@runpod/mcp-server 2.0.0 → 3.1.0

package/dist/http.cjs

@@ -30,6 +30,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/http.ts
 var http_exports = {};
 __export(http_exports, {
+  bodyIsCheckable: () => bodyIsCheckable,
+  buildToolContext: () => buildToolContext,
+  defaultCredentialChecker: () => defaultCredentialChecker,
   handleMcpRequest: () => handleMcpRequest,
   registerTools: () => registerTools
 });
@@ -38,81 +41,6 @@ var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamable
 
 // src/server.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
-var SERVER_NAME = "Runpod API Server";
-var SERVER_VERSION = true ? "2.0.0" : "dev";
-function createServer(version = SERVER_VERSION) {
-  return new import_mcp.McpServer({
-    name: SERVER_NAME,
-    version,
-    capabilities: {
-      resources: {},
-      tools: {}
-    }
-  });
-}
-
-// src/tools/runtime.ts
-var import_node_fetch = __toESM(require("node-fetch"), 1);
-var import_node_crypto = require("crypto");
-
-// src/_shared/http.ts
-var HttpError = class extends Error {
-  constructor(prefix, status, body) {
-    super(`${prefix}: ${status} - ${body}`);
-    this.name = "HttpError";
-    this.status = status;
-    this.body = body;
-  }
-};
-function isJsonContentType(contentType) {
-  if (!contentType) return false;
-  const ct = contentType.toLowerCase();
-  return ct.includes("application/json") || ct.includes("+json");
-}
-function methodSendsBody(method) {
-  return method === "POST" || method === "PATCH" || method === "PUT";
-}
-function buildRequestHeaders(apiKey, tracking) {
-  return {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    ...tracking()
-  };
-}
-function createHttpClient(deps) {
-  return async function request(url, method = "GET", body) {
-    const init = {
-      method,
-      headers: buildRequestHeaders(deps.apiKey, deps.tracking)
-    };
-    if (body && methodSendsBody(method)) {
-      init.body = JSON.stringify(body);
-    }
-    const response = await deps.fetch(url, init);
-    if (!response.ok) {
-      throw new HttpError(
-        deps.errorPrefix,
-        response.status,
-        await response.text()
-      );
-    }
-    return isJsonContentType(response.headers.get("content-type")) ? response.json() : { success: true, status: response.status };
-  };
-}
-
-// src/_shared/tracking.ts
-function sanitizeUaToken(value) {
-  return value.replace(/[()<>@,;:\\"/[\]?={}\s]/g, "_").slice(0, 64);
-}
-function buildTrackingHeaders(input) {
-  const name = sanitizeUaToken(input.clientName || "unknown");
-  const version = sanitizeUaToken(input.clientVersion || "unknown");
-  const userAgent = `runpod-mcp-server/${input.serverVersion} (caller=mcp; client=${name}; client_version=${version}; transport=${input.transport})`;
-  return {
-    "User-Agent": userAgent,
-    "X-Runpod-Session-Id": input.sessionId
-  };
-}
 
 // src/_shared/mappers.ts
 function compact(obj) {
@@ -126,6 +54,9 @@ function persistentMount(size, path) {
   if (size === void 0 || path === void 0) return void 0;
   return { persistent: { size, path } };
 }
+function joinStartCmd(cmd) {
+  return cmd && cmd.length ? cmd.join(" ") : void 0;
+}
 function containerConfigToV2(p) {
   return compact({
     image: p.imageName,
@@ -144,6 +75,13 @@ function mapPodCreateToV2(params) {
   return compact({
     ...containerConfigToV2(params),
     name: params.name,
+    // Private-image registry credential (v2 ContainerConfig `registry`). When
+    // deploying from a template, this spreads over the template's registry, so
+    // passing it overrides the inherited credential. An empty string is an
+    // explicit opt-out: emit `registry: null` (v2 accepts null) to CLEAR a
+    // template's inherited credential. Undefined is dropped by compact, so an
+    // omitted param leaves the template's registry in place.
+    registry: params.containerRegistryAuthId === "" ? null : params.containerRegistryAuthId,
     cloud: params.cloudType,
     // v2 CreatePodRequest takes `dataCenterIds` as an ARRAY (preferred data
     // centers; omit/empty = scheduler chooses). Pass the v1 list straight
@@ -161,15 +99,27 @@ function mapPodUpdateToV2(params) {
     ...compact({ name: params.name })
   };
 }
-function nestedOrUndefined(obj) {
-  const c = compact(obj);
-  return Object.keys(c).length ? c : void 0;
+var DEFAULT_ENDPOINT_TYPE = "QUEUE";
+var DEFAULT_SCALER_VALUE = 4;
+function defaultScalerType(endpointType) {
+  return endpointType === "LOAD_BALANCER" ? "REQUEST_COUNT" : "QUEUE_DELAY";
+}
+function endpointScaling(scalerType, value) {
+  return scalerType === "REQUEST_COUNT" ? { type: "REQUEST_COUNT", requestCount: value } : { type: "QUEUE_DELAY", queueDelay: value };
 }
 function endpointGpuConfig(pools, count) {
   if (!pools?.length) return void 0;
   return compact({ pools, count });
 }
-function mapEndpointToV2(params) {
+function endpointWorkers(params) {
+  const workers = compact({
+    min: params.workersMin,
+    max: params.workersMax,
+    idleTimeout: params.idleTimeout
+  });
+  return Object.keys(workers).length ? workers : void 0;
+}
+function endpointCommonToV2(params) {
   return compact({
     name: params.name,
     image: params.imageName,
@@ -179,28 +129,39 @@ function mapEndpointToV2(params) {
     env: params.env,
     registry: params.containerRegistryAuthId,
     gpu: endpointGpuConfig(params.gpuPoolIds, params.gpuCount),
-    workers: nestedOrUndefined({
-      min: params.workersMin,
-      max: params.workersMax
-    }),
-    scaling: nestedOrUndefined({
-      type: params.scalerType,
-      value: params.scalerValue,
-      idleTimeout: params.idleTimeout
-    }),
+    workers: endpointWorkers(params),
     dataCenterIds: params.dataCenterIds?.length ? params.dataCenterIds : void 0,
     networkVolumes: params.networkVolumeIds?.length ? params.networkVolumeIds : void 0,
     timeout: params.executionTimeoutMs,
     flashboot: params.flashboot
   });
 }
-var mapEndpointCreateToV2 = mapEndpointToV2;
-var mapEndpointUpdateToV2 = mapEndpointToV2;
+function mapEndpointCreateToV2(params) {
+  const endpointType = params.endpointType ?? DEFAULT_ENDPOINT_TYPE;
+  return compact({
+    ...endpointCommonToV2(params),
+    type: endpointType,
+    scaling: endpointScaling(
+      params.scalerType ?? defaultScalerType(endpointType),
+      params.scalerValue ?? DEFAULT_SCALER_VALUE
+    )
+  });
+}
+function mapEndpointUpdateToV2(params) {
+  return compact({
+    ...endpointCommonToV2(params),
+    scaling: params.scalerType ? endpointScaling(
+      params.scalerType,
+      params.scalerValue ?? DEFAULT_SCALER_VALUE
+    ) : void 0
+  });
+}
 function mapNetworkVolumeCreateToV2(params) {
   return compact({
     name: params.name,
     size: params.size,
-    dataCenter: params.dataCenterId
+    dataCenter: params.dataCenterId,
+    type: params.volumeType
   });
 }
 function mapTemplateCreateToV2(params) {
@@ -209,18 +170,39 @@ function mapTemplateCreateToV2(params) {
     ...compact({
       name: params.name,
       serverless: params.isServerless,
-      registry: params.containerRegistryAuthId
-    }),
-    // Required by v2 — always emit, defaulting to NVIDIA.
-    category: params.category ?? "NVIDIA"
+      registry: params.containerRegistryAuthId,
+      args: joinStartCmd(params.dockerStartCmd),
+      // No longer required by v2 (it defaults to NVIDIA server-side), so an
+      // unset category is dropped by compact instead of being forced here.
+      category: params.category
+    })
   };
 }
+function podBodyFromTemplate(template) {
+  const out = {};
+  const keys = [
+    "name",
+    "image",
+    "args",
+    "disk",
+    "ports",
+    "env",
+    "mounts",
+    "registry"
+  ];
+  for (const key of keys) {
+    const value = template[key];
+    if (value !== void 0 && value !== null) out[key] = value;
+  }
+  return out;
+}
 function mapTemplateUpdateToV2(params) {
   return {
     ...containerConfigToV2(params),
     ...compact({
       name: params.name,
-      registry: params.containerRegistryAuthId
+      registry: params.containerRegistryAuthId,
+      args: joinStartCmd(params.dockerStartCmd)
     })
   };
 }
@@ -237,7 +219,6 @@ var V2_UNWRAP_KEY = {
   dataCenters: "dataCenters",
   endpoints: "endpoints",
   jobs: "jobs",
-  tags: "tags",
   workers: "workers",
   billing: "records"
 };
@@ -251,7 +232,6 @@ var RESOURCE_ENV_KEY = {
   dataCenters: "DATA_CENTERS",
   endpoints: "ENDPOINTS",
   jobs: "JOBS",
-  tags: "TAGS",
   workers: "WORKERS",
   billing: "BILLING"
 };
@@ -267,6 +247,9 @@ function serverlessBase(env) {
 function publicGraphqlBase(env) {
   return env.RUNPOD_PUBLIC_GRAPHQL_URL ?? "https://api.runpod.io/graphql";
 }
+function authedGraphqlBase(env) {
+  return env.RUNPOD_AUTHED_GRAPHQL_URL ?? "https://api.runpod.io/graphql";
+}
 function unwrapList(resource, version, raw) {
   if (version === "v1") return Array.isArray(raw) ? raw : [];
   if (raw === null || typeof raw !== "object") return [];
@@ -285,6 +268,14 @@ function resolveVersion(opts) {
   }
   return "v1";
 }
+function restVersionSummary(env) {
+  const raw = (env.RUNPOD_REST_VERSION ?? "").trim().toLowerCase();
+  const base = raw ? `RUNPOD_REST_VERSION=${raw}` : "RUNPOD_REST_VERSION unset (default v2)";
+  const overrides = Object.keys(env).filter(
+    (k) => k.startsWith("RUNPOD_REST_VERSION_") && (env[k] ?? "").trim() !== ""
+  ).length;
+  return overrides > 0 ? `${base}, +${overrides} per-resource` : base;
+}
 var identity = (body) => body;
 var V1_REST_PATHS = {
   pods: { list: "/pods", get: (id) => `/pods/${id}` },
@@ -305,7 +296,6 @@ var CATALOG = /* @__PURE__ */ new Set([
   "dataCenters"
 ]);
 var V2_ONLY = /* @__PURE__ */ new Set([
-  "tags",
   "workers",
   "billing"
 ]);
@@ -323,7 +313,6 @@ var V2_REST_PATHS = {
     list: "/catalog/datacenters",
     get: (id) => `/catalog/datacenters/${id}`
   },
-  tags: { list: "/tags", get: (id) => `/tags/${id}` },
   // Endpoints live under /v2/serverless on v2 (NOT /v2/endpoints). The v2 list
   // response wraps rows under `endpoints` (see V2_UNWRAP_KEY), so the existing
   // unwrap key stays correct.
@@ -420,8 +409,186 @@ function resolveBackend(opts) {
   return version === "v2" ? buildV2Backend(resource, env, unwrap) : buildV1Backend(resource, env, unwrap);
 }
 
+// src/server.ts
+var SERVER_NAME = "Runpod API Server";
+var SERVER_VERSION = true ? "3.1.0" : "dev";
+function createServer(version = SERVER_VERSION) {
+  return new import_mcp.McpServer({
+    name: SERVER_NAME,
+    version: `${version} [${restVersionSummary(process.env)}]`,
+    capabilities: {
+      resources: {},
+      tools: {}
+    }
+  });
+}
+
 // src/tools/runtime.ts
-var MCP_SERVER_VERSION = true ? "2.0.0" : "dev";
+var import_node_fetch = __toESM(require("node-fetch"), 1);
+var import_node_crypto = require("crypto");
+
+// src/_shared/http.ts
+var HttpError = class extends Error {
+  constructor(prefix, status, body) {
+    const hint = status === 401 ? " (the Runpod API rejected the credential \u2014 the API key may be expired or revoked; re-authenticate or update RUNPOD_API_KEY)" : "";
+    super(`${prefix}: ${status} - ${body}${hint}`);
+    this.name = "HttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+function isJsonContentType(contentType) {
+  if (!contentType) return false;
+  const ct = contentType.toLowerCase();
+  return ct.includes("application/json") || ct.includes("+json");
+}
+function methodSendsBody(method) {
+  return method === "POST" || method === "PATCH" || method === "PUT";
+}
+function buildRequestHeaders(apiKey, tracking) {
+  return {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    ...tracking()
+  };
+}
+function createHttpClient(deps) {
+  return async function request(url, method = "GET", body) {
+    const init = {
+      method,
+      headers: buildRequestHeaders(deps.apiKey, deps.tracking)
+    };
+    if (body && methodSendsBody(method)) {
+      init.body = JSON.stringify(body);
+    }
+    const response = await deps.fetch(url, init);
+    if (!response.ok) {
+      throw new HttpError(
+        deps.errorPrefix,
+        response.status,
+        await response.text()
+      );
+    }
+    return isJsonContentType(response.headers.get("content-type")) ? response.json() : { success: true, status: response.status };
+  };
+}
+
+// src/_shared/tracking.ts
+function sanitizeUaToken(value) {
+  return value.replace(/[()<>@,;:\\"/[\]?={}\s]/g, "_").slice(0, 64);
+}
+function buildTrackingHeaders(input) {
+  const name = sanitizeUaToken(input.clientName || "unknown");
+  const version = sanitizeUaToken(input.clientVersion || "unknown");
+  const userAgent = `runpod-mcp-server/${input.serverVersion} (caller=mcp; client=${name}; client_version=${version}; transport=${input.transport})`;
+  return {
+    "User-Agent": userAgent,
+    "X-Runpod-Session-Id": input.sessionId
+  };
+}
+
+// src/tools/logs.ts
+var import_zod = require("zod");
+function parseLogSse(raw) {
+  const items = [];
+  for (const block of raw.split(/\r?\n\r?\n/)) {
+    const dataLines = block.split(/\r?\n/).filter((l) => l.startsWith("data:"));
+    if (!dataLines.length) continue;
+    const payload = dataLines.map((l) => l.slice(5).replace(/^ /, "")).join("\n");
+    if (!payload.trim()) continue;
+    try {
+      const parsed = JSON.parse(payload);
+      items.push(
+        parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : { raw: payload }
+      );
+    } catch {
+      items.push({ raw: payload });
+    }
+  }
+  return items;
+}
+var LOG_STREAM_DEFAULT_WAIT_MS = 5e3;
+var LOG_STREAM_MAX_BYTES = 256 * 1024;
+async function readSseSnapshot(fetchImpl, url, headers, opts) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.maxWaitMs);
+  const chunks = [];
+  let bytes = 0;
+  let truncated = false;
+  try {
+    const res = await fetchImpl(url, {
+      method: "GET",
+      headers,
+      signal: controller.signal
+    });
+    if (!res.ok) {
+      throw new HttpError(
+        "Runpod API Error",
+        res.status,
+        await res.text().catch(() => "")
+      );
+    }
+    for await (const chunk of res.body ?? []) {
+      chunks.push(chunk);
+      bytes += chunk.length;
+      if (bytes >= opts.maxBytes) {
+        truncated = true;
+        controller.abort();
+        break;
+      }
+    }
+  } catch (err) {
+    if (!(err instanceof Error && err.name === "AbortError")) throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+  return { raw: Buffer.concat(chunks).toString("utf8"), truncated };
+}
+var logStreamParams = {
+  source: import_zod.z.enum(["container", "system", "both"]).optional().describe("Which log source to read (default: both)"),
+  tail: import_zod.z.number().int().min(0).max(5e3).optional().describe(
+    "Historical lines to backfill before live output (API default 100, max 5000; 0 = live only). Ignored when `since` is set."
+  ),
+  since: import_zod.z.string().optional().describe("RFC3339 timestamp to resume from; when set, `tail` is ignored."),
+  maxWaitMs: import_zod.z.number().int().min(500).max(3e4).optional().describe("How long to read the stream, in ms (default 5000, max 30000)")
+};
+async function collectLogSnapshot(streamSse, logsUrl, params) {
+  const qs = new URLSearchParams();
+  if (params.source && params.source !== "both")
+    qs.append("source", params.source);
+  if (params.tail !== void 0) qs.append("tail", String(params.tail));
+  if (params.since) qs.append("since", params.since);
+  const query = qs.toString() ? `?${qs}` : "";
+  const { raw, truncated } = await streamSse(`${logsUrl}${query}`, {
+    maxWaitMs: params.maxWaitMs ?? LOG_STREAM_DEFAULT_WAIT_MS,
+    maxBytes: LOG_STREAM_MAX_BYTES
+  });
+  const items = parseLogSse(raw);
+  if (truncated) items.pop();
+  return { items, count: items.length, truncated };
+}
+async function streamLogsReply(rt, tool, params) {
+  const backend = rt.backendFor(tool.resource);
+  if (backend.version === "v1") {
+    return rt.jsonReply({
+      error: `${tool.name} is only available on the v2 REST API. Set RUNPOD_REST_VERSION=v2.`,
+      status: 501
+    });
+  }
+  try {
+    return rt.jsonReply(
+      await collectLogSnapshot(rt.streamSse, tool.logsUrl(backend), params)
+    );
+  } catch (error) {
+    if (error instanceof HttpError) {
+      return rt.jsonReply({ error: error.message, status: error.status });
+    }
+    throw error;
+  }
+}
+
+// src/tools/runtime.ts
+var MCP_SERVER_VERSION = true ? "3.1.0" : "dev";
 var SESSION_ID = (0, import_node_crypto.randomUUID)();
 function trackingHeaders(server, ctx) {
   const info = server.server.getClientVersion();
@@ -458,14 +625,18 @@ var DESTRUCTIVE = {
   idempotentHint: true,
   openWorldHint: true
 };
-async function graphqlRequest(query, tracking, fetchImpl, url) {
+async function graphqlRequest(query, tracking, fetchImpl, url, options) {
   const response = await fetchImpl(url, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
+      ...options?.apiKey ? { Authorization: `Bearer ${options.apiKey}` } : {},
       ...tracking()
     },
-    body: JSON.stringify({ query })
+    body: JSON.stringify({
+      query,
+      ...options?.variables ? { variables: options.variables } : {}
+    })
   });
   const result = await response.json();
   if (result.errors && result.errors.length > 0) {
@@ -480,7 +651,17 @@ async function graphqlRequest(query, tracking, fetchImpl, url) {
 }
 function createToolRuntime(server, ctx, deps = {}) {
   const tracking = () => trackingHeaders(server, ctx);
-  const httpFetch = deps.fetch ?? defaultFetch;
+  function observeUnauthorized(fn) {
+    const notify = ctx.onUnauthorized;
+    if (!notify) return fn;
+    return async (...args) => {
+      const response = await fn(...args);
+      if (response.status === 401) notify();
+      return response;
+    };
+  }
+  const rawFetch = deps.fetch ?? defaultFetch;
+  const httpFetch = observeUnauthorized(rawFetch);
   const v1Client = createHttpClient({
     apiKey: ctx.apiKey,
     fetch: httpFetch,
@@ -515,47 +696,19 @@ function createToolRuntime(server, ctx, deps = {}) {
     "Error calling Runpod API:",
     () => restClient(url, method, body)
   );
-  const streamSse = deps.streamSse ?? (async (url, opts) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), opts.maxWaitMs);
-    try {
-      const res = await (0, import_node_fetch.default)(url, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${ctx.apiKey}`,
-          Accept: "text/event-stream",
-          ...tracking()
-        },
-        signal: controller.signal
-      });
-      if (!res.ok) {
-        throw new HttpError(
-          "Runpod API Error",
-          res.status,
-          await res.text().catch(() => "")
-        );
-      }
-      const chunks = [];
-      let bytes = 0;
-      let truncated = false;
-      try {
-        for await (const chunk of res.body) {
-          chunks.push(chunk);
-          bytes += chunk.length;
-          if (bytes >= opts.maxBytes) {
-            truncated = true;
-            controller.abort();
-            break;
-          }
-        }
-      } catch (err) {
-        if (!(err instanceof Error && err.name === "AbortError")) throw err;
-      }
-      return { raw: Buffer.concat(chunks).toString("utf8"), truncated };
-    } finally {
-      clearTimeout(timer);
-    }
-  });
+  const sseFetch = observeUnauthorized(
+    deps.sseFetch ?? import_node_fetch.default
+  );
+  const streamSse = deps.streamSse ?? ((url, opts) => readSseSnapshot(
+    sseFetch,
+    url,
+    {
+      Authorization: `Bearer ${ctx.apiKey}`,
+      Accept: "text/event-stream",
+      ...tracking()
+    },
+    opts
+  ));
   const backendFor = (resource) => resolveBackend({
     resource,
     env: process.env,
@@ -577,9 +730,18 @@ function createToolRuntime(server, ctx, deps = {}) {
     graphql: (query) => graphqlRequest(
       query,
       tracking,
-      httpFetch,
+      // rawFetch, not httpFetch: this call carries no credential (see above).
+      rawFetch,
       publicGraphqlBase(process.env)
     ),
+    graphqlAuthed: (query, variables) => graphqlRequest(
+      query,
+      tracking,
+      httpFetch,
+      // NOT publicGraphqlBase: this call carries the caller's API key.
+      authedGraphqlBase(process.env),
+      { variables, apiKey: ctx.apiKey }
+    ),
     runpodRequest,
     serverlessRequest,
     callRestUrl,
@@ -591,17 +753,17 @@ function createToolRuntime(server, ctx, deps = {}) {
 }
 
 // src/tools/catalog.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 
 // src/pagination.ts
-var import_zod = require("zod");
+var import_zod2 = require("zod");
 var DEFAULT_LIST_LIMIT = 20;
 var MAX_LIST_LIMIT = 100;
 var listPaginationParams = {
-  limit: import_zod.z.number().int().positive().max(MAX_LIST_LIMIT).optional().describe(
+  limit: import_zod2.z.number().int().positive().max(MAX_LIST_LIMIT).optional().describe(
     `Maximum number of items to return (default ${DEFAULT_LIST_LIMIT}, max ${MAX_LIST_LIMIT}). Use the returned nextCursor to fetch the next page.`
   ),
-  cursor: import_zod.z.string().optional().describe(
+  cursor: import_zod2.z.string().optional().describe(
     "Opaque pagination cursor from a previous response (nextCursor). Omit to start from the beginning."
   )
 };
@@ -659,25 +821,32 @@ function registerCatalogTools(server, rt) {
   const { jsonReply: jsonReply2, graphql, callRestUrl, backendFor } = rt;
   server.tool(
     "list-gpu-types",
-    "List available GPU types with stock/pricing and capability filters (minimum VRAM, secure/community cloud, name search). Use this to discover valid gpuTypeIds before creating a pod or endpoint. On v2 the realtime stock filter is a no-op.",
+    "List available GPU types with stock/pricing and capability filters (minimum VRAM, secure/community cloud, name search). Use this to discover valid gpuTypeIds before creating a pod or endpoint. By default the full catalog is returned: each result includes an `availability` summary (HIGH/MEDIUM/LOW/NONE) and results are sorted with the most-available GPUs first, but nothing is hidden. Set includeUnavailable:false to drop out-of-stock GPUs and list only deployable ones (set includeAvailability:false to skip the stock lookup entirely). For per-datacenter availability (to pick a dataCenterIds), use get-gpu-type.",
     {
       ...listPaginationParams,
-      minMemoryGb: import_zod2.z.number().optional().describe("Filter to GPUs with at least this much VRAM in GB"),
-      secureCloudOnly: import_zod2.z.boolean().optional().describe("Filter to only GPUs available in secure cloud"),
-      communityCloudOnly: import_zod2.z.boolean().optional().describe("Filter to only GPUs available in community cloud"),
-      searchTerm: import_zod2.z.string().optional().describe(
+      minMemoryGb: import_zod3.z.number().optional().describe("Filter to GPUs with at least this much VRAM in GB"),
+      secureCloudOnly: import_zod3.z.boolean().optional().describe("Filter to only GPUs available in secure cloud"),
+      communityCloudOnly: import_zod3.z.boolean().optional().describe("Filter to only GPUs available in community cloud"),
+      searchTerm: import_zod3.z.string().optional().describe(
         "Search term to filter GPUs by name (e.g., 'A100', 'RTX 4090')"
       ),
-      includeUnavailable: import_zod2.z.boolean().optional().describe(
-        "Include GPUs that are currently out of stock. Default is false"
+      includeUnavailable: import_zod3.z.boolean().optional().describe(
+        "Out-of-stock GPUs are included by default (annotated availability:NONE and sorted last). Set false to hide them and list only currently-deployable GPUs."
+      ),
+      includeAvailability: import_zod3.z.boolean().optional().describe(
+        "Request realtime stock and annotate each GPU with an availability summary (HIGH/MEDIUM/LOW/NONE). Default true. Set false to skip the availability lookup \u2014 then out-of-stock GPUs cannot be filtered."
       )
     },
     { title: "List GPU types", ...READ_ONLY },
     async (params) => {
       const backend = backendFor("gpus");
       if (backend.version === "v2") {
-        const raw = await callRestUrl(`${backend.base}${backend.list}`);
+        const wantAvailability = params.includeAvailability !== false;
+        const raw = await callRestUrl(
+          `${backend.base}${backend.list}${wantAvailability ? "?include=AVAILABILITY" : ""}`
+        );
         let gpus = backend.unwrap(raw);
+        gpus = gpus.filter((g) => g.id !== "unknown");
         if (params.minMemoryGb !== void 0)
           gpus = gpus.filter(
             (g) => Number(g.memory ?? 0) >= params.minMemoryGb
@@ -690,6 +859,18 @@ function registerCatalogTools(server, rt) {
             (g) => String(g.id ?? "").toLowerCase().includes(t) || String(g.name ?? "").toLowerCase().includes(t)
           );
         }
+        if (params.includeUnavailable === false)
+          gpus = gpus.filter((g) => g.availability !== "NONE");
+        const rank = {
+          HIGH: 3,
+          MEDIUM: 2,
+          LOW: 1,
+          NONE: 0
+        };
+        gpus.sort(
+          (a, b) => (rank[String(b.availability)] ?? 0) - (rank[String(a.availability)] ?? 0)
+        );
+        gpus = gpus.map(({ dataCenters: _dataCenters, ...rest }) => rest);
         return capListResult(gpus, {
           limit: params.limit,
           cursor: params.cursor
@@ -719,7 +900,7 @@ function registerCatalogTools(server, rt) {
         return !!status && status !== "Out";
       };
       let gpuTypes = data.gpuTypes.filter((gpu) => gpu.id !== "unknown");
-      if (!params.includeUnavailable) {
+      if (params.includeUnavailable === false) {
         gpuTypes = gpuTypes.filter(isAvailable);
       }
       if (params.minMemoryGb) {
@@ -765,7 +946,7 @@ function registerCatalogTools(server, rt) {
     "List Runpod data centers (id, name, region/location). Use this to discover valid dataCenterIds for placing pods, endpoints, or network volumes.",
     {
       ...listPaginationParams,
-      region: import_zod2.z.string().optional().describe(
+      region: import_zod3.z.string().optional().describe(
         "Filter by region/location (e.g., 'United States', 'Europe', 'Canada')"
       )
     },
@@ -830,9 +1011,12 @@ function registerCatalogTools(server, rt) {
   );
   server.tool(
     "get-gpu-type",
-    "Get details for a single GPU type by id. v2-only \u2014 returns a 501 notice on the v1 API (use list-gpu-types there).",
+    "Get details for a single GPU type by id, including per-datacenter availability. v2-only \u2014 returns a 501 notice on the v1 API (use list-gpu-types there). Use the returned dataCenters[].availability to pick a dataCenterIds with stock before creating a pod.",
     {
-      gpuTypeId: import_zod2.z.string().describe("ID of the GPU type to retrieve")
+      gpuTypeId: import_zod3.z.string().describe("ID of the GPU type to retrieve"),
+      includeAvailability: import_zod3.z.boolean().optional().describe(
+        "Include realtime per-datacenter availability (HIGH/MEDIUM/LOW/NONE). Default true."
+      )
     },
     { title: "Get GPU type", ...READ_ONLY },
     async (params) => {
@@ -843,9 +1027,9 @@ function registerCatalogTools(server, rt) {
           status: 501
         });
       }
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(params.gpuTypeId)}`
-      );
+      const path = backend.get(encodeURIComponent(params.gpuTypeId));
+      const query = params.includeAvailability === false ? "" : "?include=AVAILABILITY";
+      const result = await callRestUrl(`${backend.base}${path}${query}`);
       return jsonReply2(result);
     }
   );
@@ -853,7 +1037,7 @@ function registerCatalogTools(server, rt) {
     "get-cpu-type",
     "Get details for a single CPU flavor type by id. v2-only \u2014 returns a 501 notice on the v1 API (use list-cpu-types there).",
     {
-      cpuTypeId: import_zod2.z.string().describe("ID of the CPU type to retrieve")
+      cpuTypeId: import_zod3.z.string().describe("ID of the CPU type to retrieve")
     },
     { title: "Get CPU type", ...READ_ONLY },
     async (params) => {
@@ -874,7 +1058,7 @@ function registerCatalogTools(server, rt) {
     "get-data-center",
     "Get details for a single data center by id. v2-only \u2014 returns a 501 notice on the v1 API (use list-data-centers there).",
     {
-      dataCenterId: import_zod2.z.string().describe("ID of the data center to retrieve")
+      dataCenterId: import_zod3.z.string().describe("ID of the data center to retrieve")
     },
     { title: "Get data center", ...READ_ONLY },
     async (params) => {
@@ -885,16 +1069,587 @@ function registerCatalogTools(server, rt) {
           status: 501
         });
       }
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(params.dataCenterId)}`
+      const result = await callRestUrl(
+        `${backend.base}${backend.get(params.dataCenterId)}`
+      );
+      return jsonReply2(result);
+    }
+  );
+}
+
+// src/tools/hub.ts
+var import_zod4 = require("zod");
+function parseReleaseConfig(config) {
+  if (!config) return void 0;
+  try {
+    return JSON.parse(config);
+  } catch {
+    return config;
+  }
+}
+function listingsQuery(withConfig) {
+  return `
+    query {
+      listings(input: {}) {
+        id
+        repoId
+        title
+        description
+        repoName
+        repoOwner
+        createdAt
+        updatedAt
+        views
+        stars
+        deploys
+        language
+        category
+        tags
+        type
+        listedRelease {
+          id
+          name
+          tagName
+          createdAt${withConfig ? "\n          config" : ""}
+          build {
+            id
+            imageName
+          }
+        }
+      }
+    }
+  `;
+}
+function serializeBoolean(value, input) {
+  if (value === "true") return input.trueValue ?? "true";
+  if (value === "false") return input.falseValue ?? "false";
+  return value;
+}
+function buildHubEnv(config, overrides) {
+  const env = [];
+  const missingRequired = [];
+  const remaining = { ...overrides };
+  for (const entry of config.env ?? []) {
+    const input = entry.input ?? {};
+    const override = entry.key in remaining ? remaining[entry.key] : void 0;
+    delete remaining[entry.key];
+    if (override !== void 0 && override !== "") {
+      env.push({
+        key: entry.key,
+        value: input.type === "boolean" ? serializeBoolean(override, input) : override
+      });
+      continue;
+    }
+    if (input.default !== void 0 && input.default !== null) {
+      env.push({
+        key: entry.key,
+        value: typeof input.default === "boolean" ? input.default ? input.trueValue ?? "true" : input.falseValue ?? "false" : String(input.default)
+      });
+      continue;
+    }
+    if (input.required) {
+      missingRequired.push(entry.key);
+      env.push({ key: entry.key, value: "" });
+      continue;
+    }
+  }
+  for (const [key, value] of Object.entries(remaining)) {
+    env.push({ key, value });
+  }
+  return { env, missingRequired };
+}
+function minCudaVersion(versions) {
+  if (!versions || versions.length === 0) return null;
+  const compare = (a, b) => {
+    const pa = a.split(".").map(Number);
+    const pb = b.split(".").map(Number);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+      if (d !== 0) return d;
+    }
+    return 0;
+  };
+  return [...versions].sort(compare)[0];
+}
+function randomSuffix() {
+  return Math.random().toString(36).slice(2, 8);
+}
+function registerHubTools(server, rt) {
+  const { graphql, graphqlAuthed, jsonReply: jsonReply2 } = rt;
+  server.tool(
+    "list-hub-repos",
+    "List repos published to the Runpod Hub (prebuilt Serverless workers and Pod templates, e.g. vLLM, ComfyUI). Public catalog \u2014 no auth required. Each result includes the currently listed release with its hubReleaseId and prebuilt image name. Results are sorted by deploy count (most popular first). Set includeConfig:true to also return the release config (hardware requirements and environment-variable schema) \u2014 it is large, so prefer requesting it for a single repo via the repoOwner/searchTerm filters.",
+    {
+      ...listPaginationParams,
+      searchTerm: import_zod4.z.string().optional().describe(
+        "Case-insensitive search across title, description, repo name, owner, and tags (e.g. 'vllm', 'comfyui', 'fine-tuning')"
+      ),
+      category: import_zod4.z.string().optional().describe(
+        "Filter by category (e.g. 'language', 'image', 'audio', 'video', 'embedding')"
+      ),
+      type: import_zod4.z.enum(["SERVERLESS", "POD"]).optional().describe(
+        "Filter by listing type: SERVERLESS (endpoint workers) or POD (pod templates)"
+      ),
+      repoOwner: import_zod4.z.string().optional().describe(
+        "Filter to listings from this GitHub owner/org (e.g. 'runpod-workers', 'axolotl-ai-cloud')"
+      ),
+      includeConfig: import_zod4.z.boolean().optional().describe(
+        "Include the listed release config (hardware requirements + env-var input schema, parsed from .runpod/hub.json). Large \u2014 off by default."
+      )
+    },
+    { title: "List Hub repos", ...READ_ONLY },
+    async (params) => {
+      const data = await graphql(
+        listingsQuery(params.includeConfig === true)
+      );
+      let listings = data.listings;
+      if (params.type) {
+        listings = listings.filter(
+          (l) => (l.type ?? "").toUpperCase() === params.type
+        );
+      }
+      if (params.category) {
+        const term = params.category.toLowerCase();
+        listings = listings.filter(
+          (l) => (l.category ?? "").toLowerCase() === term
+        );
+      }
+      if (params.repoOwner) {
+        const term = params.repoOwner.toLowerCase();
+        listings = listings.filter(
+          (l) => (l.repoOwner ?? "").toLowerCase() === term
+        );
+      }
+      if (params.searchTerm) {
+        const term = params.searchTerm.toLowerCase();
+        listings = listings.filter(
+          (l) => [
+            l.title,
+            l.description,
+            l.repoName,
+            l.repoOwner,
+            ...l.tags ?? []
+          ].some((field) => (field ?? "").toLowerCase().includes(term))
+        );
+      }
+      listings = [...listings].sort(
+        (a, b) => (b.deploys ?? 0) - (a.deploys ?? 0) || a.id.localeCompare(b.id)
+      );
+      const result = listings.map((l) => ({
+        id: l.id,
+        repo: `${l.repoOwner}/${l.repoName}`,
+        title: l.title,
+        description: l.description,
+        type: l.type,
+        category: l.category,
+        tags: l.tags,
+        language: l.language,
+        stars: l.stars,
+        deploys: l.deploys,
+        views: l.views,
+        githubUrl: `https://github.com/${l.repoOwner}/${l.repoName}`,
+        hubUrl: `https://console.runpod.io/hub/${l.repoOwner}/${l.repoName}`,
+        createdAt: l.createdAt,
+        updatedAt: l.updatedAt,
+        listedRelease: l.listedRelease ? {
+          hubReleaseId: l.listedRelease.id,
+          name: l.listedRelease.name,
+          tagName: l.listedRelease.tagName,
+          createdAt: l.listedRelease.createdAt,
+          imageName: l.listedRelease.build?.imageName,
+          ...params.includeConfig ? { config: parseReleaseConfig(l.listedRelease.config) } : {}
+        } : null
+      }));
+      return capListResult(result, {
+        limit: params.limit,
+        cursor: params.cursor
+      });
+    }
+  );
+  server.tool(
+    "deploy-hub-repo",
+    "Deploy a Runpod Hub repo's listed release as a new Serverless endpoint (the same as clicking Deploy on the Hub). Identify the repo by `repo` (\"owner/name\" from list-hub-repos) or by `hubReleaseId`. The release supplies the prebuilt image, container disk, CUDA constraints, and env-var defaults; pass `env` to override or fill in values (required keys without a default must be provided \u2014 check list-hub-repos with includeConfig:true for the schema). GPU selection comes from the release config when it specifies one; otherwise pass gpuIds (GPU pool names, e.g. 'ADA_24' or 'ADA_80_PRO,AMPERE_80'). Uses the authenticated GraphQL API (no REST home for Hub deploys yet), so it works the same on v1 and v2.",
+    {
+      repo: import_zod4.z.string().optional().describe(
+        `The Hub repo to deploy as "owner/name" (e.g. 'runpod-workers/worker-comfyui'). Deploys its currently listed release. Provide this or hubReleaseId.`
+      ),
+      hubReleaseId: import_zod4.z.string().optional().describe(
+        "The Hub release ID to deploy (from list-hub-repos listedRelease.hubReleaseId). Provide this or repo."
+      ),
+      name: import_zod4.z.string().optional().describe(
+        "Name for the new endpoint. Defaults to '<listing title> <release tag>'."
+      ),
+      env: import_zod4.z.record(import_zod4.z.string()).optional().describe(
+        "Environment variable overrides, merged over the release config defaults. Keys not in the release schema are passed through as-is."
+      ),
+      gpuIds: import_zod4.z.string().optional().describe(
+        "Comma-separated GPU pool names for workers (e.g. 'ADA_24' or 'ADA_80_PRO,AMPERE_80'). To pin specific GPU SKUs within a pool, append exclusions prefixed with '-' using GPU type ids from list-gpu-types (e.g. 'AMPERE_16,-NVIDIA RTX 2000 Ada Generation,-NVIDIA RTX A4500' allows only the pool's remaining SKUs). Defaults to the release config's gpuIds; required when the config does not specify one."
+      ),
+      gpuCount: import_zod4.z.number().int().positive().optional().describe("GPUs per worker. Defaults to the release config (or 1)."),
+      containerDiskInGb: import_zod4.z.number().int().positive().optional().describe("Container disk size in GB. Defaults to the release config."),
+      workersMin: import_zod4.z.number().int().min(0).optional().describe("Minimum workers (default 0 \u2014 scale to zero)."),
+      workersMax: import_zod4.z.number().int().positive().optional().describe("Maximum workers (default: account default)."),
+      idleTimeout: import_zod4.z.number().int().positive().optional().describe("Seconds a worker idles before scaling down (default 5)."),
+      scalerType: import_zod4.z.enum(["QUEUE_DELAY", "REQUEST_COUNT"]).optional().describe("Autoscaler type (default QUEUE_DELAY)."),
+      scalerValue: import_zod4.z.number().optional().describe("Autoscaler target value (default 4)."),
+      executionTimeoutMs: import_zod4.z.number().int().positive().optional().describe("Per-job execution timeout in ms (default 600000)."),
+      flashboot: import_zod4.z.enum(["OFF", "FLASHBOOT", "PRIORITY_FLASHBOOT"]).optional().describe("FlashBoot mode (default FLASHBOOT).")
+    },
+    { title: "Deploy Hub repo", ...WRITE },
+    async (params) => {
+      if (!params.repo && !params.hubReleaseId) {
+        return jsonReply2({
+          error: 'Provide either repo ("owner/name") or hubReleaseId. Use list-hub-repos to discover both.'
+        });
+      }
+      const catalog = await graphql(listingsQuery(true));
+      let listing;
+      if (params.hubReleaseId) {
+        listing = catalog.listings.find(
+          (l) => l.listedRelease?.id === params.hubReleaseId
+        );
+      } else {
+        const repoKey = params.repo.toLowerCase();
+        listing = catalog.listings.find(
+          (l) => `${l.repoOwner}/${l.repoName}`.toLowerCase() === repoKey
+        );
+      }
+      if (!listing) {
+        return jsonReply2({
+          error: `No Hub listing found for ${params.hubReleaseId ? `hubReleaseId "${params.hubReleaseId}" (only each repo's currently listed release is deployable)` : `repo "${params.repo}"`}. Use list-hub-repos to see the catalog.`
+        });
+      }
+      const release = listing.listedRelease;
+      if (!release?.build?.imageName) {
+        return jsonReply2({
+          error: `Hub repo ${listing.repoOwner}/${listing.repoName} has no listed release with a built image, so it cannot be deployed.`
+        });
+      }
+      if ((listing.type ?? "").toUpperCase() !== "SERVERLESS") {
+        return jsonReply2({
+          error: `Hub repo ${listing.repoOwner}/${listing.repoName} is a ${listing.type} listing \u2014 only SERVERLESS listings deploy as endpoints.`
+        });
+      }
+      const config = parseReleaseConfig(release.config) ?? {};
+      const gpuIds = params.gpuIds ?? config.gpuIds;
+      if (!gpuIds) {
+        return jsonReply2({
+          error: 'This release does not specify a GPU pool \u2014 pass gpuIds (comma-separated pool names, e.g. "ADA_80_PRO,AMPERE_80"; see the pool field on list-gpu-types).'
+        });
+      }
+      const { env, missingRequired } = buildHubEnv(config, params.env ?? {});
+      if (missingRequired.length > 0) {
+        return jsonReply2({
+          error: `Missing required environment variables for this release: ${missingRequired.join(
+            ", "
+          )}. Pass them via the env parameter.`
+        });
+      }
+      const endpointName = params.name ?? `${listing.title} ${release.tagName}`;
+      const minCuda = minCudaVersion(config.allowedCudaVersions);
+      const input = {
+        name: endpointName,
+        hubReleaseId: release.id,
+        type: "QB",
+        gpuIds,
+        gpuCount: params.gpuCount ?? config.gpuCount ?? 1,
+        workersMin: params.workersMin ?? 0,
+        workersMax: params.workersMax ?? null,
+        idleTimeout: params.idleTimeout ?? 5,
+        scalerType: params.scalerType ?? "QUEUE_DELAY",
+        scalerValue: params.scalerValue ?? 4,
+        executionTimeoutMs: params.executionTimeoutMs ?? 6e5,
+        flashBootType: params.flashboot ?? "FLASHBOOT",
+        locations: null,
+        networkVolumeIds: null,
+        compliance: [],
+        modelReferences: [],
+        ...minCuda ? {
+          minCudaVersion: minCuda,
+          allowedCudaVersions: config.allowedCudaVersions.join(",")
+        } : {},
+        template: {
+          name: `${endpointName}__template__${randomSuffix()}`,
+          imageName: release.build.imageName,
+          containerDiskInGb: params.containerDiskInGb ?? config.containerDiskInGb ?? 20,
+          containerRegistryAuthId: "",
+          dockerArgs: "",
+          startScript: "",
+          ports: "",
+          env
+        }
+      };
+      const data = await graphqlAuthed(
+        `
+          mutation saveEndpoint($input: EndpointInput!) {
+            saveEndpoint(input: $input) {
+              id
+              name
+              gpuIds
+              gpuCount
+              workersMin
+              workersMax
+              idleTimeout
+              scalerType
+              scalerValue
+              flashBootType
+              templateId
+            }
+          }
+        `,
+        { input }
+      );
+      return jsonReply2({
+        endpoint: data.saveEndpoint,
+        deployed: {
+          repo: `${listing.repoOwner}/${listing.repoName}`,
+          release: release.tagName,
+          hubReleaseId: release.id,
+          imageName: release.build.imageName
+        },
+        note: `Endpoint created. Submit jobs with run-endpoint/runsync-endpoint using endpointId "${data.saveEndpoint.id}".`
+      });
+    }
+  );
+}
+
+// src/tools/public-endpoints.ts
+var import_zod5 = require("zod");
+function parseMetadata(metadata) {
+  if (!metadata) return {};
+  try {
+    const parsed = JSON.parse(metadata);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function registerPublicEndpointTools(server, rt) {
+  const { graphql } = rt;
+  server.tool(
+    "list-public-endpoints",
+    "List Runpod Public Endpoints \u2014 managed, pay-per-use model APIs (text, image, video, audio) that require no deployment. Public catalog, no auth required. Each result includes the endpointId to call with run-endpoint/runsync-endpoint (or via https://api.runpod.ai/v2/{endpointId}), the model name, modality, owner, and pricing. Only live endpoints are returned by default; set includeOffline:true to also list ones that are not currently live.",
+    {
+      ...listPaginationParams,
+      searchTerm: import_zod5.z.string().optional().describe(
+        "Case-insensitive search across display name, model name, endpoint id, description, owner, and tag (e.g. 'kimi', 'video', 'flux')"
+      ),
+      modality: import_zod5.z.string().optional().describe(
+        "Filter by modality/category (the metadata source field, e.g. 'language', 'image', 'video', 'audio')"
+      ),
+      owner: import_zod5.z.string().optional().describe(
+        "Filter by model owner (e.g. 'moonshot', 'minimax', 'google')"
+      ),
+      includeOffline: import_zod5.z.boolean().optional().describe(
+        "Include endpoints that are not currently live (isLive:false). Default false \u2014 only live endpoints are listed."
+      )
+    },
+    { title: "List public endpoints", ...READ_ONLY },
+    async (params) => {
+      const data = await graphql(`
+        query {
+          allAiApiPublicConfigs {
+            id
+            aiApiId
+            modelName
+            displayName
+            description
+            metadata
+            isLive
+            createdAt
+            updatedAt
+          }
+        }
+      `);
+      let configs = data.allAiApiPublicConfigs.map((c) => ({
+        config: c,
+        meta: parseMetadata(c.metadata)
+      }));
+      if (!params.includeOffline) {
+        configs = configs.filter(({ config }) => config.isLive);
+      }
+      if (params.modality) {
+        const term = params.modality.toLowerCase();
+        configs = configs.filter(
+          ({ meta }) => (meta.source ?? "").toLowerCase() === term
+        );
+      }
+      if (params.owner) {
+        const term = params.owner.toLowerCase();
+        configs = configs.filter(
+          ({ meta }) => (meta.owner ?? "").toLowerCase() === term
+        );
+      }
+      if (params.searchTerm) {
+        const term = params.searchTerm.toLowerCase();
+        configs = configs.filter(
+          ({ config, meta }) => [
+            config.displayName,
+            config.modelName,
+            config.aiApiId,
+            config.description,
+            meta.owner,
+            meta.tag,
+            meta.source
+          ].some((field) => (field ?? "").toLowerCase().includes(term))
+        );
+      }
+      configs = [...configs].sort(
+        (a, b) => a.config.displayName.localeCompare(b.config.displayName)
+      );
+      const result = configs.map(({ config, meta }) => ({
+        endpointId: config.aiApiId,
+        displayName: config.displayName,
+        modelName: config.modelName,
+        description: config.description,
+        modality: meta.source,
+        tag: meta.tag,
+        owner: meta.owner,
+        pricing: meta.priceString,
+        isLive: config.isLive,
+        baseUrl: `https://api.runpod.ai/v2/${config.aiApiId}`,
+        createdAt: config.createdAt,
+        updatedAt: config.updatedAt
+      }));
+      return capListResult(result, {
+        limit: params.limit,
+        cursor: params.cursor
+      });
+    }
+  );
+}
+
+// src/tools/endpoint-gpus.ts
+var import_zod6 = require("zod");
+function registerEndpointGpuTools(server, rt) {
+  const { graphqlAuthed, jsonReply: jsonReply2 } = rt;
+  server.tool(
+    "set-endpoint-gpus",
+    "Set which GPUs a Serverless endpoint's workers run on \u2014 including pinning specific GPU SKUs, which create-endpoint/update-endpoint cannot express. Provide either a raw gpuIds string, or pools plus optional excludeGpuTypeIds (GPU type ids from list-gpu-types) and the exclusion string is built for you: a pool allows every SKU in it, and excluding all but one SKU pins that SKU exactly (e.g. pools:['AMPERE_16'], excludeGpuTypeIds:['NVIDIA RTX 2000 Ada Generation','NVIDIA RTX 4000 Ada Generation','NVIDIA RTX A4500'] pins RTX A4000). All other endpoint settings (workers, scaling, timeouts, template) are read first and preserved. Works on any Serverless endpoint via the authenticated GraphQL API.",
+    {
+      endpointId: import_zod6.z.string().describe("ID of the Serverless endpoint to update"),
+      gpuIds: import_zod6.z.string().optional().describe(
+        "Raw gpuIds string, e.g. 'ADA_24' or 'AMPERE_16,-NVIDIA RTX A4500'. Takes precedence over pools/excludeGpuTypeIds."
+      ),
+      pools: import_zod6.z.array(import_zod6.z.string()).optional().describe(
+        "GPU pool names workers may use (e.g. ['ADA_80_PRO','AMPERE_80']). The pool field from list-gpu-types."
+      ),
+      excludeGpuTypeIds: import_zod6.z.array(import_zod6.z.string()).optional().describe(
+        "GPU type ids to exclude from the allowed pools (e.g. ['NVIDIA H100 NVL']). Use with pools to pin specific SKUs."
+      ),
+      gpuCount: import_zod6.z.number().int().positive().optional().describe("GPUs per worker. Omit to keep the current value."),
+      minCudaVersion: import_zod6.z.string().optional().describe(
+        "Minimum host CUDA version workers may run on (e.g. '12.4'). Omit to keep the current value."
+      ),
+      allowedCudaVersions: import_zod6.z.string().optional().describe(
+        "Comma-separated allowed host CUDA versions (e.g. '12.8,12.7,12.6'). Omit to keep the current value. CUDA compatibility is part of GPU selection \u2014 a narrow list can leave an endpoint unable to schedule workers."
+      )
+    },
+    { title: "Set endpoint GPUs", ...WRITE, idempotentHint: true },
+    async (params) => {
+      const gpuIds = params.gpuIds ?? (params.pools && params.pools.length > 0 ? [
+        ...params.pools,
+        ...(params.excludeGpuTypeIds ?? []).map((id) => `-${id}`)
+      ].join(",") : void 0);
+      if (!gpuIds) {
+        return jsonReply2({
+          error: "Provide gpuIds (raw string) or pools (with optional excludeGpuTypeIds). See list-gpu-types for pool names and GPU type ids."
+        });
+      }
+      const data = await graphqlAuthed(`
+        query {
+          myself {
+            endpoints {
+              id
+              name
+              gpuIds
+              gpuCount
+              workersMin
+              workersMax
+              idleTimeout
+              scalerType
+              scalerValue
+              executionTimeoutMs
+              flashBootType
+              type
+              locations
+              templateId
+              allowedCudaVersions
+              minCudaVersion
+              compliance
+              modelReferences
+              networkVolumeIds {
+                networkVolumeId
+                dataCenterId
+              }
+            }
+          }
+        }
+      `);
+      const current = data.myself.endpoints.find(
+        (e) => e.id === params.endpointId
+      );
+      if (!current) {
+        return jsonReply2({
+          error: `No Serverless endpoint found with id "${params.endpointId}". Use list-endpoints to see your endpoints.`
+        });
+      }
+      const input = {
+        id: current.id,
+        name: current.name,
+        gpuIds,
+        gpuCount: params.gpuCount ?? current.gpuCount,
+        workersMin: current.workersMin,
+        workersMax: current.workersMax,
+        idleTimeout: current.idleTimeout,
+        scalerType: current.scalerType,
+        scalerValue: current.scalerValue,
+        executionTimeoutMs: current.executionTimeoutMs,
+        flashBootType: current.flashBootType,
+        type: current.type,
+        locations: current.locations,
+        networkVolumeIds: current.networkVolumeIds && current.networkVolumeIds.length > 0 ? (
+          // Drop dataCenterId: NetworkVolumeIdsInput takes networkVolumeId
+          // ONLY, and the read shape is rejected outright.
+          current.networkVolumeIds.map((v) => ({
+            networkVolumeId: v.networkVolumeId
+          }))
+        ) : null
+      };
+      for (const [key, value] of Object.entries({
+        templateId: current.templateId,
+        allowedCudaVersions: params.allowedCudaVersions ?? current.allowedCudaVersions,
+        minCudaVersion: params.minCudaVersion ?? current.minCudaVersion,
+        compliance: current.compliance,
+        modelReferences: current.modelReferences
+      })) {
+        if (value !== null && value !== void 0) input[key] = value;
+      }
+      const result = await graphqlAuthed(
+        `
+          mutation saveEndpoint($input: EndpointInput!) {
+            saveEndpoint(input: $input) {
+              id
+              name
+              gpuIds
+              gpuCount
+              workersMin
+              workersMax
+            }
+          }
+        `,
+        { input }
       );
-      return jsonReply2(result);
+      return jsonReply2({
+        endpoint: result.saveEndpoint,
+        previousGpuIds: current.gpuIds
+      });
     }
   );
 }
 
 // src/tools/pods.ts
-var import_zod3 = require("zod");
+var import_zod7 = require("zod");
 function registerPodTools(server, rt) {
   const { jsonReply: jsonReply2, callRestUrl, backendFor, podAction, env } = rt;
   server.tool(
@@ -902,12 +1657,12 @@ function registerPodTools(server, rt) {
     "List your pods (running and stopped) with optional filters \u2014 compute type, GPU type, data center, name \u2014 plus machine/network-volume expansion. Paginated via limit/cursor.",
     {
       ...listPaginationParams,
-      computeType: import_zod3.z.enum(["GPU", "CPU"]).optional().describe("Filter to only GPU or only CPU Pods"),
-      gpuTypeId: import_zod3.z.array(import_zod3.z.string()).optional().describe("Filter to Pods with any of the listed GPU types"),
-      dataCenterId: import_zod3.z.array(import_zod3.z.string()).optional().describe("Filter to Pods in any of the provided data centers"),
-      name: import_zod3.z.string().optional().describe("Filter to Pods with the provided name"),
-      includeMachine: import_zod3.z.boolean().optional().describe("Include information about the machine"),
-      includeNetworkVolume: import_zod3.z.boolean().optional().describe("Include information about attached network volumes")
+      computeType: import_zod7.z.enum(["GPU", "CPU"]).optional().describe("Filter to only GPU or only CPU Pods"),
+      gpuTypeId: import_zod7.z.array(import_zod7.z.string()).optional().describe("Filter to Pods with any of the listed GPU types"),
+      dataCenterId: import_zod7.z.array(import_zod7.z.string()).optional().describe("Filter to Pods in any of the provided data centers"),
+      name: import_zod7.z.string().optional().describe("Filter to Pods with the provided name"),
+      includeMachine: import_zod7.z.boolean().optional().describe("Include information about the machine"),
+      includeNetworkVolume: import_zod7.z.boolean().optional().describe("Include information about attached network volumes")
     },
     { title: "List pods", ...READ_ONLY },
     async (params) => {
@@ -951,9 +1706,9 @@ function registerPodTools(server, rt) {
     "get-pod",
     "Get full details for one pod by id, optionally expanding machine and attached network-volume info.",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to retrieve"),
-      includeMachine: import_zod3.z.boolean().optional().describe("Include information about the machine"),
-      includeNetworkVolume: import_zod3.z.boolean().optional().describe("Include information about attached network volumes")
+      podId: import_zod7.z.string().describe("ID of the pod to retrieve"),
+      includeMachine: import_zod7.z.boolean().optional().describe("Include information about the machine"),
+      includeNetworkVolume: import_zod7.z.boolean().optional().describe("Include information about attached network volumes")
     },
     { title: "Get pod", ...READ_ONLY },
     async (params) => {
@@ -981,26 +1736,44 @@ function registerPodTools(server, rt) {
   );
   server.tool(
     "create-pod",
-    'Create a new GPU/CPU pod on Runpod. Pass gpuTypeIds for a GPU pod, or computeType:"CPU" for a CPU pod (CPU pods are served by the v1 API for now). If the user does not specify an image, recommend the "Runpod Pytorch 2.8.0" image (runpod/pytorch:1.0.2-cu1281-torch280-ubuntu2404) as the default \u2014 it has the most up-to-date CUDA and PyTorch versions.',
+    'Create a new GPU/CPU pod on Runpod. Pass gpuTypeIds for a GPU pod, or computeType:"CPU" for a CPU pod (CPU pods are served by the v1 API for now). Pass either imageName or templateId (templateId deploys from an existing template \u2014 its name, image, start command, ports, env, disk, volume, and registry credential are used as defaults, and any field you also pass explicitly replaces the template value for that field, e.g. passing env replaces the whole env set rather than merging; pass containerRegistryAuthId to override or supply a private-image credential, or an empty string to deploy with none). If the user specifies neither an image nor a template, recommend the "Runpod Pytorch 2.8.0" image (runpod/pytorch:1.0.2-cu1281-torch280-ubuntu2404) as the default \u2014 it has the most up-to-date CUDA and PyTorch versions.',
     {
-      name: import_zod3.z.string().optional().describe("Name for the pod"),
-      imageName: import_zod3.z.string().describe("Docker image to use"),
-      computeType: import_zod3.z.enum(["GPU", "CPU"]).optional().describe(
+      name: import_zod7.z.string().optional().describe("Name for the pod"),
+      imageName: import_zod7.z.string().optional().describe("Docker image to use. Optional when templateId is provided."),
+      templateId: import_zod7.z.string().optional().describe(
+        "Deploy from an existing template (see list-templates / get-template). The template supplies name, image, start command, ports, env, disk, volume, and registry credential as defaults; any field you also pass replaces the template value for that field (whole-field, not a merge). Override the registry credential with containerRegistryAuthId. Requires the v2 REST API. Still pass gpuTypeIds or computeType to choose the compute \u2014 a template does not pin the pod compute."
+      ),
+      computeType: import_zod7.z.enum(["GPU", "CPU"]).optional().describe(
         "Pod type. On v2, required when not passing gpuTypeIds. 'CPU' is served by the v1 API for now (v2 has no CPU pods yet)."
       ),
-      cloudType: import_zod3.z.enum(["SECURE", "COMMUNITY"]).optional().describe("SECURE or COMMUNITY cloud"),
-      gpuTypeIds: import_zod3.z.array(import_zod3.z.string()).optional().describe("List of acceptable GPU types"),
-      gpuCount: import_zod3.z.number().optional().describe("Number of GPUs"),
-      containerDiskInGb: import_zod3.z.number().optional().describe("Container disk size in GB"),
-      volumeInGb: import_zod3.z.number().optional().describe("Volume size in GB"),
-      volumeMountPath: import_zod3.z.string().optional().describe("Path to mount the volume"),
-      ports: import_zod3.z.array(import_zod3.z.string()).optional().describe("Ports to expose (e.g., '8888/http', '22/tcp')"),
-      env: import_zod3.z.record(import_zod3.z.string()).optional().describe("Environment variables"),
-      dataCenterIds: import_zod3.z.array(import_zod3.z.string()).optional().describe("List of data centers")
+      cloudType: import_zod7.z.enum(["SECURE", "COMMUNITY"]).optional().describe("SECURE or COMMUNITY cloud"),
+      gpuTypeIds: import_zod7.z.array(import_zod7.z.string()).optional().describe("List of acceptable GPU types"),
+      gpuCount: import_zod7.z.number().optional().describe("Number of GPUs"),
+      containerDiskInGb: import_zod7.z.number().optional().describe("Container disk size in GB"),
+      volumeInGb: import_zod7.z.number().optional().describe("Volume size in GB"),
+      volumeMountPath: import_zod7.z.string().optional().describe("Path to mount the volume"),
+      ports: import_zod7.z.array(import_zod7.z.string()).optional().describe("Ports to expose (e.g., '8888/http', '22/tcp')"),
+      env: import_zod7.z.record(import_zod7.z.string()).optional().describe("Environment variables"),
+      containerRegistryAuthId: import_zod7.z.string().optional().describe(
+        "Container registry credential ID for pulling a private image (see list-container-registry-auths). When deploying from a templateId, this overrides the credential the template carries; pass an empty string to deploy with NO credential (clears a template\u2019s inherited registry)."
+      ),
+      dataCenterIds: import_zod7.z.array(import_zod7.z.string()).optional().describe("List of data centers")
     },
     { title: "Create pod", ...WRITE },
     async (params) => {
       const backend = backendFor("pods");
+      if (params.templateId && backend.version !== "v2") {
+        return jsonReply2({
+          error: "Deploying a pod from a templateId is only supported on the v2 REST API. Set RUNPOD_REST_VERSION=v2, or pass imageName instead.",
+          status: 501
+        });
+      }
+      if (!params.imageName && !params.templateId) {
+        return jsonReply2({
+          error: "Provide imageName, or templateId to deploy from an existing template.",
+          status: 400
+        });
+      }
       const hasGpuTypes = (params.gpuTypeIds?.length ?? 0) > 0;
       const hasGpuCount = (params.gpuCount ?? 0) > 0;
       const wantsCpu = params.computeType === "CPU";
@@ -1025,6 +1798,12 @@ function registerPodTools(server, rt) {
           });
         }
         if (wantsCpu) {
+          if (params.templateId) {
+            return jsonReply2({
+              error: "Template-based deploy is currently supported only for GPU pods on the v2 API. Create the CPU pod with an explicit imageName instead.",
+              status: 400
+            });
+          }
           try {
             const result = await callRestUrl(
               `${restV1Base(env)}/pods`,
@@ -1049,7 +1828,24 @@ function registerPodTools(server, rt) {
           }
         }
       }
-      const body = backend.mapCreate(params);
+      let body = backend.mapCreate(params);
+      if (params.templateId) {
+        let template;
+        try {
+          template = await callRestUrl(
+            `${restV2Base(env)}/templates/${params.templateId}`
+          );
+        } catch (error) {
+          if (error instanceof HttpError) {
+            return jsonReply2({
+              error: `Failed to load template ${params.templateId}: ${error.message}`,
+              status: error.status
+            });
+          }
+          throw error;
+        }
+        body = { ...podBodyFromTemplate(template), ...body };
+      }
       try {
         const result = await callRestUrl(
           `${backend.base}${backend.list}`,
@@ -1064,11 +1860,8 @@ function registerPodTools(server, rt) {
         }
         return jsonReply2(result);
       } catch (error) {
-        if (error instanceof HttpError && error.status === 501) {
-          return jsonReply2({
-            error: "CPU pods are not yet supported on the v2 REST API. Use a GPU pod, or create the CPU pod via the v1 API (set RUNPOD_REST_VERSION=v1).",
-            status: 501
-          });
+        if (error instanceof HttpError) {
+          return jsonReply2({ error: error.message, status: error.status });
         }
         throw error;
       }
@@ -1078,14 +1871,14 @@ function registerPodTools(server, rt) {
     "update-pod",
     "Update a pod's mutable fields (name, image, container disk, volume, ports, env). Only the fields you provide change.",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to update"),
-      name: import_zod3.z.string().optional().describe("New name for the pod"),
-      imageName: import_zod3.z.string().optional().describe("New Docker image"),
-      containerDiskInGb: import_zod3.z.number().optional().describe("New container disk size in GB"),
-      volumeInGb: import_zod3.z.number().optional().describe("New volume size in GB"),
-      volumeMountPath: import_zod3.z.string().optional().describe("New path to mount the volume"),
-      ports: import_zod3.z.array(import_zod3.z.string()).optional().describe("New ports to expose"),
-      env: import_zod3.z.record(import_zod3.z.string()).optional().describe("New environment variables")
+      podId: import_zod7.z.string().describe("ID of the pod to update"),
+      name: import_zod7.z.string().optional().describe("New name for the pod"),
+      imageName: import_zod7.z.string().optional().describe("New Docker image"),
+      containerDiskInGb: import_zod7.z.number().optional().describe("New container disk size in GB"),
+      volumeInGb: import_zod7.z.number().optional().describe("New volume size in GB"),
+      volumeMountPath: import_zod7.z.string().optional().describe("New path to mount the volume"),
+      ports: import_zod7.z.array(import_zod7.z.string()).optional().describe("New ports to expose"),
+      env: import_zod7.z.record(import_zod7.z.string()).optional().describe("New environment variables")
     },
     { title: "Update pod", ...WRITE, idempotentHint: true },
     async (params) => {
@@ -1104,7 +1897,7 @@ function registerPodTools(server, rt) {
     "start-pod",
     "Start a stopped pod (resumes the same pod and its billing).",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to start")
+      podId: import_zod7.z.string().describe("ID of the pod to start")
     },
     { title: "Start pod", ...WRITE, idempotentHint: true },
     async (params) => {
@@ -1116,7 +1909,7 @@ function registerPodTools(server, rt) {
     "stop-pod",
     "Stop a running pod. The pod and its disk persist; GPU billing stops.",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to stop")
+      podId: import_zod7.z.string().describe("ID of the pod to stop")
     },
     { title: "Stop pod", ...WRITE, idempotentHint: true },
     async (params) => {
@@ -1128,7 +1921,7 @@ function registerPodTools(server, rt) {
     "restart-pod",
     "Restart a running pod (single PodAction call). v2-only \u2014 on the v1 API returns a 501 notice (stop then start the pod instead).",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to restart")
+      podId: import_zod7.z.string().describe("ID of the pod to restart")
     },
     { title: "Restart pod", ...WRITE },
     async (params) => {
@@ -1143,11 +1936,29 @@ function registerPodTools(server, rt) {
       return jsonReply2(result);
     }
   );
+  server.tool(
+    "stream-pod-logs",
+    "Fetch a bounded snapshot of a pod's live logs (container and/or system) via Server-Sent Events. v2-only \u2014 returns a 501 notice on the v1 API. Reads for up to maxWaitMs (default 5s) and returns the collected log lines; use `tail` to backfill recent lines first. Large output is truncated (see the `truncated` flag).",
+    {
+      podId: import_zod7.z.string().describe("ID of the pod whose logs to stream"),
+      ...logStreamParams
+    },
+    { title: "Stream pod logs", ...READ_ONLY },
+    (params) => streamLogsReply(
+      rt,
+      {
+        name: "stream-pod-logs",
+        resource: "pods",
+        logsUrl: (backend) => `${backend.base}${backend.get(encodeURIComponent(params.podId))}/logs`
+      },
+      params
+    )
+  );
   server.tool(
     "delete-pod",
     "Permanently delete a pod and its data. This cannot be undone.",
     {
-      podId: import_zod3.z.string().describe("ID of the pod to delete")
+      podId: import_zod7.z.string().describe("ID of the pod to delete")
     },
     { title: "Delete pod", ...DESTRUCTIVE },
     async (params) => {
@@ -1162,16 +1973,27 @@ function registerPodTools(server, rt) {
 }
 
 // src/tools/endpoints.ts
-var import_zod4 = require("zod");
+var import_zod8 = require("zod");
+var MIN_QUEUE_DELAY = 0.5;
+var MIN_REQUEST_COUNT = 1;
+var MIN_IDLE_TIMEOUT = 1;
+var MAX_IDLE_TIMEOUT = 3600;
+function scalerValueError(scalerType, scalerValue) {
+  if (scalerType !== "REQUEST_COUNT" || scalerValue === void 0) return;
+  if (!Number.isInteger(scalerValue) || scalerValue < MIN_REQUEST_COUNT) {
+    return `REQUEST_COUNT scales on whole in-flight requests per worker, so scalerValue must be an integer >= ${MIN_REQUEST_COUNT} (got ${scalerValue}). For a fractional target use scalerType QUEUE_DELAY, which takes seconds >= ${MIN_QUEUE_DELAY}.`;
+  }
+  return;
+}
 function registerEndpointTools(server, rt) {
   const { jsonReply: jsonReply2, callRestUrl, backendFor } = rt;
   server.tool(
     "list-endpoints",
-    "List your Serverless endpoints, optionally expanding template and worker details (v1 only). Paginated via limit/cursor.",
+    "List your Serverless endpoints, optionally expanding template and worker details (v1 only). Paginated via limit/cursor. On v2 each endpoint carries its request routing in `type` and the URLs to call it in `requestUrls`.",
     {
       ...listPaginationParams,
-      includeTemplate: import_zod4.z.boolean().optional().describe("Include template information (v1 only)"),
-      includeWorkers: import_zod4.z.boolean().optional().describe("Include information about workers (v1 only)")
+      includeTemplate: import_zod8.z.boolean().optional().describe("Include template information (v1 only)"),
+      includeWorkers: import_zod8.z.boolean().optional().describe("Include information about workers (v1 only)")
     },
     { title: "List endpoints", ...READ_ONLY },
     async (params) => {
@@ -1202,11 +2024,11 @@ function registerEndpointTools(server, rt) {
   );
   server.tool(
     "get-endpoint",
-    "Get one Serverless endpoint by id, optionally expanding template and worker details (v1 only).",
+    "Get one Serverless endpoint by id, optionally expanding template and worker details (v1 only). On v2 the reply carries `type` (queue-based vs load-balancing routing) and `requestUrls` \u2014 the run/runsync/status/... URLs for a queue endpoint, or the base + health URLs for a load-balancing one. Read those rather than constructing endpoint URLs by hand.",
     {
-      endpointId: import_zod4.z.string().describe("ID of the endpoint to retrieve"),
-      includeTemplate: import_zod4.z.boolean().optional().describe("Include template information (v1 only)"),
-      includeWorkers: import_zod4.z.boolean().optional().describe("Include information about workers (v1 only)")
+      endpointId: import_zod8.z.string().describe("ID of the endpoint to retrieve"),
+      includeTemplate: import_zod8.z.boolean().optional().describe("Include template information (v1 only)"),
+      includeWorkers: import_zod8.z.boolean().optional().describe("Include information about workers (v1 only)")
     },
     { title: "Get endpoint", ...READ_ONLY },
     async (params) => {
@@ -1234,34 +2056,43 @@ function registerEndpointTools(server, rt) {
   );
   server.tool(
     "create-endpoint",
-    "Create a Serverless endpoint. On v2 (default), pass an inline config: imageName + gpuPoolIds (GPU pool names from list-gpu-types \u2014 the `pool` field, e.g. AMPERE_80/ADA_24) plus optional workers/scaling/disk/env. On v1, pass a templateId instead. Worker min/max set autoscaling bounds (min 0 = scale to zero).",
+    "Create a Serverless endpoint. On v2 (default), pass an inline config: imageName + gpuPoolIds (GPU pool names from list-gpu-types \u2014 the `pool` field, e.g. AMPERE_80/ADA_24) plus optional workers/scaling/disk/env. On v1, pass a templateId instead. Worker min/max set autoscaling bounds (min 0 = scale to zero). Use endpointType to pick queue-based (default) or load-balancing request routing; the response `requestUrls` carries the URLs to call the endpoint with.",
     {
-      name: import_zod4.z.string().optional().describe("Name for the endpoint"),
+      name: import_zod8.z.string().optional().describe("Name for the endpoint"),
       // --- v2 inline-config fields ---
-      imageName: import_zod4.z.string().optional().describe("Docker image (v2). Required on v2 instead of a templateId."),
-      gpuPoolIds: import_zod4.z.array(import_zod4.z.string()).optional().describe(
+      imageName: import_zod8.z.string().optional().describe("Docker image (v2). Required on v2 instead of a templateId."),
+      endpointType: import_zod8.z.enum(["QUEUE", "LOAD_BALANCER"]).optional().describe(
+        "How requests reach the workers (v2). QUEUE (default) = submit jobs through the managed queue (run/runsync/status/...). LOAD_BALANCER = send HTTP requests straight to worker-defined paths, and forces scalerType REQUEST_COUNT. Fixed at creation \u2014 update-endpoint cannot change it."
+      ),
+      gpuPoolIds: import_zod8.z.array(import_zod8.z.string()).optional().describe(
         'GPU pool names (v2, required). The `pool` field from list-gpu-types, e.g. ["AMPERE_80"]. NOT GPU type ids.'
       ),
-      gpuCount: import_zod4.z.number().optional().describe("GPUs per worker (v2)"),
-      args: import_zod4.z.string().optional().describe("Container start command/args (v2)"),
-      containerDiskInGb: import_zod4.z.number().optional().describe("Container disk size in GB (v2)"),
-      ports: import_zod4.z.array(import_zod4.z.string()).optional().describe("Ports to expose (v2), e.g. ['8000/http']"),
-      env: import_zod4.z.record(import_zod4.z.string()).optional().describe("Environment variables (v2)"),
-      containerRegistryAuthId: import_zod4.z.string().optional().describe("Container registry auth id for a private image (v2)"),
-      networkVolumeIds: import_zod4.z.array(import_zod4.z.string()).optional().describe("Network volume ids to attach (v2)"),
-      executionTimeoutMs: import_zod4.z.number().optional().describe("Per-job execution timeout in ms (v2)"),
-      flashboot: import_zod4.z.enum(["OFF", "FLASHBOOT", "PRIORITY_FLASHBOOT"]).optional().describe("FlashBoot mode (v2)"),
+      gpuCount: import_zod8.z.number().optional().describe("GPUs per worker (v2)"),
+      args: import_zod8.z.string().optional().describe("Container start command/args (v2)"),
+      containerDiskInGb: import_zod8.z.number().optional().describe("Container disk size in GB (v2)"),
+      ports: import_zod8.z.array(import_zod8.z.string()).optional().describe("Ports to expose (v2), e.g. ['8000/http']"),
+      env: import_zod8.z.record(import_zod8.z.string()).optional().describe("Environment variables (v2)"),
+      containerRegistryAuthId: import_zod8.z.string().optional().describe("Container registry auth id for a private image (v2)"),
+      networkVolumeIds: import_zod8.z.array(import_zod8.z.string()).optional().describe("Network volume ids to attach (v2)"),
+      executionTimeoutMs: import_zod8.z.number().optional().describe("Per-job execution timeout in ms (v2)"),
+      flashboot: import_zod8.z.enum(["OFF", "FLASHBOOT", "PRIORITY_FLASHBOOT"]).optional().describe("FlashBoot mode (v2)"),
       // --- v1 template-based fields ---
-      templateId: import_zod4.z.string().optional().describe("Template ID (v1). Required on v1."),
-      computeType: import_zod4.z.enum(["GPU", "CPU"]).optional().describe("GPU or CPU endpoint (v1)"),
-      gpuTypeIds: import_zod4.z.array(import_zod4.z.string()).optional().describe("List of acceptable GPU types (v1)"),
+      templateId: import_zod8.z.string().optional().describe("Template ID (v1). Required on v1."),
+      computeType: import_zod8.z.enum(["GPU", "CPU"]).optional().describe("GPU or CPU endpoint (v1)"),
+      gpuTypeIds: import_zod8.z.array(import_zod8.z.string()).optional().describe("List of acceptable GPU types (v1)"),
       // --- shared autoscaling fields ---
-      workersMin: import_zod4.z.number().optional().describe("Minimum number of workers"),
-      workersMax: import_zod4.z.number().optional().describe("Maximum number of workers"),
-      scalerType: import_zod4.z.enum(["QUEUE_DELAY", "REQUEST_COUNT"]).optional().describe("Autoscaler type"),
-      scalerValue: import_zod4.z.number().optional().describe("Autoscaler target value"),
-      idleTimeout: import_zod4.z.number().optional().describe("Idle timeout in seconds before scaling a worker down"),
-      dataCenterIds: import_zod4.z.array(import_zod4.z.string()).optional().describe("List of preferred data centers")
+      workersMin: import_zod8.z.number().optional().describe("Minimum number of workers"),
+      workersMax: import_zod8.z.number().optional().describe("Maximum number of workers"),
+      scalerType: import_zod8.z.enum(["QUEUE_DELAY", "REQUEST_COUNT"]).optional().describe(
+        "Autoscaler signal. QUEUE_DELAY scales on how long requests wait in the queue (queue endpoints only); REQUEST_COUNT scales on in-flight requests per worker. Defaults to QUEUE_DELAY for QUEUE endpoints and REQUEST_COUNT for LOAD_BALANCER ones."
+      ),
+      scalerValue: import_zod8.z.number().min(MIN_QUEUE_DELAY).optional().describe(
+        "Autoscaler target for the chosen scalerType \u2014 seconds of queue delay (min 0.5) or in-flight requests per worker (integer, min 1). Defaults to 4."
+      ),
+      idleTimeout: import_zod8.z.number().int().min(MIN_IDLE_TIMEOUT).max(MAX_IDLE_TIMEOUT).optional().describe(
+        "Idle timeout in seconds before scaling a worker down (1-3600). Does not apply to QUEUE endpoints scaling on REQUEST_COUNT."
+      ),
+      dataCenterIds: import_zod8.z.array(import_zod8.z.string()).optional().describe("List of preferred data centers")
     },
     { title: "Create endpoint", ...WRITE },
     async (params) => {
@@ -1285,6 +2116,19 @@ function registerEndpointTools(server, rt) {
             status: 400
           });
         }
+        if (params.endpointType === "LOAD_BALANCER" && params.scalerType === "QUEUE_DELAY") {
+          return jsonReply2({
+            error: "LOAD_BALANCER endpoints have no request queue, so they cannot scale on QUEUE_DELAY. Use scalerType REQUEST_COUNT (the default for this endpoint type), or create a QUEUE endpoint instead.",
+            status: 400
+          });
+        }
+        const scalerError = scalerValueError(
+          params.scalerType ?? (params.endpointType === "LOAD_BALANCER" ? "REQUEST_COUNT" : void 0),
+          params.scalerValue
+        );
+        if (scalerError) {
+          return jsonReply2({ error: scalerError, status: 400 });
+        }
         const body = backend.mapCreate(params);
         const result2 = await callRestUrl(
           `${backend.base}${backend.list}`,
@@ -1322,46 +2166,67 @@ function registerEndpointTools(server, rt) {
   );
   server.tool(
     "update-endpoint",
-    "Update a Serverless endpoint's config. On v2 you can change image/disk/env/ports/registry/workers/scaling/networkVolumes/timeout/flashboot; on v1, scaling fields (worker min/max, idle timeout, scaler type/value, name). Only provided fields change.",
+    "Update a Serverless endpoint's config. On v2 you can change image/disk/env/ports/registry/workers/scaling/networkVolumes/timeout/flashboot; on v1, scaling fields (worker min/max, idle timeout, scaler type/value, name). Only provided fields change. An endpoint's request routing (queue vs load balancer) is fixed at creation and cannot be changed here \u2014 recreate the endpoint instead.",
     {
-      endpointId: import_zod4.z.string().describe("ID of the endpoint to update"),
-      name: import_zod4.z.string().optional().describe("New name for the endpoint"),
-      workersMin: import_zod4.z.number().optional().describe("New minimum number of workers"),
-      workersMax: import_zod4.z.number().optional().describe("New maximum number of workers"),
-      idleTimeout: import_zod4.z.number().optional().describe("New idle timeout in seconds"),
-      scalerType: import_zod4.z.enum(["QUEUE_DELAY", "REQUEST_COUNT"]).optional().describe("Scaler type"),
-      scalerValue: import_zod4.z.number().optional().describe("Scaler value"),
+      endpointId: import_zod8.z.string().describe("ID of the endpoint to update"),
+      name: import_zod8.z.string().optional().describe("New name for the endpoint"),
+      workersMin: import_zod8.z.number().optional().describe("New minimum number of workers"),
+      workersMax: import_zod8.z.number().optional().describe("New maximum number of workers"),
+      idleTimeout: import_zod8.z.number().int().min(MIN_IDLE_TIMEOUT).max(MAX_IDLE_TIMEOUT).optional().describe(
+        "New idle timeout in seconds (1-3600). Does not apply to queue endpoints scaling on REQUEST_COUNT."
+      ),
+      scalerType: import_zod8.z.enum(["QUEUE_DELAY", "REQUEST_COUNT"]).optional().describe(
+        "New autoscaler signal. Switchable on queue endpoints; load-balancing endpoints only accept REQUEST_COUNT."
+      ),
+      scalerValue: import_zod8.z.number().min(MIN_QUEUE_DELAY).optional().describe(
+        "New autoscaler target \u2014 seconds of queue delay (min 0.5) or in-flight requests per worker (integer, min 1). Applies to the endpoint's current scalerType unless you also pass a new one."
+      ),
       // --- v2-only inline-config fields ---
-      imageName: import_zod4.z.string().optional().describe("New Docker image (v2)"),
-      gpuPoolIds: import_zod4.z.array(import_zod4.z.string()).optional().describe('New GPU pool names (v2), e.g. ["AMPERE_80"]'),
-      gpuCount: import_zod4.z.number().optional().describe("New GPUs per worker (v2)"),
-      args: import_zod4.z.string().optional().describe("New container args (v2)"),
-      containerDiskInGb: import_zod4.z.number().optional().describe("New container disk size in GB (v2)"),
-      ports: import_zod4.z.array(import_zod4.z.string()).optional().describe("New ports (v2)"),
-      env: import_zod4.z.record(import_zod4.z.string()).optional().describe("New environment variables (v2)"),
-      containerRegistryAuthId: import_zod4.z.string().optional().describe("New container registry auth id (v2)"),
-      networkVolumeIds: import_zod4.z.array(import_zod4.z.string()).optional().describe("New network volume ids (v2)"),
-      executionTimeoutMs: import_zod4.z.number().optional().describe("New per-job execution timeout in ms (v2)"),
-      flashboot: import_zod4.z.enum(["OFF", "FLASHBOOT", "PRIORITY_FLASHBOOT"]).optional().describe("New FlashBoot mode (v2)")
+      imageName: import_zod8.z.string().optional().describe("New Docker image (v2)"),
+      gpuPoolIds: import_zod8.z.array(import_zod8.z.string()).optional().describe('New GPU pool names (v2), e.g. ["AMPERE_80"]'),
+      gpuCount: import_zod8.z.number().optional().describe("New GPUs per worker (v2)"),
+      args: import_zod8.z.string().optional().describe("New container args (v2)"),
+      containerDiskInGb: import_zod8.z.number().optional().describe("New container disk size in GB (v2)"),
+      ports: import_zod8.z.array(import_zod8.z.string()).optional().describe("New ports (v2)"),
+      env: import_zod8.z.record(import_zod8.z.string()).optional().describe("New environment variables (v2)"),
+      containerRegistryAuthId: import_zod8.z.string().optional().describe("New container registry auth id (v2)"),
+      networkVolumeIds: import_zod8.z.array(import_zod8.z.string()).optional().describe("New network volume ids (v2)"),
+      executionTimeoutMs: import_zod8.z.number().optional().describe("New per-job execution timeout in ms (v2)"),
+      flashboot: import_zod8.z.enum(["OFF", "FLASHBOOT", "PRIORITY_FLASHBOOT"]).optional().describe("New FlashBoot mode (v2)")
     },
     { title: "Update endpoint", ...WRITE, idempotentHint: true },
     async (params) => {
       const { endpointId, ...updateParams } = params;
       const backend = backendFor("endpoints");
-      const body = backend.mapUpdate(updateParams);
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(endpointId)}`,
-        "PATCH",
-        body
+      const url = `${backend.base}${backend.get(endpointId)}`;
+      if (backend.version !== "v2") {
+        const body2 = backend.mapUpdate(updateParams);
+        return jsonReply2(await callRestUrl(url, "PATCH", body2));
+      }
+      let scalerType = updateParams.scalerType;
+      if (scalerType === void 0 && updateParams.scalerValue !== void 0) {
+        const current = await callRestUrl(url);
+        scalerType = current?.scaling?.type === "REQUEST_COUNT" ? "REQUEST_COUNT" : "QUEUE_DELAY";
+      }
+      const scalerError = scalerValueError(
+        scalerType,
+        updateParams.scalerValue
       );
-      return jsonReply2(result);
+      if (scalerError) {
+        return jsonReply2({ error: scalerError, status: 400 });
+      }
+      const body = backend.mapUpdate({
+        ...updateParams,
+        scalerType
+      });
+      return jsonReply2(await callRestUrl(url, "PATCH", body));
     }
   );
   server.tool(
     "delete-endpoint",
     "Permanently delete a Serverless endpoint. This cannot be undone.",
     {
-      endpointId: import_zod4.z.string().describe("ID of the endpoint to delete")
+      endpointId: import_zod8.z.string().describe("ID of the endpoint to delete")
     },
     { title: "Delete endpoint", ...DESTRUCTIVE },
     async (params) => {
@@ -1373,12 +2238,39 @@ function registerEndpointTools(server, rt) {
       return jsonReply2(result);
     }
   );
+  server.tool(
+    "list-endpoint-releases",
+    "List a Serverless endpoint's release history and current rollout status (workers on the latest version). v2-only \u2014 returns a 501 notice on the v1 API. Paginated via limit/cursor.",
+    {
+      ...listPaginationParams,
+      endpointId: import_zod8.z.string().describe("ID of the Serverless endpoint whose releases to list")
+    },
+    { title: "List endpoint releases", ...READ_ONLY },
+    async (params) => {
+      const backend = backendFor("endpoints");
+      if (backend.version === "v1") {
+        return jsonReply2({
+          error: "list-endpoint-releases is only available on the v2 REST API. Set RUNPOD_REST_VERSION=v2.",
+          status: 501
+        });
+      }
+      const raw = await callRestUrl(
+        `${backend.base}/serverless/${params.endpointId}/releases`
+      );
+      const releases = Array.isArray(raw?.releases) ? raw.releases : [];
+      return capListResult(
+        releases,
+        { limit: params.limit, cursor: params.cursor },
+        { rollout: raw?.rollout, endpointVersion: raw?.endpointVersion }
+      );
+    }
+  );
   server.tool(
     "list-endpoint-workers",
-    "List the workers backing a Serverless endpoint, with their status and an aggregate summary. v2-only \u2014 returns a 501 notice on the v1 API. Paginated via limit/cursor.",
+    "List the workers backing a Serverless endpoint, with their status and an aggregate summary. v2-only \u2014 returns a 501 notice on the v1 API. An UNHEALTHY worker usually means the container is crash-looping (repeated starts that exit before the handler runs) \u2014 jobs on the endpoint will sit IN_QUEUE even though this is a worker failure, not a capacity shortage; inspect it with stream-worker-logs. Zero workers while jobs queue means the endpoint is waiting for GPU capacity. Paginated via limit/cursor.",
     {
       ...listPaginationParams,
-      endpointId: import_zod4.z.string().describe("ID of the Serverless endpoint whose workers to list")
+      endpointId: import_zod8.z.string().describe("ID of the Serverless endpoint whose workers to list")
     },
     { title: "List endpoint workers", ...READ_ONLY },
     async (params) => {
@@ -1399,30 +2291,110 @@ function registerEndpointTools(server, rt) {
       );
     }
   );
+  server.tool(
+    "stream-worker-logs",
+    "Fetch a bounded snapshot of a serverless worker's live logs (container and/or system) via Server-Sent Events. v2-only \u2014 returns a 501 notice on the v1 API. Get the workerId from list-endpoint-workers. Use this to diagnose UNHEALTHY workers: repeated `start container` system lines with no container output is the crash-loop signature (the container exits before the handler runs). Reads for up to maxWaitMs (default 5s) and returns the collected log lines; use `tail` to backfill recent lines first. Large output is truncated (see the `truncated` flag).",
+    {
+      endpointId: import_zod8.z.string().describe("ID of the Serverless endpoint the worker belongs to"),
+      workerId: import_zod8.z.string().describe(
+        "ID of the worker whose logs to stream (from list-endpoint-workers)"
+      ),
+      ...logStreamParams
+    },
+    { title: "Stream worker logs", ...READ_ONLY },
+    (params) => streamLogsReply(
+      rt,
+      {
+        name: "stream-worker-logs",
+        resource: "workers",
+        logsUrl: (backend) => `${backend.base}/serverless/${encodeURIComponent(params.endpointId)}/workers/${encodeURIComponent(params.workerId)}/logs`
+      },
+      params
+    )
+  );
 }
 
 // src/tools/jobs.ts
-var import_zod5 = require("zod");
+var import_zod9 = require("zod");
+var DIAGNOSIS_TTL_MS = 15e3;
+var MAX_DIAGNOSIS_ENTRIES = 500;
+var diagnosisCache = /* @__PURE__ */ new Map();
 function registerJobTools(server, rt) {
-  const { jsonReply: jsonReply2, serverlessRequest } = rt;
-  const endpointIdSchema = import_zod5.z.string().regex(/^[a-zA-Z0-9_-]+$/, "Invalid endpoint ID format");
-  const jobIdSchema = import_zod5.z.string().regex(/^[a-zA-Z0-9_-]+$/, "Invalid job ID format");
-  const inputSchema = import_zod5.z.record(import_zod5.z.unknown()).describe(
+  const { jsonReply: jsonReply2, serverlessRequest, backendFor, callRestUrl } = rt;
+  async function diagnoseQueuedJob(endpointId) {
+    const cached = diagnosisCache.get(endpointId);
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.value;
+    }
+    diagnosisCache.delete(endpointId);
+    try {
+      const backend = backendFor("workers");
+      if (backend.version !== "v2") return null;
+      const raw = await callRestUrl(
+        `${backend.base}/serverless/${endpointId}/workers`
+      );
+      const summary = raw?.summary;
+      const workers = raw?.workers ?? [];
+      if (!summary) return null;
+      const remember = (value) => {
+        if (diagnosisCache.size >= MAX_DIAGNOSIS_ENTRIES) {
+          const oldest = diagnosisCache.keys().next().value;
+          if (oldest !== void 0) diagnosisCache.delete(oldest);
+        }
+        diagnosisCache.set(endpointId, {
+          value,
+          expiresAt: Date.now() + DIAGNOSIS_TTL_MS
+        });
+        return value;
+      };
+      if ((summary.unhealthy ?? 0) > 0) {
+        const badIds = workers.filter((w) => w.status === "UNHEALTHY").map((w) => w.id).join(", ");
+        return remember({
+          workerHealth: summary,
+          hint: `${summary.unhealthy} of ${summary.total} worker(s) on this endpoint are UNHEALTHY \u2014 the container is likely crash-looping (repeated starts that exit before the handler runs). The job can stay IN_QUEUE indefinitely; this is a worker failure, NOT a capacity shortage. Inspect the logs with stream-worker-logs${badIds ? ` (workerId: ${badIds})` : ""}.`
+        });
+      }
+      if ((summary.total ?? 0) === 0) {
+        return remember({
+          workerHealth: summary,
+          hint: "No workers are scheduled for this endpoint yet \u2014 it may simply be scaling up from zero (normal for the first seconds of a cold start), or it is waiting for GPU capacity / its GPU-CUDA constraints exclude the currently-available hosts. If this persists, check availability with list-gpu-types or widen the gpuIds/CUDA settings."
+        });
+      }
+      if ((summary.throttled ?? 0) > 0 && (summary.running ?? 0) === 0) {
+        return remember({
+          workerHealth: summary,
+          hint: "Workers exist but are throttled \u2014 the hosts are at capacity right now; the job should start when capacity frees up."
+        });
+      }
+      if ((summary.initializing ?? 0) > 0) {
+        return remember({
+          workerHealth: summary,
+          hint: "A worker is initializing \u2014 likely a cold start (image pull / model load); the job should start soon."
+        });
+      }
+      return remember({ workerHealth: summary, hint: "" });
+    } catch {
+      return null;
+    }
+  }
+  const endpointIdSchema = import_zod9.z.string().regex(/^[a-zA-Z0-9_-]+$/, "Invalid endpoint ID format");
+  const jobIdSchema = import_zod9.z.string().regex(/^[a-zA-Z0-9_-]+$/, "Invalid job ID format");
+  const inputSchema = import_zod9.z.record(import_zod9.z.unknown()).describe(
     "Input payload for the worker handler. The expected fields depend on the deployed model or worker."
   );
-  const webhookSchema = import_zod5.z.string().url().optional().describe(
+  const webhookSchema = import_zod9.z.string().url().optional().describe(
     "Webhook URL to receive job completion notifications instead of polling"
   );
-  const policySchema = import_zod5.z.object({
-    executionTimeout: import_zod5.z.number().optional().describe("Maximum execution time in milliseconds"),
-    lowPriority: import_zod5.z.boolean().optional().describe("Submit as a low-priority job"),
-    ttl: import_zod5.z.number().optional().describe("Time-to-live for the job result in milliseconds")
+  const policySchema = import_zod9.z.object({
+    executionTimeout: import_zod9.z.number().optional().describe("Maximum execution time in milliseconds"),
+    lowPriority: import_zod9.z.boolean().optional().describe("Submit as a low-priority job"),
+    ttl: import_zod9.z.number().optional().describe("Time-to-live for the job result in milliseconds")
   }).optional().describe("Execution policy options");
-  const s3ConfigSchema = import_zod5.z.object({
-    accessId: import_zod5.z.string().describe("S3 access key ID"),
-    accessSecret: import_zod5.z.string().describe("S3 secret access key"),
-    bucketName: import_zod5.z.string().describe("S3 bucket name"),
-    endpointUrl: import_zod5.z.string().describe("S3 endpoint URL")
+  const s3ConfigSchema = import_zod9.z.object({
+    accessId: import_zod9.z.string().describe("S3 access key ID"),
+    accessSecret: import_zod9.z.string().describe("S3 secret access key"),
+    bucketName: import_zod9.z.string().describe("S3 bucket name"),
+    endpointUrl: import_zod9.z.string().describe("S3 endpoint URL")
   }).optional().describe("S3-compatible storage config for large outputs");
   server.tool(
     "run-endpoint",
@@ -1456,7 +2428,7 @@ function registerJobTools(server, rt) {
         "ID of the Serverless endpoint to run synchronously"
       ),
       input: inputSchema,
-      wait: import_zod5.z.number().min(1e3).max(3e5).optional().describe(
+      wait: import_zod9.z.number().min(1e3).max(3e5).optional().describe(
         "How long in milliseconds the server should wait for a result before returning a job ID to poll (1000\u2013300000). Defaults to 90000 (90 seconds)."
       ),
       webhook: webhookSchema,
@@ -1478,7 +2450,7 @@ function registerJobTools(server, rt) {
   );
   server.tool(
     "get-job-status",
-    "Check the status of an asynchronous Serverless job. Returns the current status and output when complete. Job statuses: IN_QUEUE, IN_PROGRESS, COMPLETED, FAILED, CANCELLED, TIMED_OUT.",
+    "Check the status of an asynchronous Serverless job. Returns the current status and output when complete. Job statuses: IN_QUEUE, IN_PROGRESS, COMPLETED, FAILED, CANCELLED, TIMED_OUT. IMPORTANT: a job stuck IN_QUEUE does not necessarily mean a capacity shortage \u2014 a worker may have spun up and crash-looped (the platform marks it UNHEALTHY while the job stays queued). When the job is IN_QUEUE this tool attaches a workerHealth summary and a hint; to dig deeper, call list-endpoint-workers (look for UNHEALTHY) and stream-worker-logs.",
     {
       endpointId: endpointIdSchema.describe(
         "ID of the Serverless endpoint the job belongs to"
@@ -1491,6 +2463,16 @@ function registerJobTools(server, rt) {
         params.endpointId,
         `/status/${params.jobId}`
       );
+      if (result && typeof result === "object" && result.status === "IN_QUEUE") {
+        const diagnosis = await diagnoseQueuedJob(params.endpointId);
+        if (diagnosis) {
+          return jsonReply2({
+            ...result,
+            workerHealth: diagnosis.workerHealth,
+            ...diagnosis.hint ? { hint: diagnosis.hint } : {}
+          });
+        }
+      }
       return jsonReply2(result);
     }
   );
@@ -1592,7 +2574,7 @@ function registerJobTools(server, rt) {
   );
   server.tool(
     "endpoint-health",
-    "Get the health and operational status of a Serverless endpoint, including worker counts and job statistics.",
+    "Get the health and operational status of a Serverless endpoint, including worker counts and job statistics. Use this when jobs are stuck IN_QUEUE: unhealthy workers mean a crash-looping container (a worker failure \u2014 inspect with stream-worker-logs), while zero workers means the endpoint is waiting for GPU capacity.",
     {
       endpointId: endpointIdSchema.describe(
         "ID of the Serverless endpoint to check health for"
@@ -1625,7 +2607,7 @@ function registerJobTools(server, rt) {
 }
 
 // src/tools/templates.ts
-var import_zod6 = require("zod");
+var import_zod10 = require("zod");
 function registerTemplateTools(server, rt) {
   const { jsonReply: jsonReply2, callRestUrl, backendFor } = rt;
   server.tool(
@@ -1633,9 +2615,9 @@ function registerTemplateTools(server, rt) {
     `List available templates. By default returns only the user's own templates. Use includeRunpodTemplates to also include official Runpod templates. The recommended default template for new pods is "Runpod Pytorch 2.8.0" (ID: runpod-torch-v280) \u2014 it has the latest CUDA and PyTorch versions.`,
     {
       ...listPaginationParams,
-      includeRunpodTemplates: import_zod6.z.boolean().optional().describe("Include official Runpod templates in the response"),
-      includePublicTemplates: import_zod6.z.boolean().optional().describe("Include community-made public templates in the response"),
-      includeEndpointBoundTemplates: import_zod6.z.boolean().optional().describe(
+      includeRunpodTemplates: import_zod10.z.boolean().optional().describe("Include official Runpod templates in the response"),
+      includePublicTemplates: import_zod10.z.boolean().optional().describe("Include community-made public templates in the response"),
+      includeEndpointBoundTemplates: import_zod10.z.boolean().optional().describe(
         "Include templates bound to Serverless endpoints in the response"
       )
     },
@@ -1666,7 +2648,7 @@ function registerTemplateTools(server, rt) {
     "get-template",
     "Get one template by id (image, env, ports, disk/volume config).",
     {
-      templateId: import_zod6.z.string().describe("ID of the template to retrieve")
+      templateId: import_zod10.z.string().describe("ID of the template to retrieve")
     },
     { title: "Get template", ...READ_ONLY },
     async (params) => {
@@ -1679,23 +2661,27 @@ function registerTemplateTools(server, rt) {
   );
   server.tool(
     "create-template",
-    "Create a reusable pod/endpoint template (image, ports, env, disk/volume). On v2 a category is required and defaults to NVIDIA.",
+    "Create a reusable pod/endpoint template (image, ports, env, disk/volume). Category is optional and defaults to NVIDIA.",
     {
-      name: import_zod6.z.string().describe("Name for the template"),
-      imageName: import_zod6.z.string().describe("Docker image to use"),
-      isServerless: import_zod6.z.boolean().optional().describe("Is this a serverless template"),
-      ports: import_zod6.z.array(import_zod6.z.string()).optional().describe("Ports to expose"),
-      dockerEntrypoint: import_zod6.z.array(import_zod6.z.string()).optional().describe("Docker entrypoint commands"),
-      dockerStartCmd: import_zod6.z.array(import_zod6.z.string()).optional().describe("Docker start commands"),
-      env: import_zod6.z.record(import_zod6.z.string()).optional().describe("Environment variables"),
-      containerDiskInGb: import_zod6.z.number().optional().describe("Container disk size in GB"),
-      volumeInGb: import_zod6.z.number().optional().describe("Volume size in GB"),
-      volumeMountPath: import_zod6.z.string().optional().describe("Path to mount the volume"),
-      readme: import_zod6.z.string().optional().describe("README content in markdown format"),
-      category: import_zod6.z.enum(["CPU", "NVIDIA", "AMD"]).optional().describe(
-        "Hardware category for the template. On v2 a category is required and defaults to NVIDIA when omitted \u2014 set CPU or AMD for non-NVIDIA templates so they are not mis-categorized."
+      name: import_zod10.z.string().describe("Name for the template"),
+      imageName: import_zod10.z.string().describe("Docker image to use"),
+      isServerless: import_zod10.z.boolean().optional().describe("Is this a serverless template"),
+      ports: import_zod10.z.array(import_zod10.z.string()).optional().describe("Ports to expose"),
+      dockerEntrypoint: import_zod10.z.array(import_zod10.z.string()).optional().describe(
+        "Docker entrypoint commands. Note: not persisted on the v2 REST API, which has no separate entrypoint field (only a start command)."
+      ),
+      dockerStartCmd: import_zod10.z.array(import_zod10.z.string()).optional().describe(
+        'Container start command. On v2 this is stored as the template\'s `args` string; a multi-element array is joined with spaces (e.g. ["python","-u","app.py"] \u2192 "python -u app.py"). The join is lossy: an element that itself contains spaces is NOT preserved as one argument \u2014 e.g. ["sh","-c","echo hi"] becomes "sh -c echo hi", so pass a shell command as a single pre-quoted element if that distinction matters. Omit or pass an empty array to leave the command unset (never overwrites with "").'
+      ),
+      env: import_zod10.z.record(import_zod10.z.string()).optional().describe("Environment variables"),
+      containerDiskInGb: import_zod10.z.number().optional().describe("Container disk size in GB"),
+      volumeInGb: import_zod10.z.number().optional().describe("Volume size in GB"),
+      volumeMountPath: import_zod10.z.string().optional().describe("Path to mount the volume"),
+      readme: import_zod10.z.string().optional().describe("README content in markdown format"),
+      category: import_zod10.z.enum(["CPU", "NVIDIA", "AMD"]).optional().describe(
+        "How the template is grouped and filtered in the Runpod console \u2014 it does NOT affect hardware selection, scheduling, or billing. Optional; defaults to NVIDIA. Set CPU or AMD only to file the template correctly in the console."
       ),
-      containerRegistryAuthId: import_zod6.z.string().optional().describe(
+      containerRegistryAuthId: import_zod10.z.string().optional().describe(
         "ID of a container registry credential (from create-container-registry-auth / list-container-registry-auths) used to pull a private image. Required when imageName points at a private registry; without it serverless workers fail the image pull."
       )
     },
@@ -1713,15 +2699,18 @@ function registerTemplateTools(server, rt) {
   );
   server.tool(
     "update-template",
-    "Update a template's mutable fields (name, image, ports, env, readme). Only provided fields change.",
+    "Update a template's mutable fields (name, image, ports, env, start command, registry auth). Only provided fields change; omitted fields are left untouched.",
     {
-      templateId: import_zod6.z.string().describe("ID of the template to update"),
-      name: import_zod6.z.string().optional().describe("New name for the template"),
-      imageName: import_zod6.z.string().optional().describe("New Docker image"),
-      ports: import_zod6.z.array(import_zod6.z.string()).optional().describe("New ports to expose"),
-      env: import_zod6.z.record(import_zod6.z.string()).optional().describe("New environment variables"),
-      readme: import_zod6.z.string().optional().describe("New README content in markdown format"),
-      containerRegistryAuthId: import_zod6.z.string().optional().describe(
+      templateId: import_zod10.z.string().describe("ID of the template to update"),
+      name: import_zod10.z.string().optional().describe("New name for the template"),
+      imageName: import_zod10.z.string().optional().describe("New Docker image"),
+      dockerStartCmd: import_zod10.z.array(import_zod10.z.string()).optional().describe(
+        "New container start command. On v2 stored as the template's `args` string; a multi-element array is joined with spaces (lossy \u2014 an element containing spaces is split into separate tokens). Note: this can only set a command, not clear one \u2014 an empty or absent array is ignored so the existing command is preserved."
+      ),
+      ports: import_zod10.z.array(import_zod10.z.string()).optional().describe("New ports to expose"),
+      env: import_zod10.z.record(import_zod10.z.string()).optional().describe("New environment variables"),
+      readme: import_zod10.z.string().optional().describe("New README content in markdown format"),
+      containerRegistryAuthId: import_zod10.z.string().optional().describe(
         "ID of a container registry credential (from create-container-registry-auth / list-container-registry-auths) used to pull a private image. Set this to attach a credential to a template referencing a private registry."
       )
     },
@@ -1742,7 +2731,7 @@ function registerTemplateTools(server, rt) {
     "delete-template",
     "Permanently delete a template. This cannot be undone.",
     {
-      templateId: import_zod6.z.string().describe("ID of the template to delete")
+      templateId: import_zod10.z.string().describe("ID of the template to delete")
     },
     { title: "Delete template", ...DESTRUCTIVE },
     async (params) => {
@@ -1757,7 +2746,7 @@ function registerTemplateTools(server, rt) {
 }
 
 // src/tools/network-volumes.ts
-var import_zod7 = require("zod");
+var import_zod11 = require("zod");
 function registerNetworkVolumeTools(server, rt) {
   const { jsonReply: jsonReply2, callRestUrl, backendFor } = rt;
   server.tool(
@@ -1778,7 +2767,7 @@ function registerNetworkVolumeTools(server, rt) {
     "get-network-volume",
     "Get one network volume by id (name, size, data center).",
     {
-      networkVolumeId: import_zod7.z.string().describe("ID of the network volume to retrieve")
+      networkVolumeId: import_zod11.z.string().describe("ID of the network volume to retrieve")
     },
     { title: "Get network volume", ...READ_ONLY },
     async (params) => {
@@ -1791,11 +2780,17 @@ function registerNetworkVolumeTools(server, rt) {
   );
   server.tool(
     "create-network-volume",
-    "Create a persistent network volume in a data center (size 1\u20134000 GB) that pods can mount.",
+    "Create a persistent network volume in a data center (size 10\u20134096 GB) that pods can mount. Pass volumeType to pick a storage tier; omit it to get the data center default.",
     {
-      name: import_zod7.z.string().describe("Name for the network volume"),
-      size: import_zod7.z.number().describe("Size in GB (1-4000)"),
-      dataCenterId: import_zod7.z.string().describe("Data center ID (see list-data-centers)")
+      name: import_zod11.z.string().describe("Name for the network volume"),
+      // Bounds mirror the v2 spec (integer, minimum 10, maximum 4096). Enforced
+      // here as well as described, so an out-of-range value fails locally
+      // instead of costing an API roundtrip.
+      size: import_zod11.z.number().int().min(10).max(4096).describe("Size in GB (10-4096)"),
+      dataCenterId: import_zod11.z.string().describe("Data center ID (see list-data-centers)"),
+      volumeType: import_zod11.z.enum(["STANDARD", "HIGH_PERFORMANCE"]).optional().describe(
+        "Storage tier. Omit for the data center's default (primary) tier. HIGH_PERFORMANCE provisions an HPS volume. Immutable after creation \u2014 update-network-volume cannot change it."
+      )
     },
     { title: "Create network volume", ...WRITE },
     async (params) => {
@@ -1813,9 +2808,11 @@ function registerNetworkVolumeTools(server, rt) {
     "update-network-volume",
     "Update a network volume (rename, or grow size \u2014 the new size must exceed the current size). Only provided fields change.",
     {
-      networkVolumeId: import_zod7.z.string().describe("ID of the network volume to update"),
-      name: import_zod7.z.string().optional().describe("New name for the network volume"),
-      size: import_zod7.z.number().optional().describe("New size in GB (must be larger than current)")
+      networkVolumeId: import_zod11.z.string().describe("ID of the network volume to update"),
+      name: import_zod11.z.string().optional().describe("New name for the network volume"),
+      // Same absolute bounds as create. "Larger than current" stays server-side —
+      // we do not hold the current size here, so only the range is checked.
+      size: import_zod11.z.number().int().min(10).max(4096).optional().describe("New size in GB, 10-4096 (must be larger than current)")
     },
     { title: "Update network volume", ...WRITE, idempotentHint: true },
     async (params) => {
@@ -1834,7 +2831,7 @@ function registerNetworkVolumeTools(server, rt) {
     "delete-network-volume",
     "Permanently delete a network volume and its data. This cannot be undone.",
     {
-      networkVolumeId: import_zod7.z.string().describe("ID of the network volume to delete")
+      networkVolumeId: import_zod11.z.string().describe("ID of the network volume to delete")
     },
     { title: "Delete network volume", ...DESTRUCTIVE },
     async (params) => {
@@ -1849,9 +2846,14 @@ function registerNetworkVolumeTools(server, rt) {
 }
 
 // src/tools/registries.ts
-var import_zod8 = require("zod");
+var import_zod12 = require("zod");
+var DELEGATIONS = "/delegations";
 function registerRegistryTools(server, rt) {
   const { jsonReply: jsonReply2, callRestUrl, backendFor } = rt;
+  const delegationsV2OnlyNotice = (tool) => ({
+    error: `${tool} is only available on the v2 REST API. Set RUNPOD_REST_VERSION=v2.`,
+    status: 501
+  });
   server.tool(
     "list-container-registry-auths",
     "List your saved container-registry credentials (private image-pull auth). Paginated via limit/cursor.",
@@ -1870,7 +2872,7 @@ function registerRegistryTools(server, rt) {
     "get-container-registry-auth",
     "Get one saved container-registry credential by id (the secret/password is not returned).",
     {
-      containerRegistryAuthId: import_zod8.z.string().describe("ID of the container registry auth to retrieve")
+      containerRegistryAuthId: import_zod12.z.string().describe("ID of the container registry auth to retrieve")
     },
     { title: "Get container registry auth", ...READ_ONLY },
     async (params) => {
@@ -1885,9 +2887,9 @@ function registerRegistryTools(server, rt) {
     "create-container-registry-auth",
     "Save container-registry credentials (username + password/token) so pods and endpoints can pull private images.",
     {
-      name: import_zod8.z.string().describe("Name for the container registry auth"),
-      username: import_zod8.z.string().describe("Registry username"),
-      password: import_zod8.z.string().describe("Registry password or access token (stored as a secret)")
+      name: import_zod12.z.string().describe("Name for the container registry auth"),
+      username: import_zod12.z.string().describe("Registry username"),
+      password: import_zod12.z.string().describe("Registry password or access token (stored as a secret)")
     },
     { title: "Create container registry auth", ...WRITE },
     async (params) => {
@@ -1905,7 +2907,7 @@ function registerRegistryTools(server, rt) {
     "delete-container-registry-auth",
     "Permanently delete a saved container-registry credential. This cannot be undone.",
     {
-      containerRegistryAuthId: import_zod8.z.string().describe("ID of the container registry auth to delete")
+      containerRegistryAuthId: import_zod12.z.string().describe("ID of the container registry auth to delete")
     },
     { title: "Delete container registry auth", ...DESTRUCTIVE },
     async (params) => {
@@ -1917,166 +2919,69 @@ function registerRegistryTools(server, rt) {
       return jsonReply2(result);
     }
   );
-}
-
-// src/tools/tags.ts
-var import_zod9 = require("zod");
-var TAG_RESOURCE_TYPES = [
-  "POD",
-  "NETWORK_VOLUME",
-  "CLUSTER",
-  "SERVERLESS_ENDPOINT"
-];
-var taggedResourceSchema = import_zod9.z.object({
-  id: import_zod9.z.string().describe("Resource identifier (e.g. a pod or endpoint id)"),
-  type: import_zod9.z.enum(TAG_RESOURCE_TYPES).describe("Type of resource to associate with the tag")
-});
-function v2OnlyNotice(tool) {
-  return {
-    error: `${tool} is only available on the v2 REST API. Set RUNPOD_REST_VERSION=v2.`,
-    status: 501
-  };
-}
-function registerTagTools(server, rt) {
-  const { jsonReply: jsonReply2, callRestUrl, backendFor } = rt;
   server.tool(
-    "list-tags",
-    "List your tags (key/value labels on pods, volumes, clusters, and endpoints). v2-only \u2014 returns a 501 notice on the v1 API. Paginated via limit/cursor.",
-    {
-      ...listPaginationParams,
-      includeResources: import_zod9.z.boolean().optional().describe("Include the resources attached to each tag in the response")
-    },
-    { title: "List tags", ...READ_ONLY },
+    "list-registry-delegations",
+    "List your AWS ECR delegations \u2014 ECR repositories Runpod has been granted scoped pull access to, so private ECR images can be pulled without storing AWS credentials. Each entry includes the `dockerRegistryUri` to pull from. v2-only \u2014 returns a 501 notice on the v1 API. Paginated via limit/cursor.",
+    listPaginationParams,
+    { title: "List registry delegations", ...READ_ONLY },
     async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1") return jsonReply2(v2OnlyNotice("list-tags"));
-      const query = params.includeResources ? "?include=resources" : "";
-      const raw = await callRestUrl(`${backend.base}${backend.list}${query}`);
-      return capListResult(backend.unwrap(raw), {
+      const backend = backendFor("registries");
+      if (backend.version === "v1") {
+        return jsonReply2(delegationsV2OnlyNotice("list-registry-delegations"));
+      }
+      const raw = await callRestUrl(
+        `${backend.base}${backend.list}${DELEGATIONS}`
+      );
+      const delegations = Array.isArray(raw?.delegations) ? raw.delegations : [];
+      return capListResult(delegations, {
         limit: params.limit,
         cursor: params.cursor
       });
     }
   );
   server.tool(
-    "get-tag",
-    "Get one tag by id, optionally including its attached resources. v2-only \u2014 returns a 501 notice on the v1 API.",
-    {
-      tagId: import_zod9.z.string().describe("ID of the tag to retrieve"),
-      includeResources: import_zod9.z.boolean().optional().describe("Include the resources attached to this tag")
-    },
-    { title: "Get tag", ...READ_ONLY },
-    async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1") return jsonReply2(v2OnlyNotice("get-tag"));
-      const query = params.includeResources ? "?include=resources" : "";
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(params.tagId)}${query}`
-      );
-      return jsonReply2(result);
-    }
-  );
-  server.tool(
-    "create-tag",
-    "Create a key/value tag, optionally attaching resources at creation. v2-only \u2014 returns a 501 notice on the v1 API.",
+    "create-registry-delegation",
+    "Register an AWS ECR repository so Runpod can pull private images from it without stored credentials. Pass the repository ARN; the reply carries the `dockerRegistryUri`, resolved repository/tag, and AWS region. v2-only \u2014 returns a 501 notice on the v1 API. For a non-ECR private registry use create-container-registry-auth instead.",
     {
-      key: import_zod9.z.string().min(1).describe('Tag key (e.g. "project")'),
-      value: import_zod9.z.string().min(1).describe('Tag value (e.g. "gpt-training")'),
-      resources: import_zod9.z.array(taggedResourceSchema).optional().describe("Resources to attach to the tag at creation time")
+      resource: import_zod12.z.string().min(1).describe(
+        'ECR resource ARN, e.g. "arn:aws:ecr:us-east-2:123456789012:repository/my-org/my-image"'
+      ),
+      name: import_zod12.z.string().optional().describe("Optional human-readable name for the delegation")
     },
-    { title: "Create tag", ...WRITE },
+    { title: "Create registry delegation", ...WRITE },
     async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1")
-        return jsonReply2(v2OnlyNotice("create-tag"));
+      const backend = backendFor("registries");
+      if (backend.version === "v1") {
+        return jsonReply2(delegationsV2OnlyNotice("create-registry-delegation"));
+      }
+      const body = { resource: params.resource };
+      if (params.name !== void 0) body.name = params.name;
       const result = await callRestUrl(
-        `${backend.base}${backend.list}`,
+        `${backend.base}${backend.list}${DELEGATIONS}`,
         "POST",
-        params
+        body
       );
       return jsonReply2(result);
     }
   );
   server.tool(
-    "update-tag",
-    "Update a tag (rename its key/value, or replace its resource associations). Provide at least one of key, value, or resources. Sending resources:[] removes all associations; omitting resources leaves them unchanged. Replacing resources is NOT atomic \u2014 a failed update can leave a partially-applied set, so for small association changes prefer attach-tag/detach-tag. v2-only \u2014 returns a 501 notice on the v1 API.",
+    "delete-registry-delegation",
+    "Revoke an AWS ECR delegation, withdrawing Runpod's pull access to that repository. Existing workers keep running; future pulls fail. v2-only \u2014 returns a 501 notice on the v1 API. This cannot be undone.",
     {
-      tagId: import_zod9.z.string().describe("ID of the tag to update"),
-      key: import_zod9.z.string().min(1).optional().describe("New tag key"),
-      value: import_zod9.z.string().min(1).optional().describe("New tag value"),
-      resources: import_zod9.z.array(taggedResourceSchema).optional().describe(
-        "Replace the tag's resource associations with exactly these. Omit to leave unchanged; pass [] to detach all."
+      delegationId: import_zod12.z.string().describe(
+        "ID of the delegation to revoke (from list-registry-delegations)"
       )
     },
-    // No idempotentHint: replacing `resources` is non-atomic upstream, so a
-    // retried-after-partial-failure update is not guaranteed to be a no-op.
-    { title: "Update tag", ...WRITE },
-    async (params) => {
-      const { tagId, ...updateParams } = params;
-      const backend = backendFor("tags");
-      if (backend.version === "v1")
-        return jsonReply2(v2OnlyNotice("update-tag"));
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(tagId)}`,
-        "PATCH",
-        updateParams
-      );
-      return jsonReply2(result);
-    }
-  );
-  server.tool(
-    "delete-tag",
-    "Permanently delete a tag (removes it from all resources it is attached to). This cannot be undone. v2-only \u2014 returns a 501 notice on the v1 API.",
-    {
-      tagId: import_zod9.z.string().describe("ID of the tag to delete")
-    },
-    { title: "Delete tag", ...DESTRUCTIVE },
-    async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1")
-        return jsonReply2(v2OnlyNotice("delete-tag"));
-      const result = await callRestUrl(
-        `${backend.base}${backend.get(params.tagId)}`,
-        "DELETE"
-      );
-      return jsonReply2(result);
-    }
-  );
-  server.tool(
-    "attach-tag",
-    "Attach a tag to a resource (pod, network volume, cluster, or serverless endpoint). Idempotent \u2014 attaching an already-associated resource is a no-op. v2-only \u2014 returns a 501 notice on the v1 API.",
-    {
-      tagId: import_zod9.z.string().describe("ID of the tag"),
-      resourceType: import_zod9.z.enum(TAG_RESOURCE_TYPES).describe("Type of resource to attach the tag to"),
-      resourceId: import_zod9.z.string().describe("ID of the resource to attach the tag to")
-    },
-    { title: "Attach tag to resource", ...WRITE, idempotentHint: true },
-    async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1")
-        return jsonReply2(v2OnlyNotice("attach-tag"));
-      const result = await callRestUrl(
-        `${backend.base}/tags/${encodeURIComponent(params.tagId)}/resources/${params.resourceType}/${encodeURIComponent(params.resourceId)}`,
-        "PUT"
-      );
-      return jsonReply2(result);
-    }
-  );
-  server.tool(
-    "detach-tag",
-    "Detach a tag from a resource (removes the association only \u2014 the resource and tag are not deleted). Idempotent \u2014 detaching a resource that is not associated is a no-op. v2-only \u2014 returns a 501 notice on the v1 API.",
-    {
-      tagId: import_zod9.z.string().describe("ID of the tag"),
-      resourceType: import_zod9.z.enum(TAG_RESOURCE_TYPES).describe("Type of resource to detach the tag from"),
-      resourceId: import_zod9.z.string().describe("ID of the resource to detach the tag from")
-    },
-    { title: "Detach tag from resource", ...WRITE, idempotentHint: true },
+    { title: "Revoke registry delegation", ...DESTRUCTIVE },
     async (params) => {
-      const backend = backendFor("tags");
-      if (backend.version === "v1")
-        return jsonReply2(v2OnlyNotice("detach-tag"));
+      const backend = backendFor("registries");
+      if (backend.version === "v1") {
+        return jsonReply2(delegationsV2OnlyNotice("delete-registry-delegation"));
+      }
       const result = await callRestUrl(
-        `${backend.base}/tags/${encodeURIComponent(params.tagId)}/resources/${params.resourceType}/${encodeURIComponent(params.resourceId)}`,
+        `${backend.base}${backend.list}${DELEGATIONS}/${encodeURIComponent(
+          params.delegationId
+        )}`,
         "DELETE"
       );
       return jsonReply2(result);
@@ -2085,7 +2990,7 @@ function registerTagTools(server, rt) {
 }
 
 // src/tools/billing.ts
-var import_zod10 = require("zod");
+var import_zod13 = require("zod");
 var BILLING_SCOPE_PATH = {
   all: "/billing",
   pods: "/billing/pods",
@@ -2101,7 +3006,7 @@ function registerBillingTools(server, rt) {
     "Get time-bucketed Runpod spend history, either aggregated across all resources or broken down by resource type (pods, serverless, endpoints, network volumes, clusters). v2-only \u2014 returns a 501 notice on the v1 API. Records are capped via limit/cursor; narrow the window with startTime/endTime or lastN.",
     {
       ...listPaginationParams,
-      scope: import_zod10.z.enum([
+      scope: import_zod13.z.enum([
         "all",
         "pods",
         "serverless",
@@ -2111,14 +3016,14 @@ function registerBillingTools(server, rt) {
       ]).optional().describe(
         'Which billing breakdown to fetch. "all" (default) is the aggregate across every resource.'
       ),
-      startTime: import_zod10.z.string().optional().describe(
+      startTime: import_zod13.z.string().optional().describe(
         "Start of the period (RFC 3339, e.g. 2026-05-01T00:00:00Z). Defaults to 30 days ago. Mutually exclusive with lastN."
       ),
-      endTime: import_zod10.z.string().optional().describe(
+      endTime: import_zod13.z.string().optional().describe(
         "End of the period (RFC 3339), exclusive. Defaults to now. Mutually exclusive with lastN."
       ),
-      bucketSize: import_zod10.z.enum(["hour", "day", "week", "month", "year"]).optional().describe("Length of each time bucket. Defaults to day."),
-      lastN: import_zod10.z.number().int().positive().optional().describe(
+      bucketSize: import_zod13.z.enum(["hour", "day", "week", "month", "year"]).optional().describe("Length of each time bucket. Defaults to day."),
+      lastN: import_zod13.z.number().int().positive().optional().describe(
         "Return the last N buckets of bucketSize, ending with the current one. Mutually exclusive with startTime/endTime."
       )
     },
@@ -2153,16 +3058,119 @@ function registerBillingTools(server, rt) {
 function registerTools(server, ctx, deps = {}) {
   const rt = createToolRuntime(server, ctx, deps);
   registerCatalogTools(server, rt);
+  registerHubTools(server, rt);
+  registerPublicEndpointTools(server, rt);
   registerPodTools(server, rt);
   registerEndpointTools(server, rt);
+  registerEndpointGpuTools(server, rt);
   registerJobTools(server, rt);
   registerTemplateTools(server, rt);
   registerNetworkVolumeTools(server, rt);
   registerRegistryTools(server, rt);
-  registerTagTools(server, rt);
   registerBillingTools(server, rt);
 }
 
+// src/_shared/credential-check.ts
+var import_node_crypto2 = require("crypto");
+var VALID_TTL_MS = 6e4;
+var INVALID_TTL_MS = 3e4;
+var REQUEST_TIMEOUT_MS = 4e3;
+var MAX_CACHE_ENTRIES = 1e3;
+function hashToken(token) {
+  return (0, import_node_crypto2.createHash)("sha256").update(token).digest("hex");
+}
+function createCredentialChecker(deps) {
+  const now = deps.now ?? (() => performance.now());
+  const validTtl = deps.validTtlMs ?? VALID_TTL_MS;
+  const invalidTtl = deps.invalidTtlMs ?? INVALID_TTL_MS;
+  const timeoutMs = deps.timeoutMs ?? REQUEST_TIMEOUT_MS;
+  const maxEntries = Math.max(1, deps.maxEntries ?? MAX_CACHE_ENTRIES);
+  const entries = /* @__PURE__ */ new Map();
+  async function fetchVerdict(token) {
+    try {
+      const response = await deps.fetch(deps.url(), {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify({ query: "query { myself { id } }" }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (response.status === 401) {
+        return {
+          status: "invalid",
+          reason: "The Runpod API rejected the credential (it may have been revoked)."
+        };
+      }
+      if (!response.ok) return { status: "unknown" };
+      const result = await response.json();
+      if (result?.data?.myself?.id) return { status: "valid" };
+      if (Array.isArray(result?.errors) && result.errors.length > 0) {
+        return { status: "unknown" };
+      }
+      if (result?.data && result.data.myself === null) {
+        return {
+          status: "invalid",
+          reason: "The credential does not resolve to a Runpod account."
+        };
+      }
+      return { status: "unknown" };
+    } catch {
+      return { status: "unknown" };
+    }
+  }
+  function evictIfFull() {
+    while (entries.size >= maxEntries) {
+      let victim;
+      for (const [k, e] of entries) {
+        if (!e.promise) {
+          victim = k;
+          break;
+        }
+      }
+      if (victim === void 0) return;
+      entries.delete(victim);
+    }
+  }
+  async function verify(token) {
+    const key = hashToken(token);
+    const existing = entries.get(key);
+    if (existing?.verdict) {
+      if (existing.expiresAt > now()) {
+        entries.delete(key);
+        entries.set(key, existing);
+        return existing.verdict;
+      }
+      entries.delete(key);
+    } else if (existing?.promise) {
+      return existing.promise;
+    }
+    const entry = { expiresAt: 0 };
+    entry.promise = fetchVerdict(token).then((verdict) => {
+      if (entries.get(key) === entry) {
+        if (verdict.status !== "unknown") {
+          entry.verdict = verdict;
+          entry.expiresAt = now() + (verdict.status === "valid" ? validTtl : invalidTtl);
+          entry.promise = void 0;
+        } else {
+          entries.delete(key);
+        }
+      }
+      return verdict;
+    });
+    evictIfFull();
+    entries.set(key, entry);
+    return entry.promise;
+  }
+  return {
+    verify,
+    invalidate: (token) => {
+      entries.delete(hashToken(token));
+    }
+  };
+}
+
 // src/http.ts
 function extractBearerToken(req) {
   const authHeader = req.headers.authorization;
@@ -2179,16 +3187,111 @@ function getBaseUrl(req) {
   }
   return `${proto}://${host}`;
 }
-function writeUnauthorized(req, res, error) {
-  const headers = {
-    "Content-Type": "application/json",
-    "WWW-Authenticate": `Bearer realm="mcp", resource_metadata="${getBaseUrl(
+function writeUnauthorized(req, res, error, invalidToken = false) {
+  const challenge = [
+    'Bearer realm="mcp"',
+    ...invalidToken ? [
+      'error="invalid_token"',
+      'error_description="The credential was rejected; re-authenticate."'
+    ] : [],
+    `resource_metadata="${getBaseUrl(
       req
     )}/.well-known/oauth-protected-resource"`
-  };
-  res.writeHead(401, headers);
+  ].join(", ");
+  res.writeHead(401, {
+    "Content-Type": "application/json",
+    "WWW-Authenticate": challenge
+  });
   res.end(JSON.stringify({ error }));
 }
+function authGraphqlUrl(env) {
+  return authedGraphqlBase(env);
+}
+var defaultCredentialChecker = createCredentialChecker({
+  fetch: (url, init) => fetch(url, init),
+  url: () => authGraphqlUrl(process.env)
+});
+var sameHost = (a, b) => normalizeUrl(a) === normalizeUrl(b);
+function normalizeUrl(raw) {
+  try {
+    const u = new URL(raw);
+    return `${u.protocol}//${u.host.toLowerCase()}${u.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return raw.trim().toLowerCase().replace(/\/+$/, "");
+  }
+}
+function credentialCheckMayBeWrongEnvironment(env = process.env) {
+  const envWithoutEmpties = Object.fromEntries(
+    Object.entries(env).filter(([, v]) => v !== "")
+  );
+  const restMoved = !sameHost(restV1Base(envWithoutEmpties), restV1Base({})) || !sameHost(restV2Base(envWithoutEmpties), restV2Base({})) || !sameHost(serverlessBase(envWithoutEmpties), serverlessBase({}));
+  const graphqlMoved = !sameHost(authGraphqlUrl(env), authGraphqlUrl({}));
+  return restMoved !== graphqlMoved;
+}
+function looksLikeMcpMessage(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const msg = value;
+  return msg.jsonrpc === "2.0" && typeof msg.method === "string";
+}
+function bodyIsCheckable(body) {
+  const messages = Array.isArray(body) ? body : [body];
+  return messages.some(looksLikeMcpMessage);
+}
+function isJsonContentType2(req) {
+  const ct = req.headers["content-type"];
+  if (!ct) return false;
+  return ct.toLowerCase().includes("application/json");
+}
+var MAX_BODY_BYTES = 4 * 1024 * 1024;
+var BODY_TOO_LARGE = Symbol("body_too_large");
+async function readJsonBody(req) {
+  const existing = req.body;
+  if (existing !== void 0) return existing;
+  const declared = Number(req.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+    return BODY_TOO_LARGE;
+  }
+  try {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buf.length;
+      if (total > MAX_BODY_BYTES) return BODY_TOO_LARGE;
+      chunks.push(buf);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8").trim();
+    return raw ? JSON.parse(raw) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function earlyCredentialCheckSkip(req) {
+  if (process.env.MCP_SKIP_CREDENTIAL_CHECK === "true") return "skip_env_var";
+  if (req.method !== "POST") return "skip_not_post";
+  if (!isJsonContentType2(req)) return "skip_not_json";
+  if (credentialCheckMayBeWrongEnvironment()) return "skip_env_mismatch";
+  return null;
+}
+function buildToolContext(req, bearerToken, opts = {}) {
+  const drop = opts.invalidateCredential ?? defaultCredentialChecker.invalidate;
+  return {
+    apiKey: bearerToken,
+    transport: "http",
+    // A tools/call is a separate request from `initialize` in stateless HTTP, so
+    // the per-request server never sees the MCP `clientInfo`; fall back to the
+    // inbound User-Agent so caller-tracking still attributes the client.
+    clientUserAgent: req.headers["user-agent"],
+    serverVersion: opts.serverVersion,
+    // A tool call that 401s proves a cached "valid" wrong before its TTL. Drop it
+    // so the next request re-checks and can emit the 401 that triggers re-auth.
+    onUnauthorized: () => drop(bearerToken)
+  };
+}
+function logCredentialCheck(outcome) {
+  if (outcome === "pass" && process.env.MCP_VERBOSE_LOGS !== "true") return;
+  console.log("credential_check", { outcome });
+}
 async function handleMcpRequest(req, res, opts = {}) {
   const bearerToken = extractBearerToken(req);
   console.log("mcp_request", {
@@ -2204,13 +3307,39 @@ async function handleMcpRequest(req, res, opts = {}) {
     );
     return;
   }
+  let body = req.body;
+  const early = earlyCredentialCheckSkip(req);
+  if (early) {
+    logCredentialCheck(early);
+  } else {
+    const read = await readJsonBody(req);
+    if (read === BODY_TOO_LARGE) {
+      res.writeHead(413, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Request body too large." }));
+      return;
+    }
+    body = read;
+    if (!bodyIsCheckable(body)) {
+      logCredentialCheck("skip_not_mcp_body");
+    } else {
+      const verify = opts.verifyCredential ?? defaultCredentialChecker.verify;
+      const verdict = await verify(bearerToken);
+      logCredentialCheck(
+        verdict.status === "invalid" ? "reject" : verdict.status === "valid" ? "pass" : "fail_open"
+      );
+      if (verdict.status === "invalid") {
+        writeUnauthorized(
+          req,
+          res,
+          `${verdict.reason} Re-authenticate to continue.`,
+          true
+        );
+        return;
+      }
+    }
+  }
   const server = createServer(opts.serverVersion);
-  registerTools(server, {
-    apiKey: bearerToken,
-    transport: "http",
-    clientUserAgent: req.headers["user-agent"],
-    serverVersion: opts.serverVersion
-  });
+  registerTools(server, buildToolContext(req, bearerToken, opts));
   const transport = new import_streamableHttp.StreamableHTTPServerTransport({
     sessionIdGenerator: void 0
     // stateless — no session persistence
@@ -2222,10 +3351,13 @@ async function handleMcpRequest(req, res, opts = {}) {
     });
   });
   await server.connect(transport);
-  await transport.handleRequest(req, res, req.body);
+  await transport.handleRequest(req, res, body);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  bodyIsCheckable,
+  buildToolContext,
+  defaultCredentialChecker,
   handleMcpRequest,
   registerTools
 });