@roxyon/mcp 0.3.0 → 0.5.0

package/dist/chunk-KU3LB5HH.js

@@ -0,0 +1,1445 @@
+#!/usr/bin/env node
+
+// src/server.ts
+import { createRequire } from "module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/baas-tools.ts
+import { readFile } from "fs/promises";
+import { join, resolve } from "path";
+import { BAAS_MAX_BATCH, BAAS_MAX_PAGE, BaasDataApi, parseEnv } from "@roxyon/api-client";
+import { z } from "zod";
+
+// src/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+function runWithContext(ctx, fn) {
+  return storage.run(ctx, fn);
+}
+function currentContext() {
+  return storage.getStore() ?? {};
+}
+
+// src/session.ts
+import { Roxyon, isAuthError } from "@roxyon/api-client";
+import { endpointsFromEnv, loadCredentials, tokenFromEnv } from "@roxyon/deploy-core";
+var NotAuthenticatedError = class extends Error {
+  constructor() {
+    super(
+      "Not signed in to Roxyon. Run `roxyon login` in a terminal, or set ROXYON_TOKEN in this MCP server's environment."
+    );
+    this.name = "NotAuthenticatedError";
+  }
+};
+async function getSession() {
+  const { apiUrl, consoleUrl } = endpointsFromEnv();
+  const requestToken = currentContext().token;
+  if (requestToken) {
+    return {
+      roxyon: new Roxyon({ sessionToken: requestToken, baseUrl: apiUrl, consoleUrl }),
+      source: "oauth"
+    };
+  }
+  const envToken = tokenFromEnv();
+  if (envToken) {
+    return {
+      roxyon: new Roxyon({ sessionToken: envToken, baseUrl: apiUrl, consoleUrl }),
+      source: "env-token"
+    };
+  }
+  const creds = await loadCredentials();
+  if (!creds?.sessionToken) throw new NotAuthenticatedError();
+  return {
+    roxyon: new Roxyon({ sessionToken: creds.sessionToken, baseUrl: apiUrl, consoleUrl }),
+    preferredSubscription: creds.subscription,
+    source: "stored-login"
+  };
+}
+function isSessionGone(err) {
+  return err instanceof NotAuthenticatedError || isAuthError(err);
+}
+
+// src/result.ts
+function text(body, structured) {
+  return {
+    content: [{ type: "text", text: body }],
+    ...structured ? { structuredContent: structured } : {}
+  };
+}
+function errorResult(message, structured) {
+  return {
+    content: [{ type: "text", text: message }],
+    ...structured ? { structuredContent: structured } : {},
+    isError: true
+  };
+}
+async function guard(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (isSessionGone(err)) {
+      return errorResult(
+        err.message || "Roxyon session expired \u2014 run `roxyon login` again, or refresh ROXYON_TOKEN."
+      );
+    }
+    return errorResult(err instanceof Error ? err.message : String(err));
+  }
+}
+
+// src/baas-tools.ts
+var MAX_TEXT = 4e4;
+var dirArg = z.string().optional().describe("Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd.");
+function remoteBlock() {
+  if (!currentContext().remote) return null;
+  return errorResult(
+    "The roxyon_baas_* tools read your app secret key from your local project .env, so they only run in the local MCP server (`npx -y @roxyon/mcp`). Manage data in the hosted connector via the console's Roxyon Base panel for now."
+  );
+}
+async function baasFor(dir) {
+  const root = resolve(dir ?? process.cwd());
+  let fileEnv = {};
+  try {
+    fileEnv = parseEnv(await readFile(join(root, ".env"), "utf8"));
+  } catch {
+  }
+  const secretKey = fileEnv.RX_SECRET_KEY || process.env.RX_SECRET_KEY || "";
+  if (!secretKey) {
+    throw new Error(
+      `No BaaS V2 secret key found. Put RX_SECRET_KEY=rxsk_\u2026 in ${join(root, ".env")} (console.roxyon.com \u2192 Roxyon Base \u2192 your project \u2192 API keys). Keep it out of git and out of browser code.`
+    );
+  }
+  return new BaasDataApi({ secretKey });
+}
+function clip(s) {
+  return s.length > MAX_TEXT ? `${s.slice(0, MAX_TEXT)}
+\u2026 (truncated \u2014 narrow with fields/where/limit)` : s;
+}
+function dryRun(what) {
+  return text(`Would ${what}. Pass confirm:true to do it.`, { dryRun: true });
+}
+var SERVER_SCOPE = "Runs as the app backend (server scope, which passes every class rule). Local MCP only.";
+function registerBaasTools(server) {
+  server.registerTool(
+    "roxyon_baas_query",
+    {
+      title: "Roxyon BaaS: query records",
+      description: `Read records of a class in the project's own app on BaaS V2. \`where\` is an object like {"Status":"active","Age":{"gt":18}}; for \`in\`, pass a comma-joined string. \`fields\` defaults to "*"; built-in meta columns must be named. Up to ${BAAS_MAX_PAGE} rows a page (use skip to page). ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        where: z.record(z.any()).optional(),
+        fields: z.string().optional(),
+        order: z.string().optional().describe('e.g. "-createdAt"'),
+        limit: z.number().int().min(1).max(BAAS_MAX_PAGE).optional(),
+        skip: z.number().int().min(0).optional(),
+        count: z.boolean().optional().describe("Also return the total number of matches.")
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const api = await baasFor(args.dir);
+      const { rows, count } = await api.query(args.class, {
+        where: args.where,
+        fields: args.fields,
+        order: args.order,
+        limit: args.limit,
+        skip: args.skip,
+        count: args.count
+      });
+      const head = `${rows.length} row(s)${count !== void 0 ? ` of ${count}` : ""}`;
+      return text(clip(`${head}
+${JSON.stringify(rows, null, 2)}`), { rows, count });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_get",
+    {
+      title: "Roxyon BaaS: read one record",
+      description: `Read one record by objectId. ${SERVER_SCOPE}`,
+      inputSchema: { dir: dirArg, class: z.string(), objectId: z.string() }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const api = await baasFor(args.dir);
+      const row = await api.get(args.class, args.objectId);
+      return text(clip(JSON.stringify(row, null, 2)), { row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_create",
+    {
+      title: "Roxyon BaaS: create a record",
+      description: `Insert one record into an existing class (V2 has no schema changes with a secret key: add classes and columns in the console). For relations store the other row's objectId in a string column. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        data: z.record(z.any()),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) return dryRun(`insert into ${args.class}: ${JSON.stringify(args.data)}`);
+      const api = await baasFor(args.dir);
+      const row = await api.create(args.class, args.data);
+      return text(`\u2713 Created ${args.class} ${String(row.objectId ?? "")}.`, { ok: true, row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_update",
+    {
+      title: "Roxyon BaaS: update a record",
+      description: `Set fields on one record by objectId. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        objectId: z.string(),
+        data: z.record(z.any()),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) {
+        return dryRun(`update ${args.class} ${args.objectId}: ${JSON.stringify(args.data)}`);
+      }
+      const api = await baasFor(args.dir);
+      const row = await api.update(args.class, args.objectId, args.data);
+      return text(`\u2713 Updated ${args.class} ${args.objectId}.`, { ok: true, row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_delete",
+    {
+      title: "Roxyon BaaS: delete a record",
+      description: `Delete one record by objectId. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        objectId: z.string(),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) return dryRun(`delete ${args.class} ${args.objectId}`);
+      const api = await baasFor(args.dir);
+      await api.delete(args.class, args.objectId);
+      return text(`\u2713 Deleted ${args.class} ${args.objectId}.`, { ok: true });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_batch",
+    {
+      title: "Roxyon BaaS: batch of record requests",
+      description: `1 to ${BAAS_MAX_BATCH} record requests in one call, each answered on its own (one failing doesn't stop the others). path is /Class or /Class/<objectId>; for POST/PUT the body is {"data":{...}}; for GET the body holds query options (where, fields, limit\u2026). A batch with any write needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        requests: z.array(
+          z.object({
+            method: z.enum(["GET", "POST", "PUT", "DELETE"]),
+            path: z.string(),
+            body: z.record(z.any()).optional()
+          })
+        ).min(1).max(BAAS_MAX_BATCH),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const writes = args.requests.filter((r) => r.method !== "GET");
+      if (writes.length && !args.confirm) {
+        return dryRun(
+          `run ${args.requests.length} request(s), ${writes.length} of them writes: ${writes.map((r) => `${r.method} ${r.path}`).join(", ")}`
+        );
+      }
+      const api = await baasFor(args.dir);
+      const results = await api.batch(args.requests);
+      const failed = results.filter((r) => r.ok === false).length;
+      return text(
+        clip(
+          `${results.length} answer(s), ${failed} failed
+${JSON.stringify(results, null, 2)}`
+        ),
+        { results }
+      );
+    })
+  );
+}
+
+// src/commerce-tools.ts
+import { BILLING_CYCLES, Roxyon as Roxyon2 } from "@roxyon/api-client";
+import { endpointsFromEnv as endpointsFromEnv2 } from "@roxyon/deploy-core";
+import { z as z2 } from "zod";
+function publicRoxyon() {
+  const { apiUrl, consoleUrl } = endpointsFromEnv2();
+  return new Roxyon2({ baseUrl: apiUrl, consoleUrl });
+}
+function money(n) {
+  return n === void 0 ? "\u2014" : `$${n.toFixed(2)}`;
+}
+function productLine(p) {
+  const spec = p.vcpu !== void 0 ? ` \u2014 ${p.vcpu} vCPU (${p.cpuType}), ${p.ramGb} GB RAM, ${p.diskGb} GB disk${p.ipv4Included ? `, ${p.ipv4Included} IPv4` : ""}` : "";
+  const prices = BILLING_CYCLES.filter((c) => p.pricesUSD[c] !== void 0).map((c) => `${c} ${money(p.pricesUSD[c])}`).join(", ");
+  return `- ${p.sku || p.planId} "${p.name}" [${p.category}]${spec} | USD ${prices}${p.stock === "out" ? " | OUT OF STOCK" : ""} (planId ${p.planId})`;
+}
+function registerCommerceTools(server) {
+  server.registerTool(
+    "roxyon_catalog",
+    {
+      title: "Roxyon: product catalog",
+      description: 'List what Roxyon sells: cloud servers (cloud.vps.launch / scale / power) and web hosting (cloud.hosting.solo / multiple / isolated). Each product has its planId (what roxyon_quote takes), SKU, specs (vCPU, RAM GB, disk GB, IPv4 included) for servers, list prices in USD per billing cycle BEFORE tax and currency conversion, and stock ("out" = cannot be ordered now). No sign-in needed. Use roxyon_quote for the exact amount a buyer would pay. Read-only.',
+      inputSchema: {
+        category: z2.string().optional().describe('Filter by category prefix, e.g. "cloud.vps" or "cloud.hosting".'),
+        in_stock_only: z2.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      let products = await publicRoxyon().billing.catalog();
+      if (args.category) products = products.filter((p) => p.category.startsWith(args.category));
+      if (args.in_stock_only) products = products.filter((p) => p.stock === "in");
+      return text(
+        products.length ? products.map(productLine).join("\n") : "(no products match)",
+        { products }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_quote",
+    {
+      title: "Roxyon: price a new subscription",
+      description: "The exact amount Roxyon's checkout would charge for a NEW subscription to one plan, computed by the platform itself (same server pricing the console checkout uses, setup fee included): line items, subtotal, tax, total, in the requested currency. Pass the buyer currency and country: without them the quote is in USD with no tax, while checkout uses the account's own currency/country. No sign-in needed. Read-only: creates no order. Domains are not priced by this tool yet.",
+      inputSchema: {
+        plan: z2.string().describe('planId (or SKU, e.g. "SCALE-S") from roxyon_catalog.'),
+        cycle: z2.enum(BILLING_CYCLES),
+        currency: z2.string().length(3).optional().describe('ISO 4217, e.g. "USD", "SAR".'),
+        country: z2.string().length(2).optional().describe('ISO 3166 alpha-2, decides tax, e.g. "SA".')
+      }
+    },
+    (args) => guard(async () => {
+      const roxyon = publicRoxyon();
+      const want = args.plan.toLowerCase();
+      const product = (await roxyon.billing.catalog()).find(
+        (p) => p.planId === args.plan || p.sku.toLowerCase() === want
+      );
+      if (!product)
+        throw new Error(`No product "${args.plan}" in the catalog. See roxyon_catalog.`);
+      const q = await roxyon.billing.quote({
+        planId: product.planId,
+        cycle: args.cycle,
+        currency: args.currency,
+        country: args.country
+      });
+      const lines = [
+        ...q.lineItems.map((l) => `${l.label}: ${l.amount} ${q.currency}`),
+        `Subtotal: ${q.subtotal} ${q.currency}`,
+        `${q.taxLabel || "Tax"} (${q.taxRate}%): ${q.taxAmount} ${q.currency}`,
+        `Total: ${q.total} ${q.currency}`
+      ];
+      if (product?.stock === "out") lines.push("Note: this plan is out of stock right now.");
+      return text(lines.join("\n"), { quote: q });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_subscriptions",
+    {
+      title: "Roxyon: my subscriptions (billing)",
+      description: "The signed-in user's own subscriptions with billing details: plan + SKU, status, billing cycle, recurring price and currency, next billing date, auto-renew, and for servers the state (building / running / stopped\u2026) and public IP. Only subscriptions the user owns. Read-only.",
+      inputSchema: {}
+    },
+    () => guard(async () => {
+      const session = await getSession();
+      const subs = await session.roxyon.billing.subscriptions();
+      const body = subs.length ? subs.map(
+        (s) => `- ${s.name || s.id} [${s.status}] ${s.plan}${s.sku ? ` (${s.sku})` : ""} \u2014 ${s.price} ${s.currency}/${s.cycle || "?"}, next billing ${s.nextBillingDate ?? "\u2014"}${s.autoRenew ? ", auto-renew" : ""}${s.serverState ? `, server ${s.serverState}` : ""}${s.publicIp ? ` ${s.publicIp}` : ""}`
+      ).join("\n") : "(no subscriptions on this account)";
+      return text(body, { subscriptions: subs });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_invoices",
+    {
+      title: "Roxyon: my invoices",
+      description: "The signed-in user's own invoices, newest first: number, type, status (pending = unpaid, paid, overdue, void, failed, cancelled), total and currency, due date, and payUrl (the console page where the user pays; null when paid). Read-only: this never pays anything.",
+      inputSchema: {
+        status: z2.enum(["pending", "paid", "overdue", "void", "failed", "cancelled"]).optional(),
+        limit: z2.number().int().min(1).max(100).optional().describe("Default 25.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const invoices = await session.roxyon.billing.invoices({
+        status: args.status,
+        limit: args.limit
+      });
+      const body = invoices.length ? invoices.map(
+        (i) => `- #${i.number || i.id} ${i.type} [${i.status}] ${i.total} ${i.currency}, due ${i.dueDate ?? "\u2014"}${i.payUrl ? ` \u2014 pay at ${i.payUrl}` : ""}`
+      ).join("\n") : "(no invoices)";
+      return text(body, { invoices });
+    })
+  );
+  server.registerTool(
+    "roxyon_pay_link",
+    {
+      title: "Roxyon: where to pay an invoice",
+      description: 'The URL where the signed-in user pays one of their own open invoices (status pending, overdue or failed), plus its amount and due date. Give the invoice number (e.g. "INV2610055") or id from roxyon_list_invoices. A human opens the link and pays in the console; this tool never charges anything. Paid or void invoices have no link.',
+      inputSchema: {
+        invoice: z2.string().min(1).max(40).describe("Invoice number or id.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const want = args.invoice.replace(/^#/, "").toLowerCase();
+      const inv = (await session.roxyon.billing.invoices({ limit: 100 })).find(
+        (i) => i.id.toLowerCase() === want || i.number.toLowerCase() === want
+      );
+      if (!inv) {
+        throw new Error(
+          `No invoice "${args.invoice}" among your latest 100. See roxyon_list_invoices.`
+        );
+      }
+      if (!inv.payUrl) {
+        return text(`Invoice #${inv.number || inv.id} is ${inv.status}: nothing to pay.`, {
+          invoice: inv
+        });
+      }
+      return text(
+        `Invoice #${inv.number || inv.id}: ${inv.total} ${inv.currency}, due ${inv.dueDate ?? "\u2014"}.
+Pay at ${inv.payUrl} (sign in, open Invoices, choose this invoice).`,
+        { invoice: inv, payUrl: inv.payUrl }
+      );
+    })
+  );
+}
+
+// src/prompts.ts
+import { z as z3 } from "zod";
+function registerPrompts(server) {
+  server.registerPrompt(
+    "scaffold-lumen-app",
+    {
+      title: "Scaffold a LumenJS + Roxyon app",
+      description: "Guidance for creating a new LumenJS SPA wired to the Roxyon BaaS and ready to deploy.",
+      argsSchema: {
+        idea: z3.string().describe("What the app should do."),
+        dir: z3.string().optional().describe("Where to create it.")
+      }
+    },
+    ({ idea, dir }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Build a LumenJS single-page app: ${idea}
+
+Steps:
+1. Read the "roxyon://docs/lumenjs" resource \u2014 follow V1 rules exactly (one bind per region, no nested bind, build option lists in JS not :for, check every BaaS write for an error field).
+2. Read "roxyon://docs/baas" for the data/auth API.
+3. Scaffold with the LumenJS CLI 2.5.7: \`npx -y -p @lmjs/cli@2.5.7 lm create <name>\`${dir ? ` in ${dir}` : ""}. Put views under src/views/, wire the BaaS in src/index.js via config.json.
+4. When it runs locally (\`lm serve\`), call roxyon_init then roxyon_deploy (dry run first, then confirm:true).`
+          }
+        }
+      ]
+    })
+  );
+  server.registerPrompt(
+    "build-and-ship-site",
+    {
+      title: "Build a site and host it on Roxyon",
+      description: "Generate a static site (or no-build LumenJS SPA) in the conversation and publish it to a Roxyon host \u2014 for the hosted connector, no local files.",
+      argsSchema: {
+        brief: z3.string().describe("What the site should be."),
+        host: z3.string().describe("Where to host it, e.g. promo.mycompany.com")
+      }
+    },
+    ({ brief, host }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Build and publish a website to ${host}.
+
+Brief: ${brief}
+
+1. Read "roxyon://docs/recipe" and follow it. (Read "roxyon://docs/lumenjs" too only if the site needs reactivity.)
+2. If ${host} is not already on the account, roxyon_add_domain { host: "${host}", confirm: true } (add spa:true only for a real single-page app).
+3. Generate the site \u2014 self-contained static files, relative paths, real .html per page or <page>/index.html, \u226460 files / 2 MB.
+4. roxyon_deploy_content { host: "${host}", files: [...], clean: true, confirm: true } (dry-run first).
+5. roxyon_list_files { host: "${host}" } to verify, then give me the URL. Note that HTTPS may take a couple of minutes on a brand-new host.`
+          }
+        }
+      ]
+    })
+  );
+  server.registerPrompt(
+    "install-wordpress",
+    {
+      title: "Install WordPress on Roxyon",
+      description: "Provision a host + database and install WordPress core \u2014 local/CLI MCP only.",
+      argsSchema: {
+        host: z3.string().describe("Where to install it, e.g. blog.mycompany.com")
+      }
+    },
+    ({ host }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Install WordPress on ${host}.
+
+1. Read "roxyon://docs/recipe-wordpress" and follow it.
+2. Call roxyon_install_wordpress { host: "${host}" } first without confirm to see the plan.
+3. If it looks right, call it again with confirm:true.
+4. Report the site URL and the database credentials (shown once \u2014 pass them on to me now), and tell me to visit the URL to finish WordPress's own setup wizard (site title, admin account).`
+          }
+        }
+      ]
+    })
+  );
+  server.registerPrompt(
+    "deploy-to-roxyon",
+    {
+      title: "Deploy this project to Roxyon",
+      description: "Walk through deploying the current project to Roxyon infrastructure.",
+      argsSchema: { dir: z3.string().describe("Absolute path to the project.") }
+    },
+    ({ dir }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Deploy the project at ${dir} to Roxyon.
+
+1. If there is no roxyon.json, call roxyon_init (it detects the runtime; ask me which host if there are several).
+2. Call roxyon_deploy with just the dir first to see the plan.
+3. If the plan looks right, call roxyon_deploy again with confirm:true.
+4. For an app runtime, report the final status and, if it failed, the last error from roxyon_app_status.`
+          }
+        }
+      ]
+    })
+  );
+}
+
+// src/resources.ts
+import { readFile as readFile2 } from "fs/promises";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath } from "url";
+var RESOURCE_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "resources");
+var DOCS = [
+  {
+    uri: "roxyon://docs/lumenjs",
+    name: "lumenjs-reference",
+    file: "lumenjs.md",
+    title: "LumenJS \u2014 complete reference",
+    description: "Full LumenJS V1 reference for building SPAs with vanilla JS/HTML/CSS (no build step), contrasted with Vue/React. Read before writing .view files."
+  },
+  {
+    uri: "roxyon://docs/baas",
+    name: "baas-reference",
+    file: "baas.md",
+    title: "Roxyon BaaS reference",
+    description: "The Roxyon Backend-as-a-Service REST API: endpoints, auth flow, query rules, and the resolve-on-failure write behaviour."
+  },
+  {
+    uri: "roxyon://docs/deploy",
+    name: "deploy-reference",
+    file: "deploy.md",
+    title: "Deploying to Roxyon",
+    description: "How roxyon_init / roxyon_deploy work, the roxyon.json schema, static vs app deploys, env vars, and git push-to-deploy."
+  },
+  {
+    uri: "roxyon://docs/recipe",
+    name: "web-deploy-recipe",
+    file: "recipe-web-deploy.md",
+    title: "Recipe \u2014 build a site and host it",
+    description: 'The end-to-end flow for "build a landing page and put it on sub.mydomain.com" over the hosted connector: roxyon_add_domain \u2192 roxyon_deploy_content \u2192 roxyon_list_files.'
+  },
+  {
+    uri: "roxyon://docs/recipe-wordpress",
+    name: "wordpress-recipe",
+    file: "recipe-wordpress.md",
+    title: "Recipe \u2014 install WordPress",
+    description: 'The end-to-end flow for "put WordPress on sub.mydomain.com": roxyon_install_wordpress (host + database + WordPress core, one call). Local/CLI-backed MCP only.'
+  }
+];
+function registerResources(server) {
+  for (const doc of DOCS) {
+    server.registerResource(
+      doc.name,
+      doc.uri,
+      { title: doc.title, description: doc.description, mimeType: "text/markdown" },
+      async () => {
+        const body = await readFile2(join2(RESOURCE_DIR, doc.file), "utf8");
+        return { contents: [{ uri: doc.uri, mimeType: "text/markdown", text: body }] };
+      }
+    );
+  }
+}
+
+// src/tools.ts
+import { mkdtemp } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+import { formatEnv } from "@roxyon/api-client";
+import {
+  buildIgnore,
+  buildProjectConfig,
+  deployProject,
+  detectRuntime,
+  installWordPress,
+  listFiles,
+  loadProjectConfig,
+  packDirectory,
+  packFiles,
+  saveProjectConfig
+} from "@roxyon/deploy-core";
+import { z as z4 } from "zod";
+var MAX_FILES = 60;
+var MAX_FILE_BYTES = 1024 * 1024;
+var MAX_TOTAL_BYTES = 2 * 1024 * 1024;
+function remoteFilesystemBlock(tool) {
+  if (!currentContext().remote) return null;
+  return errorResult(
+    [
+      `${tool} needs access to your local project files, which the hosted Roxyon MCP`,
+      "server does not have. Either:",
+      "  \u2022 run the `roxyon` CLI locally (`npm i -g @roxyon/cli`, then `roxyon deploy`), or",
+      "  \u2022 use `roxyon_link_github` to connect a git repo for push-to-deploy, then",
+      "    `roxyon_app_status` / `roxyon_logs` to watch it here."
+    ].join("\n")
+  );
+}
+async function resolveApp(args) {
+  if (args.application) return { applicationId: args.application };
+  if (args.dir) {
+    const cfg = await loadProjectConfig(args.dir);
+    if (cfg?.application) return { applicationId: cfg.application, host: cfg.host };
+    throw new Error(
+      `No application linked in ${args.dir}/roxyon.json. Deploy it once (roxyon_deploy) or pass "application".`
+    );
+  }
+  throw new Error('Pass either "application" (an id) or "dir" (a project directory).');
+}
+function accountContext(session) {
+  return session.roxyon.account.context();
+}
+function registerTools(server) {
+  server.registerTool(
+    "roxyon_whoami",
+    {
+      title: "Roxyon: who am I",
+      description: "Show the signed-in Roxyon user and their subscriptions (which one is active).",
+      inputSchema: {}
+    },
+    () => guard(async () => {
+      const session = await getSession();
+      const ctx = await accountContext(session);
+      const lines = [
+        `User: ${ctx.user.email || ctx.user.id} (${ctx.user.id})`,
+        `Auth: ${session.source}${ctx.scopes.length ? ` (scopes: ${ctx.scopes.join(", ")})` : ""}`,
+        "",
+        "Subscriptions:",
+        ...ctx.subscriptions.map((s) => `  ${s.name || s.id} \u2014 ${s.status || "?"}`),
+        "",
+        `Hosts: ${ctx.domains.map((d) => d.name).join(", ") || "(none)"}`
+      ];
+      return text(lines.join("\n"), {
+        user: ctx.user,
+        scopes: ctx.scopes,
+        subscriptions: ctx.subscriptions,
+        hosts: ctx.domains.map((d) => d.name)
+      });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_domains",
+    {
+      title: "Roxyon: list hosts",
+      description: "List the domains (hosts) on the active subscription \u2014 the possible deploy targets.",
+      inputSchema: {}
+    },
+    () => guard(async () => {
+      const session = await getSession();
+      const { domains } = await accountContext(session);
+      return text(
+        domains.length ? domains.map(
+          (d) => `- ${d.name}${d.status && d.status !== "active" ? ` (${d.status})` : ""}`
+        ).join("\n") : "(no hosts on this account)",
+        { hosts: domains }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_list_apps",
+    {
+      title: "Roxyon: list applications",
+      description: "List the applications on the active subscription with their status and revision.",
+      inputSchema: {}
+    },
+    () => guard(async () => {
+      const session = await getSession();
+      const apps = await session.roxyon.account.apps();
+      const body = apps.length ? apps.map(
+        (a) => `- ${a.name} [${a.id}] \u2014 ${a.status || "?"} (rev ${a.appliedRevision}/${a.configRevision})${a.repo ? ` \xB7 git:${a.repo.branch}` : ""}`
+      ).join("\n") : "(no applications)";
+      return text(body, { applications: apps });
+    })
+  );
+  server.registerTool(
+    "roxyon_init",
+    {
+      title: "Roxyon: initialise a project",
+      description: "Detect a project's type and write roxyon.json. Run this once per project before roxyon_deploy. Does not create anything on the platform.",
+      inputSchema: {
+        dir: z4.string().describe("Absolute path to the project directory."),
+        runtime: z4.enum(["lumen", "node", "python", "php"]).optional(),
+        host: z4.string().optional().describe("Deploy host (a domain on the subscription)."),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root.'),
+        overwrite: z4.boolean().optional().describe("Replace an existing roxyon.json.")
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteFilesystemBlock("roxyon_init");
+      if (blocked) return blocked;
+      const session = await getSession();
+      const existing = await loadProjectConfig(args.dir);
+      if (existing && !args.overwrite) {
+        return errorResult(
+          `roxyon.json already exists in ${args.dir}. Pass overwrite:true to replace it.`,
+          { config: existing }
+        );
+      }
+      const { domains } = await accountContext(session);
+      if (domains.length === 0) {
+        return errorResult(
+          "This account has no hosts. Add a domain in the Roxyon console first."
+        );
+      }
+      const detected = await detectRuntime(args.dir);
+      const runtime = args.runtime ?? detected.runtime;
+      const host = args.host ?? domains[0].name;
+      if (!domains.some((d) => d.name === host)) {
+        return errorResult(
+          `Host "${host}" is not on this account (have: ${domains.map((d) => d.name).join(", ")}).`
+        );
+      }
+      const config = buildProjectConfig({
+        cwd: args.dir,
+        runtime,
+        host,
+        folder: args.folder,
+        start: detected.start
+      });
+      const path = await saveProjectConfig(config, args.dir);
+      return text(
+        `Wrote ${path}
+Detected: ${detected.runtime} (${detected.reason})
+
+${JSON.stringify(config, null, 2)}`,
+        { path, detected: detected.runtime, config }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_deploy",
+    {
+      title: "Roxyon: deploy a project",
+      description: 'Build (if configured) and deploy the project in "dir" to Roxyon. Without confirm:true this returns a dry-run plan (what would build, where it would go, how many files). With confirm:true it runs the build, uploads, and \u2014 for app runtimes \u2014 waits for it to go live. Requires roxyon.json (run roxyon_init first).',
+      inputSchema: {
+        dir: z4.string().describe("Absolute path to the project directory (must contain roxyon.json)."),
+        confirm: z4.boolean().optional().describe("Actually deploy. Omit for a dry-run plan."),
+        build: z4.boolean().optional().describe("Run the configured build command (default true)."),
+        follow: z4.boolean().optional().describe("For app runtimes, wait until running/failed (default true).")
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteFilesystemBlock("roxyon_deploy");
+      if (blocked) return blocked;
+      const session = await getSession();
+      const config = await loadProjectConfig(args.dir);
+      if (!config) {
+        return errorResult(`No roxyon.json in ${args.dir}. Run roxyon_init first.`);
+      }
+      if (!args.confirm) {
+        const ig = await buildIgnore(args.dir);
+        const packRoot = config.kind === "static" && config.outDir ? `${args.dir}/${config.outDir}` : args.dir;
+        let files = [];
+        try {
+          files = await listFiles(packRoot, ig);
+        } catch {
+        }
+        const plan = [
+          "DRY RUN \u2014 pass confirm:true to deploy.",
+          "",
+          `Project:  ${config.name} (${config.runtime}, ${config.kind})`,
+          `Target:   ${config.host}${config.folder ? `/${config.folder}` : ""}`,
+          config.build ? `Build:    ${config.build}` : "Build:    (none)",
+          config.kind === "app" ? `App:      ${config.application ?? "(created on first deploy)"}` : "Serve:    static files from the host document root",
+          files.length ? `Would pack ${files.length} file(s) from ${config.kind === "static" && config.outDir ? config.outDir : "."}` : `Would pack the build output (${config.outDir ?? "dist"}) after building`
+        ].join("\n");
+        return text(plan, { dryRun: true, config });
+      }
+      const logLines = [];
+      const outcome = await deployProject({
+        cwd: args.dir,
+        roxyon: session.roxyon,
+        preferredSubscription: session.preferredSubscription,
+        build: args.build,
+        follow: args.follow ?? true,
+        timeoutMs: 5 * 60 * 1e3,
+        reporter: {
+          step: (m) => logLines.push(`\xBB ${m}`),
+          log: (l) => logLines.push(`  ${l}`)
+        }
+      });
+      const tail = logLines.slice(-60).join("\n");
+      if (outcome.kind === "static" && outcome.ok) {
+        return text(`${tail}
+
+\u2713 Live: ${outcome.url} (${outcome.files} files)`, {
+          ok: true,
+          kind: "static",
+          url: outcome.url
+        });
+      }
+      if (outcome.kind === "app" && outcome.ok) {
+        return text(
+          `${tail}
+
+\u2713 ${outcome.status === "running" ? `Live: ${outcome.url ?? outcome.application}` : `Build queued (revision ${outcome.revision})`}`,
+          {
+            ok: true,
+            kind: "app",
+            application: outcome.application,
+            status: outcome.status,
+            url: outcome.url
+          }
+        );
+      }
+      return errorResult(
+        `${tail}
+
+\u2717 Deploy failed: ${"error" in outcome ? outcome.error : "unknown"}`,
+        { ok: false, application: "application" in outcome ? outcome.application : void 0 }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_app_status",
+    {
+      title: "Roxyon: application status",
+      description: "Current status, revisions and last error for an application (by id or project dir).",
+      inputSchema: {
+        application: z4.string().optional(),
+        dir: z4.string().optional().describe("A project directory whose roxyon.json links an application.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      const app = await session.roxyon.account.getApp(applicationId);
+      if (!app) return errorResult(`Application ${applicationId} not found.`);
+      const settled = app.configRevision <= app.appliedRevision;
+      const body = [
+        `${app.name} [${app.id}]`,
+        `Status:   ${app.status || "?"}${settled ? "" : " (applying)"}`,
+        `Revision: ${app.appliedRevision} / ${app.configRevision}`,
+        `Runtime:  ${app.runtime}`.trim(),
+        app.lastError ? `
+Last error:
+${app.lastError}` : ""
+      ].filter(Boolean).join("\n");
+      return text(body, {
+        id: app.id,
+        status: app.status,
+        settled,
+        configRevision: app.configRevision,
+        appliedRevision: app.appliedRevision,
+        lastError: app.lastError || void 0
+      });
+    })
+  );
+  server.registerTool(
+    "roxyon_logs",
+    {
+      title: "Roxyon: application logs",
+      description: "Recent journal lines for an application (by id or project dir).",
+      inputSchema: {
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        lines: z4.number().int().min(1).max(1e3).optional().describe("How many lines (default 100).")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      const lines = await session.roxyon.applications.logs(applicationId, args.lines ?? 100);
+      return text(lines.join("\n") || "(no log lines)", { lines });
+    })
+  );
+  server.registerTool(
+    "roxyon_restart",
+    {
+      title: "Roxyon: restart an application",
+      description: "Bounce the application process (no rebuild). Needs confirm:true.",
+      inputSchema: {
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      if (!args.confirm)
+        return text(`Would restart ${applicationId}. Pass confirm:true.`, { dryRun: true });
+      await session.roxyon.applications.restart(applicationId);
+      return text(`Restart queued for ${applicationId}.`, { ok: true });
+    })
+  );
+  server.registerTool(
+    "roxyon_env_get",
+    {
+      title: "Roxyon: read environment variables",
+      description: "An application's environment variables as KEY=value lines.",
+      inputSchema: { application: z4.string().optional(), dir: z4.string().optional() }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      const env = await session.roxyon.applications.getEnv(applicationId);
+      return text(formatEnv(env) || "(none set)", { env });
+    })
+  );
+  server.registerTool(
+    "roxyon_env_set",
+    {
+      title: "Roxyon: set environment variables",
+      description: "Merge variables into an application's environment and bump its revision. Run roxyon_deploy afterwards to apply. Needs confirm:true. PORT and HOST are platform-managed and ignored.",
+      inputSchema: {
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        vars: z4.record(z4.string()).describe('{ KEY: "value", ... } to set.'),
+        remove: z4.array(z4.string()).optional().describe("Keys to delete."),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      const set = {};
+      for (const [k, v] of Object.entries(args.vars)) {
+        if (k === "PORT" || k === "HOST") continue;
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) return errorResult(`Invalid env key "${k}".`);
+        set[k] = v;
+      }
+      const planned = [...Object.keys(set), ...(args.remove ?? []).map((k) => `-${k}`)];
+      if (!args.confirm) {
+        return text(`Would update: ${planned.join(", ") || "(nothing)"}. Pass confirm:true.`, {
+          dryRun: true,
+          changed: planned
+        });
+      }
+      const r = await session.roxyon.applications.setEnv(applicationId, {
+        set,
+        remove: args.remove ?? []
+      });
+      return text(`Updated ${r.changed.join(", ") || "(nothing)"}. Run roxyon_deploy to apply.`, {
+        ok: true,
+        changed: r.changed
+      });
+    })
+  );
+  server.registerTool(
+    "roxyon_link_github",
+    {
+      title: "Roxyon: connect a git remote",
+      description: "Connect a git repository to an application for push-to-deploy. Returns the deploy key and webhook URL to add to the repo. Needs confirm:true.",
+      inputSchema: {
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        repoUrl: z4.string().describe("SSH git URL, e.g. git@github.com:you/app.git"),
+        branch: z4.string().optional().describe("Branch to deploy (default main)."),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const { applicationId } = await resolveApp(args);
+      if (!args.confirm) {
+        return text(
+          `Would connect ${args.repoUrl} (${args.branch ?? "main"}) to ${applicationId}. Pass confirm:true.`,
+          { dryRun: true }
+        );
+      }
+      const res = await session.roxyon.applications.repoConnect(
+        applicationId,
+        args.repoUrl,
+        args.branch ?? "main"
+      );
+      const body = [
+        `Connected ${args.repoUrl} (${args.branch ?? "main"}).`,
+        res.deployKey ? `
+Deploy key (add to the repo, read-only):
+${res.deployKey}` : "",
+        res.webhookUrl ? `
+Webhook URL: ${res.webhookUrl}` : "",
+        res.secret ? `Webhook secret: ${res.secret}` : "",
+        res.hint ? `
+${res.hint}` : ""
+      ].filter(Boolean).join("\n");
+      return text(body, {
+        ok: true,
+        deployKey: res.deployKey,
+        webhookUrl: res.webhookUrl,
+        secret: res.secret
+      });
+    })
+  );
+  server.registerTool(
+    "roxyon_add_domain",
+    {
+      title: "Roxyon: add a subdomain / host",
+      description: "Provision a host \u2014 DNS + web server + automatic HTTPS. The host must be a subdomain of a domain the account already hosts (or a *.roxyon.com subdomain). Returns while it is still coming up; TLS follows a minute or two later. Needs confirm:true.",
+      inputSchema: {
+        host: z4.string().describe("The full hostname, e.g. promo.mycompany.com"),
+        subscription: z4.string().optional().describe("Which subscription to attach it to (omit if the account has one)."),
+        spa: z4.boolean().optional().describe("Single-page app: unmatched paths serve /index.html."),
+        phpVersion: z4.string().optional().describe(
+          'PHP version for the vhost, e.g. "8.3" (needed to run PHP apps like WordPress).'
+        ),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (!args.confirm) {
+        return text(
+          `Would provision ${args.host}${args.spa ? " (SPA routing)" : ""}. Pass confirm:true.`,
+          { dryRun: true }
+        );
+      }
+      const res = await session.roxyon.domains.create({
+        host: args.host,
+        subscription: args.subscription ?? session.preferredSubscription,
+        siteType: args.spa ? "spa" : void 0,
+        phpVersion: args.phpVersion
+      });
+      const live = res.status === "active";
+      return text(
+        [
+          `${res.host} \u2014 ${res.type}, ${res.status}.`,
+          live ? "The host is up. HTTPS may take another minute to issue." : "DNS + web server are being set up (~1\u20132 min), then HTTPS. Check roxyon_list_domains, or just deploy now \u2014 files are kept and served once it is live."
+        ].join("\n"),
+        { ok: true, host: res.host, type: res.type, status: res.status }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_deploy_content",
+    {
+      title: "Roxyon: deploy generated files",
+      description: [
+        "Publish a set of files you generated (HTML/CSS/JS/assets) to a host on the account.",
+        "The host must already exist (roxyon_add_domain, or an existing site). Overlay by",
+        "default \u2014 pass clean:true to replace the whole document root. Needs confirm:true.",
+        `Limits: ${MAX_FILES} files, ${MAX_FILE_BYTES / 1024 | 0} KB per file,`,
+        `${(MAX_TOTAL_BYTES / 1024 / 1024).toFixed(1)} MB total (base64-encode binaries).`
+      ].join(" "),
+      inputSchema: {
+        host: z4.string().describe("Target host, e.g. promo.mycompany.com"),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root.'),
+        files: z4.array(
+          z4.object({
+            path: z4.string().describe("Relative path, e.g. index.html, about/index.html"),
+            content: z4.string(),
+            encoding: z4.enum(["utf8", "base64"]).optional()
+          })
+        ).min(1),
+        clean: z4.boolean().optional().describe("Replace the whole docroot (keeps .well-known)."),
+        spa: z4.boolean().optional().describe("Also flip the host to SPA routing."),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (args.files.length > MAX_FILES) {
+        return errorResult(`Too many files (${args.files.length}); the limit is ${MAX_FILES}.`);
+      }
+      let total = 0;
+      for (const f of args.files) {
+        const n = Buffer.byteLength(f.content, f.encoding === "base64" ? "base64" : "utf8");
+        if (n > MAX_FILE_BYTES) {
+          return errorResult(
+            `"${f.path}" is ${n / 1024 | 0} KB; the per-file limit is ${MAX_FILE_BYTES / 1024 | 0} KB.`
+          );
+        }
+        total += n;
+      }
+      if (total > MAX_TOTAL_BYTES) {
+        return errorResult(
+          `Total content is ${(total / 1024 / 1024).toFixed(1)} MB; the limit is ${(MAX_TOTAL_BYTES / 1024 / 1024).toFixed(1)} MB. Deploy in parts or use the CLI.`
+        );
+      }
+      const folder = args.folder ?? "";
+      if (!args.confirm) {
+        return text(
+          [
+            "DRY RUN \u2014 pass confirm:true to deploy.",
+            "",
+            `Host:   ${args.host}${folder ? `/${folder}` : ""}`,
+            `Files:  ${args.files.length} (${total / 1024 | 0} KB)`,
+            `Mode:   ${args.clean ? "clean (replaces the document root)" : "overlay"}${args.spa ? " + SPA routing" : ""}`,
+            ...args.files.slice(0, 20).map((f) => `  ${f.path}`),
+            args.files.length > 20 ? `  \u2026 ${args.files.length - 20} more` : ""
+          ].filter(Boolean).join("\n"),
+          { dryRun: true }
+        );
+      }
+      const { buffer, files } = await packFiles(args.files, { maxBytes: MAX_TOTAL_BYTES });
+      const r = await session.roxyon.sites.deploy(args.host, folder, buffer, {
+        clean: args.clean,
+        spa: args.spa
+      });
+      const size = r.bytes ? ` (${r.bytes / 1024 | 0} KB)` : "";
+      const spaNote = args.spa ? "\nSPA routing enabled \u2014 deep links resolve to index.html." : "";
+      return text(
+        `\u2713 Deployed ${files.length} file(s) to https://${args.host}${folder ? `/${folder}` : ""}${size}.${spaNote}`,
+        { ok: true, host: args.host, files: files.length }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_list_files",
+    {
+      title: "Roxyon: list a site\u2019s files",
+      description: "The files currently deployed to a host's document root.",
+      inputSchema: {
+        host: z4.string(),
+        folder: z4.string().optional(),
+        path: z4.string().optional().describe("List under this sub-path only.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const files = await session.roxyon.sites.listFiles(
+        args.host,
+        args.folder ?? "",
+        args.path ?? ""
+      );
+      const body = files.length ? files.map(
+        (f) => `${f.type === "dir" ? "d" : "-"} ${String(f.size).padStart(8)}  ${f.path}`
+      ).join("\n") : "(empty)";
+      return text(body, { files });
+    })
+  );
+  server.registerTool(
+    "roxyon_read_file",
+    {
+      title: "Roxyon: read a site file",
+      description: "Read one file from a host's document root (to review or edit it).",
+      inputSchema: {
+        host: z4.string(),
+        folder: z4.string().optional(),
+        path: z4.string().describe("Relative path, e.g. index.html")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const f = await session.roxyon.sites.readFile(args.host, args.folder ?? "", args.path);
+      if (f.encoding === "base64") {
+        return text(
+          `${f.path} \u2014 ${f.size} bytes, binary (base64):
+
+${f.content.slice(0, 4096)}`,
+          { path: f.path, size: f.size, encoding: "base64" }
+        );
+      }
+      return text(f.content, { path: f.path, size: f.size, encoding: "utf8" });
+    })
+  );
+  server.registerTool(
+    "roxyon_database_create",
+    {
+      title: "Roxyon: create a database",
+      description: `Provision a MySQL/MariaDB database + user. The name is prefixed with the account's own username (globally unique across the shared cluster) \u2014 pass just the suffix, e.g. "wordpress". The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.`,
+      inputSchema: {
+        name: z4.string().describe("DB name suffix: lowercase letters, digits, underscore."),
+        subscription: z4.string().optional(),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one."),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (!args.confirm) {
+        return text(`Would create database "${args.name}". Pass confirm:true.`, { dryRun: true });
+      }
+      const r = await session.roxyon.databases.create({
+        name: args.name,
+        subscription: args.subscription ?? session.preferredSubscription,
+        password: args.password
+      });
+      const body = [
+        `${r.status === "active" ? "\u2713" : "\xBB"} Database ${r.name} (user ${r.username}) \u2014 ${r.status}.`,
+        r.password ? `
+Password (save this now \u2014 shown once):
+${r.password}` : "",
+        r.host ? `Host: ${r.host}` : ""
+      ].filter(Boolean).join("\n");
+      return text(body, {
+        ok: true,
+        objectId: r.objectId,
+        name: r.name,
+        username: r.username,
+        host: r.host,
+        status: r.status
+      });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_databases",
+    {
+      title: "Roxyon: list databases",
+      description: "Databases on the active subscription.",
+      inputSchema: { subscription: z4.string().optional() }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const subscription = args.subscription ?? session.preferredSubscription;
+      if (!subscription) return errorResult('No subscription \u2014 pass "subscription".');
+      const rows = await session.roxyon.databases.list(subscription);
+      const body = rows.length ? rows.map((d) => `- ${d.Name} [${d.objectId}] \u2014 ${d.Status} (user ${d.Username})`).join("\n") : "(no databases)";
+      return text(body, { databases: rows });
+    })
+  );
+  server.registerTool(
+    "roxyon_database_delete",
+    {
+      title: "Roxyon: delete a database",
+      description: "Delete a database by its objectId (from roxyon_database_create/roxyon_list_databases). Needs confirm:true.",
+      inputSchema: { database: z4.string(), confirm: z4.boolean().optional() }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (!args.confirm) {
+        return text(`Would delete database ${args.database}. Pass confirm:true.`, {
+          dryRun: true
+        });
+      }
+      const r = await session.roxyon.databases.delete(args.database);
+      return text(`Database ${args.database} \u2014 ${r.status}.`, { ok: true, status: r.status });
+    })
+  );
+  server.registerTool(
+    "roxyon_email_create",
+    {
+      title: "Roxyon: create a mailbox",
+      description: "Provision a mailbox on a host already on the account. The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.",
+      inputSchema: {
+        localPart: z4.string().describe('The part before @, e.g. "info".'),
+        domain: z4.string().describe("A hostname already on the account."),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one."),
+        quota: z4.number().int().positive().optional().describe("Quota in MB (default 1024)."),
+        forwardTo: z4.string().optional(),
+        saveCopy: z4.boolean().optional(),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const email = `${args.localPart}@${args.domain}`;
+      if (!args.confirm) {
+        return text(`Would create mailbox ${email}. Pass confirm:true.`, { dryRun: true });
+      }
+      const r = await session.roxyon.email.create({
+        localPart: args.localPart,
+        domain: args.domain,
+        password: args.password,
+        quota: args.quota,
+        forwardTo: args.forwardTo,
+        saveCopy: args.saveCopy
+      });
+      const body = [
+        `${r.status === "active" ? "\u2713" : "\xBB"} Mailbox ${r.email} \u2014 ${r.status}.`,
+        r.password ? `
+Password (save this now \u2014 shown once):
+${r.password}` : ""
+      ].filter(Boolean).join("\n");
+      return text(body, { ok: true, objectId: r.objectId, email: r.email, status: r.status });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_emails",
+    {
+      title: "Roxyon: list mailboxes",
+      description: "Mailboxes on the active subscription.",
+      inputSchema: { subscription: z4.string().optional() }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const subscription = args.subscription ?? session.preferredSubscription;
+      if (!subscription) return errorResult('No subscription \u2014 pass "subscription".');
+      const rows = await session.roxyon.email.list(subscription);
+      const body = rows.length ? rows.map((e) => `- ${e.Email} [${e.objectId}] \u2014 ${e.Status}`).join("\n") : "(no mailboxes)";
+      return text(body, { emails: rows });
+    })
+  );
+  server.registerTool(
+    "roxyon_email_delete",
+    {
+      title: "Roxyon: delete a mailbox",
+      description: "Delete a mailbox by its objectId (from roxyon_email_create/roxyon_list_emails). Needs confirm:true.",
+      inputSchema: { email: z4.string(), confirm: z4.boolean().optional() }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (!args.confirm) {
+        return text(`Would delete mailbox ${args.email}. Pass confirm:true.`, { dryRun: true });
+      }
+      const r = await session.roxyon.email.delete(args.email);
+      return text(`Mailbox ${args.email} \u2014 ${r.status}.`, { ok: true, status: r.status });
+    })
+  );
+  server.registerTool(
+    "roxyon_ssh_reset_password",
+    {
+      title: "Roxyon: reset the SSH/SFTP password",
+      description: "Reset a subscription's shell password \u2014 used for SSH, SFTP, and the file manager. Changing it signs out anything using the old one. The password is shown once in the result; the platform never stores or re-shows it. Needs confirm:true.",
+      inputSchema: {
+        subscription: z4.string().optional(),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one (12+ chars, mixed case, number, symbol)."),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      if (!args.confirm) {
+        return text("Would reset the SSH/SFTP password. Pass confirm:true.", { dryRun: true });
+      }
+      const r = await session.roxyon.ssh.resetPassword({
+        subscription: args.subscription ?? session.preferredSubscription,
+        password: args.password
+      });
+      return text(
+        `${r.status === "active" ? "\u2713" : "\xBB"} SSH/SFTP password ${r.status === "active" ? "changed" : "change queued"}.
+
+Password (save this now \u2014 shown once):
+${r.password}`,
+        { ok: true, subscription: r.subscription, status: r.status }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_install_wordpress",
+    {
+      title: "Roxyon: install WordPress",
+      description: [
+        "One-shot recipe: create a subdomain (if it does not already exist), provision a database",
+        "for it, download WordPress core, and deploy it. v1 scope \u2014 core only, no plugin/theme",
+        "selection, single site. Local-only (needs your filesystem to unpack WordPress into) \u2014 run",
+        "this from the CLI-backed MCP, not the hosted mcp.roxyon.com connector. Needs confirm:true."
+      ].join(" "),
+      inputSchema: {
+        host: z4.string().describe("The site host, e.g. blog.mycompany.com \u2014 created if it does not exist."),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root (recommended).'),
+        subscription: z4.string().optional(),
+        dbName: z4.string().optional().describe(
+          "Database name suffix (default derived from the host). See roxyon_database_create."
+        ),
+        phpVersion: z4.string().optional().describe('Default "8.3".'),
+        confirm: z4.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteFilesystemBlock("roxyon_install_wordpress");
+      if (blocked) return blocked;
+      const session = await getSession();
+      const folder = args.folder ?? "";
+      const dbSuffix = (args.dbName ?? args.host.split(".")[0] ?? "wordpress").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/^[^a-z]+/, "").slice(0, 20) || "wordpress";
+      if (!args.confirm) {
+        return text(
+          [
+            "DRY RUN \u2014 pass confirm:true to install.",
+            "",
+            `Host:     ${args.host}${folder ? `/${folder}` : ""} (created if missing)`,
+            `Database: ${dbSuffix} (prefixed with your account username)`,
+            "Steps:    add domain -> create database -> download WordPress core -> upload"
+          ].join("\n"),
+          { dryRun: true }
+        );
+      }
+      const subscription = args.subscription ?? session.preferredSubscription;
+      const domain = await session.roxyon.domains.create({
+        host: args.host,
+        subscription,
+        phpVersion: args.phpVersion ?? "8.3"
+      });
+      if (domain.status === "failed") {
+        return errorResult(
+          `Could not provision ${args.host}: ${domain.error ?? "unknown error"}`
+        );
+      }
+      const db = await session.roxyon.databases.create({ name: dbSuffix, subscription });
+      if (db.status === "failed" || !db.password || !db.host) {
+        return errorResult(`Could not provision the database: ${db.error ?? "unknown error"}`);
+      }
+      const scratchDir = await mkdtemp(join3(tmpdir(), "roxyon-wp-"));
+      await installWordPress({
+        dir: scratchDir,
+        db: { name: db.name, username: db.username, password: db.password, host: db.host }
+      });
+      const pack = await packDirectory(scratchDir);
+      const deployRes = await session.roxyon.sites.deploy(args.host, folder, pack.buffer);
+      const url = `https://${deployRes.host}${deployRes.path && deployRes.path !== "/" ? deployRes.path : ""}`;
+      return text(
+        [
+          `\u2713 WordPress installed at ${url} (${pack.files.length} files).`,
+          "Visit the site to finish setup (site title, admin account) \u2014 WordPress asks for these",
+          "on first load.",
+          "",
+          `Database: ${db.name} / ${db.username} \u2014 password shown once, save it now:`,
+          db.password
+        ].join("\n"),
+        { ok: true, url, database: { name: db.name, username: db.username } }
+      );
+    })
+  );
+}
+
+// src/server.ts
+var SERVER_NAME = "roxyon";
+var SERVER_VERSION = createRequire(import.meta.url)("../package.json").version;
+function createServer() {
+  const server = new McpServer(
+    { name: SERVER_NAME, version: SERVER_VERSION },
+    {
+      instructions: "Roxyon lets you build LumenJS SPAs, use the Roxyon BaaS, and deploy apps and web projects to Roxyon infrastructure. Read the roxyon://docs/* resources before writing LumenJS or calling the BaaS. To deploy: roxyon_init once per project, then roxyon_deploy (dry run, then confirm:true). Side-effecting tools require confirm:true."
+    }
+  );
+  registerResources(server);
+  registerPrompts(server);
+  registerTools(server);
+  registerBaasTools(server);
+  registerCommerceTools(server);
+  return server;
+}
+
+export {
+  runWithContext,
+  SERVER_NAME,
+  SERVER_VERSION,
+  createServer
+};
+//# sourceMappingURL=chunk-KU3LB5HH.js.map