@sakupa/mcp 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,59 +1,7 @@
 // src/version.ts
-var MCP_VERSION = "0.1.0";
+var MCP_VERSION = "0.3.0";
 var CLIENT_TYPE = "sakupa-mcp";
 
-// src/transport.ts
-var FetchTransport = class {
-  baseUrl;
-  constructor(baseUrl) {
-    this.baseUrl = baseUrl.replace(/\/+$/, "");
-  }
-  async request(req) {
-    let url = `${this.baseUrl}${req.path}`;
-    if (req.query && Object.keys(req.query).length > 0) {
-      url += `?${new URLSearchParams(req.query).toString()}`;
-    }
-    const headers = {
-      accept: "application/json",
-      ...req.body !== void 0 ? { "content-type": "application/json" } : {},
-      ...req.headers
-    };
-    const res = await fetch(url, {
-      method: req.method,
-      headers,
-      ...req.body !== void 0 ? { body: req.body } : {}
-    });
-    const text2 = await res.text();
-    const responseHeaders = {};
-    res.headers.forEach((value, key) => {
-      responseHeaders[key] = value;
-    });
-    return {
-      status: res.status,
-      headers: responseHeaders,
-      ...text2.length > 0 ? { body: text2 } : {}
-    };
-  }
-  async upload(target, body) {
-    if (target.url.startsWith("memory://")) {
-      throw new Error(
-        `Upload target "${target.url}" is an in-process memory URL. memory:// targets only exist inside the in-process test harness and cannot be uploaded to over HTTP.`
-      );
-    }
-    const res = await fetch(target.url, {
-      method: target.method,
-      headers: target.headers,
-      body
-    });
-    if (!res.ok) {
-      const text2 = await res.text().catch(() => "");
-      throw new Error(
-        `Upload of "${target.path}" failed with HTTP ${res.status}${text2 ? `: ${text2.slice(0, 200)}` : ""}`
-      );
-    }
-  }
-};
-
 // ../core/dist/domain/constants.js
 var SERVICE_DOMAIN = "sakupa.com";
 var FREE_SITE_URL_SUFFIX = `.${SERVICE_DOMAIN}`;
@@ -186,11 +134,11 @@ var HTTP_STATUS = {
   conflict: 409,
   state_conflict: 409,
   rate_limited: 429,
-  insufficient_balance: 402,
   payment_required: 402,
   confirmation_required: 428,
   dns_not_verified: 403,
   not_deployable: 422,
+  upgrade_required: 426,
   internal: 500
 };
 var SakupaError = class extends Error {
@@ -490,17 +438,80 @@ function safeDecode(bytes) {
   }
 }
 
+// ../core/dist/domain/hashing.js
+async function sha256Hex(bytes) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
+  let hex = "";
+  for (const byte of new Uint8Array(digest))
+    hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+
 // ../core/dist/domain/subscription.js
-var SUBSCRIPTION_WARNING_TEXT = "You are subscribing {billingDomain} to Sakupa Domain Hosting: the {plan} monthly plan (\xA5{priceJpy}/month).\n\nPaying does not prove that you own this domain, does not grant management rights, and does not by itself publish a website: the domain must still pass DNS ownership verification.\n\nIf this site outgrows its plan, Sakupa automatically upgrades the subscription to the next plan (water -> personal -> share -> business) and renewals bill the new plan. There is no metered overage: above the Business plan, growth is limited instead of billed further.\n\nYou can cancel anytime; hosting then runs to the end of the already-paid month and stops.";
+var SUBSCRIPTION_WARNING_TEXT = "You are subscribing this site ({siteUrl}) to Sakupa Hosting: the {plan} monthly plan (\xA5{priceJpy}/month).\n\nPaying makes THIS site permanent on its {siteUrl} address \u2014 it stops expiring. Binding a custom domain afterwards is an optional included extra: it requires proving DNS control of that domain, and whether or not you ever bind one does not change the subscription or qualify for a refund.\n\nIf this site outgrows its plan, Sakupa automatically upgrades the subscription to the next plan (water -> personal -> share -> business) and renewals bill the new plan. There is no metered overage: above the Business plan, growth is limited instead of billed further.\n\nYou can cancel anytime; when the subscription ends, the site immediately becomes a free temporary site again (24h validity) and all paid data \u2014 custom domain bindings included \u2014 is removed.";
 
 // ../core/dist/dto.js
 var CREDENTIAL_HEADER = "x-sakupa-credential";
 var IDEMPOTENCY_HEADER = "x-sakupa-idempotency-key";
+var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 
 // ../core/dist/services/sites.js
 var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
 var utf8Encoder = new TextEncoder();
 
+// src/transport.ts
+var FetchTransport = class {
+  baseUrl;
+  constructor(baseUrl) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+  }
+  async request(req) {
+    let url = `${this.baseUrl}${req.path}`;
+    if (req.query && Object.keys(req.query).length > 0) {
+      url += `?${new URLSearchParams(req.query).toString()}`;
+    }
+    const headers = {
+      accept: "application/json",
+      [MCP_VERSION_HEADER]: MCP_VERSION,
+      ...req.body !== void 0 ? { "content-type": "application/json" } : {},
+      ...req.headers
+    };
+    const res = await fetch(url, {
+      method: req.method,
+      headers,
+      ...req.body !== void 0 ? { body: req.body } : {}
+    });
+    const text2 = await res.text();
+    const responseHeaders = {};
+    res.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+    return {
+      status: res.status,
+      headers: responseHeaders,
+      ...text2.length > 0 ? { body: text2 } : {}
+    };
+  }
+  async upload(target, body) {
+    if (target.url.startsWith("memory://")) {
+      throw new Error(
+        `Upload target "${target.url}" is an in-process memory URL. memory:// targets only exist inside the in-process test harness and cannot be uploaded to over HTTP.`
+      );
+    }
+    const res = await fetch(target.url, {
+      method: target.method,
+      headers: target.headers,
+      body
+    });
+    if (!res.ok) {
+      const text2 = await res.text().catch(() => "");
+      throw new Error(
+        `Upload of "${target.path}" failed with HTTP ${res.status}${text2 ? `: ${text2.slice(0, 200)}` : ""}`
+      );
+    }
+  }
+};
+
 // src/api-client.ts
 var KNOWN_ERROR_CODES = /* @__PURE__ */ new Set([
   "invalid_request",
@@ -511,11 +522,11 @@ var KNOWN_ERROR_CODES = /* @__PURE__ */ new Set([
   "conflict",
   "state_conflict",
   "rate_limited",
-  "insufficient_balance",
   "payment_required",
   "confirmation_required",
   "dns_not_verified",
   "not_deployable",
+  "upgrade_required",
   "internal"
 ]);
 var HttpApiClient = class {
@@ -616,14 +627,7 @@ var HttpApiClient = class {
       { body: req }
     );
   }
-  /** Wallet-era recharge checkout; unused (kept for SakupaApiClient compatibility). */
-  async createCheckout(req) {
-    return this.call("POST", "/v1/payments/checkout", {
-      body: req,
-      idempotencyKey: req.idempotencyKey
-    });
-  }
-  /** Subscription checkout: a fixed monthly plan for one apex domain (owner-only). */
+  /** Subscription checkout: a fixed monthly plan permanentizing one site (owner-only). */
   async createPlanCheckout(req, credential) {
     return this.call("POST", "/v1/payments/checkout", {
       credential,
@@ -632,31 +636,24 @@ var HttpApiClient = class {
     });
   }
   /** Stripe-hosted billing portal (payment method, invoices, cancellation). */
-  async createBillingPortal(apexDomain, credential) {
+  async createBillingPortal(siteId, credential) {
     return this.call(
       "POST",
-      `/v1/billing/${encodeURIComponent(apexDomain)}/portal`,
+      `/v1/sites/${encodeURIComponent(siteId)}/billing/portal`,
       { credential, body: {} }
     );
   }
-  async getBillingStatus(apexDomain, credential) {
+  async getBillingStatus(siteId, credential) {
     return this.call(
       "GET",
-      `/v1/billing/${encodeURIComponent(apexDomain)}`,
-      credential !== void 0 ? { credential } : {}
-    );
-  }
-  async setBillingPlan(apexDomain, credential, req) {
-    return this.call(
-      "POST",
-      `/v1/billing/${encodeURIComponent(apexDomain)}/plan`,
-      { credential, body: req }
+      `/v1/sites/${encodeURIComponent(siteId)}/billing`,
+      { credential }
     );
   }
-  async downgradeSite(siteId, credential, req) {
+  async setBillingPlan(siteId, credential, req) {
     return this.call(
       "POST",
-      `/v1/sites/${encodeURIComponent(siteId)}/downgrade`,
+      `/v1/sites/${encodeURIComponent(siteId)}/billing/plan`,
       { credential, body: req }
     );
   }
@@ -702,8 +699,7 @@ function readSiteFile(projectDir) {
       apiBaseUrl: typeof parsed.apiBaseUrl === "string" ? parsed.apiBaseUrl : "",
       ...typeof parsed.shortId === "string" ? { shortId: parsed.shortId } : {},
       ...typeof parsed.url === "string" ? { url: parsed.url } : {},
-      ...typeof parsed.billingDomain === "string" ? { billingDomain: parsed.billingDomain } : {},
-      ...typeof parsed.billingDomainId === "string" ? { billingDomainId: parsed.billingDomainId } : {}
+      ...typeof parsed.boundDomain === "string" ? { boundDomain: parsed.boundDomain } : {}
     };
   } catch {
     return null;
@@ -1194,8 +1190,8 @@ var severityEnum = z.enum(["low", "medium", "high", "critical"]);
 function planCatalog() {
   return TIER_ORDER.map((p) => `${p} \xA5${tierPriceJpy(p)}/month`).join(", ");
 }
-function subscriptionWarning(domain, plan) {
-  return SUBSCRIPTION_WARNING_TEXT.replaceAll("{billingDomain}", domain).replaceAll("{plan}", plan).replaceAll("{priceJpy}", String(tierPriceJpy(plan)));
+function subscriptionWarning(siteUrl, plan) {
+  return SUBSCRIPTION_WARNING_TEXT.replaceAll("{siteUrl}", siteUrl).replaceAll("{plan}", plan).replaceAll("{priceJpy}", String(tierPriceJpy(plan)));
 }
 var ticketCategoryEnum = z.enum([
   "billing",
@@ -1234,6 +1230,36 @@ Please ask the user to choose, then re-run deploy_site with:
 Output directory: "${analysis.recommendedOutputDir ?? "."}", ${analysis.fileCount} files.`
   );
 }
+var MB2 = 1024 * 1024;
+function ensureUploadSizeWithinLimits(manifest, isFirstFreeDeploy) {
+  const oversized = manifest.find((f) => f.size > MAX_SINGLE_FILE_BYTES);
+  if (oversized) {
+    throw new SakupaError(
+      "validation_failed",
+      `"${oversized.path}" is ${(oversized.size / MB2).toFixed(1)}MB, over the ${Math.floor(MAX_SINGLE_FILE_BYTES / MB2)}MB per-file limit. Remove or shrink it before deploying.`
+    );
+  }
+  if (isFirstFreeDeploy) {
+    const total = manifest.reduce((sum, f) => sum + f.size, 0);
+    if (total > FREE_SITE_MAX_TOTAL_BYTES) {
+      throw new SakupaError(
+        "validation_failed",
+        `The static output is ${(total / MB2).toFixed(1)}MB, over the ${Math.floor(FREE_SITE_MAX_TOTAL_BYTES / MB2)}MB free-site limit. Reduce the output (bundle/compress assets, drop large media) or subscribe the site to a paid plan for larger sites.`
+      );
+    }
+  }
+}
+async function buildHashedManifest(files, outputAbs) {
+  const manifest = [];
+  for (const file of files) {
+    const bytes = new Uint8Array(await fs2.readFile(join3(outputAbs, file.path)));
+    manifest.push({ path: file.path, size: file.size, contentHash: await sha256Hex(bytes) });
+  }
+  return manifest;
+}
+function isIncrementalReuseFailure(e) {
+  return isSakupaError(e) && e.code === "state_conflict" && typeof e.details === "object" && e.details !== null && e.details.incrementalReuseFailed === true;
+}
 async function uploadAll(ctx, targets, files, outputAbs) {
   for (let i = 0; i < targets.length; i++) {
     const target = targets[i];
@@ -1246,6 +1272,12 @@ async function uploadAll(ctx, targets, files, outputAbs) {
       );
     }
     const bytes = new Uint8Array(await fs2.readFile(join3(outputAbs, match.path)));
+    if (bytes.byteLength !== match.size) {
+      throw new SakupaError(
+        "validation_failed",
+        `"${match.path}" changed since analysis (${match.size} -> ${bytes.byteLength} bytes). Re-run deploy_site so Sakupa re-checks the current files before uploading.`
+      );
+    }
     await ctx.client.uploadFile(target, bytes);
   }
   return targets.length;
@@ -1281,7 +1313,7 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy_site",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://{shortId}.sakupa.com) and stores the management credential in .sakupa/site.json. Later runs update the existing site and refresh its validity. Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://{shortId}.sakupa.com) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
       inputSchema: {
         outputDir: z.string().optional().describe("Output directory relative to the project root (overrides detection)."),
         spaFallback: z.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
@@ -1303,9 +1335,10 @@ Next action: ${analysis.suggestedNextAction}`,
           return notDeployableResult(analysis);
         }
         const files = analysis.files;
-        const manifest = files.map((f) => ({ path: f.path, size: f.size }));
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
+        const manifest = await buildHashedManifest(files, outputAbs);
         const existing = readSiteFile(ctx.projectDir);
+        ensureUploadSizeWithinLimits(manifest, !existing);
         if (!existing) {
           const created = await ctx.client.createSite({
             manifest,
@@ -1332,32 +1365,49 @@ Next action: ${analysis.suggestedNextAction}`,
 Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
 ` : "") + `
-This is a FREE temporary preview: it stays live for ${FREE_SITE_TTL_HOURS} hours. Deploying again or calling refresh_site extends the validity. The management credential was saved to .sakupa/site.json \u2014 keep that file: it is the only way to manage this free site.
+This is a FREE temporary preview: it stays live for ${FREE_SITE_TTL_HOURS} hours. Deploying again or calling refresh_site extends the validity; subscribing the site (subscribe_site) makes this URL permanent. The management credential was saved to .sakupa/site.json \u2014 keep that file: it is the only way to manage this site.
 ` + (finalized2.warnings.length > 0 ? `
 Warnings:
 ${JSON.stringify(finalized2.warnings, null, 2)}` : "")
           );
         }
-        const deployment = await ctx.client.createDeployment(existing.siteId, existing.credential, {
-          manifest,
-          ...args.lang !== void 0 ? { lang: args.lang } : {},
-          spaFallback: args.spaFallback === true,
-          ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
-        });
-        const uploaded = await uploadAll(ctx, deployment.uploadTargets, files, outputAbs);
-        const finalized = await ctx.client.finalizeDeployment(
-          deployment.deploymentId,
-          existing.siteId,
-          existing.credential
-        );
+        const updateOnce = async (forceFullUpload) => {
+          const req = {
+            manifest,
+            ...args.lang !== void 0 ? { lang: args.lang } : {},
+            spaFallback: args.spaFallback === true,
+            ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {},
+            ...forceFullUpload ? { forceFullUpload: true } : {}
+          };
+          const deployment = await ctx.client.createDeployment(
+            existing.siteId,
+            existing.credential,
+            req
+          );
+          const uploaded2 = await uploadAll(ctx, deployment.uploadTargets, files, outputAbs);
+          const finalized2 = await ctx.client.finalizeDeployment(
+            deployment.deploymentId,
+            existing.siteId,
+            existing.credential
+          );
+          return { uploaded: uploaded2, finalized: finalized2 };
+        };
+        let update;
+        try {
+          update = await updateOnce(false);
+        } catch (e) {
+          if (!isIncrementalReuseFailure(e)) throw e;
+          update = await updateOnce(true);
+        }
+        const { uploaded, finalized } = update;
         writeSiteFile(ctx.projectDir, { ...existing, url: finalized.url });
         return text(
           `Site updated: ${finalized.url}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
 ` : "") + (finalized.mode === "free" ? `
-Reminder: free sites stay live for ${FREE_SITE_TTL_HOURS} hours after the last deploy or refresh_site call.
-` : "") + (finalized.warnings.length > 0 ? `
+Reminder: free sites stay live for ${FREE_SITE_TTL_HOURS} hours after the last deploy or refresh_site call. Subscribing (subscribe_site) makes the site permanent.
+` : "\nThis site is subscribed and permanent \u2014 no expiry.\n") + (finalized.warnings.length > 0 ? `
 Warnings:
 ${JSON.stringify(finalized.warnings, null, 2)}` : "")
         );
@@ -1369,7 +1419,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : "")
   server.registerTool(
     "refresh_site",
     {
-      description: "Refresh the validity of the free temporary site WITHOUT uploading content. Uses the local credential in .sakupa/site.json.",
+      description: "Refresh the validity of the free temporary site WITHOUT uploading content. Uses the local credential in .sakupa/site.json. Subscribed sites are permanent and need no refresh.",
       inputSchema: {}
     },
     async () => {
@@ -1388,7 +1438,7 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
   server.registerTool(
     "site_status",
     {
-      description: "Show the current status of this project's Sakupa site: URL, mode (free/paid), expiry, domain binding, size, last deployment and warnings.",
+      description: "Show the current status of this project's Sakupa site: URL, mode (free/paid), expiry, subscription state, custom domains, size, last deployment and warnings.",
       inputSchema: {}
     },
     async () => {
@@ -1401,10 +1451,53 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
       }
     }
   );
+  server.registerTool(
+    "subscribe_site",
+    {
+      description: `Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (${planCatalog()}). Paying makes the site PERMANENT on its {shortId}.sakupa.com URL \u2014 no more 24h expiry; that is the core value of paying. Binding a custom domain afterwards (bind_domain) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first. If the site outgrows its plan, Sakupa auto-upgrades to the next plan (capped at Business, where growth is limited instead of billed further). Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Without confirm: true this tool only shows the mandatory disclosure and makes no API call.`,
+      inputSchema: {
+        plan: planEnum.describe(
+          "Monthly plan: water (very light personal pages), personal (personal brand / small shop), share (small-business site), business (steadier traffic, more headroom)."
+        ),
+        confirm: z.boolean().optional().describe("User read the subscription disclosure and confirmed. Required to proceed.")
+      }
+    },
+    async (args) => {
+      try {
+        const site = requireSiteFile(ctx);
+        const siteUrl = site.url ?? (site.shortId ? `https://${site.shortId}.sakupa.com` : site.siteId);
+        if (args.confirm !== true) {
+          return text(
+            `${subscriptionWarning(siteUrl, args.plan)}
+
+No checkout link was created yet. Please show this disclosure to the user and, after their explicit confirmation, re-run subscribe_site with confirm: true.`
+          );
+        }
+        const res = await ctx.client.createPlanCheckout(
+          {
+            siteId: site.siteId,
+            plan: args.plan,
+            idempotencyKey: randomUUID(),
+            confirmPlan: true
+          },
+          site.credential
+        );
+        return text(
+          `Stripe Checkout link \u2014 Sakupa Hosting for this site: ${res.plan} plan, \xA5${res.monthlyPriceJpy}/month
+${res.checkoutUrl}
+
+Open this link in a browser to subscribe. Card data is entered only on the Stripe-hosted page \u2014 never give card numbers, passwords or security codes to the AI tool.
+Once payment confirms, the site becomes permanent on its current URL. Binding a custom domain (bind_domain) is optional and still requires DNS verification.`
+        );
+      } catch (e) {
+        return toolError(e);
+      }
+    }
+  );
   server.registerTool(
     "bind_domain",
     {
-      description: `Start or continue binding a custom domain to this site (the paid long-term mode). Ownership is proven ONLY by DNS control of the registered apex domain \u2014 payment never grants ownership. The billing subject is always the apex domain: all its subdomains share one hosting subscription (plans: ${planCatalog()}). The apex domain needs an ACTIVE subscription (see subscribe_domain) before paid configuration can start. Call again with verificationId to check DNS verification progress.`,
+      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the registered apex domain \u2014 payment never grants ownership. A binding request never reserves the hostname: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
       inputSchema: {
         hostname: z.string().describe('Hostname to bind, e.g. "example.com" or "www.example.com".'),
         verificationId: z.string().optional().describe("Check an existing DNS verification instead of starting a new one.")
@@ -1416,12 +1509,12 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
         if (args.verificationId !== void 0) {
           const res2 = await ctx.client.checkVerification(args.verificationId, site.credential);
           if (res2.status === "verified") {
-            writeSiteFile(ctx.projectDir, { ...site, billingDomain: res2.apexDomain });
+            writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
           return text(
             `DNS verification ${res2.verificationId}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificate and CDN setup are in progress; check again with bind_domain + verificationId later.
+` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificate and serving setup are in progress; check again with bind_domain + verificationId later.
 ` : "") + (res2.pendingDnsRecords.length > 0 ? `
 DNS records still required:
 ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
@@ -1432,22 +1525,15 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
-        writeSiteFile(ctx.projectDir, {
-          ...site,
-          billingDomain: res.apexDomain,
-          billingDomainId: res.billingDomainId
-        });
         const servingHint = res.isApex ? `"${res.hostname}" is an apex domain: your DNS provider must support ALIAS, ANAME, CNAME flattening, or alias records to point it at the assigned CDN domain.` : `"${res.hostname}" is a subdomain: create a CNAME record pointing it at the assigned CDN domain once provisioning completes.`;
         return text(
           `Domain binding started for ${res.hostname}.
 
-Billing subject: the apex domain "${res.apexDomain}". Subdomains of ${res.apexDomain} cannot be separate billing subjects \u2014 they all share this domain hosting subscription.
-
 1. Prove control of ${res.apexDomain} by creating this DNS record:
    name:  ${res.verificationRecord.name}
    type:  ${res.verificationRecord.type}
    value: ${res.verificationRecord.value}
-   Ownership and management authority come ONLY from DNS control. Paying for the subscription never grants ownership, management rights, or activation.
+   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the hostname \u2014 the first verified request wins, and this challenge expires after 72 hours.
 
 2. Serving DNS (after verification): ${servingHint}
    Server guidance: ${res.servingInstructions}
@@ -1462,33 +1548,24 @@ Then run bind_domain again with verificationId: "${res.verificationId}" to check
   server.registerTool(
     "billing_status",
     {
-      description: "Show the hosting subscription status of an apex billing domain: current plan, payment state, current paid period, reconciled usage, estimated usage tier, next renewal, risks and the per-site usage breakdown. Reads are based on the latest reconciled snapshot.",
-      inputSchema: {
-        domain: z.string().optional().describe("Apex billing domain; defaults to the domain bound in .sakupa/site.json.")
-      }
+      description: "Show this site's hosting subscription: plan, payment state, current paid period, reconciled usage, estimated usage tier, bound custom domains and risks. Owner-only (uses the credential in .sakupa/site.json).",
+      inputSchema: {}
     },
-    async (args) => {
+    async () => {
       try {
-        const site = readSiteFile(ctx.projectDir);
-        const domain = args.domain ?? site?.billingDomain;
-        if (!domain) {
-          throw new SakupaError(
-            "invalid_request",
-            'No domain given and this project has no bound billing domain. Pass domain, e.g. billing_status { domain: "example.com" }.'
-          );
-        }
-        const res = await ctx.client.getBillingStatus(domain, site?.credential);
+        const site = requireSiteFile(ctx);
+        const res = await ctx.client.getBillingStatus(site.siteId, site.credential);
         const lines = [
-          `Billing status for ${res.paidSubject} (service status: ${res.serviceStatus})`,
-          res.committedTier ? `Plan: ${res.committedTier} (\xA5${tierPriceJpy(res.committedTier)}/month)` : "Plan: (no subscription yet)",
+          `Billing status for site ${res.siteId} (mode: ${res.mode})`,
+          res.permanentUrl ? `Permanent URL: ${res.permanentUrl}` : void 0,
+          res.plan ? `Plan: ${res.plan} (\xA5${res.monthlyPriceJpy ?? tierPriceJpy(res.plan)}/month)` : "Plan: (no subscription yet)",
           res.subscriptionStatus ? `Subscription payment state: ${res.subscriptionStatus}` : void 0,
-          res.cancelAtCycleEnd ? "Renewal: CANCELED \u2014 hosting stops at the end of the already-paid month" : void 0,
-          res.currentCycleStart ? `Current paid period: ${res.currentCycleStart} -> ${res.currentCycleEnd ?? "?"}` : void 0,
+          res.cancelAtPeriodEnd ? "Renewal: CANCELED \u2014 the site reverts to free at the end of the already-paid month" : void 0,
+          res.currentPeriodStart ? `Current paid period: ${res.currentPeriodStart} -> ${res.currentPeriodEnd ?? "?"}` : void 0,
           res.estimatedUsageTier ? `Estimated usage tier: ${res.estimatedUsageTier}` : void 0,
           res.lastReconciledAt ? `Last usage reconciliation: ${res.lastReconciledAt}` : void 0,
-          res.nextSettlementAt ? `Next renewal: ${res.nextSettlementAt}` : void 0,
-          res.risks.unpaid ? "ATTENTION: renewal payment failed \u2014 update the payment method (manage_billing) to keep the custom domain hosted." : void 0,
-          res.ownerView ? void 0 : "Note: public view (no valid owner credential presented)."
+          res.boundHostnames.length > 0 ? `Bound custom domains: ${res.boundHostnames.join(", ")}` : void 0,
+          res.risks.pastDue ? "ATTENTION: renewal payment failing \u2014 update the payment method (manage_billing). Serving continues while Stripe retries; if Stripe gives up, the site reverts to free." : void 0
         ].filter((l) => l !== void 0);
         return textJson(`${lines.join("\n")}
 
@@ -1498,71 +1575,18 @@ Full status:`, res);
       }
     }
   );
-  server.registerTool(
-    "subscribe_domain",
-    {
-      description: `Create a Stripe Checkout link that subscribes an apex domain to a Sakupa Domain Hosting monthly plan (${planCatalog()}). Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first; a lost credential means payment is not possible. One domain = one subscription; if the site outgrows its plan, Sakupa auto-upgrades to the next plan (capped at Business, where growth is limited instead of billed further). Paying never proves domain ownership and never activates a website \u2014 DNS verification (bind_domain) is still required. Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Without confirm: true this tool only shows the mandatory disclosure and makes no API call.`,
-      inputSchema: {
-        domain: z.string().describe('Apex domain to subscribe, e.g. "example.com".'),
-        plan: planEnum.describe(
-          "Monthly plan: water (very light personal pages), personal (personal brand / small shop), share (small-business site), business (steadier traffic, more headroom)."
-        ),
-        confirm: z.boolean().optional().describe("User read the subscription disclosure and confirmed. Required to proceed.")
-      }
-    },
-    async (args) => {
-      try {
-        const site = requireSiteFile(ctx);
-        if (args.confirm !== true) {
-          return text(
-            `${subscriptionWarning(args.domain, args.plan)}
-
-No checkout link was created yet. Please show this disclosure to the user and, after their explicit confirmation, re-run subscribe_domain with confirm: true.`
-          );
-        }
-        const res = await ctx.client.createPlanCheckout(
-          {
-            siteId: site.siteId,
-            domain: args.domain,
-            plan: args.plan,
-            idempotencyKey: randomUUID(),
-            confirmPlan: true
-          },
-          site.credential
-        );
-        return text(
-          `Stripe Checkout link \u2014 Sakupa Domain Hosting for ${res.apexDomain}: ${res.plan} plan, \xA5${res.monthlyPriceJpy}/month
-${res.checkoutUrl}
-
-Open this link in a browser to subscribe. Card data is entered only on the Stripe-hosted page \u2014 never give card numbers, passwords or security codes to the AI tool.
-Reminder: the subscription is payment state only. It grants no domain ownership and no management rights; the domain must still pass DNS verification (bind_domain) before long-term hosting activates.`
-        );
-      } catch (e) {
-        return toolError(e);
-      }
-    }
-  );
   server.registerTool(
     "manage_billing",
     {
-      description: "Open the Stripe-hosted billing portal for the bound apex domain: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json) of a site bound to the domain.",
-      inputSchema: {
-        domain: z.string().optional().describe("Apex billing domain; defaults to the domain bound in .sakupa/site.json.")
-      }
+      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json).",
+      inputSchema: {}
     },
-    async (args) => {
+    async () => {
       try {
         const site = requireSiteFile(ctx);
-        const domain = args.domain ?? site.billingDomain;
-        if (!domain) {
-          throw new SakupaError(
-            "invalid_request",
-            "No domain given and this project has no bound billing domain. Pass domain explicitly."
-          );
-        }
-        const res = await ctx.client.createBillingPortal(domain, site.credential);
+        const res = await ctx.client.createBillingPortal(site.siteId, site.credential);
         return text(
-          `Stripe billing portal for ${res.apexDomain}:
+          `Stripe billing portal for this site:
 ${res.portalUrl}
 
 Open this link in a browser to update the payment method, view invoices, or manage the subscription. The link is temporary \u2014 create a fresh one when needed.`
@@ -1575,7 +1599,7 @@ Open this link in a browser to update the payment method, view invoices, or mana
   server.registerTool(
     "recover_domain_site",
     {
-      description: "Recover management control of a paid custom-domain site after losing the local project, by proving DNS control of the apex domain. By default, completing recovery REVOKES all previous local credentials for the site. Call first with the hostname to get the DNS record, then again with verificationId to complete recovery (writes a new .sakupa/site.json and returns a download link for the current site content).",
+      description: "Recover management control of a subscribed site WITH A BOUND CUSTOM DOMAIN after losing the local project, by proving DNS control of the apex domain. Sites without a bound domain are identified solely by their local credential and cannot be recovered. By default, completing recovery REVOKES all previous local credentials. Call first with the hostname to get the DNS record, then again with verificationId to complete recovery (writes a new .sakupa/site.json and returns a download link for the current site content).",
       inputSchema: {
         hostname: z.string().describe('Hostname of the site to recover, e.g. "www.example.com".'),
         verificationId: z.string().optional().describe("Complete a recovery previously started for this hostname."),
@@ -1587,7 +1611,7 @@ Open this link in a browser to update the payment method, view invoices, or mana
         if (args.verificationId === void 0) {
           const res2 = await ctx.client.recoverDomain({ hostname: args.hostname });
           return text(
-            `Recovery started for ${args.hostname} (apex billing domain: ${res2.apexDomain}).
+            `Recovery started for ${args.hostname} (apex domain: ${res2.apexDomain}).
 
 Create this DNS record to prove apex-domain control:
    name:  ${res2.verificationRecord.name}
@@ -1606,13 +1630,13 @@ After the DNS record resolves, re-run recover_domain_site with verificationId: "
         });
         writeSiteFile(ctx.projectDir, {
           siteId: res.siteId,
-          billingDomain: res.billingDomain,
+          ...res.boundHostnames[0] !== void 0 ? { boundDomain: res.boundHostnames[0] } : {},
           credential: res.credential,
           createdAt: (/* @__PURE__ */ new Date()).toISOString(),
           apiBaseUrl: ctx.apiBaseUrl
         });
         return text(
-          `Recovery complete for ${res.billingDomain}.
+          `Recovery complete.
 Site: ${res.siteId} (hostnames: ${res.boundHostnames.join(", ") || "(none)"})
 Previous credentials revoked: ${res.revokedPreviousCredentials ? "YES" : "no (preserved on request)"}
 
@@ -1629,39 +1653,32 @@ ${res.archiveUrl}`
   server.registerTool(
     "set_billing_plan",
     {
-      description: `Change the hosting plan of the apex billing domain or cancel/re-enable renewal. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. The API returns the billing consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
+      description: `Change this site's hosting plan, cancel/re-enable renewal, or cancel immediately. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; cancelNow: true ends it IMMEDIATELY \u2014 the site reverts to a free 24h site at once and all paid data (custom domain bindings included) is removed, with no refund of the current period. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
       inputSchema: {
-        domain: z.string().optional().describe("Apex billing domain; defaults to the domain bound in .sakupa/site.json."),
         plan: planEnum.optional().describe("Target monthly plan."),
         cancelRenewal: z.boolean().optional().describe(
-          "true: cancel renewal (hosting runs to the end of the paid month, then stops). false: re-enable renewal."
+          "true: cancel renewal (the site stays permanent to the end of the paid month, then reverts to free). false: re-enable renewal."
         ),
+        cancelNow: z.boolean().optional().describe("End the subscription immediately; the site reverts to free right away."),
         confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
       }
     },
     async (args) => {
       try {
         const site = requireSiteFile(ctx);
-        const domain = args.domain ?? site.billingDomain;
-        if (!domain) {
-          throw new SakupaError(
-            "invalid_request",
-            "No domain given and this project has no bound billing domain. Pass domain explicitly."
-          );
-        }
         const req = {
-          siteId: site.siteId,
-          ...args.plan !== void 0 ? { committedTier: args.plan } : {},
+          ...args.plan !== void 0 ? { plan: args.plan } : {},
           ...args.cancelRenewal !== void 0 ? { cancelRenewal: args.cancelRenewal } : {},
+          ...args.cancelNow !== void 0 ? { cancelNow: args.cancelNow } : {},
           confirm: args.confirm === true
         };
         try {
-          const res = await ctx.client.setBillingPlan(domain, site.credential, req);
+          const res = await ctx.client.setBillingPlan(site.siteId, site.credential, req);
           return textJson(
-            `Billing plan updated for ${res.apexDomain}.
+            `Billing updated for site ${res.siteId} (mode: ${res.mode}).
 Consequences:
 ${res.consequences.map((c) => `- ${c}`).join("\n")}
-Applied plan:`,
+Result:`,
             res
           );
         } catch (e) {
@@ -1681,50 +1698,6 @@ ${e.message}
       }
     }
   );
-  server.registerTool(
-    "downgrade_to_free",
-    {
-      description: "Move this paid custom-domain site back to free temporary mode. Takes effect at the next billing period boundary by default; immediateStopServing stops custom-domain serving now but never erases the already-paid month. Remember to also cancel the domain subscription (set_billing_plan cancelRenewal: true or manage_billing) if no other site uses it. The API returns the consequences first; confirm: true is required to apply.",
-      inputSchema: {
-        immediateStopServing: z.boolean().optional().describe(
-          "Also stop custom-domain serving immediately (does not remove current-cycle charges)."
-        ),
-        confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
-      }
-    },
-    async (args) => {
-      try {
-        const site = requireSiteFile(ctx);
-        try {
-          const res = await ctx.client.downgradeSite(site.siteId, site.credential, {
-            ...args.immediateStopServing !== void 0 ? { immediateStopServing: args.immediateStopServing } : {},
-            confirm: args.confirm === true
-          });
-          return text(
-            `Downgrade scheduled for site ${res.siteId}.
-Effective at: ${res.effectiveAt}
-Immediate stop-serving applied: ${res.immediateStopApplied ? "yes" : "no"}
-${res.message}
-
-After it takes effect the site becomes a free temporary site again (24h validity, free banner, free limits). If no other site uses this domain, also cancel its hosting subscription (set_billing_plan cancelRenewal: true or manage_billing).`
-          );
-        } catch (e) {
-          if (isSakupaError(e) && e.code === "confirmation_required") {
-            return text(
-              `Confirmation required before downgrading \u2014 nothing was applied.
-
-${e.message}
-` + (e.details !== void 0 ? `${JSON.stringify(e.details, null, 2)}
-` : "") + "\nPlease show these consequences to the user and, after their explicit confirmation, re-run downgrade_to_free with confirm: true."
-            );
-          }
-          throw e;
-        }
-      } catch (e) {
-        return toolError(e);
-      }
-    }
-  );
   server.registerTool(
     "create_support_ticket",
     {
@@ -1755,7 +1728,7 @@ ${e.message}
   server.registerTool(
     "report_bug",
     {
-      description: "Prepare and submit a sanitized bug report when a Sakupa tool failed and the issue looks like a product bug. Only whitelisted structured diagnostics are sent (tool name, error code/message, site id, billing domain, deployment id, timestamps, client/MCP version, request id) \u2014 NEVER file contents, source code, secrets, .env values or credentials. Without confirmSubmit: true the exact payload is shown for user review and nothing is submitted.",
+      description: "Prepare and submit a sanitized bug report when a Sakupa tool failed and the issue looks like a product bug. Only whitelisted structured diagnostics are sent (tool name, error code/message, site id, bound domain, deployment id, timestamps, client/MCP version, request id) \u2014 NEVER file contents, source code, secrets, .env values or credentials. Without confirmSubmit: true the exact payload is shown for user review and nothing is submitted.",
       inputSchema: {
         toolName: z.string().describe('The Sakupa tool that failed, e.g. "deploy_site".'),
         errorCode: z.string().optional(),
@@ -1775,7 +1748,7 @@ ${e.message}
           ...args.errorCode !== void 0 ? { errorCode: args.errorCode } : {},
           ...args.errorMessage !== void 0 ? { sanitizedErrorMessage: args.errorMessage } : {},
           ...site ? { siteId: site.siteId } : {},
-          ...site?.billingDomain ? { billingDomain: site.billingDomain } : {},
+          ...site?.boundDomain ? { boundDomain: site.boundDomain } : {},
           ...args.deploymentId !== void 0 ? { deploymentId: args.deploymentId } : {},
           occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
           clientType: CLIENT_TYPE,
@@ -1818,19 +1791,23 @@ Workflow:
    site (public URL {shortId}.sakupa.com, valid 24 hours, free banner shown) and stores the
    management credential in .sakupa/site.json. Deploying again updates the site and refreshes
    its validity; refresh_site extends validity without uploading.
-3. For long-term use, subscribe the apex domain to a monthly hosting plan (subscribe_domain ->
+3. To make the site PERMANENT, subscribe it to a monthly hosting plan (subscribe_site ->
    Stripe-hosted checkout; water/personal/share/business, auto-upgrade when the site outgrows
-   its plan), then bind the custom domain (bind_domain): the billing subject is always the
-   registered apex domain and ownership is proven only by DNS control. billing_status,
-   set_billing_plan, manage_billing, downgrade_to_free and recover_domain_site manage the
-   paid lifecycle.
+   its plan). Paying makes the {shortId}.sakupa.com URL permanent \u2014 that is what payment buys.
+4. Optionally bind a custom domain to the subscribed site (bind_domain): an included extra
+   serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
+   first verified request wins; unverified requests expire after 72 hours. billing_status,
+   set_billing_plan, manage_billing and recover_domain_site manage the paid lifecycle.
+   Canceling the subscription immediately reverts the site to a free 24h site and removes all
+   paid data.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
 - Never upload source projects, secrets, .env files, private keys, archives, videos or audio.
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
-- A subscription is payment state only; it never grants domain ownership or management rights.
-- The management credential lives only in .sakupa/site.json; never share or upload it.`;
+- A subscription never grants domain ownership; only DNS verification does.
+- The management credential lives only in .sakupa/site.json; never share or upload it. Without
+  a bound custom domain, a lost credential is unrecoverable by design.`;
 function createSakupaMcpServer(opts) {
   const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
   const server = new McpServer(