@yawlabs/lemonsqueezy-mcp 0.9.0 → 0.9.2

package/README.md

@@ -62,7 +62,7 @@ docker build -t yawlabs/lemonsqueezy-mcp .
 docker run --rm -i -e LEMONSQUEEZY_API_KEY="your-api-key" yawlabs/lemonsqueezy-mcp
 ```
 
-A byte-identical `Containerfile` is also provided for Podman users.
+A matching `Containerfile` is provided for Podman users. It is generated from `Dockerfile` via `npm run gen:containerfile`; CI calls `npm run check:containerfile` so a divergent edit fails review rather than drifting silently.
 
 ### Claude Code
 
@@ -208,9 +208,10 @@ Add to `claude_desktop_config.json`:
 - **Zero runtime dependencies** — Single bundled file for instant `npx` startup
 - **License API** — Activate, validate, and deactivate license keys without an API key
 - **MCP annotations** — Every tool declares read-only, destructive, and idempotent hints
-- **Retry with backoff** — 429 and 5xx retries (idempotent methods only) with exponential backoff and jitter
-- **Guardrails** — optional store allowlist, refund cap, and destructive-call rate limit
-- **Structured logging** — opt-in JSON logs to stderr for observability and audit
+- **Retry with backoff** — 429 and 5xx retries (idempotent methods only) with exponential backoff, jitter, and a 90s overall-deadline ceiling
+- **Guardrails** — opt-in store allowlist, refund cap, destructive-call rate limit, authority-class disable (`LEMONSQUEEZY_DISABLE_CLASSES`), and per-authority-class rate limits (`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS`)
+- **Audit log MCP Resource** — `lemonsqueezy://audit-log` exposes the last 1000 destructive-call entries as `application/x-ndjson` for clients without stderr access
+- **Structured logging** — opt-in JSON logs to stderr with selectable levels (`error`, `audit`, `all`)
 
 ## Configuration
 
@@ -221,9 +222,9 @@ All configuration is via environment variables. Only `LEMONSQUEEZY_API_KEY` (or
 | `LEMONSQUEEZY_API_KEY` | LemonSqueezy API token. |
 | `LEMONSQUEEZY_API_KEY_COMMAND` | Command whose stdout produces the API key. Overrides `LEMONSQUEEZY_API_KEY`. Output is cached for 1 hour. Use this to pull short-lived credentials from a vault (`op read`, `gcloud secrets versions access`, etc.) without writing them to env vars. The cache is keyed by the command string, so changing it mid-process refreshes on the next request; it is also invalidated automatically on a 401/403 from the API, so a key rotated upstream takes effect on the next call without waiting for the TTL. |
 | `LEMONSQUEEZY_TEST_API_KEY` | Optional test-mode key. When set and non-empty, it takes precedence over `LEMONSQUEEZY_API_KEY` (but not over `LEMONSQUEEZY_API_KEY_COMMAND`). On first activation per process, the server prints a one-line JSON `test_mode` notice to stderr so you can confirm test mode is engaged. Use this to point the server at a sandbox/test store without unsetting your production key. |
-| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`, `ls_list_stores`) route by their own resource ID and are **not** gated by this allowlist. For those, the only authoritative store boundary is the API key itself — pair this setting with a LemonSqueezy API key scoped to the same store(s), and pair with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` for additional defense in depth. |
+| `LEMONSQUEEZY_ALLOWED_STORE_IDS` | Comma-separated allowlist of store IDs. When set: (1) any tool whose input includes a `storeId` rejects calls to a non-allowed store; (2) tools that *accept* a `storeId` filter (e.g. `ls_list_orders`, `ls_list_subscriptions`) require it — calls without one are blocked so a missing filter cannot return data from every store the API key can see. Tools with no `storeId` field at all (e.g. `ls_refund_order`, `ls_cancel_subscription`, `ls_archive_customer`, `ls_delete_webhook`, `ls_delete_discount`, `ls_update_license_key`, `ls_list_stores`) route by their own resource ID and are **not** gated by this allowlist. LemonSqueezy API keys are issued at the account level and authorize access to every store in that account, so this allowlist is the only in-process store boundary the server can enforce. Pair it with `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` / `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` / `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` for defense in depth, and — if your account hosts multiple stores you don't want exposed to the same agent — keep those stores under a separate LemonSqueezy account whose API key isn't reachable from this server. |
 | `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` | Rejects `ls_refund_order` and `ls_refund_subscription_invoice` calls above this amount. |
-| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include `ls_update_license_key` calls that set `disabled: true`, and `ls_update_subscription` calls that pause or switch plan. |
+| `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` | Positive integer. Max destructive tool calls per 60-second rolling window. In-process limit — per MCP server instance, not global; each `npx` cold start resets the window. Counts include every refund, cancellation, archive, and delete tool, plus the input-dependent destructive paths: `ls_update_license_key` calls that set `disabled: true` *or* change `activationLimit`, `ls_update_subscription` calls that pause or switch plan, and `ls_update_customer` calls with `status: "archived"`. |
 | `LEMONSQUEEZY_DISABLE_CLASSES` | Comma-separated list of [authority classes](#authority-classes) to refuse outright. Any tool whose class is listed returns a `guardrail_block` before the API call is attempted. Example: `LEMONSQUEEZY_DISABLE_CLASSES=money,recurring,pii` lets an agent run reads but blocks refunds, subscription changes, and customer-record access. Unknown class names throw at server startup. |
 | `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` | Per-class rolling rate limits, comma-separated. Each entry is `class:N`, `class:N/m`, or `class:N/h` (bare numbers default to per-minute). Example: `money:2/h,recurring:5/h,key:10/m`. Composes with `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` — both must pass. In-process per server instance. |
 | `LEMONSQUEEZY_LOG` | Structured-log verbosity to stderr. Set to `all` (or legacy `json`) to log every tool and HTTP call, `audit` to log only destructive-call audit entries plus errors (recommended for production), `error` to log only failures. Unset: no logs. Destructive calls are tagged `audit: true` and include their inputs. |
@@ -238,7 +239,11 @@ HTTP errors include the upstream `X-Request-Id` when present, so support tickets
 
 ## Authority classes
 
-Every tool is tagged with an **authority class** — a label for the kind of business authority a caller needs to invoke it. The class is separate from the binary destructive/read-only annotation: a customer-record read and a product list are both reads, but only one returns PII; a checkout creation and a refund are both writes, but only one moves money. Granular classes let an operator gate by the dimension that matters, instead of being stuck with a single "destructive" toggle.
+**The strongest access control LemonSqueezy itself exposes is the API key boundary.** A LemonSqueezy API key authorizes its full account — every store, every tool — and the only way to deny a class of authority through LemonSqueezy is to not give the API key to the agent in the first place. LemonSqueezy's team-membership UI scopes which humans can do which actions in the dashboard, but the public API key inherits the full authority of the account it was issued under; there's no "this key can read but not refund" toggle. So the authoritative boundary, as far as the upstream API is concerned, is *which API key the agent has*.
+
+That means the env vars below are the primary in-process control surface for anything LemonSqueezy can't gate by itself — per-class rate ceilings (`RATE_LIMIT_PER_CLASS`), deploy-time class disables (`DISABLE_CLASSES`), refund caps (`MAX_REFUND_AMOUNT_CENTS`), and the audit log. They are belt-and-braces in the sense that an operator who can change the server's env can remove them; they are load-bearing in the sense that LemonSqueezy has no equivalent. If you need an agent that genuinely cannot reach a store or a class of action, the durable answer is a separate LemonSqueezy account whose key is never handed to that agent.
+
+Every tool is tagged with an **authority class** — a label for the kind of business authority a caller needs to invoke it. The class is separate from the binary destructive/read-only annotation: a customer-record read and a product list are both reads, but only one returns PII; a checkout creation and a refund are both writes, but only one moves money.
 
 | Class | What it covers | Example tools |
 | --- | --- | --- |
@@ -250,9 +255,14 @@ Every tool is tagged with an **authority class** — a label for the kind of bus
 | `key` | License-key admin (activate, deactivate, disable, change activation limit). | `ls_update_license_key`, `ls_activate_license`, `ls_deactivate_license` |
 | `webhook` | Webhook configuration — affects the trust surface other systems rely on. | `ls_create_webhook`, `ls_update_webhook`, `ls_delete_webhook` |
 
-Note: `ls_get_order` returns customer fields incidentally, but its primary payload is the order — it stays in `read`, not `pii`. The class is reserved for tools whose *primary purpose* is the customer record. If you need to deny all access to customer-shaped data, prefer a scoped API key over class-disable alone.
+Note: `ls_get_order` returns customer fields incidentally, but its primary payload is the order — it stays in `read`, not `pii`. The class is reserved for tools whose *primary purpose* is the customer record. If you need to deny all access to customer-shaped data, set `LEMONSQUEEZY_DISABLE_CLASSES=pii` and — if the agent must never under any circumstances touch that data — also issue its API key from a separate LemonSqueezy account that doesn't host customer records you care about.
+
+The two opt-in env vars that consume this taxonomy:
 
-`LEMONSQUEEZY_DISABLE_CLASSES` blocks a class outright. `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` caps the call rate per class. Both are opt-in; with neither set, behavior is unchanged from prior versions.
+- `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS` — caps the call rate per class. LemonSqueezy permissions cannot express "max 2 refunds per hour"; this is the only place that policy can live. **This is the load-bearing one for runaway-agent prevention.**
+- `LEMONSQUEEZY_DISABLE_CLASSES` — blocks a class outright. Useful when fast deploy-time toggles matter — flipping `DISABLE_CLASSES=pii,mutate,money,recurring,key,webhook` to lock an analytics deployment into pure reads is a one-line config change. An operator who can change the server's env can also remove this gate, so for an authoritative deny use a separate LemonSqueezy account whose API key the agent never sees.
+
+Both are opt-in; with neither set, behavior is unchanged from prior versions.
 
 ## Resources
 
@@ -260,16 +270,16 @@ The server exposes one MCP Resource for clients that prefer structural retrieval
 
 | URI | MIME type | Contents |
 | --- | --- | --- |
-| `lemonsqueezy://audit-log` | `application/x-ndjson` | The most recent destructive tool calls and outcomes (rate-limit blocks, refund-cap blocks, exceptions, successes). Bounded ring buffer of the last 1000 entries, most-recent-first, resets on server restart. Secret-shaped input fields are redacted before they reach the buffer. |
+| `lemonsqueezy://audit-log` | `application/x-ndjson` | The most recent destructive tool calls and outcomes (rate-limit blocks, refund-cap blocks, exceptions, successes). Bounded ring buffer of the last 1000 entries, most-recent-first, resets on server restart. Redaction runs on the input payload before it reaches the buffer: any object key whose name matches a credential / PII pattern (`secret`, `password`, `token`, `api_key`, `bearer`, `authorization`, `signing_secret`, `private_key`, `pin`, `ssn`, `social_security_number`, `credit_card`, `card_number`, `cvv`, `cvc` — case-insensitive, whole-word) AND any string value matching the JWT bearer-token shape (`eyJ…`-prefixed, three base64url segments) is replaced with `[REDACTED]`. Ordinary identifiers (`licenseKey`, `instanceId`, `storeId`, `orderId`, `webhookId`) and UUID-shaped values are preserved. |
 
 ## Operating the server unattended
 
 For unattended/agentic use against a live store, we recommend:
 
-1. Use a LemonSqueezy API key scoped to the specific store(s) the agent may touch — this is the only authoritative store boundary for tools that route by their own resource ID (refunds, cancels, archive, delete-webhook, etc.). Set `LEMONSQUEEZY_ALLOWED_STORE_IDS` to the same set as a defense-in-depth gate on the tools that *do* take a `storeId`.
+1. Issue an API key under a LemonSqueezy account that hosts only the store(s) the agent is allowed to touch — LemonSqueezy doesn't expose per-store API-key scoping, so account separation is the durable store boundary. Set `LEMONSQUEEZY_ALLOWED_STORE_IDS` to the same set as a belt-and-braces in-process gate on the tools that take a `storeId`.
 2. Set `LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS` to a per-call cap well below any single-refund expectation.
 3. Set `LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT` to a small number (e.g. 5/min) as a runaway-agent circuit breaker. For finer control, add `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS=money:2/h,recurring:5/h,key:10/m` so each [authority class](#authority-classes) has its own ceiling.
-4. If a class shouldn't be reachable at all (e.g. an analytics agent that needs only `read`), set `LEMONSQUEEZY_DISABLE_CLASSES` to refuse the rest outright — calls return a `guardrail_block` before the API is touched.
+4. If a class shouldn't be reachable at all (e.g. an analytics agent that needs only `read`), set `LEMONSQUEEZY_DISABLE_CLASSES` to the classes you want refused. The server rejects them before the API call is built. For an irrevocable deny, also issue the agent's API key from a separate LemonSqueezy account.
 5. Set `LEMONSQUEEZY_LOG=audit` and ship stderr to your log aggregator. The `audit` level keeps every destructive-call entry plus errors but drops successful reads so log volume stays bounded over weeks of operation. Alert on `status: "guardrail_block"` or elevated error rates per tool. Use `LEMONSQUEEZY_LOG=all` while debugging.
 6. Run `LEMONSQUEEZY_API_KEY_COMMAND` against a vault-backed secret so credentials can rotate without restarting the server process. The API client invalidates its in-process key cache automatically on a 401/403, so a rotated upstream key picks up on the next request rather than waiting on the 1h TTL.
 
@@ -290,6 +300,13 @@ npm test                  # full unit + handler suite
 npm run test:integration  # requires LEMONSQUEEZY_TEST_API_KEY + LEMONSQUEEZY_TEST_STORE_ID
 ```
 
+`Containerfile` is generated from `Dockerfile`. After editing `Dockerfile`:
+
+```bash
+npm run gen:containerfile    # regenerate Containerfile
+npm run check:containerfile  # CI runs this; non-zero exit means the two have drifted
+```
+
 ## Releasing
 
 Two paths from a clean checkout of `main`. Both produce the same artifact (npm publish with provenance + GitHub release).
@@ -313,7 +330,7 @@ git push origin main --follow-tags
 gh run list --limit 2
 ```
 
-The tag push triggers `.github/workflows/release.yml`, which runs `release.sh` in CI mode: lint, test, build, npm publish (with `--provenance`) using the org-level `NPM_TOKEN` secret, then GitHub release creation, then a smoke test against the published tarball. No local `npm login` needed.
+The tag push triggers `.github/workflows/release.yml`, which runs `release.sh` in CI mode: lint, test, build, npm publish (with `--provenance`) using the org-level `NPM_TOKEN` secret, then GitHub release creation, then a smoke test against the published tarball, then a publish to the [Official MCP Registry](https://registry.modelcontextprotocol.io) via GitHub OIDC (no `MCP_*` secret needed; the namespace `io.github.YawLabs/*` is authorized purely from the OIDC `repository_owner` claim). No local `npm login` needed.
 
 ### 2. Local end-to-end
 
@@ -328,6 +345,8 @@ npm login --auth-type=web   # publisher of @yawlabs/lemonsqueezy-mcp
 gh auth login               # GitHub CLI for the release-creation step
 ```
 
+The local path does **not** publish to the Official MCP Registry — that step lives only in CI and depends on a GitHub Actions OIDC token. To push a locally-released version to the registry, install [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/releases), run `mcp-publisher login github` (interactive OAuth), then `mcp-publisher publish` from the repo root.
+
 ## License
 
 MIT

package/dist/index.js

@@ -3133,20 +3133,20 @@ var require_utils = __commonJS({
       return acc;
     }
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer2) {
-      buffer2.length = 0;
+    function consumeIsZone(buffer) {
+      buffer.length = 0;
       return true;
     }
-    function consumeHextets(buffer2, address, output) {
-      if (buffer2.length) {
-        const hex3 = stringArrayToHexStripped(buffer2);
+    function consumeHextets(buffer, address, output) {
+      if (buffer.length) {
+        const hex3 = stringArrayToHexStripped(buffer);
         if (hex3 !== "") {
           address.push(hex3);
         } else {
           output.error = true;
           return false;
         }
-        buffer2.length = 0;
+        buffer.length = 0;
       }
       return true;
     }
@@ -3154,7 +3154,7 @@ var require_utils = __commonJS({
       let tokenCount = 0;
       const output = { error: false, address: "", zone: "" };
       const address = [];
-      const buffer2 = [];
+      const buffer = [];
       let endipv6Encountered = false;
       let endIpv6 = false;
       let consume = consumeHextets;
@@ -3167,7 +3167,7 @@ var require_utils = __commonJS({
           if (endipv6Encountered === true) {
             endIpv6 = true;
           }
-          if (!consume(buffer2, address, output)) {
+          if (!consume(buffer, address, output)) {
             break;
           }
           if (++tokenCount > 7) {
@@ -3180,22 +3180,22 @@ var require_utils = __commonJS({
           address.push(":");
           continue;
         } else if (cursor === "%") {
-          if (!consume(buffer2, address, output)) {
+          if (!consume(buffer, address, output)) {
             break;
           }
           consume = consumeIsZone;
         } else {
-          buffer2.push(cursor);
+          buffer.push(cursor);
           continue;
         }
       }
-      if (buffer2.length) {
+      if (buffer.length) {
         if (consume === consumeIsZone) {
-          output.zone = buffer2.join("");
+          output.zone = buffer.join("");
         } else if (endIpv6) {
-          address.push(buffer2.join(""));
+          address.push(buffer.join(""));
         } else {
-          address.push(stringArrayToHexStripped(buffer2));
+          address.push(stringArrayToHexStripped(buffer));
         }
       }
       output.address = address.join("");
@@ -10015,8 +10015,8 @@ var ZodSet = class _ZodSet extends ZodType {
       maxSize: { value: maxSize, message: errorUtil.toString(message) }
     });
   }
-  size(size, message) {
-    return this.min(size, message).max(size, message);
+  size(size2, message) {
+    return this.min(size2, message).max(size2, message);
   }
   nonempty(message) {
     return this.min(1, message);
@@ -12392,8 +12392,8 @@ var $ZodCheckMaxSize = /* @__PURE__ */ $constructor("$ZodCheckMaxSize", (inst, d
   });
   inst._zod.check = (payload) => {
     const input = payload.value;
-    const size = input.size;
-    if (size <= def.maximum)
+    const size2 = input.size;
+    if (size2 <= def.maximum)
       return;
     payload.issues.push({
       origin: getSizableOrigin(input),
@@ -12420,8 +12420,8 @@ var $ZodCheckMinSize = /* @__PURE__ */ $constructor("$ZodCheckMinSize", (inst, d
   });
   inst._zod.check = (payload) => {
     const input = payload.value;
-    const size = input.size;
-    if (size >= def.minimum)
+    const size2 = input.size;
+    if (size2 >= def.minimum)
       return;
     payload.issues.push({
       origin: getSizableOrigin(input),
@@ -12449,10 +12449,10 @@ var $ZodCheckSizeEquals = /* @__PURE__ */ $constructor("$ZodCheckSizeEquals", (i
   });
   inst._zod.check = (payload) => {
     const input = payload.value;
-    const size = input.size;
-    if (size === def.size)
+    const size2 = input.size;
+    if (size2 === def.size)
       return;
-    const tooBig = size > def.size;
+    const tooBig = size2 > def.size;
     payload.issues.push({
       origin: getSizableOrigin(input),
       ...tooBig ? { code: "too_big", maximum: def.size } : { code: "too_small", minimum: def.size },
@@ -14484,12 +14484,12 @@ var $ZodPipe = /* @__PURE__ */ $constructor("$ZodPipe", (inst, def) => {
     return handlePipeResult(left, def.out, ctx);
   };
 });
-function handlePipeResult(left, next, ctx) {
+function handlePipeResult(left, next2, ctx) {
   if (left.issues.length) {
     left.aborted = true;
     return left;
   }
-  return next._zod.run({ value: left.value, issues: left.issues }, ctx);
+  return next2._zod.run({ value: left.value, issues: left.issues }, ctx);
 }
 var $ZodCodec = /* @__PURE__ */ $constructor("$ZodCodec", (inst, def) => {
   $ZodType.init(inst, def);
@@ -20922,11 +20922,11 @@ function _minSize(minimum, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _size(size, params) {
+function _size(size2, params) {
   return new $ZodCheckSizeEquals({
     check: "size_equals",
     ...normalizeParams(params),
-    size
+    size: size2
   });
 }
 // @__NO_SIDE_EFFECTS__
@@ -23878,8 +23878,8 @@ var ZodFile = /* @__PURE__ */ $constructor("ZodFile", (inst, def) => {
   $ZodFile.init(inst, def);
   ZodType2.init(inst, def);
   inst._zod.processJSONSchema = (ctx, json2, params) => fileProcessor(inst, ctx, json2, params);
-  inst.min = (size, params) => inst.check(_minSize(size, params));
-  inst.max = (size, params) => inst.check(_maxSize(size, params));
+  inst.min = (size2, params) => inst.check(_minSize(size2, params));
+  inst.max = (size2, params) => inst.check(_maxSize(size2, params));
   inst.mime = (types, params) => inst.check(_mime(Array.isArray(types) ? types : [types], params));
 });
 function file(params) {
@@ -30200,203 +30200,6 @@ var StdioServerTransport = class {
   }
 };
 
-// src/audit-buffer.ts
-var DEFAULT_CAP = 1e3;
-var buffer = [];
-var cap = DEFAULT_CAP;
-function pushAuditEntry(entry) {
-  buffer.push(entry);
-  if (buffer.length > cap) {
-    buffer.splice(0, buffer.length - cap);
-  }
-}
-function readAuditEntries(limit) {
-  const reversed = buffer.slice().reverse();
-  if (limit === void 0 || limit >= reversed.length) return reversed;
-  if (limit <= 0) return [];
-  return reversed.slice(0, limit);
-}
-
-// src/guardrails.ts
-var GuardrailError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GuardrailError";
-  }
-};
-var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
-function isAuthorityClass(s) {
-  return AUTHORITY_CLASSES.includes(s);
-}
-var cachedOptions = null;
-var destructiveTimestamps = [];
-var classTimestamps = /* @__PURE__ */ new Map();
-function readNumber(name, raw) {
-  if (raw === void 0 || raw.trim() === "") return null;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n < 0) {
-    throw new Error(`${name} must be a non-negative number (got ${JSON.stringify(raw)})`);
-  }
-  return n;
-}
-function parseDisabledClasses(raw) {
-  if (!raw || raw.trim() === "") return null;
-  const out = /* @__PURE__ */ new Set();
-  for (const part of raw.split(",")) {
-    const cls = part.trim();
-    if (!cls) continue;
-    if (!isAuthorityClass(cls)) {
-      throw new Error(
-        `LEMONSQUEEZY_DISABLE_CLASSES contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
-      );
-    }
-    out.add(cls);
-  }
-  return out.size > 0 ? out : null;
-}
-function parseClassRateLimits(raw) {
-  if (!raw || raw.trim() === "") return null;
-  const out = /* @__PURE__ */ new Map();
-  for (const part of raw.split(",")) {
-    const segment = part.trim();
-    if (!segment) continue;
-    const colon = segment.indexOf(":");
-    if (colon < 0) {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry missing colon: ${JSON.stringify(segment)} (expected class:N or class:N/h)`
-      );
-    }
-    const cls = segment.slice(0, colon).trim();
-    if (!isAuthorityClass(cls)) {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
-      );
-    }
-    const specRaw = segment.slice(colon + 1).trim();
-    const slash = specRaw.indexOf("/");
-    const numPart = slash >= 0 ? specRaw.slice(0, slash).trim() : specRaw;
-    const unitPart = slash >= 0 ? specRaw.slice(slash + 1).trim().toLowerCase() : "m";
-    const n = Number(numPart);
-    if (!Number.isFinite(n) || n < 0 || numPart === "") {
-      throw new Error(`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid number: ${JSON.stringify(segment)}`);
-    }
-    let windowMs;
-    if (unitPart === "m") windowMs = 6e4;
-    else if (unitPart === "h") windowMs = 36e5;
-    else {
-      throw new Error(
-        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid unit (expected m or h): ${JSON.stringify(segment)}`
-      );
-    }
-    out.set(cls, { limit: n, windowMs });
-  }
-  return out.size > 0 ? out : null;
-}
-function loadOptions() {
-  if (cachedOptions) return cachedOptions;
-  const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
-  const allowedSet = allowed ? new Set(
-    allowed.split(",").map((s) => s.trim()).filter(Boolean)
-  ) : null;
-  cachedOptions = {
-    allowedStoreIds: allowedSet && allowedSet.size > 0 ? allowedSet : null,
-    maxRefundAmountCents: readNumber(
-      "LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS",
-      process.env.LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS
-    ),
-    rateLimitPerMinute: readNumber(
-      "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
-      process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
-    ),
-    disabledClasses: parseDisabledClasses(process.env.LEMONSQUEEZY_DISABLE_CLASSES),
-    classRateLimits: parseClassRateLimits(process.env.LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)
-  };
-  return cachedOptions;
-}
-function checkStoreAllowed(storeId) {
-  if (!storeId) return;
-  const o = loadOptions();
-  if (!o.allowedStoreIds) return;
-  if (!o.allowedStoreIds.has(String(storeId))) {
-    throw new GuardrailError(`Store ID ${storeId} is not in LEMONSQUEEZY_ALLOWED_STORE_IDS allowlist`);
-  }
-}
-function checkRefundAmount(cents) {
-  const o = loadOptions();
-  if (o.maxRefundAmountCents === null) return;
-  if (cents > o.maxRefundAmountCents) {
-    throw new GuardrailError(
-      `Refund amount ${cents} cents exceeds LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS (${o.maxRefundAmountCents})`
-    );
-  }
-}
-function checkDestructiveRateLimit(now = Date.now()) {
-  const o = loadOptions();
-  if (o.rateLimitPerMinute === null) return;
-  const cutoff = now - 6e4;
-  destructiveTimestamps = destructiveTimestamps.filter((t) => t > cutoff);
-  if (destructiveTimestamps.length >= o.rateLimitPerMinute) {
-    throw new GuardrailError(`Destructive call rate limit exceeded (${o.rateLimitPerMinute}/min). Wait and retry.`);
-  }
-  destructiveTimestamps.push(now);
-}
-function isStoreAllowlistActive() {
-  return loadOptions().allowedStoreIds !== null;
-}
-function isPresent(value) {
-  if (value === void 0 || value === null) return false;
-  if (typeof value === "string" && value === "") return false;
-  if (Array.isArray(value) && value.length === 0) return false;
-  return true;
-}
-function checkStoreScopedToolInput(tool, input) {
-  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
-  if (toolAcceptsStoreId) {
-    const raw = input.storeId;
-    if (raw !== void 0 && raw !== null && raw !== "") {
-      checkStoreAllowed(String(raw));
-    } else if (isStoreAllowlistActive()) {
-      throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
-    }
-  }
-  if (tool.requiredFilters && tool.requiredFilters.length > 0 && isStoreAllowlistActive()) {
-    const anyPresent = tool.requiredFilters.some((key) => isPresent(input[key]));
-    if (!anyPresent) {
-      throw new GuardrailError(
-        `At least one of [${tool.requiredFilters.join(", ")}] is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set`
-      );
-    }
-  }
-}
-function isDestructiveCall(tool, input) {
-  if (typeof tool.isDestructive === "function") return tool.isDestructive(input);
-  return tool.annotations?.destructiveHint === true;
-}
-function checkClassAllowed(cls) {
-  const o = loadOptions();
-  if (!o.disabledClasses) return;
-  if (o.disabledClasses.has(cls)) {
-    throw new GuardrailError(`Tool authority class ${JSON.stringify(cls)} is disabled by LEMONSQUEEZY_DISABLE_CLASSES`);
-  }
-}
-function checkClassRateLimit(cls, now = Date.now()) {
-  const o = loadOptions();
-  if (!o.classRateLimits) return;
-  const spec = o.classRateLimits.get(cls);
-  if (!spec) return;
-  const cutoff = now - spec.windowMs;
-  const list = (classTimestamps.get(cls) ?? []).filter((t) => t > cutoff);
-  if (list.length >= spec.limit) {
-    const unit = spec.windowMs === 6e4 ? "min" : spec.windowMs === 36e5 ? "hour" : `${spec.windowMs}ms`;
-    classTimestamps.set(cls, list);
-    throw new GuardrailError(
-      `Class ${JSON.stringify(cls)} rate limit exceeded (${spec.limit}/${unit}). Wait and retry.`
-    );
-  }
-  list.push(now);
-  classTimestamps.set(cls, list);
-}
-
 // src/logger.ts
 function getLogLevel() {
   const v = process.env.LEMONSQUEEZY_LOG;
@@ -30424,6 +30227,15 @@ function shouldLog(entry, level) {
       return isErrorEntry(entry);
   }
 }
+function safeString(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "string") return value;
+  try {
+    return String(value);
+  } catch {
+    return "[unrepresentable]";
+  }
+}
 function logEvent(entry) {
   const level = getLogLevel();
   if (!shouldLog(entry, level)) return;
@@ -30445,7 +30257,7 @@ function logEvent(entry) {
       latency_ms: entry.latency_ms,
       request_id: entry.request_id,
       audit: entry.audit,
-      error: entry.error,
+      error: safeString(entry.error),
       log_error: "inputs_not_serializable"
     });
     process.stderr.write(`${fallback}
@@ -30454,41 +30266,6 @@ function logEvent(entry) {
   }
 }
 
-// src/redact.ts
-var SECRET_KEY_RE = /^(secret|password|token|api[_-]?key|bearer|authorization|signing[_-]?secret)$/i;
-var REDACTED = "[REDACTED]";
-var CIRCULAR = "[CIRCULAR]";
-var MAX_DEPTH = 32;
-function isPlainObject3(value) {
-  if (value === null || typeof value !== "object") return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function redactInner(value, visited, depth) {
-  if (depth > MAX_DEPTH) return CIRCULAR;
-  if (value === null || typeof value !== "object") return value;
-  if (Array.isArray(value)) {
-    if (visited.has(value)) return CIRCULAR;
-    visited.add(value);
-    return value.map((item) => redactInner(item, visited, depth + 1));
-  }
-  if (!isPlainObject3(value)) return value;
-  if (visited.has(value)) return CIRCULAR;
-  visited.add(value);
-  const out = {};
-  for (const [key, val] of Object.entries(value)) {
-    if (SECRET_KEY_RE.test(key)) {
-      out[key] = REDACTED;
-    } else {
-      out[key] = redactInner(val, visited, depth + 1);
-    }
-  }
-  return out;
-}
-function redactSecrets(input) {
-  return redactInner(input, /* @__PURE__ */ new WeakSet(), 0);
-}
-
 // src/retry.ts
 var REQUEST_TIMEOUT_MS = 3e4;
 var DEFAULT_RETRY_WAIT_MS = 1e3;
@@ -30595,11 +30372,15 @@ async function fetchWithRetry(url2, init, opts) {
 
 // src/secret.ts
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
 import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var COMMAND_TIMEOUT_MS = 1e4;
 var COMMAND_MAX_BUFFER = 64 * 1024;
+function fingerprintFor(mode, raw) {
+  return createHash("sha256").update(`${mode}:${raw}`).digest("hex");
+}
 var cached2 = null;
 var testModeAnnounced = false;
 function announceTestModeOnce() {
@@ -30652,7 +30433,7 @@ function intoCache(fingerprint, key) {
 async function loadApiKey() {
   const cmdStr = process.env.LEMONSQUEEZY_API_KEY_COMMAND;
   if (cmdStr && cmdStr.trim() !== "") {
-    const fingerprint2 = `cmd:${cmdStr}`;
+    const fingerprint2 = fingerprintFor("cmd", cmdStr);
     const hit2 = fromCache(fingerprint2);
     if (hit2 !== null) return hit2;
     const { command, args } = parseCommand(cmdStr);
@@ -30674,7 +30455,7 @@ async function loadApiKey() {
   }
   const testRaw = process.env.LEMONSQUEEZY_TEST_API_KEY;
   if (testRaw && testRaw.trim() !== "") {
-    const fingerprint2 = `test:${testRaw}`;
+    const fingerprint2 = fingerprintFor("test", testRaw);
     const hit2 = fromCache(fingerprint2);
     if (hit2 !== null) {
       announceTestModeOnce();
@@ -30691,7 +30472,7 @@ async function loadApiKey() {
   if (raw.trim() === "") {
     throw new Error("LEMONSQUEEZY_API_KEY is set but empty. Provide a valid API key.");
   }
-  const fingerprint = `env:${raw}`;
+  const fingerprint = fingerprintFor("env", raw);
   const hit = fromCache(fingerprint);
   if (hit !== null) return hit;
   intoCache(fingerprint, raw);
@@ -31680,6 +31461,186 @@ var orderItemTools = [
   }
 ];
 
+// src/guardrails.ts
+var GuardrailError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GuardrailError";
+  }
+};
+var AUTHORITY_CLASSES = ["read", "pii", "mutate", "money", "recurring", "key", "webhook"];
+function isAuthorityClass(s) {
+  return AUTHORITY_CLASSES.includes(s);
+}
+var cachedOptions = null;
+var destructiveTimestamps = [];
+var classTimestamps = /* @__PURE__ */ new Map();
+function readNumber(name, raw) {
+  if (raw === void 0 || raw.trim() === "") return null;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) {
+    throw new Error(`${name} must be a non-negative number (got ${JSON.stringify(raw)})`);
+  }
+  return n;
+}
+function parseDisabledClasses(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",")) {
+    const cls = part.trim();
+    if (!cls) continue;
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_DISABLE_CLASSES contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    out.add(cls);
+  }
+  return out.size > 0 ? out : null;
+}
+function parseClassRateLimits(raw) {
+  if (!raw || raw.trim() === "") return null;
+  const out = /* @__PURE__ */ new Map();
+  for (const part of raw.split(",")) {
+    const segment = part.trim();
+    if (!segment) continue;
+    const colon = segment.indexOf(":");
+    if (colon < 0) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry missing colon: ${JSON.stringify(segment)} (expected class:N or class:N/h)`
+      );
+    }
+    const cls = segment.slice(0, colon).trim();
+    if (!isAuthorityClass(cls)) {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS contains unknown class ${JSON.stringify(cls)} (expected one of: ${AUTHORITY_CLASSES.join(", ")})`
+      );
+    }
+    const specRaw = segment.slice(colon + 1).trim();
+    const slash = specRaw.indexOf("/");
+    const numPart = slash >= 0 ? specRaw.slice(0, slash).trim() : specRaw;
+    const unitPart = slash >= 0 ? specRaw.slice(slash + 1).trim().toLowerCase() : "m";
+    const n = Number(numPart);
+    if (!Number.isFinite(n) || n < 0 || numPart === "") {
+      throw new Error(`LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid number: ${JSON.stringify(segment)}`);
+    }
+    let windowMs;
+    if (unitPart === "m") windowMs = 6e4;
+    else if (unitPart === "h") windowMs = 36e5;
+    else {
+      throw new Error(
+        `LEMONSQUEEZY_RATE_LIMIT_PER_CLASS entry has invalid unit (expected m or h): ${JSON.stringify(segment)}`
+      );
+    }
+    out.set(cls, { limit: n, windowMs });
+  }
+  return out.size > 0 ? out : null;
+}
+function loadOptions() {
+  if (cachedOptions) return cachedOptions;
+  const allowed = process.env.LEMONSQUEEZY_ALLOWED_STORE_IDS;
+  const allowedSet = allowed ? new Set(
+    allowed.split(",").map((s) => s.trim()).filter(Boolean)
+  ) : null;
+  cachedOptions = {
+    allowedStoreIds: allowedSet && allowedSet.size > 0 ? allowedSet : null,
+    maxRefundAmountCents: readNumber(
+      "LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS",
+      process.env.LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS
+    ),
+    rateLimitPerMinute: readNumber(
+      "LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT",
+      process.env.LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT
+    ),
+    disabledClasses: parseDisabledClasses(process.env.LEMONSQUEEZY_DISABLE_CLASSES),
+    classRateLimits: parseClassRateLimits(process.env.LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)
+  };
+  return cachedOptions;
+}
+function checkStoreAllowed(storeId) {
+  if (!storeId) return;
+  const o = loadOptions();
+  if (!o.allowedStoreIds) return;
+  if (!o.allowedStoreIds.has(String(storeId))) {
+    throw new GuardrailError(`Store ID ${storeId} is not in LEMONSQUEEZY_ALLOWED_STORE_IDS allowlist`);
+  }
+}
+function checkRefundAmount(cents) {
+  const o = loadOptions();
+  if (o.maxRefundAmountCents === null) return;
+  if (cents > o.maxRefundAmountCents) {
+    throw new GuardrailError(
+      `Refund amount ${cents} cents exceeds LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS (${o.maxRefundAmountCents})`
+    );
+  }
+}
+function checkDestructiveRateLimit(now = Date.now()) {
+  const o = loadOptions();
+  if (o.rateLimitPerMinute === null) return;
+  const cutoff = now - 6e4;
+  destructiveTimestamps = destructiveTimestamps.filter((t) => t > cutoff);
+  if (destructiveTimestamps.length >= o.rateLimitPerMinute) {
+    throw new GuardrailError(`Destructive call rate limit exceeded (${o.rateLimitPerMinute}/min). Wait and retry.`);
+  }
+  destructiveTimestamps.push(now);
+}
+function isStoreAllowlistActive() {
+  return loadOptions().allowedStoreIds !== null;
+}
+function isPresent(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string" && value === "") return false;
+  if (Array.isArray(value) && value.length === 0) return false;
+  return true;
+}
+function checkStoreScopedToolInput(tool, input) {
+  const toolAcceptsStoreId = "storeId" in tool.inputSchema.shape;
+  if (toolAcceptsStoreId) {
+    const raw = input.storeId;
+    if (raw !== void 0 && raw !== null && raw !== "") {
+      checkStoreAllowed(String(raw));
+    } else if (isStoreAllowlistActive()) {
+      throw new GuardrailError("storeId is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set");
+    }
+  }
+  if (tool.requiredFilters && tool.requiredFilters.length > 0 && isStoreAllowlistActive()) {
+    const anyPresent = tool.requiredFilters.some((key) => isPresent(input[key]));
+    if (!anyPresent) {
+      throw new GuardrailError(
+        `At least one of [${tool.requiredFilters.join(", ")}] is required when LEMONSQUEEZY_ALLOWED_STORE_IDS is set`
+      );
+    }
+  }
+}
+function isDestructiveCall(tool, input) {
+  if (typeof tool.isDestructive === "function") return tool.isDestructive(input);
+  return tool.annotations?.destructiveHint === true;
+}
+function checkClassAllowed(cls) {
+  const o = loadOptions();
+  if (!o.disabledClasses) return;
+  if (o.disabledClasses.has(cls)) {
+    throw new GuardrailError(`Tool authority class ${JSON.stringify(cls)} is disabled by LEMONSQUEEZY_DISABLE_CLASSES`);
+  }
+}
+function checkClassRateLimit(cls, now = Date.now()) {
+  const o = loadOptions();
+  if (!o.classRateLimits) return;
+  const spec = o.classRateLimits.get(cls);
+  if (!spec) return;
+  const cutoff = now - spec.windowMs;
+  const list = (classTimestamps.get(cls) ?? []).filter((t) => t > cutoff);
+  if (list.length >= spec.limit) {
+    const unit = spec.windowMs === 6e4 ? "min" : spec.windowMs === 36e5 ? "hour" : `${spec.windowMs}ms`;
+    classTimestamps.set(cls, list);
+    throw new GuardrailError(
+      `Class ${JSON.stringify(cls)} rate limit exceeded (${spec.limit}/${unit}). Wait and retry.`
+    );
+  }
+  list.push(now);
+  classTimestamps.set(cls, list);
+}
+
 // src/tools/orders.ts
 var orderTools = [
   {
@@ -32495,8 +32456,168 @@ var webhookTools = [
   }
 ];
 
+// src/audit-buffer.ts
+var DEFAULT_CAP = 1e3;
+var backing = new Array(DEFAULT_CAP);
+var cap = DEFAULT_CAP;
+var next = 0;
+var size = 0;
+function pushAuditEntry(entry) {
+  backing[next] = entry;
+  next = (next + 1) % cap;
+  if (size < cap) size += 1;
+}
+function readAuditEntries(limit) {
+  if (limit !== void 0 && limit <= 0) return [];
+  const wanted = limit === void 0 ? size : Math.min(limit, size);
+  if (wanted === 0) return [];
+  const out = new Array(wanted);
+  let cursor = (next - 1 + cap) % cap;
+  for (let i = 0; i < wanted; i++) {
+    out[i] = backing[cursor];
+    cursor = (cursor - 1 + cap) % cap;
+  }
+  return out;
+}
+
+// src/redact.ts
+var SECRET_KEY_RE = /^(secret|password|token|api[_-]?key|bearer|authorization|signing[_-]?secret|private[_-]?key|pin|ssn|social[_-]?security[_-]?number|credit[_-]?card|card[_-]?number|cvv|cvc)$/i;
+var JWT_VALUE_RE = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}$/;
+var REDACTED = "[REDACTED]";
+var CIRCULAR = "[CIRCULAR]";
+var MAX_DEPTH = 32;
+function isPlainObject3(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function looksLikeBearerToken(value) {
+  if (typeof value !== "string") return false;
+  if (value.length < 20) return false;
+  return JWT_VALUE_RE.test(value);
+}
+function redactInner(value, visited, depth) {
+  if (depth > MAX_DEPTH) return CIRCULAR;
+  if (typeof value === "string" && looksLikeBearerToken(value)) return REDACTED;
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) {
+    if (visited.has(value)) return CIRCULAR;
+    visited.add(value);
+    return value.map((item) => redactInner(item, visited, depth + 1));
+  }
+  if (!isPlainObject3(value)) return value;
+  if (visited.has(value)) return CIRCULAR;
+  visited.add(value);
+  const out = {};
+  for (const [key, val] of Object.entries(value)) {
+    if (SECRET_KEY_RE.test(key)) {
+      out[key] = REDACTED;
+    } else {
+      out[key] = redactInner(val, visited, depth + 1);
+    }
+  }
+  return out;
+}
+function redactSecrets(input) {
+  return redactInner(input, /* @__PURE__ */ new WeakSet(), 0);
+}
+
+// src/wrapper.ts
+function createToolHandler(tool) {
+  return async (input) => {
+    if (input === null || typeof input !== "object") {
+      const contractError = `createToolHandler expected an object input for tool "${tool.name}", got ${input === null ? "null" : typeof input}. The MCP SDK should have rejected this before reaching the handler.`;
+      logEvent({
+        event: "tool_call",
+        tool: tool.name,
+        status: "exception",
+        latency_ms: 0,
+        error: contractError
+      });
+      return {
+        content: [{ type: "text", text: `Error: ${contractError}` }],
+        isError: true
+      };
+    }
+    const inputAsRecord = input;
+    const toolAsRecord = tool;
+    const isDestructive = isDestructiveCall(toolAsRecord, inputAsRecord);
+    const start = Date.now();
+    try {
+      checkClassAllowed(tool.authorityClass);
+      checkClassRateLimit(tool.authorityClass);
+      if (isDestructive) checkDestructiveRateLimit();
+      checkStoreScopedToolInput(toolAsRecord, inputAsRecord);
+      const response = await tool.handler(input);
+      const latency_ms = Date.now() - start;
+      const successEntry = {
+        event: "tool_call",
+        tool: tool.name,
+        status: response.ok ? "ok" : "error",
+        latency_ms,
+        request_id: response.requestId,
+        error: response.ok ? void 0 : response.error,
+        audit: isDestructive ? true : void 0,
+        inputs: isDestructive ? redactSecrets(input) : void 0
+      };
+      logEvent(successEntry);
+      if (isDestructive) {
+        pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...successEntry });
+      }
+      if (!response.ok) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${response.error || "Unknown error"}`
+            }
+          ],
+          isError: true
+        };
+      }
+      const text = JSON.stringify(response.data ?? { success: true }, null, 2);
+      return {
+        content: [{ type: "text", text }]
+      };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const latency_ms = Date.now() - start;
+      const errorEntry = {
+        event: "tool_call",
+        tool: tool.name,
+        status: err instanceof GuardrailError ? "guardrail_block" : "exception",
+        latency_ms,
+        error: message,
+        audit: isDestructive ? true : void 0,
+        inputs: isDestructive ? redactSecrets(input) : void 0
+      };
+      logEvent(errorEntry);
+      if (isDestructive) {
+        pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...errorEntry });
+      }
+      return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true
+      };
+    }
+  };
+}
+function readAuditLogResource(uri) {
+  const entries = readAuditEntries();
+  const text = entries.map((e) => JSON.stringify(e)).join("\n");
+  return {
+    contents: [
+      {
+        uri: uri.href,
+        mimeType: "application/x-ndjson",
+        text
+      }
+    ]
+  };
+}
+
 // src/index.ts
-var version2 = true ? "0.9.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.9.2" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -32530,74 +32651,7 @@ var server = new McpServer({
   version: version2
 });
 for (const tool of allTools) {
-  server.tool(
-    tool.name,
-    tool.description,
-    tool.inputSchema.shape,
-    tool.annotations,
-    async (input) => {
-      const isDestructive = isDestructiveCall(tool, input);
-      const start = Date.now();
-      try {
-        checkClassAllowed(tool.authorityClass);
-        checkClassRateLimit(tool.authorityClass);
-        if (isDestructive) checkDestructiveRateLimit();
-        checkStoreScopedToolInput(tool, input);
-        const result = await tool.handler(input);
-        const response = result;
-        const latency_ms = Date.now() - start;
-        const successEntry = {
-          event: "tool_call",
-          tool: tool.name,
-          status: response.ok ? "ok" : "error",
-          latency_ms,
-          request_id: response.requestId,
-          error: response.ok ? void 0 : response.error,
-          audit: isDestructive ? true : void 0,
-          inputs: isDestructive ? redactSecrets(input) : void 0
-        };
-        logEvent(successEntry);
-        if (isDestructive) {
-          pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...successEntry });
-        }
-        if (!response.ok) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Error: ${response.error || "Unknown error"}`
-              }
-            ],
-            isError: true
-          };
-        }
-        const text = JSON.stringify(response.data ?? { success: true }, null, 2);
-        return {
-          content: [{ type: "text", text }]
-        };
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const latency_ms = Date.now() - start;
-        const errorEntry = {
-          event: "tool_call",
-          tool: tool.name,
-          status: err instanceof GuardrailError ? "guardrail_block" : "exception",
-          latency_ms,
-          error: message,
-          audit: isDestructive ? true : void 0,
-          inputs: isDestructive ? redactSecrets(input) : void 0
-        };
-        logEvent(errorEntry);
-        if (isDestructive) {
-          pushAuditEntry({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...errorEntry });
-        }
-        return {
-          content: [{ type: "text", text: `Error: ${message}` }],
-          isError: true
-        };
-      }
-    }
-  );
+  server.tool(tool.name, tool.description, tool.inputSchema.shape, tool.annotations, createToolHandler(tool));
 }
 server.resource(
   "Recent destructive-call audit log",
@@ -32606,19 +32660,7 @@ server.resource(
     description: "The most recent destructive tool calls and their outcomes (rate limit, refund cap, etc.). Bounded ring buffer; resets on server restart.",
     mimeType: "application/x-ndjson"
   },
-  async (uri) => {
-    const entries = readAuditEntries();
-    const text = entries.map((e) => JSON.stringify(e)).join("\n");
-    return {
-      contents: [
-        {
-          uri: uri.href,
-          mimeType: "application/x-ndjson",
-          text
-        }
-      ]
-    };
-  }
+  async (uri) => readAuditLogResource(uri)
 );
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
   "description": "LemonSqueezy MCP server for managing your store from AI assistants",
   "license": "MIT",
@@ -35,6 +35,8 @@
     "test:integration": "npm run build && node --test dist/integration/*.test.js",
     "lint": "biome check src/",
     "lint:fix": "biome check --write src/",
+    "gen:containerfile": "node scripts/sync-containerfile.mjs",
+    "check:containerfile": "node scripts/sync-containerfile.mjs --check",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {},