@sakupa/mcp 0.7.8 → 0.7.10

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.8";
+var SAKUPA_MCP_VERSION = "0.7.10";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -458,10 +458,10 @@ var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 // src/config.ts
 var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
-  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+  return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
 function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
-  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
   const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
@@ -479,6 +479,9 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
   }
   return { apiBaseUrl, projectDir };
 }
+function environmentFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
+}
 
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -591,11 +594,14 @@ var HttpApiClient = class {
   async bindDomain(credential, req) {
     return this.call("POST", "/v1/domains/bind", { credential, body: req });
   }
-  async checkVerification(verificationId, credential) {
+  async checkVerification(verificationId, credential, latestForSiteId) {
     return this.call(
       "POST",
       `/v1/domains/verifications/${encodeURIComponent(verificationId)}/check`,
-      { credential }
+      {
+        credential,
+        ...latestForSiteId !== void 0 ? { body: { siteId: latestForSiteId } } : {}
+      }
     );
   }
   async unbindDomain(siteId, credential, req) {
@@ -1248,6 +1254,131 @@ function removeCreation(siteId) {
   if (rest.length !== all.length) writeAll(rest);
 }
 
+// src/dns-doh.ts
+var dohFetch = (input, init) => fetch(input, init);
+var TYPE_CODES = { TXT: 16, CNAME: 5, A: 1 };
+async function resolveDns(name, type) {
+  const endpoints = [
+    `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=${type}`,
+    `https://dns.google/resolve?name=${encodeURIComponent(name)}&type=${type}`
+  ];
+  for (const url of endpoints) {
+    try {
+      const res = await dohFetch(url, { headers: { accept: "application/dns-json" } });
+      if (!res.ok) continue;
+      const body = await res.json();
+      return (body.Answer ?? []).filter((a) => a.type === TYPE_CODES[type]).map((a) => a.data.replace(/^"|"$/g, "").replace(/"\s+"/g, "")).map((v) => type === "CNAME" ? v.replace(/\.$/, "").toLowerCase() : v);
+    } catch {
+    }
+  }
+  return [];
+}
+function shortHostFor(fullName, apexDomain) {
+  const suffix = `.${apexDomain}`;
+  if (fullName === apexDomain) return "@";
+  return fullName.endsWith(suffix) ? fullName.slice(0, -suffix.length) : fullName;
+}
+function matches(record, values) {
+  if (record.type === "CNAME") {
+    const want = record.value.replace(/\.$/, "").toLowerCase();
+    return values.some((v) => v === want);
+  }
+  return values.includes(record.value);
+}
+async function checkRecord(record, apexDomain) {
+  const shortHost = shortHostFor(record.name, apexDomain);
+  const found = await resolveDns(record.name, record.type);
+  if (matches(record, found)) {
+    return { record, shortHost, state: "ok", found, fix: "" };
+  }
+  const doubled = await resolveDns(`${record.name}.${apexDomain}`, record.type);
+  if (matches(record, doubled)) {
+    return {
+      record,
+      shortHost,
+      state: "double_domain",
+      found: doubled,
+      fix: `The record exists at ${record.name}.${apexDomain} \u2014 the host field was filled with the full name and your DNS panel appended ${apexDomain} again. Edit that record's host to exactly: ${shortHost}`
+    };
+  }
+  if (found.length > 0) {
+    return {
+      record,
+      shortHost,
+      state: "wrong_value",
+      found,
+      fix: `A ${record.type} record exists at ${record.name} but its value is ${JSON.stringify(found)} instead of "${record.value}". Update the value exactly.`
+    };
+  }
+  return {
+    record,
+    shortHost,
+    state: "missing",
+    found,
+    fix: `Create it now \u2014 type: ${record.type}, host: ${shortHost} (most panels append .${apexDomain} automatically; if yours wants the full name use ${record.name}), value: ${record.value}`
+  };
+}
+function renderCheck(c) {
+  const label = `${c.record.type} ${c.shortHost}`;
+  switch (c.state) {
+    case "ok":
+      return `  [OK] ${label} \u2014 live on public DNS.`;
+    case "double_domain":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "wrong_value":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "missing":
+      return `  [MISSING] ${label} \u2014 ${c.fix}`;
+  }
+}
+async function diagnoseBinding(input) {
+  const apex = input.apexDomain;
+  const byKey = /* @__PURE__ */ new Map();
+  if (input.verificationRecord) {
+    byKey.set(`TXT:${input.verificationRecord.name}`, input.verificationRecord);
+  }
+  const www = {
+    name: `www.${apex}`,
+    type: "CNAME",
+    value: input.servingTarget
+  };
+  byKey.set(`CNAME:${www.name}`, www);
+  for (const rec of input.pendingDnsRecords) {
+    const key = `${rec.type}:${rec.name}`;
+    if (!byKey.has(key)) byKey.set(key, rec);
+  }
+  const [checks, apexAnswers] = await Promise.all([
+    Promise.all([...byKey.values()].map((rec) => checkRecord(rec, apex))),
+    resolveDns(apex, "A")
+  ]);
+  const apexResolves = apexAnswers.length > 0;
+  const allOk = checks.every((c) => c.state === "ok");
+  const checklist = checks.map(renderCheck).join("\n") + `
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet: point it at ${input.servingTarget} using your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  return { checks, apexResolves, allOk, checklist, layers };
+}
+var DNS_RETRY_AFTER_SECONDS = 300;
+var DNS_MAX_ATTEMPTS = 10;
+function toDnsChecklist(checks) {
+  return checks.map((c) => ({
+    name: c.record.name,
+    type: c.record.type,
+    shortHost: c.shortHost,
+    state: c.state,
+    ...c.fix ? { fix: c.fix } : {}
+  }));
+}
+function renderChecklistBlock(diag, fixTail) {
+  const cadence = `Re-check every ${DNS_RETRY_AFTER_SECONDS / 60} minutes, up to ${DNS_MAX_ATTEMPTS} times.`;
+  return `Live DNS checklist (host values are the SHORT panel form):
+${diag.checklist}
+
+${diag.layers}
+
+` + (diag.allOk ? "All records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
+}
+
 // src/version.ts
 var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
@@ -1498,6 +1629,38 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   }
   return targets.length;
 }
+async function describePendingBinding(client, credential, pb) {
+  const framing = `
+Domain binding IN PROGRESS: ${pb.apexDomain} \u2014 ` + (pb.phase === "provisioning" ? "ownership verified; certificates/serving are provisioning." : `awaiting DNS verification (challenge valid until ${pb.verificationExpiresAt}).`);
+  let check;
+  try {
+    check = await client.checkVerification(pb.verificationId, credential);
+  } catch {
+    return {
+      note: framing + "\n(Couldn't refresh binding progress from the server just now \u2014 try site_status again shortly.)"
+    };
+  }
+  try {
+    const diag = await diagnoseBinding({
+      apexDomain: check.apexDomain,
+      servingTarget: check.servingTarget,
+      ...check.verificationRecord ? { verificationRecord: check.verificationRecord } : {},
+      pendingDnsRecords: check.pendingDnsRecords,
+      verificationStatus: check.status,
+      provisioning: pb.phase === "provisioning"
+    });
+    const block = renderChecklistBlock(
+      diag,
+      "Relay every [MISSING]/[FIX] line to the user with its exact fix."
+    );
+    return { note: `${framing}
+${block}`, checklist: toDnsChecklist(diag.checks) };
+  } catch {
+    return {
+      note: framing + '\n(Live DNS lookups are unavailable right now \u2014 run bind_domain with action "status" for the per-record checklist.)'
+    };
+  }
+}
 function freeSiteCreationBarrier() {
   const recent = listRecentCreations(Date.now());
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -1628,6 +1791,7 @@ Next action: ${analysis.suggestedNextAction}`,
           return text(
             "site_published",
             `Site published: ${finalized2.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
@@ -1647,7 +1811,8 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
               totalBytes: finalized2.totalBytes,
               warnings: finalized2.warnings,
               credentialStoredLocally: true,
-              projectDir: ctx.projectDir
+              projectDir: ctx.projectDir,
+              environment: environmentFor(ctx.apiBaseUrl)
             }
           );
         }
@@ -1693,6 +1858,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         return text(
           "site_updated",
           `Site updated: ${finalized.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
@@ -1706,6 +1872,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             url: finalized.url,
             mode: finalized.mode,
             projectDir: ctx.projectDir,
+            environment: environmentFor(ctx.apiBaseUrl),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
@@ -1754,9 +1921,11 @@ NO content was uploaded or changed by this call \u2014 to publish new or edited
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.getSiteStatus(site.siteId, site.credential);
-        return textJson("site_status_returned", "Site status:", {
+        const binding = res.pendingDomainBinding ? await describePendingBinding(ctx.client, site.credential, res.pendingDomainBinding) : void 0;
+        return textJson("site_status_returned", `Site status:${binding?.note ?? ""}`, {
           ...res,
-          projectDir: ctx.projectDir
+          projectDir: ctx.projectDir,
+          ...binding?.checklist ? { dnsChecklist: binding.checklist } : {}
         });
       } catch (e) {
         return toolError(e);
@@ -1820,7 +1989,9 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         projectDir: projectDirInput,
         action: z3.enum(["start", "status"]),
         hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe("Required for status.")
+        verificationId: z3.string().optional().describe(
+          "Optional for status: when omitted, the server finds this site's latest binding verification \u2014 a NEW session can resume without it."
+        )
       }
     },
     async (args) => {
@@ -1828,30 +1999,42 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
-          if (!args.verificationId) {
-            throw new SakupaError("invalid_request", "verificationId is required for status");
-          }
-          const res2 = await ctx.client.checkVerification(args.verificationId, site.credential);
+          const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
           if (res2.status === "verified") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
+          const apex2 = res2.apexDomain;
+          const diag = await diagnoseBinding({
+            apexDomain: apex2,
+            servingTarget: res2.servingTarget,
+            ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
+            pendingDnsRecords: res2.pendingDnsRecords,
+            verificationStatus: res2.status,
+            provisioning: res2.provisioningJobId !== void 0
+          });
+          const { apexResolves, allOk } = diag;
           return text(
             res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
-            `DNS verification ${res2.verificationId}: ${res2.status}
+            `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
-` : "") + (res2.pendingDnsRecords.length > 0 ? `
-DNS records still required:
-${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
+
+` + renderChecklistBlock(
+              diag,
+              "Fix any [MISSING]/[FIX] lines above, then re-run bind_domain status; if still failing after the attempts below, show the user this checklist."
+            ),
             {
               verificationId: res2.verificationId,
               status: res2.status,
-              apexDomain: res2.apexDomain,
+              apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
-              pendingDnsRecords: res2.pendingDnsRecords,
+              servingTarget: res2.servingTarget,
+              dnsChecklist: toDnsChecklist(diag.checks),
+              apexResolves,
+              retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+              maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "completed" : "pending_provider"
+            res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -1862,25 +2045,42 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
+        const apex = res.apexDomain;
+        const txtShort = shortHostFor(res.verificationRecord.name, apex);
         return text(
           "domain_verification_started",
-          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+          `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
 
-1. Prove control of ${res.apexDomain} by creating this DNS record:
-   name:  ${res.verificationRecord.name}
-   type:  ${res.verificationRecord.type}
-   value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
+Add ALL THREE DNS records NOW (adding them together lets verification, certificate issuance and serving complete without further record changes):
 
-2. Serving DNS (after verification): ${res.servingInstructions}
+  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
+  2) CNAME  host: www   value: ${res.servingTarget}
+  3) APEX   host: @   -> ${res.servingTarget} via your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).
 
-Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`,
+Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
+
+Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+
+Then run bind_domain with action "status" \u2014 it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
-            apexDomain: res.apexDomain,
+            apexDomain: apex,
             includedHostnames: res.includedHostnames,
             verificationRecord: res.verificationRecord,
-            servingInstructions: res.servingInstructions
+            servingTarget: res.servingTarget,
+            requiredRecords: [
+              {
+                type: "TXT",
+                shortHost: txtShort,
+                name: res.verificationRecord.name,
+                value: res.verificationRecord.value
+              },
+              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
+              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+            ],
+            servingInstructions: res.servingInstructions,
+            retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+            maxAttempts: DNS_MAX_ATTEMPTS
           },
           "waiting_user"
         );
@@ -2136,6 +2336,12 @@ ${res.archiveUrl}`,
         deploymentId: z3.string().optional(),
         severity: severityEnum.optional(),
         description: z3.string().optional().describe("What happened, in the user's words (no secrets)."),
+        agentContext: z3.string().optional().describe(
+          "YOUR OWN factual account of the session as the AI: which tools you called, what they returned, expected vs actual. Write it yourself from your observations \u2014 never ask the user to compose it, and do not read it back to them; it travels alongside the user's description as a second witness. No secrets, no file contents."
+        ),
+        contactEmail: z3.string().optional().describe(
+          "OPTIONAL. Before submitting, ask the user ONCE whether they want to leave a contact for follow-up. Omit entirely if they decline \u2014 never require it."
+        ),
         confirmSubmit: z3.boolean().optional().describe("User reviewed the report payload and approved submission.")
       }
     },
@@ -2160,7 +2366,9 @@ ${res.archiveUrl}`,
           ...site ? { siteId: site.siteId } : {},
           ...args.severity !== void 0 ? { severity: args.severity } : {},
           diagnostics,
-          ...args.description !== void 0 ? { description: args.description } : {}
+          ...args.description !== void 0 ? { description: args.description } : {},
+          ...args.agentContext !== void 0 ? { agentContext: args.agentContext } : {},
+          ...args.contactEmail !== void 0 ? { contactEmail: args.contactEmail } : {}
         };
         if (args.confirmSubmit !== true) {
           return textJson(
@@ -2503,7 +2711,9 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
 the directory the user is currently working in, on every call. Without it the server falls
 back to its startup directory, which may be a different project than the one the user is
-looking at. analyze_site, deploy_site, site_status, refresh_site, delete_site and unbind_domain echo
+looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+Explicit Environment line: TEST vs PRODUCTION). analyze_site, deploy_site, site_status,
+refresh_site, delete_site and unbind_domain echo
 the directory they acted on \u2014 verify it matches the user's active project.
 
 Safety boundaries:

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.8";
+var SAKUPA_MCP_VERSION = "0.7.10";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -457,10 +457,10 @@ var CLIENT_TYPE = "sakupa-mcp";
 // src/config.ts
 var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
-  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+  return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
 function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
-  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
   const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
@@ -478,6 +478,9 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
   }
   return { apiBaseUrl, projectDir };
 }
+function environmentFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
+}
 
 // src/transport.ts
 var FetchTransport = class {
@@ -659,11 +662,14 @@ var HttpApiClient = class {
   async bindDomain(credential, req) {
     return this.call("POST", "/v1/domains/bind", { credential, body: req });
   }
-  async checkVerification(verificationId, credential) {
+  async checkVerification(verificationId, credential, latestForSiteId) {
     return this.call(
       "POST",
       `/v1/domains/verifications/${encodeURIComponent(verificationId)}/check`,
-      { credential }
+      {
+        credential,
+        ...latestForSiteId !== void 0 ? { body: { siteId: latestForSiteId } } : {}
+      }
     );
   }
   async unbindDomain(siteId, credential, req) {
@@ -1456,6 +1462,131 @@ function removeCreation(siteId) {
   if (rest.length !== all.length) writeAll(rest);
 }
 
+// src/dns-doh.ts
+var dohFetch = (input, init) => fetch(input, init);
+var TYPE_CODES = { TXT: 16, CNAME: 5, A: 1 };
+async function resolveDns(name, type) {
+  const endpoints = [
+    `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=${type}`,
+    `https://dns.google/resolve?name=${encodeURIComponent(name)}&type=${type}`
+  ];
+  for (const url of endpoints) {
+    try {
+      const res = await dohFetch(url, { headers: { accept: "application/dns-json" } });
+      if (!res.ok) continue;
+      const body = await res.json();
+      return (body.Answer ?? []).filter((a) => a.type === TYPE_CODES[type]).map((a) => a.data.replace(/^"|"$/g, "").replace(/"\s+"/g, "")).map((v) => type === "CNAME" ? v.replace(/\.$/, "").toLowerCase() : v);
+    } catch {
+    }
+  }
+  return [];
+}
+function shortHostFor(fullName, apexDomain) {
+  const suffix = `.${apexDomain}`;
+  if (fullName === apexDomain) return "@";
+  return fullName.endsWith(suffix) ? fullName.slice(0, -suffix.length) : fullName;
+}
+function matches(record, values) {
+  if (record.type === "CNAME") {
+    const want = record.value.replace(/\.$/, "").toLowerCase();
+    return values.some((v) => v === want);
+  }
+  return values.includes(record.value);
+}
+async function checkRecord(record, apexDomain) {
+  const shortHost = shortHostFor(record.name, apexDomain);
+  const found = await resolveDns(record.name, record.type);
+  if (matches(record, found)) {
+    return { record, shortHost, state: "ok", found, fix: "" };
+  }
+  const doubled = await resolveDns(`${record.name}.${apexDomain}`, record.type);
+  if (matches(record, doubled)) {
+    return {
+      record,
+      shortHost,
+      state: "double_domain",
+      found: doubled,
+      fix: `The record exists at ${record.name}.${apexDomain} \u2014 the host field was filled with the full name and your DNS panel appended ${apexDomain} again. Edit that record's host to exactly: ${shortHost}`
+    };
+  }
+  if (found.length > 0) {
+    return {
+      record,
+      shortHost,
+      state: "wrong_value",
+      found,
+      fix: `A ${record.type} record exists at ${record.name} but its value is ${JSON.stringify(found)} instead of "${record.value}". Update the value exactly.`
+    };
+  }
+  return {
+    record,
+    shortHost,
+    state: "missing",
+    found,
+    fix: `Create it now \u2014 type: ${record.type}, host: ${shortHost} (most panels append .${apexDomain} automatically; if yours wants the full name use ${record.name}), value: ${record.value}`
+  };
+}
+function renderCheck(c) {
+  const label = `${c.record.type} ${c.shortHost}`;
+  switch (c.state) {
+    case "ok":
+      return `  [OK] ${label} \u2014 live on public DNS.`;
+    case "double_domain":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "wrong_value":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "missing":
+      return `  [MISSING] ${label} \u2014 ${c.fix}`;
+  }
+}
+async function diagnoseBinding(input) {
+  const apex = input.apexDomain;
+  const byKey = /* @__PURE__ */ new Map();
+  if (input.verificationRecord) {
+    byKey.set(`TXT:${input.verificationRecord.name}`, input.verificationRecord);
+  }
+  const www = {
+    name: `www.${apex}`,
+    type: "CNAME",
+    value: input.servingTarget
+  };
+  byKey.set(`CNAME:${www.name}`, www);
+  for (const rec of input.pendingDnsRecords) {
+    const key = `${rec.type}:${rec.name}`;
+    if (!byKey.has(key)) byKey.set(key, rec);
+  }
+  const [checks, apexAnswers] = await Promise.all([
+    Promise.all([...byKey.values()].map((rec) => checkRecord(rec, apex))),
+    resolveDns(apex, "A")
+  ]);
+  const apexResolves = apexAnswers.length > 0;
+  const allOk = checks.every((c) => c.state === "ok");
+  const checklist = checks.map(renderCheck).join("\n") + `
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet: point it at ${input.servingTarget} using your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  return { checks, apexResolves, allOk, checklist, layers };
+}
+var DNS_RETRY_AFTER_SECONDS = 300;
+var DNS_MAX_ATTEMPTS = 10;
+function toDnsChecklist(checks) {
+  return checks.map((c) => ({
+    name: c.record.name,
+    type: c.record.type,
+    shortHost: c.shortHost,
+    state: c.state,
+    ...c.fix ? { fix: c.fix } : {}
+  }));
+}
+function renderChecklistBlock(diag, fixTail) {
+  const cadence = `Re-check every ${DNS_RETRY_AFTER_SECONDS / 60} minutes, up to ${DNS_MAX_ATTEMPTS} times.`;
+  return `Live DNS checklist (host values are the SHORT panel form):
+${diag.checklist}
+
+${diag.layers}
+
+` + (diag.allOk ? "All records are live; certificate issuance completes automatically \u2014 re-check in a few minutes until the binding is active." : `${fixTail} ${cadence}`);
+}
+
 // src/tools/definitions.ts
 function text(resultCode, t, data = {}, outcome = "completed") {
   return structuredToolResult({
@@ -1562,6 +1693,38 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   }
   return targets.length;
 }
+async function describePendingBinding(client, credential, pb) {
+  const framing = `
+Domain binding IN PROGRESS: ${pb.apexDomain} \u2014 ` + (pb.phase === "provisioning" ? "ownership verified; certificates/serving are provisioning." : `awaiting DNS verification (challenge valid until ${pb.verificationExpiresAt}).`);
+  let check;
+  try {
+    check = await client.checkVerification(pb.verificationId, credential);
+  } catch {
+    return {
+      note: framing + "\n(Couldn't refresh binding progress from the server just now \u2014 try site_status again shortly.)"
+    };
+  }
+  try {
+    const diag = await diagnoseBinding({
+      apexDomain: check.apexDomain,
+      servingTarget: check.servingTarget,
+      ...check.verificationRecord ? { verificationRecord: check.verificationRecord } : {},
+      pendingDnsRecords: check.pendingDnsRecords,
+      verificationStatus: check.status,
+      provisioning: pb.phase === "provisioning"
+    });
+    const block = renderChecklistBlock(
+      diag,
+      "Relay every [MISSING]/[FIX] line to the user with its exact fix."
+    );
+    return { note: `${framing}
+${block}`, checklist: toDnsChecklist(diag.checks) };
+  } catch {
+    return {
+      note: framing + '\n(Live DNS lookups are unavailable right now \u2014 run bind_domain with action "status" for the per-record checklist.)'
+    };
+  }
+}
 function freeSiteCreationBarrier() {
   const recent = listRecentCreations(Date.now());
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -1692,6 +1855,7 @@ Next action: ${analysis.suggestedNextAction}`,
           return text(
             "site_published",
             `Site published: ${finalized2.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
@@ -1711,7 +1875,8 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
               totalBytes: finalized2.totalBytes,
               warnings: finalized2.warnings,
               credentialStoredLocally: true,
-              projectDir: ctx.projectDir
+              projectDir: ctx.projectDir,
+              environment: environmentFor(ctx.apiBaseUrl)
             }
           );
         }
@@ -1757,6 +1922,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         return text(
           "site_updated",
           `Site updated: ${finalized.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
@@ -1770,6 +1936,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             url: finalized.url,
             mode: finalized.mode,
             projectDir: ctx.projectDir,
+            environment: environmentFor(ctx.apiBaseUrl),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
@@ -1818,9 +1985,11 @@ NO content was uploaded or changed by this call \u2014 to publish new or edited
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.getSiteStatus(site.siteId, site.credential);
-        return textJson("site_status_returned", "Site status:", {
+        const binding = res.pendingDomainBinding ? await describePendingBinding(ctx.client, site.credential, res.pendingDomainBinding) : void 0;
+        return textJson("site_status_returned", `Site status:${binding?.note ?? ""}`, {
           ...res,
-          projectDir: ctx.projectDir
+          projectDir: ctx.projectDir,
+          ...binding?.checklist ? { dnsChecklist: binding.checklist } : {}
         });
       } catch (e) {
         return toolError(e);
@@ -1884,7 +2053,9 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         projectDir: projectDirInput,
         action: z3.enum(["start", "status"]),
         hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe("Required for status.")
+        verificationId: z3.string().optional().describe(
+          "Optional for status: when omitted, the server finds this site's latest binding verification \u2014 a NEW session can resume without it."
+        )
       }
     },
     async (args) => {
@@ -1892,30 +2063,42 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
-          if (!args.verificationId) {
-            throw new SakupaError("invalid_request", "verificationId is required for status");
-          }
-          const res2 = await ctx.client.checkVerification(args.verificationId, site.credential);
+          const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
           if (res2.status === "verified") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
+          const apex2 = res2.apexDomain;
+          const diag = await diagnoseBinding({
+            apexDomain: apex2,
+            servingTarget: res2.servingTarget,
+            ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
+            pendingDnsRecords: res2.pendingDnsRecords,
+            verificationStatus: res2.status,
+            provisioning: res2.provisioningJobId !== void 0
+          });
+          const { apexResolves, allOk } = diag;
           return text(
             res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
-            `DNS verification ${res2.verificationId}: ${res2.status}
+            `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
-` : "") + (res2.pendingDnsRecords.length > 0 ? `
-DNS records still required:
-${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
+
+` + renderChecklistBlock(
+              diag,
+              "Fix any [MISSING]/[FIX] lines above, then re-run bind_domain status; if still failing after the attempts below, show the user this checklist."
+            ),
             {
               verificationId: res2.verificationId,
               status: res2.status,
-              apexDomain: res2.apexDomain,
+              apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
-              pendingDnsRecords: res2.pendingDnsRecords,
+              servingTarget: res2.servingTarget,
+              dnsChecklist: toDnsChecklist(diag.checks),
+              apexResolves,
+              retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+              maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "completed" : "pending_provider"
+            res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -1926,25 +2109,42 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
+        const apex = res.apexDomain;
+        const txtShort = shortHostFor(res.verificationRecord.name, apex);
         return text(
           "domain_verification_started",
-          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+          `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
 
-1. Prove control of ${res.apexDomain} by creating this DNS record:
-   name:  ${res.verificationRecord.name}
-   type:  ${res.verificationRecord.type}
-   value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
+Add ALL THREE DNS records NOW (adding them together lets verification, certificate issuance and serving complete without further record changes):
 
-2. Serving DNS (after verification): ${res.servingInstructions}
+  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
+  2) CNAME  host: www   value: ${res.servingTarget}
+  3) APEX   host: @   -> ${res.servingTarget} via your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).
 
-Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`,
+Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
+
+Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+
+Then run bind_domain with action "status" \u2014 it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
-            apexDomain: res.apexDomain,
+            apexDomain: apex,
             includedHostnames: res.includedHostnames,
             verificationRecord: res.verificationRecord,
-            servingInstructions: res.servingInstructions
+            servingTarget: res.servingTarget,
+            requiredRecords: [
+              {
+                type: "TXT",
+                shortHost: txtShort,
+                name: res.verificationRecord.name,
+                value: res.verificationRecord.value
+              },
+              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
+              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+            ],
+            servingInstructions: res.servingInstructions,
+            retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+            maxAttempts: DNS_MAX_ATTEMPTS
           },
           "waiting_user"
         );
@@ -2200,6 +2400,12 @@ ${res.archiveUrl}`,
         deploymentId: z3.string().optional(),
         severity: severityEnum.optional(),
         description: z3.string().optional().describe("What happened, in the user's words (no secrets)."),
+        agentContext: z3.string().optional().describe(
+          "YOUR OWN factual account of the session as the AI: which tools you called, what they returned, expected vs actual. Write it yourself from your observations \u2014 never ask the user to compose it, and do not read it back to them; it travels alongside the user's description as a second witness. No secrets, no file contents."
+        ),
+        contactEmail: z3.string().optional().describe(
+          "OPTIONAL. Before submitting, ask the user ONCE whether they want to leave a contact for follow-up. Omit entirely if they decline \u2014 never require it."
+        ),
         confirmSubmit: z3.boolean().optional().describe("User reviewed the report payload and approved submission.")
       }
     },
@@ -2224,7 +2430,9 @@ ${res.archiveUrl}`,
           ...site ? { siteId: site.siteId } : {},
           ...args.severity !== void 0 ? { severity: args.severity } : {},
           diagnostics,
-          ...args.description !== void 0 ? { description: args.description } : {}
+          ...args.description !== void 0 ? { description: args.description } : {},
+          ...args.agentContext !== void 0 ? { agentContext: args.agentContext } : {},
+          ...args.contactEmail !== void 0 ? { contactEmail: args.contactEmail } : {}
         };
         if (args.confirmSubmit !== true) {
           return textJson(
@@ -2498,7 +2706,9 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
 the directory the user is currently working in, on every call. Without it the server falls
 back to its startup directory, which may be a different project than the one the user is
-looking at. analyze_site, deploy_site, site_status, refresh_site, delete_site and unbind_domain echo
+looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+Explicit Environment line: TEST vs PRODUCTION). analyze_site, deploy_site, site_status,
+refresh_site, delete_site and unbind_domain echo
 the directory they acted on \u2014 verify it matches the user's active project.
 
 Safety boundaries:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",