@sakupa/mcp 0.4.0 → 0.5.0

package/dist/bin.js

@@ -126,6 +126,9 @@ var FORBIDDEN_PATH_SEGMENTS = [
 ];
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
+// ../core/dist/domain/version.js
+var SAKUPA_MCP_VERSION = "0.5.0";
+
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
   invalid_request: 400,
@@ -461,6 +464,12 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
 var utf8Encoder = new TextEncoder();
 
+// ../core/dist/services/subscriptions.js
+var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
+
+// ../core/dist/services/billing-cancellation.js
+var encoder = new TextEncoder();
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -609,6 +618,13 @@ var HttpApiClient = class {
       { credential, body: req }
     );
   }
+  async requestBillingCancellation(req) {
+    return this.call(
+      "POST",
+      "/v1/billing/cancellation-requests",
+      { body: req }
+    );
+  }
   async createTicket(credential, req) {
     return this.call("POST", "/v1/support/tickets", {
       credential,
@@ -1115,7 +1131,7 @@ function credentialGitReminder(projectDir) {
 }
 
 // src/version.ts
-var MCP_VERSION = "0.4.0";
+var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
 
 // src/tools/context.ts
@@ -1283,6 +1299,9 @@ Next action: ${analysis.suggestedNextAction}`,
         outputDir: z.string().optional().describe("Output directory relative to the project root (overrides detection)."),
         spaFallback: z.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
         spaFallbackConfirmed: z.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        publicConfirmed: z.boolean().optional().describe(
+          "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
+        ),
         lang: z.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
       }
     },
@@ -1303,6 +1322,11 @@ Next action: ${analysis.suggestedNextAction}`,
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
         const existing = readSiteFile(ctx.projectDir);
+        if (!existing && args.publicConfirmed !== true) {
+          return text(
+            `First deployment creates a public URL that anyone with the link can open. The free preview stays live for ${FREE_SITE_TTL_HOURS} hours. Explain this to the user and obtain explicit confirmation before retrying deploy_site with publicConfirmed: true.`
+          );
+        }
         ensureUploadSizeWithinLimits(manifest, !existing);
         if (!existing) {
           const created = await ctx.client.createSite({
@@ -1543,18 +1567,40 @@ Full status:`, res);
   server.registerTool(
     "manage_billing",
     {
-      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json).",
-      inputSchema: {}
+      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. With .sakupa/site.json, this opens the site-specific portal. If the local credential was lost, pass the remembered Sakupa site URL: Sakupa returns the same generic response for every URL and, only when an eligible subscription exists, emails its Stripe billing address a one-time period-end cancellation confirmation link. This never restores site authority.",
+      inputSchema: {
+        siteUrl: z.string().optional().describe(
+          "Without .sakupa/site.json only: the remembered https://{shortId}.sakupa.com URL."
+        )
+      }
     },
-    async () => {
+    async (args) => {
       try {
-        const site = requireSiteFile(ctx);
-        const res = await ctx.client.createBillingPortal(site.siteId, site.credential);
-        return text(
-          `Stripe billing portal for this site:
-${res.portalUrl}
+        const site = readSiteFile(ctx.projectDir);
+        if (site) {
+          if (args.siteUrl !== void 0) {
+            return text(
+              "A local Sakupa credential is present, so manage_billing uses the site-specific Stripe portal. Remove siteUrl and call manage_billing again; the public lost-key path is deliberately unavailable while site authority is present."
+            );
+          }
+          const res2 = await ctx.client.createBillingPortal(site.siteId, site.credential);
+          return text(
+            `Stripe billing portal for this site:
+${res2.portalUrl}
 
 Open this link in a browser to update the payment method, view invoices, or manage the subscription. The link is temporary \u2014 create a fresh one when needed.`
+          );
+        }
+        if (args.siteUrl === void 0) {
+          return text(
+            "No .sakupa/site.json was found. Provide the remembered Sakupa site URL to request a cancellation email. Sakupa will not reveal whether the URL, site, billing email, or subscription exists. If eligible, the original Stripe billing email receives a short-lived one-time link. Opening it only shows the consequences; the user must press the confirmation button to stop the next renewal. This does not recover a key or grant deployment, download, or content access."
+          );
+        }
+        const res = await ctx.client.requestBillingCancellation({ siteUrl: args.siteUrl });
+        return text(
+          `${res.message}
+
+For privacy, this response is identical whether or not the URL, site, customer, email, or subscription exists. Check the original Stripe billing inbox. The email link expires quickly and can only schedule cancellation at the current paid period end; it cannot restore the Sakupa credential or access the site.`
         );
       } catch (e) {
         return toolError(e);
@@ -1618,13 +1664,12 @@ ${res.archiveUrl}`
   server.registerTool(
     "set_billing_plan",
     {
-      description: `Change this site's hosting plan, cancel/re-enable renewal, or cancel immediately. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; cancelNow: true ends it IMMEDIATELY \u2014 the site reverts to a free 24h site at once and all paid data (custom domain bindings included) is removed, with no refund of the current period. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
+      description: `Change this site's hosting plan or cancel/re-enable renewal. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; the paid service remains available until then. The site reverts to a free 24h site only after the signed Stripe final-cancellation webhook arrives. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
       inputSchema: {
         plan: planEnum.optional().describe("Target monthly plan."),
         cancelRenewal: z.boolean().optional().describe(
           "true: cancel renewal (the site stays permanent to the end of the paid month, then reverts to free). false: re-enable renewal."
         ),
-        cancelNow: z.boolean().optional().describe("End the subscription immediately; the site reverts to free right away."),
         confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
       }
     },
@@ -1634,7 +1679,6 @@ ${res.archiveUrl}`
         const req = {
           ...args.plan !== void 0 ? { plan: args.plan } : {},
           ...args.cancelRenewal !== void 0 ? { cancelRenewal: args.cancelRenewal } : {},
-          ...args.cancelNow !== void 0 ? { cancelNow: args.cancelNow } : {},
           confirm: args.confirm === true
         };
         try {
@@ -1815,8 +1859,8 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    set_billing_plan, manage_billing and recover_domain_site manage the paid lifecycle.
-   Canceling the subscription immediately reverts the site to a free 24h site and removes all
-   paid data.
+   An immediate Stripe cancellation reverts the site to a free 24h site and removes all paid
+   data when Sakupa receives the signed cancellation webhook.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
@@ -1824,7 +1868,9 @@ Safety boundaries:
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
-  a bound custom domain, a lost credential is unrecoverable by design.`;
+  a bound custom domain, a lost credential is unrecoverable by design. manage_billing can accept
+  the remembered Sakupa URL and request a one-time cancellation link sent only to the exact
+  subscription's Stripe billing email; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
   const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
   const server = new McpServer(

package/dist/index.js

@@ -1,7 +1,3 @@
-// src/version.ts
-var MCP_VERSION = "0.4.0";
-var CLIENT_TYPE = "sakupa-mcp";
-
 // ../core/dist/domain/constants.js
 var SERVICE_DOMAIN = "sakupa.com";
 var FREE_SITE_URL_SUFFIX = `.${SERVICE_DOMAIN}`;
@@ -124,6 +120,9 @@ var FORBIDDEN_PATH_SEGMENTS = [
 ];
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
+// ../core/dist/domain/version.js
+var SAKUPA_MCP_VERSION = "0.5.0";
+
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
   invalid_request: 400,
@@ -459,6 +458,16 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
 var utf8Encoder = new TextEncoder();
 
+// ../core/dist/services/subscriptions.js
+var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
+
+// ../core/dist/services/billing-cancellation.js
+var encoder = new TextEncoder();
+
+// src/version.ts
+var MCP_VERSION = SAKUPA_MCP_VERSION;
+var CLIENT_TYPE = "sakupa-mcp";
+
 // src/transport.ts
 var FetchTransport = class {
   baseUrl;
@@ -657,6 +666,13 @@ var HttpApiClient = class {
       { credential, body: req }
     );
   }
+  async requestBillingCancellation(req) {
+    return this.call(
+      "POST",
+      "/v1/billing/cancellation-requests",
+      { body: req }
+    );
+  }
   async createTicket(credential, req) {
     return this.call("POST", "/v1/support/tickets", {
       credential,
@@ -1331,6 +1347,9 @@ Next action: ${analysis.suggestedNextAction}`,
         outputDir: z.string().optional().describe("Output directory relative to the project root (overrides detection)."),
         spaFallback: z.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
         spaFallbackConfirmed: z.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        publicConfirmed: z.boolean().optional().describe(
+          "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
+        ),
         lang: z.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
       }
     },
@@ -1351,6 +1370,11 @@ Next action: ${analysis.suggestedNextAction}`,
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
         const existing = readSiteFile(ctx.projectDir);
+        if (!existing && args.publicConfirmed !== true) {
+          return text(
+            `First deployment creates a public URL that anyone with the link can open. The free preview stays live for ${FREE_SITE_TTL_HOURS} hours. Explain this to the user and obtain explicit confirmation before retrying deploy_site with publicConfirmed: true.`
+          );
+        }
         ensureUploadSizeWithinLimits(manifest, !existing);
         if (!existing) {
           const created = await ctx.client.createSite({
@@ -1591,18 +1615,40 @@ Full status:`, res);
   server.registerTool(
     "manage_billing",
     {
-      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. Requires the local site credential (.sakupa/site.json).",
-      inputSchema: {}
+      description: "Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page \u2014 never inside the AI tool. With .sakupa/site.json, this opens the site-specific portal. If the local credential was lost, pass the remembered Sakupa site URL: Sakupa returns the same generic response for every URL and, only when an eligible subscription exists, emails its Stripe billing address a one-time period-end cancellation confirmation link. This never restores site authority.",
+      inputSchema: {
+        siteUrl: z.string().optional().describe(
+          "Without .sakupa/site.json only: the remembered https://{shortId}.sakupa.com URL."
+        )
+      }
     },
-    async () => {
+    async (args) => {
       try {
-        const site = requireSiteFile(ctx);
-        const res = await ctx.client.createBillingPortal(site.siteId, site.credential);
-        return text(
-          `Stripe billing portal for this site:
-${res.portalUrl}
+        const site = readSiteFile(ctx.projectDir);
+        if (site) {
+          if (args.siteUrl !== void 0) {
+            return text(
+              "A local Sakupa credential is present, so manage_billing uses the site-specific Stripe portal. Remove siteUrl and call manage_billing again; the public lost-key path is deliberately unavailable while site authority is present."
+            );
+          }
+          const res2 = await ctx.client.createBillingPortal(site.siteId, site.credential);
+          return text(
+            `Stripe billing portal for this site:
+${res2.portalUrl}
 
 Open this link in a browser to update the payment method, view invoices, or manage the subscription. The link is temporary \u2014 create a fresh one when needed.`
+          );
+        }
+        if (args.siteUrl === void 0) {
+          return text(
+            "No .sakupa/site.json was found. Provide the remembered Sakupa site URL to request a cancellation email. Sakupa will not reveal whether the URL, site, billing email, or subscription exists. If eligible, the original Stripe billing email receives a short-lived one-time link. Opening it only shows the consequences; the user must press the confirmation button to stop the next renewal. This does not recover a key or grant deployment, download, or content access."
+          );
+        }
+        const res = await ctx.client.requestBillingCancellation({ siteUrl: args.siteUrl });
+        return text(
+          `${res.message}
+
+For privacy, this response is identical whether or not the URL, site, customer, email, or subscription exists. Check the original Stripe billing inbox. The email link expires quickly and can only schedule cancellation at the current paid period end; it cannot restore the Sakupa credential or access the site.`
         );
       } catch (e) {
         return toolError(e);
@@ -1666,13 +1712,12 @@ ${res.archiveUrl}`
   server.registerTool(
     "set_billing_plan",
     {
-      description: `Change this site's hosting plan, cancel/re-enable renewal, or cancel immediately. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; cancelNow: true ends it IMMEDIATELY \u2014 the site reverts to a free 24h site at once and all paid data (custom domain bindings included) is removed, with no refund of the current period. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
+      description: `Change this site's hosting plan or cancel/re-enable renewal. Plans: ${planCatalog()}. Plan changes go through the Stripe subscription; renewals bill the new plan. Auto-upgrade (one plan up when usage exceeds the current plan, capped at Business) is built in and not configurable. cancelRenewal: true ends the subscription at the period end; the paid service remains available until then. The site reverts to a free 24h site only after the signed Stripe final-cancellation webhook arrives. The API returns the consequences first; explicit owner confirmation (confirm: true) is required before anything is applied.`,
       inputSchema: {
         plan: planEnum.optional().describe("Target monthly plan."),
         cancelRenewal: z.boolean().optional().describe(
           "true: cancel renewal (the site stays permanent to the end of the paid month, then reverts to free). false: re-enable renewal."
         ),
-        cancelNow: z.boolean().optional().describe("End the subscription immediately; the site reverts to free right away."),
         confirm: z.boolean().optional().describe("User saw the consequences and explicitly confirmed.")
       }
     },
@@ -1682,7 +1727,6 @@ ${res.archiveUrl}`
         const req = {
           ...args.plan !== void 0 ? { plan: args.plan } : {},
           ...args.cancelRenewal !== void 0 ? { cancelRenewal: args.cancelRenewal } : {},
-          ...args.cancelNow !== void 0 ? { cancelNow: args.cancelNow } : {},
           confirm: args.confirm === true
         };
         try {
@@ -1811,8 +1855,8 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    set_billing_plan, manage_billing and recover_domain_site manage the paid lifecycle.
-   Canceling the subscription immediately reverts the site to a free 24h site and removes all
-   paid data.
+   An immediate Stripe cancellation reverts the site to a free 24h site and removes all paid
+   data when Sakupa receives the signed cancellation webhook.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
@@ -1820,7 +1864,9 @@ Safety boundaries:
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
-  a bound custom domain, a lost credential is unrecoverable by design.`;
+  a bound custom domain, a lost credential is unrecoverable by design. manage_billing can accept
+  the remembered Sakupa URL and request a one-time cancellation link sent only to the exact
+  subscription's Stripe billing email; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
   const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
   const server = new McpServer(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",