@sakupa/mcp 0.7.31 → 0.7.32

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.31";
+var SAKUPA_MCP_VERSION = "0.7.32";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -690,7 +690,7 @@ var HttpApiClient = class {
 // src/tools/definitions.ts
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync3, promises as fs2 } from "node:fs";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { join as join5, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
 import { z as z3 } from "zod";
 
 // src/analyze/analyzer.ts
@@ -1113,7 +1113,15 @@ async function analyzeProject(projectDir, opts = {}) {
 }
 
 // src/project-file.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmdirSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
 import { dirname, join as join2 } from "node:path";
 var SITE_DIR = ".sakupa";
 var SITE_FILE = "site.json";
@@ -1236,6 +1244,10 @@ function deleteSiteFile(projectDir) {
   if (existsSync(path)) {
     rmSync(path, { force: true });
   }
+  try {
+    rmdirSync(join2(projectDir, SITE_DIR));
+  } catch {
+  }
 }
 function findAncestor(startDir, predicate, maxLevels = Number.POSITIVE_INFINITY) {
   let cursor = startDir;
@@ -2344,18 +2356,19 @@ ${block}`, checklist: toDnsChecklist(diag.checks) };
 }
 function projectRootAbove(projectDir) {
   if (existsSync3(join5(projectDir, "package.json"))) return null;
-  return findAncestor(projectDir, (dir) => existsSync3(join5(dir, "package.json")), 4);
-}
-function findNeighborBinding(projectDir, outputRel) {
-  const bound = (dir) => loadSiteFile(dir).kind !== "absent";
-  const above = findAncestor(projectDir, bound, 3);
-  if (above) return above;
-  if (outputRel && outputRel !== ".") {
-    const outputAbs = resolve4(projectDir, outputRel);
-    if (bound(outputAbs)) return outputAbs;
+  const packageRoot = findAncestor(projectDir, (dir) => existsSync3(join5(dir, "package.json")), 4);
+  if (packageRoot) {
+    return {
+      projectRoot: packageRoot,
+      outputDir: relative2(packageRoot, projectDir).split(sep3).join("/")
+    };
   }
   return null;
 }
+function findNeighborBinding(projectDir) {
+  const bound = (dir) => loadSiteFile(dir).kind !== "absent";
+  return findAncestor(projectDir, bound, 3);
+}
 function freeSiteCreationBarrier(apiBaseUrl) {
   const recent = listRecentCreations(Date.now(), apiBaseUrl);
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -2406,12 +2419,14 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. projectDir is ALWAYS the project root where .sakupa belongs; outputDir is a separate REQUIRED relative path supplied from the current project inspection ("." when the root itself is published). NEVER pass the build/output folder as projectDir. Never uploads anything when analysis says the project is not deployable.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
         projectDir: projectDirInput,
-        outputDir: z3.string().optional().describe("Output directory relative to the project root (overrides detection)."),
+        outputDir: z3.string().min(1).describe(
+          'REQUIRED: exact publish directory relative to projectDir, supplied by the AI after inspecting this project (for example ".", "dist", "html", or any custom build directory). NEVER put this path in projectDir; .sakupa belongs at projectDir.'
+        ),
         spaFallback: z3.boolean().optional().describe(
           "Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the detected structure."
         ),
@@ -2427,9 +2442,7 @@ Next action: ${analysis.suggestedNextAction}`,
     async (args) => {
       try {
         const ctx = withProjectDir(baseCtx, args.projectDir);
-        const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
-        });
+        const analysis = await analyzeProject(ctx.projectDir, { outputDir: args.outputDir });
         if (!analysis.deployable || !analysis.files) {
           return notDeployableResult(analysis);
         }
@@ -2447,18 +2460,40 @@ Next action: ${analysis.suggestedNextAction}`,
             "blocked"
           );
         }
-        const existing = siteFileState.kind === "ok" ? siteFileState.file : null;
+        let existing = siteFileState.kind === "ok" ? siteFileState.file : null;
+        let credentialRelocatedFrom = null;
+        if (!existing && analysis.recommendedOutputDir !== ".") {
+          const outputSiteState = loadSiteFile(outputAbs);
+          if (outputSiteState.kind === "corrupted") {
+            return text(
+              "output_site_file_corrupted",
+              `A misplaced .sakupa/site.json exists in output directory ${outputAbs}, but it is damaged: ${outputSiteState.problem}. Repair that file before retrying with projectDir: ${ctx.projectDir}. Nothing was deployed and no site was created.`,
+              { projectRoot: ctx.projectDir, outputDir: analysis.recommendedOutputDir },
+              "blocked"
+            );
+          }
+          if (outputSiteState.kind === "ok") {
+            writeSiteFile(ctx.projectDir, outputSiteState.file);
+            deleteSiteFile(outputAbs);
+            existing = outputSiteState.file;
+            credentialRelocatedFrom = outputAbs;
+          }
+        }
         if (!existing) {
-          const rootAbove = args.subprojectConfirmed === true ? null : projectRootAbove(ctx.projectDir);
-          if (rootAbove) {
+          const rootHint = args.subprojectConfirmed === true ? null : projectRootAbove(ctx.projectDir);
+          if (rootHint) {
             return text(
               "not_project_root",
-              `${ctx.projectDir} has no package.json but ${rootAbove} does \u2014 this directory is a SUBFOLDER of that project (typically its build output), and .sakupa must live at the project ROOT. Re-run deploy with projectDir: ${rootAbove}. Only if the user explicitly says this subfolder is an INDEPENDENT site (e.g. a docs/ site inside a repo), re-run with subprojectConfirmed: true. Nothing was deployed and no site was created.`,
-              { projectRoot: rootAbove, confirmationField: "subprojectConfirmed" },
+              `${ctx.projectDir} is a SUBFOLDER of a package.json project, and .sakupa must live at the project ROOT. Re-run deploy with projectDir: ${rootHint.projectRoot} and outputDir: ${rootHint.outputDir}. Only if the user explicitly says this subfolder is an INDEPENDENT site (e.g. a docs/ site inside a repo), re-run with subprojectConfirmed: true. Nothing was deployed and no site was created.`,
+              {
+                projectRoot: rootHint.projectRoot,
+                outputDir: rootHint.outputDir,
+                confirmationField: "subprojectConfirmed"
+              },
               "blocked"
             );
           }
-          const neighbor = findNeighborBinding(ctx.projectDir, analysis.recommendedOutputDir);
+          const neighbor = findNeighborBinding(ctx.projectDir);
           if (neighbor) {
             return text(
               "neighbor_binding_found",
@@ -2582,6 +2617,7 @@ Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
+` : "") + (credentialRelocatedFrom ? `Credential binding relocated from ${credentialRelocatedFrom}/.sakupa to ${ctx.projectDir}/.sakupa; the existing site was preserved.
 ` : "") + (finalized.mode === "free" ? `
 Reminder: free sites stay live for ${FREE_SITE_TTL_HOURS} hours after the last deploy or refresh call. Subscribing (subscribe) makes the site permanent.
 ` : "\nThis site is subscribed and permanent \u2014 no expiry.\n") + (finalized.warnings.length > 0 ? `
@@ -2596,7 +2632,8 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
-            warnings: finalized.warnings
+            warnings: finalized.warnings,
+            ...credentialRelocatedFrom ? { credentialRelocatedFrom } : {}
           }
         );
       } catch (e) {
@@ -3635,8 +3672,11 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). The server NEVER guesses a directory and refuses
-calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder). For deploy, ALWAYS pass outputDir separately as the exact path RELATIVE to
+projectDir (use "." when publishing the root); outputDir is required and may have ANY name,
+so inspect the current project and never infer it from a conventional folder name. The server
+NEVER guesses either directory: only you can see the user's actual workspace and build output.
+After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh and delete echo
 the directory they acted on \u2014 verify it matches the user's active project.

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.31";
+var SAKUPA_MCP_VERSION = "0.7.32";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -781,7 +781,15 @@ var HttpApiClient = class {
 };
 
 // src/project-file.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmdirSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
 import { dirname, join } from "node:path";
 var SITE_DIR = ".sakupa";
 var SITE_FILE = "site.json";
@@ -904,6 +912,10 @@ function deleteSiteFile(projectDir) {
   if (existsSync(path)) {
     rmSync(path, { force: true });
   }
+  try {
+    rmdirSync(join(projectDir, SITE_DIR));
+  } catch {
+  }
 }
 function findAncestor(startDir, predicate, maxLevels = Number.POSITIVE_INFINITY) {
   let cursor = startDir;
@@ -1484,7 +1496,7 @@ function toolError(e) {
 // src/tools/definitions.ts
 import { randomUUID } from "node:crypto";
 import { existsSync as existsSync3, promises as fs2 } from "node:fs";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { join as join5, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
 import { z as z3 } from "zod";
 
 // src/recovery-archive.ts
@@ -2433,18 +2445,19 @@ ${block}`, checklist: toDnsChecklist(diag.checks) };
 }
 function projectRootAbove(projectDir) {
   if (existsSync3(join5(projectDir, "package.json"))) return null;
-  return findAncestor(projectDir, (dir) => existsSync3(join5(dir, "package.json")), 4);
-}
-function findNeighborBinding(projectDir, outputRel) {
-  const bound = (dir) => loadSiteFile(dir).kind !== "absent";
-  const above = findAncestor(projectDir, bound, 3);
-  if (above) return above;
-  if (outputRel && outputRel !== ".") {
-    const outputAbs = resolve4(projectDir, outputRel);
-    if (bound(outputAbs)) return outputAbs;
+  const packageRoot = findAncestor(projectDir, (dir) => existsSync3(join5(dir, "package.json")), 4);
+  if (packageRoot) {
+    return {
+      projectRoot: packageRoot,
+      outputDir: relative2(packageRoot, projectDir).split(sep3).join("/")
+    };
   }
   return null;
 }
+function findNeighborBinding(projectDir) {
+  const bound = (dir) => loadSiteFile(dir).kind !== "absent";
+  return findAncestor(projectDir, bound, 3);
+}
 function freeSiteCreationBarrier(apiBaseUrl) {
   const recent = listRecentCreations(Date.now(), apiBaseUrl);
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -2495,12 +2508,14 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. projectDir is ALWAYS the project root where .sakupa belongs; outputDir is a separate REQUIRED relative path supplied from the current project inspection ("." when the root itself is published). NEVER pass the build/output folder as projectDir. Never uploads anything when analysis says the project is not deployable.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
         projectDir: projectDirInput,
-        outputDir: z3.string().optional().describe("Output directory relative to the project root (overrides detection)."),
+        outputDir: z3.string().min(1).describe(
+          'REQUIRED: exact publish directory relative to projectDir, supplied by the AI after inspecting this project (for example ".", "dist", "html", or any custom build directory). NEVER put this path in projectDir; .sakupa belongs at projectDir.'
+        ),
         spaFallback: z3.boolean().optional().describe(
           "Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the detected structure."
         ),
@@ -2516,9 +2531,7 @@ Next action: ${analysis.suggestedNextAction}`,
     async (args) => {
       try {
         const ctx = withProjectDir(baseCtx, args.projectDir);
-        const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
-        });
+        const analysis = await analyzeProject(ctx.projectDir, { outputDir: args.outputDir });
         if (!analysis.deployable || !analysis.files) {
           return notDeployableResult(analysis);
         }
@@ -2536,18 +2549,40 @@ Next action: ${analysis.suggestedNextAction}`,
             "blocked"
           );
         }
-        const existing = siteFileState.kind === "ok" ? siteFileState.file : null;
+        let existing = siteFileState.kind === "ok" ? siteFileState.file : null;
+        let credentialRelocatedFrom = null;
+        if (!existing && analysis.recommendedOutputDir !== ".") {
+          const outputSiteState = loadSiteFile(outputAbs);
+          if (outputSiteState.kind === "corrupted") {
+            return text(
+              "output_site_file_corrupted",
+              `A misplaced .sakupa/site.json exists in output directory ${outputAbs}, but it is damaged: ${outputSiteState.problem}. Repair that file before retrying with projectDir: ${ctx.projectDir}. Nothing was deployed and no site was created.`,
+              { projectRoot: ctx.projectDir, outputDir: analysis.recommendedOutputDir },
+              "blocked"
+            );
+          }
+          if (outputSiteState.kind === "ok") {
+            writeSiteFile(ctx.projectDir, outputSiteState.file);
+            deleteSiteFile(outputAbs);
+            existing = outputSiteState.file;
+            credentialRelocatedFrom = outputAbs;
+          }
+        }
         if (!existing) {
-          const rootAbove = args.subprojectConfirmed === true ? null : projectRootAbove(ctx.projectDir);
-          if (rootAbove) {
+          const rootHint = args.subprojectConfirmed === true ? null : projectRootAbove(ctx.projectDir);
+          if (rootHint) {
             return text(
               "not_project_root",
-              `${ctx.projectDir} has no package.json but ${rootAbove} does \u2014 this directory is a SUBFOLDER of that project (typically its build output), and .sakupa must live at the project ROOT. Re-run deploy with projectDir: ${rootAbove}. Only if the user explicitly says this subfolder is an INDEPENDENT site (e.g. a docs/ site inside a repo), re-run with subprojectConfirmed: true. Nothing was deployed and no site was created.`,
-              { projectRoot: rootAbove, confirmationField: "subprojectConfirmed" },
+              `${ctx.projectDir} is a SUBFOLDER of a package.json project, and .sakupa must live at the project ROOT. Re-run deploy with projectDir: ${rootHint.projectRoot} and outputDir: ${rootHint.outputDir}. Only if the user explicitly says this subfolder is an INDEPENDENT site (e.g. a docs/ site inside a repo), re-run with subprojectConfirmed: true. Nothing was deployed and no site was created.`,
+              {
+                projectRoot: rootHint.projectRoot,
+                outputDir: rootHint.outputDir,
+                confirmationField: "subprojectConfirmed"
+              },
               "blocked"
             );
           }
-          const neighbor = findNeighborBinding(ctx.projectDir, analysis.recommendedOutputDir);
+          const neighbor = findNeighborBinding(ctx.projectDir);
           if (neighbor) {
             return text(
               "neighbor_binding_found",
@@ -2671,6 +2706,7 @@ Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
+` : "") + (credentialRelocatedFrom ? `Credential binding relocated from ${credentialRelocatedFrom}/.sakupa to ${ctx.projectDir}/.sakupa; the existing site was preserved.
 ` : "") + (finalized.mode === "free" ? `
 Reminder: free sites stay live for ${FREE_SITE_TTL_HOURS} hours after the last deploy or refresh call. Subscribing (subscribe) makes the site permanent.
 ` : "\nThis site is subscribed and permanent \u2014 no expiry.\n") + (finalized.warnings.length > 0 ? `
@@ -2685,7 +2721,8 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
-            warnings: finalized.warnings
+            warnings: finalized.warnings,
+            ...credentialRelocatedFrom ? { credentialRelocatedFrom } : {}
           }
         );
       } catch (e) {
@@ -3630,8 +3667,11 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). The server NEVER guesses a directory and refuses
-calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder). For deploy, ALWAYS pass outputDir separately as the exact path RELATIVE to
+projectDir (use "." when publishing the root); outputDir is required and may have ANY name,
+so inspect the current project and never infer it from a conventional folder name. The server
+NEVER guesses either directory: only you can see the user's actual workspace and build output.
+After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh and delete echo
 the directory they acted on \u2014 verify it matches the user's active project.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.31",
+  "version": "0.7.32",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",