@yawlabs/lemonsqueezy-mcp 0.6.2 → 0.7.0

package/README.md

@@ -173,11 +173,11 @@ All configuration is via environment variables. Only `LEMONSQUEEZY_API_KEY` (or
 | Variable | Purpose |
 | --- | --- |
 | `LEMONSQUEEZY_API_KEY` | LemonSqueezy API token. |
-| `LEMONSQUEEZY_API_KEY_COMMAND` | Command whose stdout produces the API key. Overrides `LEMONSQUEEZY_API_KEY`. Output is cached for 1 hour. Use this to pull short-lived credentials from a vault (`op read`, `gcloud secrets versions access`, etc.) without writing them to env vars. |
-| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_list_stores`) are not gated by this — pair with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` and `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT`. |
+| `LEMONSQUEEZY_API_KEY_COMMAND` | Command whose stdout produces the API key. Overrides `LEMONSQUEEZY_API_KEY`. Output is cached for 1 hour. Use this to pull short-lived credentials from a vault (`op read`, `gcloud secrets versions access`, etc.) without writing them to env vars. The cache is keyed by the command string, so changing it mid-process refreshes on the next request; it is also invalidated automatically on a 401/403 from the API, so a key rotated upstream takes effect on the next call without waiting for the TTL. |
+| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`, `ls_list_stores`) route by their own resource ID and are **not** gated by this allowlist. For those, the only authoritative store boundary is the API key itself — pair this setting with a LemonSqueezy API key scoped to the same store(s), and pair with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` for additional defense in depth. |
 | `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` | Rejects `ls_refund_order` and `ls_refund_subscription_invoice` calls above this amount. |
-| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include `ls_update_license_key` calls that set `disabled: true`. |
-| `LEMONSQUEEZY_LOG=json` | Emit one JSON log line to stderr per tool and HTTP call. Destructive calls are tagged `audit: true` and include their inputs. |
+| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include `ls_update_license_key` calls that set `disabled: true`, and `ls_update_subscription` calls that pause or switch plan. |
+| `LEMONSQUEEZY_LOG` | Structured-log verbosity to stderr. Set to `all` (or legacy `json`) to log every tool and HTTP call, `audit` to log only destructive-call audit entries plus errors (recommended for production), `error` to log only failures. Unset: no logs. Destructive calls are tagged `audit: true` and include their inputs. |
 
 ### Logging format
 
@@ -191,11 +191,11 @@ HTTP errors include the upstream `X-Request-Id` when present, so support tickets
 
 For unattended/agentic use against a live store, we recommend:
 
-1. Set `LEMONSQUEEZY_ALLOWED_STORE_IDS` to the specific store(s) the agent may touch.
+1. Use a LemonSqueezy API key scoped to the specific store(s) the agent may touch — this is the only authoritative store boundary for tools that route by their own resource ID (refunds, cancels, archive, delete-webhook, etc.). Set `LEMONSQUEEZY_ALLOWED_STORE_IDS` to the same set as a defense-in-depth gate on the tools that *do* take a `storeId`.
 2. Set `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` to a per-call cap well below any single-refund expectation.
 3. Set `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` to a small number (e.g. 5/min) as a runaway-agent circuit breaker.
-4. Set `LEMONSQUEEZY_LOG=json` and ship stderr to your log aggregator. Alert on `status: "guardrail_block"` or elevated error rates per tool.
-5. Run `LEMONSQUEEZY_API_KEY_COMMAND` against a vault-backed secret so credentials can rotate without restarting the server process.
+4. Set `LEMONSQUEEZY_LOG=audit` and ship stderr to your log aggregator. The `audit` level keeps every destructive-call entry plus errors but drops successful reads so log volume stays bounded over weeks of operation. Alert on `status: "guardrail_block"` or elevated error rates per tool. Use `LEMONSQUEEZY_LOG=all` while debugging.
+5. Run `LEMONSQUEEZY_API_KEY_COMMAND` against a vault-backed secret so credentials can rotate without restarting the server process. The API client invalidates its in-process key cache automatically on a 401/403, so a rotated upstream key picks up on the next request rather than waiting on the 1h TTL.
 
 What the server does **not** do and you must own at the caller level:
 

package/dist/index.js

@@ -30196,11 +30196,35 @@ function isDestructiveCall(tool, input) {
 }
 
 // src/logger.ts
-function isEnabled() {
-  return process.env.LEMONSQUEEZY_LOG === "json";
+function getLogLevel() {
+  const v = process.env.LEMONSQUEEZY_LOG;
+  if (v === "json" || v === "all") return "all";
+  if (v === "audit") return "audit";
+  if (v === "error") return "error";
+  return "off";
+}
+var ERROR_STATUS_TAGS = /* @__PURE__ */ new Set(["error", "exception", "guardrail_block", "timeout", "network_error"]);
+function isErrorEntry(entry) {
+  if (entry.error !== void 0) return true;
+  if (typeof entry.status === "string") return ERROR_STATUS_TAGS.has(entry.status);
+  if (typeof entry.status === "number") return entry.status >= 400;
+  return false;
+}
+function shouldLog(entry, level) {
+  switch (level) {
+    case "off":
+      return false;
+    case "all":
+      return true;
+    case "audit":
+      return entry.audit === true || isErrorEntry(entry);
+    case "error":
+      return isErrorEntry(entry);
+  }
 }
 function logEvent(entry) {
-  if (!isEnabled()) return;
+  const level = getLogLevel();
+  if (!shouldLog(entry, level)) return;
   try {
     const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
     process.stderr.write(`${line}
@@ -30330,10 +30354,21 @@ function parseCommand(cmd) {
   if (parts.length === 0) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND is empty");
   return { command: parts[0], args: parts.slice(1) };
 }
+function fromCache(fingerprint) {
+  if (cached2 && cached2.fingerprint === fingerprint && cached2.expiresAt > Date.now()) {
+    return cached2.key;
+  }
+  return null;
+}
+function intoCache(fingerprint, key) {
+  cached2 = { fingerprint, key, expiresAt: Date.now() + CACHE_TTL_MS };
+}
 async function loadApiKey() {
-  if (cached2 && cached2.expiresAt > Date.now()) return cached2.key;
   const cmdStr = process.env.LEMONSQUEEZY_API_KEY_COMMAND;
   if (cmdStr && cmdStr.trim() !== "") {
+    const fingerprint2 = `cmd:${cmdStr}`;
+    const hit2 = fromCache(fingerprint2);
+    if (hit2 !== null) return hit2;
     const { command, args } = parseCommand(cmdStr);
     let stdout;
     try {
@@ -30346,23 +30381,31 @@ async function loadApiKey() {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(`LEMONSQUEEZY_API_KEY_COMMAND failed: ${msg}`);
     }
-    const key2 = stdout.trim();
-    if (!key2) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND produced empty output");
-    cached2 = { key: key2, expiresAt: Date.now() + CACHE_TTL_MS };
-    return key2;
+    const key = stdout.trim();
+    if (!key) throw new Error("LEMONSQUEEZY_API_KEY_COMMAND produced empty output");
+    intoCache(fingerprint2, key);
+    return key;
   }
-  const key = process.env.LEMONSQUEEZY_API_KEY;
-  if (!key) {
+  const raw = process.env.LEMONSQUEEZY_API_KEY;
+  if (!raw) {
     throw new Error("LEMONSQUEEZY_API_KEY or LEMONSQUEEZY_API_KEY_COMMAND environment variable is required.");
   }
-  if (key.trim() === "") {
+  if (raw.trim() === "") {
     throw new Error("LEMONSQUEEZY_API_KEY is set but empty. Provide a valid API key.");
   }
-  return key;
+  const fingerprint = `env:${raw}`;
+  const hit = fromCache(fingerprint);
+  if (hit !== null) return hit;
+  intoCache(fingerprint, raw);
+  return raw;
+}
+function invalidateApiKeyCache() {
+  cached2 = null;
 }
 
 // src/api.ts
 var BASE_URL = "https://api.lemonsqueezy.com/v1";
+var lsIdSchema = external_exports3.string().max(1e4).regex(/^[1-9]\d*$/, "ID must be a positive integer string (e.g. '12345')");
 function encodePath(segment) {
   return encodeURIComponent(String(segment));
 }
@@ -30421,6 +30464,9 @@ async function apiRequest(method, path, body) {
   const latency_ms = Date.now() - start;
   const requestId = res.headers.get("x-request-id") ?? void 0;
   if (!res.ok) {
+    if (res.status === 401 || res.status === 403) {
+      invalidateApiKeyCache();
+    }
     const errorBody = await res.text();
     try {
       const parsed = JSON.parse(errorBody);
@@ -30610,7 +30656,7 @@ var affiliateTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      affiliateId: external_exports3.string().max(1e4).describe("The affiliate ID"),
+      affiliateId: lsIdSchema.describe("The affiliate ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,user')")
     }),
     handler: getHandler("/affiliates", "affiliateId")
@@ -30648,7 +30694,7 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      checkoutId: external_exports3.string().max(1e4).describe("The checkout ID"),
+      checkoutId: lsIdSchema.describe("The checkout ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variant')")
     }),
     handler: getHandler("/checkouts", "checkoutId")
@@ -30664,8 +30710,8 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
-      variantId: external_exports3.string().max(1e4).optional().describe("Filter by variant ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
+      variantId: lsIdSchema.optional().describe("Filter by variant ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variant')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -30683,10 +30729,10 @@ var checkoutTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).describe("The store ID"),
-      variantId: external_exports3.string().max(1e4).describe("The variant ID for the product being purchased"),
+      storeId: lsIdSchema.describe("The store ID"),
+      variantId: lsIdSchema.describe("The variant ID for the product being purchased"),
       customPrice: external_exports3.number().int().min(0).optional().describe("Custom price in cents (overrides the variant price)"),
-      enabledVariants: external_exports3.array(external_exports3.string()).optional().describe("Array of variant IDs to show on the checkout (for products with multiple variants)"),
+      enabledVariants: external_exports3.array(lsIdSchema).optional().describe("Array of variant IDs to show on the checkout (for products with multiple variants)"),
       email: external_exports3.string().max(1e4).optional().describe("Prefill customer email"),
       name: external_exports3.string().max(1e4).optional().describe("Prefill customer name"),
       billingAddressCountry: external_exports3.string().max(1e4).optional().describe("Prefill billing country (ISO 3166-1 alpha-2)"),
@@ -30743,7 +30789,7 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      customerId: external_exports3.string().max(1e4).describe("The customer ID"),
+      customerId: lsIdSchema.describe("The customer ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')")
     }),
     handler: getHandler("/customers", "customerId")
@@ -30759,7 +30805,7 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
       email: external_exports3.string().email().max(320).optional().describe("Filter by customer email"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,orders,subscriptions,license-keys')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
@@ -30778,7 +30824,7 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).describe("The store ID to create the customer in"),
+      storeId: lsIdSchema.describe("The store ID to create the customer in"),
       name: external_exports3.string().max(1e4).describe("Customer's full name"),
       email: external_exports3.string().email().max(320).describe("Customer's email address"),
       city: external_exports3.string().max(1e4).optional().describe("Customer's city"),
@@ -30806,7 +30852,7 @@ var customerTools = [
   },
   {
     name: "ls_update_customer",
-    description: "Update an existing customer's name, email, city, region, country, or status.",
+    description: "Update an existing customer's name, email, city, region, country, or status. The only supported status value is 'archived' \u2014 use ls_archive_customer for the dedicated, audit-tagged path.",
     annotations: {
       title: "Update customer",
       readOnlyHint: false,
@@ -30818,16 +30864,19 @@ var customerTools = [
     // ls_archive_customer and must engage the same rate limiter / audit log;
     // otherwise the dedicated archive tool's destructive flag becomes a side
     // channel anyone can route around. Other field edits (name, email,
-    // address) stay on the regular path.
+    // address) stay on the regular path. The schema constrains `status` to
+    // the literal "archived" so a typo ("archive", "Archived") fails at
+    // validation rather than slipping past the predicate as a non-destructive
+    // PATCH that the API would 422 anyway.
     isDestructive: (input) => input.status === "archived",
     inputSchema: external_exports3.object({
-      customerId: external_exports3.string().max(1e4).describe("The customer ID to update"),
+      customerId: lsIdSchema.describe("The customer ID to update"),
       name: external_exports3.string().max(1e4).optional().describe("New name"),
       email: external_exports3.string().email().max(320).optional().describe("New email"),
       city: external_exports3.string().max(1e4).optional().describe("New city"),
       region: external_exports3.string().max(1e4).optional().describe("New region/state"),
       country: external_exports3.string().max(1e4).optional().describe("New country (ISO 3166-1 alpha-2 code)"),
-      status: external_exports3.string().max(1e4).optional().describe("New status ('archived' to archive the customer)")
+      status: external_exports3.literal("archived").optional().describe("Set to 'archived' to archive the customer. Equivalent to calling ls_archive_customer.")
     }),
     handler: async (input) => {
       const attributes = {};
@@ -30857,7 +30906,7 @@ var customerTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      customerId: external_exports3.string().max(1e4).describe("The customer ID to archive")
+      customerId: lsIdSchema.describe("The customer ID to archive")
     }),
     handler: async (input) => {
       return apiPatch(`/customers/${encodePath(input.customerId)}`, {
@@ -30884,7 +30933,7 @@ var discountRedemptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      discountRedemptionId: external_exports3.string().max(1e4).describe("The discount redemption ID"),
+      discountRedemptionId: lsIdSchema.describe("The discount redemption ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'discount,order')")
     }),
     handler: getHandler("/discount-redemptions", "discountRedemptionId")
@@ -30900,8 +30949,8 @@ var discountRedemptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      discountId: external_exports3.string().max(1e4).optional().describe("Filter by discount ID"),
-      orderId: external_exports3.string().max(1e4).optional().describe("Filter by order ID"),
+      discountId: lsIdSchema.optional().describe("Filter by discount ID"),
+      orderId: lsIdSchema.optional().describe("Filter by order ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'discount,order')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -30923,7 +30972,7 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      discountId: external_exports3.string().max(1e4).describe("The discount ID"),
+      discountId: lsIdSchema.describe("The discount ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')")
     }),
     handler: getHandler("/discounts", "discountId")
@@ -30939,7 +30988,7 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants,discount-redemptions')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -30957,7 +31006,7 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).describe("The store ID to create the discount in"),
+      storeId: lsIdSchema.describe("The store ID to create the discount in"),
       name: external_exports3.string().max(1e4).describe("Internal name for the discount"),
       code: external_exports3.string().max(1e4).describe("The discount code customers will enter (e.g. 'SAVE20')"),
       amount: external_exports3.number().int().min(1).describe(
@@ -30972,7 +31021,7 @@ var discountTools = [
       startsAt: external_exports3.string().max(1e4).optional().describe("When the discount becomes active (ISO 8601 format)"),
       expiresAt: external_exports3.string().max(1e4).optional().describe("When the discount expires (ISO 8601 format)"),
       isLimitedToProducts: external_exports3.boolean().optional().describe("If true, the discount only applies to specific variants (set via variantIds)"),
-      variantIds: external_exports3.array(external_exports3.string()).optional().describe("Array of variant IDs this discount applies to (requires isLimitedToProducts: true)")
+      variantIds: external_exports3.array(lsIdSchema).optional().describe("Array of variant IDs this discount applies to (requires isLimitedToProducts: true)")
     }),
     handler: async (input) => {
       const attributes = {
@@ -31015,7 +31064,7 @@ var discountTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      discountId: external_exports3.string().max(1e4).describe("The discount ID to delete")
+      discountId: lsIdSchema.describe("The discount ID to delete")
     }),
     handler: async (input) => {
       return apiDelete(`/discounts/${encodePath(input.discountId)}`);
@@ -31036,7 +31085,7 @@ var fileTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      fileId: external_exports3.string().max(1e4).describe("The file ID"),
+      fileId: lsIdSchema.describe("The file ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')")
     }),
     handler: getHandler("/files", "fileId")
@@ -31052,7 +31101,7 @@ var fileTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      variantId: external_exports3.string().max(1e4).optional().describe("Filter by variant ID"),
+      variantId: lsIdSchema.optional().describe("Filter by variant ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31074,7 +31123,7 @@ var licenseKeyInstanceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      licenseKeyInstanceId: external_exports3.string().max(1e4).describe("The license key instance ID"),
+      licenseKeyInstanceId: lsIdSchema.describe("The license key instance ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'license-key')")
     }),
     handler: getHandler("/license-key-instances", "licenseKeyInstanceId")
@@ -31090,7 +31139,7 @@ var licenseKeyInstanceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      licenseKeyId: external_exports3.string().max(1e4).optional().describe("Filter by license key ID"),
+      licenseKeyId: lsIdSchema.optional().describe("Filter by license key ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'license-key')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31112,7 +31161,7 @@ var licenseKeyTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      licenseKeyId: external_exports3.string().max(1e4).describe("The license key ID"),
+      licenseKeyId: lsIdSchema.describe("The license key ID"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,license-key-instances')"
       )
@@ -31130,10 +31179,10 @@ var licenseKeyTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
-      orderId: external_exports3.string().max(1e4).optional().describe("Filter by order ID"),
-      orderItemId: external_exports3.string().max(1e4).optional().describe("Filter by order item ID"),
-      productId: external_exports3.string().max(1e4).optional().describe("Filter by product ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
+      orderId: lsIdSchema.optional().describe("Filter by order ID"),
+      orderItemId: lsIdSchema.optional().describe("Filter by order item ID"),
+      productId: lsIdSchema.optional().describe("Filter by product ID"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,license-key-instances')"
       ),
@@ -31163,7 +31212,7 @@ var licenseKeyTools = [
     // on the regular path.
     isDestructive: (input) => input.disabled === true,
     inputSchema: external_exports3.object({
-      licenseKeyId: external_exports3.string().max(1e4).describe("The license key ID to update"),
+      licenseKeyId: lsIdSchema.describe("The license key ID to update"),
       activationLimit: external_exports3.number().int().min(0).optional().describe("Maximum number of activations allowed (0 = unlimited)"),
       disabled: external_exports3.boolean().optional().describe("Set to true to disable this license key"),
       expiresAt: external_exports3.string().max(1e4).nullable().optional().describe("Expiry date (ISO 8601 format). Set to null to remove expiry.")
@@ -31263,7 +31312,7 @@ var orderItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      orderItemId: external_exports3.string().max(1e4).describe("The order item ID"),
+      orderItemId: lsIdSchema.describe("The order item ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')")
     }),
     handler: getHandler("/order-items", "orderItemId")
@@ -31279,9 +31328,9 @@ var orderItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      orderId: external_exports3.string().max(1e4).optional().describe("Filter by order ID"),
-      productId: external_exports3.string().max(1e4).optional().describe("Filter by product ID"),
-      variantId: external_exports3.string().max(1e4).optional().describe("Filter by variant ID"),
+      orderId: lsIdSchema.optional().describe("Filter by order ID"),
+      productId: lsIdSchema.optional().describe("Filter by product ID"),
+      variantId: lsIdSchema.optional().describe("Filter by variant ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'order,product,variant')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31303,7 +31352,7 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      orderId: external_exports3.string().max(1e4).describe("The order ID"),
+      orderId: lsIdSchema.describe("The order ID"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order-items,subscriptions,license-keys,discount-redemptions')"
       )
@@ -31321,7 +31370,7 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
       userEmail: external_exports3.string().email().max(320).optional().describe("Filter by user email"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order-items,subscriptions,license-keys,discount-redemptions')"
@@ -31342,7 +31391,7 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      orderId: external_exports3.string().max(1e4).describe("The order ID"),
+      orderId: lsIdSchema.describe("The order ID"),
       name: external_exports3.string().max(1e4).optional().describe("Customer name on the invoice"),
       address: external_exports3.string().max(1e4).optional().describe("Customer address on the invoice"),
       city: external_exports3.string().max(1e4).optional().describe("Customer city"),
@@ -31377,7 +31426,7 @@ var orderTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      orderId: external_exports3.string().max(1e4).describe("The order ID to refund"),
+      orderId: lsIdSchema.describe("The order ID to refund"),
       amount: external_exports3.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
     handler: async (input) => {
@@ -31402,7 +31451,7 @@ var priceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      priceId: external_exports3.string().max(1e4).describe("The price ID"),
+      priceId: lsIdSchema.describe("The price ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')")
     }),
     handler: getHandler("/prices", "priceId")
@@ -31418,7 +31467,7 @@ var priceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      variantId: external_exports3.string().max(1e4).optional().describe("Filter by variant ID"),
+      variantId: lsIdSchema.optional().describe("Filter by variant ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'variant')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31440,7 +31489,7 @@ var productTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      productId: external_exports3.string().max(1e4).describe("The product ID"),
+      productId: lsIdSchema.describe("The product ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants')")
     }),
     handler: getHandler("/products", "productId")
@@ -31456,7 +31505,7 @@ var productTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,variants')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31478,7 +31527,7 @@ var storeTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).describe("The store ID"),
+      storeId: lsIdSchema.describe("The store ID"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'products,discounts,license-keys,subscriptions,webhooks')"
       )
@@ -31519,7 +31568,7 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionInvoiceId: external_exports3.string().max(1e4).describe("The subscription invoice ID"),
+      subscriptionInvoiceId: lsIdSchema.describe("The subscription invoice ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')")
     }),
     handler: getHandler("/subscription-invoices", "subscriptionInvoiceId")
@@ -31535,8 +31584,8 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
-      subscriptionId: external_exports3.string().max(1e4).optional().describe("Filter by subscription ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
+      subscriptionId: lsIdSchema.optional().describe("Filter by subscription ID"),
       status: external_exports3.enum(["pending", "paid", "void", "refunded"]).optional().describe("Filter by invoice status"),
       refunded: external_exports3.boolean().optional().describe("Filter by refunded status"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store,subscription')"),
@@ -31561,7 +31610,7 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionInvoiceId: external_exports3.string().max(1e4).describe("The subscription invoice ID"),
+      subscriptionInvoiceId: lsIdSchema.describe("The subscription invoice ID"),
       name: external_exports3.string().max(1e4).optional().describe("Customer name on the invoice"),
       address: external_exports3.string().max(1e4).optional().describe("Customer address on the invoice"),
       city: external_exports3.string().max(1e4).optional().describe("Customer city"),
@@ -31598,7 +31647,7 @@ var subscriptionInvoiceTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionInvoiceId: external_exports3.string().max(1e4).describe("The subscription invoice ID to refund"),
+      subscriptionInvoiceId: lsIdSchema.describe("The subscription invoice ID to refund"),
       amount: external_exports3.number().int().min(1).describe("Refund amount in cents (e.g. 1000 = $10.00)")
     }),
     handler: async (input) => {
@@ -31627,7 +31676,7 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionItemId: external_exports3.string().max(1e4).describe("The subscription item ID"),
+      subscriptionItemId: lsIdSchema.describe("The subscription item ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')")
     }),
     handler: getHandler("/subscription-items", "subscriptionItemId")
@@ -31643,8 +31692,8 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionId: external_exports3.string().max(1e4).optional().describe("Filter by subscription ID"),
-      priceId: external_exports3.string().max(1e4).optional().describe("Filter by price ID"),
+      subscriptionId: lsIdSchema.optional().describe("Filter by subscription ID"),
+      priceId: lsIdSchema.optional().describe("Filter by price ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription,price,usage-records')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31662,7 +31711,7 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionItemId: external_exports3.string().max(1e4).describe("The subscription item ID to update"),
+      subscriptionItemId: lsIdSchema.describe("The subscription item ID to update"),
       quantity: external_exports3.number().int().min(1).describe("New quantity for the subscription item")
     }),
     handler: async (input) => {
@@ -31686,7 +31735,7 @@ var subscriptionItemTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionItemId: external_exports3.string().max(1e4).describe("The subscription item ID")
+      subscriptionItemId: lsIdSchema.describe("The subscription item ID")
     }),
     handler: async (input) => {
       return apiGet(`/subscription-items/${encodePath(input.subscriptionItemId)}/current-usage`);
@@ -31707,7 +31756,7 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionId: external_exports3.string().max(1e4).describe("The subscription ID"),
+      subscriptionId: lsIdSchema.describe("The subscription ID"),
       include: external_exports3.string().max(1e4).optional().describe(
         "Comma-separated related resources to include (e.g. 'store,customer,order,order-item,product,variant,subscription-items,subscription-invoices')"
       )
@@ -31725,11 +31774,11 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
-      orderId: external_exports3.string().max(1e4).optional().describe("Filter by order ID"),
-      orderItemId: external_exports3.string().max(1e4).optional().describe("Filter by order item ID"),
-      productId: external_exports3.string().max(1e4).optional().describe("Filter by product ID"),
-      variantId: external_exports3.string().max(1e4).optional().describe("Filter by variant ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
+      orderId: lsIdSchema.optional().describe("Filter by order ID"),
+      orderItemId: lsIdSchema.optional().describe("Filter by order item ID"),
+      productId: lsIdSchema.optional().describe("Filter by product ID"),
+      variantId: lsIdSchema.optional().describe("Filter by variant ID"),
       userEmail: external_exports3.string().email().max(320).optional().describe("Filter by user email"),
       status: external_exports3.enum(["on_trial", "active", "paused", "past_due", "unpaid", "cancelled", "expired"]).optional().describe("Filter by subscription status"),
       include: external_exports3.string().max(1e4).optional().describe(
@@ -31770,8 +31819,8 @@ var subscriptionTools = [
     //   - disableProrations         toggle on plan-change behavior
     isDestructive: (input) => typeof input.pause === "string" && input.pause !== "resume" || typeof input.variantId === "string",
     inputSchema: external_exports3.object({
-      subscriptionId: external_exports3.string().max(1e4).describe("The subscription ID to update"),
-      variantId: external_exports3.string().max(1e4).regex(/^[1-9]\d*$/, "variantId must be a positive integer string (e.g. '12345')").optional().describe("New variant ID for plan switching"),
+      subscriptionId: lsIdSchema.describe("The subscription ID to update"),
+      variantId: lsIdSchema.optional().describe("New variant ID for plan switching"),
       pause: external_exports3.enum(["void", "free", "resume"]).optional().describe("Pause mode: 'void' (pause, skip billing), 'free' (pause, keep access free), or 'resume' to unpause"),
       cancelled: external_exports3.literal(false).optional().describe(
         "Set to false to un-cancel a subscription before it expires. To cancel, use ls_cancel_subscription instead."
@@ -31810,7 +31859,7 @@ var subscriptionTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionId: external_exports3.string().max(1e4).describe("The subscription ID to cancel")
+      subscriptionId: lsIdSchema.describe("The subscription ID to cancel")
     }),
     handler: async (input) => {
       return apiDelete(`/subscriptions/${encodePath(input.subscriptionId)}`);
@@ -31831,7 +31880,7 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      usageRecordId: external_exports3.string().max(1e4).describe("The usage record ID"),
+      usageRecordId: lsIdSchema.describe("The usage record ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')")
     }),
     handler: getHandler("/usage-records", "usageRecordId")
@@ -31847,7 +31896,7 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionItemId: external_exports3.string().max(1e4).optional().describe("Filter by subscription item ID"),
+      subscriptionItemId: lsIdSchema.optional().describe("Filter by subscription item ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'subscription-item')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31868,7 +31917,7 @@ var usageRecordTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      subscriptionItemId: external_exports3.string().max(1e4).describe("The subscription item ID to report usage for"),
+      subscriptionItemId: lsIdSchema.describe("The subscription item ID to report usage for"),
       quantity: external_exports3.number().int().min(0).describe("The usage quantity to report"),
       action: external_exports3.enum(["increment", "set"]).optional().describe("How to apply the quantity: 'increment' (add to current, default) or 'set' (replace current)")
     }),
@@ -31924,7 +31973,7 @@ var variantTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      variantId: external_exports3.string().max(1e4).describe("The variant ID"),
+      variantId: lsIdSchema.describe("The variant ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'product,files')")
     }),
     handler: getHandler("/variants", "variantId")
@@ -31940,7 +31989,7 @@ var variantTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      productId: external_exports3.string().max(1e4).optional().describe("Filter by product ID"),
+      productId: lsIdSchema.optional().describe("Filter by product ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'product,files')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31962,7 +32011,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      webhookId: external_exports3.string().max(1e4).describe("The webhook ID"),
+      webhookId: lsIdSchema.describe("The webhook ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store')")
     }),
     handler: getHandler("/webhooks", "webhookId")
@@ -31978,7 +32027,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).optional().describe("Filter by store ID"),
+      storeId: lsIdSchema.optional().describe("Filter by store ID"),
       include: external_exports3.string().max(1e4).optional().describe("Comma-separated related resources to include (e.g. 'store')"),
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
@@ -31996,7 +32045,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      storeId: external_exports3.string().max(1e4).describe("The store ID"),
+      storeId: lsIdSchema.describe("The store ID"),
       url: external_exports3.string().max(1e4).describe("The URL to send webhook events to"),
       events: external_exports3.array(external_exports3.string()).describe(
         "Event types to subscribe to (e.g. ['order_created', 'subscription_created', 'subscription_updated', 'subscription_cancelled', 'subscription_payment_success', 'subscription_payment_failed', 'license_key_created'])"
@@ -32030,7 +32079,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      webhookId: external_exports3.string().max(1e4).describe("The webhook ID to update"),
+      webhookId: lsIdSchema.describe("The webhook ID to update"),
       url: external_exports3.string().max(1e4).optional().describe("New URL to send webhook events to"),
       events: external_exports3.array(external_exports3.string()).optional().describe("Updated list of event types to subscribe to"),
       secret: external_exports3.string().min(6).max(40).optional().describe("New signing secret")
@@ -32060,7 +32109,7 @@ var webhookTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      webhookId: external_exports3.string().max(1e4).describe("The webhook ID to delete")
+      webhookId: lsIdSchema.describe("The webhook ID to delete")
     }),
     handler: async (input) => {
       return apiDelete(`/webhooks/${encodePath(input.webhookId)}`);
@@ -32069,7 +32118,7 @@ var webhookTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.6.2" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.7.0" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",