Prompt: pause or retire an ird p2p app without losing its config

Have an agent take a p2p app down in the right order — capture every setting into a JSON re-create recipe, stop new peers by tightening the origins, switch the relay off, drain and switch off the mailbox only with your explicit yes, detach the custom domains, delete the app, and prove the billing stopped — with the reverse path that rebuilds it from the recipe and tells your clients what changed.

Needs: ird access (MCP server or the ird CLI, logged in — ird credits ledger is CLI-only); an existing p2p app; for re-creation, the same zone on ird DNS for the custom domains Costs: nothing new; the app bills credits_prices → recurring.p2p-app-hourly (per_hour, plus per_mb_hour_cached for mailbox storage) until it is deleted; draining the mailbox bills replays as relayed traffic plus one p2p.credentials mint (a token reused across rooms) Group: p2p

Paste everything below the line into a fresh conversation. Fill in the FILL IN block first.

Task

Do MODE on APP below. Every step that drops peers, drops stored messages or deletes something is announced with its consequence and waits for my yes. A paused app still bills per_hour; only deleting it (re-creating later from the recipe) stops the hourly charge.

FILL IN

APP:         whiteboard            # name, hostname or id from p2p_list_apps
MODE:        retire                # pause (drain, keep the app, hourly still bills) | retire (delete) | restore (from RECIPE)
RECIPE:      ./whiteboard.p2p.json # where the recipe is written / read from
MAILBOX_ROOMS: room-a, room-b      # rooms to drain into the recipe before the mailbox goes off (blank = none)
NEW_NAME:    whiteboard            # restore: name to create (taken = new hostname; reuse after delete undocumented)

Non-negotiable rules

1. Recipe before anything changes. Step A writes RECIPE and shows it first.
2. Origins replace whole. p2p_set_origins overwrites the list and an empty list means any origin — a drain sets one dead origin, never [] — an inference; no pause is documented.
3. Disabling the mailbox drops the app's stored messages. Only after the step D drain and a separate, explicit yes.
4. Delete is immediate. p2p_delete_app stops billing, signaling, TURN and the custom domains at once. Only by the id written in chat.
5. Rates from credits_prices, usage from p2p_usage. Nothing from memory.

Steps

A. Capture. p2p_list_apps → the APP entry (CLI: ird p2p info APP --json): id, name, hostname, origins, settings (limit overrides), relay_enabled, relay_peer_id, relay_multiaddrs, mailbox_enabled, mailbox_open_mint, domains (hostname, wildcard, dns_cname_target). p2p_usage → hourly_cost. Write RECIPE as JSON with those fields and captured_at; show it.

B. Drain new peers. p2p_set_origins(app=APP, origins=["https://paused.invalid"]) (CLI: ird p2p origins APP --set https://paused.invalid). Within a minute new signaling, TURN mints and open mailbox mints from real sites are refused; whether open connections are cut is not documented — step C drops libp2p peers.

C. Relay off. p2p_set_relay(app=APP, enabled=false) (CLI: ird p2p relay APP --disable) — connected libp2p peers drop; applied within a minute. An idle relay costs nothing extra — this cuts peers, not cost.

D. Mailbox. If mailbox_enabled and MAILBOX_ROOMS: mint one token, p2p_mailbox_credentials(app=APP) (CLI: ird p2p mailbox creds APP), then per room p2p_mailbox_recv(app=APP, room=<room>, token=…) (CLI: ird p2p mailbox recv APP <room> --token … --all --json), paging with after until has_more is false — a call without token mints again — and store the base64 payloads under mailbox.<room> in RECIPE (ciphertext only my clients can read). Then ask: "turn the mailbox off and drop what the node still holds?" Only on yes: p2p_set_mailbox(app=APP, enabled=false) (CLI: ird p2p mailbox APP --disable). No yes: leave it on — cached bytes bill per_mb_hour_cached until they expire.

E. Detach domains. Per domains entry: p2p_domain_delete(app=APP, domain=<hostname>) (CLI: ird p2p domains remove APP <hostname>). Then dns_get_zone(<zone>): removal of the CNAME ird created is not documented — delete a leftover with dns_delete_record(domain=<zone>, name="<hostname>.", type="CNAME") if I want the name free.

F. Delete (retire only). Show id and hourly rate, wait for the id in chat, then p2p_delete_app(app=<id>) (CLI: ird p2p delete <id>).

G. Verify billing stopped. p2p_list_apps no longer lists it; p2p_usage shows apps one lower and hourly_cost down by per_hour; ird credits ledger --kind charge (CLI-only) shows no charge for the app after deletion. If the ledger errors, say so and compare credits_balance now and an hour later.

H. Restore (MODE restore). Read RECIPE. p2p_create_app(name=NEW_NAME, origins=<recipe origins>) (CLI: ird p2p create NEW_NAME --origin …) — bills hourly from now; confirm first. Then from the recipe: p2p_set_limits(app, …) with every key in settings; p2p_set_mailbox(app, enabled=…, open_mint=…); each domain with p2p_domain_add(app, hostname, wildcard) and p2p_domain_verify if a CNAME had to be set by hand; p2p_set_relay(app, enabled=true) if it was on. Re-read p2p_list_apps: expect a new relay_peer_id and relay_multiaddrs (each app has its own relay peer) — clients that hardcoded the old ones must re-read them (https://<hostname>/.well-known/ap2p); a different NEW_NAME also changes the signaling and TURN URLs. Drained mailbox payloads are re-deposited by my clients, not ird; say so.

Deliverable

RECIPE path and contents, steps applied with times, what was dropped (peers, messages) and on whose yes, the app id deleted, p2p_usage before/after, and — for restore — the new hostname, relay_peer_id, relay_multiaddrs and the client changes they require.