@sakupa/mcp 0.7.8 → 0.7.9

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.8";
+var SAKUPA_MCP_VERSION = "0.7.9";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -458,10 +458,10 @@ var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 // src/config.ts
 var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
-  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+  return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
 function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
-  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
   const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
@@ -479,6 +479,9 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
   }
   return { apiBaseUrl, projectDir };
 }
+function environmentFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
+}
 
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -591,11 +594,14 @@ var HttpApiClient = class {
   async bindDomain(credential, req) {
     return this.call("POST", "/v1/domains/bind", { credential, body: req });
   }
-  async checkVerification(verificationId, credential) {
+  async checkVerification(verificationId, credential, latestForSiteId) {
     return this.call(
       "POST",
       `/v1/domains/verifications/${encodeURIComponent(verificationId)}/check`,
-      { credential }
+      {
+        credential,
+        ...latestForSiteId !== void 0 ? { body: { siteId: latestForSiteId } } : {}
+      }
     );
   }
   async unbindDomain(siteId, credential, req) {
@@ -1248,6 +1254,111 @@ function removeCreation(siteId) {
   if (rest.length !== all.length) writeAll(rest);
 }
 
+// src/dns-doh.ts
+var dohFetch = (input, init) => fetch(input, init);
+var TYPE_CODES = { TXT: 16, CNAME: 5, A: 1 };
+async function resolveDns(name, type) {
+  const endpoints = [
+    `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=${type}`,
+    `https://dns.google/resolve?name=${encodeURIComponent(name)}&type=${type}`
+  ];
+  for (const url of endpoints) {
+    try {
+      const res = await dohFetch(url, { headers: { accept: "application/dns-json" } });
+      if (!res.ok) continue;
+      const body = await res.json();
+      return (body.Answer ?? []).filter((a) => a.type === TYPE_CODES[type]).map((a) => a.data.replace(/^"|"$/g, "").replace(/"\s+"/g, "")).map((v) => type === "CNAME" ? v.replace(/\.$/, "").toLowerCase() : v);
+    } catch {
+    }
+  }
+  return [];
+}
+function shortHostFor(fullName, apexDomain) {
+  const suffix = `.${apexDomain}`;
+  if (fullName === apexDomain) return "@";
+  return fullName.endsWith(suffix) ? fullName.slice(0, -suffix.length) : fullName;
+}
+function matches(record, values) {
+  if (record.type === "CNAME") {
+    const want = record.value.replace(/\.$/, "").toLowerCase();
+    return values.some((v) => v === want);
+  }
+  return values.includes(record.value);
+}
+async function checkRecord(record, apexDomain) {
+  const shortHost = shortHostFor(record.name, apexDomain);
+  const found = await resolveDns(record.name, record.type);
+  if (matches(record, found)) {
+    return { record, shortHost, state: "ok", found, fix: "" };
+  }
+  const doubled = await resolveDns(`${record.name}.${apexDomain}`, record.type);
+  if (matches(record, doubled)) {
+    return {
+      record,
+      shortHost,
+      state: "double_domain",
+      found: doubled,
+      fix: `The record exists at ${record.name}.${apexDomain} \u2014 the host field was filled with the full name and your DNS panel appended ${apexDomain} again. Edit that record's host to exactly: ${shortHost}`
+    };
+  }
+  if (found.length > 0) {
+    return {
+      record,
+      shortHost,
+      state: "wrong_value",
+      found,
+      fix: `A ${record.type} record exists at ${record.name} but its value is ${JSON.stringify(found)} instead of "${record.value}". Update the value exactly.`
+    };
+  }
+  return {
+    record,
+    shortHost,
+    state: "missing",
+    found,
+    fix: `Create it now \u2014 type: ${record.type}, host: ${shortHost} (most panels append .${apexDomain} automatically; if yours wants the full name use ${record.name}), value: ${record.value}`
+  };
+}
+function renderCheck(c) {
+  const label = `${c.record.type} ${c.shortHost}`;
+  switch (c.state) {
+    case "ok":
+      return `  [OK] ${label} \u2014 live on public DNS.`;
+    case "double_domain":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "wrong_value":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "missing":
+      return `  [MISSING] ${label} \u2014 ${c.fix}`;
+  }
+}
+async function diagnoseBinding(input) {
+  const apex = input.apexDomain;
+  const byKey = /* @__PURE__ */ new Map();
+  if (input.verificationRecord) {
+    byKey.set(`TXT:${input.verificationRecord.name}`, input.verificationRecord);
+  }
+  const www = {
+    name: `www.${apex}`,
+    type: "CNAME",
+    value: input.servingTarget
+  };
+  byKey.set(`CNAME:${www.name}`, www);
+  for (const rec of input.pendingDnsRecords) {
+    const key = `${rec.type}:${rec.name}`;
+    if (!byKey.has(key)) byKey.set(key, rec);
+  }
+  const [checks, apexAnswers] = await Promise.all([
+    Promise.all([...byKey.values()].map((rec) => checkRecord(rec, apex))),
+    resolveDns(apex, "A")
+  ]);
+  const apexResolves = apexAnswers.length > 0;
+  const allOk = checks.every((c) => c.state === "ok");
+  const checklist = checks.map(renderCheck).join("\n") + `
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet: point it at ${input.servingTarget} using your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  return { checks, apexResolves, allOk, checklist, layers };
+}
+
 // src/version.ts
 var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
@@ -1498,6 +1609,8 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   }
   return targets.length;
 }
+var DNS_RETRY_AFTER_SECONDS = 300;
+var DNS_MAX_ATTEMPTS = 10;
 function freeSiteCreationBarrier() {
   const recent = listRecentCreations(Date.now());
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -1628,6 +1741,7 @@ Next action: ${analysis.suggestedNextAction}`,
           return text(
             "site_published",
             `Site published: ${finalized2.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
@@ -1647,7 +1761,8 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
               totalBytes: finalized2.totalBytes,
               warnings: finalized2.warnings,
               credentialStoredLocally: true,
-              projectDir: ctx.projectDir
+              projectDir: ctx.projectDir,
+              environment: environmentFor(ctx.apiBaseUrl)
             }
           );
         }
@@ -1693,6 +1808,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         return text(
           "site_updated",
           `Site updated: ${finalized.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
@@ -1706,6 +1822,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             url: finalized.url,
             mode: finalized.mode,
             projectDir: ctx.projectDir,
+            environment: environmentFor(ctx.apiBaseUrl),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
@@ -1820,7 +1937,9 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         projectDir: projectDirInput,
         action: z3.enum(["start", "status"]),
         hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe("Required for status.")
+        verificationId: z3.string().optional().describe(
+          "Optional for status: when omitted, the server finds this site's latest binding verification \u2014 a NEW session can resume without it."
+        )
       }
     },
     async (args) => {
@@ -1828,30 +1947,49 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
-          if (!args.verificationId) {
-            throw new SakupaError("invalid_request", "verificationId is required for status");
-          }
-          const res2 = await ctx.client.checkVerification(args.verificationId, site.credential);
+          const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
           if (res2.status === "verified") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
+          const apex2 = res2.apexDomain;
+          const { checks, apexResolves, allOk, checklist, layers } = await diagnoseBinding({
+            apexDomain: apex2,
+            servingTarget: res2.servingTarget,
+            ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
+            pendingDnsRecords: res2.pendingDnsRecords,
+            verificationStatus: res2.status,
+            provisioning: res2.provisioningJobId !== void 0
+          });
           return text(
             res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
-            `DNS verification ${res2.verificationId}: ${res2.status}
+            `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
-` : "") + (res2.pendingDnsRecords.length > 0 ? `
-DNS records still required:
-${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
+
+Live DNS checklist (host values are the SHORT panel form):
+${checklist}
+
+${layers}
+
+` + (allOk && res2.status === "verified" ? "All records are live; certificate issuance completes automatically \u2014 check again in a few minutes until the binding is active." : "Fix any [MISSING]/[FIX] lines above, then re-run bind_domain status. Re-check every 5 minutes, up to 10 times; if still failing after that, show the user this checklist."),
             {
               verificationId: res2.verificationId,
               status: res2.status,
-              apexDomain: res2.apexDomain,
+              apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
-              pendingDnsRecords: res2.pendingDnsRecords,
+              servingTarget: res2.servingTarget,
+              dnsChecklist: checks.map((c) => ({
+                name: c.record.name,
+                type: c.record.type,
+                shortHost: c.shortHost,
+                state: c.state,
+                fix: c.fix || void 0
+              })),
+              apexResolves,
+              retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+              maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "completed" : "pending_provider"
+            res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -1862,25 +2000,42 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
+        const apex = res.apexDomain;
+        const txtShort = shortHostFor(res.verificationRecord.name, apex);
         return text(
           "domain_verification_started",
-          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+          `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+
+Add ALL THREE DNS records NOW (adding them together lets verification, certificate issuance and serving complete without further record changes):
 
-1. Prove control of ${res.apexDomain} by creating this DNS record:
-   name:  ${res.verificationRecord.name}
-   type:  ${res.verificationRecord.type}
-   value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
+  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
+  2) CNAME  host: www   value: ${res.servingTarget}
+  3) APEX   host: @   -> ${res.servingTarget} via your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).
 
-2. Serving DNS (after verification): ${res.servingInstructions}
+Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
 
-Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`,
+Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+
+Then run bind_domain with action "status" \u2014 it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
-            apexDomain: res.apexDomain,
+            apexDomain: apex,
             includedHostnames: res.includedHostnames,
             verificationRecord: res.verificationRecord,
-            servingInstructions: res.servingInstructions
+            servingTarget: res.servingTarget,
+            requiredRecords: [
+              {
+                type: "TXT",
+                shortHost: txtShort,
+                name: res.verificationRecord.name,
+                value: res.verificationRecord.value
+              },
+              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
+              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+            ],
+            servingInstructions: res.servingInstructions,
+            retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+            maxAttempts: DNS_MAX_ATTEMPTS
           },
           "waiting_user"
         );
@@ -2503,7 +2658,9 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
 the directory the user is currently working in, on every call. Without it the server falls
 back to its startup directory, which may be a different project than the one the user is
-looking at. analyze_site, deploy_site, site_status, refresh_site, delete_site and unbind_domain echo
+looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+Explicit Environment line: TEST vs PRODUCTION). analyze_site, deploy_site, site_status,
+refresh_site, delete_site and unbind_domain echo
 the directory they acted on \u2014 verify it matches the user's active project.
 
 Safety boundaries:

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.8";
+var SAKUPA_MCP_VERSION = "0.7.9";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -457,10 +457,10 @@ var CLIENT_TYPE = "sakupa-mcp";
 // src/config.ts
 var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
-  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+  return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
 function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
-  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
   const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
@@ -478,6 +478,9 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
   }
   return { apiBaseUrl, projectDir };
 }
+function environmentFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
+}
 
 // src/transport.ts
 var FetchTransport = class {
@@ -659,11 +662,14 @@ var HttpApiClient = class {
   async bindDomain(credential, req) {
     return this.call("POST", "/v1/domains/bind", { credential, body: req });
   }
-  async checkVerification(verificationId, credential) {
+  async checkVerification(verificationId, credential, latestForSiteId) {
     return this.call(
       "POST",
       `/v1/domains/verifications/${encodeURIComponent(verificationId)}/check`,
-      { credential }
+      {
+        credential,
+        ...latestForSiteId !== void 0 ? { body: { siteId: latestForSiteId } } : {}
+      }
     );
   }
   async unbindDomain(siteId, credential, req) {
@@ -1456,6 +1462,111 @@ function removeCreation(siteId) {
   if (rest.length !== all.length) writeAll(rest);
 }
 
+// src/dns-doh.ts
+var dohFetch = (input, init) => fetch(input, init);
+var TYPE_CODES = { TXT: 16, CNAME: 5, A: 1 };
+async function resolveDns(name, type) {
+  const endpoints = [
+    `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(name)}&type=${type}`,
+    `https://dns.google/resolve?name=${encodeURIComponent(name)}&type=${type}`
+  ];
+  for (const url of endpoints) {
+    try {
+      const res = await dohFetch(url, { headers: { accept: "application/dns-json" } });
+      if (!res.ok) continue;
+      const body = await res.json();
+      return (body.Answer ?? []).filter((a) => a.type === TYPE_CODES[type]).map((a) => a.data.replace(/^"|"$/g, "").replace(/"\s+"/g, "")).map((v) => type === "CNAME" ? v.replace(/\.$/, "").toLowerCase() : v);
+    } catch {
+    }
+  }
+  return [];
+}
+function shortHostFor(fullName, apexDomain) {
+  const suffix = `.${apexDomain}`;
+  if (fullName === apexDomain) return "@";
+  return fullName.endsWith(suffix) ? fullName.slice(0, -suffix.length) : fullName;
+}
+function matches(record, values) {
+  if (record.type === "CNAME") {
+    const want = record.value.replace(/\.$/, "").toLowerCase();
+    return values.some((v) => v === want);
+  }
+  return values.includes(record.value);
+}
+async function checkRecord(record, apexDomain) {
+  const shortHost = shortHostFor(record.name, apexDomain);
+  const found = await resolveDns(record.name, record.type);
+  if (matches(record, found)) {
+    return { record, shortHost, state: "ok", found, fix: "" };
+  }
+  const doubled = await resolveDns(`${record.name}.${apexDomain}`, record.type);
+  if (matches(record, doubled)) {
+    return {
+      record,
+      shortHost,
+      state: "double_domain",
+      found: doubled,
+      fix: `The record exists at ${record.name}.${apexDomain} \u2014 the host field was filled with the full name and your DNS panel appended ${apexDomain} again. Edit that record's host to exactly: ${shortHost}`
+    };
+  }
+  if (found.length > 0) {
+    return {
+      record,
+      shortHost,
+      state: "wrong_value",
+      found,
+      fix: `A ${record.type} record exists at ${record.name} but its value is ${JSON.stringify(found)} instead of "${record.value}". Update the value exactly.`
+    };
+  }
+  return {
+    record,
+    shortHost,
+    state: "missing",
+    found,
+    fix: `Create it now \u2014 type: ${record.type}, host: ${shortHost} (most panels append .${apexDomain} automatically; if yours wants the full name use ${record.name}), value: ${record.value}`
+  };
+}
+function renderCheck(c) {
+  const label = `${c.record.type} ${c.shortHost}`;
+  switch (c.state) {
+    case "ok":
+      return `  [OK] ${label} \u2014 live on public DNS.`;
+    case "double_domain":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "wrong_value":
+      return `  [FIX] ${label} \u2014 ${c.fix}`;
+    case "missing":
+      return `  [MISSING] ${label} \u2014 ${c.fix}`;
+  }
+}
+async function diagnoseBinding(input) {
+  const apex = input.apexDomain;
+  const byKey = /* @__PURE__ */ new Map();
+  if (input.verificationRecord) {
+    byKey.set(`TXT:${input.verificationRecord.name}`, input.verificationRecord);
+  }
+  const www = {
+    name: `www.${apex}`,
+    type: "CNAME",
+    value: input.servingTarget
+  };
+  byKey.set(`CNAME:${www.name}`, www);
+  for (const rec of input.pendingDnsRecords) {
+    const key = `${rec.type}:${rec.name}`;
+    if (!byKey.has(key)) byKey.set(key, rec);
+  }
+  const [checks, apexAnswers] = await Promise.all([
+    Promise.all([...byKey.values()].map((rec) => checkRecord(rec, apex))),
+    resolveDns(apex, "A")
+  ]);
+  const apexResolves = apexAnswers.length > 0;
+  const allOk = checks.every((c) => c.state === "ok");
+  const checklist = checks.map(renderCheck).join("\n") + `
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet: point it at ${input.servingTarget} using your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  return { checks, apexResolves, allOk, checklist, layers };
+}
+
 // src/tools/definitions.ts
 function text(resultCode, t, data = {}, outcome = "completed") {
   return structuredToolResult({
@@ -1562,6 +1673,8 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   }
   return targets.length;
 }
+var DNS_RETRY_AFTER_SECONDS = 300;
+var DNS_MAX_ATTEMPTS = 10;
 function freeSiteCreationBarrier() {
   const recent = listRecentCreations(Date.now());
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -1692,6 +1805,7 @@ Next action: ${analysis.suggestedNextAction}`,
           return text(
             "site_published",
             `Site published: ${finalized2.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded2} (${finalized2.totalBytes} bytes)
 ` + (finalized2.expiresAt ? `Expires at: ${finalized2.expiresAt}
@@ -1711,7 +1825,8 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
               totalBytes: finalized2.totalBytes,
               warnings: finalized2.warnings,
               credentialStoredLocally: true,
-              projectDir: ctx.projectDir
+              projectDir: ctx.projectDir,
+              environment: environmentFor(ctx.apiBaseUrl)
             }
           );
         }
@@ -1757,6 +1872,7 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         return text(
           "site_updated",
           `Site updated: ${finalized.url}
+Environment: ${environmentFor(ctx.apiBaseUrl).toUpperCase()} (${ctx.apiBaseUrl})
 Project directory: ${ctx.projectDir}
 Files uploaded: ${uploaded} (${finalized.totalBytes} bytes)
 ` + (finalized.expiresAt ? `Validity refreshed \u2014 expires at: ${finalized.expiresAt}
@@ -1770,6 +1886,7 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
             url: finalized.url,
             mode: finalized.mode,
             projectDir: ctx.projectDir,
+            environment: environmentFor(ctx.apiBaseUrl),
             expiresAt: finalized.expiresAt,
             filesUploaded: uploaded,
             totalBytes: finalized.totalBytes,
@@ -1884,7 +2001,9 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         projectDir: projectDirInput,
         action: z3.enum(["start", "status"]),
         hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe("Required for status.")
+        verificationId: z3.string().optional().describe(
+          "Optional for status: when omitted, the server finds this site's latest binding verification \u2014 a NEW session can resume without it."
+        )
       }
     },
     async (args) => {
@@ -1892,30 +2011,49 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
         const ctx = withProjectDir(baseCtx, args.projectDir);
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
-          if (!args.verificationId) {
-            throw new SakupaError("invalid_request", "verificationId is required for status");
-          }
-          const res2 = await ctx.client.checkVerification(args.verificationId, site.credential);
+          const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
           if (res2.status === "verified") {
             writeSiteFile(ctx.projectDir, { ...site, boundDomain: res2.apexDomain });
           }
+          const apex2 = res2.apexDomain;
+          const { checks, apexResolves, allOk, checklist, layers } = await diagnoseBinding({
+            apexDomain: apex2,
+            servingTarget: res2.servingTarget,
+            ...res2.verificationRecord ? { verificationRecord: res2.verificationRecord } : {},
+            pendingDnsRecords: res2.pendingDnsRecords,
+            verificationStatus: res2.status,
+            provisioning: res2.provisioningJobId !== void 0
+          });
           return text(
             res2.status === "verified" ? "domain_verification_succeeded" : "domain_verification_pending",
-            `DNS verification ${res2.verificationId}: ${res2.status}
+            `Domain binding status for ${apex2}: ${res2.status}
 ${res2.message}
-` + (res2.provisioningJobId ? `Provisioning started (job ${res2.provisioningJobId}). HTTPS certificates and serving setup are in progress; check again with bind_domain + verificationId later.
-` : "") + (res2.pendingDnsRecords.length > 0 ? `
-DNS records still required:
-${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
+
+Live DNS checklist (host values are the SHORT panel form):
+${checklist}
+
+${layers}
+
+` + (allOk && res2.status === "verified" ? "All records are live; certificate issuance completes automatically \u2014 check again in a few minutes until the binding is active." : "Fix any [MISSING]/[FIX] lines above, then re-run bind_domain status. Re-check every 5 minutes, up to 10 times; if still failing after that, show the user this checklist."),
             {
               verificationId: res2.verificationId,
               status: res2.status,
-              apexDomain: res2.apexDomain,
+              apexDomain: apex2,
               provisioningJobId: res2.provisioningJobId,
-              pendingDnsRecords: res2.pendingDnsRecords,
+              servingTarget: res2.servingTarget,
+              dnsChecklist: checks.map((c) => ({
+                name: c.record.name,
+                type: c.record.type,
+                shortHost: c.shortHost,
+                state: c.state,
+                fix: c.fix || void 0
+              })),
+              apexResolves,
+              retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+              maxAttempts: DNS_MAX_ATTEMPTS,
               message: res2.message
             },
-            res2.status === "verified" ? "completed" : "pending_provider"
+            res2.status === "verified" ? "pending_provider" : "waiting_user"
           );
         }
         if (!args.hostname) {
@@ -1926,25 +2064,42 @@ ${JSON.stringify(res2.pendingDnsRecords, null, 2)}` : ""),
           hostname: args.hostname
         };
         const res = await ctx.client.bindDomain(site.credential, req);
+        const apex = res.apexDomain;
+        const txtShort = shortHostFor(res.verificationRecord.name, apex);
         return text(
           "domain_verification_started",
-          `Domain binding started for ${res.apexDomain} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+          `Domain binding started for ${apex} (includes: ${res.includedHostnames.join(", ")} \u2014 both will serve this site).
+
+Add ALL THREE DNS records NOW (adding them together lets verification, certificate issuance and serving complete without further record changes):
 
-1. Prove control of ${res.apexDomain} by creating this DNS record:
-   name:  ${res.verificationRecord.name}
-   type:  ${res.verificationRecord.type}
-   value: ${res.verificationRecord.value}
-   Ownership comes ONLY from DNS control; paying never grants it. This request does not reserve the domain \u2014 the first verified request wins, and this challenge expires after 72 hours.
+  1) TXT    host: ${txtShort}   value: ${res.verificationRecord.value}
+  2) CNAME  host: www   value: ${res.servingTarget}
+  3) APEX   host: @   -> ${res.servingTarget} via your DNS panel's ALIAS / ANAME / CNAME-flattening feature (an apex cannot use a plain CNAME).
 
-2. Serving DNS (after verification): ${res.servingInstructions}
+Host fields above are the SHORT form: most DNS panels append the domain automatically. After saving, the record list must NOT show ${apex} twice in one name \u2014 that means the full name was pasted into an auto-appending field.
 
-Then run bind_domain again with verificationId: "${res.verificationId}" to check verification and start provisioning.`,
+Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
+
+Then run bind_domain with action "status" \u2014 it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
             verificationId: res.verificationId,
-            apexDomain: res.apexDomain,
+            apexDomain: apex,
             includedHostnames: res.includedHostnames,
             verificationRecord: res.verificationRecord,
-            servingInstructions: res.servingInstructions
+            servingTarget: res.servingTarget,
+            requiredRecords: [
+              {
+                type: "TXT",
+                shortHost: txtShort,
+                name: res.verificationRecord.name,
+                value: res.verificationRecord.value
+              },
+              { type: "CNAME", shortHost: "www", name: `www.${apex}`, value: res.servingTarget },
+              { type: "ALIAS", shortHost: "@", name: apex, value: res.servingTarget }
+            ],
+            servingInstructions: res.servingInstructions,
+            retryAfterSeconds: DNS_RETRY_AFTER_SECONDS,
+            maxAttempts: DNS_MAX_ATTEMPTS
           },
           "waiting_user"
         );
@@ -2498,7 +2653,9 @@ Project directory contract: ONE directory = ONE site (its .sakupa/site.json hold
 binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
 the directory the user is currently working in, on every call. Without it the server falls
 back to its startup directory, which may be a different project than the one the user is
-looking at. analyze_site, deploy_site, site_status, refresh_site, delete_site and unbind_domain echo
+looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+Explicit Environment line: TEST vs PRODUCTION). analyze_site, deploy_site, site_status,
+refresh_site, delete_site and unbind_domain echo
 the directory they acted on \u2014 verify it matches the user's active project.
 
 Safety boundaries:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",