@drop2run/mcp 0.8.0 → 0.9.0

package/README.md

@@ -87,6 +87,11 @@ lose it.
 | `list_sites` | Lists the sites on the account |
 | `list_folders` | Lists the account's folders, each with the path `folder` accepts |
 | `delete_site` | Deletes a site permanently, subdomain included — requires the subdomain repeated as `confirm` |
+| `get_site` | Reads a site's settings, whether it is paused, and its versions with the live one marked |
+| `update_site` | Changes a site's name, serving mode, password, forms, scheduled takedown or folder |
+| `pause_site` | Takes a site off the air, keeping its files, versions and subdomain |
+| `resume_site` | Puts a paused site back on the air |
+| `rollback_site` | Serves an earlier version again, by its id from `get_site` |
 
 Both publish tools take an optional `site` — a subdomain or site id to publish over. Leave it out and a
 new site is created.
@@ -102,6 +107,12 @@ by path such as `Clients/Acme`, or by the id `list_folders` shows. Like `subdoma
 site, so it cannot be combined with `site`. It never creates a folder: one that does not exist is refused
 with the list of those that do, and nothing is published.
 
+`update_site` changes only the settings it is given. An empty `name`, `password` or `expiresAt` clears
+that setting, and `folder: "root"` moves the site back to the top level. A takedown pauses the site by
+default; `expiryAction: "delete"` removes it instead, and asks for the subdomain as `confirm` the way
+`delete_site` does. Settings your plan does not include are refused with the reason, and `get_site` says
+which ones those are.
+
 Both sign-in tools answer "not approved yet" rather than failing while they wait, and calling them
 again keeps waiting on the same sign-in. Neither replaces a token that is already stored unless asked
 to with `replace`.

package/dist/index.js

@@ -105,7 +105,9 @@ async function call(credentials, path, init = {}) {
 async function findSite(credentials, site) {
   const found = await lookUpSite(credentials, site);
   if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+    throw new Error(
+      `No site of yours is called "${site}". \`drop2run ls\` or the list_sites tool shows what exists.`
+    );
   }
   return found;
 }
@@ -142,6 +144,115 @@ async function deleteSite(credentials, siteId) {
     throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
   }
 }
+async function promoteDeploy(credentials, siteId, deployId) {
+  return await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/deploys/${encodeURIComponent(deployId)}/promote`,
+    { method: "POST" }
+  );
+}
+function enumName(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+function actionOf(expiresAt, action) {
+  return expiresAt === null ? null : enumName(action);
+}
+async function readInvitedOnly(credentials, siteId) {
+  try {
+    const page = await call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}/viewers?pageSize=1`
+    );
+    return typeof page.invitedOnly === "boolean" ? page.invitedOnly : null;
+  } catch {
+    return null;
+  }
+}
+async function folderFromListing(credentials, siteId, subdomain) {
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(subdomain)}`
+  );
+  return sites.find((candidate) => candidate.siteId === siteId)?.folderId ?? null;
+}
+async function getSite(credentials, siteId) {
+  const [site, invitedOnly] = await Promise.all([
+    call(
+      credentials,
+      `sites/${encodeURIComponent(siteId)}`
+    ),
+    readInvitedOnly(credentials, siteId)
+  ]);
+  const folderId = site.folderId !== void 0 ? site.folderId : await folderFromListing(credentials, site.siteId, site.subdomain);
+  return {
+    siteId: site.siteId,
+    subdomain: site.subdomain,
+    url: site.url,
+    name: site.name,
+    status: enumName(site.status),
+    invitedOnly,
+    liveDeployId: site.liveDeployId,
+    spaMode: site.spaMode,
+    docsMode: site.docsMode,
+    modeIsManual: site.modeIsManual,
+    passwordProtected: site.passwordProtected,
+    passwordProtectionAvailable: site.passwordProtectionAvailable,
+    formsEnabled: site.formsEnabled,
+    formsAvailable: site.formsAvailable,
+    expiresAt: site.expiresAt,
+    expiryAction: actionOf(site.expiresAt, site.expiryAction ?? ""),
+    scheduledExpiryAvailable: site.scheduledExpiryAvailable,
+    folderId,
+    deploys: site.deploys.map((deploy2) => ({
+      deployId: deploy2.deployId,
+      status: deploy2.status,
+      fileCount: deploy2.fileCount,
+      totalBytes: deploy2.totalBytes,
+      createdAt: deploy2.createdAt,
+      completedAt: deploy2.completedAt,
+      filesKept: deploy2.filesKept
+    }))
+  };
+}
+async function updateSiteSettings(credentials, siteId, change) {
+  const body = {};
+  if (change.name !== void 0) body.name = change.name;
+  if (change.mode !== void 0) {
+    body.spaMode = change.mode === "spa";
+    body.docsMode = change.mode === "docs";
+  }
+  if (change.password !== void 0) body.password = change.password;
+  if (change.expiresAt !== void 0) body.expiresAt = change.expiresAt;
+  if (change.expiryAction !== void 0) body.expiryAction = change.expiryAction;
+  if (change.formsEnabled !== void 0) body.formsEnabled = change.formsEnabled;
+  if (change.folderId !== void 0) body.folderId = change.folderId;
+  if (Object.keys(body).length === 0) throw new Error("Nothing to change — name a setting.");
+  const wasInvitedOnly = change.password !== void 0 && change.password !== "" ? await readInvitedOnly(credentials, siteId) : null;
+  const settings = await call(credentials, `sites/${encodeURIComponent(siteId)}`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  const invitedOnly = typeof settings.invitedOnly === "boolean" ? settings.invitedOnly : null;
+  return {
+    ...settings,
+    expiryAction: actionOf(settings.expiresAt, settings.expiryAction ?? ""),
+    invitedOnly,
+    replacedInviteOnly: wasInvitedOnly === true && invitedOnly === false
+  };
+}
+async function setSitePaused(credentials, siteId, action) {
+  const state = await call(
+    credentials,
+    `sites/${encodeURIComponent(siteId)}/${action}`,
+    { method: "POST" }
+  );
+  return {
+    siteId: state.siteId,
+    subdomain: state.subdomain,
+    status: enumName(state.status),
+    ownerPaused: state.ownerPaused
+  };
+}
 const SITES_PER_REQUEST = 100;
 async function listSites(credentials) {
   const body = await call(
@@ -212,6 +323,46 @@ async function resolveFolder(credentials, folder) {
     `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
   );
 }
+const ROOT_FOLDER = "root";
+async function resolveFolderTarget(credentials, folder) {
+  return folder.trim().toLowerCase() === ROOT_FOLDER ? ROOT_FOLDER : await resolveFolder(credentials, folder);
+}
+const VERSIONS_LISTED = 10;
+function servingModeOf$1(site) {
+  if (site.spaMode) return "spa";
+  if (site.docsMode) return "docs";
+  return "static";
+}
+function accessOf(site) {
+  if (site.passwordProtected) return "password";
+  if (site.invitedOnly === true) return "invite-only";
+  if (site.invitedOnly === false) return "public";
+  return "no password (whether it is invite-only could not be read)";
+}
+function describeSite(site, folderPath) {
+  const unavailable = (available) => available ? "" : " (not on this plan)";
+  const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
+    const live = deploy2.deployId === site.liveDeployId ? " ← served" : "";
+    const kept = deploy2.filesKept ? "" : ", files collected — cannot be rolled back to";
+    return `  ${deploy2.deployId}  ${deploy2.createdAt}  ${deploy2.status}, ${deploy2.fileCount} files${kept}${live}`;
+  });
+  const more = site.deploys.length - versions.length;
+  return [
+    `${site.subdomain} — ${site.url}`,
+    `  name      ${site.name ?? "(none)"}`,
+    `  status    ${site.status}`,
+    `  access    ${accessOf(site)}`,
+    `  mode      ${servingModeOf$1(site)}${site.modeIsManual ? "" : " (detected on each publish)"}`,
+    `  password  ${site.passwordProtected ? "on" : "off"}${unavailable(site.passwordProtectionAvailable)}`,
+    `  forms     ${site.formsEnabled ? "on" : "off"}${unavailable(site.formsAvailable)}`,
+    `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
+    `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
+    "",
+    site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
+    ...versions,
+    ...more > 0 ? [`  … and ${more} older`] : []
+  ].join("\n");
+}
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
   return {
@@ -1075,6 +1226,24 @@ function canPublish(paths) {
   if (isImageFolder(paths)) return true;
   return paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0]);
 }
+function servingModeOf(flags) {
+  if (flags.docsMode) return "docs";
+  if (flags.spaMode) return "spa";
+  return "static";
+}
+function predictedModeOf(paths) {
+  if (paths.some((path) => path === REQUIRED_INDEX)) return "static";
+  if (paths.some(isDocumentPath)) return "docs";
+  if (isImageFolder(paths)) return "docs";
+  if (paths.length === 1 && paths[0] !== void 0 && isViewablePath(paths[0])) return "docs";
+  return "static";
+}
+function nestedIndexOf(paths) {
+  if (predictedModeOf(paths) !== "docs") return null;
+  const suffix = `/${REQUIRED_INDEX}`;
+  const folders = paths.filter((path) => path.endsWith(suffix)).map((path) => path.slice(0, -suffix.length)).sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+  return folders[0] ?? null;
+}
 function renameOfLoneHtmlPage(paths) {
   if (paths.length !== 1) return null;
   const [only] = paths;
@@ -1610,7 +1779,13 @@ async function deploy(source, siteId, onProgress, signal, options = {}) {
       signal,
       await readSiteName(files)
     );
-    onProgress({ type: "done", url: completed.url, name: completed.name });
+    onProgress({
+      type: "done",
+      url: completed.url,
+      name: completed.name,
+      mode: servingModeOf(completed),
+      modeIsManual: completed.modeIsManual
+    });
   } catch (error) {
     const failure = asDeployError(error);
     onProgress({
@@ -1663,6 +1838,15 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
+function describeMode(result) {
+  if (result.mode === null) return null;
+  if (result.nestedIndex !== null) {
+    return `Served as documents: there is no index.html at the top, but ${result.nestedIndex}/index.html is there. To publish the website, publish the ${result.nestedIndex} folder instead.`;
+  }
+  if (result.mode === "docs") return "Served as documents, in the documents reader.";
+  if (result.mode === "spa") return "Served as a single-page app.";
+  return "Served as a static site.";
+}
 async function resolveSite(credentials, site, newSite) {
   const { subdomain, folder } = newSite;
   if (site !== void 0 && subdomain !== void 0) {
@@ -1672,7 +1856,7 @@ async function resolveSite(credentials, site, newSite) {
   }
   if (site !== void 0 && folder !== void 0) {
     throw new Error(
-      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site with `drop2run set folder` or the `update_site` tool's `folder`."
     );
   }
   if (site === void 0) {
@@ -1692,6 +1876,8 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
   let files = 0;
   let url = target.url;
   let unchanged = false;
+  let mode = null;
+  let paths = [];
   let failure = null;
   let failureDetail;
   const record = (event) => {
@@ -1700,13 +1886,21 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
       unchanged = true;
       url = event.url || target.url;
     }
-    if (event.type === "done") url = event.url;
+    if (event.type === "done") {
+      url = event.url;
+      mode = event.mode;
+    }
     if (event.type === "error") {
       failure = event.message;
       failureDetail = event.detail;
     }
   };
-  await deploy(source, target.siteId, record, void 0, {
+  const watched = async (signal, onRead) => {
+    const collected = await source(signal, onRead);
+    paths = collected.map((file) => file.path);
+    return collected;
+  };
+  await deploy(watched, target.siteId, record, void 0, {
     baseUrl: credentials.apiBaseUrl,
     token: credentials.token
   }).catch((error) => {
@@ -1716,7 +1910,15 @@ async function publish(credentials, source, site, onProgress, newSite = {}) {
     thrown.detail = failureDetail ?? error?.detail;
     throw thrown;
   });
-  return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
+  return {
+    url,
+    siteId: target.siteId,
+    subdomain: target.subdomain,
+    files,
+    unchanged,
+    mode,
+    nestedIndex: mode === "docs" ? nestedIndexOf(paths) : null
+  };
 }
 async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
@@ -1925,7 +2127,7 @@ async function signInWithCode(waitSeconds, replace = false) {
     "Call this tool again to keep waiting. Nothing has been changed yet."
   ].join("\n");
 }
-const SERVER_VERSION = "0.8.0";
+const SERVER_VERSION = "0.9.0";
 const CREDENTIAL_WRITE = {
   readOnlyHint: false,
   destructiveHint: false,
@@ -1957,6 +2159,83 @@ const REMOVES_A_SITE = {
   idempotentHint: false,
   openWorldHint: true
 };
+const CHANGES_A_SITE = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true
+};
+const RESTORES_A_SITE = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+const SITE_INPUT = z.string().min(1).describe("Subdomain or site id, from list_sites.");
+const VERSION_OUTPUT = z.object({
+  deployId: z.string().describe("Identifier of the version, which rollback_site takes."),
+  status: z.string().describe(
+    "`live` for the one being served, `superseded` for one served before, `ready` for one that finished but was never served, `failed`, or a stage still under way. Whether it can be rolled back to is `filesKept`, not this."
+  ),
+  fileCount: z.number().int().describe("How many files it carries."),
+  createdAt: z.string().describe("When it was published, ISO 8601."),
+  filesKept: z.boolean().describe(
+    "Whether its files are still stored; a version without them cannot be rolled back to."
+  ),
+  live: z.boolean().describe("Whether this is the version being served.")
+});
+const SETTINGS_OUTPUT = {
+  siteId: z.string().describe("Identifier of the site."),
+  name: z.string().nullable().describe("What it is called, or null."),
+  mode: z.enum(["static", "spa", "docs"]).describe("How it serves its files."),
+  passwordProtected: z.boolean().describe("Whether visitors must type a password."),
+  invitedOnly: z.boolean().nullable().describe(
+    "Whether only invited people can open it, or null when that could not be read. Null does not mean public."
+  ),
+  formsEnabled: z.boolean().describe("Whether it accepts form submissions."),
+  expiresAt: z.string().nullable().describe("When it is scheduled to come down, or null."),
+  expiryAction: z.string().nullable().describe("What the takedown does: `pause` or `delete`, or null when none is scheduled."),
+  folderId: z.string().nullable().describe("The folder it is filed in, or null at the top level.")
+};
+const PAUSE_OUTPUT = {
+  siteId: z.string().describe("Identifier of the site."),
+  subdomain: z.string().describe("Its subdomain."),
+  status: z.string().describe("`active` or `paused` afterwards."),
+  ownerPaused: z.boolean().describe("Whether the pause is the owner's own.")
+};
+async function folderPathOf(credentials, folderId) {
+  if (folderId === null) return void 0;
+  return (await listFolders(credentials)).find((folder) => folder.folderId === folderId)?.path;
+}
+function structuredSite(site) {
+  return {
+    siteId: site.siteId,
+    subdomain: site.subdomain,
+    url: site.url,
+    name: site.name,
+    status: site.status,
+    mode: servingModeOf$1(site),
+    passwordProtected: site.passwordProtected,
+    invitedOnly: site.invitedOnly,
+    formsEnabled: site.formsEnabled,
+    expiresAt: site.expiresAt,
+    expiryAction: site.expiryAction,
+    folderId: site.folderId,
+    available: {
+      password: site.passwordProtectionAvailable,
+      forms: site.formsAvailable,
+      scheduledTakedown: site.scheduledExpiryAvailable
+    },
+    versions: site.deploys.map((deploy2) => ({
+      deployId: deploy2.deployId,
+      status: deploy2.status,
+      fileCount: deploy2.fileCount,
+      createdAt: deploy2.createdAt,
+      filesKept: deploy2.filesKept,
+      live: deploy2.deployId === site.liveDeployId
+    }))
+  };
+}
 const SITE_OUTPUT = z.object({
   siteId: z.string().describe("Identifier of the site."),
   subdomain: z.string().describe("Its subdomain, which is what `site` accepts."),
@@ -1970,7 +2249,7 @@ const FOLDER_OUTPUT = z.object({
   )
 });
 const FOLDER_INPUT = z.string().optional().describe(
-  "Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is done in the dashboard. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published."
+  "Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is update_site's `folder`. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published."
 );
 function say(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
@@ -1993,11 +2272,13 @@ async function attempt(work) {
 }
 function describe(result) {
   const what = result.unchanged ? "Already live — every file matched what the site already serves, so no new version was published." : `Published ${result.files.toLocaleString()} ${result.files === 1 ? "file" : "files"}.`;
+  const mode = describeMode(result);
   return [
     what,
     "",
     result.url,
     "",
+    ...mode === null ? [] : [mode, ""],
     `Site ${result.subdomain} (${result.siteId}). Reaching every edge takes up to about a minute.`
   ].join("\n");
 }
@@ -2037,7 +2318,14 @@ function createServer() {
         "",
         "delete_site is permanent and frees the subdomain for anybody to claim. Ask the person for",
         "the subdomain and pass what they say as `confirm` — do not fill it in from what you already",
-        "know, because being told it is the point of the step."
+        "know, because being told it is the point of the step.",
+        "",
+        "An existing site's settings are read with get_site and changed with update_site: its name,",
+        "serving mode (static, spa, docs), a password, whether forms accept submissions, a scheduled",
+        "takedown, and its folder. pause_site and resume_site take it off the air and back without",
+        "deleting anything, and rollback_site serves an earlier version from get_site's list. Use",
+        "a password or a date only when the person gave one, and scheduling a deletion asks for",
+        "`confirm` the way delete_site does."
       ].join("\n")
     }
   );
@@ -2188,6 +2476,171 @@ function createServer() {
       return report(text, { folders: folders.map((folder) => ({ ...folder })) });
     })
   );
+  server.registerTool(
+    "get_site",
+    {
+      title: "Read a site's settings",
+      description: "Reads one site's settings and state — serving mode, password, forms, scheduled takedown, folder, whether it is paused — and its versions, newest first, with the one being served marked. Also says which settings the account's plan does not include.",
+      inputSchema: { site: SITE_INPUT },
+      outputSchema: {
+        ...SETTINGS_OUTPUT,
+        subdomain: z.string().describe("Its subdomain."),
+        url: z.string().describe("Its live URL."),
+        status: z.string().describe("`active`, `paused`, or a state the platform put it in."),
+        available: z.object({
+          password: z.boolean(),
+          forms: z.boolean(),
+          scheduledTakedown: z.boolean()
+        }).describe("Which settings the account's plan includes."),
+        versions: z.array(VERSION_OUTPUT).describe("Its versions, newest first.")
+      },
+      annotations: READS_ONLY
+    },
+    ({ site }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const detail = await getSite(credentials, found.siteId);
+      return report(
+        describeSite(detail, await folderPathOf(credentials, detail.folderId)),
+        structuredSite(detail)
+      );
+    })
+  );
+  server.registerTool(
+    "update_site",
+    {
+      title: "Change a site's settings",
+      description: "Changes one or more settings of an existing site; anything left out stays as it is. Takes effect on every edge within about a minute, without publishing again. Settings the plan does not include are refused with the reason. Only change what the person asked for — never invent a password or a date.",
+      inputSchema: {
+        site: SITE_INPUT,
+        name: z.string().optional().describe("What to call the site in the dashboard. An empty string clears it."),
+        mode: z.enum(["static", "spa", "docs"]).optional().describe(
+          "How the site serves: `static` answers 404 for a missing path, `spa` falls back to index.html for a client-side router, `docs` reads documents through the viewer. Setting it stops the mode being detected on each publish."
+        ),
+        password: z.string().optional().describe(
+          "A password visitors must type before seeing the site, as the person gave it. An empty string removes the password. On an invite-only site a password replaces invite-only and shuts out everyone on its list, so check get_site's `invitedOnly` and ask first."
+        ),
+        forms: z.boolean().optional().describe("Whether the site's forms (marked data-drop2run) accept submissions."),
+        expiresAt: z.string().optional().describe(
+          "When the site should come down, as an ISO 8601 instant in the future such as 2026-12-01T09:00:00Z. An empty string cancels a scheduled takedown."
+        ),
+        expiryAction: z.enum(["pause", "delete"]).optional().describe(
+          "What the takedown does, read only with `expiresAt`: `pause` (the default) keeps the files and can be resumed; `delete` removes the site and frees its subdomain, and needs `confirm`."
+        ),
+        folder: z.string().optional().describe(
+          "Folder to move the site to — a path such as Clients/Acme or an id from list_folders — or `root` for the top level. Never creates a folder."
+        ),
+        confirm: z.string().optional().describe(
+          "Required only with `expiryAction: delete`: the site's subdomain, repeated exactly as the person said it. Ask for it rather than filling it in."
+        )
+      },
+      outputSchema: SETTINGS_OUTPUT,
+      annotations: CHANGES_A_SITE
+    },
+    ({ site, name, mode, password, forms, expiresAt, expiryAction, folder, confirm }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      if (expiryAction !== void 0 && expiresAt === void 0) {
+        throw new Error("`expiryAction` only applies with `expiresAt` — send the date too.");
+      }
+      if (expiryAction === "delete" && expiresAt !== "" && confirm?.trim().toLowerCase() !== found.subdomain.toLowerCase()) {
+        throw new Error(
+          `Refusing to schedule ${found.subdomain} for deletion: \`confirm\` said "${confirm ?? ""}". Repeat the subdomain exactly to go ahead, or use \`expiryAction: pause\`, which keeps the files.`
+        );
+      }
+      const change = {
+        name,
+        mode,
+        password,
+        expiresAt,
+        // Dropped on a cancellation: the API reads an action only with a date, and sending
+        // `delete` alongside an empty date would still run its owner-only check for nothing.
+        expiryAction: expiresAt === "" ? void 0 : expiryAction,
+        formsEnabled: forms,
+        folderId: folder === void 0 ? void 0 : await resolveFolderTarget(credentials, folder)
+      };
+      const settings = await updateSiteSettings(credentials, found.siteId, change);
+      const lines = [
+        `Updated ${found.subdomain}.`,
+        `  access    ${accessOf(settings)}`,
+        `  mode      ${servingModeOf$1(settings)}`,
+        `  forms     ${settings.formsEnabled ? "on" : "off"}`,
+        `  takedown  ${settings.expiresAt === null ? "none" : `${settings.expiresAt} (${settings.expiryAction})`}`,
+        ...settings.replacedInviteOnly ? [
+          "The password replaced invite-only: the people on its list can no longer get in without it. The list is kept for switching back in the dashboard."
+        ] : [],
+        ...settings.live ? ["Reaching every edge takes up to about a minute."] : ["Nothing is published yet, so this applies from the first publish."]
+      ];
+      return report(lines.join("\n"), {
+        siteId: settings.siteId,
+        name: settings.name,
+        mode: servingModeOf$1(settings),
+        passwordProtected: settings.passwordProtected,
+        invitedOnly: settings.invitedOnly,
+        formsEnabled: settings.formsEnabled,
+        expiresAt: settings.expiresAt,
+        expiryAction: settings.expiryAction,
+        folderId: settings.folderId
+      });
+    })
+  );
+  server.registerTool(
+    "pause_site",
+    {
+      title: "Pause a site",
+      description: "Takes a site off the air without deleting anything: visitors see that it is paused, and its files, versions and subdomain are kept. resume_site puts it back.",
+      inputSchema: { site: SITE_INPUT },
+      outputSchema: PAUSE_OUTPUT,
+      annotations: CHANGES_A_SITE
+    },
+    ({ site }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const state = await setSitePaused(credentials, found.siteId, "pause");
+      return report(
+        state.status === "paused" ? `Paused ${state.subdomain}. Its files and subdomain are kept; resume_site puts it back.` : `${state.subdomain} is ${state.status}, not paused by its owner, so resume_site cannot bring it back. The pause is recorded and applies if that is lifted.`,
+        { ...state }
+      );
+    })
+  );
+  server.registerTool(
+    "resume_site",
+    {
+      title: "Resume a paused site",
+      description: "Puts a paused site back on the air. Refused, with the reason, when the plan has no room for another active site, the account is past due, or the site was suspended by Drop2Run.",
+      inputSchema: { site: SITE_INPUT },
+      outputSchema: PAUSE_OUTPUT,
+      annotations: RESTORES_A_SITE
+    },
+    ({ site }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const state = await setSitePaused(credentials, found.siteId, "resume");
+      return report(`${state.subdomain} is back on the air.
+${found.url}`, { ...state });
+    })
+  );
+  server.registerTool(
+    "rollback_site",
+    {
+      title: "Roll a site back",
+      description: "Serves an earlier version of a site again, without publishing anything. get_site lists the versions; one whose files were collected cannot be rolled back to.",
+      inputSchema: {
+        site: SITE_INPUT,
+        deployId: z.string().min(1).describe("The version to serve, from get_site's `versions`.")
+      },
+      outputSchema: {
+        deployId: z.string().describe("The version now being served."),
+        url: z.string().describe("The URL it is served on.")
+      },
+      annotations: CHANGES_A_SITE
+    },
+    ({ site, deployId }) => withCredentials(async (credentials) => {
+      const found = await findSite(credentials, site);
+      const promoted = await promoteDeploy(credentials, found.siteId, deployId);
+      return report(
+        `${found.subdomain} is back on ${promoted.deployId}. Reaching every edge takes up to about a minute.
+${promoted.url}`,
+        { deployId: promoted.deployId, url: promoted.url }
+      );
+    })
+  );
   return server;
 }
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"description": "MCP server that publishes what an AI made — a page, a document or a whole site — to Drop2Run and returns a live URL.",
 	"mcpName": "run.dropto/drop2run",
 	"license": "MIT",
@@ -46,14 +46,14 @@
 		"build:mcpb": "node scripts/build-mcpb.mjs"
 	},
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.30.0",
+		"@modelcontextprotocol/sdk": "^1.32.1",
 		"zod": "^4.1.12"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.5.11",
 		"@types/node": "^26.4.0",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.11",
-		"vite": "^7.2.1"
+		"vite": "^7.2.1",
+		"vitest": "^4.1.11"
 	}
 }