@spacelr/mcp 0.0.2 → 0.0.5

package/dist/index.mjs

@@ -76,13 +76,13 @@ async function refreshToken(credentials) {
     clearTimeout(timer);
   }
 }
-async function resolveAuthToken() {
+async function resolveAuthToken(forceRefresh = false) {
   const envToken = process.env["SPACELR_AUTH_TOKEN"];
   if (envToken) return envToken;
   const credentials = readStoredCredentials();
   if (!credentials) return null;
   const isExpired = Date.now() >= credentials.expiresAt - 6e4;
-  if (!isExpired) return credentials.accessToken;
+  if (!forceRefresh && !isExpired) return credentials.accessToken;
   return refreshToken(credentials);
 }
 function warnIfInsecureUrl(url) {
@@ -119,6 +119,14 @@ function resolveApiUrl(credentials) {
   console.error(`Warning: No API URL configured, using default: ${defaultUrl}`);
   return defaultUrl;
 }
+function resolveApiBaseUrl() {
+  try {
+    const credentials = readStoredCredentials();
+    return resolveApiUrl(credentials);
+  } catch {
+    return null;
+  }
+}
 async function loadConfig() {
   const credentials = readStoredCredentials();
   const authToken = await resolveAuthToken();
@@ -175,9 +183,9 @@ var ApiClient = class {
   async delete(path2, opts) {
     return this.requestWithRetry("DELETE", path2, opts);
   }
-  async refreshAuthToken() {
+  async refreshAuthToken(force = false) {
     if (!this.refreshPromise) {
-      this.refreshPromise = resolveAuthToken().finally(() => {
+      this.refreshPromise = resolveAuthToken(force).finally(() => {
         this.refreshPromise = null;
       });
     }
@@ -189,7 +197,14 @@ var ApiClient = class {
     } catch (error) {
       if (error instanceof ApiError && error.status === 401) {
         const currentToken = this.headers["Authorization"];
-        const newToken = await this.refreshAuthToken();
+        let newToken = await this.refreshAuthToken();
+        const newBaseUrl = resolveApiBaseUrl();
+        if (newBaseUrl && newBaseUrl !== this.baseUrl) {
+          this.baseUrl = newBaseUrl;
+        }
+        if (newToken && `Bearer ${newToken}` === currentToken) {
+          newToken = await resolveAuthToken(true);
+        }
         if (newToken && `Bearer ${newToken}` !== currentToken) {
           this.headers["Authorization"] = `Bearer ${newToken}`;
           return this.request(method, path2, opts);
@@ -1948,6 +1963,598 @@ function registerStorageTools(server, api) {
   );
 }
 
+// libs/mcp-server/src/tools/functions.ts
+import { z as z7 } from "zod";
+function registerFunctionTools(server, api) {
+  server.registerTool(
+    "functions_list",
+    {
+      description: "List all functions for a project",
+      inputSchema: {
+        projectId: z7.string()
+      }
+    },
+    async ({ projectId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to list functions: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_get",
+    {
+      description: "Get details of a specific function",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to get function: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_create",
+    {
+      description: "Create a new serverless function in a project",
+      inputSchema: {
+        projectId: z7.string(),
+        name: z7.string().min(1).max(255),
+        description: z7.string().max(1e3).optional(),
+        entryPoint: z7.string().max(255).optional(),
+        cronExpression: z7.string().optional(),
+        cronTimezone: z7.string().optional(),
+        timeout: z7.number().int().min(1e3).max(12e4).optional(),
+        memoryLimitMb: z7.number().int().min(16).max(512).optional(),
+        enabled: z7.boolean().optional()
+      }
+    },
+    async ({ projectId, ...body }) => {
+      try {
+        const result = await api.post(
+          `/projects/${encodeURIComponent(projectId)}/functions`,
+          { body }
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to create function: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_update",
+    {
+      description: "Update an existing function",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string(),
+        name: z7.string().min(1).max(255).optional(),
+        description: z7.string().max(1e3).optional(),
+        entryPoint: z7.string().max(255).optional(),
+        cronExpression: z7.string().optional(),
+        cronTimezone: z7.string().optional(),
+        timeout: z7.number().int().min(1e3).max(12e4).optional(),
+        memoryLimitMb: z7.number().int().min(16).max(512).optional(),
+        enabled: z7.boolean().optional()
+      }
+    },
+    async ({ projectId, functionId, ...body }) => {
+      try {
+        const result = await api.patch(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}`,
+          { body }
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to update function: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_delete",
+    {
+      description: "Delete a function and its associated cron job",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.delete(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to delete function: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_get_code",
+    {
+      description: "Get the deployed source code of a function with syntax-highlighted file contents",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/code`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to get function code: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_deployments_list",
+    {
+      description: "List all deployments (versions) of a function",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/deployments`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to list deployments: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_trigger",
+    {
+      description: "Manually trigger a function execution",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.post(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/trigger`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to trigger function: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_executions_list",
+    {
+      description: "List recent executions of a function with status, duration, and logs",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string(),
+        limit: z7.number().int().min(1).max(100).optional(),
+        offset: z7.number().int().min(0).optional()
+      }
+    },
+    async ({ projectId, functionId, limit, offset }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/executions`,
+          { params: { limit, offset } }
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to list executions: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_enable_webhook",
+    {
+      description: "Enable webhook trigger for a function. Returns a one-time webhook secret.",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.post(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/webhook/enable`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to enable webhook: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_regenerate_webhook_secret",
+    {
+      description: "Regenerate the webhook secret for a function. Old secret stops working immediately.",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.post(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/webhook/regenerate-secret`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to regenerate webhook secret: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_disable_webhook",
+    {
+      description: "Disable webhook trigger for a function. The webhook secret is deleted.",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.post(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/webhook/disable`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to disable webhook: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_get_env_vars",
+    {
+      description: "Get environment variables for a function (decrypted). Use these to store API keys and secrets.",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/env`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to get env vars: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_set_env_vars",
+    {
+      description: "Set environment variables for a function. Merges with existing vars. Values are encrypted at rest.",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string(),
+        variables: z7.record(z7.string(), z7.string())
+      }
+    },
+    async ({ projectId, functionId, variables }) => {
+      try {
+        const existing = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/env`
+        );
+        const merged = { ...existing, ...variables };
+        await api.patch(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}`,
+          { body: { environmentVariables: merged } }
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify({ success: true, keys: Object.keys(merged) }, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to set env vars: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "functions_kv_list",
+    {
+      description: "List KV store keys for a function",
+      inputSchema: {
+        projectId: z7.string(),
+        functionId: z7.string()
+      }
+    },
+    async ({ projectId, functionId }) => {
+      try {
+        const result = await api.get(
+          `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionId)}/kv`
+        );
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to list KV keys: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
+// libs/mcp-server/src/tools/emailTemplates.ts
+import { z as z8 } from "zod";
+function registerEmailTemplateTools(server, api) {
+  server.registerTool(
+    "email_templates_list",
+    {
+      description: "List all email templates for a project (includes system defaults)",
+      inputSchema: {
+        projectId: z8.string()
+      }
+    },
+    async ({ projectId }) => {
+      try {
+        const result = await api.get(`/projects/${encodeURIComponent(projectId)}/email-templates`);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to list email templates: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "email_templates_get",
+    {
+      description: "Get a single email template by ID",
+      inputSchema: {
+        id: z8.string()
+      }
+    },
+    async ({ id }) => {
+      try {
+        const result = await api.get(`/email-templates/${encodeURIComponent(id)}`);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to get email template: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "email_templates_create",
+    {
+      description: 'Create a new project-specific email template. The type identifies the template purpose (e.g. "verify-email", "welcome", "invoice").',
+      inputSchema: {
+        projectId: z8.string(),
+        type: z8.string(),
+        name: z8.string(),
+        subject: z8.string(),
+        mjmlSource: z8.string(),
+        variables: z8.array(z8.string()).optional(),
+        isActive: z8.boolean().optional()
+      }
+    },
+    async ({ projectId, type, name, subject, mjmlSource, variables, isActive }) => {
+      try {
+        const body = { projectId, type, name, subject, mjmlSource };
+        if (variables !== void 0) body.variables = variables;
+        if (isActive !== void 0) body.isActive = isActive;
+        const result = await api.post(`/projects/${encodeURIComponent(projectId)}/email-templates`, { body });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to create email template: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "email_templates_update",
+    {
+      description: "Update an existing email template",
+      inputSchema: {
+        id: z8.string(),
+        name: z8.string().optional(),
+        subject: z8.string().optional(),
+        mjmlSource: z8.string().optional(),
+        variables: z8.array(z8.string()).optional(),
+        isActive: z8.boolean().optional()
+      }
+    },
+    async ({ id, name, subject, mjmlSource, variables, isActive }) => {
+      try {
+        const body = {};
+        if (name !== void 0) body.name = name;
+        if (subject !== void 0) body.subject = subject;
+        if (mjmlSource !== void 0) body.mjmlSource = mjmlSource;
+        if (variables !== void 0) body.variables = variables;
+        if (isActive !== void 0) body.isActive = isActive;
+        if (Object.keys(body).length === 0) {
+          return {
+            content: [{ type: "text", text: "At least one field must be provided" }],
+            isError: true
+          };
+        }
+        const result = await api.patch(`/email-templates/${encodeURIComponent(id)}`, { body });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to update email template: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "email_templates_delete",
+    {
+      description: "Delete an email template. System default templates cannot be deleted.",
+      inputSchema: {
+        id: z8.string()
+      }
+    },
+    async ({ id }) => {
+      try {
+        const result = await api.delete(`/email-templates/${encodeURIComponent(id)}`);
+        return {
+          content: [{ type: "text", text: result ? JSON.stringify(result, null, 2) : "Email template deleted" }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to delete email template: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  server.registerTool(
+    "email_templates_preview",
+    {
+      description: "Preview a compiled email template. Renders MJML to HTML and applies Handlebars variables.",
+      inputSchema: {
+        mjmlSource: z8.string(),
+        variables: z8.record(z8.string(), z8.unknown()).optional()
+      }
+    },
+    async ({ mjmlSource, variables }) => {
+      try {
+        const body = { mjmlSource };
+        if (variables !== void 0) body.variables = variables;
+        const result = await api.post("/email-templates/preview", { body });
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: `Failed to preview email template: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
 // libs/mcp-server/src/tools/index.ts
 function registerAllTools(server, api) {
   registerAuthTools(server, api);
@@ -1956,6 +2563,313 @@ function registerAllTools(server, api) {
   registerDatabaseTools(server, api);
   registerHostingTools(server, api);
   registerStorageTools(server, api);
+  registerFunctionTools(server, api);
+  registerEmailTemplateTools(server, api);
+}
+
+// libs/mcp-server/src/prompts/database.ts
+import { z as z9 } from "zod";
+function registerDatabasePrompts(server) {
+  server.registerPrompt(
+    "setup-collection",
+    {
+      title: "Setup Database Collection",
+      description: "Guide for creating a new database collection with proper security rules. Collections MUST have rules defined before data can be inserted.",
+      argsSchema: {
+        projectId: z9.string().describe("Project ID"),
+        collectionName: z9.string().describe("Name of the collection to create"),
+        access: z9.enum(["public-read", "authenticated", "admin-only"]).optional().describe("Access level (default: admin-only)")
+      }
+    },
+    async ({ projectId, collectionName, access }) => {
+      const accessLevel = access || "admin-only";
+      const rules = {
+        "public-read": {
+          ".create": "true",
+          ".read": "true",
+          ".update": "false",
+          ".delete": "auth.role === 'owner' || auth.role === 'admin'"
+        },
+        authenticated: {
+          ".create": "!!auth.uid",
+          ".read": "!!auth.uid",
+          ".update": "!!auth.uid",
+          ".delete": "auth.role === 'owner' || auth.role === 'admin'"
+        },
+        "admin-only": {
+          ".create": "auth.role === 'owner' || auth.role === 'admin'",
+          ".read": "auth.role === 'owner' || auth.role === 'admin'",
+          ".update": "auth.role === 'owner' || auth.role === 'admin'",
+          ".delete": "auth.role === 'owner' || auth.role === 'admin'"
+        }
+      };
+      const collectionRules = rules[accessLevel];
+      const rulesJson = JSON.stringify(collectionRules, null, 2);
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                `Set up a new database collection "${collectionName}" in project ${projectId}.`,
+                "",
+                "IMPORTANT WORKFLOW:",
+                "1. First, get the current rules with database_rules_get",
+                "2. Add the new collection rules to the existing rules object",
+                "3. Set the updated rules with database_rules_set \u2014 this automatically creates the collection",
+                '4. Do NOT try to insert documents before the rules are set \u2014 it will fail with "Rule denied"',
+                "",
+                `Suggested rules for "${collectionName}" (${accessLevel}):`,
+                rulesJson,
+                "",
+                "The $other catch-all rule should deny access to undefined collections:",
+                '  "$other": { ".read": "false", ".write": "false" }',
+                "",
+                "After rules are set, the collection is ready for use via:",
+                "- database_documents_insert",
+                "- database_documents_find",
+                '- Serverless functions using spacelr.db.collection("' + collectionName + '")'
+              ].join("\n")
+            }
+          }
+        ]
+      };
+    }
+  );
+  server.registerPrompt(
+    "database-workflow",
+    {
+      title: "Database Workflow Guide",
+      description: "Explains how the Spacelr database system works: rules-first approach, collection lifecycle, and security model.",
+      argsSchema: {
+        projectId: z9.string().describe("Project ID")
+      }
+    },
+    async ({ projectId }) => {
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                `Guide me through the Spacelr database system for project ${projectId}.`,
+                "",
+                "CORE CONCEPTS:",
+                "",
+                "1. RULES-FIRST: Collections are defined through security rules.",
+                "   - Use database_rules_get to see current rules",
+                "   - Use database_rules_set to add/modify collection rules",
+                "   - Setting rules automatically creates the collection definition",
+                "   - Without rules, all operations are denied by the $other catch-all",
+                "",
+                "2. SECURITY RULES SYNTAX:",
+                '   - ".create": Expression that must evaluate to true for inserts',
+                '   - ".read": Expression for reads/queries',
+                '   - ".update": Expression for document updates',
+                '   - ".delete": Expression for document deletion',
+                '   - ".validate": Per-field validation expressions',
+                '   - ".schema": Field type declarations',
+                "   Available context: auth.uid, auth.role, newData (for validation)",
+                "",
+                "3. WORKFLOW:",
+                "   a) Define rules for the collection",
+                "   b) Optionally create indexes (database_indexes_create)",
+                "   c) Insert/query documents",
+                "",
+                "4. DATA ISOLATION:",
+                "   - Each project has its own database (project_{projectId})",
+                "   - Collections are scoped to the project automatically",
+                "   - No cross-project data access is possible"
+              ].join("\n")
+            }
+          }
+        ]
+      };
+    }
+  );
+}
+
+// libs/mcp-server/src/prompts/functions.ts
+import { z as z10 } from "zod";
+function registerFunctionPrompts(server) {
+  server.registerPrompt(
+    "deploy-function",
+    {
+      title: "Deploy a Serverless Function",
+      description: "Step-by-step guide for creating, deploying, and testing a serverless function. Covers the full lifecycle from creation to execution.",
+      argsSchema: {
+        projectId: z10.string().describe("Project ID"),
+        name: z10.string().describe("Function name"),
+        useCase: z10.string().optional().describe('What the function should do (e.g. "fetch data from API and store in DB")')
+      }
+    },
+    async ({ projectId, name, useCase }) => {
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                `Deploy a serverless function "${name}" in project ${projectId}.`,
+                useCase ? `Use case: ${useCase}` : "",
+                "",
+                "DEPLOYMENT WORKFLOW:",
+                "",
+                "1. CREATE the function:",
+                "   Use functions_create with name, entryPoint (default: index.js),",
+                "   timeout (ms, default: 30000), memoryLimitMb (default: 128)",
+                "   Optional: cronExpression for scheduled execution",
+                "",
+                "2. WRITE the code:",
+                "   Create an index.js file. Available APIs inside the sandbox:",
+                "",
+                "   - console.log/warn/error/info() \u2014 captured to execution logs",
+                "   - await fetch(url, options) \u2014 HTTP client (10s timeout, 5MB limit)",
+                "     Response: { status, headers, body } where body is a STRING",
+                "     Use JSON.parse(response.body) for JSON APIs",
+                "   - env.get(key) \u2014 read environment variables (API keys, secrets \u2014 set via Console UI or CLI)",
+                "   - await kv.get/set/delete/list() \u2014 Redis KV store (256KB values, 1000 keys)",
+                "   - await spacelr.db.collection(name).find/insertOne/insertMany()",
+                "   - await spacelr.storage.list/getInfo/getDownloadUrl()",
+                "   - await spacelr.email.send/sendRaw() \u2014 send template or raw emails",
+                "   - await spacelr.notifications.send/sendMany() \u2014 push notifications",
+                "",
+                "   IMPORTANT: Top-level await is supported. No imports/require available.",
+                "",
+                "3. IF USING spacelr.db:",
+                "   Database rules MUST be set BEFORE the function writes to a collection.",
+                "   Use the setup-collection prompt or manually set rules via database_rules_set.",
+                '   Without rules, inserts will fail with "Rule denied".',
+                "",
+                "4. DEPLOY the code:",
+                "   Zip the file(s) and upload via the CLI:",
+                "   spacelr functions deploy ./my-function --name " + name,
+                "   Or use the admin API: POST /projects/{projectId}/functions/{id}/deploy",
+                "",
+                "5. TRIGGER:",
+                "   Functions support multiple trigger types:",
+                "",
+                "   a) Manual: Use functions_trigger to execute on demand.",
+                "   b) Cron: Set cronExpression when creating/updating the function.",
+                "   c) Webhook: Enable with functions_enable_webhook to get a secret,",
+                "      then POST to /api/v1/functions/{projectId}/{functionId}/invoke",
+                "      with the X-Webhook-Secret header. Use functions_regenerate_webhook_secret",
+                "      to rotate the secret (old secret stops working immediately).",
+                "   d) Event: Configure event triggers to run the function in response",
+                "      to platform events (e.g. database changes, storage uploads).",
+                "",
+                "   Check results with functions_executions_list.",
+                "",
+                "6. VERIFY:",
+                "   Check execution status, logs, and duration.",
+                "   Use functions_get_code to review the deployed source."
+              ].join("\n")
+            }
+          }
+        ]
+      };
+    }
+  );
+  server.registerPrompt(
+    "function-sandbox-reference",
+    {
+      title: "Function Sandbox API Reference",
+      description: "Complete reference for all APIs available inside a serverless function sandbox.",
+      argsSchema: {}
+    },
+    async () => {
+      return {
+        messages: [
+          {
+            role: "user",
+            content: {
+              type: "text",
+              text: [
+                "Show me the complete API reference for the Spacelr function sandbox.",
+                "",
+                "\u2550\u2550\u2550 CONSOLE \u2550\u2550\u2550",
+                "console.log(...args)    \u2014 log level",
+                "console.info(...args)   \u2014 info level",
+                "console.warn(...args)   \u2014 warn level",
+                "console.error(...args)  \u2014 error level",
+                "All logs are captured and stored in the execution record.",
+                "Log buffer is capped at 1MB.",
+                "",
+                "\u2550\u2550\u2550 FETCH \u2550\u2550\u2550",
+                "const response = await fetch(url, options?)",
+                "  options: { method, headers, body }",
+                "  returns: { status: number, headers: Record<string,string>, body: string }",
+                "  NOTE: body is always a string \u2014 use JSON.parse(response.body) for JSON",
+                "  Limits: 10s timeout, 5MB response, no private/internal URLs (SSRF blocked)",
+                "",
+                "\u2550\u2550\u2550 ENV (Environment Variables) \u2550\u2550\u2550",
+                "env.get(key) \u2192 string | undefined",
+                "Read-only access to function environment variables.",
+                "Use env vars to store API keys, secrets, and configuration \u2014 never hardcode them in function code.",
+                "Set via Console UI (Function Detail \u2192 Environment Variables) or CLI (spacelr functions env set).",
+                "Values are encrypted at rest and only decrypted when the function executes.",
+                "",
+                "\u2550\u2550\u2550 KV STORE \u2550\u2550\u2550",
+                "await kv.get(key) \u2192 string | null",
+                "await kv.set(key, value, ttlSeconds?) \u2192 void",
+                "await kv.delete(key) \u2192 boolean",
+                "await kv.list(prefix?) \u2192 string[]",
+                "Backed by Redis. Scoped per function.",
+                "Limits: 256KB per value, 1000 keys per function, 30-day default TTL.",
+                "",
+                "\u2550\u2550\u2550 DATABASE \u2550\u2550\u2550",
+                "const docs = await spacelr.db.collection(name).find(filter?, options?)",
+                "  options: { sort, limit, offset }",
+                "await spacelr.db.collection(name).insertOne(doc)",
+                "await spacelr.db.collection(name).insertMany(docs)",
+                "Scoped to the function's project. Requires database rules to be set first.",
+                "",
+                "\u2550\u2550\u2550 STORAGE \u2550\u2550\u2550",
+                "await spacelr.storage.list(options?) \u2192 FileInfo[]",
+                "await spacelr.storage.getInfo(fileId) \u2192 FileInfo",
+                "await spacelr.storage.getDownloadUrl(fileId) \u2192 string",
+                "Scoped to the function's project.",
+                "",
+                "\u2550\u2550\u2550 EMAIL \u2550\u2550\u2550",
+                "await spacelr.email.send({ to, template, variables })",
+                "  Sends a template-based email using project templates (MJML + Handlebars).",
+                "  template: template name (must exist in the project)",
+                "  variables: Record<string, string> of template variables",
+                "  Returns: { messageId }",
+                "await spacelr.email.sendRaw({ to, subject, html })",
+                "  Sends a raw HTML email directly. Max 500KB HTML.",
+                "  Returns: { messageId }",
+                "Rate limit: 100 emails/hour per project (configurable via FUNCTION_EMAIL_HOURLY_LIMIT).",
+                "",
+                "\u2550\u2550\u2550 NOTIFICATIONS \u2550\u2550\u2550",
+                "await spacelr.notifications.send({ userId, title, body, data? })",
+                "  Sends a push notification to a specific user in the project.",
+                "await spacelr.notifications.sendMany({ userIds, title, body, data? })",
+                "  Sends to multiple users. Deduplicates userIds automatically.",
+                "Rate limit: 500 notifications/hour per project (configurable via FUNCTION_NOTIFICATION_HOURLY_LIMIT). Scoped to the function's project.",
+                "",
+                "\u2550\u2550\u2550 RESOURCE LIMITS \u2550\u2550\u2550",
+                "Execution timeout: 30s default, 120s max",
+                "Memory: 128MB default, 512MB max",
+                "Code bundle: 10MB max (zip)",
+                "Concurrent executions: 10 per project",
+                "CPU time: limited by watchdog (equals timeout)"
+              ].join("\n")
+            }
+          }
+        ]
+      };
+    }
+  );
+}
+
+// libs/mcp-server/src/prompts/index.ts
+function registerAllPrompts(server) {
+  registerDatabasePrompts(server);
+  registerFunctionPrompts(server);
 }
 
 // libs/mcp-server/src/index.ts
@@ -1967,6 +2881,7 @@ async function main() {
     version: "0.1.0"
   });
   registerAllTools(server, api);
+  registerAllPrompts(server);
   const transport = new StdioServerTransport();
   await server.connect(transport);
   const shutdown = async () => {