@yawlabs/lemonsqueezy-mcp 0.7.1 → 0.9.0

package/README.md

@@ -2,12 +2,47 @@
 
 MCP server for the [LemonSqueezy](https://lemonsqueezy.com) API. Manage your store, products, customers, subscriptions, discounts, license keys, and more from any MCP-compatible AI assistant.
 
+[![Add to mcp.hosting](https://mcp.hosting/install-button.svg)](https://mcp.hosting/install?name=LemonSqueezy&command=npx&args=-y%2C%40yawlabs%2Flemonsqueezy-mcp&description=LemonSqueezy%20store%20management%20-%20products%2C%20orders%2C%20subscriptions%2C%20license%20keys&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Flemonsqueezy-mcp)
+
+One click adds this to your [mcp.hosting](https://mcp.hosting) account so it syncs to every MCP client you use. Or install manually below.
+
 ## Quick start
 
 ```bash
 npx @yawlabs/lemonsqueezy-mcp
 ```
 
+Or one-click install via Smithery:
+
+```bash
+npx -y @smithery/cli install @yawlabs/lemonsqueezy-mcp --client claude
+```
+
+Smithery prompts for your env vars (API key, optional guardrails) and writes the config into your client for you.
+
+## What it looks like
+
+Once configured, you can ask your AI assistant store-management questions in plain English and it routes them through the MCP tools:
+
+```
+You:  How much did we make from the "Pro Annual" plan last month?
+Claude: [calls ls_list_subscriptions, ls_get_variant, ls_list_subscription_invoices]
+        Pro Annual brought in $14,280 across 84 active subscriptions in April.
+        Three of those were upgrades from monthly; none churned.
+
+You:  Refund order #LS-1234 in full.
+Claude: [calls ls_get_order to fetch the total, then ls_refund_order with amount = total]
+        Refunded $99.00 against order LS-1234. The customer's card will see the
+        credit in 5-10 business days.
+
+You:  Disable license key abc-123 for the customer who reported abuse.
+Claude: [calls ls_list_license_keys to find the ID, then ls_update_license_key with disabled: true]
+        License key disabled. Their existing activations will fail validation
+        on the next check.
+```
+
+Guardrails (refund cap, rate limit, store allowlist) catch the obvious mistakes before they reach LemonSqueezy. See [Configuration](#configuration) for the env vars that turn them on.
+
 ## Setup
 
 Set your LemonSqueezy API key as an environment variable:
@@ -18,6 +53,17 @@ export LEMONSQUEEZY_API_KEY="your-api-key"
 
 Get your API key from your [LemonSqueezy dashboard](https://app.lemonsqueezy.com/settings/api).
 
+### Docker
+
+A multi-stage `Dockerfile` is included at the repo root. The runtime image is a single bundled file on `node:20-alpine` running as the non-root `node` user, with no port exposed (stdio transport).
+
+```bash
+docker build -t yawlabs/lemonsqueezy-mcp .
+docker run --rm -i -e LEMONSQUEEZY_API_KEY="your-api-key" yawlabs/lemonsqueezy-mcp
+```
+
+A byte-identical `Containerfile` is also provided for Podman users.
+
 ### Claude Code
 
 Add to your MCP config:
@@ -174,9 +220,12 @@ All configuration is via environment variables. Only `LEMONSQUEEZY_API_KEY` (or
 | --- | --- |
 | `LEMONSQUEEZY_API_KEY` | LemonSqueezy API token. |
 | `LEMONSQUEEZY_API_KEY_COMMAND` | Command whose stdout produces the API key. Overrides `LEMONSQUEEZY_API_KEY`. Output is cached for 1 hour. Use this to pull short-lived credentials from a vault (`op read`, `gcloud secrets versions access`, etc.) without writing them to env vars. The cache is keyed by the command string, so changing it mid-process refreshes on the next request; it is also invalidated automatically on a 401/403 from the API, so a key rotated upstream takes effect on the next call without waiting for the TTL. |
+| `LEMONSQUEEZY_TEST_API_KEY` | Optional test-mode key. When set and non-empty, it takes precedence over `LEMONSQUEEZY_API_KEY` (but not over `LEMONSQUEEZY_API_KEY_COMMAND`). On first activation per process, the server prints a one-line JSON `test_mode` notice to stderr so you can confirm test mode is engaged. Use this to point the server at a sandbox/test store without unsetting your production key. |
 | `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`, `ls_list_stores`) route by their own resource ID and are **not** gated by this allowlist. For those, the only authoritative store boundary is the API key itself — pair this setting with a LemonSqueezy API key scoped to the same store(s), and pair with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` for additional defense in depth. |
 | `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` | Rejects `ls_refund_order` and `ls_refund_subscription_invoice` calls above this amount. |
 | `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include `ls_update_license_key` calls that set `disabled: true`, and `ls_update_subscription` calls that pause or switch plan. |
+| `LEMONSQUEEZY_DISABLE_CLASSES` | Comma-separated list of [authority classes](#authority-classes) to refuse outright. Any tool whose class is listed returns a `guardrail_block` before the API call is attempted. Example: `LEMONSQUEEZY_DISABLE_CLASSES=money,recurring,pii` lets an agent run reads but blocks refunds, subscription changes, and customer-record access. Unknown class names throw at server startup. |
+| `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` | Per-class rolling rate limits, comma-separated. Each entry is `class:N`, `class:N/m`, or `class:N/h` (bare numbers default to per-minute). Example: `money:2/h,recurring:5/h,key:10/m`. Composes with `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` — both must pass. In-process per server instance. |
 | `LEMONSQUEEZY_LOG` | Structured-log verbosity to stderr. Set to `all` (or legacy `json`) to log every tool and HTTP call, `audit` to log only destructive-call audit entries plus errors (recommended for production), `error` to log only failures. Unset: no logs. Destructive calls are tagged `audit: true` and include their inputs. |
 
 ### Logging format
@@ -187,15 +236,42 @@ Each line: `{ts, event, tool?, method?, path?, status, latency_ms, request_id?,
 
 HTTP errors include the upstream `X-Request-Id` when present, so support tickets to LemonSqueezy can reference the exact call.
 
+## Authority classes
+
+Every tool is tagged with an **authority class** — a label for the kind of business authority a caller needs to invoke it. The class is separate from the binary destructive/read-only annotation: a customer-record read and a product list are both reads, but only one returns PII; a checkout creation and a refund are both writes, but only one moves money. Granular classes let an operator gate by the dimension that matters, instead of being stuck with a single "destructive" toggle.
+
+| Class | What it covers | Example tools |
+| --- | --- | --- |
+| `read` | Safe reads (list/get) that don't return customer PII as the primary payload. | `ls_list_orders`, `ls_get_product`, `ls_validate_license` |
+| `pii` | Reads or writes whose primary payload is a customer record. | `ls_list_customers`, `ls_create_customer`, `ls_archive_customer` |
+| `mutate` | Safe mutations: checkouts, discounts, invoice generation, usage records. | `ls_create_checkout`, `ls_create_discount`, `ls_generate_order_invoice` |
+| `money` | Money movement. Irreversible at the payment layer. | `ls_refund_order`, `ls_refund_subscription_invoice` |
+| `recurring` | Subscription state changes that affect recurring revenue. | `ls_update_subscription`, `ls_cancel_subscription`, `ls_update_subscription_item` |
+| `key` | License-key admin (activate, deactivate, disable, change activation limit). | `ls_update_license_key`, `ls_activate_license`, `ls_deactivate_license` |
+| `webhook` | Webhook configuration — affects the trust surface other systems rely on. | `ls_create_webhook`, `ls_update_webhook`, `ls_delete_webhook` |
+
+Note: `ls_get_order` returns customer fields incidentally, but its primary payload is the order — it stays in `read`, not `pii`. The class is reserved for tools whose *primary purpose* is the customer record. If you need to deny all access to customer-shaped data, prefer a scoped API key over class-disable alone.
+
+`LEMONSQUEEZY_DISABLE_CLASSES` blocks a class outright. `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` caps the call rate per class. Both are opt-in; with neither set, behavior is unchanged from prior versions.
+
+## Resources
+
+The server exposes one MCP Resource for clients that prefer structural retrieval over parsing stderr:
+
+| URI | MIME type | Contents |
+| --- | --- | --- |
+| `lemonsqueezy://audit-log` | `application/x-ndjson` | The most recent destructive tool calls and outcomes (rate-limit blocks, refund-cap blocks, exceptions, successes). Bounded ring buffer of the last 1000 entries, most-recent-first, resets on server restart. Secret-shaped input fields are redacted before they reach the buffer. |
+
 ## Operating the server unattended
 
 For unattended/agentic use against a live store, we recommend:
 
 1. Use a LemonSqueezy API key scoped to the specific store(s) the agent may touch — this is the only authoritative store boundary for tools that route by their own resource ID (refunds, cancels, archive, delete-webhook, etc.). Set `LEMONSQUEEZY_ALLOWED_STORE_IDS` to the same set as a defense-in-depth gate on the tools that *do* take a `storeId`.
 2. Set `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` to a per-call cap well below any single-refund expectation.
-3. Set `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` to a small number (e.g. 5/min) as a runaway-agent circuit breaker.
-4. Set `LEMONSQUEEZY_LOG=audit` and ship stderr to your log aggregator. The `audit` level keeps every destructive-call entry plus errors but drops successful reads so log volume stays bounded over weeks of operation. Alert on `status: "guardrail_block"` or elevated error rates per tool. Use `LEMONSQUEEZY_LOG=all` while debugging.
-5. Run `LEMONSQUEEZY_API_KEY_COMMAND` against a vault-backed secret so credentials can rotate without restarting the server process. The API client invalidates its in-process key cache automatically on a 401/403, so a rotated upstream key picks up on the next request rather than waiting on the 1h TTL.
+3. Set `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` to a small number (e.g. 5/min) as a runaway-agent circuit breaker. For finer control, add `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS=money:2/h,recurring:5/h,key:10/m` so each [authority class](#authority-classes) has its own ceiling.
+4. If a class shouldn't be reachable at all (e.g. an analytics agent that needs only `read`), set `LEMONSQUEEZY_DISABLE_CLASSES` to refuse the rest outright — calls return a `guardrail_block` before the API is touched.
+5. Set `LEMONSQUEEZY_LOG=audit` and ship stderr to your log aggregator. The `audit` level keeps every destructive-call entry plus errors but drops successful reads so log volume stays bounded over weeks of operation. Alert on `status: "guardrail_block"` or elevated error rates per tool. Use `LEMONSQUEEZY_LOG=all` while debugging.
+6. Run `LEMONSQUEEZY_API_KEY_COMMAND` against a vault-backed secret so credentials can rotate without restarting the server process. The API client invalidates its in-process key cache automatically on a 401/403, so a rotated upstream key picks up on the next request rather than waiting on the 1h TTL.
 
 What the server does **not** do and you must own at the caller level:
 
@@ -216,15 +292,36 @@ npm run test:integration  # requires LEMONSQUEEZY_TEST_API_KEY + LEMONSQUEEZY_TE
 
 ## Releasing
 
-Releases are cut locally — there is no CI pipeline. From a clean checkout of `main`:
+Two paths from a clean checkout of `main`. Both produce the same artifact (npm publish with provenance + GitHub release).
+
+### 1. Tag-and-let-CI (preferred)
 
 ```bash
-./release.sh 0.6.0
+# 1. Bump version
+npm version X.Y.Z --no-git-tag-version
+
+# 2. Commit
+git add package.json && git commit -m "vX.Y.Z"
+
+# 3. Annotated tag (lightweight tags are silently skipped by --follow-tags)
+git tag -a vX.Y.Z -m "vX.Y.Z"
+
+# 4. Push commit + tag
+git push origin main --follow-tags
+
+# 5. Confirm the Release workflow fired (not just CI on the bump commit)
+gh run list --limit 2
 ```
 
-The script lints, tests, builds, bumps the version, commits and tags, pushes to `origin`, publishes to npm, and creates a GitHub release. Each step is idempotent — re-running with the same version after a partial failure resumes from where it stopped.
+The tag push triggers `.github/workflows/release.yml`, which runs `release.sh` in CI mode: lint, test, build, npm publish (with `--provenance`) using the org-level `NPM_TOKEN` secret, then GitHub release creation, then a smoke test against the published tarball. No local `npm login` needed.
+
+### 2. Local end-to-end
+
+```bash
+./release.sh X.Y.Z
+```
 
-One-time setup on the release machine:
+Does the same steps 1–7 on the workstation: lint, test, build, bump, commit, annotated tag, push, npm publish, GitHub release, verify. Idempotent — safe to re-run with the same version after a partial failure. Requires one-time setup:
 
 ```bash
 npm login --auth-type=web   # publisher of @yawlabs/lemonsqueezy-mcp

package/dist/index.js

@@ -3105,6 +3105,9 @@ var require_utils = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3130,20 +3133,20 @@ var require_utils = __commonJS({
       return acc;
     }
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer) {
-      buffer.length = 0;
+    function consumeIsZone(buffer2) {
+      buffer2.length = 0;
       return true;
     }
-    function consumeHextets(buffer, address, output) {
-      if (buffer.length) {
-        const hex3 = stringArrayToHexStripped(buffer);
+    function consumeHextets(buffer2, address, output) {
+      if (buffer2.length) {
+        const hex3 = stringArrayToHexStripped(buffer2);
         if (hex3 !== "") {
           address.push(hex3);
         } else {
           output.error = true;
           return false;
         }
-        buffer.length = 0;
+        buffer2.length = 0;
       }
       return true;
     }
@@ -3151,7 +3154,7 @@ var require_utils = __commonJS({
       let tokenCount = 0;
       const output = { error: false, address: "", zone: "" };
       const address = [];
-      const buffer = [];
+      const buffer2 = [];
       let endipv6Encountered = false;
       let endIpv6 = false;
       let consume = consumeHextets;
@@ -3164,7 +3167,7 @@ var require_utils = __commonJS({
           if (endipv6Encountered === true) {
             endIpv6 = true;
           }
-          if (!consume(buffer, address, output)) {
+          if (!consume(buffer2, address, output)) {
             break;
           }
           if (++tokenCount > 7) {
@@ -3177,22 +3180,22 @@ var require_utils = __commonJS({
           address.push(":");
           continue;
         } else if (cursor === "%") {
-          if (!consume(buffer, address, output)) {
+          if (!consume(buffer2, address, output)) {
             break;
           }
           consume = consumeIsZone;
         } else {
-          buffer.push(cursor);
+          buffer2.push(cursor);
           continue;
         }
       }
-      if (buffer.length) {
+      if (buffer2.length) {
         if (consume === consumeIsZone) {
-          output.zone = buffer.join("");
+          output.zone = buffer2.join("");
         } else if (endIpv6) {
-          address.push(buffer.join(""));
+          address.push(buffer2.join(""));
         } else {
-          address.push(stringArrayToHexStripped(buffer));
+          address.push(stringArrayToHexStripped(buffer2));
         }
       }
       output.address = address.join("");
@@ -3297,27 +3300,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc2) {
-      const func = esc2 !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -3332,7 +3385,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -3346,7 +3399,10 @@ var require_utils = __commonJS({
     module.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -3570,12 +3626,12 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse3(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse3(serialize(uri, options), options);
@@ -3642,19 +3698,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3679,12 +3725,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -3719,7 +3765,16 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse3(uri, opts) {
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -3730,6 +3785,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3750,6 +3806,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -3788,14 +3849,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -3804,7 +3869,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse3(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -30113,6 +30200,23 @@ var StdioServerTransport = class {
   }
 };
 
+// src/audit-buffer.ts
+var DEFAULT_CAP = 1e3;
+var buffer = [];
+var cap = DEFAULT_CAP;
+function pushAuditEntry(entry) {
+  buffer.push(entry);
+  if (buffer.length > cap) {
+    buffer.splice(0, buffer.length - cap);
+  }
+}
+function readAuditEntries(limit) {
+  const reversed = buffer.slice().reverse();
+  if (limit === void 0 || limit >= reversed.length) return reversed;
+  if (limit <= 0) return [];
+  return reversed.slice(0, limit);
+}
+
 // src/guardrails.ts
 var GuardrailError = class extends Error {
   constructor(message) {
@@ -30120,8 +30224,13 @@ var GuardrailError = class extends Error {
     this.name = "GuardrailError";
   }
 };
+var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
+function isAuthorityClass(s) {
+  return AUTHORITY_CLASSES.includes(s);
+}
 var cachedOptions = null;
 var destructiveTimestamps = [];
+var classTimestamps = /* @__PURE__ */ new Map();
 function readNumber(name, raw) {
   if (raw === void 0 || raw.trim() === "") return null;
   const n = Number(raw);
@@ -30130,6 +30239,59 @@ function readNumber(name, raw) {
   }
   return n;
 }
+function parseDisabledClasses(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",")) {
+    const cls = part.trim();
+    if (!cls) continue;
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_DISABLE_CLASSES contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    out.add(cls);
+  }
+  return out.size > 0 ? out : null;
+}
+function parseClassRateLimits(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Map();
+  for (const part of raw.split(",")) {
+    const segment = part.trim();
+    if (!segment) continue;
+    const colon = segment.indexOf(":");
+    if (colon < 0) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry missing colon: ${JSON.stringify(segment)} (expected class:N or class:N/h)`
+      );
+    }
+    const cls = segment.slice(0, colon).trim();
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    const specRaw = segment.slice(colon + 1).trim();
+    const slash = specRaw.indexOf("/");
+    const numPart = slash >= 0 ? specRaw.slice(0, slash).trim() : specRaw;
+    const unitPart = slash >= 0 ? specRaw.slice(slash + 1).trim().toLowerCase() : "m";
+    const n = Number(numPart);
+    if (!Number.isFinite(n) || n < 0 || numPart === "") {
+      throw new Error(`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid number: ${JSON.stringify(segment)}`);
+    }
+    let windowMs;
+    if (unitPart === "m") windowMs = 6e4;
+    else if (unitPart === "h") windowMs = 36e5;
+    else {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid unit (expected m or h): ${JSON.stringify(segment)}`
+      );
+    }
+    out.set(cls, { limit: n, windowMs });
+  }
+  return out.size > 0 ? out : null;
+}
 function loadOptions() {
   if (cachedOptions) return cachedOptions;
   const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
@@ -30145,7 +30307,9 @@ function loadOptions() {
     rateLimitPerMinute: readNumber(
       "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
       process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
-    )
+    ),
+    disabledClasses: parseDisabledClasses(process.env.LEMONSQUEEZY_DISABLE_CLASSES),
+    classRateLimits: parseClassRateLimits(process.env.LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)
   };
   return cachedOptions;
 }
@@ -30208,6 +30372,30 @@ function isDestructiveCall(tool, input) {
   if (typeof tool.isDestructive === "function") return tool.isDestructive(input);
   return tool.annotations?.destructiveHint === true;
 }
+function checkClassAllowed(cls) {
+  const o = loadOptions();
+  if (!o.disabledClasses) return;
+  if (o.disabledClasses.has(cls)) {
+    throw new GuardrailError(`Tool authority class ${JSON.stringify(cls)} is disabled by LEMONSQUEEZY_DISABLE_CLASSES`);
+  }
+}
+function checkClassRateLimit(cls, now = Date.now()) {
+  const o = loadOptions();
+  if (!o.classRateLimits) return;
+  const spec = o.classRateLimits.get(cls);
+  if (!spec) return;
+  const cutoff = now - spec.windowMs;
+  const list = (classTimestamps.get(cls) ?? []).filter((t) => t > cutoff);
+  if (list.length >= spec.limit) {
+    const unit = spec.windowMs === 6e4 ? "min" : spec.windowMs === 36e5 ? "hour" : `${spec.windowMs}ms`;
+    classTimestamps.set(cls, list);
+    throw new GuardrailError(
+      `Class ${JSON.stringify(cls)} rate limit exceeded (${spec.limit}/${unit}). Wait and retry.`
+    );
+  }
+  list.push(now);
+  classTimestamps.set(cls, list);
+}
 
 // src/logger.ts
 function getLogLevel() {
@@ -30413,6 +30601,18 @@ var CACHE_TTL_MS = 60 * 60 * 1e3;
 var COMMAND_TIMEOUT_MS = 1e4;
 var COMMAND_MAX_BUFFER = 64 * 1024;
 var cached2 = null;
+var testModeAnnounced = false;
+function announceTestModeOnce() {
+  if (testModeAnnounced) return;
+  testModeAnnounced = true;
+  const line = `${JSON.stringify({
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    event: "test_mode",
+    message: "Using LEMONSQUEEZY_TEST_API_KEY (test mode)"
+  })}
+`;
+  process.stderr.write(line);
+}
 function parseCommand(cmd) {
   const parts = [];
   let current = "";
@@ -30472,6 +30672,18 @@ async function loadApiKey() {
     intoCache(fingerprint2, key);
     return key;
   }
+  const testRaw = process.env.LEMONSQUEEZY_TEST_API_KEY;
+  if (testRaw && testRaw.trim() !== "") {
+    const fingerprint2 = `test:${testRaw}`;
+    const hit2 = fromCache(fingerprint2);
+    if (hit2 !== null) {
+      announceTestModeOnce();
+      return hit2;
+    }
+    announceTestModeOnce();
+    intoCache(fingerprint2, testRaw);
+    return testRaw;
+  }
   const raw = process.env.LEMONSQUEEZY_API_KEY;
   if (!raw) {
     throw new Error("LEMONSQUEEZY_API_KEY or LEMONSQUEEZY_API_KEY_COMMAND environment variable is required.");
@@ -30741,6 +30953,7 @@ async function apiDelete(path) {
 var affiliateTools = [
   {
     name: "ls_get_affiliate",
+    authorityClass: "read",
     description: "Get a specific affiliate by ID, including commission rate, status, and earnings.",
     annotations: {
       title: "Get affiliate",
@@ -30757,6 +30970,7 @@ var affiliateTools = [
   },
   {
     name: "ls_list_affiliates",
+    authorityClass: "read",
     description: "List all affiliates for the authenticated user's stores, optionally filtered by user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool can still return affiliates tied to non-allowed stores -- the endpoint has no parent ID filter to scope by. Pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List affiliates",
@@ -30779,6 +30993,7 @@ var affiliateTools = [
 var checkoutTools = [
   {
     name: "ls_get_checkout",
+    authorityClass: "read",
     description: "Get a specific checkout by ID, including URL, expiry, and custom data.",
     annotations: {
       title: "Get checkout",
@@ -30795,6 +31010,7 @@ var checkoutTools = [
   },
   {
     name: "ls_list_checkouts",
+    authorityClass: "read",
     description: "List all checkouts, optionally filtered by store or variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List checkouts",
@@ -30814,6 +31030,7 @@ var checkoutTools = [
   },
   {
     name: "ls_create_checkout",
+    authorityClass: "mutate",
     description: "Create a new checkout URL for a product variant. Returns a URL where the customer can complete their purchase. Supports custom pricing, prefilled customer data, and checkout customization.",
     annotations: {
       title: "Create checkout",
@@ -30874,6 +31091,7 @@ var checkoutTools = [
 var customerTools = [
   {
     name: "ls_get_customer",
+    authorityClass: "pii",
     description: "Get a specific customer by ID, including name, email, city, country, MRR, total revenue, and customer portal URL.",
     annotations: {
       title: "Get customer",
@@ -30890,6 +31108,7 @@ var customerTools = [
   },
   {
     name: "ls_list_customers",
+    authorityClass: "pii",
     description: "List all customers, optionally filtered by store or email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List customers",
@@ -30909,6 +31128,7 @@ var customerTools = [
   },
   {
     name: "ls_create_customer",
+    authorityClass: "pii",
     description: "Create a new customer in a store.",
     annotations: {
       title: "Create customer",
@@ -30946,6 +31166,7 @@ var customerTools = [
   },
   {
     name: "ls_update_customer",
+    authorityClass: "pii",
     description: "Update an existing customer's name, email, city, region, country, or status. The only supported status value is 'archived' \u2014 use ls_archive_customer for the dedicated, audit-tagged path.",
     annotations: {
       title: "Update customer",
@@ -30991,6 +31212,7 @@ var customerTools = [
   },
   {
     name: "ls_archive_customer",
+    authorityClass: "pii",
     description: "Archive a customer. Sets their status to 'archived'. This is reversible by updating their status back.",
     annotations: {
       title: "Archive customer",
@@ -31018,6 +31240,7 @@ var customerTools = [
 var discountRedemptionTools = [
   {
     name: "ls_get_discount_redemption",
+    authorityClass: "read",
     description: "Get a specific discount redemption by ID, showing when and where a discount was used.",
     annotations: {
       title: "Get discount redemption",
@@ -31034,6 +31257,7 @@ var discountRedemptionTools = [
   },
   {
     name: "ls_list_discount_redemptions",
+    authorityClass: "read",
     description: "List all discount redemptions, optionally filtered by discount or order. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: discountId, orderId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List discount redemptions",
@@ -31058,6 +31282,7 @@ var discountRedemptionTools = [
 var discountTools = [
   {
     name: "ls_get_discount",
+    authorityClass: "read",
     description: "Get a specific discount by ID, including code, amount, type, and usage limits.",
     annotations: {
       title: "Get discount",
@@ -31074,6 +31299,7 @@ var discountTools = [
   },
   {
     name: "ls_list_discounts",
+    authorityClass: "read",
     description: "List all discounts, optionally filtered by store. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List discounts",
@@ -31092,6 +31318,7 @@ var discountTools = [
   },
   {
     name: "ls_create_discount",
+    authorityClass: "mutate",
     description: "Create a new discount code. Supports percentage or fixed amount discounts with optional duration and usage limits.",
     annotations: {
       title: "Create discount",
@@ -31150,6 +31377,7 @@ var discountTools = [
   },
   {
     name: "ls_delete_discount",
+    authorityClass: "mutate",
     description: "Permanently delete a discount. This is irreversible.",
     annotations: {
       title: "Delete discount",
@@ -31171,6 +31399,7 @@ var discountTools = [
 var fileTools = [
   {
     name: "ls_get_file",
+    authorityClass: "read",
     description: "Get a specific file by ID, including name, size, download URL, and associated variant.",
     annotations: {
       title: "Get file",
@@ -31187,6 +31416,7 @@ var fileTools = [
   },
   {
     name: "ls_list_files",
+    authorityClass: "read",
     description: "List all files, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List files",
@@ -31210,6 +31440,7 @@ var fileTools = [
 var licenseKeyInstanceTools = [
   {
     name: "ls_get_license_key_instance",
+    authorityClass: "read",
     description: "Get a specific license key instance (activation) by ID, including instance name and creation date.",
     annotations: {
       title: "Get license key instance",
@@ -31226,6 +31457,7 @@ var licenseKeyInstanceTools = [
   },
   {
     name: "ls_list_license_key_instances",
+    authorityClass: "read",
     description: "List all license key instances (activations), optionally filtered by license key. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: licenseKeyId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List license key instances",
@@ -31249,6 +31481,7 @@ var licenseKeyInstanceTools = [
 var licenseKeyTools = [
   {
     name: "ls_get_license_key",
+    authorityClass: "read",
     description: "Get a specific license key by ID, including key value, status, activation limit, and expiry date.",
     annotations: {
       title: "Get license key",
@@ -31267,6 +31500,7 @@ var licenseKeyTools = [
   },
   {
     name: "ls_list_license_keys",
+    authorityClass: "read",
     description: "List all license keys, optionally filtered by store, order, or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List license keys",
@@ -31295,6 +31529,7 @@ var licenseKeyTools = [
   },
   {
     name: "ls_update_license_key",
+    authorityClass: "key",
     description: "Update a license key's activation limit, expiry date, or disabled status. Setting `disabled: true` revokes customer access and is treated as destructive (rate-limited and audited).",
     annotations: {
       title: "Update license key",
@@ -31337,6 +31572,7 @@ var licenseKeyTools = [
 var licenseTools = [
   {
     name: "ls_activate_license",
+    authorityClass: "key",
     description: "Activate a license key for an instance. Does not require an API key \u2014 uses the license key itself for auth.",
     annotations: {
       title: "Activate license",
@@ -31358,6 +31594,7 @@ var licenseTools = [
   },
   {
     name: "ls_validate_license",
+    authorityClass: "read",
     description: "Validate a license key or specific instance. Does not require an API key \u2014 uses the license key itself for auth.",
     annotations: {
       title: "Validate license",
@@ -31378,6 +31615,7 @@ var licenseTools = [
   },
   {
     name: "ls_deactivate_license",
+    authorityClass: "key",
     description: "Deactivate a license key instance. Does not require an API key \u2014 uses the license key itself for auth.",
     annotations: {
       title: "Deactivate license",
@@ -31403,6 +31641,7 @@ var licenseTools = [
 var orderItemTools = [
   {
     name: "ls_get_order_item",
+    authorityClass: "read",
     description: "Get a specific order item by ID, including product name, variant, price, and quantity.",
     annotations: {
       title: "Get order item",
@@ -31419,6 +31658,7 @@ var orderItemTools = [
   },
   {
     name: "ls_list_order_items",
+    authorityClass: "read",
     description: "List all order items, optionally filtered by order or product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: orderId, productId, variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List order items",
@@ -31444,6 +31684,7 @@ var orderItemTools = [
 var orderTools = [
   {
     name: "ls_get_order",
+    authorityClass: "read",
     description: "Get a specific order by ID, including status, total, currency, customer info, and payment details.",
     annotations: {
       title: "Get order",
@@ -31462,6 +31703,7 @@ var orderTools = [
   },
   {
     name: "ls_list_orders",
+    authorityClass: "read",
     description: "List all orders, optionally filtered by store or user email. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List orders",
@@ -31483,6 +31725,7 @@ var orderTools = [
   },
   {
     name: "ls_generate_order_invoice",
+    authorityClass: "mutate",
     description: "Generate a PDF invoice for an order. Returns a download URL for the invoice.",
     annotations: {
       title: "Generate order invoice",
@@ -31518,6 +31761,7 @@ var orderTools = [
   },
   {
     name: "ls_refund_order",
+    authorityClass: "money",
     description: "Issue a refund for an order. This is irreversible \u2014 the refund amount is in cents (e.g. 1000 = $10.00).",
     annotations: {
       title: "Refund order",
@@ -31543,6 +31787,7 @@ var orderTools = [
 var priceTools = [
   {
     name: "ls_get_price",
+    authorityClass: "read",
     description: "Get a specific price by ID, including amount, currency, and billing interval.",
     annotations: {
       title: "Get price",
@@ -31559,6 +31804,7 @@ var priceTools = [
   },
   {
     name: "ls_list_prices",
+    authorityClass: "read",
     description: "List all prices, optionally filtered by variant. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: variantId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List prices",
@@ -31582,6 +31828,7 @@ var priceTools = [
 var productTools = [
   {
     name: "ls_get_product",
+    authorityClass: "read",
     description: "Get a specific product by ID, including name, description, price, and status.",
     annotations: {
       title: "Get product",
@@ -31598,6 +31845,7 @@ var productTools = [
   },
   {
     name: "ls_list_products",
+    authorityClass: "read",
     description: "List all products, optionally filtered by store. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List products",
@@ -31620,6 +31868,7 @@ var productTools = [
 var storeTools = [
   {
     name: "ls_get_store",
+    authorityClass: "read",
     description: "Get a specific store by ID, including name, slug, currency, and sales statistics.",
     annotations: {
       title: "Get store",
@@ -31638,6 +31887,7 @@ var storeTools = [
   },
   {
     name: "ls_list_stores",
+    authorityClass: "read",
     description: "List all stores for the authenticated user. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List stores",
@@ -31661,6 +31911,7 @@ var storeTools = [
 var subscriptionInvoiceTools = [
   {
     name: "ls_get_subscription_invoice",
+    authorityClass: "read",
     description: "Get a specific subscription invoice by ID, including status, total, billing reason, and payment details.",
     annotations: {
       title: "Get subscription invoice",
@@ -31677,6 +31928,7 @@ var subscriptionInvoiceTools = [
   },
   {
     name: "ls_list_subscription_invoices",
+    authorityClass: "read",
     description: "List all subscription invoices, optionally filtered by store, subscription, or status. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List subscription invoices",
@@ -31703,6 +31955,7 @@ var subscriptionInvoiceTools = [
   },
   {
     name: "ls_generate_subscription_invoice",
+    authorityClass: "mutate",
     description: "Generate a PDF invoice for a subscription invoice. Returns a download URL.",
     annotations: {
       title: "Generate subscription invoice",
@@ -31740,6 +31993,7 @@ var subscriptionInvoiceTools = [
   },
   {
     name: "ls_refund_subscription_invoice",
+    authorityClass: "money",
     description: "Issue a refund for a subscription invoice. This is irreversible \u2014 the refund amount is in cents (e.g. 1000 = $10.00).",
     annotations: {
       title: "Refund subscription invoice",
@@ -31769,6 +32023,7 @@ var subscriptionInvoiceTools = [
 var subscriptionItemTools = [
   {
     name: "ls_get_subscription_item",
+    authorityClass: "read",
     description: "Get a specific subscription item by ID, including quantity, pricing, and associated subscription.",
     annotations: {
       title: "Get subscription item",
@@ -31785,6 +32040,7 @@ var subscriptionItemTools = [
   },
   {
     name: "ls_list_subscription_items",
+    authorityClass: "read",
     description: "List all subscription items, optionally filtered by subscription or price. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionId, priceId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List subscription items",
@@ -31805,6 +32061,7 @@ var subscriptionItemTools = [
   },
   {
     name: "ls_update_subscription_item",
+    authorityClass: "recurring",
     description: "Update a subscription item's quantity. Used for seat-based or quantity-based billing.",
     annotations: {
       title: "Update subscription item",
@@ -31829,6 +32086,7 @@ var subscriptionItemTools = [
   },
   {
     name: "ls_get_subscription_item_usage",
+    authorityClass: "read",
     description: "Get the current usage for a metered subscription item within the current billing period.",
     annotations: {
       title: "Get subscription item usage",
@@ -31850,6 +32108,7 @@ var subscriptionItemTools = [
 var subscriptionTools = [
   {
     name: "ls_get_subscription",
+    authorityClass: "read",
     description: "Get a specific subscription by ID, including status, billing interval, renewal date, and customer info.",
     annotations: {
       title: "Get subscription",
@@ -31868,6 +32127,7 @@ var subscriptionTools = [
   },
   {
     name: "ls_list_subscriptions",
+    authorityClass: "read",
     description: "List all subscriptions, optionally filtered by store, order, product, variant, or status. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List subscriptions",
@@ -31902,6 +32162,7 @@ var subscriptionTools = [
   },
   {
     name: "ls_update_subscription",
+    authorityClass: "recurring",
     description: "Update a subscription. Can change the variant (plan switch), pause/unpause, set billing anchor, or update invoice details. Use ls_cancel_subscription for cancellation.",
     annotations: {
       title: "Update subscription",
@@ -31953,6 +32214,7 @@ var subscriptionTools = [
   },
   {
     name: "ls_cancel_subscription",
+    authorityClass: "recurring",
     description: "Cancel a subscription. The subscription remains active until the end of the current billing period, then expires.",
     annotations: {
       title: "Cancel subscription",
@@ -31974,6 +32236,7 @@ var subscriptionTools = [
 var usageRecordTools = [
   {
     name: "ls_get_usage_record",
+    authorityClass: "read",
     description: "Get a specific usage record by ID, including quantity and action type.",
     annotations: {
       title: "Get usage record",
@@ -31990,6 +32253,7 @@ var usageRecordTools = [
   },
   {
     name: "ls_list_usage_records",
+    authorityClass: "read",
     description: "List all usage records, optionally filtered by subscription item. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: subscriptionItemId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List usage records",
@@ -32009,6 +32273,7 @@ var usageRecordTools = [
   },
   {
     name: "ls_create_usage_record",
+    authorityClass: "mutate",
     description: "Report usage for a metered subscription item. Use 'increment' action to add to the current usage, or 'set' to replace it.",
     annotations: {
       title: "Create usage record",
@@ -32049,6 +32314,7 @@ var usageRecordTools = [
 var userTools = [
   {
     name: "ls_get_user",
+    authorityClass: "read",
     description: "Get the authenticated user's information including name, email, and avatar.",
     annotations: {
       title: "Get authenticated user",
@@ -32068,6 +32334,7 @@ var userTools = [
 var variantTools = [
   {
     name: "ls_get_variant",
+    authorityClass: "read",
     description: "Get a specific product variant by ID, including price, billing interval, and trial settings.",
     annotations: {
       title: "Get variant",
@@ -32084,6 +32351,7 @@ var variantTools = [
   },
   {
     name: "ls_list_variants",
+    authorityClass: "read",
     description: "List all variants, optionally filtered by product. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total. Cross-store note: when LEMONSQUEEZY_ALLOWED_STORE_IDS is set, this tool requires at least one of: productId. Even with that set, pair with a scoped LemonSqueezy API key for true cross-store enforcement -- the API key's visibility is the true boundary.",
     annotations: {
       title: "List variants",
@@ -32107,6 +32375,7 @@ var variantTools = [
 var webhookTools = [
   {
     name: "ls_get_webhook",
+    authorityClass: "read",
     description: "Get a specific webhook by ID, including URL, events, and last sent timestamp.",
     annotations: {
       title: "Get webhook",
@@ -32123,6 +32392,7 @@ var webhookTools = [
   },
   {
     name: "ls_list_webhooks",
+    authorityClass: "read",
     description: "List all webhooks, optionally filtered by store. Results are paginated \u2014 check meta.page in the response for currentPage, lastPage, and total.",
     annotations: {
       title: "List webhooks",
@@ -32141,6 +32411,7 @@ var webhookTools = [
   },
   {
     name: "ls_create_webhook",
+    authorityClass: "webhook",
     description: "Create a new webhook to receive event notifications. The signing secret is returned only once \u2014 save it immediately.",
     annotations: {
       title: "Create webhook",
@@ -32175,6 +32446,7 @@ var webhookTools = [
   },
   {
     name: "ls_update_webhook",
+    authorityClass: "webhook",
     description: "Update an existing webhook's URL, events, or secret.",
     annotations: {
       title: "Update webhook",
@@ -32205,6 +32477,7 @@ var webhookTools = [
   },
   {
     name: "ls_delete_webhook",
+    authorityClass: "webhook",
     description: "Permanently delete a webhook. This is irreversible.",
     annotations: {
       title: "Delete webhook",
@@ -32223,7 +32496,7 @@ var webhookTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.7.1" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.9.0" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -32266,12 +32539,14 @@ for (const tool of allTools) {
       const isDestructive = isDestructiveCall(tool, input);
       const start = Date.now();
       try {
+        checkClassAllowed(tool.authorityClass);
+        checkClassRateLimit(tool.authorityClass);
         if (isDestructive) checkDestructiveRateLimit();
         checkStoreScopedToolInput(tool, input);
         const result = await tool.handler(input);
         const response = result;
         const latency_ms = Date.now() - start;
-        logEvent({
+        const successEntry = {
           event: "tool_call",
           tool: tool.name,
           status: response.ok ? "ok" : "error",
@@ -32280,7 +32555,11 @@ for (const tool of allTools) {
           error: response.ok ? void 0 : response.error,
           audit: isDestructive ? true : void 0,
           inputs: isDestructive ? redactSecrets(input) : void 0
-        });
+        };
+        logEvent(successEntry);
+        if (isDestructive) {
+          pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...successEntry });
+        }
         if (!response.ok) {
           return {
             content: [
@@ -32299,7 +32578,7 @@ for (const tool of allTools) {
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         const latency_ms = Date.now() - start;
-        logEvent({
+        const errorEntry = {
           event: "tool_call",
           tool: tool.name,
           status: err instanceof GuardrailError ? "guardrail_block" : "exception",
@@ -32307,7 +32586,11 @@ for (const tool of allTools) {
           error: message,
           audit: isDestructive ? true : void 0,
           inputs: isDestructive ? redactSecrets(input) : void 0
-        });
+        };
+        logEvent(errorEntry);
+        if (isDestructive) {
+          pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...errorEntry });
+        }
         return {
           content: [{ type: "text", text: `Error: ${message}` }],
           isError: true
@@ -32316,6 +32599,27 @@ for (const tool of allTools) {
     }
   );
 }
+server.resource(
+  "Recent destructive-call audit log",
+  "lemonsqueezy://audit-log",
+  {
+    description: "The most recent destructive tool calls and their outcomes (rate limit, refund cap, etc.). Bounded ring buffer; resets on server restart.",
+    mimeType: "application/x-ndjson"
+  },
+  async (uri) => {
+    const entries = readAuditEntries();
+    const text = entries.map((e) => JSON.stringify(e)).join("\n");
+    return {
+      contents: [
+        {
+          uri: uri.href,
+          mimeType: "application/x-ndjson",
+          text
+        }
+      ]
+    };
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.7.1",
+  "version": "0.9.0",
+  "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",