helipod-mcp 0.5.12 → 0.5.16

package/README.md

@@ -2,8 +2,8 @@
 
 Use [Helipod](https://helipod.io) from AI coding tools: deploy apps and databases, run VPS servers, buy domains and edit DNS, and send email, by asking in plain language.
 
-- **MCP server** (`helipod-mcp`): 238 tools over the Container, Database, VPS, Domain, Email, Account and AI APIs. Works in Claude Code, Codex, Cursor, VS Code, Windsurf, Claude Desktop and any MCP client.
-- **Skills** (`skills/`): step-by-step playbooks so the agent deploys, prices and confirms the way Helipod expects (price first, confirm before deleting, read build logs on failure).
+- **MCP server** (`helipod-mcp`): 263 tools over the Container, Database, VPS, Domain, Email, Account and AI APIs. Works in Claude Code, Codex, Cursor, VS Code, Windsurf, Claude Desktop and any MCP client.
+- **Skills** (`skills/`): step-by-step playbooks so the agent deploys, prices and confirms the way Helipod expects (price first, confirm before deleting, read build logs on failure): containers, VPS and apps on a VPS, databases, domains, email, the AI gateway, end-to-end launches (app + database + domain + email) and reselling.
 
 Step-by-step guides for each tool (Claude Code, Codex, Cursor, VS Code, Gemini CLI, opencode, Windsurf, Claude Desktop, Cline and others): **https://docs.helipod.io/docs/helipod/ai-agents**
 

package/dist/http.js

@@ -35623,6 +35623,14 @@ class HelipodClient {
     const headers = !this.cfg.emailApiKey && opts.project ? { "x-helipod-project": opts.project } : undefined;
     return this.request(this.emailApiUrl, key, method, path, { ...opts, headers });
   }
+  emailWithAccountKey(method, path, opts = {}) {
+    const key = this.cfg.apiKey;
+    if (!key) {
+      throw new HelipodError(401, "NO_API_KEY", "Managing email keys needs HELIPOD_API_KEY (a Helipod API key with the Email API enabled); an email key cannot do it.");
+    }
+    const headers = opts.project ? { "x-helipod-project": opts.project } : undefined;
+    return this.request(this.emailApiUrl, key, method, path, { ...opts, headers });
+  }
   async image(link, maxBytes) {
     let url2;
     try {
@@ -35686,7 +35694,7 @@ class HelipodClient {
       const details = json2?.details && typeof json2.details === "object" && !Array.isArray(json2.details) ? json2.details : undefined;
       throw new HelipodError(res.status, json2?.code, retry ? `${msg} (retry after ${retry}s)` : String(msg), details);
     }
-    return json2 && "data" in json2 ? json2.data : json2;
+    return json2 && "data" in json2 ? json2.data : json2 ?? (text || null);
   }
 }
 
@@ -35753,7 +35761,7 @@ var containerTools = [
     kind: "read",
     description: "Projects this API key can reach, each with its environments (production, staging, ...). Start here to find an environmentId.",
     input: {},
-    run: (_a3, api2) => api2.api("GET", `${C}/projects`)
+    run: (_a3, api2) => api2.api("GET", `/projects`)
   }),
   defineTool({
     name: "get_project",
@@ -35761,7 +35769,7 @@ var containerTools = [
     kind: "read",
     description: "One project with its environments (ids and names). Use it to find an environmentId when you already know the project.",
     input: { projectId: id("Project") },
-    run: (a, api2) => api2.api("GET", `${C}/projects/${a.projectId}`)
+    run: (a, api2) => api2.api("GET", `/projects/${a.projectId}`)
   }),
   defineTool({
     name: "create_project",
@@ -35769,7 +35777,7 @@ var containerTools = [
     kind: "write",
     description: "Create a project (free) with its default production environment. Needs a whole-account key (a key limited to one project gets 403). Pass an idempotencyKey when retrying.",
     input: { name: exports_external.string().min(3).max(100), description: exports_external.string().max(500).optional(), idempotencyKey: idem },
-    run: (a, api2) => api2.api("POST", `${C}/projects`, { body: { name: a.name, description: a.description }, idempotencyKey: a.idempotencyKey })
+    run: (a, api2) => api2.api("POST", `/projects`, { body: { name: a.name, description: a.description }, idempotencyKey: a.idempotencyKey })
   }),
   defineTool({
     name: "update_project",
@@ -35778,7 +35786,7 @@ var containerTools = [
     idempotent: true,
     description: "Change a project's name and/or description.",
     input: { projectId: id("Project"), name: exports_external.string().min(3).max(100).optional(), description: exports_external.string().max(500).optional() },
-    run: (a, api2) => api2.api("PATCH", `${C}/projects/${a.projectId}`, { body: { name: a.name, description: a.description } })
+    run: (a, api2) => api2.api("PATCH", `/projects/${a.projectId}`, { body: { name: a.name, description: a.description } })
   }),
   defineTool({
     name: "delete_project",
@@ -35786,7 +35794,7 @@ var containerTools = [
     kind: "destructive",
     description: "Delete an EMPTY project and its environments and shared variables. Irreversible. Refused (409 PROJECT_NOT_EMPTY) while it still has services, databases, VPS or other resources: those must be deleted first. Needs a whole-account key. Only after the user confirms; confirm must be the project's exact name.",
     input: { projectId: id("Project"), confirm: exports_external.string().max(255).describe("The project name, exactly") },
-    run: (a, api2) => api2.api("DELETE", `${C}/projects/${a.projectId}`, { body: { confirm: a.confirm } })
+    run: (a, api2) => api2.api("DELETE", `/projects/${a.projectId}`, { body: { confirm: a.confirm } })
   }),
   defineTool({
     name: "create_environment",
@@ -35794,7 +35802,7 @@ var containerTools = [
     kind: "write",
     description: "Add an environment (e.g. staging) to a project. Free; services in it are billed as usual once deployed.",
     input: { projectId: id("Project"), name: exports_external.string().regex(/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,49}$/).describe("1-50 characters: letters, digits, space _ . -") },
-    run: (a, api2) => api2.api("POST", `${C}/projects/${a.projectId}/environments`, { body: { name: a.name } })
+    run: (a, api2) => api2.api("POST", `/projects/${a.projectId}/environments`, { body: { name: a.name } })
   }),
   defineTool({
     name: "rename_environment",
@@ -35803,7 +35811,7 @@ var containerTools = [
     idempotent: true,
     description: "Rename an environment (names are unique within the project).",
     input: { environmentId: id("Environment"), name: exports_external.string().regex(/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,49}$/) },
-    run: (a, api2) => api2.api("PATCH", `${C}/environments/${a.environmentId}`, { body: { name: a.name } })
+    run: (a, api2) => api2.api("PATCH", `/environments/${a.environmentId}`, { body: { name: a.name } })
   }),
   defineTool({
     name: "delete_environment",
@@ -35811,7 +35819,7 @@ var containerTools = [
     kind: "destructive",
     description: "Delete an EMPTY environment (409 ENVIRONMENT_NOT_EMPTY while it has services: delete them first). Irreversible. Only after the user confirms; confirm must be the environment's exact name.",
     input: { environmentId: id("Environment"), confirm: exports_external.string().max(255).describe("The environment name, exactly") },
-    run: (a, api2) => api2.api("DELETE", `${C}/environments/${a.environmentId}`, { body: { confirm: a.confirm } })
+    run: (a, api2) => api2.api("DELETE", `/environments/${a.environmentId}`, { body: { confirm: a.confirm } })
   }),
   defineTool({
     name: "list_project_variables",
@@ -35910,6 +35918,7 @@ var containerTools = [
       ram: exports_external.number().int().min(128).max(8192).optional().describe("MB, multiple of 128"),
       startCommand: exports_external.string().optional(),
       healthcheckPath: exports_external.string().optional().describe("HTTP path answering 2xx when ready, e.g. /health"),
+      healthcheckTimeout: exports_external.number().int().min(1).max(3600).optional().describe("Seconds the first start may take before the health check counts (default from the platform)"),
       deploy: exports_external.boolean().optional().describe("false: create without deploying (nothing is charged)"),
       dryRun,
       idempotencyKey: idem
@@ -35931,7 +35940,7 @@ var containerTools = [
           cpu: a.cpu,
           ram: a.ram,
           startCommand: a.startCommand,
-          healthcheck: a.healthcheckPath ? { path: a.healthcheckPath } : undefined,
+          healthcheck: a.healthcheckPath ? { path: a.healthcheckPath, timeout: a.healthcheckTimeout } : undefined,
           deploy: a.deploy
         }
       });
@@ -36061,6 +36070,14 @@ var containerTools = [
     },
     run: (a, api2) => api2.api("POST", `${C}/services/${a.serviceId}/domains`, { body: { kind: a.kind, domain: a.domain, port: a.port, protocol: a.protocol } })
   }),
+  defineTool({
+    name: "verify_service_domain",
+    title: "Check custom domain DNS",
+    kind: "write",
+    description: "Check a custom domain's DNS now instead of waiting for the automatic check. Answers the domain with its DNS state (verified, or what is still wrong); the certificate follows once the record points to Helipod (the record to add is in list_service_domains).",
+    input: { serviceId: id("Service"), domainId: id("Domain") },
+    run: (a, api2) => api2.api("POST", `${C}/services/${a.serviceId}/domains/${a.domainId}/verify`)
+  }),
   defineTool({
     name: "remove_service_domain",
     title: "Remove domain from service",
@@ -36777,22 +36794,40 @@ var record3 = exports_external.object({
   content: exports_external.string().describe('TXT without surrounding quotes (they are added by the DNS server); MX as "10 mail.example.com"'),
   ttl: exports_external.number().int().optional()
 });
+var owner = exports_external.object({
+  name: exports_external.string().min(3).max(255),
+  email: exports_external.string().max(255).optional().describe("Gets the registry's verification email; defaults to the account email"),
+  organization: exports_external.string().max(255).optional(),
+  phone: exports_external.string().min(9).max(20).describe("e.g. +6281234567890"),
+  addressLine1: exports_external.string().min(3).max(500),
+  addressLine2: exports_external.string().max(500).optional(),
+  city: exports_external.string().min(3).max(100),
+  state: exports_external.string().min(1).max(100),
+  countryCode: exports_external.string().regex(/^[A-Za-z]{2}$/).describe("ISO 3166-1 alpha-2, e.g. ID"),
+  postalCode: exports_external.string().min(1).max(20),
+  fax: exports_external.string().max(50).optional()
+});
 var domainTools = [
   defineTool({
     name: "search_domain",
     title: "Check domain availability",
     kind: "read",
     description: "Is a domain name available to register? No key needed.",
-    input: { domain: exports_external.string().describe("e.g. tokosaya.id") },
-    run: (a, api2) => api2.api("GET", "/domains/search", { query: { domain: a.domain }, auth: false })
+    input: { domain: exports_external.string().describe("e.g. tokosaya.id"), includePremium: exports_external.boolean().optional().describe("Also check names the registry sells as premium (is_premium_name). Premium names cannot be bought online: the user must contact support") },
+    run: (a, api2) => api2.api("GET", "/domains/search", { query: { domain: a.domain, includePremium: a.includePremium ? "true" : undefined }, auth: false })
   }),
   defineTool({
     name: "domain_prices",
     title: "Domain prices",
     kind: "read",
     description: "Registration, renewal and transfer prices per extension (IDR, VAT included) and the yearly WHOIS privacy price.",
-    input: { extension: exports_external.string().optional().describe("e.g. .id or .com"), limit: exports_external.number().int().min(1).max(100).optional() },
-    run: (a, api2) => api2.api("GET", "/domains/prices", { query: { extension: a.extension, limit: a.limit ?? 50 }, auth: false })
+    input: {
+      extension: exports_external.string().optional().describe("e.g. .id or .com"),
+      promo: exports_external.boolean().optional().describe("true: only extensions on promotion"),
+      limit: exports_external.number().int().min(1).max(100).optional(),
+      page: exports_external.number().int().min(1).optional()
+    },
+    run: (a, api2) => api2.api("GET", "/domains/prices", { query: { extension: a.extension, promo: a.promo === undefined ? undefined : String(a.promo), limit: a.limit ?? 50, page: a.page }, auth: false })
   }),
   defineTool({
     name: "list_my_domains",
@@ -36851,17 +36886,32 @@ var domainTools = [
       name: exports_external.string().describe("Full domain, e.g. tokosaya.id"),
       nameservers: exports_external.array(exports_external.string()).min(2).max(5).optional(),
       whoisProtection: exports_external.boolean().optional(),
+      registrant: owner.optional().describe("Owner of THIS domain instead of the account's owner details (e.g. a reseller's customer). .id domains only: others answer 400 REGISTRANT_NOT_SUPPORTED. Use only details the user gave."),
       dryRun: dryRun3
     },
-    run: (a, api2) => api2.api("POST", "/domains/register", { body: { name: a.name, period: 1, nameservers: a.nameservers, whoisProtection: a.whoisProtection }, query: { dryRun: a.dryRun ? "true" : undefined } })
+    run: (a, api2) => api2.api("POST", "/domains/register", { body: { name: a.name, period: 1, nameservers: a.nameservers, whoisProtection: a.whoisProtection, registrant: a.registrant }, query: { dryRun: a.dryRun ? "true" : undefined } })
   }),
   defineTool({
     name: "transfer_domain",
     title: "Transfer domain in",
     kind: "write",
-    description: `Transfer a domain from another registrar (adds 1 year). COSTS MONEY from the wallet. Needs the domain's auth code. ${DRY2}`,
-    input: { name: exports_external.string(), authCode: exports_external.string(), nameservers: exports_external.array(exports_external.string()).min(2).max(5).optional(), dryRun: dryRun3 },
-    run: (a, api2) => api2.api("POST", "/domains/transfer", { body: { name: a.name, authCode: a.authCode, period: 1, nameservers: a.nameservers }, query: { dryRun: a.dryRun ? "true" : undefined } })
+    description: `Transfer a domain from another registrar (adds 1 year). COSTS MONEY from the wallet. Needs the domain's auth code. ${DRY2} With registrant (.id only) the domain gets that owner when the transfer completes (ownerPending until then); without it, the account's owner details.`,
+    input: {
+      name: exports_external.string(),
+      authCode: exports_external.string(),
+      nameservers: exports_external.array(exports_external.string()).min(2).max(5).optional(),
+      registrant: owner.optional().describe("Owner of THIS domain once the transfer completes (e.g. a reseller's customer). .id domains only: others answer 400 REGISTRANT_NOT_SUPPORTED. Use only details the user gave."),
+      dryRun: dryRun3
+    },
+    run: (a, api2) => api2.api("POST", "/domains/transfer", { body: { name: a.name, authCode: a.authCode, period: 1, nameservers: a.nameservers, registrant: a.registrant }, query: { dryRun: a.dryRun ? "true" : undefined } })
+  }),
+  defineTool({
+    name: "set_domain_owner",
+    title: "Set domain owner",
+    kind: "write",
+    description: "Set a new owner (registrant) for one .id domain of the account, e.g. a reseller's customer or a domain transferred earlier. Free. An active domain gets it now (ownerPending false); a transfer in progress gets it when it completes, and a change the registry does not take yet is retried automatically (ownerPending true, HTTP 202). Other domains keep their other contacts. Use only details the user gave.",
+    input: { domainId, owner },
+    run: (a, api2) => api2.api("PATCH", `/domains/${a.domainId}/registrant`, { body: a.owner })
   }),
   defineTool({
     name: "renew_domain",
@@ -36908,9 +36958,9 @@ var domainTools = [
     name: "enable_whois_privacy",
     title: "Enable WHOIS privacy",
     kind: "write",
-    description: "Hide the owner's details in WHOIS. COSTS MONEY (the whois_protection price per year).",
-    input: { domainId },
-    run: (a, api2) => api2.api("POST", `/domains/${a.domainId}/whois-protection`)
+    description: `Hide the owner's details in WHOIS. COSTS MONEY (the whois_protection price per year). ${DRY2}`,
+    input: { domainId, dryRun: dryRun3 },
+    run: (a, api2) => api2.api("POST", `/domains/${a.domainId}/whois-protection`, { query: { dryRun: a.dryRun ? "true" : undefined } })
   }),
   defineTool({
     name: "get_domain_price",
@@ -36953,6 +37003,23 @@ var domainTools = [
     input: { domainId, emailDomainId: exports_external.string().uuid() },
     run: (a, api2) => api2.api("POST", `/domains/${a.domainId}/email-records`, { body: { emailDomainId: a.emailDomainId } })
   }),
+  defineTool({
+    name: "get_child_nameserver",
+    title: "Get child nameserver",
+    kind: "read",
+    description: "One child nameserver (glue record) of a registered domain: hostname and IP address.",
+    input: { domainId, hostId },
+    run: (a, api2) => api2.api("GET", `/domains/${a.domainId}/hosts/${a.hostId}`)
+  }),
+  defineTool({
+    name: "set_domain_auto_renew",
+    title: "Set domain auto-renew",
+    kind: "write",
+    idempotent: true,
+    description: "Turn automatic renewal of a domain on or off (sets the value given; calling it twice is safe). On: renewed from the wallet before it expires. Off: it expires unless renewed by hand (renew_domain). Nothing is charged now.",
+    input: { domainId, autoRenew: exports_external.boolean() },
+    run: (a, api2) => api2.api("PATCH", `/domains/${a.domainId}/auto-renew`, { body: { autoRenew: a.autoRenew } })
+  }),
   defineTool({
     name: "list_child_nameservers",
     title: "List child nameservers",
@@ -37029,7 +37096,10 @@ var message = exports_external.object({
   templateId: exports_external.string().optional(),
   templateData: exports_external.record(exports_external.string(), exports_external.string()).optional(),
   variables: exports_external.record(exports_external.string(), exports_external.string()).optional(),
-  idempotencyKey: exports_external.string().max(128).optional()
+  idempotencyKey: exports_external.string().max(128).optional(),
+  headers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Extra MIME headers (letters, digits, hyphens in names; no line breaks). Not with templateId"),
+  metadata: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Your own key/value data, stored with the email (get_email returns it)"),
+  sensitive: exports_external.boolean().optional().describe("true when templateData or variables carry a secret (password, one-time code): their values are wiped from the job record after the send")
 });
 var dryRun4 = exports_external.boolean().optional().describe("true = return the price (IDR) and the wallet balance after it; nothing is charged or changed");
 var idem2 = exports_external.string().regex(/^[A-Za-z0-9_.:-]{8,128}$/).optional().describe("Idempotency-Key for the real purchase. Generated when omitted; pass the same value when retrying so it is never charged twice");
@@ -37120,6 +37190,24 @@ var emailTools = [
       idempotencyKey: purchaseKey(a.dryRun, a.idempotencyKey)
     })
   }),
+  defineTool({
+    name: "set_email_auto_renew",
+    title: "Set email auto-renew",
+    kind: "write",
+    idempotent: true,
+    description: "Turn the active email plan's auto-renew on or off (sets the value, safe to repeat). On: the plan renews from the wallet deposit when it ends; off: it ends at its expiry date. get_email_plan and email_status show it as autoRenew. A free plan renews at Rp 0.",
+    input: { projectId, autoRenew: exports_external.boolean() },
+    run: (a, api2) => api2.email("POST", "/plan/auto-renew", { project: a.projectId, body: { enabled: a.autoRenew } })
+  }),
+  defineTool({
+    name: "set_email_payg",
+    title: "Set email pay-as-you-go",
+    kind: "write",
+    idempotent: true,
+    description: "Turn pay-as-you-go on or off for the active paid email plan (sets the value, safe to repeat; off by default). Off: once the monthly quota is used, sends stop with 402 PAYG_DISABLED and nothing is charged. On: sends continue past the quota and blocks of 100 emails are bought from the wallet deposit at the plan's per-email price (unused ones refunded if the plan is not renewed). email_status shows it as paygEnabled. No effect on the free plan.",
+    input: { projectId, paygEnabled: exports_external.boolean() },
+    run: (a, api2) => api2.email("POST", "/plan/payg", { project: a.projectId, body: { enabled: a.paygEnabled } })
+  }),
   defineTool({
     name: "send_email",
     title: "Send email",
@@ -37138,7 +37226,10 @@ var emailTools = [
       templateId: exports_external.string().optional(),
       templateData: exports_external.record(exports_external.string(), exports_external.string()).optional(),
       variables: exports_external.record(exports_external.string(), exports_external.string()).optional(),
-      idempotencyKey: exports_external.string().max(128).optional()
+      idempotencyKey: exports_external.string().max(128).optional(),
+      headers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Extra MIME headers (letters, digits, hyphens in names; no line breaks). Not with templateId"),
+      metadata: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Your own key/value data, stored with the email (get_email returns it)"),
+      sensitive: exports_external.boolean().optional().describe("true when templateData or variables carry a secret (password, one-time code): their values are wiped from the job record after the send")
     },
     run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/send", { body: a, project })
   }),
@@ -37147,7 +37238,15 @@ var emailTools = [
     title: "List sent emails",
     kind: "read",
     description: "Email log, newest first, with delivery status.",
-    input: { projectId, status: exports_external.string().optional(), search: exports_external.string().optional(), limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().optional() },
+    input: {
+      projectId,
+      status: exports_external.string().optional(),
+      search: exports_external.string().optional(),
+      from: exports_external.string().optional().describe("Sent at or after (ISO 8601), e.g. 2026-10-01T00:00:00Z"),
+      to: exports_external.string().optional().describe("Sent before (ISO 8601)"),
+      limit: exports_external.number().int().min(1).max(100).optional(),
+      cursor: exports_external.string().optional()
+    },
     run: ({ projectId: project, ...a }, api2) => api2.email("GET", "/emails", { query: a, project })
   }),
   defineTool({
@@ -37182,6 +37281,30 @@ var emailTools = [
     input: { projectId, domainId: exports_external.string() },
     run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/verify`, { project: a.projectId })
   }),
+  defineTool({
+    name: "list_email_keys",
+    title: "List email keys",
+    kind: "read",
+    description: "Email API keys of a project (name, prefix, last used, expiry; never the key itself). Needs a Helipod API key with the Email API: an email key or a sign-in token answers 403 KEY_NOT_ALLOWED.",
+    input: { projectId },
+    run: (a, api2) => api2.emailWithAccountKey("GET", "/keys", { project: a.projectId })
+  }),
+  defineTool({
+    name: "create_email_key",
+    title: "Create email key",
+    kind: "write",
+    description: "Make an email API key for a project, e.g. one per customer of a reseller. The key works on the Email API and as the SMTP password (smtp.helipod.io, username apikey) for that project only, and cannot make keys itself. The full key is in the answer ONCE: give it to the user to store; it cannot be shown again. Needs a Helipod API key with the Email API (an email key or a sign-in token answers 403 KEY_NOT_ALLOWED). Per project: 5 active keys on Free/Starter, 10 on Pro, 50 on Business.",
+    input: { projectId, name: exports_external.string().min(1).max(100).describe("To tell keys apart, e.g. the customer's name"), expiresInDays: exports_external.number().int().min(1).max(3650).optional() },
+    run: (a, api2) => api2.emailWithAccountKey("POST", "/keys", { project: a.projectId, body: { name: a.name, expiresInDays: a.expiresInDays } })
+  }),
+  defineTool({
+    name: "revoke_email_key",
+    title: "Revoke email key",
+    kind: "destructive",
+    description: "Revoke an email API key of the project: it stops working at once, also for open SMTP sessions. Apps using it can no longer send. Needs a Helipod API key with the Email API.",
+    input: { projectId, keyId: uid("Email key") },
+    run: (a, api2) => api2.emailWithAccountKey("DELETE", `/keys/${a.keyId}`, { project: a.projectId })
+  }),
   defineTool({
     name: "list_email_templates",
     title: "List email templates",
@@ -37195,7 +37318,16 @@ var emailTools = [
     title: "Add contact",
     kind: "write",
     description: "Add or update an audience contact.",
-    input: { projectId, email: exports_external.string(), firstName: exports_external.string().optional(), lastName: exports_external.string().optional() },
+    input: {
+      projectId,
+      email: exports_external.string(),
+      firstName: exports_external.string().optional(),
+      lastName: exports_external.string().optional(),
+      status: exports_external.enum(["subscribed", "unsubscribed"]).optional(),
+      properties: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Custom properties (used by segments and {{placeholders}})"),
+      consentConfirmed: exports_external.boolean().optional().describe("true only when the person agreed to receive email (you have their opt-in)"),
+      consentSource: exports_external.string().max(50).optional().describe("Where the consent came from, e.g. signup_form")
+    },
     run: ({ projectId: project, ...a }, api2) => api2.email("POST", "/contacts", { body: a, project })
   }),
   defineTool({
@@ -37674,6 +37806,162 @@ var emailTools = [
     description: "Delete a received message permanently.",
     input: { projectId, messageId: uid("Message") },
     run: (a, api2) => api2.email("DELETE", `/inbound/messages/${a.messageId}`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "add_email_contacts",
+    title: "Add contacts (bulk)",
+    kind: "write",
+    description: "Add or update up to 1000 contacts in one call (same fields as add_contact). For a CSV file use import_email_contacts.",
+    input: {
+      projectId,
+      contacts: exports_external.array(exports_external.object({
+        email: exports_external.string(),
+        firstName: exports_external.string().max(100).optional(),
+        lastName: exports_external.string().max(100).optional(),
+        status: exports_external.enum(["subscribed", "unsubscribed"]).optional(),
+        properties: exports_external.record(exports_external.string(), exports_external.string()).optional()
+      })).min(1).max(1000),
+      consentConfirmed: exports_external.boolean().optional().describe("true only when every one of them opted in"),
+      consentSource: exports_external.string().max(50).optional()
+    },
+    run: ({ projectId: project, ...body }, api2) => api2.email("POST", "/contacts", { body, project })
+  }),
+  defineTool({
+    name: "import_email_contacts",
+    title: "Import contacts from CSV",
+    kind: "write",
+    description: "Import contacts from CSV text (header row with email, optional firstName, lastName and property columns). Runs in the background: the answer has a job id for get_email_job.",
+    input: {
+      projectId,
+      csv: exports_external.string().min(1).max(1e7),
+      consentConfirmed: exports_external.boolean().optional().describe("true only when every contact in the file opted in"),
+      consentSource: exports_external.string().max(50).optional()
+    },
+    run: ({ projectId: project, ...body }, api2) => api2.email("POST", "/contacts/import", { body, project })
+  }),
+  defineTool({
+    name: "export_email_contacts",
+    title: "Export contacts (CSV)",
+    kind: "read",
+    description: "Every contact as CSV text (up to 50,000). Contact data is personal: give it only to the user who asked.",
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/contacts/export", { project: a.projectId })
+  }),
+  defineTool({
+    name: "set_email_contact_properties",
+    title: "Set contact properties",
+    kind: "write",
+    idempotent: true,
+    description: "Set custom properties of a contact. Given keys are overwritten, other keys are kept.",
+    input: { projectId, contactId: uid("Contact"), properties: exports_external.record(exports_external.string(), exports_external.string()) },
+    run: (a, api2) => api2.email("PUT", `/contacts/${a.contactId}/properties`, { body: { properties: a.properties }, project: a.projectId })
+  }),
+  defineTool({
+    name: "set_email_contact_topics",
+    title: "Subscribe contact to topics",
+    kind: "write",
+    idempotent: true,
+    description: "Subscribe a contact to the given topics (ids from list_email_topics).",
+    input: { projectId, contactId: uid("Contact"), topicIds: exports_external.array(exports_external.string().uuid()).max(50) },
+    run: (a, api2) => api2.email("PUT", `/contacts/${a.contactId}/topics`, { body: { topicIds: a.topicIds }, project: a.projectId })
+  }),
+  defineTool({
+    name: "get_email_segment",
+    title: "Get segment",
+    kind: "read",
+    description: "One segment with its filter and contact count.",
+    input: { projectId, segmentId: uid("Segment") },
+    run: (a, api2) => api2.email("GET", `/segments/${a.segmentId}`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "recalculate_email_segment",
+    title: "Recalculate segment",
+    kind: "write",
+    description: "Rebuild a segment's member list now (in the background) after contacts or properties changed.",
+    input: { projectId, segmentId: uid("Segment") },
+    run: (a, api2) => api2.email("POST", `/segments/${a.segmentId}/recalculate`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "delete_email_broadcast",
+    title: "Delete broadcast",
+    kind: "destructive",
+    description: "Delete a broadcast that is not sending right now (a draft, scheduled, cancelled or finished one). Use cancel_email_broadcast to stop one that is sending.",
+    input: { projectId, broadcastId: uid("Broadcast") },
+    run: (a, api2) => api2.email("DELETE", `/broadcasts/${a.broadcastId}`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "check_email_inbound",
+    title: "Check domain for receiving",
+    kind: "read",
+    description: "Before turning on receiving: the MX records of the host that would receive mail. existingMx not empty = mail for that host currently goes to another provider and would move to Helipod: suggest a subdomain (e.g. mail.example.com) to keep it.",
+    input: { projectId, domainId: uid("Sending domain"), host: exports_external.string().max(254).optional().describe("The domain or a subdomain of it; default the domain") },
+    run: (a, api2) => api2.email("GET", `/domains/${a.domainId}/inbound/check`, { query: { host: a.host }, project: a.projectId })
+  }),
+  defineTool({
+    name: "set_email_inbound",
+    title: "Turn receiving on or off",
+    kind: "write",
+    idempotent: true,
+    description: "Turn receiving mail on (or off) for a verified sending domain, on the domain or a subdomain. Run check_email_inbound first and tell the user if existing mail would move. The answer is the domain: its dnsRecords now include the receiving MX record to publish, then verify_email_domain (inboundMxValid turns true).",
+    input: { projectId, domainId: uid("Sending domain"), enabled: exports_external.boolean(), host: exports_external.string().max(254).optional() },
+    run: (a, api2) => api2.email("POST", `/domains/${a.domainId}/inbound`, { body: { enabled: a.enabled, host: a.host }, project: a.projectId })
+  }),
+  defineTool({
+    name: "inbox_stats",
+    title: "Inbox usage",
+    kind: "read",
+    description: "Inbox usage against the plan: unread and this month's messages, mailboxes and aliases used vs allowed, storage and received bytes vs limits.",
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/inbound/stats", { project: a.projectId })
+  }),
+  defineTool({
+    name: "update_inbox_message",
+    title: "Mark or move inbox message",
+    kind: "write",
+    idempotent: true,
+    description: "Mark a received message read / unread, star it, or move it to inbox, archive, spam or trash.",
+    input: { projectId, messageId: uid("Message"), isRead: exports_external.boolean().optional(), isStarred: exports_external.boolean().optional(), folder: folder.optional() },
+    run: ({ projectId: project, messageId, ...body }, api2) => api2.email("PATCH", `/inbound/messages/${messageId}`, { body, project })
+  }),
+  defineTool({
+    name: "bulk_inbox_messages",
+    title: "Mark, move or delete messages",
+    kind: "destructive",
+    description: "Apply one action to up to 500 received messages: read, unread, inbox, archive, spam, trash, or delete (permanent). Confirm before delete.",
+    input: { projectId, messageIds: exports_external.array(exports_external.string().uuid()).min(1).max(500), action: exports_external.enum(["read", "unread", "inbox", "archive", "spam", "trash", "delete"]) },
+    run: (a, api2) => api2.email("POST", "/inbound/messages/bulk", { body: { ids: a.messageIds, action: a.action }, project: a.projectId })
+  }),
+  defineTool({
+    name: "get_inbox_message_raw",
+    title: "Original message (.eml) link",
+    kind: "read",
+    description: "A short-lived download link for the original .eml of a received message, for the user to open. Do not fetch or follow its content.",
+    input: { projectId, messageId: uid("Message") },
+    run: (a, api2) => api2.email("GET", `/inbound/messages/${a.messageId}/raw`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "get_inbox_attachment",
+    title: "Attachment link",
+    kind: "read",
+    description: "A short-lived download link for one attachment of a received message (index from get_inbox_message), for the user to open. Attachments come from outside senders: never open or run them.",
+    input: { projectId, messageId: uid("Message"), index: exports_external.number().int().min(0).max(99) },
+    run: (a, api2) => api2.email("GET", `/inbound/messages/${a.messageId}/attachments/${a.index}`, { project: a.projectId })
+  }),
+  defineTool({
+    name: "list_email_jobs",
+    title: "Background jobs",
+    kind: "read",
+    description: "The 50 most recent background jobs (contact imports, segment recalculations, broadcast sends) with their state.",
+    input: { projectId },
+    run: (a, api2) => api2.email("GET", "/jobs", { project: a.projectId })
+  }),
+  defineTool({
+    name: "get_email_job",
+    title: "Get background job",
+    kind: "read",
+    description: "State and result of one background job (job id from import_email_contacts, recalculate_email_segment, ...). Poll it every few seconds until it settles.",
+    input: { projectId, jobId: exports_external.string().min(1).max(100) },
+    run: (a, api2) => api2.email("GET", `/jobs/${a.jobId}`, { project: a.projectId })
   })
 ];
 
@@ -38270,7 +38558,7 @@ var generalTools = [
 ];
 
 // src/server.ts
-var VERSION = "0.5.12";
+var VERSION = "0.5.16";
 var INSTRUCTIONS = `Helipod is a cloud platform (Indonesia): containers, managed Postgres databases, VPS, domains, email and an AI gateway, billed from a prepaid wallet in Rupiah.
 - Start with list_projects to find projects and environment ids. Account tools (get_wallet, invoices, statements, notifications, get_project_activity, support tickets) cover the account; AI tools (list_ai_models, get_ai_overview, get_ai_usage, AI keys, top-ups, generate_ai_image) cover the AI gateway.
 - Anything that costs money (create/deploy/scale services, resize volumes, upgrade a database plan, create/renew/upgrade VPS, VPS backups, register/renew/transfer domains, email plans and inbox add-ons, AI top-ups and auto top-up, generating images): call it with dryRun=true first (or the price lookup when it has no dry run), tell the user the cost in IDR and the wallet balance after, and wait for an explicit yes before the real call. Never treat silence or an earlier general OK as a yes.
@@ -38279,6 +38567,8 @@ var INSTRUCTIONS = `Helipod is a cloud platform (Indonesia): containers, managed
 - Deploying an app, step by step: list_projects (pick the project and its production environmentId) -> get_bundle (is it covered?) -> if it needs Postgres: create_database, then get_database_connection and store DATABASE_URL with set_variables (secrets) after the service exists, or pass it in create_service variables -> create_service with dryRun=true (repo or image, port, variables) -> tell the user the cost (included in the bundle, or walletDailyCost per day) and wait for their OK -> create_service for real -> poll get_deployment until it settles, read get_deployment_logs if it failed -> give the user the *.helipod.app URL from get_service. Ask the user for secrets (API keys) only when the app needs them; never invent values.
 - Destructive tools (delete, terminate, reinstall, rollback, restore a backup or an import, copy a backup onto another VPS, replace DNS, revoke a key, remove an SSH key or port forward, send a broadcast, execute_database_sql): confirm with the user and name what will be lost. Before execute_database_sql, run classify_database_sql.
 - Email: when a project has no email yet (email_status shows activated false) or its plan ended, start it with buy_email_plan (dryRun first; the FREE plan costs nothing, still confirm). That also sets email up for the project; then add and verify a sending domain.
+- Email keys: create_email_key gives an app or a customer its own key (also its SMTP password: smtp.helipod.io, username apikey); the full key is shown once, so hand it over and never print it again. Domain on Helipod: add_domain_email_records puts the sending domain's DNS records in place in one call.
+- Domains for someone else (resellers): register_domain and transfer_domain take registrant (.id only; a transfer gets the owner when it completes), set_domain_owner changes it later. Use only details the user gave.
 - Before replacing all DNS records (set_dns_records), read list_dns_records and keep every record the user still needs. Before sending or scheduling a broadcast, tell the user how many contacts it reaches. Before deleting or replacing code, files or variables, read the current value. After renaming a service, fix the variable references listed in warnings.
 - Databases: get_database_connection returns a password; put it in a secret variable (DATABASE_URL) instead of code or chat.
 - Migrate (free): create_vps_import returns a one-time command for the USER to run as root on their old server (never run it yourself); before the first restore_vps_import, show fetchedIp and ask the user to confirm it is their server.