@sakupa/mcp 0.7.5 → 0.7.7

package/dist/bin.js

@@ -128,7 +128,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.5";
+var SAKUPA_MCP_VERSION = "0.7.7";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -407,22 +407,13 @@ function validateDeployableFiles(files, opts) {
           severity: "warning",
           code: "missing_html_lang",
           path: entryHtmlPath,
-          message: 'The entry HTML has no lang attribute. Add html lang="en" | "ja" | "zh-CN" so Sakupa surfaces match the site language.'
+          message: 'The entry HTML has no lang attribute. Before deploying, add one matching the content language (html lang="en" | "ja" | "zh-CN") \u2014 it drives screen-reader pronunciation and search-engine language detection, and Sakupa surfaces follow it.'
         });
       }
     }
   }
   const jsCount = files.filter((f) => ["js", "mjs"].includes(fileExtension(f.path))).length;
   const looksLikeSpa = htmlPaths.length === 1 && entryHtmlPath === "index.html" && jsCount > 0;
-  const wantsSpa = opts.spaFallbackRequested === true || looksLikeSpa;
-  const spaFallbackConfirmationRequired = wantsSpa && opts.spaFallbackConfirmed !== true;
-  if (opts.spaFallbackRequested === true && opts.spaFallbackConfirmed !== true) {
-    issues.push({
-      severity: "error",
-      code: "spa_fallback_confirmation_required",
-      message: "SPA fallback rewrites unknown paths to index.html and changes normal 404 behavior. It must be explicitly confirmed."
-    });
-  }
   const ok = issues.every((i) => i.severity !== "error");
   return {
     ok,
@@ -432,8 +423,7 @@ function validateDeployableFiles(files, opts) {
     entryHtmlPath,
     htmlLang,
     supportedLang,
-    looksLikeSpa,
-    spaFallbackConfirmationRequired
+    looksLikeSpa
   };
 }
 function safeDecode(bytes) {
@@ -1052,7 +1042,7 @@ async function analyzeProject(projectDir, opts = {}) {
       fileCount: 0,
       issues: [],
       ssrRisks,
-      spa: { looksLikeSpa: false, fallbackRecommended: false, confirmationRequired: false },
+      spa: { looksLikeSpa: false, autoFallback: false },
       deployable: false,
       suggestedNextAction: suggestedNextAction2
     };
@@ -1072,30 +1062,23 @@ async function analyzeProject(projectDir, opts = {}) {
     }
     candidates.push({ path: file.path, size: file.size, ...content ? { content } : {} });
   }
-  const validation = validateDeployableFiles(candidates, {
-    mode: "free",
-    ...opts.spaFallbackRequested !== void 0 ? { spaFallbackRequested: opts.spaFallbackRequested } : {},
-    ...opts.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: opts.spaFallbackConfirmed } : {}
-  });
+  const validation = validateDeployableFiles(candidates, { mode: "free" });
   ssrRisks.push(...serverAndDbDepRisks(pkg, true));
   const deployable = validation.ok && walked.length > 0;
   const spa = {
     looksLikeSpa: validation.looksLikeSpa,
-    fallbackRecommended: validation.looksLikeSpa,
-    confirmationRequired: validation.spaFallbackConfirmationRequired
+    autoFallback: validation.looksLikeSpa
   };
   let suggestedNextAction;
   if (!deployable) {
     const firstError = validation.issues.find((i) => i.severity === "error");
     if (firstError?.code === "missing_index_html") {
       suggestedNextAction = `No index.html at the root of "${outputDirRel}". Deploy the built static output (the directory whose root contains index.html), not the source project. Build locally first if needed (${buildCommandHint ?? "npm run build"}), then re-run analyze_site.`;
-    } else if (firstError?.code === "spa_fallback_confirmation_required") {
-      suggestedNextAction = "SPA fallback rewrites unknown paths to index.html and changes normal 404 behavior. Confirm it explicitly: re-run with spaFallbackRequested: true and spaFallbackConfirmed: true.";
     } else {
       suggestedNextAction = "Fix the listed issues (remove forbidden/secret files, reduce size, add missing entry HTML), then re-run analyze_site.";
     }
-  } else if (spa.confirmationRequired) {
-    suggestedNextAction = `The output in "${outputDirRel}" is deployable, but it looks like a single-page app. Decide about SPA fallback first: run deploy_site with spaFallback: true and spaFallbackConfirmed: true to enable it, or with spaFallbackConfirmed: true alone to deploy without fallback.`;
+  } else if (spa.looksLikeSpa) {
+    suggestedNextAction = `Run deploy_site to publish the static output in "${outputDirRel}". It looks like a single-page app, so SPA fallback (unknown paths rewrite to index.html) will be enabled automatically; pass spaFallback: false to opt out.`;
   } else {
     suggestedNextAction = `Run deploy_site to publish the static output in "${outputDirRel}".`;
   }
@@ -1299,7 +1282,8 @@ function toolError(e) {
       ([key, value]) => safeDetailKeys.has(key) && (typeof value === "string" || typeof value === "number" || typeof value === "boolean")
     )
   ) : void 0;
-  const safeSummary = errorCode === "not_found" ? "The required local project binding or resource is unavailable; if this project has no .sakupa/site.json yet, run deploy_site first." : errorCode === "unauthorized" ? "The server rejected the site credential: the one in .sakupa/site.json no longer matches the server-side verifier. The site itself is intact on the server \u2014 only the local binding file is the problem. Repair the file (restore a backup or undo the local edit). Do NOT delete the .sakupa directory to work around this: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site." : errorCode === "invalid_request" || errorCode === "validation_failed" ? "The request arguments or local project checks did not pass." : errorCode === "state_conflict" ? "The resource state has changed; re-query the current status before deciding the next step." : errorCode === "confirmation_required" ? "The site or billing state changed, so the previous confirmation is stale; run the preview again and confirm against the fresh snapshot." : errorCode === "payment_required" ? "This operation requires an active subscription; check billing_status first." : errorCode === "rate_limited" ? "The server rate limit was reached; retry after the returned wait time." : retryable ? "An upstream service is temporarily unavailable or busy; retry shortly." : "The operation failed; no server-internal details are exposed.";
+  const minimumVersion = rawDetails && typeof rawDetails["minimumVersion"] === "string" ? rawDetails["minimumVersion"] : void 0;
+  const safeSummary = errorCode === "upgrade_required" ? `This Sakupa MCP client is v${MCP_VERSION}, older than the server's minimum supported version${minimumVersion !== void 0 ? ` (v${minimumVersion})` : ""}, so the server refused the call. To fix it: ask the user to fully restart their MCP client session \u2014 "npx -y @sakupa/mcp@latest" setups fetch the current version on restart (run "npx clear-npx-cache" first if the old version persists); global installs need "npm install -g @sakupa/mcp@latest". After the restart, retry this exact tool call.` : errorCode === "not_found" ? "The required local project binding or resource is unavailable; if this project has no .sakupa/site.json yet, run deploy_site first." : errorCode === "unauthorized" ? "The server rejected the site credential: the one in .sakupa/site.json no longer matches the server-side verifier. The site itself is intact on the server \u2014 only the local binding file is the problem. Repair the file (restore a backup or undo the local edit). Do NOT delete the .sakupa directory to work around this: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site." : errorCode === "invalid_request" || errorCode === "validation_failed" ? "The request arguments or local project checks did not pass." : errorCode === "state_conflict" ? "The resource state has changed; re-query the current status before deciding the next step." : errorCode === "confirmation_required" ? "The site or billing state changed, so the previous confirmation is stale; run the preview again and confirm against the fresh snapshot." : errorCode === "payment_required" ? "This operation requires an active subscription; check billing_status first." : errorCode === "rate_limited" ? "The server rate limit was reached; retry after the returned wait time." : retryable ? "An upstream service is temporarily unavailable or busy; retry shortly." : "The operation failed; no server-internal details are exposed.";
   const result = structuredToolResult({
     schemaVersion: 1,
     outcome: "failed",
@@ -1341,7 +1325,7 @@ ${JSON.stringify(obj, null, 2)}`;
 var planEnum = z2.enum(["water", "personal", "share", "business"]);
 var severityEnum = z2.enum(["low", "medium", "high", "critical"]);
 function planCatalog() {
-  return TIER_ORDER.map((p) => `${p} \xA5${tierPriceJpy(p)}/month`).join(", ");
+  return TIER_ORDER.map((p) => `${p} JPY ${tierPriceJpy(p)}/month`).join(", ");
 }
 var ticketCategoryEnum = z2.enum([
   "billing",
@@ -1369,22 +1353,6 @@ Analysis:`,
     "blocked"
   );
 }
-function spaConfirmationResult(analysis) {
-  return text(
-    "spa_fallback_confirmation_required",
-    `SPA fallback confirmation required \u2014 nothing was deployed yet.
-
-This site looks like a single-page application (one index.html plus JavaScript). SPA fallback rewrites every unknown path to index.html so client-side routes work, but it CHANGES normal 404 behavior: visitors never see a not-found page.
-
-Please ask the user to choose, then re-run deploy_site with:
-- spaFallback: true, spaFallbackConfirmed: true  -> enable SPA fallback
-- spaFallbackConfirmed: true (spaFallback omitted or false) -> deploy WITHOUT fallback (unknown paths return 404)
-
-Output directory: "${analysis.recommendedOutputDir ?? "."}", ${analysis.fileCount} files.`,
-    { analysis: analysisSummary(analysis), requestedConfirmation: "spa_fallback" },
-    "waiting_user"
-  );
-}
 var MB2 = 1024 * 1024;
 function ensureUploadSizeWithinLimits(manifest, isFirstFreeDeploy) {
   const oversized = manifest.find((f) => f.size > MAX_SINGLE_FILE_BYTES);
@@ -1446,17 +1414,13 @@ function registerTools(server, ctx) {
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
       inputSchema: {
-        outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection)."),
-        spaFallbackRequested: z2.boolean().optional().describe("User asked for SPA fallback (unknown paths rewritten to index.html)."),
-        spaFallbackConfirmed: z2.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change.")
+        outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection).")
       }
     },
     async (args) => {
       try {
         const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {},
-          ...args.spaFallbackRequested !== void 0 ? { spaFallbackRequested: args.spaFallbackRequested } : {},
-          ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
         });
         return textJson(
           "site_analysis_completed",
@@ -1477,8 +1441,9 @@ Next action: ${analysis.suggestedNextAction}`,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
         outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection)."),
-        spaFallback: z2.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
-        spaFallbackConfirmed: z2.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        spaFallback: z2.boolean().optional().describe(
+          "Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the detected structure."
+        ),
         publicConfirmed: z2.boolean().optional().describe(
           "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
         ),
@@ -1488,13 +1453,8 @@ Next action: ${analysis.suggestedNextAction}`,
     async (args) => {
       try {
         const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {},
-          ...args.spaFallback !== void 0 ? { spaFallbackRequested: args.spaFallback } : {},
-          ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
         });
-        if (analysis.spa.confirmationRequired && args.spaFallbackConfirmed !== true) {
-          return spaConfirmationResult(analysis);
-        }
         if (!analysis.deployable || !analysis.files) {
           return notDeployableResult(analysis);
         }
@@ -1526,8 +1486,7 @@ Next action: ${analysis.suggestedNextAction}`,
           const created = await ctx.client.createSite({
             manifest,
             ...args.lang !== void 0 ? { lang: args.lang } : {},
-            spaFallback: args.spaFallback === true,
-            ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+            ...args.spaFallback !== void 0 ? { spaFallback: args.spaFallback } : {}
           });
           const uploaded2 = await uploadAll(ctx, created.uploadTargets, files, outputAbs);
           const finalized2 = await ctx.client.finalizeDeployment(
@@ -1571,8 +1530,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
           const req = {
             manifest,
             ...args.lang !== void 0 ? { lang: args.lang } : {},
-            spaFallback: args.spaFallback === true,
-            ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {},
+            ...args.spaFallback !== void 0 ? { spaFallback: args.spaFallback } : {},
             ...forceFullUpload ? { forceFullUpload: true } : {}
           };
           const deployment = await ctx.client.createDeployment(
@@ -1647,7 +1605,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
         return text(
           "site_refreshed",
           `Site validity refreshed. New expiry: ${res.expiresAt}
-Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refresh.`,
+NO content was uploaded or changed by this call \u2014 to publish new or edited files, run deploy_site. Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refresh.`,
           { siteId: site.siteId, expiresAt: res.expiresAt }
         );
       } catch (e) {
@@ -1698,7 +1656,7 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
         );
         return text(
           "subscription_checkout_ready",
-          `Stripe Checkout link \u2014 Sakupa Hosting for this site: ${res.plan} plan, \xA5${res.monthlyPriceJpy}/month
+          `Stripe Checkout link \u2014 Sakupa Hosting for this site: ${res.plan} plan, JPY ${res.monthlyPriceJpy}/month (Japanese yen)
 ${res.checkoutUrl}
 
 Open this link in a browser to subscribe. Card data is entered only on the Stripe-hosted page \u2014 never give card numbers, passwords or security codes to the AI tool.
@@ -1810,7 +1768,7 @@ Then run bind_domain again with verificationId: "${res.verificationId}" to check
         const lines = [
           `Billing status for site ${res.siteId} (mode: ${res.mode})`,
           res.permanentUrl ? `Permanent URL: ${res.permanentUrl}` : void 0,
-          res.plan ? `Plan: ${res.plan} (\xA5${res.monthlyPriceJpy ?? tierPriceJpy(res.plan)}/month)` : "Plan: (no subscription yet)",
+          res.plan ? `Plan: ${res.plan} (JPY ${res.monthlyPriceJpy ?? tierPriceJpy(res.plan)}/month)` : "Plan: (no subscription yet)",
           res.subscriptionStatus ? `Subscription payment state: ${res.subscriptionStatus}` : void 0,
           res.cancelAtPeriodEnd ? "Renewal: CANCELED \u2014 the site reverts to free at the end of the already-paid month" : void 0,
           res.currentPeriodStart ? `Current paid period: ${res.currentPeriodStart} -> ${res.currentPeriodEnd ?? "?"}` : void 0,
@@ -2393,6 +2351,16 @@ Safety boundaries:
 - Never upload source projects, secrets, .env files, private keys, archives, videos or audio.
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
+- Never repeat, echo, or memorize the credential value from .sakupa/site.json \u2014 quoting it
+  into the conversation copies the site's only key outside the protected local file. Read it
+  only through the tools.
+- Before deploying, if the entry HTML lacks a lang attribute, add one matching the content
+  language (infer it from the content) and then deploy; only skip when the user explicitly
+  wants no lang attribute.
+- Prices are authoritative in JPY (Japanese yen). When talking with a user in a language
+  other than Japanese, look up the approximate exchange rate and show an estimated local
+  price next to the JPY amount, clearly marked as an estimate \u2014 Stripe always settles the
+  real charge in JPY. Never show a bare Yen sign.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
   a bound custom domain, a lost credential is unrecoverable by design. manage_billing then opens
   Stripe's public no-code portal login, where the customer verifies the checkout email with a

package/dist/index.js

@@ -123,7 +123,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.5";
+var SAKUPA_MCP_VERSION = "0.7.7";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -402,22 +402,13 @@ function validateDeployableFiles(files, opts) {
           severity: "warning",
           code: "missing_html_lang",
           path: entryHtmlPath,
-          message: 'The entry HTML has no lang attribute. Add html lang="en" | "ja" | "zh-CN" so Sakupa surfaces match the site language.'
+          message: 'The entry HTML has no lang attribute. Before deploying, add one matching the content language (html lang="en" | "ja" | "zh-CN") \u2014 it drives screen-reader pronunciation and search-engine language detection, and Sakupa surfaces follow it.'
         });
       }
     }
   }
   const jsCount = files.filter((f) => ["js", "mjs"].includes(fileExtension(f.path))).length;
   const looksLikeSpa = htmlPaths.length === 1 && entryHtmlPath === "index.html" && jsCount > 0;
-  const wantsSpa = opts.spaFallbackRequested === true || looksLikeSpa;
-  const spaFallbackConfirmationRequired = wantsSpa && opts.spaFallbackConfirmed !== true;
-  if (opts.spaFallbackRequested === true && opts.spaFallbackConfirmed !== true) {
-    issues.push({
-      severity: "error",
-      code: "spa_fallback_confirmation_required",
-      message: "SPA fallback rewrites unknown paths to index.html and changes normal 404 behavior. It must be explicitly confirmed."
-    });
-  }
   const ok = issues.every((i) => i.severity !== "error");
   return {
     ok,
@@ -427,8 +418,7 @@ function validateDeployableFiles(files, opts) {
     entryHtmlPath,
     htmlLang,
     supportedLang,
-    looksLikeSpa,
-    spaFallbackConfirmationRequired
+    looksLikeSpa
   };
 }
 function safeDecode(bytes) {
@@ -1215,7 +1205,7 @@ async function analyzeProject(projectDir, opts = {}) {
       fileCount: 0,
       issues: [],
       ssrRisks,
-      spa: { looksLikeSpa: false, fallbackRecommended: false, confirmationRequired: false },
+      spa: { looksLikeSpa: false, autoFallback: false },
       deployable: false,
       suggestedNextAction: suggestedNextAction2
     };
@@ -1235,30 +1225,23 @@ async function analyzeProject(projectDir, opts = {}) {
     }
     candidates.push({ path: file.path, size: file.size, ...content ? { content } : {} });
   }
-  const validation = validateDeployableFiles(candidates, {
-    mode: "free",
-    ...opts.spaFallbackRequested !== void 0 ? { spaFallbackRequested: opts.spaFallbackRequested } : {},
-    ...opts.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: opts.spaFallbackConfirmed } : {}
-  });
+  const validation = validateDeployableFiles(candidates, { mode: "free" });
   ssrRisks.push(...serverAndDbDepRisks(pkg, true));
   const deployable = validation.ok && walked.length > 0;
   const spa = {
     looksLikeSpa: validation.looksLikeSpa,
-    fallbackRecommended: validation.looksLikeSpa,
-    confirmationRequired: validation.spaFallbackConfirmationRequired
+    autoFallback: validation.looksLikeSpa
   };
   let suggestedNextAction;
   if (!deployable) {
     const firstError = validation.issues.find((i) => i.severity === "error");
     if (firstError?.code === "missing_index_html") {
       suggestedNextAction = `No index.html at the root of "${outputDirRel}". Deploy the built static output (the directory whose root contains index.html), not the source project. Build locally first if needed (${buildCommandHint ?? "npm run build"}), then re-run analyze_site.`;
-    } else if (firstError?.code === "spa_fallback_confirmation_required") {
-      suggestedNextAction = "SPA fallback rewrites unknown paths to index.html and changes normal 404 behavior. Confirm it explicitly: re-run with spaFallbackRequested: true and spaFallbackConfirmed: true.";
     } else {
       suggestedNextAction = "Fix the listed issues (remove forbidden/secret files, reduce size, add missing entry HTML), then re-run analyze_site.";
     }
-  } else if (spa.confirmationRequired) {
-    suggestedNextAction = `The output in "${outputDirRel}" is deployable, but it looks like a single-page app. Decide about SPA fallback first: run deploy_site with spaFallback: true and spaFallbackConfirmed: true to enable it, or with spaFallbackConfirmed: true alone to deploy without fallback.`;
+  } else if (spa.looksLikeSpa) {
+    suggestedNextAction = `Run deploy_site to publish the static output in "${outputDirRel}". It looks like a single-page app, so SPA fallback (unknown paths rewrite to index.html) will be enabled automatically; pass spaFallback: false to opt out.`;
   } else {
     suggestedNextAction = `Run deploy_site to publish the static output in "${outputDirRel}".`;
   }
@@ -1357,7 +1340,8 @@ function toolError(e) {
       ([key, value]) => safeDetailKeys.has(key) && (typeof value === "string" || typeof value === "number" || typeof value === "boolean")
     )
   ) : void 0;
-  const safeSummary = errorCode === "not_found" ? "The required local project binding or resource is unavailable; if this project has no .sakupa/site.json yet, run deploy_site first." : errorCode === "unauthorized" ? "The server rejected the site credential: the one in .sakupa/site.json no longer matches the server-side verifier. The site itself is intact on the server \u2014 only the local binding file is the problem. Repair the file (restore a backup or undo the local edit). Do NOT delete the .sakupa directory to work around this: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site." : errorCode === "invalid_request" || errorCode === "validation_failed" ? "The request arguments or local project checks did not pass." : errorCode === "state_conflict" ? "The resource state has changed; re-query the current status before deciding the next step." : errorCode === "confirmation_required" ? "The site or billing state changed, so the previous confirmation is stale; run the preview again and confirm against the fresh snapshot." : errorCode === "payment_required" ? "This operation requires an active subscription; check billing_status first." : errorCode === "rate_limited" ? "The server rate limit was reached; retry after the returned wait time." : retryable ? "An upstream service is temporarily unavailable or busy; retry shortly." : "The operation failed; no server-internal details are exposed.";
+  const minimumVersion = rawDetails && typeof rawDetails["minimumVersion"] === "string" ? rawDetails["minimumVersion"] : void 0;
+  const safeSummary = errorCode === "upgrade_required" ? `This Sakupa MCP client is v${MCP_VERSION}, older than the server's minimum supported version${minimumVersion !== void 0 ? ` (v${minimumVersion})` : ""}, so the server refused the call. To fix it: ask the user to fully restart their MCP client session \u2014 "npx -y @sakupa/mcp@latest" setups fetch the current version on restart (run "npx clear-npx-cache" first if the old version persists); global installs need "npm install -g @sakupa/mcp@latest". After the restart, retry this exact tool call.` : errorCode === "not_found" ? "The required local project binding or resource is unavailable; if this project has no .sakupa/site.json yet, run deploy_site first." : errorCode === "unauthorized" ? "The server rejected the site credential: the one in .sakupa/site.json no longer matches the server-side verifier. The site itself is intact on the server \u2014 only the local binding file is the problem. Repair the file (restore a backup or undo the local edit). Do NOT delete the .sakupa directory to work around this: the credential is unrecoverable by design, so abandoning it permanently orphans the existing site." : errorCode === "invalid_request" || errorCode === "validation_failed" ? "The request arguments or local project checks did not pass." : errorCode === "state_conflict" ? "The resource state has changed; re-query the current status before deciding the next step." : errorCode === "confirmation_required" ? "The site or billing state changed, so the previous confirmation is stale; run the preview again and confirm against the fresh snapshot." : errorCode === "payment_required" ? "This operation requires an active subscription; check billing_status first." : errorCode === "rate_limited" ? "The server rate limit was reached; retry after the returned wait time." : retryable ? "An upstream service is temporarily unavailable or busy; retry shortly." : "The operation failed; no server-internal details are exposed.";
   const result = structuredToolResult({
     schemaVersion: 1,
     outcome: "failed",
@@ -1403,7 +1387,7 @@ ${JSON.stringify(obj, null, 2)}`;
 var planEnum = z2.enum(["water", "personal", "share", "business"]);
 var severityEnum = z2.enum(["low", "medium", "high", "critical"]);
 function planCatalog() {
-  return TIER_ORDER.map((p) => `${p} \xA5${tierPriceJpy(p)}/month`).join(", ");
+  return TIER_ORDER.map((p) => `${p} JPY ${tierPriceJpy(p)}/month`).join(", ");
 }
 var ticketCategoryEnum = z2.enum([
   "billing",
@@ -1431,22 +1415,6 @@ Analysis:`,
     "blocked"
   );
 }
-function spaConfirmationResult(analysis) {
-  return text(
-    "spa_fallback_confirmation_required",
-    `SPA fallback confirmation required \u2014 nothing was deployed yet.
-
-This site looks like a single-page application (one index.html plus JavaScript). SPA fallback rewrites every unknown path to index.html so client-side routes work, but it CHANGES normal 404 behavior: visitors never see a not-found page.
-
-Please ask the user to choose, then re-run deploy_site with:
-- spaFallback: true, spaFallbackConfirmed: true  -> enable SPA fallback
-- spaFallbackConfirmed: true (spaFallback omitted or false) -> deploy WITHOUT fallback (unknown paths return 404)
-
-Output directory: "${analysis.recommendedOutputDir ?? "."}", ${analysis.fileCount} files.`,
-    { analysis: analysisSummary(analysis), requestedConfirmation: "spa_fallback" },
-    "waiting_user"
-  );
-}
 var MB2 = 1024 * 1024;
 function ensureUploadSizeWithinLimits(manifest, isFirstFreeDeploy) {
   const oversized = manifest.find((f) => f.size > MAX_SINGLE_FILE_BYTES);
@@ -1508,17 +1476,13 @@ function registerTools(server, ctx) {
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
       inputSchema: {
-        outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection)."),
-        spaFallbackRequested: z2.boolean().optional().describe("User asked for SPA fallback (unknown paths rewritten to index.html)."),
-        spaFallbackConfirmed: z2.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change.")
+        outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection).")
       }
     },
     async (args) => {
       try {
         const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {},
-          ...args.spaFallbackRequested !== void 0 ? { spaFallbackRequested: args.spaFallbackRequested } : {},
-          ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
         });
         return textJson(
           "site_analysis_completed",
@@ -1539,8 +1503,9 @@ Next action: ${analysis.suggestedNextAction}`,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
         outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection)."),
-        spaFallback: z2.boolean().optional().describe("Enable SPA fallback (requires spaFallbackConfirmed: true)."),
-        spaFallbackConfirmed: z2.boolean().optional().describe("User explicitly confirmed the SPA fallback 404-behavior change."),
+        spaFallback: z2.boolean().optional().describe(
+          "Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the detected structure."
+        ),
         publicConfirmed: z2.boolean().optional().describe(
           "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
         ),
@@ -1550,13 +1515,8 @@ Next action: ${analysis.suggestedNextAction}`,
     async (args) => {
       try {
         const analysis = await analyzeProject(ctx.projectDir, {
-          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {},
-          ...args.spaFallback !== void 0 ? { spaFallbackRequested: args.spaFallback } : {},
-          ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+          ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
         });
-        if (analysis.spa.confirmationRequired && args.spaFallbackConfirmed !== true) {
-          return spaConfirmationResult(analysis);
-        }
         if (!analysis.deployable || !analysis.files) {
           return notDeployableResult(analysis);
         }
@@ -1588,8 +1548,7 @@ Next action: ${analysis.suggestedNextAction}`,
           const created = await ctx.client.createSite({
             manifest,
             ...args.lang !== void 0 ? { lang: args.lang } : {},
-            spaFallback: args.spaFallback === true,
-            ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {}
+            ...args.spaFallback !== void 0 ? { spaFallback: args.spaFallback } : {}
           });
           const uploaded2 = await uploadAll(ctx, created.uploadTargets, files, outputAbs);
           const finalized2 = await ctx.client.finalizeDeployment(
@@ -1633,8 +1592,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
           const req = {
             manifest,
             ...args.lang !== void 0 ? { lang: args.lang } : {},
-            spaFallback: args.spaFallback === true,
-            ...args.spaFallbackConfirmed !== void 0 ? { spaFallbackConfirmed: args.spaFallbackConfirmed } : {},
+            ...args.spaFallback !== void 0 ? { spaFallback: args.spaFallback } : {},
             ...forceFullUpload ? { forceFullUpload: true } : {}
           };
           const deployment = await ctx.client.createDeployment(
@@ -1709,7 +1667,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
         return text(
           "site_refreshed",
           `Site validity refreshed. New expiry: ${res.expiresAt}
-Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refresh.`,
+NO content was uploaded or changed by this call \u2014 to publish new or edited files, run deploy_site. Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refresh.`,
           { siteId: site.siteId, expiresAt: res.expiresAt }
         );
       } catch (e) {
@@ -1760,7 +1718,7 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
         );
         return text(
           "subscription_checkout_ready",
-          `Stripe Checkout link \u2014 Sakupa Hosting for this site: ${res.plan} plan, \xA5${res.monthlyPriceJpy}/month
+          `Stripe Checkout link \u2014 Sakupa Hosting for this site: ${res.plan} plan, JPY ${res.monthlyPriceJpy}/month (Japanese yen)
 ${res.checkoutUrl}
 
 Open this link in a browser to subscribe. Card data is entered only on the Stripe-hosted page \u2014 never give card numbers, passwords or security codes to the AI tool.
@@ -1872,7 +1830,7 @@ Then run bind_domain again with verificationId: "${res.verificationId}" to check
         const lines = [
           `Billing status for site ${res.siteId} (mode: ${res.mode})`,
           res.permanentUrl ? `Permanent URL: ${res.permanentUrl}` : void 0,
-          res.plan ? `Plan: ${res.plan} (\xA5${res.monthlyPriceJpy ?? tierPriceJpy(res.plan)}/month)` : "Plan: (no subscription yet)",
+          res.plan ? `Plan: ${res.plan} (JPY ${res.monthlyPriceJpy ?? tierPriceJpy(res.plan)}/month)` : "Plan: (no subscription yet)",
           res.subscriptionStatus ? `Subscription payment state: ${res.subscriptionStatus}` : void 0,
           res.cancelAtPeriodEnd ? "Renewal: CANCELED \u2014 the site reverts to free at the end of the already-paid month" : void 0,
           res.currentPeriodStart ? `Current paid period: ${res.currentPeriodStart} -> ${res.currentPeriodEnd ?? "?"}` : void 0,
@@ -2386,6 +2344,16 @@ Safety boundaries:
 - Never upload source projects, secrets, .env files, private keys, archives, videos or audio.
 - Payment card data is entered only on Stripe-hosted pages \u2014 never through the AI tool.
 - A subscription never grants domain ownership; only DNS verification does.
+- Never repeat, echo, or memorize the credential value from .sakupa/site.json \u2014 quoting it
+  into the conversation copies the site's only key outside the protected local file. Read it
+  only through the tools.
+- Before deploying, if the entry HTML lacks a lang attribute, add one matching the content
+  language (infer it from the content) and then deploy; only skip when the user explicitly
+  wants no lang attribute.
+- Prices are authoritative in JPY (Japanese yen). When talking with a user in a language
+  other than Japanese, look up the approximate exchange rate and show an estimated local
+  price next to the JPY amount, clearly marked as an estimate \u2014 Stripe always settles the
+  real charge in JPY. Never show a bare Yen sign.
 - The management credential lives only in .sakupa/site.json; never share or upload it. Without
   a bound custom domain, a lost credential is unrecoverable by design. manage_billing then opens
   Stripe's public no-code portal login, where the customer verifies the checkout email with a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",