@yawlabs/lemonsqueezy-mcp 0.3.0 → 0.4.0

package/dist/index.js

@@ -21010,39 +21010,219 @@ var StdioServerTransport = class {
   }
 };
 
-// src/api.ts
-var BASE_URL = "https://api.lemonsqueezy.com/v1";
+// src/guardrails.ts
+var GuardrailError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GuardrailError";
+  }
+};
+var cachedOptions = null;
+var destructiveTimestamps = [];
+function readNumber(name, raw) {
+  if (raw === void 0 || raw.trim() === "") return null;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) {
+    throw new Error(`${name} must be a non-negative number (got ${JSON.stringify(raw)})`);
+  }
+  return n;
+}
+function loadOptions() {
+  if (cachedOptions) return cachedOptions;
+  const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
+  const allowedSet = allowed ? new Set(
+    allowed.split(",").map((s) => s.trim()).filter(Boolean)
+  ) : null;
+  cachedOptions = {
+    allowedStoreIds: allowedSet && allowedSet.size > 0 ? allowedSet : null,
+    maxRefundAmountCents: readNumber(
+      "LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS",
+      process.env.LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS
+    ),
+    rateLimitPerMinute: readNumber(
+      "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
+      process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
+    )
+  };
+  return cachedOptions;
+}
+function checkStoreAllowed(storeId) {
+  if (!storeId) return;
+  const o = loadOptions();
+  if (!o.allowedStoreIds) return;
+  if (!o.allowedStoreIds.has(String(storeId))) {
+    throw new GuardrailError(`Store ID ${storeId} is not in LEMONSQUEEZY_ALLOWED_STORE_IDS allowlist`);
+  }
+}
+function checkRefundAmount(cents) {
+  const o = loadOptions();
+  if (o.maxRefundAmountCents === null) return;
+  if (cents > o.maxRefundAmountCents) {
+    throw new GuardrailError(
+      `Refund amount ${cents} cents exceeds LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS (${o.maxRefundAmountCents})`
+    );
+  }
+}
+function checkDestructiveRateLimit(now = Date.now()) {
+  const o = loadOptions();
+  if (o.rateLimitPerMinute === null) return;
+  const cutoff = now - 6e4;
+  destructiveTimestamps = destructiveTimestamps.filter((t) => t > cutoff);
+  if (destructiveTimestamps.length >= o.rateLimitPerMinute) {
+    throw new GuardrailError(`Destructive call rate limit exceeded (${o.rateLimitPerMinute}/min). Wait and retry.`);
+  }
+  destructiveTimestamps.push(now);
+}
+
+// src/logger.ts
+function isEnabled() {
+  return process.env.LEMONSQUEEZY_LOG === "json";
+}
+function logEvent(entry) {
+  if (!isEnabled()) return;
+  try {
+    const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
+    process.stderr.write(`${line}
+`);
+  } catch {
+  }
+}
+
+// src/retry.ts
 var REQUEST_TIMEOUT_MS = 3e4;
 var DEFAULT_RETRY_WAIT_MS = 1e3;
 var MAX_RETRY_WAIT_MS = 3e4;
+var DEFAULT_MAX_ATTEMPTS = 4;
+var BASE_BACKOFF_MS = 250;
+var JITTER_FRACTION = 0.25;
 function parseRetryAfterMs(header) {
   if (!header) return DEFAULT_RETRY_WAIT_MS;
   const trimmed = header.trim();
   const seconds = Number(trimmed);
-  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  if (!Number.isNaN(seconds)) {
+    return seconds >= 0 ? seconds * 1e3 : DEFAULT_RETRY_WAIT_MS;
+  }
   const dateMs = Date.parse(trimmed);
   if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
   return DEFAULT_RETRY_WAIT_MS;
 }
-async function fetchWithRetry(url, init) {
-  const makeCall = () => fetch(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
-  const res = await makeCall();
-  if (res.status !== 429) return res;
-  const waitMs = parseRetryAfterMs(res.headers.get("retry-after"));
-  if (waitMs > MAX_RETRY_WAIT_MS) return res;
-  await new Promise((resolve) => setTimeout(resolve, waitMs));
-  return makeCall();
+function isAbortTimeoutError(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  return e.name === "TimeoutError" || e.name === "AbortError" || e.code === "ABORT_ERR";
+}
+function backoffDelay(attempt, rand = Math.random) {
+  const base = BASE_BACKOFF_MS * 2 ** (attempt - 1);
+  const jitter = rand() * base * JITTER_FRACTION;
+  return Math.min(base + jitter, MAX_RETRY_WAIT_MS);
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function fetchWithRetry(url, init, opts) {
+  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const sleep = opts.sleep ?? defaultSleep;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const rand = opts.rand ?? Math.random;
+  let lastError;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      const res = await fetchImpl(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+      if (res.status === 429) {
+        if (attempt === maxAttempts) return res;
+        const waitMs = parseRetryAfterMs(res.headers.get("retry-after"));
+        if (waitMs > MAX_RETRY_WAIT_MS) return res;
+        await sleep(waitMs);
+        continue;
+      }
+      if (res.status >= 500 && res.status < 600 && opts.idempotent && attempt < maxAttempts) {
+        await sleep(backoffDelay(attempt, rand));
+        continue;
+      }
+      return res;
+    } catch (err) {
+      lastError = err;
+      if (isAbortTimeoutError(err)) {
+        if (!opts.idempotent || attempt === maxAttempts) throw err;
+        await sleep(backoffDelay(attempt, rand));
+        continue;
+      }
+      if (err instanceof TypeError && opts.idempotent && attempt < maxAttempts) {
+        await sleep(backoffDelay(attempt, rand));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw lastError ?? new Error("fetchWithRetry exhausted attempts");
+}
+
+// src/secret.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+var COMMAND_TIMEOUT_MS = 1e4;
+var COMMAND_MAX_BUFFER = 64 * 1024;
+var cached2 = null;
+function parseCommand(cmd) {
+  const parts = [];
+  let current = "";
+  let quote = null;
+  for (const ch of cmd) {
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+        continue;
+      }
+      current += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (ch === " " || ch === "	") {
+      if (current) {
+        parts.push(current);
+        current = "";
+      }
+    } else {
+      current += ch;
+    }
+  }
+  if (quote) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND has an unterminated quote");
+  if (current) parts.push(current);
+  if (parts.length === 0) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND is empty");
+  return { command: parts[0], args: parts.slice(1) };
 }
-function getApiKey() {
+async function loadApiKey() {
+  if (cached2 && cached2.expiresAt > Date.now()) return cached2.key;
+  const cmdStr = process.env.LEMONSQUEEZY_API_KEY_COMMAND;
+  if (cmdStr && cmdStr.trim() !== "") {
+    const { command, args } = parseCommand(cmdStr);
+    let stdout;
+    try {
+      const result = await execFileAsync(command, args, {
+        timeout: COMMAND_TIMEOUT_MS,
+        maxBuffer: COMMAND_MAX_BUFFER
+      });
+      stdout = result.stdout;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(`LEMONSQUEEZY_API_KEY_COMMAND failed: ${msg}`);
+    }
+    const key2 = stdout.trim();
+    if (!key2) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND produced empty output");
+    cached2 = { key: key2, expiresAt: Date.now() + CACHE_TTL_MS };
+    return key2;
+  }
   const key = process.env.LEMONSQUEEZY_API_KEY;
   if (!key) {
-    throw new Error("LEMONSQUEEZY_API_KEY environment variable is required.");
+    throw new Error("LEMONSQUEEZY_API_KEY or LEMONSQUEEZY_API_KEY_COMMAND environment variable is required.");
   }
   if (key.trim() === "") {
     throw new Error("LEMONSQUEEZY_API_KEY is set but empty. Provide a valid API key.");
   }
   return key;
 }
+
+// src/api.ts
+var BASE_URL = "https://api.lemonsqueezy.com/v1";
 function buildQuery(params) {
   if (!params) return "";
   const parts = [];
@@ -21064,9 +21244,14 @@ function buildQuery(params) {
   }
   return parts.length > 0 ? `?${parts.join("&")}` : "";
 }
+function decorateError(error2, requestId) {
+  return requestId ? `${error2} (request_id: ${requestId})` : error2;
+}
 async function apiRequest(method, path, body) {
+  const start = Date.now();
+  const apiKey = await loadApiKey();
   const headers = {
-    Authorization: `Bearer ${getApiKey()}`,
+    Authorization: `Bearer ${apiKey}`,
     Accept: "application/vnd.api+json"
   };
   let fetchBody;
@@ -21075,64 +21260,163 @@ async function apiRequest(method, path, body) {
     fetchBody = JSON.stringify(body);
   }
   const url = path.startsWith("http") ? path : `${BASE_URL}${path}`;
+  const idempotent = method === "GET" || method === "DELETE";
   let res;
   try {
-    res = await fetchWithRetry(url, { method, headers, body: fetchBody });
+    res = await fetchWithRetry(url, { method, headers, body: fetchBody }, { idempotent });
   } catch (err) {
-    if (err instanceof Error && err.name === "TimeoutError") {
-      return { ok: false, status: 0, error: `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s` };
-    }
+    const latency_ms2 = Date.now() - start;
+    if (isAbortTimeoutError(err)) {
+      const error2 = `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s`;
+      logEvent({ event: "http_call", method, path, status: "timeout", latency_ms: latency_ms2, error: error2 });
+      return { ok: false, status: 0, error: error2 };
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    logEvent({ event: "http_call", method, path, status: "network_error", latency_ms: latency_ms2, error: message });
     throw err;
   }
+  const latency_ms = Date.now() - start;
+  const requestId = res.headers.get("x-request-id") ?? void 0;
   if (!res.ok) {
     const errorBody = await res.text();
     try {
       const parsed = JSON.parse(errorBody);
-      return { ok: false, status: res.status, data: parsed, error: parsed.errors?.[0]?.detail ?? errorBody };
+      const detail = parsed.errors?.[0]?.detail ?? errorBody;
+      logEvent({
+        event: "http_call",
+        method,
+        path,
+        status: res.status,
+        latency_ms,
+        request_id: requestId,
+        error: detail
+      });
+      return {
+        ok: false,
+        status: res.status,
+        data: parsed,
+        error: decorateError(detail, requestId),
+        requestId
+      };
     } catch {
-      return { ok: false, status: res.status, error: errorBody };
+      logEvent({
+        event: "http_call",
+        method,
+        path,
+        status: res.status,
+        latency_ms,
+        request_id: requestId,
+        error: errorBody
+      });
+      return {
+        ok: false,
+        status: res.status,
+        error: decorateError(errorBody, requestId),
+        requestId
+      };
     }
   }
+  logEvent({
+    event: "http_call",
+    method,
+    path,
+    status: res.status,
+    latency_ms,
+    request_id: requestId
+  });
   if (res.status === 204) {
-    return { ok: true, status: res.status };
+    return { ok: true, status: res.status, requestId };
   }
   const data = await res.json();
-  return { ok: true, status: res.status, data };
+  return { ok: true, status: res.status, data, requestId };
 }
 async function licenseRequest(path, body) {
   const url = `${BASE_URL}${path}`;
+  const start = Date.now();
   let res;
   try {
-    res = await fetchWithRetry(url, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
+    res = await fetchWithRetry(
+      url,
+      {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams(body)
       },
-      body: new URLSearchParams(body)
-    });
+      { idempotent: false }
+    );
   } catch (err) {
-    if (err instanceof Error && err.name === "TimeoutError") {
-      return { ok: false, status: 0, error: `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s` };
-    }
+    const latency_ms2 = Date.now() - start;
+    if (isAbortTimeoutError(err)) {
+      const error2 = `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s`;
+      logEvent({ event: "http_call", method: "POST", path, status: "timeout", latency_ms: latency_ms2, error: error2 });
+      return { ok: false, status: 0, error: error2 };
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    logEvent({
+      event: "http_call",
+      method: "POST",
+      path,
+      status: "network_error",
+      latency_ms: latency_ms2,
+      error: message
+    });
     throw err;
   }
+  const latency_ms = Date.now() - start;
+  const requestId = res.headers.get("x-request-id") ?? void 0;
   if (!res.ok) {
     const errorBody = await res.text();
     try {
       const parsed = JSON.parse(errorBody);
+      const p = parsed;
+      const detail = p.errors?.[0]?.detail ?? p.error ?? errorBody;
+      logEvent({
+        event: "http_call",
+        method: "POST",
+        path,
+        status: res.status,
+        latency_ms,
+        request_id: requestId,
+        error: detail
+      });
       return {
         ok: false,
         status: res.status,
         data: parsed,
-        error: parsed.errors?.[0]?.detail ?? parsed.error ?? errorBody
+        error: decorateError(detail, requestId),
+        requestId
       };
     } catch {
-      return { ok: false, status: res.status, error: errorBody };
+      logEvent({
+        event: "http_call",
+        method: "POST",
+        path,
+        status: res.status,
+        latency_ms,
+        request_id: requestId,
+        error: errorBody
+      });
+      return {
+        ok: false,
+        status: res.status,
+        error: decorateError(errorBody, requestId),
+        requestId
+      };
     }
   }
+  logEvent({
+    event: "http_call",
+    method: "POST",
+    path,
+    status: res.status,
+    latency_ms,
+    request_id: requestId
+  });
   const data = await res.json();
-  return { ok: true, status: res.status, data };
+  return { ok: true, status: res.status, data, requestId };
 }
 function getHandler(endpoint, idField) {
   return async (input) => {
@@ -21181,8 +21465,8 @@ var affiliateTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      affiliateId: external_exports.string().describe("The affiliate ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,user')")
+      affiliateId: external_exports.string().max(1e4).describe("The affiliate ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,user')")
     }),
     handler: getHandler("/affiliates", "affiliateId")
   },
@@ -21197,8 +21481,8 @@ var affiliateTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      userEmail: external_exports.string().email().optional().describe("Filter by affiliate's user email"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,user')"),
+      userEmail: external_exports.string().email().max(320).optional().describe("Filter by affiliate's user email"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,user')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21219,8 +21503,8 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      checkoutId: external_exports.string().describe("The checkout ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variant')")
+      checkoutId: external_exports.string().max(1e4).describe("The checkout ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variant')")
     }),
     handler: getHandler("/checkouts", "checkoutId")
   },
@@ -21235,9 +21519,9 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      variantId: external_exports.string().optional().describe("Filter by variant ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variant')"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      variantId: external_exports.string().max(1e4).optional().describe("Filter by variant ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variant')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21254,18 +21538,18 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().describe("The store ID"),
-      variantId: external_exports.string().describe("The variant ID for the product being purchased"),
+      storeId: external_exports.string().max(1e4).describe("The store ID"),
+      variantId: external_exports.string().max(1e4).describe("The variant ID for the product being purchased"),
       customPrice: external_exports.number().int().min(0).optional().describe("Custom price in cents (overrides the variant price)"),
       enabledVariants: external_exports.array(external_exports.string()).optional().describe("Array of variant IDs to show on the checkout (for products with multiple variants)"),
-      email: external_exports.string().optional().describe("Prefill customer email"),
-      name: external_exports.string().optional().describe("Prefill customer name"),
-      billingAddressCountry: external_exports.string().optional().describe("Prefill billing country (ISO 3166-1 alpha-2)"),
-      billingAddressZip: external_exports.string().optional().describe("Prefill billing ZIP/postal code"),
-      taxNumber: external_exports.string().optional().describe("Prefill tax/VAT number"),
-      discountCode: external_exports.string().optional().describe("Pre-apply a discount code"),
+      email: external_exports.string().max(1e4).optional().describe("Prefill customer email"),
+      name: external_exports.string().max(1e4).optional().describe("Prefill customer name"),
+      billingAddressCountry: external_exports.string().max(1e4).optional().describe("Prefill billing country (ISO 3166-1 alpha-2)"),
+      billingAddressZip: external_exports.string().max(1e4).optional().describe("Prefill billing ZIP/postal code"),
+      taxNumber: external_exports.string().max(1e4).optional().describe("Prefill tax/VAT number"),
+      discountCode: external_exports.string().max(1e4).optional().describe("Pre-apply a discount code"),
       customData: external_exports.record(external_exports.unknown()).optional().describe("Custom data object to attach to the order"),
-      expiresAt: external_exports.string().optional().describe("Checkout expiry date (ISO 8601 format)")
+      expiresAt: external_exports.string().max(1e4).optional().describe("Checkout expiry date (ISO 8601 format)")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -21316,8 +21600,8 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      customerId: external_exports.string().describe("The customer ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')")
+      customerId: external_exports.string().max(1e4).describe("The customer ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')")
     }),
     handler: getHandler("/customers", "customerId")
   },
@@ -21332,9 +21616,9 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      email: external_exports.string().optional().describe("Filter by customer email"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      email: external_exports.string().max(1e4).optional().describe("Filter by customer email"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21351,12 +21635,12 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().describe("The store ID to create the customer in"),
-      name: external_exports.string().describe("Customer's full name"),
-      email: external_exports.string().describe("Customer's email address"),
-      city: external_exports.string().optional().describe("Customer's city"),
-      region: external_exports.string().optional().describe("Customer's region/state"),
-      country: external_exports.string().optional().describe("Customer's country (ISO 3166-1 alpha-2 code, e.g. 'US')")
+      storeId: external_exports.string().max(1e4).describe("The store ID to create the customer in"),
+      name: external_exports.string().max(1e4).describe("Customer's full name"),
+      email: external_exports.string().max(1e4).describe("Customer's email address"),
+      city: external_exports.string().max(1e4).optional().describe("Customer's city"),
+      region: external_exports.string().max(1e4).optional().describe("Customer's region/state"),
+      country: external_exports.string().max(1e4).optional().describe("Customer's country (ISO 3166-1 alpha-2 code, e.g. 'US')")
     }),
     handler: async (input) => {
       const attributes = {
@@ -21388,13 +21672,13 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      customerId: external_exports.string().describe("The customer ID to update"),
-      name: external_exports.string().optional().describe("New name"),
-      email: external_exports.string().optional().describe("New email"),
-      city: external_exports.string().optional().describe("New city"),
-      region: external_exports.string().optional().describe("New region/state"),
-      country: external_exports.string().optional().describe("New country (ISO 3166-1 alpha-2 code)"),
-      status: external_exports.string().optional().describe("New status ('archived' to archive the customer)")
+      customerId: external_exports.string().max(1e4).describe("The customer ID to update"),
+      name: external_exports.string().max(1e4).optional().describe("New name"),
+      email: external_exports.string().max(1e4).optional().describe("New email"),
+      city: external_exports.string().max(1e4).optional().describe("New city"),
+      region: external_exports.string().max(1e4).optional().describe("New region/state"),
+      country: external_exports.string().max(1e4).optional().describe("New country (ISO 3166-1 alpha-2 code)"),
+      status: external_exports.string().max(1e4).optional().describe("New status ('archived' to archive the customer)")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -21424,7 +21708,7 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      customerId: external_exports.string().describe("The customer ID to archive")
+      customerId: external_exports.string().max(1e4).describe("The customer ID to archive")
     }),
     handler: async (input) => {
       return apiPatch(`/customers/${input.customerId}`, {
@@ -21451,8 +21735,8 @@ var discountRedemptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      discountRedemptionId: external_exports.string().describe("The discount redemption ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'discount,order')")
+      discountRedemptionId: external_exports.string().max(1e4).describe("The discount redemption ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'discount,order')")
     }),
     handler: getHandler("/discount-redemptions", "discountRedemptionId")
   },
@@ -21467,9 +21751,9 @@ var discountRedemptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      discountId: external_exports.string().optional().describe("Filter by discount ID"),
-      orderId: external_exports.string().optional().describe("Filter by order ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'discount,order')"),
+      discountId: external_exports.string().max(1e4).optional().describe("Filter by discount ID"),
+      orderId: external_exports.string().max(1e4).optional().describe("Filter by order ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'discount,order')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21490,8 +21774,8 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      discountId: external_exports.string().describe("The discount ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')")
+      discountId: external_exports.string().max(1e4).describe("The discount ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')")
     }),
     handler: getHandler("/discounts", "discountId")
   },
@@ -21506,8 +21790,8 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21524,9 +21808,9 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().describe("The store ID to create the discount in"),
-      name: external_exports.string().describe("Internal name for the discount"),
-      code: external_exports.string().describe("The discount code customers will enter (e.g. 'SAVE20')"),
+      storeId: external_exports.string().max(1e4).describe("The store ID to create the discount in"),
+      name: external_exports.string().max(1e4).describe("Internal name for the discount"),
+      code: external_exports.string().max(1e4).describe("The discount code customers will enter (e.g. 'SAVE20')"),
       amount: external_exports.number().int().min(1).describe(
         "Discount amount \u2014 in cents for 'fixed' type (e.g. 1000 = $10.00), or percentage for 'percent' type (e.g. 20 = 20%)"
       ),
@@ -21536,8 +21820,8 @@ var discountTools = [
       ),
       durationInMonths: external_exports.number().int().min(1).optional().describe("Number of months the discount applies (required when duration is 'repeating')"),
       maxRedemptions: external_exports.number().int().min(0).optional().describe("Maximum number of times this discount can be redeemed (0 = unlimited)"),
-      startsAt: external_exports.string().optional().describe("When the discount becomes active (ISO 8601 format)"),
-      expiresAt: external_exports.string().optional().describe("When the discount expires (ISO 8601 format)"),
+      startsAt: external_exports.string().max(1e4).optional().describe("When the discount becomes active (ISO 8601 format)"),
+      expiresAt: external_exports.string().max(1e4).optional().describe("When the discount expires (ISO 8601 format)"),
       isLimitedToProducts: external_exports.boolean().optional().describe("If true, the discount only applies to specific variants (set via variantIds)"),
       variantIds: external_exports.array(external_exports.string()).optional().describe("Array of variant IDs this discount applies to (requires isLimitedToProducts: true)")
     }),
@@ -21582,7 +21866,7 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      discountId: external_exports.string().describe("The discount ID to delete")
+      discountId: external_exports.string().max(1e4).describe("The discount ID to delete")
     }),
     handler: async (input) => {
       return apiDelete(`/discounts/${input.discountId}`);
@@ -21603,8 +21887,8 @@ var fileTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      fileId: external_exports.string().describe("The file ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'variant')")
+      fileId: external_exports.string().max(1e4).describe("The file ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')")
     }),
     handler: getHandler("/files", "fileId")
   },
@@ -21619,8 +21903,8 @@ var fileTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      variantId: external_exports.string().optional().describe("Filter by variant ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
+      variantId: external_exports.string().max(1e4).optional().describe("Filter by variant ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21641,8 +21925,8 @@ var licenseKeyInstanceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKeyInstanceId: external_exports.string().describe("The license key instance ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'license-key')")
+      licenseKeyInstanceId: external_exports.string().max(1e4).describe("The license key instance ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'license-key')")
     }),
     handler: getHandler("/license-key-instances", "licenseKeyInstanceId")
   },
@@ -21657,8 +21941,8 @@ var licenseKeyInstanceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKeyId: external_exports.string().optional().describe("Filter by license key ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'license-key')"),
+      licenseKeyId: external_exports.string().max(1e4).optional().describe("Filter by license key ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'license-key')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21679,8 +21963,8 @@ var licenseKeyTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKeyId: external_exports.string().describe("The license key ID"),
-      include: external_exports.string().optional().describe(
+      licenseKeyId: external_exports.string().max(1e4).describe("The license key ID"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,license-key-instances')"
       )
     }),
@@ -21697,11 +21981,11 @@ var licenseKeyTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      orderId: external_exports.string().optional().describe("Filter by order ID"),
-      orderItemId: external_exports.string().optional().describe("Filter by order item ID"),
-      productId: external_exports.string().optional().describe("Filter by product ID"),
-      include: external_exports.string().optional().describe(
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      orderId: external_exports.string().max(1e4).optional().describe("Filter by order ID"),
+      orderItemId: external_exports.string().max(1e4).optional().describe("Filter by order item ID"),
+      productId: external_exports.string().max(1e4).optional().describe("Filter by product ID"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,license-key-instances')"
       ),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
@@ -21725,10 +22009,10 @@ var licenseKeyTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKeyId: external_exports.string().describe("The license key ID to update"),
+      licenseKeyId: external_exports.string().max(1e4).describe("The license key ID to update"),
       activationLimit: external_exports.number().int().min(0).optional().describe("Maximum number of activations allowed (0 = unlimited)"),
       disabled: external_exports.boolean().optional().describe("Set to true to disable this license key"),
-      expiresAt: external_exports.string().optional().describe("Expiry date (ISO 8601 format). Set to null to remove expiry.")
+      expiresAt: external_exports.string().max(1e4).optional().describe("Expiry date (ISO 8601 format). Set to null to remove expiry.")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -21759,8 +22043,8 @@ var licenseTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKey: external_exports.string().describe("The license key to activate"),
-      instanceName: external_exports.string().describe("A name for this activation instance (e.g. machine name, user identifier)")
+      licenseKey: external_exports.string().max(1e4).describe("The license key to activate"),
+      instanceName: external_exports.string().max(1e4).describe("A name for this activation instance (e.g. machine name, user identifier)")
     }),
     handler: async (input) => {
       return licenseRequest("/licenses/activate", {
@@ -21780,8 +22064,8 @@ var licenseTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKey: external_exports.string().describe("The license key to validate"),
-      instanceId: external_exports.string().optional().describe("Optional instance ID to validate a specific activation")
+      licenseKey: external_exports.string().max(1e4).describe("The license key to validate"),
+      instanceId: external_exports.string().max(1e4).optional().describe("Optional instance ID to validate a specific activation")
     }),
     handler: async (input) => {
       const body = { license_key: input.licenseKey };
@@ -21800,8 +22084,8 @@ var licenseTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      licenseKey: external_exports.string().describe("The license key"),
-      instanceId: external_exports.string().describe("The instance ID to deactivate")
+      licenseKey: external_exports.string().max(1e4).describe("The license key"),
+      instanceId: external_exports.string().max(1e4).describe("The instance ID to deactivate")
     }),
     handler: async (input) => {
       return licenseRequest("/licenses/deactivate", {
@@ -21825,8 +22109,8 @@ var orderItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      orderItemId: external_exports.string().describe("The order item ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')")
+      orderItemId: external_exports.string().max(1e4).describe("The order item ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')")
     }),
     handler: getHandler("/order-items", "orderItemId")
   },
@@ -21841,10 +22125,10 @@ var orderItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      orderId: external_exports.string().optional().describe("Filter by order ID"),
-      productId: external_exports.string().optional().describe("Filter by product ID"),
-      variantId: external_exports.string().optional().describe("Filter by variant ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')"),
+      orderId: external_exports.string().max(1e4).optional().describe("Filter by order ID"),
+      productId: external_exports.string().max(1e4).optional().describe("Filter by product ID"),
+      variantId: external_exports.string().max(1e4).optional().describe("Filter by variant ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -21865,8 +22149,8 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      orderId: external_exports.string().describe("The order ID"),
-      include: external_exports.string().optional().describe(
+      orderId: external_exports.string().max(1e4).describe("The order ID"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order-items,subscriptions,license-keys,discount-redemptions')"
       )
     }),
@@ -21883,9 +22167,9 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      userEmail: external_exports.string().optional().describe("Filter by user email"),
-      include: external_exports.string().optional().describe(
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      userEmail: external_exports.string().max(1e4).optional().describe("Filter by user email"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order-items,subscriptions,license-keys,discount-redemptions')"
       ),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
@@ -21904,15 +22188,15 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      orderId: external_exports.string().describe("The order ID"),
-      name: external_exports.string().optional().describe("Customer name on the invoice"),
-      address: external_exports.string().optional().describe("Customer address on the invoice"),
-      city: external_exports.string().optional().describe("Customer city"),
-      state: external_exports.string().optional().describe("Customer state/region"),
-      zipCode: external_exports.string().optional().describe("Customer ZIP/postal code"),
-      country: external_exports.string().optional().describe("Customer country"),
-      notes: external_exports.string().optional().describe("Additional notes to include on the invoice"),
-      locale: external_exports.string().optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
+      orderId: external_exports.string().max(1e4).describe("The order ID"),
+      name: external_exports.string().max(1e4).optional().describe("Customer name on the invoice"),
+      address: external_exports.string().max(1e4).optional().describe("Customer address on the invoice"),
+      city: external_exports.string().max(1e4).optional().describe("Customer city"),
+      state: external_exports.string().max(1e4).optional().describe("Customer state/region"),
+      zipCode: external_exports.string().max(1e4).optional().describe("Customer ZIP/postal code"),
+      country: external_exports.string().max(1e4).optional().describe("Customer country"),
+      notes: external_exports.string().max(1e4).optional().describe("Additional notes to include on the invoice"),
+      locale: external_exports.string().max(1e4).optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
     }),
     handler: async (input) => {
       const params = new URLSearchParams();
@@ -21939,10 +22223,11 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      orderId: external_exports.string().describe("The order ID to refund"),
+      orderId: external_exports.string().max(1e4).describe("The order ID to refund"),
       amount: external_exports.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
     handler: async (input) => {
+      checkRefundAmount(input.amount);
       return apiPost(`/orders/${input.orderId}/refund`, {
         data: { type: "orders", id: input.orderId, attributes: { amount: input.amount } }
       });
@@ -21963,8 +22248,8 @@ var priceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      priceId: external_exports.string().describe("The price ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'variant')")
+      priceId: external_exports.string().max(1e4).describe("The price ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')")
     }),
     handler: getHandler("/prices", "priceId")
   },
@@ -21979,8 +22264,8 @@ var priceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      variantId: external_exports.string().optional().describe("Filter by variant ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
+      variantId: external_exports.string().max(1e4).optional().describe("Filter by variant ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22001,8 +22286,8 @@ var productTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      productId: external_exports.string().describe("The product ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variants')")
+      productId: external_exports.string().max(1e4).describe("The product ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants')")
     }),
     handler: getHandler("/products", "productId")
   },
@@ -22017,8 +22302,8 @@ var productTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,variants')"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22039,8 +22324,8 @@ var storeTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().describe("The store ID"),
-      include: external_exports.string().optional().describe(
+      storeId: external_exports.string().max(1e4).describe("The store ID"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'products,discounts,license-keys,subscriptions,webhooks')"
       )
     }),
@@ -22057,7 +22342,7 @@ var storeTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      include: external_exports.string().optional().describe(
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'products,discounts,license-keys,subscriptions,webhooks')"
       ),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
@@ -22080,8 +22365,8 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionInvoiceId: external_exports.string().describe("The subscription invoice ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')")
+      subscriptionInvoiceId: external_exports.string().max(1e4).describe("The subscription invoice ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')")
     }),
     handler: getHandler("/subscription-invoices", "subscriptionInvoiceId")
   },
@@ -22096,11 +22381,11 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      subscriptionId: external_exports.string().optional().describe("Filter by subscription ID"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      subscriptionId: external_exports.string().max(1e4).optional().describe("Filter by subscription ID"),
       status: external_exports.enum(["pending", "paid", "void", "refunded"]).optional().describe("Filter by invoice status"),
       refunded: external_exports.boolean().optional().describe("Filter by refunded status"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22122,15 +22407,15 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionInvoiceId: external_exports.string().describe("The subscription invoice ID"),
-      name: external_exports.string().optional().describe("Customer name on the invoice"),
-      address: external_exports.string().optional().describe("Customer address on the invoice"),
-      city: external_exports.string().optional().describe("Customer city"),
-      state: external_exports.string().optional().describe("Customer state/region"),
-      zipCode: external_exports.string().optional().describe("Customer ZIP/postal code"),
-      country: external_exports.string().optional().describe("Customer country"),
-      notes: external_exports.string().optional().describe("Additional notes to include on the invoice"),
-      locale: external_exports.string().optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
+      subscriptionInvoiceId: external_exports.string().max(1e4).describe("The subscription invoice ID"),
+      name: external_exports.string().max(1e4).optional().describe("Customer name on the invoice"),
+      address: external_exports.string().max(1e4).optional().describe("Customer address on the invoice"),
+      city: external_exports.string().max(1e4).optional().describe("Customer city"),
+      state: external_exports.string().max(1e4).optional().describe("Customer state/region"),
+      zipCode: external_exports.string().max(1e4).optional().describe("Customer ZIP/postal code"),
+      country: external_exports.string().max(1e4).optional().describe("Customer country"),
+      notes: external_exports.string().max(1e4).optional().describe("Additional notes to include on the invoice"),
+      locale: external_exports.string().max(1e4).optional().describe("Invoice language locale (e.g. 'en', 'fr', 'de')")
     }),
     handler: async (input) => {
       const params = new URLSearchParams();
@@ -22157,7 +22442,7 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionInvoiceId: external_exports.string().describe("The subscription invoice ID to refund"),
+      subscriptionInvoiceId: external_exports.string().max(1e4).describe("The subscription invoice ID to refund"),
       amount: external_exports.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
     handler: async (input) => {
@@ -22185,8 +22470,8 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionItemId: external_exports.string().describe("The subscription item ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')")
+      subscriptionItemId: external_exports.string().max(1e4).describe("The subscription item ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')")
     }),
     handler: getHandler("/subscription-items", "subscriptionItemId")
   },
@@ -22201,9 +22486,9 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionId: external_exports.string().optional().describe("Filter by subscription ID"),
-      priceId: external_exports.string().optional().describe("Filter by price ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')"),
+      subscriptionId: external_exports.string().max(1e4).optional().describe("Filter by subscription ID"),
+      priceId: external_exports.string().max(1e4).optional().describe("Filter by price ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22220,7 +22505,7 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionItemId: external_exports.string().describe("The subscription item ID to update"),
+      subscriptionItemId: external_exports.string().max(1e4).describe("The subscription item ID to update"),
       quantity: external_exports.number().int().min(1).describe("New quantity for the subscription item")
     }),
     handler: async (input) => {
@@ -22244,7 +22529,7 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionItemId: external_exports.string().describe("The subscription item ID")
+      subscriptionItemId: external_exports.string().max(1e4).describe("The subscription item ID")
     }),
     handler: async (input) => {
       return apiGet(`/subscription-items/${input.subscriptionItemId}/current-usage`);
@@ -22265,8 +22550,8 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionId: external_exports.string().describe("The subscription ID"),
-      include: external_exports.string().optional().describe(
+      subscriptionId: external_exports.string().max(1e4).describe("The subscription ID"),
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,variant,subscription-items,subscription-invoices')"
       )
     }),
@@ -22283,14 +22568,14 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      orderId: external_exports.string().optional().describe("Filter by order ID"),
-      orderItemId: external_exports.string().optional().describe("Filter by order item ID"),
-      productId: external_exports.string().optional().describe("Filter by product ID"),
-      variantId: external_exports.string().optional().describe("Filter by variant ID"),
-      userEmail: external_exports.string().optional().describe("Filter by user email"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      orderId: external_exports.string().max(1e4).optional().describe("Filter by order ID"),
+      orderItemId: external_exports.string().max(1e4).optional().describe("Filter by order item ID"),
+      productId: external_exports.string().max(1e4).optional().describe("Filter by product ID"),
+      variantId: external_exports.string().max(1e4).optional().describe("Filter by variant ID"),
+      userEmail: external_exports.string().max(1e4).optional().describe("Filter by user email"),
       status: external_exports.enum(["on_trial", "active", "paused", "past_due", "unpaid", "cancelled", "expired"]).optional().describe("Filter by subscription status"),
-      include: external_exports.string().optional().describe(
+      include: external_exports.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,variant')"
       ),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
@@ -22317,8 +22602,8 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionId: external_exports.string().describe("The subscription ID to update"),
-      variantId: external_exports.string().optional().describe("New variant ID for plan switching"),
+      subscriptionId: external_exports.string().max(1e4).describe("The subscription ID to update"),
+      variantId: external_exports.string().max(1e4).optional().describe("New variant ID for plan switching"),
       pause: external_exports.enum(["void", "free", "resume"]).optional().describe("Pause mode: 'void' (pause, skip billing), 'free' (pause, keep access free), or 'resume' to unpause"),
       cancelled: external_exports.literal(false).optional().describe(
         "Set to false to un-cancel a subscription before it expires. To cancel, use ls_cancel_subscription instead."
@@ -22326,7 +22611,7 @@ var subscriptionTools = [
       billingAnchor: external_exports.number().int().min(1).max(28).optional().describe("Day of month (1-28) to anchor billing to"),
       invoiceImmediately: external_exports.boolean().optional().describe("If true, invoice immediately when updating (default false for prorated changes)"),
       disableProrations: external_exports.boolean().optional().describe("If true, disable prorations when changing plans"),
-      trialEndsAt: external_exports.string().optional().describe("Set trial end date (ISO 8601 format). Set to null to end trial immediately.")
+      trialEndsAt: external_exports.string().max(1e4).optional().describe("Set trial end date (ISO 8601 format). Set to null to end trial immediately.")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -22357,7 +22642,7 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionId: external_exports.string().describe("The subscription ID to cancel")
+      subscriptionId: external_exports.string().max(1e4).describe("The subscription ID to cancel")
     }),
     handler: async (input) => {
       return apiDelete(`/subscriptions/${input.subscriptionId}`);
@@ -22378,8 +22663,8 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      usageRecordId: external_exports.string().describe("The usage record ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')")
+      usageRecordId: external_exports.string().max(1e4).describe("The usage record ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')")
     }),
     handler: getHandler("/usage-records", "usageRecordId")
   },
@@ -22394,8 +22679,8 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionItemId: external_exports.string().optional().describe("Filter by subscription item ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')"),
+      subscriptionItemId: external_exports.string().max(1e4).optional().describe("Filter by subscription item ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22412,7 +22697,7 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      subscriptionItemId: external_exports.string().describe("The subscription item ID to report usage for"),
+      subscriptionItemId: external_exports.string().max(1e4).describe("The subscription item ID to report usage for"),
       quantity: external_exports.number().int().min(0).describe("The usage quantity to report"),
       action: external_exports.enum(["increment", "set"]).optional().describe("How to apply the quantity: 'increment' (add to current, default) or 'set' (replace current)")
     }),
@@ -22468,8 +22753,8 @@ var variantTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      variantId: external_exports.string().describe("The variant ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'product,files')")
+      variantId: external_exports.string().max(1e4).describe("The variant ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'product,files')")
     }),
     handler: getHandler("/variants", "variantId")
   },
@@ -22484,8 +22769,8 @@ var variantTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      productId: external_exports.string().optional().describe("Filter by product ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'product,files')"),
+      productId: external_exports.string().max(1e4).optional().describe("Filter by product ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'product,files')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22506,8 +22791,8 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      webhookId: external_exports.string().describe("The webhook ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store')")
+      webhookId: external_exports.string().max(1e4).describe("The webhook ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store')")
     }),
     handler: getHandler("/webhooks", "webhookId")
   },
@@ -22522,8 +22807,8 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().optional().describe("Filter by store ID"),
-      include: external_exports.string().optional().describe("Comma-separated related resources to include (e.g. 'store')"),
+      storeId: external_exports.string().max(1e4).optional().describe("Filter by store ID"),
+      include: external_exports.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store')"),
       pageNumber: external_exports.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
@@ -22540,8 +22825,8 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      storeId: external_exports.string().describe("The store ID"),
-      url: external_exports.string().describe("The URL to send webhook events to"),
+      storeId: external_exports.string().max(1e4).describe("The store ID"),
+      url: external_exports.string().max(1e4).describe("The URL to send webhook events to"),
       events: external_exports.array(external_exports.string()).describe(
         "Event types to subscribe to (e.g. ['order_created', 'subscription_created', 'subscription_updated', 'subscription_cancelled', 'subscription_payment_success', 'subscription_payment_failed', 'license_key_created'])"
       ),
@@ -22574,10 +22859,10 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      webhookId: external_exports.string().describe("The webhook ID to update"),
-      url: external_exports.string().optional().describe("New URL to send webhook events to"),
+      webhookId: external_exports.string().max(1e4).describe("The webhook ID to update"),
+      url: external_exports.string().max(1e4).optional().describe("New URL to send webhook events to"),
       events: external_exports.array(external_exports.string()).optional().describe("Updated list of event types to subscribe to"),
-      secret: external_exports.string().optional().describe("New signing secret")
+      secret: external_exports.string().max(1e4).optional().describe("New signing secret")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -22604,7 +22889,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      webhookId: external_exports.string().describe("The webhook ID to delete")
+      webhookId: external_exports.string().max(1e4).describe("The webhook ID to delete")
     }),
     handler: async (input) => {
       return apiDelete(`/webhooks/${input.webhookId}`);
@@ -22613,7 +22898,7 @@ var webhookTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.3.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.4.0" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -22647,15 +22932,31 @@ var server = new McpServer({
   version: version2
 });
 for (const tool of allTools) {
+  const isDestructive = tool.annotations?.destructiveHint === true;
   server.tool(
     tool.name,
     tool.description,
     tool.inputSchema.shape,
     tool.annotations,
     async (input) => {
+      const start = Date.now();
       try {
+        if (isDestructive) checkDestructiveRateLimit();
+        const storeId = input.storeId;
+        if (typeof storeId === "string") checkStoreAllowed(storeId);
         const result = await tool.handler(input);
         const response = result;
+        const latency_ms = Date.now() - start;
+        logEvent({
+          event: "tool_call",
+          tool: tool.name,
+          status: response.ok ? "ok" : "error",
+          latency_ms,
+          request_id: response.requestId,
+          error: response.ok ? void 0 : response.error,
+          audit: isDestructive ? true : void 0,
+          inputs: isDestructive ? input : void 0
+        });
         if (!response.ok) {
           return {
             content: [
@@ -22673,6 +22974,16 @@ for (const tool of allTools) {
         };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        const latency_ms = Date.now() - start;
+        logEvent({
+          event: "tool_call",
+          tool: tool.name,
+          status: err instanceof GuardrailError ? "guardrail_block" : "exception",
+          latency_ms,
+          error: message,
+          audit: isDestructive ? true : void 0,
+          inputs: isDestructive ? input : void 0
+        });
         return {
           content: [{ type: "text", text: `Error: ${message}` }],
           isError: true