@yawlabs/lemonsqueezy-mcp 0.7.0 → 0.7.1

package/dist/index.js

@@ -30179,15 +30179,29 @@ function checkDestructiveRateLimit(now = Date.now()) {
 function isStoreAllowlistActive() {
   return loadOptions().allowedStoreIds !== null;
 }
-function checkStoreScopedToolInput(toolAcceptsStoreId, input) {
-  if (!toolAcceptsStoreId) return;
-  const raw = input.storeId;
-  if (raw !== void 0 && raw !== null && raw !== "") {
-    checkStoreAllowed(String(raw));
-    return;
-  }
-  if (isStoreAllowlistActive()) {
-    throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
+function isPresent(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string" && value === "") return false;
+  if (Array.isArray(value) && value.length === 0) return false;
+  return true;
+}
+function checkStoreScopedToolInput(tool, input) {
+  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
+  if (toolAcceptsStoreId) {
+    const raw = input.storeId;
+    if (raw !== void 0 && raw !== null && raw !== "") {
+      checkStoreAllowed(String(raw));
+    } else if (isStoreAllowlistActive()) {
+      throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
+    }
+  }
+  if (tool.requiredFilters && tool.requiredFilters.length > 0 && isStoreAllowlistActive()) {
+    const anyPresent = tool.requiredFilters.some((key) => isPresent(input[key]));
+    if (!anyPresent) {
+      throw new GuardrailError(
+        `At least one of [${tool.requiredFilters.join(", ")}] is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set`
+      );
+    }
   }
 }
 function isDestructiveCall(tool, input) {
@@ -30252,10 +30266,46 @@ function logEvent(entry) {
   }
 }
 
+// src/redact.ts
+var SECRET_KEY_RE = /^(secret|password|token|api[_-]?key|bearer|authorization|signing[_-]?secret)$/i;
+var REDACTED = "[REDACTED]";
+var CIRCULAR = "[CIRCULAR]";
+var MAX_DEPTH = 32;
+function isPlainObject3(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function redactInner(value, visited, depth) {
+  if (depth > MAX_DEPTH) return CIRCULAR;
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) {
+    if (visited.has(value)) return CIRCULAR;
+    visited.add(value);
+    return value.map((item) => redactInner(item, visited, depth + 1));
+  }
+  if (!isPlainObject3(value)) return value;
+  if (visited.has(value)) return CIRCULAR;
+  visited.add(value);
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (SECRET_KEY_RE.test(key)) {
+      out[key] = REDACTED;
+    } else {
+      out[key] = redactInner(val, visited, depth + 1);
+    }
+  }
+  return out;
+}
+function redactSecrets(input) {
+  return redactInner(input, /* @__PURE__ */ new WeakSet(), 0);
+}
+
 // src/retry.ts
 var REQUEST_TIMEOUT_MS = 3e4;
 var DEFAULT_RETRY_WAIT_MS = 1e3;
 var MAX_RETRY_WAIT_MS = 3e4;
+var OVERALL_DEADLINE_MS = 9e4;
 var DEFAULT_MAX_ATTEMPTS = 4;
 var BASE_BACKOFF_MS = 250;
 var JITTER_FRACTION = 0.25;
@@ -30275,6 +30325,19 @@ function isAbortTimeoutError(err) {
   const e = err;
   return e.name === "TimeoutError" || e.name === "AbortError" || e.code === "ABORT_ERR";
 }
+function isRetryTimeoutError(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  return e.name === "TimeoutError" && typeof e.elapsedMs === "number" && typeof e.attempts === "number";
+}
+function makeRetryTimeoutError(elapsedMs, attempts, cause) {
+  const err = new Error("Request timed out");
+  err.name = "TimeoutError";
+  err.elapsedMs = elapsedMs;
+  err.attempts = attempts;
+  if (cause !== void 0) err.cause = cause;
+  return err;
+}
 function backoffDelay(attempt, rand = Math.random) {
   const base = BASE_BACKOFF_MS * 2 ** (attempt - 1);
   const jitter = rand() * base * JITTER_FRACTION;
@@ -30286,31 +30349,54 @@ async function fetchWithRetry(url2, init, opts) {
   const sleep = opts.sleep ?? defaultSleep;
   const fetchImpl = opts.fetchImpl ?? fetch;
   const rand = opts.rand ?? Math.random;
+  const deadlineMs = opts.deadlineMs ?? OVERALL_DEADLINE_MS;
+  const now = opts.now ?? Date.now;
+  const startedAt = now();
+  const deadlineAt = startedAt + deadlineMs;
+  let attempts = 0;
   let lastError;
+  let lastResponse;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    if (attempt > 1 && now() >= deadlineAt) {
+      if (lastResponse) return lastResponse;
+      throw makeRetryTimeoutError(now() - startedAt, attempts, lastError);
+    }
+    attempts = attempt;
     try {
       const res = await fetchImpl(url2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+      lastResponse = res;
       if (res.status === 429) {
         if (attempt === maxAttempts) return res;
         const waitMs = parseRetryAfterMs(res.headers.get("retry-after"));
         if (waitMs > MAX_RETRY_WAIT_MS) return res;
+        if (now() + waitMs >= deadlineAt) return res;
         await sleep(waitMs);
         continue;
       }
       if (res.status >= 500 && res.status < 600 && opts.idempotent && attempt < maxAttempts) {
-        await sleep(backoffDelay(attempt, rand));
+        const waitMs = backoffDelay(attempt, rand);
+        if (now() + waitMs >= deadlineAt) return res;
+        await sleep(waitMs);
         continue;
       }
       return res;
     } catch (err) {
       lastError = err;
       if (isAbortTimeoutError(err)) {
-        if (!opts.idempotent || attempt === maxAttempts) throw err;
-        await sleep(backoffDelay(attempt, rand));
+        if (!opts.idempotent || attempt === maxAttempts) {
+          throw makeRetryTimeoutError(now() - startedAt, attempts, err);
+        }
+        const waitMs = backoffDelay(attempt, rand);
+        if (now() + waitMs >= deadlineAt) {
+          throw makeRetryTimeoutError(now() - startedAt, attempts, err);
+        }
+        await sleep(waitMs);
         continue;
       }
       if (err instanceof TypeError && opts.idempotent && attempt < maxAttempts) {
-        await sleep(backoffDelay(attempt, rand));
+        const waitMs = backoffDelay(attempt, rand);
+        if (now() + waitMs >= deadlineAt) throw err;
+        await sleep(waitMs);
         continue;
       }
       throw err;
@@ -30433,6 +30519,14 @@ function buildQuery(params) {
 function decorateError(error48, requestId) {
   return requestId ? `${error48} (request_id: ${requestId})` : error48;
 }
+function formatTimeoutMessage(err, fallbackElapsedMs) {
+  if (isRetryTimeoutError(err)) {
+    const seconds2 = Math.max(1, Math.round(err.elapsedMs / 1e3));
+    return `Request timed out after ${seconds2}s (${err.attempts} attempts)`;
+  }
+  const seconds = Math.max(1, Math.round(fallbackElapsedMs / 1e3));
+  return `Request timed out after ${seconds}s (1 attempts)`;
+}
 async function apiRequest(method, path, body) {
   const start = Date.now();
   const apiKey = await loadApiKey();
@@ -30453,7 +30547,7 @@ async function apiRequest(method, path, body) {
   } catch (err) {
     const latency_ms2 = Date.now() - start;
     if (isAbortTimeoutError(err)) {
-      const error48 = `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s`;
+      const error48 = formatTimeoutMessage(err, latency_ms2);
       logEvent({ event: "http_call", method, path, status: "timeout", latency_ms: latency_ms2, error: error48 });
       return { ok: false, status: 0, error: error48 };
     }
@@ -30540,7 +30634,7 @@ async function licenseRequest(path, body) {
   } catch (err) {
     const latency_ms2 = Date.now() - start;
     if (isAbortTimeoutError(err)) {
-      const error48 = `Request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s`;
+      const error48 = formatTimeoutMessage(err, latency_ms2);
       logEvent({ event: "http_call", method: "POST", path, status: "timeout", latency_ms: latency_ms2, error: error48 });
       return { ok: false, status: 0, error: error48 };
     }
@@ -30663,7 +30757,7 @@ var affiliateTools = [
   },
   {
     name: "ls_list_affiliates",
-    description: "List all affiliates for the authenticated user's stores, optionally filtered by user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all affiliates for the authenticated user's stores, optionally filtered by user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool can still return affiliates tied to non-allowed stores -- the endpoint has no parent ID filter to scope by. Pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List affiliates",
       readOnlyHint: true,
@@ -30733,7 +30827,7 @@ var checkoutTools = [
       variantId: lsIdSchema.describe("The variant ID for the product being purchased"),
       customPrice: external_exports3.number().int().min(0).optional().describe("Custom price in cents (overrides the variant price)"),
       enabledVariants: external_exports3.array(lsIdSchema).optional().describe("Array of variant IDs to show on the checkout (for products with multiple variants)"),
-      email: external_exports3.string().max(1e4).optional().describe("Prefill customer email"),
+      email: external_exports3.string().email().max(320).optional().describe("Prefill customer email"),
       name: external_exports3.string().max(1e4).optional().describe("Prefill customer name"),
       billingAddressCountry: external_exports3.string().max(1e4).optional().describe("Prefill billing country (ISO 3166-1 alpha-2)"),
       billingAddressZip: external_exports3.string().max(1e4).optional().describe("Prefill billing ZIP/postal code"),
@@ -30940,7 +31034,7 @@ var discountRedemptionTools = [
   },
   {
     name: "ls_list_discount_redemptions",
-    description: "List all discount redemptions, optionally filtered by discount or order. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all discount redemptions, optionally filtered by discount or order. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: discountId, orderId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List discount redemptions",
       readOnlyHint: true,
@@ -30955,6 +31049,7 @@ var discountRedemptionTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["discountId", "orderId"],
     handler: listHandler("/discount-redemptions", { discountId: "discount_id", orderId: "order_id" })
   }
 ];
@@ -31092,7 +31187,7 @@ var fileTools = [
   },
   {
     name: "ls_list_files",
-    description: "List all files, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all files, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List files",
       readOnlyHint: true,
@@ -31106,6 +31201,7 @@ var fileTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["variantId"],
     handler: listHandler("/files", { variantId: "variant_id" })
   }
 ];
@@ -31130,7 +31226,7 @@ var licenseKeyInstanceTools = [
   },
   {
     name: "ls_list_license_key_instances",
-    description: "List all license key instances (activations), optionally filtered by license key. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all license key instances (activations), optionally filtered by license key. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: licenseKeyId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List license key instances",
       readOnlyHint: true,
@@ -31144,6 +31240,7 @@ var licenseKeyInstanceTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["licenseKeyId"],
     handler: listHandler("/license-key-instances", { licenseKeyId: "license_key_id" })
   }
 ];
@@ -31206,11 +31303,14 @@ var licenseKeyTools = [
       idempotentHint: true,
       openWorldHint: true
     },
-    // Disabling a license key revokes a customer's access. Tag the call as
-    // destructive only when `disabled: true` so the rate limiter and audit log
-    // engage on revocation, while benign edits (expiry, activation limit) stay
-    // on the regular path.
-    isDestructive: (input) => input.disabled === true,
+    // Disabling a license key revokes a customer's access outright. Changing
+    // the activation limit can also revoke access -- setting it to 0, or to
+    // any value below the customer's current activation count, kicks
+    // already-activated instances offline. We can't tell from the input alone
+    // whether a given limit change shrinks or grows, so treat ANY
+    // `activationLimit` change as destructive alongside `disabled: true`.
+    // Benign edits (expiry) stay on the regular path.
+    isDestructive: (input) => input.disabled === true || input.activationLimit !== void 0,
     inputSchema: external_exports3.object({
       licenseKeyId: lsIdSchema.describe("The license key ID to update"),
       activationLimit: external_exports3.number().int().min(0).optional().describe("Maximum number of activations allowed (0 = unlimited)"),
@@ -31319,7 +31419,7 @@ var orderItemTools = [
   },
   {
     name: "ls_list_order_items",
-    description: "List all order items, optionally filtered by order or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all order items, optionally filtered by order or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: orderId, productId, variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List order items",
       readOnlyHint: true,
@@ -31335,6 +31435,7 @@ var orderItemTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["orderId", "productId", "variantId"],
     handler: listHandler("/order-items", { orderId: "order_id", productId: "product_id", variantId: "variant_id" })
   }
 ];
@@ -31458,7 +31559,7 @@ var priceTools = [
   },
   {
     name: "ls_list_prices",
-    description: "List all prices, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all prices, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List prices",
       readOnlyHint: true,
@@ -31472,6 +31573,7 @@ var priceTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["variantId"],
     handler: listHandler("/prices", { variantId: "variant_id" })
   }
 ];
@@ -31683,7 +31785,7 @@ var subscriptionItemTools = [
   },
   {
     name: "ls_list_subscription_items",
-    description: "List all subscription items, optionally filtered by subscription or price. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all subscription items, optionally filtered by subscription or price. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionId, priceId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List subscription items",
       readOnlyHint: true,
@@ -31698,6 +31800,7 @@ var subscriptionItemTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["subscriptionId", "priceId"],
     handler: listHandler("/subscription-items", { subscriptionId: "subscription_id", priceId: "price_id" })
   },
   {
@@ -31887,7 +31990,7 @@ var usageRecordTools = [
   },
   {
     name: "ls_list_usage_records",
-    description: "List all usage records, optionally filtered by subscription item. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all usage records, optionally filtered by subscription item. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionItemId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List usage records",
       readOnlyHint: true,
@@ -31901,6 +32004,7 @@ var usageRecordTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["subscriptionItemId"],
     handler: listHandler("/usage-records", { subscriptionItemId: "subscription_item_id" })
   },
   {
@@ -31980,7 +32084,7 @@ var variantTools = [
   },
   {
     name: "ls_list_variants",
-    description: "List all variants, optionally filtered by product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
+    description: "List all variants, optionally filtered by product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: productId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List variants",
       readOnlyHint: true,
@@ -31994,6 +32098,7 @@ var variantTools = [
       pageNumber: external_exports3.number().int().min(1).optional().describe("Page number (1-indexed)"),
       pageSize: external_exports3.number().int().min(1).max(100).optional().describe("Results per page (1-100)")
     }),
+    requiredFilters: ["productId"],
     handler: listHandler("/variants", { productId: "product_id" })
   }
 ];
@@ -32118,7 +32223,7 @@ var webhookTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.7.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.7.1" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -32152,7 +32257,6 @@ var server = new McpServer({
   version: version2
 });
 for (const tool of allTools) {
-  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
   server.tool(
     tool.name,
     tool.description,
@@ -32163,7 +32267,7 @@ for (const tool of allTools) {
       const start = Date.now();
       try {
         if (isDestructive) checkDestructiveRateLimit();
-        checkStoreScopedToolInput(toolAcceptsStoreId, input);
+        checkStoreScopedToolInput(tool, input);
         const result = await tool.handler(input);
         const response = result;
         const latency_ms = Date.now() - start;
@@ -32175,7 +32279,7 @@ for (const tool of allTools) {
           request_id: response.requestId,
           error: response.ok ? void 0 : response.error,
           audit: isDestructive ? true : void 0,
-          inputs: isDestructive ? input : void 0
+          inputs: isDestructive ? redactSecrets(input) : void 0
         });
         if (!response.ok) {
           return {
@@ -32202,7 +32306,7 @@ for (const tool of allTools) {
           latency_ms,
           error: message,
           audit: isDestructive ? true : void 0,
-          inputs: isDestructive ? input : void 0
+          inputs: isDestructive ? redactSecrets(input) : void 0
         });
         return {
           content: [{ type: "text", text: `Error: ${message}` }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",