@yawlabs/lemonsqueezy-mcp 0.10.0 → 0.10.1

package/dist/index.js

@@ -30200,6 +30200,189 @@ var StdioServerTransport = class {
   }
 };
 
+// src/guardrails.ts
+var GuardrailError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GuardrailError";
+  }
+};
+var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
+function isAuthorityClass(s) {
+  return AUTHORITY_CLASSES.includes(s);
+}
+var cachedOptions = null;
+var destructiveTimestamps = [];
+var classTimestamps = /* @__PURE__ */ new Map();
+function readNumber(name, raw) {
+  if (raw === void 0 || raw.trim() === "") return null;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) {
+    throw new Error(`${name} must be a non-negative number (got ${JSON.stringify(raw)})`);
+  }
+  return n;
+}
+function parseDisabledClasses(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",")) {
+    const cls = part.trim();
+    if (!cls) continue;
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_DISABLE_CLASSES contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    out.add(cls);
+  }
+  return out.size > 0 ? out : null;
+}
+function parseClassRateLimits(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Map();
+  for (const part of raw.split(",")) {
+    const segment = part.trim();
+    if (!segment) continue;
+    const colon = segment.indexOf(":");
+    if (colon < 0) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry missing colon: ${JSON.stringify(segment)} (expected class:N or class:N/h)`
+      );
+    }
+    const cls = segment.slice(0, colon).trim();
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    const specRaw = segment.slice(colon + 1).trim();
+    const slash = specRaw.indexOf("/");
+    const numPart = slash >= 0 ? specRaw.slice(0, slash).trim() : specRaw;
+    const unitPart = slash >= 0 ? specRaw.slice(slash + 1).trim().toLowerCase() : "m";
+    const n = Number(numPart);
+    if (!Number.isFinite(n) || n < 0 || numPart === "") {
+      throw new Error(`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid number: ${JSON.stringify(segment)}`);
+    }
+    let windowMs;
+    if (unitPart === "m") windowMs = 6e4;
+    else if (unitPart === "h") windowMs = 36e5;
+    else {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid unit (expected m or h): ${JSON.stringify(segment)}`
+      );
+    }
+    out.set(cls, { limit: n, windowMs });
+  }
+  return out.size > 0 ? out : null;
+}
+function loadOptions() {
+  if (cachedOptions) return cachedOptions;
+  const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
+  const allowedSet = allowed ? new Set(
+    allowed.split(",").map((s) => s.trim()).filter(Boolean)
+  ) : null;
+  cachedOptions = {
+    allowedStoreIds: allowedSet && allowedSet.size > 0 ? allowedSet : null,
+    maxRefundAmountCents: readNumber(
+      "LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS",
+      process.env.LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS
+    ),
+    rateLimitPerMinute: readNumber(
+      "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
+      process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
+    ),
+    disabledClasses: parseDisabledClasses(process.env.LEMONSQUEEZY_DISABLE_CLASSES),
+    classRateLimits: parseClassRateLimits(process.env.LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)
+  };
+  return cachedOptions;
+}
+function checkStoreAllowed(storeId) {
+  if (!storeId) return;
+  const o = loadOptions();
+  if (!o.allowedStoreIds) return;
+  if (!o.allowedStoreIds.has(String(storeId))) {
+    throw new GuardrailError(`Store ID ${storeId} is not in LEMONSQUEEZY_ALLOWED_STORE_IDS allowlist`);
+  }
+}
+function checkRefundAmount(cents) {
+  const o = loadOptions();
+  if (o.maxRefundAmountCents === null) return;
+  if (cents > o.maxRefundAmountCents) {
+    throw new GuardrailError(
+      `Refund amount ${cents} cents exceeds LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS (${o.maxRefundAmountCents})`
+    );
+  }
+}
+function checkDestructiveRateLimit(now = Date.now()) {
+  const o = loadOptions();
+  if (o.rateLimitPerMinute === null) return;
+  const cutoff = now - 6e4;
+  destructiveTimestamps = destructiveTimestamps.filter((t) => t > cutoff);
+  if (destructiveTimestamps.length >= o.rateLimitPerMinute) {
+    throw new GuardrailError(`Destructive call rate limit exceeded (${o.rateLimitPerMinute}/min). Wait and retry.`);
+  }
+  destructiveTimestamps.push(now);
+}
+function isStoreAllowlistActive() {
+  return loadOptions().allowedStoreIds !== null;
+}
+function loadGuardrailOptions() {
+  loadOptions();
+}
+function isPresent(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string" && value === "") return false;
+  if (Array.isArray(value) && value.length === 0) return false;
+  return true;
+}
+function checkStoreScopedToolInput(tool, input) {
+  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
+  if (toolAcceptsStoreId) {
+    const raw = input.storeId;
+    if (raw !== void 0 && raw !== null && raw !== "") {
+      checkStoreAllowed(String(raw));
+    } else if (isStoreAllowlistActive()) {
+      throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
+    }
+  }
+  if (tool.requiredFilters && tool.requiredFilters.length > 0 && isStoreAllowlistActive()) {
+    const anyPresent = tool.requiredFilters.some((key) => isPresent(input[key]));
+    if (!anyPresent) {
+      throw new GuardrailError(
+        `At least one of [${tool.requiredFilters.join(", ")}] is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set`
+      );
+    }
+  }
+}
+function isDestructiveCall(tool, input) {
+  if (typeof tool.isDestructive === "function") return tool.isDestructive(input);
+  return tool.annotations?.destructiveHint === true;
+}
+function checkClassAllowed(cls) {
+  const o = loadOptions();
+  if (!o.disabledClasses) return;
+  if (o.disabledClasses.has(cls)) {
+    throw new GuardrailError(`Tool authority class ${JSON.stringify(cls)} is disabled by LEMONSQUEEZY_DISABLE_CLASSES`);
+  }
+}
+function checkClassRateLimit(cls, now = Date.now()) {
+  const o = loadOptions();
+  if (!o.classRateLimits) return;
+  const spec = o.classRateLimits.get(cls);
+  if (!spec) return;
+  const cutoff = now - spec.windowMs;
+  const list = (classTimestamps.get(cls) ?? []).filter((t) => t > cutoff);
+  if (list.length >= spec.limit) {
+    const unit = spec.windowMs === 6e4 ? "min" : spec.windowMs === 36e5 ? "hour" : `${spec.windowMs}ms`;
+    classTimestamps.set(cls, list);
+    throw new GuardrailError(
+      `Class ${JSON.stringify(cls)} rate limit exceeded (${spec.limit}/${unit}). Wait and retry.`
+    );
+  }
+  list.push(now);
+  classTimestamps.set(cls, list);
+}
+
 // src/logger.ts
 function getLogLevel() {
   const v = process.env.LEMONSQUEEZY_LOG;
@@ -31461,186 +31644,6 @@ var orderItemTools = [
   }
 ];
 
-// src/guardrails.ts
-var GuardrailError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GuardrailError";
-  }
-};
-var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
-function isAuthorityClass(s) {
-  return AUTHORITY_CLASSES.includes(s);
-}
-var cachedOptions = null;
-var destructiveTimestamps = [];
-var classTimestamps = /* @__PURE__ */ new Map();
-function readNumber(name, raw) {
-  if (raw === void 0 || raw.trim() === "") return null;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n < 0) {
-    throw new Error(`${name} must be a non-negative number (got ${JSON.stringify(raw)})`);
-  }
-  return n;
-}
-function parseDisabledClasses(raw) {
-  if (!raw || raw.trim() === "") return null;
-  const out = /* @__PURE__ */ new Set();
-  for (const part of raw.split(",")) {
-    const cls = part.trim();
-    if (!cls) continue;
-    if (!isAuthorityClass(cls)) {
-      throw new Error(
-        `LEMONSQUEEZY_DISABLE_CLASSES contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
-      );
-    }
-    out.add(cls);
-  }
-  return out.size > 0 ? out : null;
-}
-function parseClassRateLimits(raw) {
-  if (!raw || raw.trim() === "") return null;
-  const out = /* @__PURE__ */ new Map();
-  for (const part of raw.split(",")) {
-    const segment = part.trim();
-    if (!segment) continue;
-    const colon = segment.indexOf(":");
-    if (colon < 0) {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry missing colon: ${JSON.stringify(segment)} (expected class:N or class:N/h)`
-      );
-    }
-    const cls = segment.slice(0, colon).trim();
-    if (!isAuthorityClass(cls)) {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
-      );
-    }
-    const specRaw = segment.slice(colon + 1).trim();
-    const slash = specRaw.indexOf("/");
-    const numPart = slash >= 0 ? specRaw.slice(0, slash).trim() : specRaw;
-    const unitPart = slash >= 0 ? specRaw.slice(slash + 1).trim().toLowerCase() : "m";
-    const n = Number(numPart);
-    if (!Number.isFinite(n) || n < 0 || numPart === "") {
-      throw new Error(`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid number: ${JSON.stringify(segment)}`);
-    }
-    let windowMs;
-    if (unitPart === "m") windowMs = 6e4;
-    else if (unitPart === "h") windowMs = 36e5;
-    else {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid unit (expected m or h): ${JSON.stringify(segment)}`
-      );
-    }
-    out.set(cls, { limit: n, windowMs });
-  }
-  return out.size > 0 ? out : null;
-}
-function loadOptions() {
-  if (cachedOptions) return cachedOptions;
-  const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
-  const allowedSet = allowed ? new Set(
-    allowed.split(",").map((s) => s.trim()).filter(Boolean)
-  ) : null;
-  cachedOptions = {
-    allowedStoreIds: allowedSet && allowedSet.size > 0 ? allowedSet : null,
-    maxRefundAmountCents: readNumber(
-      "LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS",
-      process.env.LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS
-    ),
-    rateLimitPerMinute: readNumber(
-      "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
-      process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
-    ),
-    disabledClasses: parseDisabledClasses(process.env.LEMONSQUEEZY_DISABLE_CLASSES),
-    classRateLimits: parseClassRateLimits(process.env.LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)
-  };
-  return cachedOptions;
-}
-function checkStoreAllowed(storeId) {
-  if (!storeId) return;
-  const o = loadOptions();
-  if (!o.allowedStoreIds) return;
-  if (!o.allowedStoreIds.has(String(storeId))) {
-    throw new GuardrailError(`Store ID ${storeId} is not in LEMONSQUEEZY_ALLOWED_STORE_IDS allowlist`);
-  }
-}
-function checkRefundAmount(cents) {
-  const o = loadOptions();
-  if (o.maxRefundAmountCents === null) return;
-  if (cents > o.maxRefundAmountCents) {
-    throw new GuardrailError(
-      `Refund amount ${cents} cents exceeds LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS (${o.maxRefundAmountCents})`
-    );
-  }
-}
-function checkDestructiveRateLimit(now = Date.now()) {
-  const o = loadOptions();
-  if (o.rateLimitPerMinute === null) return;
-  const cutoff = now - 6e4;
-  destructiveTimestamps = destructiveTimestamps.filter((t) => t > cutoff);
-  if (destructiveTimestamps.length >= o.rateLimitPerMinute) {
-    throw new GuardrailError(`Destructive call rate limit exceeded (${o.rateLimitPerMinute}/min). Wait and retry.`);
-  }
-  destructiveTimestamps.push(now);
-}
-function isStoreAllowlistActive() {
-  return loadOptions().allowedStoreIds !== null;
-}
-function isPresent(value) {
-  if (value === void 0 || value === null) return false;
-  if (typeof value === "string" && value === "") return false;
-  if (Array.isArray(value) && value.length === 0) return false;
-  return true;
-}
-function checkStoreScopedToolInput(tool, input) {
-  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
-  if (toolAcceptsStoreId) {
-    const raw = input.storeId;
-    if (raw !== void 0 && raw !== null && raw !== "") {
-      checkStoreAllowed(String(raw));
-    } else if (isStoreAllowlistActive()) {
-      throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
-    }
-  }
-  if (tool.requiredFilters && tool.requiredFilters.length > 0 && isStoreAllowlistActive()) {
-    const anyPresent = tool.requiredFilters.some((key) => isPresent(input[key]));
-    if (!anyPresent) {
-      throw new GuardrailError(
-        `At least one of [${tool.requiredFilters.join(", ")}] is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set`
-      );
-    }
-  }
-}
-function isDestructiveCall(tool, input) {
-  if (typeof tool.isDestructive === "function") return tool.isDestructive(input);
-  return tool.annotations?.destructiveHint === true;
-}
-function checkClassAllowed(cls) {
-  const o = loadOptions();
-  if (!o.disabledClasses) return;
-  if (o.disabledClasses.has(cls)) {
-    throw new GuardrailError(`Tool authority class ${JSON.stringify(cls)} is disabled by LEMONSQUEEZY_DISABLE_CLASSES`);
-  }
-}
-function checkClassRateLimit(cls, now = Date.now()) {
-  const o = loadOptions();
-  if (!o.classRateLimits) return;
-  const spec = o.classRateLimits.get(cls);
-  if (!spec) return;
-  const cutoff = now - spec.windowMs;
-  const list = (classTimestamps.get(cls) ?? []).filter((t) => t > cutoff);
-  if (list.length >= spec.limit) {
-    const unit = spec.windowMs === 6e4 ? "min" : spec.windowMs === 36e5 ? "hour" : `${spec.windowMs}ms`;
-    classTimestamps.set(cls, list);
-    throw new GuardrailError(
-      `Class ${JSON.stringify(cls)} rate limit exceeded (${spec.limit}/${unit}). Wait and retry.`
-    );
-  }
-  list.push(now);
-  classTimestamps.set(cls, list);
-}
-
 // src/tools/orders.ts
 var orderTools = [
   {
@@ -32776,12 +32779,13 @@ function readAuditLogResource(uri) {
 }
 
 // src/index.ts
-var version2 = true ? "0.10.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.10.1" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
   process.exit(0);
 }
+loadGuardrailOptions();
 var allTools = [
   ...userTools,
   ...storeTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",