@yawlabs/lemonsqueezy-mcp 0.10.13 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,88 @@
 
 All notable changes to `@yawlabs/lemonsqueezy-mcp` are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versioning follows [SEMVER.md](./SEMVER.md).
 
+## [0.11.0] -- 2026-08-07
+
+### Security
+
+- **`redactSecrets` no longer degrades to exponential traversal on a shared-reference payload.** The cycle guard tracks the ancestor path (entries removed on the way back up) so a merely *shared* object is redacted normally instead of being falsely reported as `[CIRCULAR]` -- but an ancestor set alone is O(paths), not O(nodes). A "diamond chain" holding two references to the same child at every level has 2^depth paths over depth+1 objects: measured at 3.2 seconds for 23 objects, doubling per level, which at the 32-level cap would block the stdio server for the better part of an hour from inside the audit path. A memo of completed subtrees restores linear behaviour. Reuse is gated on the cached entry having been computed with at least as much depth budget as the current position, so a subtree truncated near the cap is never replayed into a shallower slot where real (possibly secret-bearing) input belongs.
+
+### Added
+
+- **`validation_error` log/audit status.** Failure entries previously collapsed client mistakes into `exception`, the same bucket as upstream 5xx and genuine faults. The new `ToolInputError` is tagged `validation_error`, so a log scan at `LEMONSQUEEZY_LOG=error` can separate "an agent sent a malformed request" from "the server or upstream faulted". `guardrail_block` (operator policy refused it) is unchanged.
+- **`preflight` hook on the tool contract.** An input-dependent guardrail that runs ahead of the rate limiters. Both refund tools now declare the cap check there, so a rejected over-cap refund no longer consumes the caller's destructive and `money`-class budgets -- previously a client looping on an over-cap amount could exhaust a `money:2/h` allowance on calls that never left the process.
+- **Cross-store disclosure on `ls_list_stores`.** It has no `storeId` field and no parent ID to scope by, so `LEMONSQUEEZY_ALLOWED_STORE_IDS` does not gate it and it enumerates every store the API key can see. This was documented in the README but absent from the tool description an agent actually reads. `ls_list_affiliates` carried the note already.
+
+### Fixed
+
+- **Empty-PATCH guards on the remaining three update tools.** `ls_update_customer`, `ls_update_subscription`, and `ls_update_license_key` sent `attributes: {}` upstream when called with only an ID; `ls_update_webhook` had rejected this locally since 0.10.10. All four now reject before the round-trip and throw `ToolInputError`.
+- **`ls_update_subscription` and `ls_update_customer` descriptions now disclose their conditional-destructive behaviour.** A tool whose destructiveness depends on the input carries `destructiveHint: false`, because the MCP annotation is static and the verdict is per-call -- so an MCP client will not prompt, and the description is the only signal left. `ls_update_subscription` said nothing about pausing or plan switches; `ls_update_customer` mentioned auditing only to point at `ls_archive_customer`, never saying that setting `status: 'archived'` *here* is itself rate-limited and audited. A new invariant in `tools.test.ts` fails the build if any predicate-carrying tool omits the warning.
+- **`Retry-After: " "` no longer means "retry immediately".** `Number("")` is `0`, not `NaN`, so a whitespace-only header fell through the numeric branch and produced a 0 ms wait instead of the 1 s default.
+- **`include: ""` no longer emits a bare `?include=`.** The include schemas set `.max()` but no `.min()`, so an empty string is valid input and split to `[""]`.
+- **Sink response size limit measures UTF-8 bytes, not UTF-16 code units.** `String.length` undercounts every multi-byte character, so a non-ASCII body could exceed the 10 MB limit while reporting a char count under it -- and the message still said "bytes".
+- **A bare `{"error": "..."}` envelope is now read on the management API**, not just the License API, via the shared error handler.
+- **A throwing `isDestructive` predicate can no longer escape as an unhandled rejection.** It is evaluated outside the main try block so it stays in scope for the audit path on the error branch; it now has its own guard that fails closed (treats the call as destructive) and logs the fault.
+
+### Changed
+
+- **`apiRequest` and `licenseRequest` share one error path and one 2xx body reader.** Roughly 90 lines of near-identical parse/log/decorate logic collapsed to two helpers. `licenseRequest` still deliberately does not bust the API-key cache on 401, since it authenticates with the caller's license key rather than `LEMONSQUEEZY_API_KEY`.
+- **Both generate-invoice tools share one query builder** (`buildInvoiceQuery`) instead of duplicating an eight-field `URLSearchParams` block.
+- **Cross-store notes are generated from each module's `requiredFilters` array**, so the disclosure and the runtime gate cannot drift apart.
+- **`src/index.ts` is free of top-level await.** The version fallback used `await import("node:module")`, which the CJS single-binary build cannot emit; it survived only because both builds define `__VERSION__` and esbuild constant-folded the branch away. A static `createRequire` import removes the dependency on that folding -- verified by bundling to CJS with the define absent.
+
+### Added
+
+- **Opt-in [oam.js](https://oamjs.org) build tooling.** `npm run check:oam` type-checks via `oam check` (tsgo, TypeScript 7 native) -- 2878ms against 4406ms for `tsc --noEmit`, same clean result. `npm run build:binary:oam` builds the standalone binary via `oam compile` instead of the Node SEA path, writing to the same `bin/<platform>-<arch>/` location so the release staging script consumes either unchanged. Neither touches the published npm package.
+
+  **Node remains the default runtime.** oam runs the server unmodified (verified against 0.8.2: full handshake, all 64 tools, the audit-log resource, working `fetch`, guardrail errors identical to Node), but cold start measured 196ms for Node against 424ms for `oam run` -- and since an MCP client pays startup once per session, that is the cost that matters. oam is also not distributed on npm, so defaulting to it would break `npx` for anyone without it. `src/` stays runtime-agnostic (no `oam:` imports, tests on `node:test`) so the Node path remains a real fallback rather than a nominal one.
+
+- `oam/` added to `.gitignore` -- any `oam` invocation writes a bytecode cache there.
+
+### Documentation
+
+- `0` documented as a valid value for the refund cap and both rate limits (blocks everything; unset/empty means no limit).
+- `LEMONSQUEEZY_LOG` row now lists what each failure `status` means.
+- README's allowlist row no longer describes `ls_list_stores` as routing "by its own resource ID"; the two genuinely ungated list tools are called out separately from the ID-targeted ones.
+
+## [0.10.13] -- 2026-06-11
+
+### Added
+
+- **Cross-platform single-binary pipeline** (Scoop + Homebrew) via `scripts/build-binary.mjs` and `scripts/stage-release-asset.mjs`.
+
+### Fixed
+
+- **`npm test` runs every test file under POSIX sh**, not only nested ones -- an unquoted `**/*` glob skipped the top-level files.
+
+### Changed
+
+- Node engine requirement raised to `>=22`; dev-dependency vulnerabilities cleared.
+
+## [0.10.12] -- 2026-06-02
+
+### Fixed
+
+- **Release drift guard compares tag-object SHAs**, so resuming a partial release no longer false-aborts.
+- **`SKIP_LINT=1` escape hatch** for environments where the lint runner itself is broken.
+- **`release.sh` refuses to push if origin's tag drifted from local.**
+- README "Add to Yaw MCP" badge points at the https forwarder.
+
+### Added
+
+- End-to-end coverage for the refund-cap guard on both refund tools.
+
+## [0.10.11] -- 2026-05-28
+
+### Changed
+
+- **MCP Registry publish folded into `release.sh`**; `release.yml` and the remaining non-release workflows removed. `release.sh` is now the only release path.
+
+### Fixed
+
+- Confirmation prompt is tty-gated, so non-interactive runs no longer block.
+- `server.json` syncs unconditionally rather than only inside the version-bump branch.
+- Falls back to the `gh` auth token for MCP Registry authentication.
+
 ## [0.10.10] -- 2026-05-22
 
 ### Fixed
@@ -390,6 +472,10 @@ Hardening pass for unattended automation against live billing flows.
 Initial release. 59 tools covering all 17 LemonSqueezy API resources.
 
 [Unreleased]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.9...HEAD
+[0.11.0]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.13...v0.11.0
+[0.10.13]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.12...v0.10.13
+[0.10.12]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.11...v0.10.12
+[0.10.11]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.10...v0.10.11
 [0.10.10]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.9...v0.10.10
 [0.10.9]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.8...v0.10.9
 [0.10.8]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.7...v0.10.8

package/README.md

@@ -229,12 +229,12 @@ All configuration is via environment variables. Only `LEMONSQUEEZY_API_KEY` (or
 | `LEMONSQUEEZY_API_KEY` | LemonSqueezy API token. |
 | `LEMONSQUEEZY_API_KEY_COMMAND` | Command whose stdout produces the API key. Overrides `LEMONSQUEEZY_API_KEY`. Output is cached for 1 hour. Use this to pull short-lived credentials from a vault (`op read`, `gcloud secrets versions access`, etc.) without writing them to env vars. The cache is keyed by the command string, so changing it mid-process refreshes on the next request; it is also invalidated automatically on a 401/403 from the API, so a key rotated upstream takes effect on the next call without waiting for the TTL. |
 | `LEMONSQUEEZY_TEST_API_KEY` | Optional test-mode key. When set and non-empty, it takes precedence over `LEMONSQUEEZY_API_KEY` (but not over `LEMONSQUEEZY_API_KEY_COMMAND`). On first activation per process, the server prints a one-line JSON `test_mode` notice to stderr so you can confirm test mode is engaged. Use this to point the server at a sandbox/test store without unsetting your production key. |
-| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`, `ls_list_stores`) route by their own resource ID and are **not** gated by this allowlist. LemonSqueezy API keys are issued at the account level and authorize access to every store in that account, so this allowlist is the only in-process store boundary the server can enforce. Pair it with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` / `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` for defense in depth, and — if your account hosts multiple stores you don't want exposed to the same agent — keep those stores under a separate LemonSqueezy account whose API key isn't reachable from this server. |
-| `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` | Rejects `ls_refund_order` and `ls_refund_subscription_invoice` calls above this amount. |
-| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Positive integer. Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include every refund, cancellation, archive, and delete tool, plus the input-dependent destructive paths: `ls_update_license_key` calls that set `disabled: true` *or* change `activationLimit`, `ls_update_subscription` calls that pause or switch plan, and `ls_update_customer` calls with `status: "archived"`. |
+| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all are **not** gated by this allowlist, in two distinct shapes: (a) ID-targeted tools (`ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`) route by their own resource ID, so the caller must already know the ID; (b) `ls_list_stores` and `ls_list_affiliates` take no scoping ID at all and **return rows from every store the API key can see** — `ls_list_stores` will enumerate stores outside the allowlist. Both say so in their own tool descriptions. Other list-by-parent tools (`ls_list_prices`, `ls_list_files`, `ls_list_variants`, `ls_list_order_items`, `ls_list_discount_redemptions`, `ls_list_license_key_instances`, `ls_list_subscription_items`, `ls_list_usage_records`) require a parent-ID filter when the allowlist is set — a partial mitigation, since that parent can itself belong to a non-allowed store. LemonSqueezy API keys are issued at the account level and authorize access to every store in that account, so this allowlist is the only in-process store boundary the server can enforce. Pair it with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` / `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` for defense in depth, and — if your account hosts multiple stores you don't want exposed to the same agent — keep those stores under a separate LemonSqueezy account whose API key isn't reachable from this server. |
+| `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` | Non-negative integer. Rejects `ls_refund_order` and `ls_refund_subscription_invoice` calls above this amount. Unset or empty means no cap; **`0` is a valid value and blocks every refund** (the schemas require `amount >= 1`), so use it as a kill switch. The check runs *before* the rate limiters, so a rejected over-cap refund does not consume your destructive or `money`-class budget. |
+| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Non-negative integer. Max destructive tool calls per 60-second rolling window. Unset or empty means no limit; **`0` blocks every destructive call.** In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include every refund, cancellation, archive, and delete tool, plus the input-dependent destructive paths: `ls_update_license_key` calls that set `disabled: true` *or* change `activationLimit`, `ls_update_subscription` calls that pause or switch plan, and `ls_update_customer` calls with `status: "archived"`. |
 | `LEMONSQUEEZY_DISABLE_CLASSES` | Comma-separated list of [authority classes](#authority-classes) to refuse outright. Any tool whose class is listed returns a `guardrail_block` before the API call is attempted. Example: `LEMONSQUEEZY_DISABLE_CLASSES=money,recurring,pii` lets an agent run reads but blocks refunds, subscription changes, and customer-record access. Unknown class names throw at server startup. |
-| `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` | Per-class rolling rate limits, comma-separated. Each entry is `class:N`, `class:N/m`, or `class:N/h` (bare numbers default to per-minute). Example: `money:2/h,recurring:5/h,key:10/m`. Composes with `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` — both must pass. In-process per server instance. |
-| `LEMONSQUEEZY_LOG` | Structured-log verbosity to stderr. Set to `all` (or legacy `json`) to log every tool and HTTP call, `audit` to log only destructive-call audit entries plus errors (recommended for production), `error` to log only failures. Unset: no logs. Destructive calls are tagged `audit: true` and include their inputs. |
+| `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` | Per-class rolling rate limits, comma-separated. Each entry is `class:N`, `class:N/m`, or `class:N/h` (bare numbers default to per-minute). Example: `money:2/h,recurring:5/h,key:10/m`. Composes with `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` — both must pass. A limit of `0` blocks every call in that class; classes you don't list are unlimited. Malformed entries throw at server startup. In-process per server instance. |
+| `LEMONSQUEEZY_LOG` | Structured-log verbosity to stderr. Set to `all` (or legacy `json`) to log every tool and HTTP call, `audit` to log only destructive-call audit entries plus errors (recommended for production), `error` to log only failures. Unset: no logs. Destructive calls are tagged `audit: true` and include their inputs. Failure entries carry a `status` that identifies the cause: `guardrail_block` (operator policy refused the call), `validation_error` (the client sent a malformed request, e.g. an update with no fields to change), `exception` (something faulted), plus `timeout` / `network_error` and raw HTTP status codes. |
 | `LEMONSQUEEZY_SINK_URL` | Base URL of an optional [@yawlabs/lemonsqueezy-webhook-sink](https://github.com/YawLabs/lemonsqueezy-webhook-sink) instance (e.g. `https://webhooks.example.com`). Trailing slashes are stripped. Enables the `ls_sink_*` reconciliation tools below. Unset: the tools are still registered but return a "not configured" error when called. |
 | `LEMONSQUEEZY_SINK_ADMIN_TOKEN` | Bearer token for the sink's admin endpoints. Must match the sink's `WEBHOOK_SINK_ADMIN_TOKEN`. Required when `LEMONSQUEEZY_SINK_URL` is set; if the sink itself was started without an admin token, its admin endpoints return 404 and `ls_sink_*` calls surface that diagnostically. |
 
@@ -316,6 +316,33 @@ npm run gen:containerfile    # regenerate Containerfile
 npm run check:containerfile  # CI runs this; non-zero exit means the two have drifted
 ```
 
+## Running on oam.js (optional)
+
+[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.8.2: full MCP handshake, all 64 tools, the `lemonsqueezy://audit-log` resource, working `fetch`, and guardrail rejections with error text identical to Node.
+
+```jsonc
+{
+  "mcpServers": {
+    "lemonsqueezy": {
+      "command": "oam",
+      "args": ["run", "/path/to/lemonsqueezy-mcp/dist/index.js"],
+      "env": { "LEMONSQUEEZY_API_KEY": "..." }
+    }
+  }
+}
+```
+
+Note the `--` separator if you pass arguments to the server rather than to oam: `oam run dist/index.js -- version`.
+
+**Node stays the default, deliberately.** An MCP client cold-starts this server once per session, so startup is the cost that actually gets paid — and on the machine this was measured on, Node won: **196ms median against 424ms for `oam run`** (8 runs each, `version` subcommand, which exercises full boot plus tool registration). Making oam the default would mean either a launcher that probes for it on every start — a cost paid by everyone, including the majority who do not have oam installed — or making oam a hard requirement, which would break `npx @yawlabs/lemonsqueezy-mcp` for every user without it, since oam is not distributed on npm. Neither is worth it to reach a runtime that is slower here. Measure on your own hardware before concluding anything; if oam wins on yours, the config above is all you need.
+
+Two places oam *does* win for this repo, both opt-in and neither touching the npm package:
+
+- **`npm run check:oam`** — type-checks via `oam check` (tsgo, TypeScript 7 native). Measured 2878ms against 4406ms for `tsc --noEmit`, same clean result. `npx tsc --noEmit` remains the portable default and is what the pre-commit checklist calls for.
+- **`npm run build:binary:oam`** — builds the standalone binary via `oam compile` instead of the Node SEA path. Measured 57.14 MB. Writes to the same `bin/<platform>-<arch>/` path as `npm run build:binary`, so the release staging script consumes either unchanged — run one or the other, not both. If you redistribute that binary it embeds oam's runtime, so ship oam's `LICENSE`, `NOTICE` and `THIRD_PARTY_LICENSES.md` with it.
+
+The source stays runtime-agnostic on purpose: no `oam:` imports anywhere, and tests stay on `node:test`. That is what keeps the Node fallback real rather than nominal — an `oam:test` or `oam:`-prefixed import would make "falls back to Node" false the moment it landed. Any `oam` invocation writes a bytecode cache to `oam/` in the working directory; that path is gitignored.
+
 ## Releasing
 
 Two paths from a clean checkout of `main`. Both produce the same artifact (npm publish with provenance + GitHub release).

package/dist/index.js

@@ -6889,6 +6889,9 @@ var require_dist = __commonJS({
   }
 });
 
+// src/index.ts
+import "node:module";
+
 // node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -21108,6 +21111,12 @@ var GuardrailError = class extends Error {
     this.name = "GuardrailError";
   }
 };
+var ToolInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolInputError";
+  }
+};
 var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
 function isAuthorityClass(s) {
   return AUTHORITY_CLASSES.includes(s);
@@ -21292,7 +21301,14 @@ function getLogLevel() {
   if (v === "error") return "error";
   return "off";
 }
-var ERROR_STATUS_TAGS = /* @__PURE__ */ new Set(["error", "exception", "guardrail_block", "timeout", "network_error"]);
+var ERROR_STATUS_TAGS = /* @__PURE__ */ new Set([
+  "error",
+  "exception",
+  "guardrail_block",
+  "validation_error",
+  "timeout",
+  "network_error"
+]);
 function isErrorEntry(entry) {
   if (entry.error !== void 0) return true;
   if (typeof entry.status === "string") return ERROR_STATUS_TAGS.has(entry.status);
@@ -21374,6 +21390,7 @@ var JITTER_FRACTION = 0.25;
 function parseRetryAfterMs(header) {
   if (!header) return DEFAULT_RETRY_WAIT_MS;
   const trimmed = header.trim();
+  if (trimmed === "") return DEFAULT_RETRY_WAIT_MS;
   const seconds = Number(trimmed);
   if (!Number.isNaN(seconds)) {
     return seconds >= 0 ? seconds * 1e3 : DEFAULT_RETRY_WAIT_MS;
@@ -21586,7 +21603,10 @@ function buildQuery(params) {
   if (!params) return "";
   const parts = [];
   if (params.include?.length) {
-    parts.push(`include=${encodeURIComponent(params.include.map((s) => s.trim()).join(","))}`);
+    const segments = params.include.map((s) => s.trim()).filter(Boolean);
+    if (segments.length > 0) {
+      parts.push(`include=${encodeURIComponent(segments.join(","))}`);
+    }
   }
   if (params.filter) {
     for (const [key, value] of Object.entries(params.filter)) {
@@ -21606,6 +21626,49 @@ function buildQuery(params) {
 function decorateError(error2, requestId) {
   return requestId ? `${error2} (request_id: ${requestId})` : error2;
 }
+async function handleErrorResponse(res, route, latency_ms, requestId) {
+  const errorBody = await res.text();
+  try {
+    const parsed = JSON.parse(errorBody);
+    const detail = parsed.errors?.[0]?.detail ?? parsed.error ?? errorBody;
+    logEvent({
+      event: "http_call",
+      method: route.method,
+      path: route.path,
+      status: res.status,
+      latency_ms,
+      request_id: requestId,
+      error: detail
+    });
+    return {
+      ok: false,
+      status: res.status,
+      data: parsed,
+      error: decorateError(detail, requestId),
+      requestId
+    };
+  } catch {
+    logEvent({
+      event: "http_call",
+      method: route.method,
+      path: route.path,
+      status: res.status,
+      latency_ms,
+      request_id: requestId,
+      error: errorBody
+    });
+    return {
+      ok: false,
+      status: res.status,
+      error: decorateError(errorBody, requestId),
+      requestId
+    };
+  }
+}
+async function readJsonBody(res) {
+  const bodyText = await res.text();
+  return bodyText.trim() ? JSON.parse(bodyText) : void 0;
+}
 function formatTimeoutMessage(err, fallbackElapsedMs) {
   const plural = (n) => `${n} attempt${n === 1 ? "" : "s"}`;
   if (isRetryTimeoutError(err)) {
@@ -21649,43 +21712,7 @@ async function apiRequest(method, path, body) {
     if (res.status === 401 || res.status === 403) {
       invalidateApiKeyCache();
     }
-    const errorBody = await res.text();
-    try {
-      const parsed = JSON.parse(errorBody);
-      const detail = parsed.errors?.[0]?.detail ?? errorBody;
-      logEvent({
-        event: "http_call",
-        method,
-        path,
-        status: res.status,
-        latency_ms,
-        request_id: requestId,
-        error: detail
-      });
-      return {
-        ok: false,
-        status: res.status,
-        data: parsed,
-        error: decorateError(detail, requestId),
-        requestId
-      };
-    } catch {
-      logEvent({
-        event: "http_call",
-        method,
-        path,
-        status: res.status,
-        latency_ms,
-        request_id: requestId,
-        error: errorBody
-      });
-      return {
-        ok: false,
-        status: res.status,
-        error: decorateError(errorBody, requestId),
-        requestId
-      };
-    }
+    return handleErrorResponse(res, { method, path }, latency_ms, requestId);
   }
   logEvent({
     event: "http_call",
@@ -21698,9 +21725,7 @@ async function apiRequest(method, path, body) {
   if (res.status === 204) {
     return { ok: true, status: res.status, requestId };
   }
-  const bodyText = await res.text();
-  const data = bodyText.trim() ? JSON.parse(bodyText) : void 0;
-  return { ok: true, status: res.status, data, requestId };
+  return { ok: true, status: res.status, data: await readJsonBody(res), requestId };
 }
 async function licenseRequest(path, body) {
   const url = `${BASE_URL}${path}`;
@@ -21740,44 +21765,7 @@ async function licenseRequest(path, body) {
   const latency_ms = Date.now() - start;
   const requestId = res.headers.get("x-request-id") ?? void 0;
   if (!res.ok) {
-    const errorBody = await res.text();
-    try {
-      const parsed = JSON.parse(errorBody);
-      const p = parsed;
-      const detail = p.errors?.[0]?.detail ?? p.error ?? errorBody;
-      logEvent({
-        event: "http_call",
-        method: "POST",
-        path,
-        status: res.status,
-        latency_ms,
-        request_id: requestId,
-        error: detail
-      });
-      return {
-        ok: false,
-        status: res.status,
-        data: parsed,
-        error: decorateError(detail, requestId),
-        requestId
-      };
-    } catch {
-      logEvent({
-        event: "http_call",
-        method: "POST",
-        path,
-        status: res.status,
-        latency_ms,
-        request_id: requestId,
-        error: errorBody
-      });
-      return {
-        ok: false,
-        status: res.status,
-        error: decorateError(errorBody, requestId),
-        requestId
-      };
-    }
+    return handleErrorResponse(res, { method: "POST", path }, latency_ms, requestId);
   }
   logEvent({
     event: "http_call",
@@ -21787,9 +21775,7 @@ async function licenseRequest(path, body) {
     latency_ms,
     request_id: requestId
   });
-  const bodyText = await res.text();
-  const data = bodyText.trim() ? JSON.parse(bodyText) : void 0;
-  return { ok: true, status: res.status, data, requestId };
+  return { ok: true, status: res.status, data: await readJsonBody(res), requestId };
 }
 function getHandler(endpoint, idField) {
   return async (input) => {
@@ -21813,6 +21799,32 @@ function listHandler(endpoint, filterMap = {}) {
   };
   return Object.assign(handler, { filterMap });
 }
+var INVOICE_FIELD_MAP = {
+  name: "name",
+  address: "address",
+  city: "city",
+  state: "state",
+  zipCode: "zip_code",
+  country: "country",
+  notes: "notes",
+  locale: "locale"
+};
+function buildInvoiceQuery(input) {
+  const params = new URLSearchParams();
+  for (const [inputKey, apiKey] of Object.entries(INVOICE_FIELD_MAP)) {
+    const value = input[inputKey];
+    if (value !== void 0) params.set(apiKey, value);
+  }
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+var CROSS_STORE_TRAILER = "Pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.";
+function crossStoreFilterNote(filters) {
+  return `Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: ${filters.join(", ")}. Even with that set, ${CROSS_STORE_TRAILER}`;
+}
+function crossStoreUngatedNote(returns) {
+  return `Cross-store note: LEMONSQUEEZY_ALLOWED_STORE_IDS does NOT gate this tool -- it has no storeId field and no parent ID filter to scope by, so it returns ${returns}. ${CROSS_STORE_TRAILER}`;
+}
 async function apiGet(path) {
   return apiRequest("GET", path);
 }
@@ -21848,7 +21860,9 @@ var affiliateTools = [
   {
     name: "ls_list_affiliates",
     authorityClass: "read",
-    description: "List all affiliates for the authenticated user's stores, optionally filtered by user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool can still return affiliates tied to non-allowed stores -- the endpoint has no parent ID filter to scope by. Pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all affiliates for the authenticated user's stores, optionally filtered by user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreUngatedNote(
+      "affiliates tied to every store the API key can see, including non-allowed ones"
+    )}`,
     annotations: {
       title: "List affiliates",
       readOnlyHint: true,
@@ -22044,7 +22058,7 @@ var customerTools = [
   {
     name: "ls_update_customer",
     authorityClass: "pii",
-    description: "Update an existing customer's name, email, city, region, country, or status. The only supported status value is 'archived' \u2014 use ls_archive_customer for the dedicated, audit-tagged path.",
+    description: "Update an existing customer's name, email, city, region, country, or status. The only supported status value is 'archived'; setting it here is the same operation as ls_archive_customer and is treated as destructive (rate-limited and audited). Other field edits are not.",
     annotations: {
       title: "Update customer",
       readOnlyHint: false,
@@ -22078,6 +22092,11 @@ var customerTools = [
       if (input.region !== void 0) attributes.region = input.region;
       if (input.country !== void 0) attributes.country = input.country;
       if (input.status !== void 0) attributes.status = input.status;
+      if (Object.keys(attributes).length === 0) {
+        throw new ToolInputError(
+          "ls_update_customer requires at least one of: name, email, city, region, country, status"
+        );
+      }
       return apiPatch(`/customers/${encodePath(input.customerId)}`, {
         data: {
           type: "customers",
@@ -22114,6 +22133,7 @@ var customerTools = [
 ];
 
 // src/tools/discount-redemptions.ts
+var LIST_DISCOUNT_REDEMPTIONS_FILTERS = ["discountId", "orderId"];
 var discountRedemptionTools = [
   {
     name: "ls_get_discount_redemption",
@@ -22135,7 +22155,7 @@ var discountRedemptionTools = [
   {
     name: "ls_list_discount_redemptions",
     authorityClass: "read",
-    description: "List all discount redemptions, optionally filtered by discount or order. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: discountId, orderId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all discount redemptions, optionally filtered by discount or order. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_DISCOUNT_REDEMPTIONS_FILTERS)}`,
     annotations: {
       title: "List discount redemptions",
       readOnlyHint: true,
@@ -22150,7 +22170,7 @@ var discountRedemptionTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["discountId", "orderId"],
+    requiredFilters: LIST_DISCOUNT_REDEMPTIONS_FILTERS,
     handler: listHandler("/discount-redemptions", { discountId: "discount_id", orderId: "order_id" })
   }
 ];
@@ -22273,6 +22293,7 @@ var discountTools = [
 ];
 
 // src/tools/files.ts
+var LIST_FILES_FILTERS = ["variantId"];
 var fileTools = [
   {
     name: "ls_get_file",
@@ -22294,7 +22315,7 @@ var fileTools = [
   {
     name: "ls_list_files",
     authorityClass: "read",
-    description: "List all files, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all files, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_FILES_FILTERS)}`,
     annotations: {
       title: "List files",
       readOnlyHint: true,
@@ -22308,12 +22329,13 @@ var fileTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["variantId"],
+    requiredFilters: LIST_FILES_FILTERS,
     handler: listHandler("/files", { variantId: "variant_id" })
   }
 ];
 
 // src/tools/license-key-instances.ts
+var LIST_LICENSE_KEY_INSTANCES_FILTERS = ["licenseKeyId"];
 var licenseKeyInstanceTools = [
   {
     name: "ls_get_license_key_instance",
@@ -22335,7 +22357,7 @@ var licenseKeyInstanceTools = [
   {
     name: "ls_list_license_key_instances",
     authorityClass: "read",
-    description: "List all license key instances (activations), optionally filtered by license key. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: licenseKeyId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all license key instances (activations), optionally filtered by license key. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_LICENSE_KEY_INSTANCES_FILTERS)}`,
     annotations: {
       title: "List license key instances",
       readOnlyHint: true,
@@ -22349,7 +22371,7 @@ var licenseKeyInstanceTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["licenseKeyId"],
+    requiredFilters: LIST_LICENSE_KEY_INSTANCES_FILTERS,
     handler: listHandler("/license-key-instances", { licenseKeyId: "license_key_id" })
   }
 ];
@@ -22434,6 +22456,11 @@ var licenseKeyTools = [
       if (input.activationLimit !== void 0) attributes.activation_limit = input.activationLimit;
       if (input.disabled !== void 0) attributes.disabled = input.disabled;
       if (input.expiresAt !== void 0) attributes.expires_at = input.expiresAt;
+      if (Object.keys(attributes).length === 0) {
+        throw new ToolInputError(
+          "ls_update_license_key requires at least one of: activationLimit, disabled, expiresAt"
+        );
+      }
       return apiPatch(`/license-keys/${encodePath(input.licenseKeyId)}`, {
         data: {
           type: "license-keys",
@@ -22515,6 +22542,7 @@ var licenseTools = [
 ];
 
 // src/tools/order-items.ts
+var LIST_ORDER_ITEMS_FILTERS = ["orderId", "productId", "variantId"];
 var orderItemTools = [
   {
     name: "ls_get_order_item",
@@ -22536,7 +22564,7 @@ var orderItemTools = [
   {
     name: "ls_list_order_items",
     authorityClass: "read",
-    description: "List all order items, optionally filtered by order or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: orderId, productId, variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all order items, optionally filtered by order or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_ORDER_ITEMS_FILTERS)}`,
     annotations: {
       title: "List order items",
       readOnlyHint: true,
@@ -22552,7 +22580,7 @@ var orderItemTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["orderId", "productId", "variantId"],
+    requiredFilters: LIST_ORDER_ITEMS_FILTERS,
     handler: listHandler("/order-items", { orderId: "order_id", productId: "product_id", variantId: "variant_id" })
   }
 ];
@@ -22623,17 +22651,7 @@ var orderTools = [
       locale: external_exports.string().max(1e4).optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
     }),
     handler: async (input) => {
-      const params = new URLSearchParams();
-      if (input.name !== void 0) params.set("name", input.name);
-      if (input.address !== void 0) params.set("address", input.address);
-      if (input.city !== void 0) params.set("city", input.city);
-      if (input.state !== void 0) params.set("state", input.state);
-      if (input.zipCode !== void 0) params.set("zip_code", input.zipCode);
-      if (input.country !== void 0) params.set("country", input.country);
-      if (input.notes !== void 0) params.set("notes", input.notes);
-      if (input.locale !== void 0) params.set("locale", input.locale);
-      const qs = params.toString();
-      return apiPost(`/orders/${encodePath(input.orderId)}/generate-invoice${qs ? `?${qs}` : ""}`);
+      return apiPost(`/orders/${encodePath(input.orderId)}/generate-invoice${buildInvoiceQuery(input)}`);
     }
   },
   {
@@ -22651,6 +22669,12 @@ var orderTools = [
       orderId: lsIdSchema.describe("The order ID to refund"),
       amount: external_exports.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
+    // Run the cap check ahead of the rate limiters (see `preflight` on
+    // RegisterableTool) so a rejected over-cap refund does not consume the
+    // caller's money-class and destructive budgets. The handler repeats the
+    // check for direct callers that bypass the wrapper; checkRefundAmount is
+    // pure, so running it twice is free.
+    preflight: (input) => checkRefundAmount(input.amount),
     handler: async (input) => {
       checkRefundAmount(input.amount);
       return apiPost(`/orders/${encodePath(input.orderId)}/refund`, {
@@ -22661,6 +22685,7 @@ var orderTools = [
 ];
 
 // src/tools/prices.ts
+var LIST_PRICES_FILTERS = ["variantId"];
 var priceTools = [
   {
     name: "ls_get_price",
@@ -22682,7 +22707,7 @@ var priceTools = [
   {
     name: "ls_list_prices",
     authorityClass: "read",
-    description: "List all prices, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all prices, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_PRICES_FILTERS)}`,
     annotations: {
       title: "List prices",
       readOnlyHint: true,
@@ -22696,7 +22721,7 @@ var priceTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["variantId"],
+    requiredFilters: LIST_PRICES_FILTERS,
     handler: listHandler("/prices", { variantId: "variant_id" })
   }
 ];
@@ -22852,10 +22877,11 @@ async function sinkRequest(config2, method, pathAndQuery) {
   }
   const text = readResult.text;
   if (!text.trim()) return { ok: true, data: {} };
-  if (text.length > MAX_BODY_SIZE_BYTES) {
+  const byteLength = Buffer.byteLength(text, "utf8");
+  if (byteLength > MAX_BODY_SIZE_BYTES) {
     return {
       ok: false,
-      error: `Sink response body too large: ${text.length} bytes exceeds ${MAX_BODY_SIZE_BYTES} byte limit`
+      error: `Sink response body too large: ${byteLength} bytes exceeds ${MAX_BODY_SIZE_BYTES} byte limit`
     };
   }
   try {
@@ -22959,7 +22985,9 @@ var storeTools = [
   {
     name: "ls_list_stores",
     authorityClass: "read",
-    description: "List all stores for the authenticated user. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: `List all stores for the authenticated user. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreUngatedNote(
+      "every store the API key can see, including stores outside the allowlist"
+    )}`,
     annotations: {
       title: "List stores",
       readOnlyHint: true,
@@ -23047,18 +23075,8 @@ var subscriptionInvoiceTools = [
       locale: external_exports.string().max(1e4).optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
     }),
     handler: async (input) => {
-      const params = new URLSearchParams();
-      if (input.name !== void 0) params.set("name", input.name);
-      if (input.address !== void 0) params.set("address", input.address);
-      if (input.city !== void 0) params.set("city", input.city);
-      if (input.state !== void 0) params.set("state", input.state);
-      if (input.zipCode !== void 0) params.set("zip_code", input.zipCode);
-      if (input.country !== void 0) params.set("country", input.country);
-      if (input.notes !== void 0) params.set("notes", input.notes);
-      if (input.locale !== void 0) params.set("locale", input.locale);
-      const qs = params.toString();
       return apiPost(
-        `/subscription-invoices/${encodePath(input.subscriptionInvoiceId)}/generate-invoice${qs ? `?${qs}` : ""}`
+        `/subscription-invoices/${encodePath(input.subscriptionInvoiceId)}/generate-invoice${buildInvoiceQuery(input)}`
       );
     }
   },
@@ -23077,6 +23095,9 @@ var subscriptionInvoiceTools = [
       subscriptionInvoiceId: lsIdSchema.describe("The subscription invoice ID to refund"),
       amount: external_exports.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
+    // See the matching comment on ls_refund_order: the cap check runs ahead of
+    // the rate limiters so a rejection costs the caller no budget.
+    preflight: (input) => checkRefundAmount(input.amount),
     handler: async (input) => {
       checkRefundAmount(input.amount);
       return apiPost(`/subscription-invoices/${encodePath(input.subscriptionInvoiceId)}/refund`, {
@@ -23091,6 +23112,7 @@ var subscriptionInvoiceTools = [
 ];
 
 // src/tools/subscription-items.ts
+var LIST_SUBSCRIPTION_ITEMS_FILTERS = ["subscriptionId", "priceId"];
 var subscriptionItemTools = [
   {
     name: "ls_get_subscription_item",
@@ -23112,7 +23134,7 @@ var subscriptionItemTools = [
   {
     name: "ls_list_subscription_items",
     authorityClass: "read",
-    description: "List all subscription items, optionally filtered by subscription or price. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionId, priceId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all subscription items, optionally filtered by subscription or price. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_SUBSCRIPTION_ITEMS_FILTERS)}`,
     annotations: {
       title: "List subscription items",
       readOnlyHint: true,
@@ -23127,7 +23149,7 @@ var subscriptionItemTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["subscriptionId", "priceId"],
+    requiredFilters: LIST_SUBSCRIPTION_ITEMS_FILTERS,
     handler: listHandler("/subscription-items", { subscriptionId: "subscription_id", priceId: "price_id" })
   },
   {
@@ -23234,7 +23256,7 @@ var subscriptionTools = [
   {
     name: "ls_update_subscription",
     authorityClass: "recurring",
-    description: "Update a subscription. Can change the variant (plan switch), pause/unpause, set billing anchor, or update invoice details. Use ls_cancel_subscription for cancellation.",
+    description: "Update a subscription. Can change the variant (plan switch), pause/unpause, set billing anchor, or update invoice details. Pausing (`pause: 'void'` or `'free'`) or switching plan (`variantId`) is customer-impacting and is treated as destructive (rate-limited and audited); resuming and the billing-neutral edits are not. Use ls_cancel_subscription for cancellation.",
     annotations: {
       title: "Update subscription",
       readOnlyHint: false,
@@ -23274,6 +23296,11 @@ var subscriptionTools = [
       if (input.invoiceImmediately !== void 0) attributes.invoice_immediately = input.invoiceImmediately;
       if (input.disableProrations !== void 0) attributes.disable_prorations = input.disableProrations;
       if (input.trialEndsAt !== void 0) attributes.trial_ends_at = input.trialEndsAt;
+      if (Object.keys(attributes).length === 0) {
+        throw new ToolInputError(
+          "ls_update_subscription requires at least one of: variantId, pause, cancelled, billingAnchor, invoiceImmediately, disableProrations, trialEndsAt"
+        );
+      }
       return apiPatch(`/subscriptions/${encodePath(input.subscriptionId)}`, {
         data: {
           type: "subscriptions",
@@ -23304,6 +23331,7 @@ var subscriptionTools = [
 ];
 
 // src/tools/usage-records.ts
+var LIST_USAGE_RECORDS_FILTERS = ["subscriptionItemId"];
 var usageRecordTools = [
   {
     name: "ls_get_usage_record",
@@ -23325,7 +23353,7 @@ var usageRecordTools = [
   {
     name: "ls_list_usage_records",
     authorityClass: "read",
-    description: "List all usage records, optionally filtered by subscription item. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionItemId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all usage records, optionally filtered by subscription item. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_USAGE_RECORDS_FILTERS)}`,
     annotations: {
       title: "List usage records",
       readOnlyHint: true,
@@ -23339,7 +23367,7 @@ var usageRecordTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["subscriptionItemId"],
+    requiredFilters: LIST_USAGE_RECORDS_FILTERS,
     handler: listHandler("/usage-records", { subscriptionItemId: "subscription_item_id" })
   },
   {
@@ -23402,6 +23430,7 @@ var userTools = [
 ];
 
 // src/tools/variants.ts
+var LIST_VARIANTS_FILTERS = ["productId"];
 var variantTools = [
   {
     name: "ls_get_variant",
@@ -23423,7 +23452,7 @@ var variantTools = [
   {
     name: "ls_list_variants",
     authorityClass: "read",
-    description: "List all variants, optionally filtered by product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: productId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
+    description: `List all variants, optionally filtered by product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. ${crossStoreFilterNote(LIST_VARIANTS_FILTERS)}`,
     annotations: {
       title: "List variants",
       readOnlyHint: true,
@@ -23437,7 +23466,7 @@ var variantTools = [
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
-    requiredFilters: ["productId"],
+    requiredFilters: LIST_VARIANTS_FILTERS,
     handler: listHandler("/variants", { productId: "product_id" })
   }
 ];
@@ -23544,7 +23573,7 @@ var webhookTools = [
       if (input.events !== void 0) attributes.events = input.events;
       if (input.secret !== void 0) attributes.secret = input.secret;
       if (Object.keys(attributes).length === 0) {
-        throw new Error("ls_update_webhook requires at least one of: url, events, secret");
+        throw new ToolInputError("ls_update_webhook requires at least one of: url, events, secret");
       }
       return apiPatch(`/webhooks/${encodePath(input.webhookId)}`, {
         data: {
@@ -23615,30 +23644,32 @@ function looksLikeBearerToken(value) {
   if (value.length < 20) return false;
   return JWT_VALUE_RE.test(value);
 }
-function redactInner(value, visited, depth) {
+function redactInner(value, ancestors, memo, depth) {
   if (depth > MAX_DEPTH) return CIRCULAR;
   if (typeof value === "string" && looksLikeBearerToken(value)) return REDACTED;
   if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    if (visited.has(value)) return CIRCULAR;
-    visited.add(value);
-    return value.map((item) => redactInner(item, visited, depth + 1));
-  }
-  if (!isPlainObject3(value)) return value;
-  if (visited.has(value)) return CIRCULAR;
-  visited.add(value);
-  const out = {};
-  for (const [key, val] of Object.entries(value)) {
-    if (SECRET_KEY_RE.test(key)) {
-      out[key] = REDACTED;
-    } else {
-      out[key] = redactInner(val, visited, depth + 1);
+  const isArray = Array.isArray(value);
+  if (!isArray && !isPlainObject3(value)) return value;
+  if (ancestors.has(value)) return CIRCULAR;
+  const cached3 = memo.get(value);
+  if (cached3 !== void 0 && cached3.depth <= depth) return cached3.result;
+  ancestors.add(value);
+  let result;
+  if (isArray) {
+    result = value.map((item) => redactInner(item, ancestors, memo, depth + 1));
+  } else {
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+      out[key] = SECRET_KEY_RE.test(key) ? REDACTED : redactInner(val, ancestors, memo, depth + 1);
     }
+    result = out;
   }
-  return out;
+  ancestors.delete(value);
+  memo.set(value, { depth, result });
+  return result;
 }
 function redactSecrets(input) {
-  return redactInner(input, /* @__PURE__ */ new WeakSet(), 0);
+  return redactInner(input, /* @__PURE__ */ new WeakSet(), /* @__PURE__ */ new WeakMap(), 0);
 }
 
 // src/wrapper.ts
@@ -23660,10 +23691,23 @@ function createToolHandler(tool) {
     }
     const inputAsRecord = input;
     const toolAsRecord = tool;
-    const isDestructive = isDestructiveCall(toolAsRecord, inputAsRecord);
+    let isDestructive;
+    try {
+      isDestructive = isDestructiveCall(toolAsRecord, inputAsRecord);
+    } catch (predicateErr) {
+      isDestructive = true;
+      logEvent({
+        event: "tool_call",
+        tool: tool.name,
+        status: "exception",
+        latency_ms: 0,
+        error: `isDestructive predicate for tool "${tool.name}" threw: ${predicateErr instanceof Error ? predicateErr.message : String(predicateErr)}. Treating the call as destructive.`
+      });
+    }
     const start = Date.now();
     try {
       checkClassAllowed(tool.authorityClass);
+      tool.preflight?.(input);
       checkClassRateLimit(tool.authorityClass);
       if (isDestructive) checkDestructiveRateLimit();
       checkStoreScopedToolInput(toolAsRecord, inputAsRecord);
@@ -23709,7 +23753,10 @@ function createToolHandler(tool) {
         const errorEntry = {
           event: "tool_call",
           tool: tool.name,
-          status: err instanceof GuardrailError ? "guardrail_block" : "exception",
+          // Three distinct buckets, because they mean three different things
+          // to whoever is reading the log: operator policy refused the call,
+          // the client sent a bad request, or something actually broke.
+          status: err instanceof GuardrailError ? "guardrail_block" : err instanceof ToolInputError ? "validation_error" : "exception",
           latency_ms,
           error: message,
           audit: isDestructive ? true : void 0,
@@ -23742,7 +23789,7 @@ function readAuditLogResource(uri) {
 }
 
 // src/index.ts
-var version2 = true ? "0.10.13" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.11.0" : createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.10.13",
+  "version": "0.11.0",
   "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",
@@ -36,6 +36,8 @@
     "test:integration": "npm run build && node --test dist/integration/*.test.js",
     "lint": "biome check src/",
     "lint:fix": "biome check --write src/",
+    "check:oam": "oam check",
+    "build:binary:oam": "node scripts/build-binary.mjs --oam",
     "gen:containerfile": "node scripts/sync-containerfile.mjs",
     "check:containerfile": "node scripts/sync-containerfile.mjs --check",
     "prepublishOnly": "npm run build"