@sakupa/mcp 0.3.0 → 0.5.0

package/dist/bin.js

@@ -126,6 +126,9 @@ var FORBIDDEN_PATH_SEGMENTS = [
 ];
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
+// ../core/dist/domain/version.js
+var SAKUPA_MCP_VERSION = "0.5.0";
+
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
   invalid_request: 400,
@@ -461,6 +464,12 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
 var utf8Encoder = new TextEncoder();
 
+// ../core/dist/services/subscriptions.js
+var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
+
+// ../core/dist/services/billing-cancellation.js
+var encoder = new TextEncoder();
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -609,6 +618,13 @@ var HttpApiClient = class {
       { credential, body: req }
     );
   }
+  async requestBillingCancellation(req) {
+    return this.call(
+      "POST",
+      "/v1/billing/cancellation-requests",
+      { body: req }
+    );
+  }
   async createTicket(credential, req) {
     return this.call("POST", "/v1/support/tickets", {
       credential,
@@ -1057,7 +1073,7 @@ async function analyzeProject(projectDir, opts = {}) {
 
 // src/project-file.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { dirname, join as join2 } from "node:path";
 var SITE_DIR = ".sakupa";
 var SITE_FILE = "site.json";
 function siteFilePath(projectDir) {
@@ -1100,9 +1116,22 @@ function writeSiteFile(projectDir, file) {
   } catch {
   }
 }
+function isInsideGitRepo(projectDir) {
+  let dir = projectDir;
+  for (; ; ) {
+    if (existsSync(join2(dir, ".git"))) return true;
+    const parent = dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function credentialGitReminder(projectDir) {
+  if (!isInsideGitRepo(projectDir)) return "";
+  return '\nNOTE: this project is inside a git repository. The management credential in .sakupa/site.json is the key to this site \u2014 do NOT commit it to a PUBLIC repository (add ".sakupa/" to .gitignore yourself if you want to keep it out of version control).';
+}
 
 // src/version.ts
-var MCP_VERSION = "0.3.0";
+var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
 
 // src/tools/context.ts
@@ -1270,6 +1299,9 @@ Next action: ${analysis.suggestedNextAction}`,
         outputDir: z.string().optional().describe("Output directory relative to the project root (overrides detection)."),
         spaFallback: z.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
         spaFallbackConfirmed: z.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        publicConfirmed: z.boolean().optional().describe(
+          "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
+        ),
         lang: z.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
       }
     },
@@ -1290,6 +1322,11 @@ Next action: ${analysis.suggestedNextAction}`,
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
         const existing = readSiteFile(ctx.projectDir);
+        if (!existing && args.publicConfirmed !== true) {
+          return text(
+            `First deployment creates a public URL that anyone with the link can open. The free preview stays live for ${FREE_SITE_TTL_HOURS} hours. Explain this to the user and obtain explicit confirmation before retrying deploy_site with publicConfirmed: true.`
+          );
+        }
         ensureUploadSizeWithinLimits(manifest, !existing);
         if (!existing) {
           const created = await ctx.client.createSite({
@@ -1318,7 +1355,7 @@ Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
 ` : "") + `
 This is a FREE temporary preview: it stays live for ${FREE_SITE_TTL_HOURS} hours. Deploying again or calling refresh_site extends the validity; subscribing the site (subscribe_site) makes this URL permanent. The management credential was saved to .sakupa/site.json \u2014 keep that file: it is the only way to manage this site.
-` + (finalized2.warnings.length > 0 ? `
+` + credentialGitReminder(ctx.projectDir) + (finalized2.warnings.length > 0 ? `
 Warnings:
 ${JSON.stringify(finalized2.warnings, null, 2)}` : "")
           );
@@ -1449,9 +1486,11 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind_domain",
     {
-      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the registered apex domain \u2014 payment never grants ownership. A binding request never reserves the hostname: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
+      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
       inputSchema: {
-        hostname: z.string().describe('Hostname to bind, e.g. "example.com" or "www.example.com".'),
+        hostname: z.string().describe(
+          'Domain to bind: the apex ("example.com") or its www form ("www.example.com") \u2014 both mean the same unit. Other subdomains cannot be bound.'
+        ),
         verificationId: z.string().optional().describe("Check an existing DNS verification instead of starting a new one.")
       }
     },
@@ -1466,7 +1505,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
           return text(
             `DNS verification ${res2.verificationId}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificate and serving setup are in progress; check again with bind_domain + verificationId later.
+` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
 ` : "") + (res2.pendingDnsRecords.length > 0 ? `
 DNS records still required:
 ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
@@ -1477,18 +1516,16 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
-        const servingHint = res.isApex ? `"${res.hostname}" is an apex domain: your DNS provider must support ALIAS, ANAME, CNAME flattening, or alias records to point it at the assigned CDN domain.` : `"${res.hostname}" is a subdomain: create a CNAME record pointing it at the assigned CDN domain once provisioning completes.`;
         return text(
-          `Domain binding started for ${res.hostname}.
+          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
 
 1. Prove control of ${res.apexDomain} by creating this DNS record:
    name:  ${res.verificationRecord.name}
    type:  ${res.verificationRecord.type}
    value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the hostname \u2014 the first verified request wins, and this challenge expires after 72 hours.
+   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
 
-2. Serving DNS (after verification): ${servingHint}
-   Server guidance: ${res.servingInstructions}
+2. Serving DNS (after verification): ${res.servingInstructions}
 
 Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`
         );
@@ -1530,18 +1567,40 @@ Full status:`, res);
   server.registerTool(
     "manage_billing",
     {
-      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json).",
-      inputSchema: {}
+      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. With .sakupa/site.json, this opens the site-specific portal. If the local credential was lost, pass the remembered Sakupa site URL: Sakupa returns the same generic response for every URL and, only when an eligible subscription exists, emails its Stripe billing address a one-time period-end cancellation confirmation link. This never restores site authority.",
+      inputSchema: {
+        siteUrl: z.string().optional().describe(
+          "Without .sakupa/site.json only: the remembered https://{shortId}.sakupa.com URL."
+        )
+      }
     },
-    async () => {
+    async (args) => {
       try {
-        const site = requireSiteFile(ctx);
-        const res = await ctx.client.createBillingPortal(site.siteId, site.credential);
-        return text(
-          `Stripe billing portal for this site:
-${res.portalUrl}
+        const site = readSiteFile(ctx.projectDir);
+        if (site) {
+          if (args.siteUrl !== void 0) {
+            return text(
+              "A local Sakupa credential is present, so manage_billing uses the site-specific Stripe portal. Remove siteUrl and call manage_billing again; the public lost-key path is deliberately unavailable while site authority is present."
+            );
+          }
+          const res2 = await ctx.client.createBillingPortal(site.siteId, site.credential);
+          return text(
+            `Stripe billing portal for this site:
+${res2.portalUrl}
 
 Open this link in a browser to update the payment method, view invoices, or manage the subscription. The link is temporary \u2014 create a fresh one when needed.`
+          );
+        }
+        if (args.siteUrl === void 0) {
+          return text(
+            "No .sakupa/site.json was found. Provide the remembered Sakupa site URL to request a cancellation email. Sakupa will not reveal whether the URL, site, billing email, or subscription exists. If eligible, the original Stripe billing email receives a short-lived one-time link. Opening it only shows the consequences; the user must press the confirmation button to stop the next renewal. This does not recover a key or grant deployment, download, or content access."
+          );
+        }
+        const res = await ctx.client.requestBillingCancellation({ siteUrl: args.siteUrl });
+        return text(
+          `${res.message}
+
+For privacy, this response is identical whether or not the URL, site, customer, email, or subscription exists. Check the original Stripe billing inbox. The email link expires quickly and can only schedule cancellation at the current paid period end; it cannot restore the Sakupa credential or access the site.`
         );
       } catch (e) {
         return toolError(e);
@@ -1593,7 +1652,7 @@ Site: ${res.siteId} (hostnames: ${res.boundHostnames.join(", ") || "(none)"})
 Previous credentials revoked: ${res.revokedPreviousCredentials ? "YES" : "no (preserved on request)"}
 
 A NEW management credential was written to .sakupa/site.json in this project \u2014 this project now manages the site.
-
+` + credentialGitReminder(ctx.projectDir) + `
 Download the current site content (signed URL):
 ${res.archiveUrl}`
         );
@@ -1605,13 +1664,12 @@ ${res.archiveUrl}`
   server.registerTool(
     "set_billing_plan",
     {
-      description: `Change this site's hosting plan, cancel/re-enable renewal, or cancel immediately. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; cancelNow: true ends it IMMEDIATELY \u2014 the site reverts to a free 24h site at once and all paid data (custom domain bindings included) is removed, with no refund of the current period. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
+      description: `Change this site's hosting plan or cancel/re-enable renewal. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; the paid service remains available until then. The site reverts to a free 24h site only after the signed Stripe final-cancellation webhook arrives. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
       inputSchema: {
         plan: planEnum.optional().describe("Target monthly plan."),
         cancelRenewal: z.boolean().optional().describe(
           "true: cancel renewal (the site stays permanent to the end of the paid month, then reverts to free). false: re-enable renewal."
         ),
-        cancelNow: z.boolean().optional().describe("End the subscription immediately; the site reverts to free right away."),
         confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
       }
     },
@@ -1621,7 +1679,6 @@ ${res.archiveUrl}`
         const req = {
           ...args.plan !== void 0 ? { plan: args.plan } : {},
           ...args.cancelRenewal !== void 0 ? { cancelRenewal: args.cancelRenewal } : {},
-          ...args.cancelNow !== void 0 ? { cancelNow: args.cancelNow } : {},
           confirm: args.confirm === true
         };
         try {
@@ -1802,8 +1859,8 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    set_billing_plan, manage_billing and recover_domain_site manage the paid lifecycle.
-   Canceling the subscription immediately reverts the site to a free 24h site and removes all
-   paid data.
+   An immediate Stripe cancellation reverts the site to a free 24h site and removes all paid
+   data when Sakupa receives the signed cancellation webhook.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
@@ -1811,7 +1868,9 @@ Safety boundaries:
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
-  a bound custom domain, a lost credential is unrecoverable by design.`;
+  a bound custom domain, a lost credential is unrecoverable by design. manage_billing can accept
+  the remembered Sakupa URL and request a one-time cancellation link sent only to the exact
+  subscription's Stripe billing email; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
   const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
   const server = new McpServer(

package/dist/index.js

@@ -1,7 +1,3 @@
-// src/version.ts
-var MCP_VERSION = "0.3.0";
-var CLIENT_TYPE = "sakupa-mcp";
-
 // ../core/dist/domain/constants.js
 var SERVICE_DOMAIN = "sakupa.com";
 var FREE_SITE_URL_SUFFIX = `.${SERVICE_DOMAIN}`;
@@ -124,6 +120,9 @@ var FORBIDDEN_PATH_SEGMENTS = [
 ];
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
+// ../core/dist/domain/version.js
+var SAKUPA_MCP_VERSION = "0.5.0";
+
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
   invalid_request: 400,
@@ -459,6 +458,16 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
 var utf8Encoder = new TextEncoder();
 
+// ../core/dist/services/subscriptions.js
+var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
+
+// ../core/dist/services/billing-cancellation.js
+var encoder = new TextEncoder();
+
+// src/version.ts
+var MCP_VERSION = SAKUPA_MCP_VERSION;
+var CLIENT_TYPE = "sakupa-mcp";
+
 // src/transport.ts
 var FetchTransport = class {
   baseUrl;
@@ -657,6 +666,13 @@ var HttpApiClient = class {
       { credential, body: req }
     );
   }
+  async requestBillingCancellation(req) {
+    return this.call(
+      "POST",
+      "/v1/billing/cancellation-requests",
+      { body: req }
+    );
+  }
   async createTicket(credential, req) {
     return this.call("POST", "/v1/support/tickets", {
       credential,
@@ -673,7 +689,7 @@ var HttpApiClient = class {
 
 // src/project-file.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 var SITE_DIR = ".sakupa";
 var SITE_FILE = "site.json";
 function siteFilePath(projectDir) {
@@ -722,6 +738,19 @@ function deleteSiteFile(projectDir) {
     rmSync(path, { force: true });
   }
 }
+function isInsideGitRepo(projectDir) {
+  let dir = projectDir;
+  for (; ; ) {
+    if (existsSync(join(dir, ".git"))) return true;
+    const parent = dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function credentialGitReminder(projectDir) {
+  if (!isInsideGitRepo(projectDir)) return "";
+  return '\nNOTE: this project is inside a git repository. The management credential in .sakupa/site.json is the key to this site \u2014 do NOT commit it to a PUBLIC repository (add ".sakupa/" to .gitignore yourself if you want to keep it out of version control).';
+}
 
 // src/analyze/analyzer.ts
 import { promises as fs } from "node:fs";
@@ -1318,6 +1347,9 @@ Next action: ${analysis.suggestedNextAction}`,
         outputDir: z.string().optional().describe("Output directory relative to the project root (overrides detection)."),
         spaFallback: z.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
         spaFallbackConfirmed: z.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        publicConfirmed: z.boolean().optional().describe(
+          "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
+        ),
         lang: z.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
       }
     },
@@ -1338,6 +1370,11 @@ Next action: ${analysis.suggestedNextAction}`,
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
         const existing = readSiteFile(ctx.projectDir);
+        if (!existing && args.publicConfirmed !== true) {
+          return text(
+            `First deployment creates a public URL that anyone with the link can open. The free preview stays live for ${FREE_SITE_TTL_HOURS} hours. Explain this to the user and obtain explicit confirmation before retrying deploy_site with publicConfirmed: true.`
+          );
+        }
         ensureUploadSizeWithinLimits(manifest, !existing);
         if (!existing) {
           const created = await ctx.client.createSite({
@@ -1366,7 +1403,7 @@ Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
 ` : "") + `
 This is a FREE temporary preview: it stays live for ${FREE_SITE_TTL_HOURS} hours. Deploying again or calling refresh_site extends the validity; subscribing the site (subscribe_site) makes this URL permanent. The management credential was saved to .sakupa/site.json \u2014 keep that file: it is the only way to manage this site.
-` + (finalized2.warnings.length > 0 ? `
+` + credentialGitReminder(ctx.projectDir) + (finalized2.warnings.length > 0 ? `
 Warnings:
 ${JSON.stringify(finalized2.warnings, null, 2)}` : "")
           );
@@ -1497,9 +1534,11 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind_domain",
     {
-      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the registered apex domain \u2014 payment never grants ownership. A binding request never reserves the hostname: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
+      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
       inputSchema: {
-        hostname: z.string().describe('Hostname to bind, e.g. "example.com" or "www.example.com".'),
+        hostname: z.string().describe(
+          'Domain to bind: the apex ("example.com") or its www form ("www.example.com") \u2014 both mean the same unit. Other subdomains cannot be bound.'
+        ),
         verificationId: z.string().optional().describe("Check an existing DNS verification instead of starting a new one.")
       }
     },
@@ -1514,7 +1553,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
           return text(
             `DNS verification ${res2.verificationId}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificate and serving setup are in progress; check again with bind_domain + verificationId later.
+` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
 ` : "") + (res2.pendingDnsRecords.length > 0 ? `
 DNS records still required:
 ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
@@ -1525,18 +1564,16 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : "")
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
-        const servingHint = res.isApex ? `"${res.hostname}" is an apex domain: your DNS provider must support ALIAS, ANAME, CNAME flattening, or alias records to point it at the assigned CDN domain.` : `"${res.hostname}" is a subdomain: create a CNAME record pointing it at the assigned CDN domain once provisioning completes.`;
         return text(
-          `Domain binding started for ${res.hostname}.
+          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
 
 1. Prove control of ${res.apexDomain} by creating this DNS record:
    name:  ${res.verificationRecord.name}
    type:  ${res.verificationRecord.type}
    value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the hostname \u2014 the first verified request wins, and this challenge expires after 72 hours.
+   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
 
-2. Serving DNS (after verification): ${servingHint}
-   Server guidance: ${res.servingInstructions}
+2. Serving DNS (after verification): ${res.servingInstructions}
 
 Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`
         );
@@ -1578,18 +1615,40 @@ Full status:`, res);
   server.registerTool(
     "manage_billing",
     {
-      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json).",
-      inputSchema: {}
+      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. With .sakupa/site.json, this opens the site-specific portal. If the local credential was lost, pass the remembered Sakupa site URL: Sakupa returns the same generic response for every URL and, only when an eligible subscription exists, emails its Stripe billing address a one-time period-end cancellation confirmation link. This never restores site authority.",
+      inputSchema: {
+        siteUrl: z.string().optional().describe(
+          "Without .sakupa/site.json only: the remembered https://{shortId}.sakupa.com URL."
+        )
+      }
     },
-    async () => {
+    async (args) => {
       try {
-        const site = requireSiteFile(ctx);
-        const res = await ctx.client.createBillingPortal(site.siteId, site.credential);
-        return text(
-          `Stripe billing portal for this site:
-${res.portalUrl}
+        const site = readSiteFile(ctx.projectDir);
+        if (site) {
+          if (args.siteUrl !== void 0) {
+            return text(
+              "A local Sakupa credential is present, so manage_billing uses the site-specific Stripe portal. Remove siteUrl and call manage_billing again; the public lost-key path is deliberately unavailable while site authority is present."
+            );
+          }
+          const res2 = await ctx.client.createBillingPortal(site.siteId, site.credential);
+          return text(
+            `Stripe billing portal for this site:
+${res2.portalUrl}
 
 Open this link in a browser to update the payment method, view invoices, or manage the subscription. The link is temporary \u2014 create a fresh one when needed.`
+          );
+        }
+        if (args.siteUrl === void 0) {
+          return text(
+            "No .sakupa/site.json was found. Provide the remembered Sakupa site URL to request a cancellation email. Sakupa will not reveal whether the URL, site, billing email, or subscription exists. If eligible, the original Stripe billing email receives a short-lived one-time link. Opening it only shows the consequences; the user must press the confirmation button to stop the next renewal. This does not recover a key or grant deployment, download, or content access."
+          );
+        }
+        const res = await ctx.client.requestBillingCancellation({ siteUrl: args.siteUrl });
+        return text(
+          `${res.message}
+
+For privacy, this response is identical whether or not the URL, site, customer, email, or subscription exists. Check the original Stripe billing inbox. The email link expires quickly and can only schedule cancellation at the current paid period end; it cannot restore the Sakupa credential or access the site.`
         );
       } catch (e) {
         return toolError(e);
@@ -1641,7 +1700,7 @@ Site: ${res.siteId} (hostnames: ${res.boundHostnames.join(", ") || "(none)"})
 Previous credentials revoked: ${res.revokedPreviousCredentials ? "YES" : "no (preserved on request)"}
 
 A NEW management credential was written to .sakupa/site.json in this project \u2014 this project now manages the site.
-
+` + credentialGitReminder(ctx.projectDir) + `
 Download the current site content (signed URL):
 ${res.archiveUrl}`
         );
@@ -1653,13 +1712,12 @@ ${res.archiveUrl}`
   server.registerTool(
     "set_billing_plan",
     {
-      description: `Change this site's hosting plan, cancel/re-enable renewal, or cancel immediately. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; cancelNow: true ends it IMMEDIATELY \u2014 the site reverts to a free 24h site at once and all paid data (custom domain bindings included) is removed, with no refund of the current period. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
+      description: `Change this site's hosting plan or cancel/re-enable renewal. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; the paid service remains available until then. The site reverts to a free 24h site only after the signed Stripe final-cancellation webhook arrives. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
       inputSchema: {
         plan: planEnum.optional().describe("Target monthly plan."),
         cancelRenewal: z.boolean().optional().describe(
           "true: cancel renewal (the site stays permanent to the end of the paid month, then reverts to free). false: re-enable renewal."
         ),
-        cancelNow: z.boolean().optional().describe("End the subscription immediately; the site reverts to free right away."),
         confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
       }
     },
@@ -1669,7 +1727,6 @@ ${res.archiveUrl}`
         const req = {
           ...args.plan !== void 0 ? { plan: args.plan } : {},
           ...args.cancelRenewal !== void 0 ? { cancelRenewal: args.cancelRenewal } : {},
-          ...args.cancelNow !== void 0 ? { cancelNow: args.cancelNow } : {},
           confirm: args.confirm === true
         };
         try {
@@ -1798,8 +1855,8 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    set_billing_plan, manage_billing and recover_domain_site manage the paid lifecycle.
-   Canceling the subscription immediately reverts the site to a free 24h site and removes all
-   paid data.
+   An immediate Stripe cancellation reverts the site to a free 24h site and removes all paid
+   data when Sakupa receives the signed cancellation webhook.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
@@ -1807,7 +1864,9 @@ Safety boundaries:
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
-  a bound custom domain, a lost credential is unrecoverable by design.`;
+  a bound custom domain, a lost credential is unrecoverable by design. manage_billing can accept
+  the remembered Sakupa URL and request a one-time cancellation link sent only to the exact
+  subscription's Stripe billing email; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
   const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
   const server = new McpServer(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",