@yawlabs/lemonsqueezy-mcp 0.13.3 → 0.13.5

package/CHANGELOG.md

@@ -1,6 +1,58 @@
 # Changelog
 
-## [Unreleased]
+## [0.13.5] — 2026-09-13
+
+### Fixed
+
+- **The launcher always uses the newest oam, and the minimum is now the latest release, 0.15.2.** It used to take the FIRST oam binary it found and only then check its version, so a stale copy in an earlier location hid a current one: with oam 0.9.0 in `~/.oam/bin` and 0.15.2 on `PATH`, it ran 0.9.0. Every oam binary it can see is now asked for its version, and the newest at or above 0.15.2 wins; a tie keeps search order, so the installed copy wins over `PATH`.
+- **An oam host older than the floor no longer serves the server itself.** When a client ran `oam run bin/lemonsqueezy-mcp.mjs` with an old oam, the launcher spawned whatever discovery found, or, when that failed, served in-process on the old oam -- and below 0.9.0 oam passes `LEMONSQUEEZY_API_KEY_COMMAND`'s arguments through a shell. The spawn also inherited stdio, which an old oam does not honor, so the MCP handshake never answered (measured on a real oam 0.8.2 host, in aws-mcp's launcher). An old host now hands off with piped stdio to the newest usable oam, or to Node on `PATH`, or exits with an error when there is neither.
+- **A missing `OAM_BIN` is now reported, and a bad one no longer stops discovery.** A path that does not exist used to fall back to Node without a word; it is now named on stderr, as an oam below the floor and a binary that will not run already were. In all three cases discovery now carries on instead of dropping straight to Node.
+- **`LEMONSQUEEZY_MCP_RUNTIME=node` now always means Node.** Launched under `oam run`, it hands off to Node on `PATH` rather than staying on oam.
+- **A failed oam spawn under `auto` now says so** on stderr before falling back, instead of falling back silently.
+- Each `oam --version` probe is bounded at 5s, so a wedged binary on `PATH` cannot hang the launch.
+
+`LEMONSQUEEZY_MCP_SANDBOX=1` keeps its rules: it still spawns a fresh oam, now the newest one, even on a supported oam host, and still serves without `--permission` under `auto` when no usable oam can be started (in-process on Node or on an oam host at the floor, handed off to Node from one below it). The sandbox flags are verified to be accepted by oam 0.15.2 with a real MCP handshake.
+
+### Changed
+
+- Docs only: the README documents `LEMONSQUEEZY_MCP_RUNTIME` and `OAM_BIN`, and no longer says Node is the packaged default -- the published command has preferred oam since 0.12.0 -- or quotes the 196ms / 424ms cold-start figures `CLAUDE.md` already withdrew.
+
+## [0.13.4] — 2026-09-12
+
+### Added
+
+- **Price records now carry the price actually charged.** Lemon Squeezy returns a `unit_price` on every price record, and on a `volume` or `graduated` scheme it is vestigial -- the charged rate lives in `tiers[]`. In one store, three per-seat products all reported `unit_price: 2000` while billing $25, $100 and $200 per seat, and an agent reading the obvious field quoted all three as $20. `ls_get_price` and `ls_list_prices` now annotate every record with:
+  - `effective_unit_price` -- cents charged per unit: the first tier's rate on tiered schemes, `unit_price / package_size` on `package`, and `unit_price` on `standard`. `unit_price_decimal` wins wherever it is set, so sub-cent and metered rates are not rounded. It is `null` when the record carries no usable price; a tiered record with no tiers is never backfilled from `unit_price`, since that is how the wrong number got quoted in the first place.
+  - `effective_unit_price_note` -- where the number came from, including when the rate varies with quantity and any non-zero tier `fixed_fee` or enabled `setup_fee`, which are named but kept out of the per-unit figure.
+  - `unit_price_is_not_charged: true` on tiered records, and `unit_price_is_per_package: true` on `package` pricing whose block is larger than one unit.
+
+  Additive only: every raw field and the payload shape are untouched, and error bodies pass through unannotated.
+- **The same annotation reaches price records embedded via `include=price`** on `ls_get_subscription_item` and `ls_list_subscription_items` -- the seat-based-billing path, where a raw `unit_price` is the most likely to be read as a per-seat rate. The subscription item itself is not annotated.
+
+### Changed
+
+- **Variant tools warn that `price` is not the charged amount.** A variant payload has nothing to derive a charged price from, so `ls_get_variant` and `ls_list_variants` now say so in their descriptions and point at `ls_list_prices`. `ls_list_prices` also documents that a variant can carry several price records, the current one being the newest by `created_at`.
+
+### Fixed
+
+- **The launcher no longer starts a second oam when it is already running on one.** A host that resolves this package's `bin` and launches `oam run bin/lemonsqueezy-mcp.mjs` -- Yaw MCP does, and so does oam's sidecar regression matrix -- got a nested runtime: the launcher discovered and spawned an oam without asking what it was already running on, so one server cost two runtime boots, measured on Windows as `oam.exe` with a nested `oam.exe` + `conhost.exe` underneath it. When `process.versions.oam` clears the same 0.9.0 floor a discovered binary has to, the server is now imported into the running process: no discovery, no `oam --version` probe, no second oam. `OAM_BIN` is not consulted on that path, since the host has already chosen which oam runs.
+
+  Two cases still take the discovery path: `LEMONSQUEEZY_MCP_SANDBOX=1`, because `--permission` is a process-level flag only a freshly started oam can apply, and a host oam below the floor. That is a preference for a fresh oam, not a guarantee of one. If discovery then fails -- no binary found, one below the floor or unreadable, or a spawn that errors -- the existing fallback still serves the server in-process **without** `--permission` under the default `LEMONSQUEEZY_MCP_RUNTIME=auto`, as it did before this change. `LEMONSQUEEZY_MCP_RUNTIME=oam` is what turns that into a hard failure.
+- **`npm run check:oam` type-checks again.** It failed before checking anything with `TS2688: Cannot find type definition file for 'node'`: `oam check` extends this tsconfig from oam's cache directory, and from there tsgo does not find `@types/node` when the project names only `types: ["node"]`. `tsconfig.json` now declares `typeRoots`, which resolves the lookup relative to the file. Stock `tsc` was never affected, and the built `dist/` is byte-identical with and without it.
+
+## [0.13.3] — 2026-09-11
+
+No runtime changes: nothing under `src/` changed and no dependency moved. This release is tooling, packaging metadata and docs. This entry was backfilled -- `[Unreleased]` was empty when 0.13.3 was cut, so its GitHub release notes fell back to bare commit subjects.
+
+### Fixed
+
+- **`npm run lint` checks the biome version the repo actually installs.** On Windows ARM64, `scripts/lint.mjs` runs the x64 build of biome under emulation, because some arm64 builds -- including 2.5.4, the one this repo installs -- exit 139 on a real check while still answering `--version` cleanly. It chose the version to provision from `biome.json`'s `$schema`, which pins what the config is validated against rather than the installed binary, and the two had drifted: `$schema` said 2.4.12 while the lockfile installs 2.5.4, so "lint clean" was a claim about a version this repo does not use. The version now comes from `package-lock.json`, falls back to the installed package, and fails with an actionable message when neither is present.
+
+### Changed
+
+- **`release.sh` promotes `[Unreleased]` to the released version and commits the result.** The script read CHANGELOG.md for release notes but never renamed the heading, so documented work accumulated under `[Unreleased]` while the shipped version went out without an entry of its own. It now renames the first `## [Unreleased]` heading to `## [X.Y.Z] <dash> <date>`, reusing whichever dash the file already uses, stages CHANGELOG.md in the version-bump commit, and fails the release when the version has no entry but `[Unreleased]` has content.
+- **npm metadata.** `homepage` now points at https://yaw.sh/mcp-servers/lemonsqueezy-mcp/, and the description and keywords name what the server manages: stores, orders, subscriptions, license keys, refunds and webhooks.
+- **README:** added a follow badge for @TokenLimitNews on X.
 
 ## [0.13.2] — 2026-08-23
 
@@ -558,7 +610,12 @@ Hardening pass for unattended automation against live billing flows.
 
 Initial release. 59 tools covering all 17 LemonSqueezy API resources.
 
-[Unreleased]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.9...HEAD
+[Unreleased]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.13.3...HEAD
+[0.13.3]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.13.2...v0.13.3
+[0.13.2]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.13.1...v0.13.2
+[0.13.1]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.13.0...v0.13.1
+[0.13.0]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.12.0...v0.13.0
+[0.12.0]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.11.1...v0.12.0
 [0.11.1]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.13...v0.11.0
 [0.10.13]: https://github.com/YawLabs/lemonsqueezy-mcp/compare/v0.10.12...v0.10.13