@sakupa/mcp 0.7.18 → 0.7.20

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.18";
+var SAKUPA_MCP_VERSION = "0.7.20";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -455,6 +455,9 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 // ../core/dist/services/subscriptions.js
 var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 
+// ../core/dist/services/lifecycle.js
+var EPHEMERAL_RETENTION_HOURS = 90 * 24;
+
 // src/config.ts
 var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
@@ -1351,8 +1354,8 @@ async function diagnoseBinding(input) {
   const apexResolves = apexAnswers.length > 0;
   const allOk = checks.every((c) => c.state === "ok");
   const checklist = checks.map(renderCheck).join("\n") + `
-  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
-  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  [${apexResolves ? "OK" : "OPTIONAL"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves; this optional extra entrance is available." : `not configured, which is valid and does NOT block binding. If the user explicitly wants the naked domain too, use the first option their DNS provider supports: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) Otherwise leave the apex unconfigured or add a URL redirect from @ to www; never treat this as an error.`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the required www record above is OK; run bind status again in about 5 minutes to re-check the provider and advance activation)." : "starts after verification.");
   return { checks, apexResolves, allOk, checklist, layers };
 }
 var DNS_RETRY_AFTER_SECONDS = 300;
@@ -1373,7 +1376,7 @@ ${diag.checklist}
 
 ${diag.layers}
 
-` + (diag.allOk ? "All records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
+` + (diag.allOk ? "All required records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
 }
 
 // src/version.ts
@@ -2018,7 +2021,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind",
     {
-      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and permanent URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both, and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and permanent URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -2036,7 +2039,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
           const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
-          if (res2.status === "verified") {
+          if (res2.bindingStatus === "active") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
           const apex2 = res2.apexDomain;
@@ -2046,11 +2049,11 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
             ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
             pendingDnsRecords: res2.pendingDnsRecords,
             verificationStatus: res2.status,
-            provisioning: res2.provisioningJobId !== void 0
+            provisioning: res2.bindingStatus === "provisioning"
           });
           const { apexResolves, allOk } = diag;
           return text(
-            res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
+            res2.bindingStatus === "active" ? "domain_binding_active" : res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
             `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
 
@@ -2061,16 +2064,20 @@ ${res2.message}
             {
               verificationId: res2.verificationId,
               status: res2.status,
+              bindingStatus: res2.bindingStatus,
               apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
               servingTarget: res2.servingTarget,
               dnsChecklist: toDnsChecklist(diag.checks),
               apexResolves,
+              apexRequired: false,
+              requiredServingHostname: `www.${apex2}`,
+              optionalApexHostname: apex2,
               retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
               maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "pending_provider" : "waiting_user"
+            res2.bindingStatus === "active" ? "completed" : res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -2088,25 +2095,24 @@ ${res2.message}
 ` : "";
         return text(
           "domain_verification_started",
-          switchNotice + `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
-
-STEP 1 of 2 \u2014 add ALL THREE records NOW:
+          switchNotice + `Domain binding started for ${apex} (routes reserved: ${res.includedHostnames.join(", ")}). Only www.${apex} is required to go live; the naked domain is optional.
 
-  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
-  2) CNAME  host: www   value: ${res.servingTarget}
-  3) APEX   host: @   -> ${res.servingTarget}. Try a plain CNAME at host @ first (most panels accept it); if rejected use ALIAS / ANAME / CNAME-flattening; if the panel has neither, skip it \u2014 www alone works, and a URL redirect from @ to www covers bare-domain visitors.
+This is a STEP-BY-STEP setup \u2014 give the user ONE record at a time so they do not get overwhelmed and give up.
 
-Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
+STEP 1 of 2 \u2014 prove ownership. Add ONE record:
 
-Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+  TXT   host: ${txtShort}   value: ${res.verificationRecord.value}
 
-STEP 2 (after ownership verifies): Sakupa issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too (copy names and values EXACTLY as given). Everything then completes automatically.
+Host is the SHORT form: most panels append the domain automatically (the saved record must NOT show ${apex} twice in one name). Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-Drive the whole flow with bind "status": it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
+When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
             apexDomain: apex,
             includedHostnames: res.includedHostnames,
+            apexRequired: false,
+            requiredServingHostname: `www.${apex}`,
+            optionalApexHostname: apex,
             verificationRecord: res.verificationRecord,
             servingTarget: res.servingTarget,
             ...res.supersedes ? { supersedes: res.supersedes } : {},
@@ -2116,11 +2122,8 @@ Drive the whole flow with bind "status": it live-checks every record and names t
                 shortHost: txtShort,
                 name: res.verificationRecord.name,
                 value: res.verificationRecord.value
-              },
-              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
-              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+              }
             ],
-            servingInstructions: res.servingInstructions,
             retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
             maxAttempts: DNS_MAX_ATTEMPTS
           },
@@ -2530,7 +2533,7 @@ function registerLifecycleTools(server, baseCtx) {
   server.registerTool(
     "delete",
     {
-      description: "Preview or execute deletion of this Sakupa site. Execution requires an exact server-validated confirmation bound to the current site state.",
+      description: "Preview or execute deletion of this Sakupa site. Execution requires an exact server-validated confirmation bound to the current site state. Paid sites must first cancel renewal through portal and return to free mode. For a temporary pause, publish a pause notice as index.html with deploy instead of deleting the site.",
       inputSchema: {
         projectDir: projectDirInput,
         action: z5.enum(["preview", "confirm"]),
@@ -2549,6 +2552,20 @@ function registerLifecycleTools(server, baseCtx) {
           const preview = await ctx.client.previewDeleteSite(site.siteId, site.credential, {
             operationId
           });
+          if (preview.consequences.requiresFreeModeBeforeDelete) {
+            return structuredToolResult({
+              schemaVersion: 1,
+              outcome: "waiting_user",
+              resultCode: "paid_site_must_return_to_free",
+              operationId,
+              summary: "This paid site cannot be deleted yet. Open portal to cancel renewal, then wait until Stripe ends the subscription and Sakupa reports free mode before calling delete again. If the goal is only a temporary pause, edit the site index.html to show a pause notice and call deploy; this keeps the subscription and URL.",
+              data: { preview },
+              nextActions: [
+                { tool: "portal", allowed: true, reasonCode: "cancel_renewal_first" },
+                { tool: "deploy", allowed: true, reasonCode: "temporary_pause_alternative" }
+              ]
+            });
+          }
           return structuredToolResult({
             schemaVersion: 1,
             outcome: "waiting_user",
@@ -2567,6 +2584,12 @@ function registerLifecycleTools(server, baseCtx) {
             'To CONFIRM deletion, first call delete with action:"preview" to get the exact confirmation object bound to the current site state, then call again with action:"confirm", the same operationId, and that confirmation object.'
           );
         }
+        if (args.confirmation.expectedMode === "paid") {
+          throw new LocalGuidanceError(
+            "state_conflict",
+            "A paid site cannot be deleted. Cancel renewal through portal and wait until it returns to free mode. For a temporary pause, publish a pause notice as index.html."
+          );
+        }
         const result = await ctx.client.deleteSite(site.siteId, site.credential, {
           operationId,
           confirmation: args.confirmation

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.18";
+var SAKUPA_MCP_VERSION = "0.7.20";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -450,6 +450,9 @@ var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 // ../core/dist/services/subscriptions.js
 var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 
+// ../core/dist/services/lifecycle.js
+var EPHEMERAL_RETENTION_HOURS = 90 * 24;
+
 // src/version.ts
 var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
@@ -1560,8 +1563,8 @@ async function diagnoseBinding(input) {
   const apexResolves = apexAnswers.length > 0;
   const allOk = checks.every((c) => c.state === "ok");
   const checklist = checks.map(renderCheck).join("\n") + `
-  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
-  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  [${apexResolves ? "OK" : "OPTIONAL"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves; this optional extra entrance is available." : `not configured, which is valid and does NOT block binding. If the user explicitly wants the naked domain too, use the first option their DNS provider supports: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) Otherwise leave the apex unconfigured or add a URL redirect from @ to www; never treat this as an error.`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the required www record above is OK; run bind status again in about 5 minutes to re-check the provider and advance activation)." : "starts after verification.");
   return { checks, apexResolves, allOk, checklist, layers };
 }
 var DNS_RETRY_AFTER_SECONDS = 300;
@@ -1582,7 +1585,7 @@ ${diag.checklist}
 
 ${diag.layers}
 
-` + (diag.allOk ? "All records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
+` + (diag.allOk ? "All required records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
 }
 
 // src/tools/definitions.ts
@@ -2084,7 +2087,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind",
     {
-      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and permanent URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both, and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and permanent URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -2102,7 +2105,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
           const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
-          if (res2.status === "verified") {
+          if (res2.bindingStatus === "active") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
           const apex2 = res2.apexDomain;
@@ -2112,11 +2115,11 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
             ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
             pendingDnsRecords: res2.pendingDnsRecords,
             verificationStatus: res2.status,
-            provisioning: res2.provisioningJobId !== void 0
+            provisioning: res2.bindingStatus === "provisioning"
           });
           const { apexResolves, allOk } = diag;
           return text(
-            res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
+            res2.bindingStatus === "active" ? "domain_binding_active" : res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
             `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
 
@@ -2127,16 +2130,20 @@ ${res2.message}
             {
               verificationId: res2.verificationId,
               status: res2.status,
+              bindingStatus: res2.bindingStatus,
               apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
               servingTarget: res2.servingTarget,
               dnsChecklist: toDnsChecklist(diag.checks),
               apexResolves,
+              apexRequired: false,
+              requiredServingHostname: `www.${apex2}`,
+              optionalApexHostname: apex2,
               retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
               maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "pending_provider" : "waiting_user"
+            res2.bindingStatus === "active" ? "completed" : res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -2154,25 +2161,24 @@ ${res2.message}
 ` : "";
         return text(
           "domain_verification_started",
-          switchNotice + `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
-
-STEP 1 of 2 \u2014 add ALL THREE records NOW:
+          switchNotice + `Domain binding started for ${apex} (routes reserved: ${res.includedHostnames.join(", ")}). Only www.${apex} is required to go live; the naked domain is optional.
 
-  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
-  2) CNAME  host: www   value: ${res.servingTarget}
-  3) APEX   host: @   -> ${res.servingTarget}. Try a plain CNAME at host @ first (most panels accept it); if rejected use ALIAS / ANAME / CNAME-flattening; if the panel has neither, skip it \u2014 www alone works, and a URL redirect from @ to www covers bare-domain visitors.
+This is a STEP-BY-STEP setup \u2014 give the user ONE record at a time so they do not get overwhelmed and give up.
 
-Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
+STEP 1 of 2 \u2014 prove ownership. Add ONE record:
 
-Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+  TXT   host: ${txtShort}   value: ${res.verificationRecord.value}
 
-STEP 2 (after ownership verifies): Sakupa issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too (copy names and values EXACTLY as given). Everything then completes automatically.
+Host is the SHORT form: most panels append the domain automatically (the saved record must NOT show ${apex} twice in one name). Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-Drive the whole flow with bind "status": it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
+When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
             apexDomain: apex,
             includedHostnames: res.includedHostnames,
+            apexRequired: false,
+            requiredServingHostname: `www.${apex}`,
+            optionalApexHostname: apex,
             verificationRecord: res.verificationRecord,
             servingTarget: res.servingTarget,
             ...res.supersedes ? { supersedes: res.supersedes } : {},
@@ -2182,11 +2188,8 @@ Drive the whole flow with bind "status": it live-checks every record and names t
                 shortHost: txtShort,
                 name: res.verificationRecord.name,
                 value: res.verificationRecord.value
-              },
-              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
-              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+              }
             ],
-            servingInstructions: res.servingInstructions,
             retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
             maxAttempts: DNS_MAX_ATTEMPTS
           },
@@ -2524,7 +2527,7 @@ function registerLifecycleTools(server, baseCtx) {
   server.registerTool(
     "delete",
     {
-      description: "Preview or execute deletion of this Sakupa site. Execution requires an exact server-validated confirmation bound to the current site state.",
+      description: "Preview or execute deletion of this Sakupa site. Execution requires an exact server-validated confirmation bound to the current site state. Paid sites must first cancel renewal through portal and return to free mode. For a temporary pause, publish a pause notice as index.html with deploy instead of deleting the site.",
       inputSchema: {
         projectDir: projectDirInput,
         action: z4.enum(["preview", "confirm"]),
@@ -2543,6 +2546,20 @@ function registerLifecycleTools(server, baseCtx) {
           const preview = await ctx.client.previewDeleteSite(site.siteId, site.credential, {
             operationId
           });
+          if (preview.consequences.requiresFreeModeBeforeDelete) {
+            return structuredToolResult({
+              schemaVersion: 1,
+              outcome: "waiting_user",
+              resultCode: "paid_site_must_return_to_free",
+              operationId,
+              summary: "This paid site cannot be deleted yet. Open portal to cancel renewal, then wait until Stripe ends the subscription and Sakupa reports free mode before calling delete again. If the goal is only a temporary pause, edit the site index.html to show a pause notice and call deploy; this keeps the subscription and URL.",
+              data: { preview },
+              nextActions: [
+                { tool: "portal", allowed: true, reasonCode: "cancel_renewal_first" },
+                { tool: "deploy", allowed: true, reasonCode: "temporary_pause_alternative" }
+              ]
+            });
+          }
           return structuredToolResult({
             schemaVersion: 1,
             outcome: "waiting_user",
@@ -2561,6 +2578,12 @@ function registerLifecycleTools(server, baseCtx) {
             'To CONFIRM deletion, first call delete with action:"preview" to get the exact confirmation object bound to the current site state, then call again with action:"confirm", the same operationId, and that confirmation object.'
           );
         }
+        if (args.confirmation.expectedMode === "paid") {
+          throw new LocalGuidanceError(
+            "state_conflict",
+            "A paid site cannot be deleted. Cancel renewal through portal and wait until it returns to free mode. For a temporary pause, publish a pause notice as index.html."
+          );
+        }
         const result = await ctx.client.deleteSite(site.siteId, site.credential, {
           operationId,
           confirmation: args.confirmation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.18",
+  "version": "0.7.20",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",