@selfhost.dev/mcp-server 0.9.1 → 0.11.0

package/dist/tools/project-services.js

@@ -1,16 +1,26 @@
+import { isIP } from "node:net";
 import { z } from "zod";
 import { apiRequest } from "../client.js";
 import { session } from "../session.js";
 /**
- * Project services (CoolifyService) - one-click application templates deployed
- * into a project. FOUR templates are live, not one: the backend resolves them
- * from `ServiceProvisioning::Strategy.all`.
+ * Project services (CoolifyService) - one-click application templates deployed into a project.
+ * THIRTY-SIX templates are live, resolved backend-side from `ServiceProvisioning::Strategy.all`
+ * (one strategy file per template, auto-discovered). This module shipped knowing four of them
+ * until the 2026-09 sync, which meant an agent could only reach a sixth of the catalogue; the
+ * 2026-09-25 sync added the ten the backend gained after it (Mysterium, Mysterium VPN Gateway,
+ * URnetwork, Nginx, WireGuard, code-server, OpenSSH server, JupyterLab, Jupyter Data Science,
+ * Laravel). The backend's `compose` strategy is bring-your-own Docker Compose, not a template,
+ * and has no tool here.
  *
  * Endpoints:
  * - GET    /api/v1/platform/projects/:pid/services
  * - GET    /api/v1/platform/projects/:pid/services/:service_pid   (the ONLY source of credentials)
  * - POST   /api/v1/platform/projects/:pid/services/:template_type (202 - async provisioning)
  * - DELETE /api/v1/platform/projects/:pid/services/:service_pid   (202; body {name} must match)
+ * - POST   /api/v1/platform/projects/:pid/services/:pid/custom_domain
+ * - DELETE /api/v1/platform/projects/:pid/services/:pid/custom_domain
+ * - POST/GET /api/v1/platform/projects/:pid/services/:pid/logs    (async request-then-read)
+ * - POST/GET /api/v1/platform/projects/:pid/services/:pid/stats   (async request-then-read)
  *
  * The project must be `active` before creating a service (409 otherwise).
  *
@@ -20,50 +30,540 @@ import { session } from "../session.js";
  *
  * The backend ships templates ahead of its clients, so `list_project_services` can
  * return a `template_type` this module does not know. Report it by its wire string
- * rather than guessing - list and delete work on any type.
+ * rather than guessing - list, delete, logs, stats and custom domains work on any type.
+ *
+ * FIVE CREDENTIAL SHAPES, and getting this wrong is the main failure mode here:
+ * - `dashboardLogin`  - the create takes `dashboard_username` + `dashboard_password`, and they
+ *                       become the app's admin login. The username's accepted FORM varies:
+ *                       any string, a slug (`[a-zA-Z0-9_-]+`), an email address (Krayin signs
+ *                       in by email, so a bare `admin` creates an unusable account) or a Linux
+ *                       login name (OpenSSH server). WireGuard and OpenSSH default the username
+ *                       (`admin`, `dev`), so it is optional for those two only.
+ * - `fixedRootPassword` - password only; the app owns the username (GitLab is always `root`,
+ *                       Elasticsearch `elastic`, Mysterium `myst`) or has none (code-server,
+ *                       JupyterLab, Jupyter Data Science, Odoo, AnythingLLM). Sending a
+ *                       username is refused here.
+ * - `none`            - no admin env at all. THE FIRST VISITOR TO THE PUBLIC URL CLAIMS THE
+ *                       OWNER ACCOUNT. This is a real security consequence and every create
+ *                       of one of these says so unprompted.
+ * - `noLogin`         - no login AND nothing to claim: a static site (Nginx), a fresh app with
+ *                       no accounts yet (Laravel) or an HTTP proxy with no UI (Mysterium VPN
+ *                       Gateway). Not the first-visitor warning.
+ * - `authCode`        - a vendor token instead of a login (URnetwork's code from ur.io/app).
+ *                       It is a secret: never echo it back.
+ *
+ * THREE TEMPLATES SHARE THE SERVER'S NETWORK WITH OTHER PEOPLE OR SPEND MONEY OUTSIDE THE
+ * PLATFORM (Mysterium, Mysterium VPN Gateway, URnetwork), so their create demands
+ * `acknowledge_network_terms: true`, the same gate the console puts in front of them. Four
+ * templates have NO web component (Mysterium, the gateway, URnetwork, OpenSSH server): no
+ * public URL and no custom domain. Four are only reachable through a firewall rule the
+ * backend opens when `is_public` is true (Mysterium's panel, the gateway's proxy, WireGuard's
+ * UDP port, the OpenSSH port), so `is_public: false` is refused for them.
+ *
+ * CAPACITY IS A DECLARE-TIME REFUSAL, NOT A RUNTIME DEGRADATION. A project is ONE VM.
+ * `heavy` templates (many containers, large pulls, first-boot migrations) are held to
+ * stricter free-memory limits than light ones, some carry a hard minimum on the host's TOTAL
+ * RAM, at most 5 children can exist per project, and Stalwart is a singleton because its mail
+ * ports are fixed on the host. A project server cannot be resized, so "out of RAM" means a
+ * NEW project - which is why the numbers are surfaced before the call rather than after.
  */
 const PROJECTS_BASE = "/api/v1/platform/projects";
 /** Wire values accepted at `POST .../services/:template_type`. */
-const TEMPLATE_TYPES = ["supabase", "n8n", "n8n-with-postgresql", "twenty"];
-/**
- * Per-template truth. `dashboardCreds` is the one that changes the call shape:
- * Supabase takes its Studio credentials as env at deploy, while n8n and Twenty
- * have no admin env at all - their first admin is whoever opens the URL first.
- */
+const TEMPLATE_TYPES = [
+    "supabase", "n8n", "n8n-with-postgresql", "twenty",
+    "wordpress", "gitlab", "elasticsearch", "elasticsearch-with-kibana",
+    "immich", "nextcloud", "jenkins", "grafana",
+    "grafana-with-postgresql", "strapi", "metabase", "anythingllm",
+    "stalwart", "chatwoot", "mautic", "minio",
+    "open-webui-with-ollama", "litellm", "odoo", "paperless",
+    "espocrm", "krayin", "mysterium", "mysterium-gateway",
+    "urnetwork", "nginx", "wireguard", "code-server",
+    "openssh-server", "jupyterlab", "jupyter-datascience", "laravel",
+];
 const TEMPLATES = {
-    supabase: {
+    "supabase": {
         label: "Supabase",
-        dashboardCreds: true,
-        boot: "about 5 minutes",
-        firstAdmin: "the dashboard username/password you pass here",
-        credentials: "dashboard username + password, `public_url`, and the anon key when present",
-    },
-    n8n: {
-        label: "n8n (workflow automation)",
-        dashboardCreds: false,
-        boot: "up to 10 minutes",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - n8n shows an owner-setup screen to whoever gets there first",
-        credentials: "`public_url` only",
+        tagline: "Postgres, Auth, storage and auto-generated APIs.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 7,
+    },
+    "n8n": {
+        label: "n8n",
+        tagline: "Workflow automation with hundreds of integrations.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 4,
     },
     "n8n-with-postgresql": {
-        label: "n8n backed by PostgreSQL",
-        dashboardCreds: false,
-        boot: "up to 10 minutes",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - n8n shows an owner-setup screen to whoever gets there first",
-        credentials: "`public_url` only",
+        label: "n8n (Postgres)",
+        tagline: "The same n8n, backed by its own Postgres instead of SQLite.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 5,
     },
-    twenty: {
+    "twenty": {
         label: "Twenty (CRM)",
-        dashboardCreds: false,
-        boot: "up to 15 minutes - it pulls images and runs migrations, so do not call it stuck early",
-        firstAdmin: "THE FIRST PERSON TO OPEN THE URL - Twenty shows a sign-up screen to whoever gets there first",
-        credentials: "`public_url` only",
+        tagline: "Open-source CRM for contacts, deals and pipelines.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 14,
+    },
+    "wordpress": {
+        label: "WordPress",
+        tagline: "MariaDB-backed WordPress for publishing and sites.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 6,
+    },
+    "gitlab": {
+        label: "GitLab CE",
+        tagline: "Repositories, reviews and CI.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "root",
+        minPasswordLength: 12,
+        hostFloorGb: 8,
+        bootMinutes: 25,
+        loginNote: "GitLab ships with public sign-up disabled.",
+    },
+    "elasticsearch": {
+        label: "Elasticsearch",
+        tagline: "Search and analytics over your own documents.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "elastic",
+        minPasswordLength: 8,
+        bootMinutes: 10,
+        loginNote: "This password is the only lock on the endpoint, so keep it somewhere safe.",
+    },
+    "elasticsearch-with-kibana": {
+        label: "Elasticsearch + Kibana",
+        tagline: "Search and analytics with a UI in front of it.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "elastic",
+        minPasswordLength: 8,
+        hostFloorGb: 4,
+        bootMinutes: 8,
+        loginNote: "The URL is KIBANA, not the raw Elasticsearch API. Query the API from Kibana's Dev Tools, or deploy plain `elasticsearch` when an app needs to reach it directly.",
+    },
+    "immich": {
+        label: "Immich",
+        tagline: "Photo and video backup for your phone.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 20,
+    },
+    "nextcloud": {
+        label: "Nextcloud",
+        tagline: "Files, calendar and contacts you host yourself.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 15,
+    },
+    "jenkins": {
+        label: "Jenkins",
+        tagline: "The CI server for your builds.",
+        recommendedRamGb: 4,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        hostFloorGb: 2,
+        bootMinutes: 15,
+        loginNote: "No setup wizard and no unlock key to find: the admin is seeded before the first boot.",
+    },
+    "grafana": {
+        label: "Grafana",
+        tagline: "Dashboards and alerts over your metrics.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 5,
+        loginNote: "It never boots on the well-known admin/admin default.",
+    },
+    "grafana-with-postgresql": {
+        label: "Grafana (Postgres)",
+        tagline: "The same Grafana, with its dashboards and alerts in a bundled Postgres.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 5,
+        loginNote: "It never boots on the well-known admin/admin default.",
+    },
+    "strapi": {
+        label: "Strapi",
+        tagline: "A headless CMS with an admin panel and a content API.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "none",
+        bootMinutes: 6,
+    },
+    "metabase": {
+        label: "Metabase",
+        tagline: "Dashboards and questions over your data.",
+        recommendedRamGb: 4,
+        heavy: true,
+        creds: "none",
+        hostFloorGb: 2,
+        bootMinutes: 7,
+    },
+    "anythingllm": {
+        label: "AnythingLLM",
+        tagline: "Chat over your own documents.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        minPasswordLength: 8,
+        bootMinutes: 6,
+        loginNote: "The unlock screen asks for this password ALONE, with no username. Without it AnythingLLM would boot open to anyone with the link.",
+    },
+    "stalwart": {
+        label: "Stalwart (mail server)",
+        tagline: "A full mail server, SMTP through JMAP.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "admin",
+        minPasswordLength: 8,
+        singleton: true,
+        bootMinutes: 4,
+        loginNote: "Hetzner blocks outbound port 25 on new accounts, so RECEIVING mail works at once but SENDING needs an unblock request or a relay. ONE STALWART PER PROJECT - the mail ports are fixed on the host, so a second one is refused at declare time.",
+    },
+    "chatwoot": {
+        label: "Chatwoot",
+        tagline: "Live chat and a shared support inbox.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 12,
+    },
+    "mautic": {
+        label: "Mautic",
+        tagline: "Marketing automation and campaigns.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 8,
+    },
+    "minio": {
+        label: "MinIO",
+        tagline: "S3-compatible object storage.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 3,
+        loginNote: "The username is the S3 ACCESS KEY and the password is the SECRET. There is no web console: manage buckets with the `mc` CLI or any S3 SDK.",
+    },
+    "open-webui-with-ollama": {
+        label: "Open WebUI + Ollama",
+        tagline: "Chat with local models on your own box.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "none",
+        bootMinutes: 11,
+        loginNote: "Project servers are CPU ONLY, so stay with small models (1B-3B). Nothing ships with a model - you pull the first one yourself.",
+    },
+    "litellm": {
+        label: "LiteLLM",
+        tagline: "One OpenAI-compatible endpoint in front of every model provider.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "admin",
+        minPasswordLength: 8,
+        bootMinutes: 6,
+        loginNote: "This password is ALSO the API master key, as `sk-<password>`. Mint scoped virtual keys in the UI rather than handing that one out.",
+    },
+    "odoo": {
+        label: "Odoo",
+        tagline: "The open-source ERP and business suite.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        minPasswordLength: 8,
+        bootMinutes: 8,
+        loginNote: "This is the DATABASE-MANAGER MASTER PASSWORD, not a login. You use it once to create the database and pick your own admin email and password.",
+    },
+    "paperless": {
+        label: "Paperless-ngx",
+        tagline: "A searchable, OCR-indexed archive of your documents.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        minPasswordLength: 8,
+        bootMinutes: 8,
+    },
+    "espocrm": {
+        label: "EspoCRM",
+        tagline: "Contacts, accounts and deals in a CRM you own.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        usernameShape: "slug",
+        minPasswordLength: 8,
+        bootMinutes: 12,
+        loginNote: "No install wizard: the admin is seeded before the first boot, so it never comes up on the documented admin/password default.",
+    },
+    "krayin": {
+        label: "Krayin (CRM)",
+        tagline: "Leads, quotes and deals in an open-source CRM you own.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "dashboardLogin",
+        fixedUsername: "",
+        usernameShape: "email",
+        minPasswordLength: 8,
+        unsupportedArchitectures: ["arm"],
+        bootMinutes: 15,
+        loginNote: "Krayin signs in with an EMAIL ADDRESS, so dashboard_username must be one - a bare `admin` creates an account nobody can sign in as. The admin is seeded before the first boot.",
+    },
+    "mysterium": {
+        label: "Mysterium (VPN node)",
+        tagline: "A VPN node that shares the server's bandwidth on the Mysterium network, and earns for it.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "myst",
+        minPasswordLength: 12,
+        maxPasswordBytes: 72,
+        passwordForbids: "nul",
+        singleton: true,
+        noWebComponent: true,
+        requiresPublic: "its node panel (HTTP on port 4449) is reachable only through a firewall rule the backend opens for a public service, restricted to `panel_source` - that restriction, not `is_public: false`, is what keeps it private",
+        networkTerms: "a Mysterium node shares this server's bandwidth with strangers on the Mysterium network: their traffic leaves from the project's IP address, under Mysterium's terms",
+        bootMinutes: 4,
+        loginNote: "The node panel is plain HTTP on port 4449 of the project IP (`public_url` from get_project_service), reachable ONLY from `panel_source`. Sign in as `myst` with the password; on first boot the password can take a minute to apply. Then claim the node on mystnodes.com. A running container does not mean the node is claimed or earning. The allowed IPs can be changed later in the console (Settings, Panel access); this MCP has no tool for that yet.",
+    },
+    "mysterium-gateway": {
+        label: "Mysterium VPN Gateway",
+        tagline: "An HTTP proxy that routes your apps through the Mysterium VPN network, paid for in MYST.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "noLogin",
+        singleton: true,
+        noWebComponent: true,
+        requiresPublic: "its HTTP proxy (port 3128) is reachable only through a firewall rule the backend opens for a public service, restricted to `proxy_source` - that restriction, not `is_public: false`, is what keeps it from being an open proxy",
+        networkTerms: "the gateway consumes the Mysterium network and is paid for in MYST per GB from a funded identity, separately from the project server, under Mysterium's terms",
+        bootMinutes: 10,
+        loginNote: "No login and no web UI: it is an HTTP proxy on port 3128 (`proxy_endpoint` from get_project_service), reachable ONLY from `proxy_source`. It carries NO traffic until its identity is registered and funded with MYST: request the `connector` container's logs (request_project_container_logs) for the identity address to fund, the registration state and the exit IP. Then set HTTP_PROXY / HTTPS_PROXY in the app to `proxy_endpoint`.",
+    },
+    "urnetwork": {
+        label: "URnetwork (bandwidth node)",
+        tagline: "A provider node that shares the server's bandwidth with the URnetwork network.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "authCode",
+        noWebComponent: true,
+        networkTerms: "a URnetwork provider shares this server's bandwidth with the URnetwork network: other people's traffic leaves from the project's IP address, under URnetwork's terms",
+        bootMinutes: 10,
+        loginNote: "No UI and no ports: the node dials out to URnetwork. Manage it (earnings, pausing) at ur.io/app. A running container does NOT prove the auth code was accepted: check the account, or the container logs for `init proxy auth failed`. Auth codes expire; a new one can replace it without recreating the node from the console (Settings, URnetwork account); this MCP has no tool for that yet.",
+    },
+    "nginx": {
+        label: "Nginx (static site)",
+        tagline: "A static website served over HTTPS, with custom domains.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "noLogin",
+        bootMinutes: 10,
+        loginNote: "No login: it serves a welcome page until you upload a site. get_project_service returns `credentials.content_path` (for example `~/nginx-def123`); install a project SSH key (add_project_ssh_key), connect as `shell` to the project IP, and put the site's files there. They are served immediately, with no sudo or Docker. The directory can outlive a deleted service, and a recreated service gets a new one.",
+    },
+    "wireguard": {
+        label: "WireGuard (wg-easy)",
+        tagline: "A private WireGuard VPN with an HTTPS admin panel.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "any",
+        defaultUsername: "admin",
+        usernameMaxLength: 64,
+        minPasswordLength: 12,
+        singleton: true,
+        requiresPublic: "VPN clients reach it on UDP 51820 only through a firewall rule the backend opens for a public service; the admin panel is password-protected HTTPS",
+        bootMinutes: 10,
+        loginNote: "Sign in to the admin panel over HTTPS with this login, add VPN peers there, and import their configurations into WireGuard clients. Clients connect to `wireguard_endpoint` (the project IP, UDP 51820). A running container does not prove a working tunnel.",
+    },
+    "code-server": {
+        label: "code-server",
+        tagline: "VS Code in the browser, with a terminal and your extensions.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "fixedRootPassword",
+        fixedUsername: "",
+        minPasswordLength: 12,
+        bootMinutes: 10,
+        loginNote: "There is no username: the sign-in screen asks for the password alone, and the same password unlocks sudo in the terminal. Settings, extensions and /config/workspace persist across restarts.",
+    },
+    "openssh-server": {
+        label: "OpenSSH server",
+        tagline: "A Linux container you reach over SSH, with sudo and a home that persists.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "dashboardLogin",
+        usernameShape: "unix",
+        defaultUsername: "dev",
+        minPasswordLength: 12,
+        passwordForbids: "control",
+        noWebComponent: true,
+        requiresPublic: "its SSH port (`public_port`, default 2222) is reachable only through a firewall rule the backend opens for a public service",
+        publicPortNote: "the host port sshd listens on (default 2222); each SSH server in a project needs its own",
+        bootMinutes: 10,
+        loginNote: "Connect with `credentials.ssh_command` from get_project_service (`ssh -p <public_port> <user>@<project IP>`). The SSH port is open to the whole internet, which is why the password is required even with a key; sudo uses the same password. It is its own SSH server in a container, separate from the project server's `shell` access, and everything under /config persists across restarts.",
+    },
+    "jupyterlab": {
+        label: "JupyterLab",
+        tagline: "Python notebooks with numpy, pandas and scikit-learn installed.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "",
+        minPasswordLength: 12,
+        bootMinutes: 15,
+        loginNote: "There is no username: paste the password into the `Password or token` box on the sign-in page. The whole home folder (notebooks, settings, `pip install --user` packages) persists across restarts.",
+    },
+    "jupyter-datascience": {
+        label: "Jupyter Data Science",
+        tagline: "JupyterLab with Python, R and Julia notebooks.",
+        recommendedRamGb: 8,
+        heavy: true,
+        creds: "fixedRootPassword",
+        fixedUsername: "",
+        minPasswordLength: 12,
+        bootMinutes: 20,
+        loginNote: "There is no username: paste the password into the `Password or token` box on the sign-in page. It is JupyterLab with the R (tidyverse) and Julia kernels added, a ~2.7 GB image; `jupyterlab` is the lighter Python-only choice. The whole home folder persists across restarts.",
+    },
+    "laravel": {
+        label: "Laravel",
+        tagline: "A fresh Laravel app on its own MySQL database.",
+        recommendedRamGb: 4,
+        heavy: false,
+        creds: "noLogin",
+        bootMinutes: 15,
+        loginNote: "No login to set: the URL serves the Laravel welcome page on its own MySQL database, and the app built on it defines its own sign-in. First boot runs `composer create-project`, so the URL can take several minutes to serve.",
+    },
+};
+/** `RESERVED_USERNAMES` on the OpenSSH server's validator: root and the image's own accounts. */
+const UNIX_RESERVED_USERNAMES = new Set(["root", "abc", "daemon", "bin", "sys", "nobody", "sshd"]);
+/** Username validation per shape, mirroring the backend validators. */
+const USERNAME_SHAPE_RULES = {
+    any: { test: (v) => v.length > 0, hint: "any non-empty string" },
+    slug: { test: (v) => /^[a-zA-Z0-9_-]+$/.test(v), hint: "letters, digits, hyphen and underscore only" },
+    email: { test: (v) => /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v), hint: "an email address - this app signs in by email" },
+    unix: {
+        test: (v) => /^[a-z_][a-z0-9_-]{0,31}$/.test(v) && !UNIX_RESERVED_USERNAMES.has(v),
+        hint: "a lowercase Linux login name (letters, digits, - and _, starting with a letter or _, up to 32) and never root or a system account",
     },
 };
+/** The key algorithms the OpenSSH server's `PUBLIC_KEY_FORMAT` accepts. */
+const OPENSSH_KEY_ALGORITHMS = new Set([
+    "ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp521", "sk-ssh-ed25519@openssh.com", "sk-ecdsa-sha2-nistp256@openssh.com",
+]);
+/** Gateway service types (`MysteriumGatewayServiceValidator::SERVICE_TYPES`), default first. */
+const GATEWAY_SERVICE_TYPES = ["wireguard", "scraping", "data_transfer", "quic"];
+/** URnetwork's `AUTH_CODE_FORMAT`, with its 20-character floor. */
+const URNETWORK_AUTH_CODE = /^[A-Za-z0-9_\-=+/.]{20,}$/;
+/**
+ * One IP or CIDR the backend's `IPAddr.new` would accept, never an everything-range: the
+ * console refuses a world-open panel or proxy at create, and so does this. Returns an error
+ * sentence, or null when the value is fine.
+ */
+function sourceError(value, field) {
+    const v = value.trim();
+    const [address, prefix, extra] = v.split("/");
+    const family = isIP(address ?? "");
+    const bits = family === 4 ? 32 : 128;
+    if (!family || extra !== undefined || (prefix !== undefined && !/^\d{1,3}$/.test(prefix))
+        || (prefix !== undefined && Number(prefix) > bits)) {
+        return `${field} \`${v}\` is not an IP address or CIDR range (for example 203.0.113.7 or 203.0.113.0/24).`;
+    }
+    if (prefix !== undefined && Number(prefix) === 0) {
+        return `${field} \`${v}\` is every address on the internet. Pass the IP (or range) that should reach it; opening it to everyone is a deliberate choice made later in the console, never at create.`;
+    }
+    return null;
+}
+/** Rendered into the create description so the catalogue cannot drift from the code. */
+const TEMPLATE_CATALOGUE_TEXT = TEMPLATE_TYPES.map((t) => {
+    const f = TEMPLATES[t];
+    const username = f.defaultUsername
+        ? `optional username (default \`${f.defaultUsername}\`; ${USERNAME_SHAPE_RULES[f.usernameShape ?? "any"].hint})`
+        : `username (${USERNAME_SHAPE_RULES[f.usernameShape ?? "any"].hint})`;
+    const password = `password${f.minPasswordLength && f.minPasswordLength > 8 ? ` (${f.minPasswordLength}+)` : ""}`;
+    const creds = f.creds === "dashboardLogin"
+        ? `${username} + ${password}`
+        : f.creds === "fixedRootPassword"
+            ? `${password} only${f.fixedUsername ? `, user is always \`${f.fixedUsername}\`` : ", no username"}`
+            : f.creds === "noLogin"
+                ? "no login and nothing to claim"
+                : f.creds === "authCode"
+                    ? "an `auth_code` from ur.io/app"
+                    : "NO admin creds - first visitor owns it";
+    const flags = [
+        f.heavy ? "heavy" : null,
+        f.hostFloorGb ? `needs a ${f.hostFloorGb} GB+ host` : null,
+        f.singleton ? "one per project" : null,
+        f.unsupportedArchitectures?.length ? `no ${f.unsupportedArchitectures.join("/")} hosts` : null,
+        f.noWebComponent ? "no URL, no custom domain" : null,
+        f.requiresPublic ? "is_public must be true" : null,
+        f.networkTerms ? "needs acknowledge_network_terms" : null,
+    ].filter(Boolean).join(", ");
+    return `- \`${t}\` (${f.label}) - ${f.tagline} ${creds}. ~${f.bootMinutes} min, ${f.recommendedRamGb} GB recommended${flags ? ` [${flags}]` : ""}`;
+}).join("\n");
 const NO_ORG = "No active organization. Call `list_organizations` then `select_organization` first.";
 function hasOrg() {
     return session.getActiveOrgId() !== null;
 }
+/**
+ * Container inspection covers project SERVICES and project DATABASES with one contract - both
+ * are Docker containers on the project's single box, and the backend shares one
+ * `ContainerInspectable` concern for them. `resource_type` picks the collection rather than
+ * this module carrying two near-identical copies of four tools.
+ *
+ * REQUEST-THEN-READ, like the AWS instance-logs surface: POST dispatches a fetch to the host
+ * agent and returns a `pending` record; GET settles pending fetches against their tasks and
+ * returns the recent ones (newest first, up to 20).
+ *
+ * READ-ONLY BY CONSTRUCTION. The backend emits only allow-listed `docker ps / logs / stats /
+ * inspect` commands through the agent - no shell, no Docker socket, and the docker filter is
+ * scoped to this resource's containers. There is deliberately NO start / stop / restart /
+ * remove / exec surface anywhere on the platform, so do not go looking for one or promise it.
+ */
+const INSPECT_LINES_DEFAULT = 200;
+const INSPECT_LINES_MAX = 1000;
+const INSPECT_RESOURCE_TYPES = ["service", "database"];
+const FETCH_POLL_NOTE = "The response is a `fetches` array, newest first (up to 20). Each carries `status` (`pending` | `completed` | `failed`), `output` once completed, `error` when it failed, and `lines_requested`. A fetch still `pending` after 3 minutes settles as `failed` - the agent's reply was lost, so request a fresh one rather than polling on. An empty array means nothing has been requested for this resource yet.";
+function inspectPath(projectPid, resourceType, resourcePid, operation) {
+    const collection = resourceType === "service" ? "services" : "databases";
+    return `${PROJECTS_BASE}/${projectPid}/${collection}/${resourcePid}/${operation}`;
+}
+const inspectArgs = {
+    project_pid: z.string().min(1),
+    resource_type: z.enum(INSPECT_RESOURCE_TYPES)
+        .describe("`service` for a one-click template, `database` for a project Postgres/Redis/MySQL/MongoDB. Picks which collection the pid is looked up in."),
+    resource_pid: z.string().min(1).describe("The service or database pid, as returned by list_project_services / list_project_databases"),
+};
 export function registerProjectServiceTools(server) {
     server.tool("list_project_services", `List the one-click application templates deployed in a project. Returns pid, name, template_type, status (\`creating\` | \`active\` | \`inactive\` | \`failed\` | \`unknown\`), is_public, public_port, external_url, \`error_message\` when it failed, and a \`provisioning\` block with the per-stage progress.
 
@@ -86,9 +586,19 @@ A \`template_type\` you do not recognise means the backend shipped a template ne
     });
     server.tool("get_project_service", `Get one deployed service, INCLUDING ITS CREDENTIALS. This is the only endpoint that returns them - \`list_project_services\` deliberately does not.
 
-Credentials appear once the service reaches \`active\`; before that the block is simply absent and the right answer is "not ready yet", not an error. What you get depends on the template: Supabase returns the dashboard username and password plus \`public_url\` (and the anon key when present); n8n, n8n-with-postgresql and Twenty return \`public_url\` only, because their first admin is created through the app's own first-run screen rather than from env.
+The block can be absent or partial until the service reaches \`active\`; then the right answer is "not ready yet", not an error. What it holds depends on the template:
+- Login templates: the username and password plus \`public_url\`; Supabase adds the anon key.
+- First-visitor templates (n8n, n8n-with-postgresql, Twenty, WordPress, Immich, Strapi, Metabase, Chatwoot, Mautic, Open WebUI + Ollama): \`public_url\` only, because their first admin is created through the app's own first-run screen rather than from env.
+- code-server, JupyterLab and Jupyter Data Science: \`password\` and \`public_url\`, and no username.
+- Laravel: \`public_url\` only. A fresh app with no accounts, so there is nothing to claim and no warning to give.
+- OpenSSH server: \`host\`, \`port\`, \`username\`, \`password\` and a ready-made \`ssh_command\`; no URL.
+- WireGuard: the admin \`username\` and \`password\`, the HTTPS \`public_url\`, and \`wireguard_endpoint\` (the project IP, UDP 51820) for VPN clients.
+- Mysterium: \`public_url\` (its HTTP panel on port 4449), the fixed username \`myst\`, the password, and the \`panel_sources\` allowed to open it.
+- Mysterium VPN Gateway: \`proxy_endpoint\`, \`proxy_sources\`, \`country\` and \`service_type\`; no login.
+- Nginx: \`content_path\`, the directory to upload the site to over SSH.
+- URnetwork: a \`hint\` only; the node is managed at ur.io/app.
 
-HAND THE URL OVER WITH THE WARNING ATTACHED for n8n and Twenty: the account is claimed by whoever opens it first, so an unattended public URL is an open door until the user completes setup.
+HAND THE URL OVER WITH THE WARNING ATTACHED for the first-visitor templates: the account is claimed by whoever opens it first, so an unattended public URL is an open door until the user completes setup.
 
 Call this after \`create_project_service\` reports \`active\`, and give the user the credentials - creating a service and not passing on how to log into it leaves the job half done.`, {
         project_pid: z.string().min(1),
@@ -104,59 +614,192 @@ Call this after \`create_project_service\` reports \`active\`, and give the user
         }
         return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
     });
-    server.tool("create_project_service", `Deploy a one-click application template into a project. FOUR are available:
+    server.tool("create_project_service", `Deploy a one-click application template into a project. THIRTY-SIX are available:
+
+${TEMPLATE_CATALOGUE_TEXT}
+
+CREDENTIALS DIFFER PER TEMPLATE AND THE WRONG SHAPE IS REFUSED HERE rather than sent and silently dropped:
+- Templates taking a username + password: pass \`dashboard_username\` and \`dashboard_password\`. The accepted username FORM varies - a slug for Jenkins/Grafana/EspoCRM, an EMAIL for Krayin, a Linux login name for the OpenSSH server, anything for the rest. WireGuard and the OpenSSH server default the username (\`admin\`, \`dev\`), so it is optional for those two. The catalogue above says which.
+- Templates taking a password only: pass \`dashboard_password\` alone. The app owns the username (GitLab is \`root\`, Elasticsearch \`elastic\`, Mysterium \`myst\`) or has none (code-server, JupyterLab, Jupyter Data Science). Passing a username is refused.
+- Templates taking nothing: pass neither. "No login and nothing to claim" (Nginx, Laravel, the Mysterium VPN Gateway) is NOT the first-visitor case below.
+- URnetwork takes an \`auth_code\` from ur.io/app instead of a login. It is a secret: never repeat it back.
 
-- \`supabase\` - Postgres + Studio + auth/storage/realtime. The ONLY one that takes admin credentials up front: \`dashboard_username\` and \`dashboard_password\` (8+ chars) are REQUIRED and become the Studio login. Boots in about 5 minutes.
-- \`n8n\` - workflow automation, data in a bundled SQLite volume. Name only.
-- \`n8n-with-postgresql\` - the same n8n, backed by a per-service PostgreSQL sidecar instead of SQLite. Pick this for anything beyond light use; the difference is durability and concurrency, and it cannot be switched afterwards. Name only.
-- \`twenty\` - open-source CRM. Name only. Boots in up to 15 minutes (images + migrations) - do not declare it stuck early.
+TEMPLATE-SPECIFIC FIELDS, each refused on any other template:
+- Mysterium: \`panel_source\`, the IP or CIDR allowed to open its HTTP panel on 4449.
+- Mysterium VPN Gateway: \`proxy_source\`, the IP or CIDR of the apps that will use the proxy on 3128; \`country\` (two-letter code, optional); \`service_type\` (wireguard, the default, or scraping, data_transfer, quic).
+  For both, an omitted source makes the backend use the IP this MCP's requests come from, which is the machine running this server and not necessarily where the user or their apps are. Pass it explicitly; \`list_project_ssh_keys\` shows the \`requester_ip\` the backend sees. A world range (\`/0\`) is refused.
+- OpenSSH server: \`public_key\` (one OpenSSH public key line, optional) and \`password_access\` (default true; false only with a key, and the password still gates sudo). \`public_port\` is its SSH port, default 2222, and a second SSH server in the same project needs another one.
+- Mysterium, the Mysterium VPN Gateway and URnetwork share the server's network with other people or spend MYST outside the platform, so each needs \`acknowledge_network_terms: true\`. Explain what they are agreeing to and ask; never set it on the user's behalf.
 
-FIRST-ADMIN WARNING for n8n, n8n-with-postgresql and Twenty: these have no admin credentials at all. The first person to open the public URL gets the owner account. Tell the user to complete setup immediately, and do not post the URL anywhere until they have. Passing \`dashboard_username\`/\`dashboard_password\` to them does nothing - they are rejected here rather than sent and silently ignored.
+FIRST-ADMIN SECURITY WARNING, for every template marked "first visitor owns it": these ship with no admin credentials whatsoever. Whoever opens the public URL first gets the owner account. Say this UNPROMPTED, tell the user to finish setup the moment it is up, and tell them not to share the URL before then.
 
-\`is_public\` is REQUIRED with no default: ASK THE USER. These are web apps whose first-run setup happens at the public URL, so \`true\` is usually what they want, but do not assume it.
+\`is_public\` is REQUIRED with no default: ASK THE USER. Most templates are web apps whose first-run setup happens at the public URL, so \`true\` is usually what they want, but do not assume it. Four are refused with \`false\` because the backend would never open the port they are reached on: Mysterium, the Mysterium VPN Gateway, WireGuard and the OpenSSH server (the first two stay private through their source IP lock, not through \`is_public\`).
+
+CAPACITY: a project is ONE server, and these limits are refusals at declare time, not slow degradation. \`heavy\` templates must leave more headroom (65% memory / 75% disk vs 80% / 85%); some need a minimum TOTAL host RAM whatever is free; at most 5 children per project; Stalwart, WireGuard, Mysterium and the Mysterium VPN Gateway are one-per-project (their ports are fixed on the host). A project server CANNOT be resized, so exhausting it means creating a new project - check the recommended RAM against the project's server BEFORE promising a deploy.
 
 The project must be \`active\` (409 otherwise). Returns 202 with status \`creating\`; poll \`list_project_services\`, then call \`get_project_service\` for the credentials once it is \`active\`.
 
-EXPECT THESE 422s: a duplicate service name inside the same project; \`public_port\` already claimed by another database or service in the project; and the host being out of RAM (a capacity guard refuses new services rather than thrashing the box - the fix is a bigger project server, and there is no in-place resize for projects, so it means a new project).`, {
+EXPECT THESE 422s: a duplicate service name inside the same project; \`public_port\` already claimed by another database or service (a second OpenSSH server left on 2222 is the common one); the capacity guard refusing the template; a second Stalwart, WireGuard, Mysterium or Mysterium VPN Gateway; and Krayin on an ARM (\`cax*\`) host, whose image has no ARM manifest at any tag.`, {
         project_pid: z.string().min(1),
-        template_type: z.enum(TEMPLATE_TYPES).describe("supabase | n8n | n8n-with-postgresql | twenty"),
+        template_type: z.enum(TEMPLATE_TYPES).describe("One of the 36 template slugs - see the catalogue in the description"),
         name: z.string().min(1).max(255).describe("Unique within the project"),
         is_public: z.boolean().describe("Required choice (ask the user, do not assume): true = internet-reachable; false = private to the project. First-run setup for these apps happens at the public URL."),
-        dashboard_username: z.string().min(1).max(255).optional().describe("Supabase ONLY - the Studio dashboard username. Required for supabase, rejected for every other template."),
-        dashboard_password: z.string().min(8).max(255).optional().describe("Supabase ONLY - the Studio dashboard password, 8+ chars. Required for supabase, rejected for every other template."),
-        public_port: z.number().int().min(1024).max(65535).optional().describe("Optional. Must not collide with another database or service in this project."),
-    }, async ({ project_pid, template_type, name, is_public, dashboard_username, dashboard_password, public_port }) => {
+        dashboard_username: z.string().min(1).max(255).optional().describe("For templates that take a username + password only. The accepted form varies per template (slug / email / Linux login name / any) - see the catalogue. Optional for WireGuard (default admin) and the OpenSSH server (default dev). Refused for password-only and no-credential templates."),
+        dashboard_password: z.string().min(8).max(255).optional().describe("For templates that take any password. 8+ chars; 12+ for GitLab, Mysterium, WireGuard, code-server, the OpenSSH server, JupyterLab and Jupyter Data Science (see the catalogue). Refused for no-credential templates."),
+        public_port: z.number().int().min(1024).max(65535).optional().describe("Optional. Must not collide with another database or service in this project. For the OpenSSH server it is the SSH port (default 2222)."),
+        panel_source: z.string().min(1).max(64).optional().describe("Mysterium only: the IP or CIDR allowed to open its HTTP panel on 4449. Omitted, the backend uses the IP this MCP's requests come from."),
+        proxy_source: z.string().min(1).max(64).optional().describe("Mysterium VPN Gateway only: the IP or CIDR of the apps that will use the proxy on 3128. Omitted, the backend uses the IP this MCP's requests come from."),
+        country: z.string().length(2).optional().describe("Mysterium VPN Gateway only: a two-letter country code to exit from. Optional."),
+        service_type: z.enum(GATEWAY_SERVICE_TYPES).optional().describe("Mysterium VPN Gateway only: the Mysterium service to consume. Default wireguard."),
+        auth_code: z.string().min(1).max(512).optional().describe("URnetwork only, and required there: the auth code from ur.io/app (20+ characters, letters, digits and _-=+/. only). A secret: never repeat it back."),
+        public_key: z.string().min(1).max(16384).optional().describe("OpenSSH server only: one OpenSSH PUBLIC key line (ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521 or their sk- variants). Never a private key."),
+        password_access: z.boolean().optional().describe("OpenSSH server only: false turns password sign-in off, which needs a public_key. Default true. The password still gates sudo."),
+        acknowledge_network_terms: z.boolean().optional().describe("Mysterium, Mysterium VPN Gateway and URnetwork only, and required true there: the user has agreed to what the catalogue says the template does with the server's network or their money. Ask; never set it on their behalf."),
+    }, async ({ project_pid, template_type, name, is_public, dashboard_username, dashboard_password, public_port, panel_source, proxy_source, country, service_type, auth_code, public_key, password_access, acknowledge_network_terms }) => {
         if (!hasOrg())
             return { content: [{ type: "text", text: NO_ORG }] };
         const template = TEMPLATES[template_type];
-        // Fail loudly on a credential/template mismatch instead of sending fields the
-        // backend drops. Silently ignoring them is how "I set a Twenty admin password"
-        // becomes a false belief the user acts on.
-        if (template.dashboardCreds) {
-            if (!dashboard_username || !dashboard_password) {
-                return {
-                    content: [{
-                            type: "text",
-                            text: `\`${template_type}\` requires both dashboard_username and dashboard_password (8+ chars) - they become the Supabase Studio login. Ask the user for them.`,
-                        }],
-                };
+        const minPw = template.minPasswordLength ?? 8;
+        const refuse = (text) => ({ content: [{ type: "text", text }] });
+        // Trimmed like the console does, and blank means absent. " admin" would otherwise reach
+        // a validator that does not trim and fail a shape check the user cannot see.
+        const username = dashboard_username?.trim() || undefined;
+        // A field that belongs to one template is refused on every other one: the backend would
+        // drop it silently, and for `auth_code` that means a secret sent somewhere it is not used.
+        const ownFields = [
+            ["panel_source", panel_source, "mysterium"],
+            ["proxy_source", proxy_source, "mysterium-gateway"],
+            ["country", country, "mysterium-gateway"],
+            ["service_type", service_type, "mysterium-gateway"],
+            ["auth_code", auth_code, "urnetwork"],
+            ["public_key", public_key, "openssh-server"],
+            ["password_access", password_access, "openssh-server"],
+        ];
+        for (const [field, value, owner] of ownFields) {
+            if (value !== undefined && template_type !== owner) {
+                return refuse(`\`${field}\` belongs to \`${owner}\` only, so it was NOT sent for \`${template_type}\`. Re-run without it.`);
             }
         }
-        else if (dashboard_username || dashboard_password) {
-            return {
-                content: [{
-                        type: "text",
-                        text: `\`${template_type}\` has no admin credentials to set, so dashboard_username / dashboard_password do not apply and were not sent. Its first admin is ${template.firstAdmin}. Re-run without them.`,
-                    }],
-            };
+        if (template.requiresPublic && !is_public) {
+            return refuse(`${template.label} needs is_public: true, because ${template.requiresPublic}. With false the backend never opens that port and the service cannot be reached. Re-run with is_public true.`);
+        }
+        if (template.networkTerms && acknowledge_network_terms !== true) {
+            return refuse(`${template.label} needs acknowledge_network_terms: true, because ${template.networkTerms}. Explain that to the user and ask; re-run with the flag only once they agree.`);
+        }
+        // Validate the credential SHAPE before sending. The backend drops fields a template
+        // does not accept, so a silently-ignored password leaves the user believing they set
+        // one - which for a "first visitor owns it" template is a security problem, not a
+        // cosmetic one.
+        if (template.creds === "dashboardLogin") {
+            const rule = USERNAME_SHAPE_RULES[template.usernameShape ?? "any"];
+            const usernameOptional = template.defaultUsername !== undefined;
+            if (!dashboard_password || (!username && !usernameOptional)) {
+                return refuse(usernameOptional
+                    ? `\`${template_type}\` (${template.label}) requires dashboard_password (${minPw}+ chars). dashboard_username is optional and defaults to \`${template.defaultUsername}\`; if given it must be ${rule.hint}. Ask the user for the password.`
+                    : `\`${template_type}\` (${template.label}) requires BOTH dashboard_username and dashboard_password - they become its admin login. Username must be ${rule.hint}; password ${minPw}+ chars. Ask the user for them.`);
+            }
+            if (username !== undefined && !rule.test(username)) {
+                return refuse(`dashboard_username \`${username}\` is not valid for ${template.label}: it must be ${rule.hint}.${template.usernameShape === "email" ? " Krayin signs in by email address, so a non-email username creates an admin account nobody can log in as." : ""}`);
+            }
+            if (username !== undefined && template.usernameMaxLength && [...username].length > template.usernameMaxLength) {
+                return refuse(`dashboard_username is too long for ${template.label}: ${template.usernameMaxLength} characters at most.`);
+            }
+        }
+        else if (template.creds === "fixedRootPassword") {
+            if (!dashboard_password) {
+                return refuse(`\`${template_type}\` (${template.label}) requires dashboard_password (${minPw}+ chars).${template.fixedUsername ? ` The username is fixed by the app: \`${template.fixedUsername}\`.` : " The app does not use a username here."}${template.loginNote ? `\n\n${template.loginNote}` : ""}`);
+            }
+            if (username) {
+                return refuse(`\`${template_type}\` does not accept a username - ${template.fixedUsername ? `the app's account is always \`${template.fixedUsername}\`` : "it has no username"}, so dashboard_username was not sent. Re-run with the password alone.`);
+            }
+        }
+        else if (username || dashboard_password) {
+            return refuse(template.creds === "none"
+                ? `\`${template_type}\` (${template.label}) has no admin credentials to set, so dashboard_username / dashboard_password do not apply and were NOT sent. Its owner account goes to the first person who opens the public URL. Re-run without them.`
+                : `\`${template_type}\` (${template.label}) has no login to set, so dashboard_username / dashboard_password do not apply and were NOT sent.${template.creds === "authCode" ? " It takes an `auth_code` from ur.io/app instead." : ""} Re-run without them.`);
+        }
+        if (dashboard_password) {
+            if (dashboard_password.length < minPw) {
+                return refuse(`${template.label} requires a password of at least ${minPw} characters (got ${dashboard_password.length}).`);
+            }
+            if (dashboard_password.trim() === "") {
+                return refuse(`${template.label} needs a real password: one made only of spaces fails the backend's presence check.`);
+            }
+            if (template.maxPasswordBytes && Buffer.byteLength(dashboard_password, "utf8") > template.maxPasswordBytes) {
+                return refuse(`${template.label} takes a password of at most ${template.maxPasswordBytes} bytes (its image hashes it with bcrypt, which cannot take more). Use a shorter one.`);
+            }
+            if (template.passwordForbids === "nul" && dashboard_password.includes("\u0000")) {
+                return refuse(`${template.label} cannot take a password with a null character in it.`);
+            }
+            if (template.passwordForbids === "control" && /[\u0000-\u001f\u007f-\u009f]/.test(dashboard_password)) {
+                return refuse(`${template.label} cannot take a password with a tab, line break or other control character: the image feeds it to chpasswd as one line, so a line break would inject a second entry.`);
+            }
+        }
+        if (panel_source !== undefined) {
+            const error = sourceError(panel_source, "panel_source");
+            if (error)
+                return refuse(error);
+        }
+        if (proxy_source !== undefined) {
+            const error = sourceError(proxy_source, "proxy_source");
+            if (error)
+                return refuse(error);
+        }
+        if (country !== undefined && !/^[A-Za-z]{2}$/.test(country)) {
+            return refuse("country must be a two-letter ISO-3166 code, like DE or US.");
+        }
+        let authCode;
+        if (template.creds === "authCode") {
+            authCode = auth_code?.trim();
+            if (!authCode) {
+                return refuse("URnetwork requires auth_code: the token the user creates at ur.io/app. Ask them for it.");
+            }
+            if (!URNETWORK_AUTH_CODE.test(authCode)) {
+                return refuse("That auth_code is not a URnetwork auth code: it must be one token of 20 or more characters using letters, digits and _-=+/. only, copied exactly from ur.io/app. It was NOT sent.");
+            }
+        }
+        let publicKey;
+        if (public_key !== undefined) {
+            const key = public_key.trim();
+            if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(key)) {
+                return refuse("That is a PRIVATE key, and it was NOT sent anywhere. Send the PUBLIC half - the `.pub` one-liner (`ssh-ed25519 AAAA... user@host`). Treat the pasted private key as compromised and generate a new keypair.");
+            }
+            const parts = /^(\S+)\s+(\S+)(?:\s+(.*))?$/.exec(key);
+            if (/[\r\n]/.test(key) || !parts || !OPENSSH_KEY_ALGORITHMS.has(parts[1])
+                || !/^[A-Za-z0-9+/]+={0,3}$/.test(parts[2]) || parts[2].length < 40) {
+                return refuse(`public_key must be ONE OpenSSH public key line: an algorithm (${[...OPENSSH_KEY_ALGORITHMS].join(", ")}), the base64 key, and an optional comment - the contents of a \`.pub\` file.`);
+            }
+            // Single spaces between the parts, as the backend's PUBLIC_KEY_FORMAT expects.
+            publicKey = [parts[1], parts[2], parts[3]?.trim()].filter(Boolean).join(" ");
+        }
+        if (password_access === false && !publicKey) {
+            return refuse("password_access: false needs a public_key: without one nobody could sign in. Pass the user's public key, or leave password sign-in on.");
         }
         const body = { name, is_public, instant_deploy: true };
-        if (template.dashboardCreds) {
-            body.dashboard_username = dashboard_username;
+        if (template.creds === "dashboardLogin") {
+            body.dashboard_username = username ?? template.defaultUsername;
+            body.dashboard_password = dashboard_password;
+        }
+        else if (template.creds === "fixedRootPassword") {
             body.dashboard_password = dashboard_password;
         }
+        else if (template.creds === "authCode") {
+            body.auth_code = authCode;
+        }
         if (public_port !== undefined)
             body.public_port = public_port;
+        if (panel_source !== undefined)
+            body.panel_source = panel_source.trim();
+        if (proxy_source !== undefined)
+            body.proxy_source = proxy_source.trim();
+        if (country !== undefined)
+            body.country = country.toUpperCase();
+        if (service_type !== undefined)
+            body.service_type = service_type;
+        if (publicKey !== undefined)
+            body.public_key = publicKey;
+        if (password_access !== undefined)
+            body.password_access = password_access;
         const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${template_type}`, {
             method: "POST",
             body,
@@ -166,11 +809,14 @@ EXPECT THESE 422s: a duplicate service name inside the same project; \`public_po
             return { content: [{ type: "text", text: `Failed to create service (${result.statusCode}): ${result.message}` }] };
         }
         const lines = [
-            `${template.label} service \`${name}\` is provisioning (status: creating). Expect ${template.boot}.`,
-            `Poll \`list_project_services\`, then call \`get_project_service\` for ${template.credentials}.`,
+            `${template.label} service \`${name}\` is provisioning (status: creating). Expect around ${template.bootMinutes} minute${template.bootMinutes === 1 ? "" : "s"} - do not call it stuck before then.`,
+            "Poll `list_project_services`, then call `get_project_service` (with include_credentials) once it is `active`. Credentials live on that endpoint only.",
         ];
-        if (!template.dashboardCreds) {
-            lines.push(`SECURITY: the first admin is ${template.firstAdmin}. Tell the user to open the URL and finish setup as soon as it is up, and not to share it before then.`);
+        if (template.creds === "none") {
+            lines.push(`SECURITY - ACT ON THIS NOW: ${template.label} has no admin account. THE FIRST PERSON TO OPEN THE PUBLIC URL BECOMES THE OWNER. Tell the user to open it and finish setup as soon as it is up, and not to share the URL until they have.`);
+        }
+        if (template.loginNote) {
+            lines.push(template.loginNote);
         }
         return {
             content: [
@@ -200,5 +846,141 @@ EXPECT THESE 422s: a duplicate service name inside the same project; \`public_po
         }
         return { content: [{ type: "text", text: "Service deletion queued." }] };
     });
+    server.tool("request_project_container_logs", `Ask the project's host to capture container logs for one service or database, then read them with \`get_project_container_logs\`. THIS DOES NOT RETURN LOGS: it dispatches a fetch to the host agent and returns a \`pending\` record, because the round-trip is too slow to block a request on.
+
+Reach for this when a service or database is \`active\` but misbehaving. This is the container's own stdout/stderr, which is where a crash loop, a failed migration or a bad env var actually shows up - the platform's own status fields will only tell you it is unhealthy, not why.
+
+Read-only: the backend runs an allow-listed \`docker logs\` scoped to this resource's containers. There is no start/stop/restart/exec anywhere on this surface.`, {
+        ...inspectArgs,
+        lines: z.number().int().min(1).max(INSPECT_LINES_MAX).optional()
+            .describe(`Tail length (default ${INSPECT_LINES_DEFAULT}, max ${INSPECT_LINES_MAX}; clamped server-side)`),
+    }, async ({ project_pid, resource_type, resource_pid, lines }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const body = {};
+        if (lines !== undefined)
+            body.lines = lines;
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "logs"), {
+            method: "POST",
+            body,
+            toolName: "request_project_container_logs",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to request container logs (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Log fetch dispatched (`pending`). Call `get_project_container_logs` with the same ids to read it - give the agent a second or two first." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("get_project_container_logs", `Read container logs previously requested with \`request_project_container_logs\`. ${FETCH_POLL_NOTE}`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "logs"), {
+            toolName: "get_project_container_logs",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to read container logs (${result.statusCode}): ${result.message}` }] };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("request_project_container_stats", `Ask the project's host for a live resource snapshot of one service's or database's containers - \`docker stats\`: CPU, memory, network and block IO. Dispatches a fetch and returns a \`pending\` record; read it with \`get_project_container_stats\`.
+
+THIS IS THE TOOL FOR "why is my project server full?". A project is ONE VM shared by every service and database in it, it cannot be resized, and the capacity guard refuses new children once it fills up. Identifying which container is eating the memory is the only actionable answer - the alternative is telling the user to build a new project.`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "stats"), {
+            method: "POST",
+            toolName: "request_project_container_stats",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to request container stats (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Stats fetch dispatched (`pending`). Call `get_project_container_stats` with the same ids to read it." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("get_project_container_stats", `Read the resource snapshot previously requested with \`request_project_container_stats\`. ${FETCH_POLL_NOTE}`, inspectArgs, async ({ project_pid, resource_type, resource_pid }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(inspectPath(project_pid, resource_type, resource_pid, "stats"), {
+            toolName: "get_project_container_stats",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to read container stats (${result.statusCode}): ${result.message}` }] };
+        }
+        return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
+    });
+    server.tool("set_project_service_custom_domain", `Point a custom domain at a project service's web UI, replacing its platform-generated hostname. Every template exposes a web component except four with no web UI to route: Mysterium, the Mysterium VPN Gateway, URnetwork and the OpenSSH server. The backend refuses a domain for those, so do not offer one.
+
+DNS MUST ALREADY BE POINTING HERE BEFORE YOU CALL THIS. The backend resolves the domain and refuses if it does not already answer with the project's public IP - deliberately, because applying a domain before DNS lands burns Let's Encrypt rate limits on certificate requests that are guaranteed to fail. The correct order is:
+1. \`get_project\` for the project's \`public_ip\`.
+2. Have the user create a DNS **A record** for the domain pointing at that IP (a CNAME chain resolving to it also passes).
+3. Wait for propagation.
+4. Call this. A 422 naming the IP means step 2 or 3 is not done - relay it and retry later, do not loop.
+
+Pass a BARE HOSTNAME you own: no scheme, no path, and not a platform-generated suffix. The service must already be provisioned (\`uuid\` present) - a 422 says it is not ready yet.
+
+Templates whose containers bake their own public URL from the domain (Twenty's SERVER_URL, n8n's WEBHOOK_URL) re-derive it on the redeploy this triggers, so there is no env var for you to fix afterwards. Routing and TLS are verified after the call returns - re-read \`get_project_service\` to see the domain's status settle.`, {
+        project_pid: z.string().min(1),
+        service_pid: z.string().min(1),
+        domain: z.string().min(1).describe("Bare hostname, e.g. crm.example.com - no https://, no trailing path"),
+    }, async ({ project_pid, service_pid, domain }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${service_pid}/custom_domain`, {
+            method: "POST",
+            body: { domain },
+            toolName: "set_project_service_custom_domain",
+        });
+        if (!result.success) {
+            const dnsHint = result.statusCode === 422
+                ? " If the message names an IP, the domain is not resolving to the project server yet: create the A record, wait for propagation, then retry."
+                : "";
+            return { content: [{ type: "text", text: `Failed to set custom domain (${result.statusCode}): ${result.message}.${dnsHint}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: `\`${domain}\` applied. The platform is now verifying routing and issuing TLS, which is not instant - re-read \`get_project_service\` to watch the domain status settle rather than assuming it is live.` },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
+    server.tool("remove_project_service_custom_domain", `Remove a project service's custom domain and re-pin its platform-generated hostname. A 422 means no custom domain is set on that service.
+
+The service redeploys so its containers pick the platform URL back up, which means a brief interruption. Anything referencing the custom domain - bookmarks, webhooks registered with third parties, OAuth callback URLs - stops working, so say so before doing it.`, {
+        project_pid: z.string().min(1),
+        service_pid: z.string().min(1),
+        confirm: z.boolean().describe("Must be true. The service redeploys and anything pointing at the custom domain - webhooks, OAuth callbacks - breaks."),
+    }, async ({ project_pid, service_pid, confirm }) => {
+        if (!hasOrg())
+            return { content: [{ type: "text", text: NO_ORG }] };
+        if (!confirm) {
+            return {
+                content: [{
+                        type: "text",
+                        text: `About to remove the custom domain from service ${service_pid}. It goes back to its platform hostname and redeploys (brief interruption), and any webhook or OAuth callback registered against the custom domain will break.\n\nCall again with confirm=true.`,
+                    }],
+            };
+        }
+        const result = await apiRequest(`${PROJECTS_BASE}/${project_pid}/services/${service_pid}/custom_domain`, {
+            method: "DELETE",
+            toolName: "remove_project_service_custom_domain",
+        });
+        if (!result.success) {
+            return { content: [{ type: "text", text: `Failed to remove custom domain (${result.statusCode}): ${result.message}` }] };
+        }
+        return {
+            content: [
+                { type: "text", text: "Custom domain removed and the platform hostname restored. Re-read `get_project_service` for the current `public_url`." },
+                { type: "text", text: JSON.stringify(result.data, null, 2) },
+            ],
+        };
+    });
 }
 //# sourceMappingURL=project-services.js.map