@mgsoftwarebv/mg-dashboard-mcp 6.4.0 → 6.6.0

package/dist/index.js

@@ -11,7 +11,7 @@ import { createServer as createServer$1 } from 'net';
 import { Client } from 'ssh2';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { createServer } from 'http';
-import { randomUUID, createHash, randomBytes, createDecipheriv, createCipheriv } from 'crypto';
+import { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto';
 import { sql } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
@@ -460,7 +460,7 @@ var connectionConfig = {
     }
   },
   connection: {
-    application_name: `mg-dashboard-${process.env.VERCEL ? "vercel" : process.env.TRIGGER_RUN_ID ? "trigger" : "local"}`
+    application_name: `mg-dashboard-${process.env.TRIGGER_RUN_ID ? "trigger" : "local"}`
   }
 };
 function getDatabaseUrl() {
@@ -556,10 +556,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-run": "ci_cd"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql4 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql3 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql4}" 2>/dev/null | tr -d '[:space:]')`,
+    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql3}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$KEY"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -580,8 +580,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2 };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql4 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql4}" 2>/dev/null`;
+  const sql3 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql3}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -663,8 +663,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql4 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql4}" 2>/dev/null`;
+      const sql3 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql3}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -859,621 +859,6 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
     }]
   };
 }
-var VERCEL_API = "https://api.vercel.com";
-var VERCEL_TOOLS = [
-  {
-    name: "vercel-projects",
-    description: "List Vercel projects in the configured account/team. Returns id, name, framework, GitHub repo link, production URL, and the latest deployment summary. Use the project name or id as input to vercel-deployments.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        limit: { type: "number", description: "Max projects to return (default 50, max 200)" },
-        search: { type: "string", description: "Substring filter on project name (case-insensitive)" }
-      }
-    }
-  },
-  {
-    name: "vercel-deployments",
-    description: "List recent deployments for a Vercel project. Returns deployment ID, state, target, branch, commit and timestamps. Use the deployment ID with vercel-logs.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        project: { type: "string", description: "Vercel project ID or name (from vercel-projects)" },
-        state: {
-          type: "string",
-          description: "Optional state filter: BUILDING, ERROR, INITIALIZING, QUEUED, READY, CANCELED"
-        },
-        target: { type: "string", description: "Optional target filter: production or preview" },
-        limit: { type: "number", description: "Max deployments to return (default 20, max 100)" }
-      },
-      required: ["project"]
-    }
-  },
-  {
-    name: "vercel-domains",
-    description: 'Manage domains attached to a Vercel project. Use `action` to pick the operation:\n- "list" (default): list all domains attached to the project, including verification status and any redirect.\n- "add": attach a new domain to the project. Returns DNS records to set if the domain is not yet verified.\n- "verify": re-check verification status and surface required CNAME / A / TXT records if misconfigured.\n- "remove": detach a domain from the project.\nPick the project via vercel-projects first.',
-    inputSchema: {
-      type: "object",
-      properties: {
-        action: {
-          type: "string",
-          enum: ["list", "add", "remove", "verify"],
-          description: "Which operation to perform (default: list)."
-        },
-        project: {
-          type: "string",
-          description: "Vercel project ID or name (from vercel-projects)."
-        },
-        domain: {
-          type: "string",
-          description: 'Domain name (required for action="add", "remove", or "verify").'
-        },
-        gitBranch: {
-          type: "string",
-          description: 'Optional git branch this domain should deploy from (action="add" only).'
-        },
-        redirect: {
-          type: "string",
-          description: 'Optional redirect target domain (action="add" only).'
-        },
-        redirectStatusCode: {
-          type: "number",
-          description: 'Optional redirect status code, e.g. 301 / 302 / 307 / 308 (action="add" only).'
-        }
-      },
-      required: ["project"]
-    }
-  },
-  {
-    name: "vercel-logs",
-    description: 'Unified log inspector for Vercel. Use `kind` to pick the source:\n- "build" (default): build / deployment console events (stdout, stderr, command, exit). Requires deploymentId.\n- "runtime": runtime / function logs after a successful build. Requires project + deploymentId.\n- "webhooks": our own vercel_webhook_logs table (Telegram / push delivery history). No deployment needed.\nPick deployments via vercel-deployments first.',
-    inputSchema: {
-      type: "object",
-      properties: {
-        kind: {
-          type: "string",
-          enum: ["build", "runtime", "webhooks"],
-          description: "Which log stream to fetch (default: build)."
-        },
-        project: {
-          type: "string",
-          description: 'Vercel project ID or name (required for kind="runtime").'
-        },
-        deploymentId: {
-          type: "string",
-          description: 'Vercel deployment ID (required for kind="build" or "runtime").'
-        },
-        projectName: {
-          type: "string",
-          description: 'Optional project_name filter (kind="webhooks" only).'
-        },
-        status: {
-          type: "string",
-          description: 'Optional status filter (kind="webhooks" only): sent, skipped, error.'
-        },
-        sinceMinutes: {
-          type: "number",
-          description: `Time window in minutes (kind="runtime" only, max 7 days). When omitted, the tool auto-detects the deployment's created timestamp and queries from there with a 5-minute buffer \u2014 so you don't miss logs by picking a too-small window.`
-        },
-        limit: {
-          type: "number",
-          description: "Max entries to return. Defaults per kind: build=500 (max 5000), runtime=200 (max 1000), webhooks=25 (max 200)."
-        }
-      }
-    }
-  }
-];
-var VERCEL_TOOL_NAMES = new Set(VERCEL_TOOLS.map((t) => t.name));
-var VERCEL_TOOL_MODULE_MAP = {
-  "vercel-projects": "ci_cd",
-  "vercel-deployments": "ci_cd",
-  "vercel-logs": "ci_cd",
-  "vercel-domains": "ci_cd"
-};
-async function vercelFetch(token, path, init) {
-  const res = await fetch(`${VERCEL_API}${path}`, {
-    method: init?.method ?? "GET",
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
-  });
-  const body = await res.text();
-  let parsed = null;
-  try {
-    parsed = body ? JSON.parse(body) : null;
-  } catch {
-  }
-  if (!res.ok) {
-    const msg = parsed?.error?.message ?? parsed?.message ?? body ?? `HTTP ${res.status}`;
-    return { data: null, error: `Vercel API ${res.status}: ${msg}`, status: res.status };
-  }
-  return { data: parsed, error: null, status: res.status };
-}
-async function listVercelProjectsAll(token, limit) {
-  const collected = [];
-  let nextTimestamp;
-  while (collected.length < limit) {
-    const params = new URLSearchParams({ limit: String(Math.min(limit - collected.length, 100)) });
-    if (nextTimestamp) params.set("until", String(nextTimestamp));
-    const res = await vercelFetch(token, `/v9/projects?${params.toString()}`);
-    if (res.error) return { projects: [], error: res.error };
-    if (!res.data?.projects?.length) break;
-    collected.push(...res.data.projects);
-    if (!res.data.pagination?.next) break;
-    nextTimestamp = res.data.pagination.next;
-  }
-  return { projects: collected, error: null };
-}
-async function listVercelDeployments(token, options) {
-  const params = new URLSearchParams({
-    limit: String(options.limit),
-    projectId: options.projectId
-  });
-  if (options.state) params.set("state", options.state);
-  if (options.target) params.set("target", options.target);
-  const res = await vercelFetch(
-    token,
-    `/v6/deployments?${params.toString()}`
-  );
-  if (res.error) return { deployments: [], error: res.error };
-  return { deployments: res.data?.deployments ?? [], error: null };
-}
-async function getDeploymentBuildEvents(token, deploymentId, limit) {
-  const params = new URLSearchParams({
-    limit: String(limit),
-    direction: "forward",
-    follow: "0"
-  });
-  const url = `${VERCEL_API}/v3/deployments/${encodeURIComponent(deploymentId)}/events?${params.toString()}`;
-  const res = await fetch(url, {
-    headers: { Authorization: `Bearer ${token}` }
-  });
-  const body = await res.text();
-  if (!res.ok) {
-    let msg = body;
-    try {
-      const parsed = JSON.parse(body);
-      msg = parsed?.error?.message ?? parsed?.message ?? body;
-    } catch {
-    }
-    return { events: [], error: `Vercel API ${res.status}: ${msg}` };
-  }
-  const events = [];
-  const trimmed = body.trim();
-  if (!trimmed) return { events, error: null };
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (Array.isArray(parsed)) {
-      for (const r of parsed) events.push(r);
-      return { events, error: null };
-    }
-  } catch {
-  }
-  for (const line of trimmed.split("\n")) {
-    const s = line.trim();
-    if (!s) continue;
-    try {
-      events.push(JSON.parse(s));
-    } catch {
-    }
-  }
-  return { events, error: null };
-}
-async function getDeploymentCreatedMs(token, deploymentId) {
-  const res = await vercelFetch(
-    token,
-    `/v13/deployments/${encodeURIComponent(deploymentId)}`
-  );
-  if (res.error || !res.data) return null;
-  return res.data.createdAt ?? res.data.created ?? null;
-}
-async function getRuntimeLogs(token, projectIdOrName, deploymentId, limit, sinceMs) {
-  const params = new URLSearchParams({
-    limit: String(Math.min(Math.max(limit, 1), 1e3))
-  });
-  if (sinceMs) params.set("since", String(sinceMs));
-  const url = `${VERCEL_API}/v1/projects/${encodeURIComponent(projectIdOrName)}/deployments/${encodeURIComponent(deploymentId)}/runtime-logs?${params.toString()}`;
-  const res = await fetch(url, {
-    headers: { Authorization: `Bearer ${token}` }
-  });
-  const body = await res.text();
-  if (!res.ok) {
-    let msg = body;
-    try {
-      const parsed = JSON.parse(body);
-      msg = parsed?.error?.message ?? parsed?.message ?? body;
-    } catch {
-    }
-    return { logs: [], error: `Vercel API ${res.status}: ${msg}` };
-  }
-  const logs = [];
-  const trimmed = body.trim();
-  if (!trimmed) return { logs, error: null };
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (Array.isArray(parsed)) {
-      for (const r of parsed) logs.push(r);
-      return { logs, error: null };
-    }
-  } catch {
-  }
-  for (const line of trimmed.split("\n")) {
-    const s = line.trim();
-    if (!s) continue;
-    try {
-      logs.push(JSON.parse(s));
-    } catch {
-    }
-  }
-  return { logs, error: null };
-}
-async function listProjectDomains(token, projectId) {
-  const res = await vercelFetch(
-    token,
-    `/v9/projects/${encodeURIComponent(projectId)}/domains?limit=100`
-  );
-  if (res.error) return { domains: [], error: res.error };
-  return { domains: res.data?.domains ?? [], error: null };
-}
-async function addProjectDomain(token, projectId, body) {
-  const res = await vercelFetch(
-    token,
-    `/v10/projects/${encodeURIComponent(projectId)}/domains`,
-    { method: "POST", body }
-  );
-  if (res.error) return { domain: null, error: res.error };
-  return { domain: res.data, error: null };
-}
-async function removeProjectDomain(token, projectId, domain) {
-  const res = await vercelFetch(
-    token,
-    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`,
-    { method: "DELETE" }
-  );
-  return { error: res.error };
-}
-async function getProjectDomain(token, projectId, domain) {
-  const res = await vercelFetch(
-    token,
-    `/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}`
-  );
-  if (res.error) return { domain: null, error: res.error };
-  return { domain: res.data, error: null };
-}
-async function getDomainConfig(token, domain) {
-  const res = await vercelFetch(
-    token,
-    `/v6/domains/${encodeURIComponent(domain)}/config`
-  );
-  if (res.error) return { config: null, error: res.error };
-  return { config: res.data, error: null };
-}
-async function getVercelToken(deps) {
-  const rows = await deps.db.execute(sql`
-    SELECT vercel_token_encrypted FROM app_setting LIMIT 1
-  `);
-  const data = rows[0];
-  if (!data?.vercel_token_encrypted) {
-    throw new Error("Vercel API token is not configured. Add it in dashboard Settings.");
-  }
-  try {
-    return deps.decrypt(data.vercel_token_encrypted);
-  } catch {
-    throw new Error("Failed to decrypt the stored Vercel API token.");
-  }
-}
-async function resolveProjectId(token, projectInput) {
-  const res = await vercelFetch(
-    token,
-    `/v9/projects/${encodeURIComponent(projectInput)}`
-  );
-  if (res.error || !res.data?.id) {
-    throw new Error(
-      `Could not resolve Vercel project "${projectInput}": ${res.error ?? "not found"}`
-    );
-  }
-  return res.data.id;
-}
-function formatTimestamp(ms) {
-  if (!ms) return "";
-  return new Date(ms).toLocaleString("nl-NL", { timeZone: "Europe/Amsterdam" });
-}
-function formatProjectsTable(projects) {
-  if (projects.length === 0) return "No Vercel projects found";
-  const lines = projects.map((p) => {
-    const repo = p.link ? `${p.link.org ?? ""}/${p.link.repo ?? ""}` : "";
-    const prodUrl = p.targets?.production?.alias?.[0] ?? p.targets?.production?.url ?? "";
-    const latest = p.latestDeployments?.[0];
-    const latestStr = latest ? `${latest.state} @ ${formatTimestamp(latest.createdAt)}` : "";
-    return `${p.id.padEnd(28)}  ${(p.name || "").padEnd(40)}  ${(p.framework || "-").padEnd(10)}  ${repo.padEnd(40)}  ${prodUrl.padEnd(35)}  ${latestStr}`;
-  });
-  const header = `${"ID".padEnd(28)}  ${"NAME".padEnd(40)}  ${"FRAMEWORK".padEnd(10)}  ${"REPO".padEnd(40)}  ${"PROD URL".padEnd(35)}  LATEST`;
-  return `${header}
-${"-".repeat(header.length)}
-${lines.join("\n")}`;
-}
-function formatDeploymentsTable(deployments) {
-  if (deployments.length === 0) return "No deployments found";
-  const lines = deployments.map((d) => {
-    const branch = d.meta?.githubCommitRef ?? "";
-    const sha = d.meta?.githubCommitSha?.slice(0, 7) ?? "";
-    const msg = (d.meta?.githubCommitMessage ?? "").replace(/\n.*/s, "").slice(0, 60);
-    return `${d.uid.padEnd(28)}  ${d.state.padEnd(11)}  ${(d.target || "-").padEnd(10)}  ${branch.padEnd(20)}  ${sha.padEnd(8)}  ${formatTimestamp(d.created).padEnd(20)}  ${msg}`;
-  });
-  const header = `${"ID".padEnd(28)}  ${"STATE".padEnd(11)}  ${"TARGET".padEnd(10)}  ${"BRANCH".padEnd(20)}  ${"COMMIT".padEnd(8)}  ${"CREATED".padEnd(20)}  MESSAGE`;
-  return `${header}
-${"-".repeat(header.length)}
-${lines.join("\n")}`;
-}
-function formatBuildEvents(events) {
-  if (events.length === 0) return "No build events found for this deployment";
-  const filtered = events.filter(
-    (e) => ["command", "stdout", "stderr", "exit", "delimiter", "deployment-state"].includes(e.type)
-  );
-  return filtered.map((e) => {
-    const time = e.created ? new Date(e.created).toISOString().slice(11, 19) : "--:--:--";
-    const text = (e.payload?.text ?? e.text ?? "").replace(/\s+$/u, "");
-    const prefix = e.type === "stderr" ? "!" : " ";
-    return `${prefix}${time} [${e.type.padEnd(16)}] ${text}`;
-  }).join("\n");
-}
-function formatRuntimeLogs(logs) {
-  if (logs.length === 0) {
-    return "No runtime logs found for this deployment in the requested window";
-  }
-  return logs.map((l) => {
-    const ts = l.timestampInMs ?? l.timestamp ?? 0;
-    const time = ts ? new Date(ts).toISOString().slice(11, 23) : "--:--:--";
-    const level = (l.level ?? "info").toUpperCase().padEnd(5);
-    const status = l.proxy?.statusCode ?? l.responseStatusCode;
-    const reqInfo = l.proxy?.method ? `${l.proxy.method} ${l.proxy.path ?? ""} ${status ?? ""}`.trim() : "";
-    const message = (l.message ?? l.text ?? "").replace(/\s+$/u, "");
-    const reqId = l.requestId ? ` [${l.requestId.slice(0, 12)}]` : "";
-    const head = reqInfo ? `${reqInfo}${reqId}` : reqId.trim();
-    return `${time} [${level}] ${head ? head + " " : ""}${message}`;
-  }).join("\n");
-}
-function formatWebhookHistory(rows) {
-  if (rows.length === 0) return "No webhook log rows match those filters";
-  const lines = rows.map((r) => {
-    const ts = new Date(r.created_at).toLocaleString("nl-NL", { timeZone: "Europe/Amsterdam" });
-    const note = r.error_message ?? r.message ?? "";
-    return `${ts.padEnd(20)}  ${r.event_type.padEnd(22)}  ${r.status.padEnd(8)}  ${(r.project_name ?? "").padEnd(40)}  ${(r.target ?? "").padEnd(10)}  ${(r.deployment_id ?? "").padEnd(28)}  ${note}`;
-  });
-  const header = `${"WHEN".padEnd(20)}  ${"EVENT".padEnd(22)}  ${"STATUS".padEnd(8)}  ${"PROJECT".padEnd(40)}  ${"TARGET".padEnd(10)}  ${"DEPLOYMENT".padEnd(28)}  NOTE`;
-  return `${header}
-${"-".repeat(header.length)}
-${lines.join("\n")}`;
-}
-function formatDomainsTable(domains) {
-  if (domains.length === 0) return "No domains attached to this project";
-  const lines = domains.map((d) => {
-    const verified = d.verified ? "yes" : "no";
-    const branch = d.gitBranch ?? "";
-    const redirect = d.redirect ? `${d.redirect}${d.redirectStatusCode ? ` (${d.redirectStatusCode})` : ""}` : "";
-    return `${d.name.padEnd(45)}  ${verified.padEnd(9)}  ${branch.padEnd(20)}  ${redirect.padEnd(35)}  ${formatTimestamp(d.createdAt)}`;
-  });
-  const header = `${"DOMAIN".padEnd(45)}  ${"VERIFIED".padEnd(9)}  ${"GIT BRANCH".padEnd(20)}  ${"REDIRECT".padEnd(35)}  CREATED`;
-  return `${header}
-${"-".repeat(header.length)}
-${lines.join("\n")}`;
-}
-function formatDomainStatus(domain, config) {
-  const lines = [];
-  lines.push(`Domain: ${domain.name}`);
-  lines.push(`Verified: ${domain.verified ? "yes" : "no"}`);
-  if (config) {
-    lines.push(`Misconfigured: ${config.misconfigured ? "yes" : "no"}`);
-    if (config.configuredBy) lines.push(`Configured by: ${config.configuredBy}`);
-  }
-  if (domain.gitBranch) lines.push(`Git branch: ${domain.gitBranch}`);
-  if (domain.redirect) {
-    lines.push(
-      `Redirect: ${domain.redirect}${domain.redirectStatusCode ? ` (${domain.redirectStatusCode})` : ""}`
-    );
-  }
-  if (domain.verification && domain.verification.length > 0) {
-    lines.push("");
-    lines.push("Required DNS records to verify ownership:");
-    for (const v of domain.verification) {
-      lines.push(`  ${v.type.padEnd(6)} ${v.domain.padEnd(45)} ${v.value}${v.reason ? `  // ${v.reason}` : ""}`);
-    }
-  }
-  return lines.join("\n");
-}
-async function handleVercelTool(name, args2, deps) {
-  switch (name) {
-    case "vercel-projects": {
-      const token = await getVercelToken(deps);
-      const limit = Math.min(Math.max(Number(args2.limit) || 50, 1), 200);
-      const search = typeof args2.search === "string" ? args2.search.toLowerCase() : null;
-      const { projects, error } = await listVercelProjectsAll(token, limit);
-      if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-      const filtered = search ? projects.filter((p) => (p.name || "").toLowerCase().includes(search)) : projects;
-      return { content: [{ type: "text", text: formatProjectsTable(filtered) }] };
-    }
-    case "vercel-deployments": {
-      const token = await getVercelToken(deps);
-      const projectInput = String(args2.project);
-      const limit = Math.min(Math.max(Number(args2.limit) || 20, 1), 100);
-      const projectId = await resolveProjectId(token, projectInput);
-      const { deployments, error } = await listVercelDeployments(token, {
-        projectId,
-        limit,
-        state: args2.state ? String(args2.state) : void 0,
-        target: args2.target ? String(args2.target) : void 0
-      });
-      if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-      return { content: [{ type: "text", text: formatDeploymentsTable(deployments) }] };
-    }
-    case "vercel-logs": {
-      const kind = (args2.kind ? String(args2.kind) : "build").toLowerCase();
-      if (kind === "build") {
-        if (!args2.deploymentId) {
-          return { content: [{ type: "text", text: 'Error: kind="build" requires deploymentId.' }] };
-        }
-        const token = await getVercelToken(deps);
-        const deploymentId = String(args2.deploymentId);
-        const limit = Math.min(Math.max(Number(args2.limit) || 500, 1), 5e3);
-        const { events, error } = await getDeploymentBuildEvents(token, deploymentId, limit);
-        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-        return { content: [{ type: "text", text: formatBuildEvents(events) }] };
-      }
-      if (kind === "runtime") {
-        if (!args2.project || !args2.deploymentId) {
-          return {
-            content: [
-              { type: "text", text: 'Error: kind="runtime" requires both project and deploymentId.' }
-            ]
-          };
-        }
-        const token = await getVercelToken(deps);
-        const projectInput = String(args2.project);
-        const deploymentId = String(args2.deploymentId);
-        const limit = Math.min(Math.max(Number(args2.limit) || 200, 1), 1e3);
-        const sinceMinutesRaw = Number(args2.sinceMinutes);
-        const sinceExplicit = Number.isFinite(sinceMinutesRaw) && sinceMinutesRaw > 0;
-        const [projectId, deploymentCreatedMs] = await Promise.all([
-          resolveProjectId(token, projectInput),
-          sinceExplicit ? Promise.resolve(null) : getDeploymentCreatedMs(token, deploymentId)
-        ]);
-        const maxWindowMin = 7 * 24 * 60;
-        const autoCapMin = 30;
-        let sinceMs;
-        let windowNote = "";
-        if (sinceExplicit) {
-          const capped = Math.min(sinceMinutesRaw, maxWindowMin);
-          sinceMs = Date.now() - capped * 6e4;
-          windowNote = `window: last ${capped} min (caller-specified)`;
-        } else if (deploymentCreatedMs) {
-          const bufferMs = 5 * 6e4;
-          const sinceDeploymentMs = deploymentCreatedMs - bufferMs;
-          const ageMin = Math.max(1, Math.round((Date.now() - sinceDeploymentMs) / 6e4));
-          if (ageMin <= autoCapMin) {
-            sinceMs = sinceDeploymentMs;
-            windowNote = `window: auto ${ageMin} min from deployment createdAt - 5 min buffer`;
-          } else {
-            sinceMs = Date.now() - autoCapMin * 6e4;
-            windowNote = `window: capped to last ${autoCapMin} min (deployment is ${ageMin} min old \u2014 pass sinceMinutes to widen up to ${maxWindowMin})`;
-          }
-        } else {
-          sinceMs = Date.now() - autoCapMin * 6e4;
-          windowNote = `window: last ${autoCapMin} min (deployment metadata unavailable, used fallback)`;
-        }
-        const { logs, error } = await getRuntimeLogs(
-          token,
-          projectId,
-          deploymentId,
-          limit,
-          sinceMs
-        );
-        if (error) {
-          const hint = error.includes("404") || error.includes("400") ? '\n\nThis endpoint requires both project ID and deployment ID and may not be available on every Vercel plan. Use kind="webhooks" or query the vercel_deployment_log table directly for archived runtime logs.' : "";
-          return { content: [{ type: "text", text: `Error: ${error}${hint}` }] };
-        }
-        const body = formatRuntimeLogs(logs);
-        const hitDurationLimit = /Exceeded query duration limit/i.test(body);
-        const footer = hitDurationLimit ? `
-
-[${windowNote}]
-[hint] Vercel hit its 5-min query budget for this window. Try a smaller sinceMinutes (e.g. 5-10), lower limit, or use kind="webhooks" / query the vercel_deployment_log table for archived logs.` : `
-
-[${windowNote}]`;
-        return { content: [{ type: "text", text: body + footer }] };
-      }
-      if (kind === "webhooks") {
-        const limit = Math.min(Math.max(Number(args2.limit) || 25, 1), 200);
-        const conds = [sql`TRUE`];
-        if (args2.projectName) conds.push(sql`project_name = ${String(args2.projectName)}`);
-        if (args2.status) conds.push(sql`status = ${String(args2.status)}`);
-        const where = sql.join(conds, sql` AND `);
-        try {
-          const rows = await deps.db.execute(sql`
-            SELECT id, event_type, status, project_name, deployment_id, target,
-                   message, error_message, created_at
-            FROM vercel_webhook_logs
-            WHERE ${where}
-            ORDER BY created_at DESC
-            LIMIT ${limit}
-          `);
-          return {
-            content: [{ type: "text", text: formatWebhookHistory([...rows]) }]
-          };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return { content: [{ type: "text", text: `Error: ${msg}` }] };
-        }
-      }
-      return {
-        content: [
-          { type: "text", text: `Error: unknown kind "${kind}". Use build, runtime, or webhooks.` }
-        ]
-      };
-    }
-    case "vercel-domains": {
-      const action = (args2.action ? String(args2.action) : "list").toLowerCase();
-      if (!args2.project) {
-        return { content: [{ type: "text", text: 'Error: vercel-domains requires "project".' }] };
-      }
-      const token = await getVercelToken(deps);
-      const projectInput = String(args2.project);
-      const projectId = await resolveProjectId(token, projectInput);
-      if (action === "list") {
-        const { domains, error } = await listProjectDomains(token, projectId);
-        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-        return { content: [{ type: "text", text: formatDomainsTable(domains) }] };
-      }
-      if (action === "add") {
-        if (!args2.domain) {
-          return { content: [{ type: "text", text: 'Error: action="add" requires "domain".' }] };
-        }
-        const body = { name: String(args2.domain) };
-        if (args2.gitBranch) body.gitBranch = String(args2.gitBranch);
-        if (args2.redirect) body.redirect = String(args2.redirect);
-        if (args2.redirectStatusCode) body.redirectStatusCode = Number(args2.redirectStatusCode);
-        const { domain, error } = await addProjectDomain(token, projectId, body);
-        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-        if (!domain) {
-          return { content: [{ type: "text", text: `Domain ${body.name} added (no detail returned).` }] };
-        }
-        const { config } = await getDomainConfig(token, domain.name);
-        const status = formatDomainStatus(domain, config);
-        const headline = domain.verified ? `Domain ${domain.name} added and verified.` : `Domain ${domain.name} added. DNS verification still pending.`;
-        return { content: [{ type: "text", text: `${headline}
-
-${status}` }] };
-      }
-      if (action === "verify") {
-        if (!args2.domain) {
-          return { content: [{ type: "text", text: 'Error: action="verify" requires "domain".' }] };
-        }
-        const domainName = String(args2.domain);
-        const { domain, error } = await getProjectDomain(token, projectId, domainName);
-        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-        if (!domain) {
-          return { content: [{ type: "text", text: `Domain ${domainName} not found on this project.` }] };
-        }
-        const { config } = await getDomainConfig(token, domainName);
-        return { content: [{ type: "text", text: formatDomainStatus(domain, config) }] };
-      }
-      if (action === "remove") {
-        if (!args2.domain) {
-          return { content: [{ type: "text", text: 'Error: action="remove" requires "domain".' }] };
-        }
-        const domainName = String(args2.domain);
-        const { error } = await removeProjectDomain(token, projectId, domainName);
-        if (error) return { content: [{ type: "text", text: `Error: ${error}` }] };
-        return { content: [{ type: "text", text: `Domain ${domainName} removed from project.` }] };
-      }
-      return {
-        content: [
-          { type: "text", text: `Error: unknown action "${action}". Use list, add, verify, or remove.` }
-        ]
-      };
-    }
-    default:
-      return { content: [{ type: "text", text: `Unknown vercel tool: ${name}` }] };
-  }
-}
 var REPO_TOOLS = [
   {
     name: "repo-list",
@@ -2343,7 +1728,6 @@ var TOOL_MODULE_MAP = {
   "dns-list": "domains",
   "dns-record": "domains",
   ...TRIGGER_TOOL_MODULE_MAP,
-  ...VERCEL_TOOL_MODULE_MAP,
   ...REPO_TOOL_MODULE_MAP
 };
 var authContext = null;
@@ -2700,151 +2084,6 @@ function decrypt(payload) {
   decrypted += decipher.final("utf8");
   return decrypted;
 }
-var VERCEL_API2 = "https://api.vercel.com";
-function parseEnvContent(content) {
-  const result = {};
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eqIdx = trimmed.indexOf("=");
-    if (eqIdx === -1) continue;
-    const key = trimmed.slice(0, eqIdx).trim();
-    let value = trimmed.slice(eqIdx + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    if (key) result[key] = value;
-  }
-  return result;
-}
-function stageToVercelTargets(stageType, customEnvId) {
-  if (stageType === "prod") return { target: ["production"] };
-  if (customEnvId) return { customEnvironmentIds: [customEnvId] };
-  return { target: ["preview"] };
-}
-function getVercelEnvSyncTargetings(stageType, customEnvId) {
-  const primary = stageToVercelTargets(stageType, customEnvId);
-  if (stageType !== "dev") return [primary];
-  return [primary, { target: ["development"] }];
-}
-async function syncEnvVarsToVercel(token, projectId, envVars) {
-  if (envVars.length === 0) return { created: 0, error: null };
-  const res = await fetch(
-    `${VERCEL_API2}/v10/projects/${encodeURIComponent(projectId)}/env?upsert=true`,
-    {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(envVars)
-    }
-  );
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    return { created: 0, error: `Vercel API ${res.status}: ${body}` };
-  }
-  const data = await res.json().catch(() => ({}));
-  return { created: data?.created?.length ?? envVars.length, error: null };
-}
-async function attemptVercelSync(appName, environment, knownStageId) {
-  try {
-    let stageId = knownStageId;
-    if (!stageId) {
-      const directRows = await db.execute(sql`
-        SELECT release_profile_stage_id
-        FROM env_config
-        WHERE app_name = ${appName} AND release_profile_stage_id IS NOT NULL
-        LIMIT 1
-      `);
-      stageId = directRows[0]?.release_profile_stage_id;
-    }
-    if (!stageId) return "Vercel sync skipped: no stage link found";
-    const settingsRows = await db.execute(sql`
-      SELECT vercel_token_encrypted FROM app_setting LIMIT 1
-    `);
-    const settings = settingsRows[0];
-    if (!settings?.vercel_token_encrypted) return "Vercel sync skipped: no Vercel token configured";
-    let token;
-    try {
-      token = decrypt(settings.vercel_token_encrypted);
-    } catch {
-      return "Vercel sync failed: could not decrypt Vercel token";
-    }
-    const stageRows = await db.execute(sql`
-      SELECT id, stage, stage_apps FROM release_profile_stage
-      WHERE id = ${stageId}
-      LIMIT 1
-    `);
-    const stage = stageRows[0];
-    if (!stage) return "Vercel sync skipped: stage not found";
-    const stageType = stage.stage;
-    const stageApps = stage.stage_apps || [];
-    const vercelApps = stageApps.filter(
-      (a) => a.deployMethod === "vercel" && a.enabled && a.vercelProjectId
-    );
-    if (vercelApps.length === 0) return "Vercel sync skipped: no Vercel apps in stage";
-    const envConfigs = await db.execute(sql`
-      SELECT id, app_name, environment, variant, env_data_encrypted, release_profile_stage_id
-      FROM env_config
-      WHERE release_profile_stage_id = ${stageId}
-    `);
-    if (envConfigs.length === 0) return "Vercel sync skipped: no env configs for stage";
-    const variantMap = {
-      dev: "development",
-      staging: "staging",
-      prod: "production"
-    };
-    const deployedVariant = variantMap[stageType] ?? stageType;
-    const syncResults = [];
-    for (const app of vercelApps) {
-      const name = app.path.replace("apps/", "");
-      const config = envConfigs.find(
-        (c) => c.app_name === name && c.variant === deployedVariant
-      );
-      if (!config) {
-        syncResults.push(`${app.label}: skipped (no config for variant "${deployedVariant}")`);
-        continue;
-      }
-      let envContent;
-      try {
-        envContent = decrypt(config.env_data_encrypted);
-      } catch {
-        syncResults.push(`${app.label}: decrypt failed`);
-        continue;
-      }
-      const pairs = parseEnvContent(envContent);
-      const keys = Object.keys(pairs);
-      if (keys.length === 0) {
-        syncResults.push(`${app.label}: empty config`);
-        continue;
-      }
-      const targetings = getVercelEnvSyncTargetings(stageType, app.vercelCustomEnvId);
-      let createdTotal = 0;
-      let lastErr = null;
-      for (const targeting of targetings) {
-        const envVars = keys.map((key) => ({
-          key,
-          value: pairs[key],
-          type: "encrypted",
-          ...targeting
-        }));
-        const { created, error } = await syncEnvVarsToVercel(token, app.vercelProjectId, envVars);
-        if (error) lastErr = error;
-        else createdTotal += created;
-      }
-      if (lastErr) {
-        syncResults.push(`${app.label}: FAILED - ${lastErr}`);
-      } else {
-        syncResults.push(`${app.label}: ${createdTotal} var upsert(s) synced`);
-      }
-    }
-    return `Vercel sync: ${syncResults.join("; ")}`;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return `Vercel sync error: ${msg}`;
-  }
-}
 function posixQuote(arg) {
   if (arg === "") return "''";
   if (/^[A-Za-z0-9._\/=:@%+\-]+$/.test(arg)) return arg;
@@ -4473,11 +3712,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql4) {
-  return sql4.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql3) {
+  return sql3.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql4) {
-  return createHash("sha256").update(normaliseMigrationSql(sql4), "utf8").digest("hex");
+function migrationSha256(sql3) {
+  return createHash("sha256").update(normaliseMigrationSql(sql3), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -4685,7 +3924,7 @@ async function mijnhostFetch(path, options = {}) {
       "API-Key": key,
       "Accept": "application/json",
       "Content-Type": "application/json",
-      "User-Agent": "mg-dashboard-mcp/2.2.0",
+      "User-Agent": "mg-dashboard-mcp/6.6.0",
       ...options.headers || {}
     }
   });
@@ -4696,6 +3935,36 @@ async function mijnhostFetch(path, options = {}) {
   }
   return body;
 }
+var DNS_MIN_INTERVAL_MS = 750;
+var DNS_RETRY_BACKOFF_MS = 1500;
+var dnsZoneQueue = /* @__PURE__ */ new Map();
+var dnsLastPutAt = /* @__PURE__ */ new Map();
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withDnsZoneLock(domain, fn) {
+  const key = domain.toLowerCase();
+  const previous = dnsZoneQueue.get(key) ?? Promise.resolve();
+  const run = previous.then(async () => {
+    const last = dnsLastPutAt.get(key) ?? 0;
+    const wait = DNS_MIN_INTERVAL_MS - (Date.now() - last);
+    if (wait > 0) await sleep(wait);
+    return fn();
+  });
+  const queued = run.finally(() => {
+    if (dnsZoneQueue.get(key) === queued) dnsZoneQueue.delete(key);
+  });
+  dnsZoneQueue.set(key, queued.catch(() => {
+  }));
+  return run;
+}
+function markDnsPut(domain) {
+  dnsLastPutAt.set(domain.toLowerCase(), Date.now());
+}
+function isTransientMijnhostError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /Internal Server Error|API error: 5\d\d|fetch failed|ETIMEDOUT|ECONNRESET/i.test(msg);
+}
 var TOOLS = [
   {
     name: "list-servers",
@@ -5059,7 +4328,7 @@ var TOOLS = [
   },
   {
     name: "dns-record",
-    description: 'Mutate a single DNS record on a mijn.host domain. Pick the mutation with `action`:\n- "create": add a new record. Required: type, name, value. Optional: ttl (default 3600).\n- "update": replace an existing record. Required: type, name, oldValue, newValue. Optional: ttl.\n- "delete": remove a record. Required: type, name, value.\n\nAlways pass `dryRun: true` first when touching MX / SPF / DKIM / DMARC \u2014 returns a full before/after diff with a mail-auth warning and applies nothing. Re-run without dryRun once the diff looks correct.\n\nUse `dns-list` to inspect the current zone first if you need to identify the right `oldValue`. Requires MIJNHOST_API_KEY.',
+    description: 'Mutate a single DNS record on a mijn.host domain. Pick the mutation with `action`:\n- "create": add a new record. Required: type, name, value. Optional: ttl (default 3600).\n- "update": replace an existing record. Required: type, name, oldValue, newValue. Optional: ttl.\n- "delete": remove a record. Required: type, name, value.\n\nAlways pass `dryRun: true` first when touching MX / SPF / DKIM / DMARC \u2014 returns a full before/after diff with a mail-auth warning and applies nothing. Re-run without dryRun once the diff looks correct.\n\nUse `dns-list` to inspect the current zone first if you need to identify the right `oldValue`. Requires MIJNHOST_API_KEY.\n\nConcurrency: calls are automatically serialized per domain (mijn.host\'s API does GET-then-PUT-the-whole-zone, so parallel calls would race and silently drop records). A minimum 750 ms gap is enforced between PUTs to the same zone, transient 5xx errors are retried once, and a stale-snapshot guard refuses to PUT a zone that suddenly shrunk. You can still fire calls in parallel \u2014 they just queue safely behind each other per domain.',
     inputSchema: {
       type: "object",
       properties: {
@@ -5078,12 +4347,10 @@ var TOOLS = [
   },
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS,
-  // ----- Vercel -----
-  ...VERCEL_TOOLS,
   // ----- Repo reference -----
   ...REPO_TOOLS
 ];
-var MCP_VERSION = "6.3.0";
+var MCP_VERSION = "6.6.0";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const accessible = TOOLS.filter((tool) => {
@@ -6560,9 +5827,7 @@ LIMIT ${limit};
           `);
           saveMsg = `Stored env config: ${appName}/${environment}`;
         }
-        const syncStageId = existing?.release_profile_stage_id ?? resolvedStageIds?.[0];
-        const vercelStatus = await attemptVercelSync(appName, environment, syncStageId);
-        return { content: [{ type: "text", text: `${saveMsg}. ${vercelStatus}` }] };
+        return { content: [{ type: "text", text: saveMsg }] };
       }
       // ----- Cache Purge -----
       case "cache-purge": {
@@ -6750,82 +6015,107 @@ ${lines.join("\n")}` }] };
         if (!domain || !type || !dnsName) {
           throw new Error("domain, type, and name are required");
         }
-        const current = await mijnhostFetch(
-          `/domains/${encodeURIComponent(domain)}/dns`
-        );
-        let nextRecords;
-        let diffArgs;
-        let okMessage;
-        if (action === "create") {
-          const value = typeof a.value === "string" ? a.value : "";
-          if (!value) throw new Error('action="create" requires value');
-          const ttl = Number(a.ttl) || 3600;
-          const newRecord = { type, name: dnsName, value, ttl };
-          nextRecords = [...current.data.records, newRecord];
-          diffArgs = { verb: "create", added: [newRecord] };
-          okMessage = `DNS record created: ${type} ${dnsName} \u2192 ${value} (TTL: ${ttl})`;
-        } else if (action === "update") {
-          const oldValue = typeof a.oldValue === "string" ? a.oldValue : "";
-          const newValue = typeof a.newValue === "string" ? a.newValue : "";
-          if (!oldValue || !newValue) throw new Error('action="update" requires oldValue and newValue');
-          const ttlArg = a.ttl !== void 0 ? Number(a.ttl) : void 0;
-          const idx = current.data.records.findIndex(
-            (r) => r.type === type && r.name === dnsName && r.value === oldValue
+        return withDnsZoneLock(domain, async () => {
+          const fetchZone = () => mijnhostFetch(
+            `/domains/${encodeURIComponent(domain)}/dns`
           );
-          if (idx === -1) {
-            throw new Error(
-              `No matching DNS record found: ${type} ${dnsName} = ${oldValue}
+          let current = await fetchZone();
+          if (current.data.records.length === 0) {
+            await sleep(DNS_RETRY_BACKOFF_MS);
+            current = await fetchZone();
+          }
+          let nextRecords;
+          let diffArgs;
+          let okMessage;
+          if (action === "create") {
+            const value = typeof a.value === "string" ? a.value : "";
+            if (!value) throw new Error('action="create" requires value');
+            const ttl = Number(a.ttl) || 3600;
+            const newRecord = { type, name: dnsName, value, ttl };
+            nextRecords = [...current.data.records, newRecord];
+            diffArgs = { verb: "create", added: [newRecord] };
+            okMessage = `DNS record created: ${type} ${dnsName} \u2192 ${value} (TTL: ${ttl})`;
+          } else if (action === "update") {
+            const oldValue = typeof a.oldValue === "string" ? a.oldValue : "";
+            const newValue = typeof a.newValue === "string" ? a.newValue : "";
+            if (!oldValue || !newValue) throw new Error('action="update" requires oldValue and newValue');
+            const ttlArg = a.ttl !== void 0 ? Number(a.ttl) : void 0;
+            const idx = current.data.records.findIndex(
+              (r) => r.type === type && r.name === dnsName && r.value === oldValue
+            );
+            if (idx === -1) {
+              throw new Error(
+                `No matching DNS record found: ${type} ${dnsName} = ${oldValue}
 ` + describeDnsCandidates(current.data.records, type, dnsName, oldValue)
+              );
+            }
+            const updated = [...current.data.records];
+            const before = updated[idx];
+            const after = {
+              type,
+              name: dnsName,
+              value: newValue,
+              ttl: ttlArg ?? before.ttl
+            };
+            updated[idx] = after;
+            nextRecords = updated;
+            diffArgs = { verb: "update", removed: [before], added: [after] };
+            okMessage = `DNS record updated: ${type} ${dnsName} \u2192 ${newValue}${ttlArg ? ` (TTL: ${ttlArg})` : ""}`;
+          } else {
+            const value = typeof a.value === "string" ? a.value : "";
+            if (!value) throw new Error('action="delete" requires value');
+            const removed = current.data.records.filter(
+              (r) => r.type === type && r.name === dnsName && r.value === value
             );
+            const remaining = current.data.records.filter(
+              (r) => !(r.type === type && r.name === dnsName && r.value === value)
+            );
+            if (removed.length === 0) {
+              throw new Error(
+                `No matching DNS record found: ${type} ${dnsName} = ${value}
+` + describeDnsCandidates(current.data.records, type, dnsName, value)
+              );
+            }
+            nextRecords = remaining;
+            diffArgs = { verb: "delete", removed };
+            okMessage = `DNS record deleted: ${type} ${dnsName} = ${value} (${remaining.length} records remaining)`;
           }
-          const updated = [...current.data.records];
-          const before = updated[idx];
-          const after = {
-            type,
-            name: dnsName,
-            value: newValue,
-            ttl: ttlArg ?? before.ttl
-          };
-          updated[idx] = after;
-          nextRecords = updated;
-          diffArgs = { verb: "update", removed: [before], added: [after] };
-          okMessage = `DNS record updated: ${type} ${dnsName} \u2192 ${newValue}${ttlArg ? ` (TTL: ${ttlArg})` : ""}`;
-        } else {
-          const value = typeof a.value === "string" ? a.value : "";
-          if (!value) throw new Error('action="delete" requires value');
-          const removed = current.data.records.filter(
-            (r) => r.type === type && r.name === dnsName && r.value === value
-          );
-          const remaining = current.data.records.filter(
-            (r) => !(r.type === type && r.name === dnsName && r.value === value)
-          );
-          if (removed.length === 0) {
+          if (dryRun) {
+            const diff = formatDnsDiff(domain, current.data.records, nextRecords, diffArgs);
+            return { content: [{ type: "text", text: diff }] };
+          }
+          if (nextRecords.length < 3 && current.data.records.length >= 5 && action !== "delete") {
             throw new Error(
-              `No matching DNS record found: ${type} ${dnsName} = ${value}
-` + describeDnsCandidates(current.data.records, type, dnsName, value)
+              `Aborting PUT: would shrink ${domain} from ${current.data.records.length} to ${nextRecords.length} records. This usually indicates a stale zone snapshot from mijn.host. Run dns-list and retry.`
             );
           }
-          nextRecords = remaining;
-          diffArgs = { verb: "delete", removed };
-          okMessage = `DNS record deleted: ${type} ${dnsName} = ${value} (${remaining.length} records remaining)`;
-        }
-        if (dryRun) {
-          const diff = formatDnsDiff(domain, current.data.records, nextRecords, diffArgs);
-          return { content: [{ type: "text", text: diff }] };
-        }
-        await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
-          method: "PUT",
-          body: JSON.stringify({ records: nextRecords })
+          try {
+            await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
+              method: "PUT",
+              body: JSON.stringify({ records: nextRecords })
+            });
+          } catch (err) {
+            if (!isTransientMijnhostError(err)) throw err;
+            await sleep(DNS_RETRY_BACKOFF_MS);
+            const refetched = await fetchZone();
+            const stillNeedsApply = action === "create" ? !refetched.data.records.some((r) => r.type === type && r.name === dnsName && r.value === (typeof a.value === "string" ? a.value : "")) : true;
+            if (!stillNeedsApply) {
+              markDnsPut(domain);
+              return { content: [{ type: "text", text: `${okMessage} (already applied; recovered from transient error)` }] };
+            }
+            await mijnhostFetch(`/domains/${encodeURIComponent(domain)}/dns`, {
+              method: "PUT",
+              body: JSON.stringify({ records: nextRecords })
+            });
+          }
+          markDnsPut(domain);
+          return { content: [{ type: "text", text: okMessage }] };
         });
-        return { content: [{ type: "text", text: okMessage }] };
       }
       default:
         if (TRIGGER_TOOL_NAMES.has(name)) {
           return handleTriggerTool(name, a, { sshExec, getServerConnection });
         }
-        if (VERCEL_TOOL_NAMES.has(name)) {
-          return handleVercelTool(name, a, { db, decrypt });
-        }
         if (REPO_TOOL_NAMES.has(name)) {
           return handleRepoTool(name, a, { db, sshExec, getServerConnection });
         }