_service({ service_id: "svc_abc", name: "api-prod" }) \u2192 { service: { name: "api-prod", \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId."),
-    name: z12.string().min(1).max(60).describe("New service name (1\u201360 chars).")
+    service_id: z13.string().describe("Service publicId."),
+    name: z13.string().min(1).max(60).describe("New service name (1\u201360 chars).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1836,9 +2139,9 @@ defineTool({
   name: "update_service_config",
   category: "services",
   description: [
-    "Update build/runtime configuration for a service: build command, start command, install command, branch, root directory, dockerfile path, auto-deploy flag, instance count. All fields optional \u2014 pass only what you want to change.",
+    "Update build/runtime configuration for a service. All fields optional \u2014 pass only what you want to change.",
     "",
-    "When to use: the user wants to tweak how a service builds or runs. Build/runtime fields (branch, install/build/start command, root, dockerfile) take effect on the next deploy \u2014 call trigger_deploy after if you need them applied immediately. instance_count rescales without a redeploy.",
+    "When to use: the user wants to tweak how a service builds, runs, scales, or health-checks. Build/runtime fields (branch, install/build/start command, root, dockerfile) take effect on the next deploy \u2014 call trigger_deploy after if you need them applied immediately. Instance_count, resource and health-check changes rescale or rewire without a redeploy.",
     "",
     "Inputs:",
     "  - service_id: publicId of the service.",
@@ -1847,27 +2150,59 @@ defineTool({
     "  - root_directory (optional): build context root inside the repo.",
     "  - dockerfile_path (optional): path to Dockerfile relative to root_directory. Pass null to clear.",
     "  - auto_deploy (optional): boolean \u2014 auto-deploy on git push.",
-    "  - instance_count (optional): integer \u22651 \u2014 pin both min and max instances to this value.",
+    '  - health_check_path (optional): HTTP path the platform GETs to verify liveness (e.g. "/health"). Pass null for TCP-only check.',
+    "  - health_check_enabled (optional): boolean \u2014 toggle health checking on/off.",
+    "  - health_check_interval (optional): integer 5\u2013300 seconds \u2014 how often the check runs.",
+    "  - health_check_timeout (optional): integer 1\u201360 seconds \u2014 single-attempt timeout.",
+    '  - health_check_grace_period_sec (optional): integer 1\u20131800 seconds \u2014 startup tolerance before failures count. RAISE THIS (e.g. 180) when the agent reports "Health check timed out" on a cold-boot app (Bun + Vite SSR typically need 90\u2013180s).',
+    "  - memory_mb (optional): integer 128\u201316384 \u2014 container memory cap.",
+    "  - cpu_shares (optional): integer 128\u20134096 \u2014 relative CPU weight.",
+    "  - disk_size_gb (optional): integer 1\u2013100 \u2014 ephemeral disk cap.",
+    "  - port (optional): integer 1\u201365535 \u2014 container port the platform forwards traffic to.",
+    '  - protocol (optional): "http" | "tcp".',
+    '  - restart_policy (optional): "always" | "on-failure" | "no".',
+    "  - pre_deploy_command (optional): shell command run before the new release accepts traffic (typical use: migrations).",
+    "  - instance_count (optional): integer 1\u201350 \u2014 pin both min and max instances to this value.",
+    "  - min_instances, max_instances (optional): integers \u2014 autoscale bounds. Use instead of instance_count when you want a range.",
+    "  - scale_cpu_threshold, scale_memory_threshold (optional): integer 10\u2013100 \u2014 autoscale trigger percentage.",
     '  - log_filter_rules (optional): list of { pattern, action } rules applied to runtime logs at query time. Pattern matches the message by case-insensitive substring; action is "drop" (filter out) or "downgrade" (flip stderr \u2192 stdout so it stops looking like an error). Pass [] to clear all rules. Capped at 50 rules.',
     "",
     "Returns: { service?: Service, config?: ServiceConfig } \u2014 whichever rows were touched.",
     "",
-    'Example: update_service_config({ service_id: "svc_abc", start_command: "bun apps/api/src/index.ts" }) \u2192 { service: { startCommand: "bun apps/api/src/index.ts", \u2026 } }'
+    'Example: update_service_config({ service_id: "svc_abc", health_check_grace_period_sec: 180 }) \u2192 { config: { healthCheckGracePeriodSec: 180, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId."),
-    install_command: z12.string().nullable().optional().describe("Install shell command. Null clears."),
-    build_command: z12.string().nullable().optional().describe("Build shell command. Null clears."),
-    start_command: z12.string().nullable().optional().describe("Start shell command. Null clears."),
-    branch: z12.string().optional().describe("Git branch to track."),
-    root_directory: z12.string().optional().describe("Build context root."),
-    dockerfile_path: z12.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
-    auto_deploy: z12.boolean().optional().describe("Auto-deploy on push."),
-    instance_count: z12.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
-    log_filter_rules: z12.array(
-      z12.object({
-        pattern: z12.string().min(1).max(200),
-        action: z12.enum(["drop", "downgrade"])
+    service_id: z13.string().describe("Service publicId."),
+    install_command: z13.string().nullable().optional().describe("Install shell command. Null clears."),
+    build_command: z13.string().nullable().optional().describe("Build shell command. Null clears."),
+    start_command: z13.string().nullable().optional().describe("Start shell command. Null clears."),
+    branch: z13.string().optional().describe("Git branch to track."),
+    root_directory: z13.string().optional().describe("Build context root."),
+    dockerfile_path: z13.string().nullable().optional().describe("Path to Dockerfile relative to root. Null clears."),
+    auto_deploy: z13.boolean().optional().describe("Auto-deploy on push."),
+    health_check_path: z13.string().nullable().optional().describe('HTTP health-check path (e.g. "/health"). Null = TCP-only check.'),
+    health_check_enabled: z13.boolean().optional().describe("Toggle health checking on/off."),
+    health_check_interval: z13.number().int().min(5).max(300).optional().describe("How often the check runs, in seconds (5\u2013300)."),
+    health_check_timeout: z13.number().int().min(1).max(60).optional().describe("Single-attempt timeout in seconds (1\u201360)."),
+    health_check_grace_period_sec: z13.number().int().min(1).max(1800).optional().describe(
+      "Startup grace period in seconds (1\u20131800). Raise this if the app needs more time to boot before health checks start counting failures."
+    ),
+    memory_mb: z13.number().int().min(128).max(16384).optional().describe("Container memory cap in MB (128\u201316384)."),
+    cpu_shares: z13.number().int().min(128).max(4096).optional().describe("Relative CPU weight (128\u20134096)."),
+    disk_size_gb: z13.number().int().min(1).max(100).optional().describe("Ephemeral disk size in GB (1\u2013100)."),
+    port: z13.number().int().min(1).max(65535).optional().describe("Container port the platform forwards traffic to."),
+    protocol: z13.enum(["http", "tcp"]).optional().describe("Traffic protocol."),
+    restart_policy: z13.enum(["always", "on-failure", "no"]).optional().describe("Docker restart policy."),
+    pre_deploy_command: z13.string().optional().describe("Shell command run before the new release accepts traffic."),
+    instance_count: z13.number().int().positive().max(50).optional().describe("Pin min and max instances to this value (1\u201350)."),
+    min_instances: z13.number().int().min(0).max(50).optional().describe("Autoscale lower bound. Use with max_instances for a range."),
+    max_instances: z13.number().int().min(1).max(50).optional().describe("Autoscale upper bound. Use with min_instances for a range."),
+    scale_cpu_threshold: z13.number().int().min(10).max(100).optional().describe("Autoscale CPU trigger percentage (10\u2013100)."),
+    scale_memory_threshold: z13.number().int().min(10).max(100).optional().describe("Autoscale memory trigger percentage (10\u2013100)."),
+    log_filter_rules: z13.array(
+      z13.object({
+        pattern: z13.string().min(1).max(200),
+        action: z13.enum(["drop", "downgrade"])
       })
     ).max(50).optional().describe(
       "Runtime-log filter rules. Empty array [] clears all rules. Each pattern is case-insensitive substring match against the message."
@@ -1885,11 +2220,35 @@ defineTool({
     if (args2.branch !== void 0) serviceUpdate["branch"] = args2.branch;
     if (args2.root_directory !== void 0) serviceUpdate["rootDirectory"] = args2.root_directory;
     if (args2.auto_deploy !== void 0) serviceUpdate["autoDeploy"] = args2.auto_deploy;
+    if (args2.health_check_path !== void 0)
+      serviceUpdate["healthCheckPath"] = args2.health_check_path;
     const configUpdate = {};
+    if (args2.health_check_enabled !== void 0)
+      configUpdate["healthCheckEnabled"] = args2.health_check_enabled;
+    if (args2.health_check_interval !== void 0)
+      configUpdate["healthCheckInterval"] = args2.health_check_interval;
+    if (args2.health_check_timeout !== void 0)
+      configUpdate["healthCheckTimeout"] = args2.health_check_timeout;
+    if (args2.health_check_grace_period_sec !== void 0)
+      configUpdate["healthCheckGracePeriodSec"] = args2.health_check_grace_period_sec;
+    if (args2.memory_mb !== void 0) configUpdate["memoryMb"] = args2.memory_mb;
+    if (args2.cpu_shares !== void 0) configUpdate["cpuShares"] = args2.cpu_shares;
+    if (args2.disk_size_gb !== void 0) configUpdate["diskSizeGb"] = args2.disk_size_gb;
+    if (args2.port !== void 0) configUpdate["port"] = args2.port;
+    if (args2.protocol !== void 0) configUpdate["protocol"] = args2.protocol;
+    if (args2.restart_policy !== void 0) configUpdate["restartPolicy"] = args2.restart_policy;
+    if (args2.pre_deploy_command !== void 0)
+      configUpdate["preDeployCommand"] = args2.pre_deploy_command;
     if (args2.instance_count !== void 0) {
       configUpdate["minInstances"] = args2.instance_count;
       configUpdate["maxInstances"] = args2.instance_count;
     }
+    if (args2.min_instances !== void 0) configUpdate["minInstances"] = args2.min_instances;
+    if (args2.max_instances !== void 0) configUpdate["maxInstances"] = args2.max_instances;
+    if (args2.scale_cpu_threshold !== void 0)
+      configUpdate["scaleCpuThreshold"] = args2.scale_cpu_threshold;
+    if (args2.scale_memory_threshold !== void 0)
+      configUpdate["scaleMemoryThreshold"] = args2.scale_memory_threshold;
     if (args2.log_filter_rules !== void 0) {
       configUpdate["logFilterRules"] = args2.log_filter_rules;
     }
@@ -1938,7 +2297,7 @@ defineTool({
     'Example: suspend_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId.")
+    service_id: z13.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1962,7 +2321,7 @@ defineTool({
     'Example: resume_service({ service_id: "svc_dev" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId.")
+    service_id: z13.string().describe("Service publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -1996,16 +2355,16 @@ defineTool({
     '  - Just count error lines without fetching them: get_service_logs({ service_id: "svc_abc", level: "error", since: "-5m", count_only: true }) \u2192 { count: 47 }'
   ].join("\n"),
   input: {
-    service_id: z12.string().describe("Service publicId."),
-    lines: z12.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
-    since: z12.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z12.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z12.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z12.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
+    service_id: z13.string().describe("Service publicId."),
+    lines: z13.number().int().positive().max(1e3).optional().describe("Tail size; default 200, hard cap 1000."),
+    since: z13.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z13.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z13.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z13.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe(
       "Filter by structured JSON log level (pino/bunyan/severity). Falls back to a stream-alias hint for plain-text logs (info/debug\u2192stdout, warn/error/fatal\u2192stderr)."
     ),
-    search: z12.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z12.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
+    search: z13.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z13.boolean().optional().describe("When true, return only { count } \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2054,14 +2413,14 @@ defineTool({
     'Example: get_service_logs_bulk({ service_ids: ["svc_api", "svc_worker"], level: "error", since: "-15m", count_only: true }) \u2192 { results: { svc_api: { count: 0 }, svc_worker: { count: 12 } } }.'
   ].join("\n"),
   input: {
-    service_ids: z12.array(z12.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
-    lines_per_service: z12.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
-    since: z12.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
-    until: z12.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
-    stream: z12.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
-    level: z12.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
-    search: z12.string().max(100).optional().describe("Case-insensitive substring filter."),
-    count_only: z12.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
+    service_ids: z13.array(z13.string()).min(1).max(10).describe("Service publicIds (1\u201310). Hard cap 10 to bound parallel work."),
+    lines_per_service: z13.number().int().positive().max(500).optional().describe("Tail size per service; default 100, hard cap 500."),
+    since: z13.string().optional().describe('ISO-8601 timestamp or relative offset (e.g. "-5m", "-1h").'),
+    until: z13.string().optional().describe("ISO-8601 timestamp or relative offset upper bound."),
+    stream: z13.enum(["stdout", "stderr"]).optional().describe("Restrict to one stream."),
+    level: z13.enum(["stdout", "stderr", "trace", "debug", "info", "warn", "error", "fatal"]).optional().describe("Structured log level filter (same as get_service_logs)."),
+    search: z13.string().max(100).optional().describe("Case-insensitive substring filter."),
+    count_only: z13.boolean().optional().describe("When true, return only counts per service \u2014 skips the log payload.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2107,7 +2466,7 @@ defineTool({
 });
 
 // src/tools/volumes.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 defineTool({
   name: "list_volumes",
   category: "volumes",
@@ -2124,7 +2483,7 @@ defineTool({
     'Example: list_volumes({ service_id: "svc_abc" }) \u2192 { items: [{ name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" }] }'
   ].join("\n"),
   input: {
-    service_id: z13.string().describe("Service publicId (e.g. svc_abc123).")
+    service_id: z14.string().describe("Service publicId (e.g. svc_abc123).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2153,10 +2512,10 @@ defineTool({
     'Example: create_volume({ service_id: "svc_abc", name: "data", mount_path: "/var/data", size_gb: 10 }) \u2192 { volume: { name: "data", mountPath: "/var/data", sizeGb: 10, status: "active" } }'
   ].join("\n"),
   input: {
-    service_id: z13.string().describe("Service publicId."),
-    name: z13.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
-    mount_path: z13.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
-    size_gb: z13.number().int().min(1).max(100).optional().describe("Disk size in GB (default 1, max 100).")
+    service_id: z14.string().describe("Service publicId."),
+    name: z14.string().min(1).max(64).regex(/^[a-z0-9-]+$/).describe("Volume name (lowercase alphanumeric + hyphens)."),
+    mount_path: z14.string().startsWith("/").max(500).describe("In-container mount path (absolute)."),
+    size_gb: z14.number().int().min(1).max(100).optional().describe("Disk size in GB (default 1, max 100).")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2192,10 +2551,10 @@ defineTool({
     'Example: update_volume({ service_id: "svc_abc", volume_id: "vol_xyz", size_gb: 20 }) \u2192 { volume: { sizeGb: 20, \u2026 } }'
   ].join("\n"),
   input: {
-    service_id: z13.string().describe("Service publicId."),
-    volume_id: z13.string().describe("Volume publicId (e.g. vol_\u2026)."),
-    mount_path: z13.string().startsWith("/").max(500).optional().describe("New mount path."),
-    size_gb: z13.number().int().min(1).max(100).optional().describe("New size in GB.")
+    service_id: z14.string().describe("Service publicId."),
+    volume_id: z14.string().describe("Volume publicId (e.g. vol_\u2026)."),
+    mount_path: z14.string().startsWith("/").max(500).optional().describe("New mount path."),
+    size_gb: z14.number().int().min(1).max(100).optional().describe("New size in GB.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2233,8 +2592,8 @@ defineTool({
     'Example: delete_volume({ service_id: "svc_abc", volume_id: "vol_xyz" }) \u2192 { ok: true }'
   ].join("\n"),
   input: {
-    service_id: z13.string().describe("Service publicId."),
-    volume_id: z13.string().describe("Volume publicId.")
+    service_id: z14.string().describe("Service publicId."),
+    volume_id: z14.string().describe("Volume publicId.")
   },
   handler: async (args2, ctx) => {
     const teamId = await ctx.resolveTeamId();
@@ -2248,7 +2607,7 @@ defineTool({
 
 // src/server-factory.ts
 var PACKAGE_NAME = "hoststack";
-var PACKAGE_VERSION = "0.1.2";
+var PACKAGE_VERSION = "0.6.0";
 function createMcpServer(options) {
   const baseUrl2 = (options.baseUrl ?? "https://hoststack.dev").replace(/\/$/, "");
   const hoststack = new HostStack({ apiKey: options.apiKey, baseUrl: baseUrl2 });