@sakupa/mcp 0.7.53 → 0.7.55

package/dist/bin.js

@@ -402,7 +402,7 @@ function isFreeSiteAllowanceNetworkReference(value) {
 }
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.53";
+var SAKUPA_MCP_VERSION = "0.7.55";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -4820,7 +4820,7 @@ Once Stripe confirms payment and Sakupa synchronizes the subscription, the curre
   server.registerTool(
     "bind",
     {
-      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the subscription-backed ${previewHostPattern} URL keeps working alongside it while the subscription is active. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both, and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and subscription-backed Sakupa URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the subscription-backed ${previewHostPattern} URL keeps working alongside it while the subscription is active. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both. A site has one FINAL apex domain; starting a different apex begins a zero-downtime switch and the previous domain remains until the new www is live. The www CNAME must remain while bound. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and subscription-backed Sakupa URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -4850,12 +4850,15 @@ Once Stripe confirms payment and Sakupa synchronizes the subscription, the curre
             provisioning: res2.bindingStatus === "provisioning"
           });
           const { apexResolves, allOk } = diag;
+          const manualProviderRecheckRequired = res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns";
+          const customerRecheckInstruction = `The customer cannot know whether the certificate is ready. Never use conditional readiness wording or ask the customer to decide the provider state. Tell the customer: "You do not need to judge readiness. After about one minute, reply: check domain status. I will check it once." The AI, not the customer, calls bind status exactly once. During this zero-downtime transition, the previously active domain may still serve. Once this binding becomes active, Sakupa retains only the last bound domain unit: ${apex2} and www.${apex2}.`;
           return text(
             res2.bindingStatus === "active" ? "domain_binding_active" : res2.bindingStatus === "provisioning" ? "domain_binding_provisioning" : "domain_verification_pending",
             `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
+The serving CNAME www.${apex2} \u2192 ${res2.servingTarget} must remain for as long as this domain is bound.` + (manualProviderRecheckRequired ? `
 
-` + renderChecklistBlock(
+${customerRecheckInstruction}` : "") + "\n\n" + renderChecklistBlock(
               diag,
               "Fix any [MISSING]/[FIX] lines above, then re-run bind status; if still failing after the attempts below, show the user this checklist."
             ),
@@ -4871,12 +4874,19 @@ ${res2.message}
               apexResolves,
               apexRequired: false,
               requiredServingHostname: `www.${apex2}`,
+              requiredCnameMustRemainWhileBound: true,
               optionalApexHostname: apex2,
               automaticRetries: 0,
               manualRecheckOnly: true,
               backgroundRetry: false,
-              manualStatusCheckRequired: res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns",
-              suggestedRecheckAfterSeconds: res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns" ? 60 : void 0,
+              manualStatusCheckRequired: manualProviderRecheckRequired,
+              suggestedRecheckAfterSeconds: manualProviderRecheckRequired ? 60 : void 0,
+              customerReadinessJudgmentRequired: false,
+              customerReplyIntent: manualProviderRecheckRequired ? "check_domain_status" : void 0,
+              customerInstruction: manualProviderRecheckRequired ? customerRecheckInstruction : void 0,
+              transitionMayServePreviousDomain: manualProviderRecheckRequired,
+              finalActiveBindingExclusive: true,
+              postActivationRetainedHostnames: [apex2, `www.${apex2}`],
               customerLiveConfirmed: res2.bindingStatus === "active",
               message: res2.message
             },
@@ -4916,13 +4926,14 @@ STEP 1 of 2 \u2014 prove ownership. Add ONE record:
 
 Host is the SHORT form: most panels append the domain automatically (the saved record must NOT show ${apex} twice in one name). Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
+When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). That CNAME must remain for as long as the domain stays bound to Sakupa. Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
             apexDomain: apex,
             includedHostnames: res.includedHostnames,
             apexRequired: false,
             requiredServingHostname: `www.${apex}`,
+            requiredCnameMustRemainWhileBound: true,
             optionalApexHostname: apex,
             verificationRecord: res.verificationRecord,
             servingTarget: res.servingTarget,
@@ -5760,7 +5771,12 @@ var TOOL_MANUALS = {
     preconditions: "A subscribed site and DNS control.",
     parameterNames: ["action", "hostname", "verificationId"],
     parameters: "Action plus hostname or verificationId as returned by the prior step.",
-    warnings: ["www is mandatory; the apex is optional.", "Copy DNS values verbatim."],
+    warnings: [
+      "www is mandatory; the apex is optional.",
+      "Copy DNS values verbatim.",
+      "The www CNAME must remain for as long as the domain stays bound; only the ownership TXT is temporary.",
+      "If the domain already belongs to this site, use bind status instead of starting a new challenge."
+    ],
     nextStep: "Follow the returned DNS checklist and call bind status/check."
   },
   billing: {

package/dist/index.js

@@ -147,7 +147,7 @@ function isFreeSiteAllowanceNetworkReference(value) {
 }
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.53";
+var SAKUPA_MCP_VERSION = "0.7.55";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -4936,7 +4936,7 @@ Once Stripe confirms payment and Sakupa synchronizes the subscription, the curre
   server.registerTool(
     "bind",
     {
-      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the subscription-backed ${previewHostPattern} URL keeps working alongside it while the subscription is active. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both, and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and subscription-backed Sakupa URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the subscription-backed ${previewHostPattern} URL keeps working alongside it while the subscription is active. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both. A site has one FINAL apex domain; starting a different apex begins a zero-downtime switch and the previous domain remains until the new www is live. The www CNAME must remain while bound. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and subscription-backed Sakupa URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -4966,12 +4966,15 @@ Once Stripe confirms payment and Sakupa synchronizes the subscription, the curre
             provisioning: res2.bindingStatus === "provisioning"
           });
           const { apexResolves, allOk } = diag;
+          const manualProviderRecheckRequired = res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns";
+          const customerRecheckInstruction = `The customer cannot know whether the certificate is ready. Never use conditional readiness wording or ask the customer to decide the provider state. Tell the customer: "You do not need to judge readiness. After about one minute, reply: check domain status. I will check it once." The AI, not the customer, calls bind status exactly once. During this zero-downtime transition, the previously active domain may still serve. Once this binding becomes active, Sakupa retains only the last bound domain unit: ${apex2} and www.${apex2}.`;
           return text(
             res2.bindingStatus === "active" ? "domain_binding_active" : res2.bindingStatus === "provisioning" ? "domain_binding_provisioning" : "domain_verification_pending",
             `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
+The serving CNAME www.${apex2} \u2192 ${res2.servingTarget} must remain for as long as this domain is bound.` + (manualProviderRecheckRequired ? `
 
-` + renderChecklistBlock(
+${customerRecheckInstruction}` : "") + "\n\n" + renderChecklistBlock(
               diag,
               "Fix any [MISSING]/[FIX] lines above, then re-run bind status; if still failing after the attempts below, show the user this checklist."
             ),
@@ -4987,12 +4990,19 @@ ${res2.message}
               apexResolves,
               apexRequired: false,
               requiredServingHostname: `www.${apex2}`,
+              requiredCnameMustRemainWhileBound: true,
               optionalApexHostname: apex2,
               automaticRetries: 0,
               manualRecheckOnly: true,
               backgroundRetry: false,
-              manualStatusCheckRequired: res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns",
-              suggestedRecheckAfterSeconds: res2.bindingStatus === "provisioning" && res2.provisioningPhase !== "waiting_dns" ? 60 : void 0,
+              manualStatusCheckRequired: manualProviderRecheckRequired,
+              suggestedRecheckAfterSeconds: manualProviderRecheckRequired ? 60 : void 0,
+              customerReadinessJudgmentRequired: false,
+              customerReplyIntent: manualProviderRecheckRequired ? "check_domain_status" : void 0,
+              customerInstruction: manualProviderRecheckRequired ? customerRecheckInstruction : void 0,
+              transitionMayServePreviousDomain: manualProviderRecheckRequired,
+              finalActiveBindingExclusive: true,
+              postActivationRetainedHostnames: [apex2, `www.${apex2}`],
               customerLiveConfirmed: res2.bindingStatus === "active",
               message: res2.message
             },
@@ -5032,13 +5042,14 @@ STEP 1 of 2 \u2014 prove ownership. Add ONE record:
 
 Host is the SHORT form: most panels append the domain automatically (the saved record must NOT show ${apex} twice in one name). Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
+When the user says the TXT is set, run bind "status". It verifies ownership and then hands back STEP 2 \u2014 a SINGLE www CNAME (there are NO certificate TXT records; HTTPS validates automatically over that CNAME). That CNAME must remain for as long as the domain stays bound to Sakupa. Each "status" checks the previous step and, unless something is misconfigured, advances to the next \u2014 so run it whenever the user reports a step done, NOT on a timer. Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
             apexDomain: apex,
             includedHostnames: res.includedHostnames,
             apexRequired: false,
             requiredServingHostname: `www.${apex}`,
+            requiredCnameMustRemainWhileBound: true,
             optionalApexHostname: apex,
             verificationRecord: res.verificationRecord,
             servingTarget: res.servingTarget,
@@ -5879,7 +5890,12 @@ var TOOL_MANUALS = {
     preconditions: "A subscribed site and DNS control.",
     parameterNames: ["action", "hostname", "verificationId"],
     parameters: "Action plus hostname or verificationId as returned by the prior step.",
-    warnings: ["www is mandatory; the apex is optional.", "Copy DNS values verbatim."],
+    warnings: [
+      "www is mandatory; the apex is optional.",
+      "Copy DNS values verbatim.",
+      "The www CNAME must remain for as long as the domain stays bound; only the ownership TXT is temporary.",
+      "If the domain already belongs to this site, use bind status instead of starting a new challenge."
+    ],
     nextStep: "Follow the returned DNS checklist and call bind status/check."
   },
   billing: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.53",
+  "version": "0.7.55",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",