@sakupa/mcp 0.7.2 → 0.7.4

package/dist/bin.js

@@ -128,7 +128,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.2";
+var SAKUPA_MCP_VERSION = "0.7.4";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -444,6 +444,9 @@ function safeDecode(bytes) {
   }
 }
 
+// ../core/dist/domain/credentials.js
+var CREDENTIAL_PATTERN = /^sk_[A-Za-z0-9_-]{43}$/;
+
 // ../core/dist/domain/hashing.js
 async function sha256Hex(bytes) {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
@@ -458,10 +461,6 @@ var CREDENTIAL_HEADER = "x-sakupa-credential";
 var IDEMPOTENCY_HEADER = "x-sakupa-idempotency-key";
 var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 
-// ../core/dist/services/sites.js
-var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
-var utf8Encoder = new TextEncoder();
-
 // ../core/dist/services/subscriptions.js
 var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 
@@ -1128,20 +1127,42 @@ var SITE_FILE = "site.json";
 function siteFilePath(projectDir) {
   return join2(projectDir, SITE_DIR, SITE_FILE);
 }
-function readSiteFile(projectDir) {
+function loadSiteFile(projectDir) {
   const path = siteFilePath(projectDir);
+  if (!existsSync(path)) return { kind: "absent" };
   let raw;
   try {
     raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
+  } catch (err) {
+    return {
+      kind: "corrupted",
+      problem: `the file exists but could not be read (${err instanceof Error ? err.message : String(err)})`
+    };
   }
+  let parsed;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return null;
-    if (typeof parsed.siteId !== "string" || parsed.siteId.length === 0) return null;
-    if (typeof parsed.credential !== "string" || parsed.credential.length === 0) return null;
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: "corrupted", problem: "the file exists but is not valid JSON" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { kind: "corrupted", problem: "the file does not contain a JSON object" };
+  }
+  if (typeof parsed.siteId !== "string" || parsed.siteId.length === 0) {
+    return { kind: "corrupted", problem: "the siteId field is missing or empty" };
+  }
+  if (typeof parsed.credential !== "string" || parsed.credential.length === 0) {
+    return { kind: "corrupted", problem: "the credential field is missing or empty" };
+  }
+  if (!CREDENTIAL_PATTERN.test(parsed.credential)) {
     return {
+      kind: "corrupted",
+      problem: "the credential does not match the shape Sakupa issues (sk_ followed by exactly 43 URL-safe base64 characters) \u2014 it looks locally altered or damaged"
+    };
+  }
+  return {
+    kind: "ok",
+    file: {
       siteId: parsed.siteId,
       credential: parsed.credential,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : "",
@@ -1149,12 +1170,26 @@ function readSiteFile(projectDir) {
       ...typeof parsed.shortId === "string" ? { shortId: parsed.shortId } : {},
       ...typeof parsed.url === "string" ? { url: parsed.url } : {},
       ...typeof parsed.boundDomain === "string" ? { boundDomain: parsed.boundDomain } : {}
-    };
-  } catch {
-    return null;
-  }
+    }
+  };
 }
-function writeSiteFile(projectDir, file) {
+function siteFileRecoveryGuidance(projectDir) {
+  return `The site itself is intact on the server; only the local binding file (${siteFilePath(projectDir)}) is the problem. Restore the file (from a backup or by undoing the local edit). Do NOT delete it to work around the error: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site. Publishing this project as a brand-NEW site requires the user to manually delete the .sakupa directory first \u2014 the tool will never overwrite it.`;
+}
+function writeSiteFile(projectDir, file, opts = {}) {
+  if (opts.allowReplace !== true) {
+    const existing = loadSiteFile(projectDir);
+    if (existing.kind === "corrupted") {
+      throw new Error(
+        `Refusing to overwrite ${siteFilePath(projectDir)}: ${existing.problem}. ` + siteFileRecoveryGuidance(projectDir)
+      );
+    }
+    if (existing.kind === "ok" && existing.file.siteId !== file.siteId) {
+      throw new Error(
+        `Refusing to overwrite ${siteFilePath(projectDir)}: it already binds this project to site ${existing.file.siteId}. ` + siteFileRecoveryGuidance(projectDir)
+      );
+    }
+  }
   const dir = join2(projectDir, SITE_DIR);
   mkdirSync(dir, { recursive: true });
   const path = join2(dir, SITE_FILE);
@@ -1232,14 +1267,20 @@ function structuredToolResult(envelope) {
 
 // src/tools/context.ts
 function requireSiteFile(ctx) {
-  const file = readSiteFile(ctx.projectDir);
-  if (!file) {
+  const state = loadSiteFile(ctx.projectDir);
+  if (state.kind === "corrupted") {
+    throw new SakupaError(
+      "invalid_request",
+      `.sakupa/site.json in ${ctx.projectDir} is damaged: ${state.problem}. ` + siteFileRecoveryGuidance(ctx.projectDir)
+    );
+  }
+  if (state.kind === "absent") {
     throw new SakupaError(
       "not_found",
       `No .sakupa/site.json found in ${ctx.projectDir}. This project has no Sakupa site binding yet \u2014 run deploy_site first to publish it (the management credential will be stored locally in .sakupa/site.json). If this was a paid custom-domain site whose project file was lost, use recover_domain_site instead.`
     );
   }
-  return file;
+  return state.file;
 }
 function toolError(e) {
   const errorCode = isSakupaError(e) ? e.code : "internal";
@@ -1460,7 +1501,18 @@ Next action: ${analysis.suggestedNextAction}`,
         const files = analysis.files;
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
-        const existing = readSiteFile(ctx.projectDir);
+        const siteFileState = loadSiteFile(ctx.projectDir);
+        if (siteFileState.kind === "corrupted") {
+          return text(
+            "site_file_corrupted",
+            `This project's .sakupa/site.json is damaged: ${siteFileState.problem}.
+
+` + siteFileRecoveryGuidance(ctx.projectDir) + "\n\nNothing was deployed and no new site was created.",
+            { problem: siteFileState.problem },
+            "blocked"
+          );
+        }
+        const existing = siteFileState.kind === "ok" ? siteFileState.file : null;
         if (!existing && args.publicConfirmed !== true) {
           return text(
             "public_deployment_confirmation_required",
@@ -1540,6 +1592,16 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         try {
           update = await updateOnce(false);
         } catch (e) {
+          if (isSakupaError(e) && e.code === "unauthorized") {
+            return text(
+              "credential_mismatch",
+              `The server rejected the credential in .sakupa/site.json for site ${existing.siteId} \u2014 the local file no longer matches the server-side verifier (most often a local edit or merge damage).
+
+` + siteFileRecoveryGuidance(ctx.projectDir) + "\n\nNothing was deployed and no new site was created.",
+              { siteId: existing.siteId },
+              "blocked"
+            );
+          }
           if (!isIncrementalReuseFailure(e)) throw e;
           update = await updateOnce(true);
         }
@@ -1890,13 +1952,17 @@ After the DNS record resolves, re-run recover_domain_site with verificationId: "
         const res = await ctx.client.completeRecovery(args.verificationId, {
           ...args.preserveExistingCredentials !== void 0 ? { preserveExistingCredentials: args.preserveExistingCredentials } : {}
         });
-        writeSiteFile(ctx.projectDir, {
-          siteId: res.siteId,
-          ...res.boundHostnames[0] !== void 0 ? { boundDomain: res.boundHostnames[0] } : {},
-          credential: res.credential,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          apiBaseUrl: ctx.apiBaseUrl
-        });
+        writeSiteFile(
+          ctx.projectDir,
+          {
+            siteId: res.siteId,
+            ...res.boundHostnames[0] !== void 0 ? { boundDomain: res.boundHostnames[0] } : {},
+            credential: res.credential,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            apiBaseUrl: ctx.apiBaseUrl
+          },
+          { allowReplace: true }
+        );
         return text(
           "domain_recovery_completed",
           `Recovery complete.
@@ -1973,7 +2039,8 @@ ${res.archiveUrl}`,
     },
     async (args) => {
       try {
-        const site = readSiteFile(ctx.projectDir);
+        const siteState = loadSiteFile(ctx.projectDir);
+        const site = siteState.kind === "ok" ? siteState.file : null;
         const diagnostics = {
           toolName: args.toolName,
           ...args.errorCode !== void 0 ? { errorCode: args.errorCode } : {},
@@ -2301,9 +2368,11 @@ Workflow:
 2. deploy_site \u2014 uploads ONLY the built static output. The first deploy creates a free temporary
    site (public URL ${hostPattern}, valid 24 hours, free banner shown) and stores the
    management credential in .sakupa/site.json. Deploying again updates the site and refreshes
-   its validity; refresh_site extends validity without uploading.
-3. To make the site PERMANENT, subscribe it to a monthly hosting plan (subscribe_site ->
-   Stripe-hosted checkout; water/personal/share/business). Paying makes the
+   its validity; refresh_site extends validity without uploading; site_status shows the
+   current deployment and serving state at any time.
+3. To make the site PERMANENT, subscribe it to a monthly hosting plan (list_billing_plans
+   shows the catalog; subscribe_site -> Stripe-hosted checkout;
+   water/personal/share/business). Paying makes the
    ${hostPattern} URL permanent \u2014 that is what payment buys. Usage over the chosen plan
    shows an over-limit notice by default. An external AI may periodically query usage and
    recommend a plan, but Sakupa never changes a subscription automatically.
@@ -2311,9 +2380,13 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    change_subscription_plan, manage_billing and recover_domain_site manage the paid
-   lifecycle. Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
+   lifecycle; unbind_domain removes the custom domain (the permanent URL keeps serving) and
+   delete_site tears the whole site down after explicit confirmation.
+   Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
    A cancellation keeps the site paid through the current period. Sakupa reverts it to a free
    24h site and removes paid data after Stripe sends the signed final-cancellation webhook.
+5. create_support_ticket (subscribed sites) opens a support ticket; report_bug sends a
+   sanitized diagnostic report after the user explicitly confirms it.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.

package/dist/index.js

@@ -123,7 +123,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.2";
+var SAKUPA_MCP_VERSION = "0.7.4";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -439,6 +439,9 @@ function safeDecode(bytes) {
   }
 }
 
+// ../core/dist/domain/credentials.js
+var CREDENTIAL_PATTERN = /^sk_[A-Za-z0-9_-]{43}$/;
+
 // ../core/dist/domain/hashing.js
 async function sha256Hex(bytes) {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
@@ -453,10 +456,6 @@ var CREDENTIAL_HEADER = "x-sakupa-credential";
 var IDEMPOTENCY_HEADER = "x-sakupa-idempotency-key";
 var MCP_VERSION_HEADER = "x-sakupa-mcp-version";
 
-// ../core/dist/services/sites.js
-var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
-var utf8Encoder = new TextEncoder();
-
 // ../core/dist/services/subscriptions.js
 var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 
@@ -764,20 +763,42 @@ var SITE_FILE = "site.json";
 function siteFilePath(projectDir) {
   return join(projectDir, SITE_DIR, SITE_FILE);
 }
-function readSiteFile(projectDir) {
+function loadSiteFile(projectDir) {
   const path = siteFilePath(projectDir);
+  if (!existsSync(path)) return { kind: "absent" };
   let raw;
   try {
     raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
+  } catch (err) {
+    return {
+      kind: "corrupted",
+      problem: `the file exists but could not be read (${err instanceof Error ? err.message : String(err)})`
+    };
   }
+  let parsed;
   try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) return null;
-    if (typeof parsed.siteId !== "string" || parsed.siteId.length === 0) return null;
-    if (typeof parsed.credential !== "string" || parsed.credential.length === 0) return null;
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: "corrupted", problem: "the file exists but is not valid JSON" };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { kind: "corrupted", problem: "the file does not contain a JSON object" };
+  }
+  if (typeof parsed.siteId !== "string" || parsed.siteId.length === 0) {
+    return { kind: "corrupted", problem: "the siteId field is missing or empty" };
+  }
+  if (typeof parsed.credential !== "string" || parsed.credential.length === 0) {
+    return { kind: "corrupted", problem: "the credential field is missing or empty" };
+  }
+  if (!CREDENTIAL_PATTERN.test(parsed.credential)) {
     return {
+      kind: "corrupted",
+      problem: "the credential does not match the shape Sakupa issues (sk_ followed by exactly 43 URL-safe base64 characters) \u2014 it looks locally altered or damaged"
+    };
+  }
+  return {
+    kind: "ok",
+    file: {
       siteId: parsed.siteId,
       credential: parsed.credential,
       createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : "",
@@ -785,12 +806,26 @@ function readSiteFile(projectDir) {
       ...typeof parsed.shortId === "string" ? { shortId: parsed.shortId } : {},
       ...typeof parsed.url === "string" ? { url: parsed.url } : {},
       ...typeof parsed.boundDomain === "string" ? { boundDomain: parsed.boundDomain } : {}
-    };
-  } catch {
-    return null;
-  }
+    }
+  };
 }
-function writeSiteFile(projectDir, file) {
+function siteFileRecoveryGuidance(projectDir) {
+  return `The site itself is intact on the server; only the local binding file (${siteFilePath(projectDir)}) is the problem. Restore the file (from a backup or by undoing the local edit). Do NOT delete it to work around the error: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site. Publishing this project as a brand-NEW site requires the user to manually delete the .sakupa directory first \u2014 the tool will never overwrite it.`;
+}
+function writeSiteFile(projectDir, file, opts = {}) {
+  if (opts.allowReplace !== true) {
+    const existing = loadSiteFile(projectDir);
+    if (existing.kind === "corrupted") {
+      throw new Error(
+        `Refusing to overwrite ${siteFilePath(projectDir)}: ${existing.problem}. ` + siteFileRecoveryGuidance(projectDir)
+      );
+    }
+    if (existing.kind === "ok" && existing.file.siteId !== file.siteId) {
+      throw new Error(
+        `Refusing to overwrite ${siteFilePath(projectDir)}: it already binds this project to site ${existing.file.siteId}. ` + siteFileRecoveryGuidance(projectDir)
+      );
+    }
+  }
   const dir = join(projectDir, SITE_DIR);
   mkdirSync(dir, { recursive: true });
   const path = join(dir, SITE_FILE);
@@ -1290,14 +1325,20 @@ function structuredToolResult(envelope) {
 
 // src/tools/context.ts
 function requireSiteFile(ctx) {
-  const file = readSiteFile(ctx.projectDir);
-  if (!file) {
+  const state = loadSiteFile(ctx.projectDir);
+  if (state.kind === "corrupted") {
+    throw new SakupaError(
+      "invalid_request",
+      `.sakupa/site.json in ${ctx.projectDir} is damaged: ${state.problem}. ` + siteFileRecoveryGuidance(ctx.projectDir)
+    );
+  }
+  if (state.kind === "absent") {
     throw new SakupaError(
       "not_found",
       `No .sakupa/site.json found in ${ctx.projectDir}. This project has no Sakupa site binding yet \u2014 run deploy_site first to publish it (the management credential will be stored locally in .sakupa/site.json). If this was a paid custom-domain site whose project file was lost, use recover_domain_site instead.`
     );
   }
-  return file;
+  return state.file;
 }
 function toolError(e) {
   const errorCode = isSakupaError(e) ? e.code : "internal";
@@ -1522,7 +1563,18 @@ Next action: ${analysis.suggestedNextAction}`,
         const files = analysis.files;
         const outputAbs = resolve2(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
         const manifest = await buildHashedManifest(files, outputAbs);
-        const existing = readSiteFile(ctx.projectDir);
+        const siteFileState = loadSiteFile(ctx.projectDir);
+        if (siteFileState.kind === "corrupted") {
+          return text(
+            "site_file_corrupted",
+            `This project's .sakupa/site.json is damaged: ${siteFileState.problem}.
+
+` + siteFileRecoveryGuidance(ctx.projectDir) + "\n\nNothing was deployed and no new site was created.",
+            { problem: siteFileState.problem },
+            "blocked"
+          );
+        }
+        const existing = siteFileState.kind === "ok" ? siteFileState.file : null;
         if (!existing && args.publicConfirmed !== true) {
           return text(
             "public_deployment_confirmation_required",
@@ -1602,6 +1654,16 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         try {
           update = await updateOnce(false);
         } catch (e) {
+          if (isSakupaError(e) && e.code === "unauthorized") {
+            return text(
+              "credential_mismatch",
+              `The server rejected the credential in .sakupa/site.json for site ${existing.siteId} \u2014 the local file no longer matches the server-side verifier (most often a local edit or merge damage).
+
+` + siteFileRecoveryGuidance(ctx.projectDir) + "\n\nNothing was deployed and no new site was created.",
+              { siteId: existing.siteId },
+              "blocked"
+            );
+          }
           if (!isIncrementalReuseFailure(e)) throw e;
           update = await updateOnce(true);
         }
@@ -1952,13 +2014,17 @@ After the DNS record resolves, re-run recover_domain_site with verificationId: "
         const res = await ctx.client.completeRecovery(args.verificationId, {
           ...args.preserveExistingCredentials !== void 0 ? { preserveExistingCredentials: args.preserveExistingCredentials } : {}
         });
-        writeSiteFile(ctx.projectDir, {
-          siteId: res.siteId,
-          ...res.boundHostnames[0] !== void 0 ? { boundDomain: res.boundHostnames[0] } : {},
-          credential: res.credential,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          apiBaseUrl: ctx.apiBaseUrl
-        });
+        writeSiteFile(
+          ctx.projectDir,
+          {
+            siteId: res.siteId,
+            ...res.boundHostnames[0] !== void 0 ? { boundDomain: res.boundHostnames[0] } : {},
+            credential: res.credential,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            apiBaseUrl: ctx.apiBaseUrl
+          },
+          { allowReplace: true }
+        );
         return text(
           "domain_recovery_completed",
           `Recovery complete.
@@ -2035,7 +2101,8 @@ ${res.archiveUrl}`,
     },
     async (args) => {
       try {
-        const site = readSiteFile(ctx.projectDir);
+        const siteState = loadSiteFile(ctx.projectDir);
+        const site = siteState.kind === "ok" ? siteState.file : null;
         const diagnostics = {
           toolName: args.toolName,
           ...args.errorCode !== void 0 ? { errorCode: args.errorCode } : {},
@@ -2294,9 +2361,11 @@ Workflow:
 2. deploy_site \u2014 uploads ONLY the built static output. The first deploy creates a free temporary
    site (public URL ${hostPattern}, valid 24 hours, free banner shown) and stores the
    management credential in .sakupa/site.json. Deploying again updates the site and refreshes
-   its validity; refresh_site extends validity without uploading.
-3. To make the site PERMANENT, subscribe it to a monthly hosting plan (subscribe_site ->
-   Stripe-hosted checkout; water/personal/share/business). Paying makes the
+   its validity; refresh_site extends validity without uploading; site_status shows the
+   current deployment and serving state at any time.
+3. To make the site PERMANENT, subscribe it to a monthly hosting plan (list_billing_plans
+   shows the catalog; subscribe_site -> Stripe-hosted checkout;
+   water/personal/share/business). Paying makes the
    ${hostPattern} URL permanent \u2014 that is what payment buys. Usage over the chosen plan
    shows an over-limit notice by default. An external AI may periodically query usage and
    recommend a plan, but Sakupa never changes a subscription automatically.
@@ -2304,9 +2373,13 @@ Workflow:
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
    change_subscription_plan, manage_billing and recover_domain_site manage the paid
-   lifecycle. Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
+   lifecycle; unbind_domain removes the custom domain (the permanent URL keeps serving) and
+   delete_site tears the whole site down after explicit confirmation.
+   Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
    A cancellation keeps the site paid through the current period. Sakupa reverts it to a free
    24h site and removes paid data after Stripe sends the signed final-cancellation webhook.
+5. create_support_ticket (subscribed sites) opens a support ticket; report_bug sends a
+   sanitized diagnostic report after the user explicitly confirms it.
 
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
@@ -2352,7 +2425,7 @@ export {
   createSakupaMcpServer,
   deleteSiteFile,
   loadMcpRuntimeConfig,
-  readSiteFile,
+  loadSiteFile,
   registerLifecycleTools,
   registerTools,
   requireSiteFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",