@roxyon/mcp 0.4.0 → 0.5.0

package/dist/{chunk-HMGCNPGW.js → chunk-KU3LB5HH.js}

@@ -4,8 +4,422 @@
 import { createRequire } from "module";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-// src/prompts.ts
+// src/baas-tools.ts
+import { readFile } from "fs/promises";
+import { join, resolve } from "path";
+import { BAAS_MAX_BATCH, BAAS_MAX_PAGE, BaasDataApi, parseEnv } from "@roxyon/api-client";
 import { z } from "zod";
+
+// src/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+function runWithContext(ctx, fn) {
+  return storage.run(ctx, fn);
+}
+function currentContext() {
+  return storage.getStore() ?? {};
+}
+
+// src/session.ts
+import { Roxyon, isAuthError } from "@roxyon/api-client";
+import { endpointsFromEnv, loadCredentials, tokenFromEnv } from "@roxyon/deploy-core";
+var NotAuthenticatedError = class extends Error {
+  constructor() {
+    super(
+      "Not signed in to Roxyon. Run `roxyon login` in a terminal, or set ROXYON_TOKEN in this MCP server's environment."
+    );
+    this.name = "NotAuthenticatedError";
+  }
+};
+async function getSession() {
+  const { apiUrl, consoleUrl } = endpointsFromEnv();
+  const requestToken = currentContext().token;
+  if (requestToken) {
+    return {
+      roxyon: new Roxyon({ sessionToken: requestToken, baseUrl: apiUrl, consoleUrl }),
+      source: "oauth"
+    };
+  }
+  const envToken = tokenFromEnv();
+  if (envToken) {
+    return {
+      roxyon: new Roxyon({ sessionToken: envToken, baseUrl: apiUrl, consoleUrl }),
+      source: "env-token"
+    };
+  }
+  const creds = await loadCredentials();
+  if (!creds?.sessionToken) throw new NotAuthenticatedError();
+  return {
+    roxyon: new Roxyon({ sessionToken: creds.sessionToken, baseUrl: apiUrl, consoleUrl }),
+    preferredSubscription: creds.subscription,
+    source: "stored-login"
+  };
+}
+function isSessionGone(err) {
+  return err instanceof NotAuthenticatedError || isAuthError(err);
+}
+
+// src/result.ts
+function text(body, structured) {
+  return {
+    content: [{ type: "text", text: body }],
+    ...structured ? { structuredContent: structured } : {}
+  };
+}
+function errorResult(message, structured) {
+  return {
+    content: [{ type: "text", text: message }],
+    ...structured ? { structuredContent: structured } : {},
+    isError: true
+  };
+}
+async function guard(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (isSessionGone(err)) {
+      return errorResult(
+        err.message || "Roxyon session expired \u2014 run `roxyon login` again, or refresh ROXYON_TOKEN."
+      );
+    }
+    return errorResult(err instanceof Error ? err.message : String(err));
+  }
+}
+
+// src/baas-tools.ts
+var MAX_TEXT = 4e4;
+var dirArg = z.string().optional().describe("Project directory whose .env holds RX_SECRET_KEY. Defaults to cwd.");
+function remoteBlock() {
+  if (!currentContext().remote) return null;
+  return errorResult(
+    "The roxyon_baas_* tools read your app secret key from your local project .env, so they only run in the local MCP server (`npx -y @roxyon/mcp`). Manage data in the hosted connector via the console's Roxyon Base panel for now."
+  );
+}
+async function baasFor(dir) {
+  const root = resolve(dir ?? process.cwd());
+  let fileEnv = {};
+  try {
+    fileEnv = parseEnv(await readFile(join(root, ".env"), "utf8"));
+  } catch {
+  }
+  const secretKey = fileEnv.RX_SECRET_KEY || process.env.RX_SECRET_KEY || "";
+  if (!secretKey) {
+    throw new Error(
+      `No BaaS V2 secret key found. Put RX_SECRET_KEY=rxsk_\u2026 in ${join(root, ".env")} (console.roxyon.com \u2192 Roxyon Base \u2192 your project \u2192 API keys). Keep it out of git and out of browser code.`
+    );
+  }
+  return new BaasDataApi({ secretKey });
+}
+function clip(s) {
+  return s.length > MAX_TEXT ? `${s.slice(0, MAX_TEXT)}
+\u2026 (truncated \u2014 narrow with fields/where/limit)` : s;
+}
+function dryRun(what) {
+  return text(`Would ${what}. Pass confirm:true to do it.`, { dryRun: true });
+}
+var SERVER_SCOPE = "Runs as the app backend (server scope, which passes every class rule). Local MCP only.";
+function registerBaasTools(server) {
+  server.registerTool(
+    "roxyon_baas_query",
+    {
+      title: "Roxyon BaaS: query records",
+      description: `Read records of a class in the project's own app on BaaS V2. \`where\` is an object like {"Status":"active","Age":{"gt":18}}; for \`in\`, pass a comma-joined string. \`fields\` defaults to "*"; built-in meta columns must be named. Up to ${BAAS_MAX_PAGE} rows a page (use skip to page). ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        where: z.record(z.any()).optional(),
+        fields: z.string().optional(),
+        order: z.string().optional().describe('e.g. "-createdAt"'),
+        limit: z.number().int().min(1).max(BAAS_MAX_PAGE).optional(),
+        skip: z.number().int().min(0).optional(),
+        count: z.boolean().optional().describe("Also return the total number of matches.")
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const api = await baasFor(args.dir);
+      const { rows, count } = await api.query(args.class, {
+        where: args.where,
+        fields: args.fields,
+        order: args.order,
+        limit: args.limit,
+        skip: args.skip,
+        count: args.count
+      });
+      const head = `${rows.length} row(s)${count !== void 0 ? ` of ${count}` : ""}`;
+      return text(clip(`${head}
+${JSON.stringify(rows, null, 2)}`), { rows, count });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_get",
+    {
+      title: "Roxyon BaaS: read one record",
+      description: `Read one record by objectId. ${SERVER_SCOPE}`,
+      inputSchema: { dir: dirArg, class: z.string(), objectId: z.string() }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const api = await baasFor(args.dir);
+      const row = await api.get(args.class, args.objectId);
+      return text(clip(JSON.stringify(row, null, 2)), { row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_create",
+    {
+      title: "Roxyon BaaS: create a record",
+      description: `Insert one record into an existing class (V2 has no schema changes with a secret key: add classes and columns in the console). For relations store the other row's objectId in a string column. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        data: z.record(z.any()),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) return dryRun(`insert into ${args.class}: ${JSON.stringify(args.data)}`);
+      const api = await baasFor(args.dir);
+      const row = await api.create(args.class, args.data);
+      return text(`\u2713 Created ${args.class} ${String(row.objectId ?? "")}.`, { ok: true, row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_update",
+    {
+      title: "Roxyon BaaS: update a record",
+      description: `Set fields on one record by objectId. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        objectId: z.string(),
+        data: z.record(z.any()),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) {
+        return dryRun(`update ${args.class} ${args.objectId}: ${JSON.stringify(args.data)}`);
+      }
+      const api = await baasFor(args.dir);
+      const row = await api.update(args.class, args.objectId, args.data);
+      return text(`\u2713 Updated ${args.class} ${args.objectId}.`, { ok: true, row });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_delete",
+    {
+      title: "Roxyon BaaS: delete a record",
+      description: `Delete one record by objectId. Needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        class: z.string(),
+        objectId: z.string(),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      if (!args.confirm) return dryRun(`delete ${args.class} ${args.objectId}`);
+      const api = await baasFor(args.dir);
+      await api.delete(args.class, args.objectId);
+      return text(`\u2713 Deleted ${args.class} ${args.objectId}.`, { ok: true });
+    })
+  );
+  server.registerTool(
+    "roxyon_baas_batch",
+    {
+      title: "Roxyon BaaS: batch of record requests",
+      description: `1 to ${BAAS_MAX_BATCH} record requests in one call, each answered on its own (one failing doesn't stop the others). path is /Class or /Class/<objectId>; for POST/PUT the body is {"data":{...}}; for GET the body holds query options (where, fields, limit\u2026). A batch with any write needs confirm:true. ${SERVER_SCOPE}`,
+      inputSchema: {
+        dir: dirArg,
+        requests: z.array(
+          z.object({
+            method: z.enum(["GET", "POST", "PUT", "DELETE"]),
+            path: z.string(),
+            body: z.record(z.any()).optional()
+          })
+        ).min(1).max(BAAS_MAX_BATCH),
+        confirm: z.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      const blocked = remoteBlock();
+      if (blocked) return blocked;
+      const writes = args.requests.filter((r) => r.method !== "GET");
+      if (writes.length && !args.confirm) {
+        return dryRun(
+          `run ${args.requests.length} request(s), ${writes.length} of them writes: ${writes.map((r) => `${r.method} ${r.path}`).join(", ")}`
+        );
+      }
+      const api = await baasFor(args.dir);
+      const results = await api.batch(args.requests);
+      const failed = results.filter((r) => r.ok === false).length;
+      return text(
+        clip(
+          `${results.length} answer(s), ${failed} failed
+${JSON.stringify(results, null, 2)}`
+        ),
+        { results }
+      );
+    })
+  );
+}
+
+// src/commerce-tools.ts
+import { BILLING_CYCLES, Roxyon as Roxyon2 } from "@roxyon/api-client";
+import { endpointsFromEnv as endpointsFromEnv2 } from "@roxyon/deploy-core";
+import { z as z2 } from "zod";
+function publicRoxyon() {
+  const { apiUrl, consoleUrl } = endpointsFromEnv2();
+  return new Roxyon2({ baseUrl: apiUrl, consoleUrl });
+}
+function money(n) {
+  return n === void 0 ? "\u2014" : `$${n.toFixed(2)}`;
+}
+function productLine(p) {
+  const spec = p.vcpu !== void 0 ? ` \u2014 ${p.vcpu} vCPU (${p.cpuType}), ${p.ramGb} GB RAM, ${p.diskGb} GB disk${p.ipv4Included ? `, ${p.ipv4Included} IPv4` : ""}` : "";
+  const prices = BILLING_CYCLES.filter((c) => p.pricesUSD[c] !== void 0).map((c) => `${c} ${money(p.pricesUSD[c])}`).join(", ");
+  return `- ${p.sku || p.planId} "${p.name}" [${p.category}]${spec} | USD ${prices}${p.stock === "out" ? " | OUT OF STOCK" : ""} (planId ${p.planId})`;
+}
+function registerCommerceTools(server) {
+  server.registerTool(
+    "roxyon_catalog",
+    {
+      title: "Roxyon: product catalog",
+      description: 'List what Roxyon sells: cloud servers (cloud.vps.launch / scale / power) and web hosting (cloud.hosting.solo / multiple / isolated). Each product has its planId (what roxyon_quote takes), SKU, specs (vCPU, RAM GB, disk GB, IPv4 included) for servers, list prices in USD per billing cycle BEFORE tax and currency conversion, and stock ("out" = cannot be ordered now). No sign-in needed. Use roxyon_quote for the exact amount a buyer would pay. Read-only.',
+      inputSchema: {
+        category: z2.string().optional().describe('Filter by category prefix, e.g. "cloud.vps" or "cloud.hosting".'),
+        in_stock_only: z2.boolean().optional()
+      }
+    },
+    (args) => guard(async () => {
+      let products = await publicRoxyon().billing.catalog();
+      if (args.category) products = products.filter((p) => p.category.startsWith(args.category));
+      if (args.in_stock_only) products = products.filter((p) => p.stock === "in");
+      return text(
+        products.length ? products.map(productLine).join("\n") : "(no products match)",
+        { products }
+      );
+    })
+  );
+  server.registerTool(
+    "roxyon_quote",
+    {
+      title: "Roxyon: price a new subscription",
+      description: "The exact amount Roxyon's checkout would charge for a NEW subscription to one plan, computed by the platform itself (same server pricing the console checkout uses, setup fee included): line items, subtotal, tax, total, in the requested currency. Pass the buyer currency and country: without them the quote is in USD with no tax, while checkout uses the account's own currency/country. No sign-in needed. Read-only: creates no order. Domains are not priced by this tool yet.",
+      inputSchema: {
+        plan: z2.string().describe('planId (or SKU, e.g. "SCALE-S") from roxyon_catalog.'),
+        cycle: z2.enum(BILLING_CYCLES),
+        currency: z2.string().length(3).optional().describe('ISO 4217, e.g. "USD", "SAR".'),
+        country: z2.string().length(2).optional().describe('ISO 3166 alpha-2, decides tax, e.g. "SA".')
+      }
+    },
+    (args) => guard(async () => {
+      const roxyon = publicRoxyon();
+      const want = args.plan.toLowerCase();
+      const product = (await roxyon.billing.catalog()).find(
+        (p) => p.planId === args.plan || p.sku.toLowerCase() === want
+      );
+      if (!product)
+        throw new Error(`No product "${args.plan}" in the catalog. See roxyon_catalog.`);
+      const q = await roxyon.billing.quote({
+        planId: product.planId,
+        cycle: args.cycle,
+        currency: args.currency,
+        country: args.country
+      });
+      const lines = [
+        ...q.lineItems.map((l) => `${l.label}: ${l.amount} ${q.currency}`),
+        `Subtotal: ${q.subtotal} ${q.currency}`,
+        `${q.taxLabel || "Tax"} (${q.taxRate}%): ${q.taxAmount} ${q.currency}`,
+        `Total: ${q.total} ${q.currency}`
+      ];
+      if (product?.stock === "out") lines.push("Note: this plan is out of stock right now.");
+      return text(lines.join("\n"), { quote: q });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_subscriptions",
+    {
+      title: "Roxyon: my subscriptions (billing)",
+      description: "The signed-in user's own subscriptions with billing details: plan + SKU, status, billing cycle, recurring price and currency, next billing date, auto-renew, and for servers the state (building / running / stopped\u2026) and public IP. Only subscriptions the user owns. Read-only.",
+      inputSchema: {}
+    },
+    () => guard(async () => {
+      const session = await getSession();
+      const subs = await session.roxyon.billing.subscriptions();
+      const body = subs.length ? subs.map(
+        (s) => `- ${s.name || s.id} [${s.status}] ${s.plan}${s.sku ? ` (${s.sku})` : ""} \u2014 ${s.price} ${s.currency}/${s.cycle || "?"}, next billing ${s.nextBillingDate ?? "\u2014"}${s.autoRenew ? ", auto-renew" : ""}${s.serverState ? `, server ${s.serverState}` : ""}${s.publicIp ? ` ${s.publicIp}` : ""}`
+      ).join("\n") : "(no subscriptions on this account)";
+      return text(body, { subscriptions: subs });
+    })
+  );
+  server.registerTool(
+    "roxyon_list_invoices",
+    {
+      title: "Roxyon: my invoices",
+      description: "The signed-in user's own invoices, newest first: number, type, status (pending = unpaid, paid, overdue, void, failed, cancelled), total and currency, due date, and payUrl (the console page where the user pays; null when paid). Read-only: this never pays anything.",
+      inputSchema: {
+        status: z2.enum(["pending", "paid", "overdue", "void", "failed", "cancelled"]).optional(),
+        limit: z2.number().int().min(1).max(100).optional().describe("Default 25.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const invoices = await session.roxyon.billing.invoices({
+        status: args.status,
+        limit: args.limit
+      });
+      const body = invoices.length ? invoices.map(
+        (i) => `- #${i.number || i.id} ${i.type} [${i.status}] ${i.total} ${i.currency}, due ${i.dueDate ?? "\u2014"}${i.payUrl ? ` \u2014 pay at ${i.payUrl}` : ""}`
+      ).join("\n") : "(no invoices)";
+      return text(body, { invoices });
+    })
+  );
+  server.registerTool(
+    "roxyon_pay_link",
+    {
+      title: "Roxyon: where to pay an invoice",
+      description: 'The URL where the signed-in user pays one of their own open invoices (status pending, overdue or failed), plus its amount and due date. Give the invoice number (e.g. "INV2610055") or id from roxyon_list_invoices. A human opens the link and pays in the console; this tool never charges anything. Paid or void invoices have no link.',
+      inputSchema: {
+        invoice: z2.string().min(1).max(40).describe("Invoice number or id.")
+      }
+    },
+    (args) => guard(async () => {
+      const session = await getSession();
+      const want = args.invoice.replace(/^#/, "").toLowerCase();
+      const inv = (await session.roxyon.billing.invoices({ limit: 100 })).find(
+        (i) => i.id.toLowerCase() === want || i.number.toLowerCase() === want
+      );
+      if (!inv) {
+        throw new Error(
+          `No invoice "${args.invoice}" among your latest 100. See roxyon_list_invoices.`
+        );
+      }
+      if (!inv.payUrl) {
+        return text(`Invoice #${inv.number || inv.id} is ${inv.status}: nothing to pay.`, {
+          invoice: inv
+        });
+      }
+      return text(
+        `Invoice #${inv.number || inv.id}: ${inv.total} ${inv.currency}, due ${inv.dueDate ?? "\u2014"}.
+Pay at ${inv.payUrl} (sign in, open Invoices, choose this invoice).`,
+        { invoice: inv, payUrl: inv.payUrl }
+      );
+    })
+  );
+}
+
+// src/prompts.ts
+import { z as z3 } from "zod";
 function registerPrompts(server) {
   server.registerPrompt(
     "scaffold-lumen-app",
@@ -13,8 +427,8 @@ function registerPrompts(server) {
       title: "Scaffold a LumenJS + Roxyon app",
       description: "Guidance for creating a new LumenJS SPA wired to the Roxyon BaaS and ready to deploy.",
       argsSchema: {
-        idea: z.string().describe("What the app should do."),
-        dir: z.string().optional().describe("Where to create it.")
+        idea: z3.string().describe("What the app should do."),
+        dir: z3.string().optional().describe("Where to create it.")
       }
     },
     ({ idea, dir }) => ({
@@ -28,7 +442,7 @@ function registerPrompts(server) {
 Steps:
 1. Read the "roxyon://docs/lumenjs" resource \u2014 follow V1 rules exactly (one bind per region, no nested bind, build option lists in JS not :for, check every BaaS write for an error field).
 2. Read "roxyon://docs/baas" for the data/auth API.
-3. Scaffold with the LumenJS CLI: \`lm create <name>\`${dir ? ` in ${dir}` : ""}. Put views under src/views/, wire the BaaS in src/index.js via config.json.
+3. Scaffold with the LumenJS CLI 2.5.7: \`npx -y -p @lmjs/cli@2.5.7 lm create <name>\`${dir ? ` in ${dir}` : ""}. Put views under src/views/, wire the BaaS in src/index.js via config.json.
 4. When it runs locally (\`lm serve\`), call roxyon_init then roxyon_deploy (dry run first, then confirm:true).`
           }
         }
@@ -41,8 +455,8 @@ Steps:
       title: "Build a site and host it on Roxyon",
       description: "Generate a static site (or no-build LumenJS SPA) in the conversation and publish it to a Roxyon host \u2014 for the hosted connector, no local files.",
       argsSchema: {
-        brief: z.string().describe("What the site should be."),
-        host: z.string().describe("Where to host it, e.g. promo.mycompany.com")
+        brief: z3.string().describe("What the site should be."),
+        host: z3.string().describe("Where to host it, e.g. promo.mycompany.com")
       }
     },
     ({ brief, host }) => ({
@@ -71,7 +485,7 @@ Brief: ${brief}
       title: "Install WordPress on Roxyon",
       description: "Provision a host + database and install WordPress core \u2014 local/CLI MCP only.",
       argsSchema: {
-        host: z.string().describe("Where to install it, e.g. blog.mycompany.com")
+        host: z3.string().describe("Where to install it, e.g. blog.mycompany.com")
       }
     },
     ({ host }) => ({
@@ -96,7 +510,7 @@ Brief: ${brief}
     {
       title: "Deploy this project to Roxyon",
       description: "Walk through deploying the current project to Roxyon infrastructure.",
-      argsSchema: { dir: z.string().describe("Absolute path to the project.") }
+      argsSchema: { dir: z3.string().describe("Absolute path to the project.") }
     },
     ({ dir }) => ({
       messages: [
@@ -118,10 +532,10 @@ Brief: ${brief}
 }
 
 // src/resources.ts
-import { readFile } from "fs/promises";
-import { dirname, join } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
-var RESOURCE_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "resources");
+var RESOURCE_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "resources");
 var DOCS = [
   {
     uri: "roxyon://docs/lumenjs",
@@ -166,7 +580,7 @@ function registerResources(server) {
       doc.uri,
       { title: doc.title, description: doc.description, mimeType: "text/markdown" },
       async () => {
-        const body = await readFile(join(RESOURCE_DIR, doc.file), "utf8");
+        const body = await readFile2(join2(RESOURCE_DIR, doc.file), "utf8");
         return { contents: [{ uri: doc.uri, mimeType: "text/markdown", text: body }] };
       }
     );
@@ -176,7 +590,7 @@ function registerResources(server) {
 // src/tools.ts
 import { mkdtemp } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { formatEnv } from "@roxyon/api-client";
 import {
   buildIgnore,
@@ -190,85 +604,7 @@ import {
   packFiles,
   saveProjectConfig
 } from "@roxyon/deploy-core";
-import { z as z2 } from "zod";
-
-// src/context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var storage = new AsyncLocalStorage();
-function runWithContext(ctx, fn) {
-  return storage.run(ctx, fn);
-}
-function currentContext() {
-  return storage.getStore() ?? {};
-}
-
-// src/session.ts
-import { Roxyon, isAuthError } from "@roxyon/api-client";
-import { endpointsFromEnv, loadCredentials, tokenFromEnv } from "@roxyon/deploy-core";
-var NotAuthenticatedError = class extends Error {
-  constructor() {
-    super(
-      "Not signed in to Roxyon. Run `roxyon login` in a terminal, or set ROXYON_TOKEN in this MCP server's environment."
-    );
-    this.name = "NotAuthenticatedError";
-  }
-};
-async function getSession() {
-  const { apiUrl, consoleUrl } = endpointsFromEnv();
-  const requestToken = currentContext().token;
-  if (requestToken) {
-    return {
-      roxyon: new Roxyon({ sessionToken: requestToken, baseUrl: apiUrl, consoleUrl }),
-      source: "oauth"
-    };
-  }
-  const envToken = tokenFromEnv();
-  if (envToken) {
-    return {
-      roxyon: new Roxyon({ sessionToken: envToken, baseUrl: apiUrl, consoleUrl }),
-      source: "env-token"
-    };
-  }
-  const creds = await loadCredentials();
-  if (!creds?.sessionToken) throw new NotAuthenticatedError();
-  return {
-    roxyon: new Roxyon({ sessionToken: creds.sessionToken, baseUrl: apiUrl, consoleUrl }),
-    preferredSubscription: creds.subscription,
-    source: "stored-login"
-  };
-}
-function isSessionGone(err) {
-  return err instanceof NotAuthenticatedError || isAuthError(err);
-}
-
-// src/result.ts
-function text(body, structured) {
-  return {
-    content: [{ type: "text", text: body }],
-    ...structured ? { structuredContent: structured } : {}
-  };
-}
-function errorResult(message, structured) {
-  return {
-    content: [{ type: "text", text: message }],
-    ...structured ? { structuredContent: structured } : {},
-    isError: true
-  };
-}
-async function guard(fn) {
-  try {
-    return await fn();
-  } catch (err) {
-    if (isSessionGone(err)) {
-      return errorResult(
-        err.message || "Roxyon session expired \u2014 run `roxyon login` again, or refresh ROXYON_TOKEN."
-      );
-    }
-    return errorResult(err instanceof Error ? err.message : String(err));
-  }
-}
-
-// src/tools.ts
+import { z as z4 } from "zod";
 var MAX_FILES = 60;
 var MAX_FILE_BYTES = 1024 * 1024;
 var MAX_TOTAL_BYTES = 2 * 1024 * 1024;
@@ -366,11 +702,11 @@ function registerTools(server) {
       title: "Roxyon: initialise a project",
       description: "Detect a project's type and write roxyon.json. Run this once per project before roxyon_deploy. Does not create anything on the platform.",
       inputSchema: {
-        dir: z2.string().describe("Absolute path to the project directory."),
-        runtime: z2.enum(["lumen", "node", "python", "php"]).optional(),
-        host: z2.string().optional().describe("Deploy host (a domain on the subscription)."),
-        folder: z2.string().optional().describe('Sub-path under the host; "" = site root.'),
-        overwrite: z2.boolean().optional().describe("Replace an existing roxyon.json.")
+        dir: z4.string().describe("Absolute path to the project directory."),
+        runtime: z4.enum(["lumen", "node", "python", "php"]).optional(),
+        host: z4.string().optional().describe("Deploy host (a domain on the subscription)."),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root.'),
+        overwrite: z4.boolean().optional().describe("Replace an existing roxyon.json.")
       }
     },
     (args) => guard(async () => {
@@ -421,10 +757,10 @@ ${JSON.stringify(config, null, 2)}`,
       title: "Roxyon: deploy a project",
       description: 'Build (if configured) and deploy the project in "dir" to Roxyon. Without confirm:true this returns a dry-run plan (what would build, where it would go, how many files). With confirm:true it runs the build, uploads, and \u2014 for app runtimes \u2014 waits for it to go live. Requires roxyon.json (run roxyon_init first).',
       inputSchema: {
-        dir: z2.string().describe("Absolute path to the project directory (must contain roxyon.json)."),
-        confirm: z2.boolean().optional().describe("Actually deploy. Omit for a dry-run plan."),
-        build: z2.boolean().optional().describe("Run the configured build command (default true)."),
-        follow: z2.boolean().optional().describe("For app runtimes, wait until running/failed (default true).")
+        dir: z4.string().describe("Absolute path to the project directory (must contain roxyon.json)."),
+        confirm: z4.boolean().optional().describe("Actually deploy. Omit for a dry-run plan."),
+        build: z4.boolean().optional().describe("Run the configured build command (default true)."),
+        follow: z4.boolean().optional().describe("For app runtimes, wait until running/failed (default true).")
       }
     },
     (args) => guard(async () => {
@@ -505,8 +841,8 @@ ${JSON.stringify(config, null, 2)}`,
       title: "Roxyon: application status",
       description: "Current status, revisions and last error for an application (by id or project dir).",
       inputSchema: {
-        application: z2.string().optional(),
-        dir: z2.string().optional().describe("A project directory whose roxyon.json links an application.")
+        application: z4.string().optional(),
+        dir: z4.string().optional().describe("A project directory whose roxyon.json links an application.")
       }
     },
     (args) => guard(async () => {
@@ -540,9 +876,9 @@ ${app.lastError}` : ""
       title: "Roxyon: application logs",
       description: "Recent journal lines for an application (by id or project dir).",
       inputSchema: {
-        application: z2.string().optional(),
-        dir: z2.string().optional(),
-        lines: z2.number().int().min(1).max(1e3).optional().describe("How many lines (default 100).")
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        lines: z4.number().int().min(1).max(1e3).optional().describe("How many lines (default 100).")
       }
     },
     (args) => guard(async () => {
@@ -558,9 +894,9 @@ ${app.lastError}` : ""
       title: "Roxyon: restart an application",
       description: "Bounce the application process (no rebuild). Needs confirm:true.",
       inputSchema: {
-        application: z2.string().optional(),
-        dir: z2.string().optional(),
-        confirm: z2.boolean().optional()
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -577,7 +913,7 @@ ${app.lastError}` : ""
     {
       title: "Roxyon: read environment variables",
       description: "An application's environment variables as KEY=value lines.",
-      inputSchema: { application: z2.string().optional(), dir: z2.string().optional() }
+      inputSchema: { application: z4.string().optional(), dir: z4.string().optional() }
     },
     (args) => guard(async () => {
       const session = await getSession();
@@ -592,11 +928,11 @@ ${app.lastError}` : ""
       title: "Roxyon: set environment variables",
       description: "Merge variables into an application's environment and bump its revision. Run roxyon_deploy afterwards to apply. Needs confirm:true. PORT and HOST are platform-managed and ignored.",
       inputSchema: {
-        application: z2.string().optional(),
-        dir: z2.string().optional(),
-        vars: z2.record(z2.string()).describe('{ KEY: "value", ... } to set.'),
-        remove: z2.array(z2.string()).optional().describe("Keys to delete."),
-        confirm: z2.boolean().optional()
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        vars: z4.record(z4.string()).describe('{ KEY: "value", ... } to set.'),
+        remove: z4.array(z4.string()).optional().describe("Keys to delete."),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -631,11 +967,11 @@ ${app.lastError}` : ""
       title: "Roxyon: connect a git remote",
       description: "Connect a git repository to an application for push-to-deploy. Returns the deploy key and webhook URL to add to the repo. Needs confirm:true.",
       inputSchema: {
-        application: z2.string().optional(),
-        dir: z2.string().optional(),
-        repoUrl: z2.string().describe("SSH git URL, e.g. git@github.com:you/app.git"),
-        branch: z2.string().optional().describe("Branch to deploy (default main)."),
-        confirm: z2.boolean().optional()
+        application: z4.string().optional(),
+        dir: z4.string().optional(),
+        repoUrl: z4.string().describe("SSH git URL, e.g. git@github.com:you/app.git"),
+        branch: z4.string().optional().describe("Branch to deploy (default main)."),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -677,13 +1013,13 @@ ${res.hint}` : ""
       title: "Roxyon: add a subdomain / host",
       description: "Provision a host \u2014 DNS + web server + automatic HTTPS. The host must be a subdomain of a domain the account already hosts (or a *.roxyon.com subdomain). Returns while it is still coming up; TLS follows a minute or two later. Needs confirm:true.",
       inputSchema: {
-        host: z2.string().describe("The full hostname, e.g. promo.mycompany.com"),
-        subscription: z2.string().optional().describe("Which subscription to attach it to (omit if the account has one)."),
-        spa: z2.boolean().optional().describe("Single-page app: unmatched paths serve /index.html."),
-        phpVersion: z2.string().optional().describe(
+        host: z4.string().describe("The full hostname, e.g. promo.mycompany.com"),
+        subscription: z4.string().optional().describe("Which subscription to attach it to (omit if the account has one)."),
+        spa: z4.boolean().optional().describe("Single-page app: unmatched paths serve /index.html."),
+        phpVersion: z4.string().optional().describe(
           'PHP version for the vhost, e.g. "8.3" (needed to run PHP apps like WordPress).'
         ),
-        confirm: z2.boolean().optional()
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -722,18 +1058,18 @@ ${res.hint}` : ""
         `${(MAX_TOTAL_BYTES / 1024 / 1024).toFixed(1)} MB total (base64-encode binaries).`
       ].join(" "),
       inputSchema: {
-        host: z2.string().describe("Target host, e.g. promo.mycompany.com"),
-        folder: z2.string().optional().describe('Sub-path under the host; "" = site root.'),
-        files: z2.array(
-          z2.object({
-            path: z2.string().describe("Relative path, e.g. index.html, about/index.html"),
-            content: z2.string(),
-            encoding: z2.enum(["utf8", "base64"]).optional()
+        host: z4.string().describe("Target host, e.g. promo.mycompany.com"),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root.'),
+        files: z4.array(
+          z4.object({
+            path: z4.string().describe("Relative path, e.g. index.html, about/index.html"),
+            content: z4.string(),
+            encoding: z4.enum(["utf8", "base64"]).optional()
           })
         ).min(1),
-        clean: z2.boolean().optional().describe("Replace the whole docroot (keeps .well-known)."),
-        spa: z2.boolean().optional().describe("Also flip the host to SPA routing."),
-        confirm: z2.boolean().optional()
+        clean: z4.boolean().optional().describe("Replace the whole docroot (keeps .well-known)."),
+        spa: z4.boolean().optional().describe("Also flip the host to SPA routing."),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -790,9 +1126,9 @@ ${res.hint}` : ""
       title: "Roxyon: list a site\u2019s files",
       description: "The files currently deployed to a host's document root.",
       inputSchema: {
-        host: z2.string(),
-        folder: z2.string().optional(),
-        path: z2.string().optional().describe("List under this sub-path only.")
+        host: z4.string(),
+        folder: z4.string().optional(),
+        path: z4.string().optional().describe("List under this sub-path only.")
       }
     },
     (args) => guard(async () => {
@@ -814,9 +1150,9 @@ ${res.hint}` : ""
       title: "Roxyon: read a site file",
       description: "Read one file from a host's document root (to review or edit it).",
       inputSchema: {
-        host: z2.string(),
-        folder: z2.string().optional(),
-        path: z2.string().describe("Relative path, e.g. index.html")
+        host: z4.string(),
+        folder: z4.string().optional(),
+        path: z4.string().describe("Relative path, e.g. index.html")
       }
     },
     (args) => guard(async () => {
@@ -839,10 +1175,10 @@ ${f.content.slice(0, 4096)}`,
       title: "Roxyon: create a database",
       description: `Provision a MySQL/MariaDB database + user. The name is prefixed with the account's own username (globally unique across the shared cluster) \u2014 pass just the suffix, e.g. "wordpress". The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.`,
       inputSchema: {
-        name: z2.string().describe("DB name suffix: lowercase letters, digits, underscore."),
-        subscription: z2.string().optional(),
-        password: z2.string().optional().describe("Omit to have Roxyon generate one."),
-        confirm: z2.boolean().optional()
+        name: z4.string().describe("DB name suffix: lowercase letters, digits, underscore."),
+        subscription: z4.string().optional(),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one."),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -877,7 +1213,7 @@ ${r.password}` : "",
     {
       title: "Roxyon: list databases",
       description: "Databases on the active subscription.",
-      inputSchema: { subscription: z2.string().optional() }
+      inputSchema: { subscription: z4.string().optional() }
     },
     (args) => guard(async () => {
       const session = await getSession();
@@ -893,7 +1229,7 @@ ${r.password}` : "",
     {
       title: "Roxyon: delete a database",
       description: "Delete a database by its objectId (from roxyon_database_create/roxyon_list_databases). Needs confirm:true.",
-      inputSchema: { database: z2.string(), confirm: z2.boolean().optional() }
+      inputSchema: { database: z4.string(), confirm: z4.boolean().optional() }
     },
     (args) => guard(async () => {
       const session = await getSession();
@@ -912,13 +1248,13 @@ ${r.password}` : "",
       title: "Roxyon: create a mailbox",
       description: "Provision a mailbox on a host already on the account. The password is shown once in the result; there is no way to retrieve it later. Needs confirm:true.",
       inputSchema: {
-        localPart: z2.string().describe('The part before @, e.g. "info".'),
-        domain: z2.string().describe("A hostname already on the account."),
-        password: z2.string().optional().describe("Omit to have Roxyon generate one."),
-        quota: z2.number().int().positive().optional().describe("Quota in MB (default 1024)."),
-        forwardTo: z2.string().optional(),
-        saveCopy: z2.boolean().optional(),
-        confirm: z2.boolean().optional()
+        localPart: z4.string().describe('The part before @, e.g. "info".'),
+        domain: z4.string().describe("A hostname already on the account."),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one."),
+        quota: z4.number().int().positive().optional().describe("Quota in MB (default 1024)."),
+        forwardTo: z4.string().optional(),
+        saveCopy: z4.boolean().optional(),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -949,7 +1285,7 @@ ${r.password}` : ""
     {
       title: "Roxyon: list mailboxes",
       description: "Mailboxes on the active subscription.",
-      inputSchema: { subscription: z2.string().optional() }
+      inputSchema: { subscription: z4.string().optional() }
     },
     (args) => guard(async () => {
       const session = await getSession();
@@ -965,7 +1301,7 @@ ${r.password}` : ""
     {
       title: "Roxyon: delete a mailbox",
       description: "Delete a mailbox by its objectId (from roxyon_email_create/roxyon_list_emails). Needs confirm:true.",
-      inputSchema: { email: z2.string(), confirm: z2.boolean().optional() }
+      inputSchema: { email: z4.string(), confirm: z4.boolean().optional() }
     },
     (args) => guard(async () => {
       const session = await getSession();
@@ -982,9 +1318,9 @@ ${r.password}` : ""
       title: "Roxyon: reset the SSH/SFTP password",
       description: "Reset a subscription's shell password \u2014 used for SSH, SFTP, and the file manager. Changing it signs out anything using the old one. The password is shown once in the result; the platform never stores or re-shows it. Needs confirm:true.",
       inputSchema: {
-        subscription: z2.string().optional(),
-        password: z2.string().optional().describe("Omit to have Roxyon generate one (12+ chars, mixed case, number, symbol)."),
-        confirm: z2.boolean().optional()
+        subscription: z4.string().optional(),
+        password: z4.string().optional().describe("Omit to have Roxyon generate one (12+ chars, mixed case, number, symbol)."),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -1016,14 +1352,14 @@ ${r.password}`,
         "this from the CLI-backed MCP, not the hosted mcp.roxyon.com connector. Needs confirm:true."
       ].join(" "),
       inputSchema: {
-        host: z2.string().describe("The site host, e.g. blog.mycompany.com \u2014 created if it does not exist."),
-        folder: z2.string().optional().describe('Sub-path under the host; "" = site root (recommended).'),
-        subscription: z2.string().optional(),
-        dbName: z2.string().optional().describe(
+        host: z4.string().describe("The site host, e.g. blog.mycompany.com \u2014 created if it does not exist."),
+        folder: z4.string().optional().describe('Sub-path under the host; "" = site root (recommended).'),
+        subscription: z4.string().optional(),
+        dbName: z4.string().optional().describe(
           "Database name suffix (default derived from the host). See roxyon_database_create."
         ),
-        phpVersion: z2.string().optional().describe('Default "8.3".'),
-        confirm: z2.boolean().optional()
+        phpVersion: z4.string().optional().describe('Default "8.3".'),
+        confirm: z4.boolean().optional()
       }
     },
     (args) => guard(async () => {
@@ -1059,7 +1395,7 @@ ${r.password}`,
       if (db.status === "failed" || !db.password || !db.host) {
         return errorResult(`Could not provision the database: ${db.error ?? "unknown error"}`);
       }
-      const scratchDir = await mkdtemp(join2(tmpdir(), "roxyon-wp-"));
+      const scratchDir = await mkdtemp(join3(tmpdir(), "roxyon-wp-"));
       await installWordPress({
         dir: scratchDir,
         db: { name: db.name, username: db.username, password: db.password, host: db.host }
@@ -1095,6 +1431,8 @@ function createServer() {
   registerResources(server);
   registerPrompts(server);
   registerTools(server);
+  registerBaasTools(server);
+  registerCommerceTools(server);
   return server;
 }
 
@@ -1104,4 +1442,4 @@ export {
   SERVER_VERSION,
   createServer
 };
-//# sourceMappingURL=chunk-HMGCNPGW.js.map
+//# sourceMappingURL=chunk-KU3LB5HH.js.map