@celilo/cli 0.10.0 → 0.11.0-alpha.0

package/src/cli/commands/apt-upgrade.ts

@@ -0,0 +1,63 @@
+/**
+ * `celilo apt-upgrade` — upgrade the deb-installed celilo packages and apply
+ * pending DB migrations. The management server (celilo-bootstrap) installs
+ * celilo via apt, so keeping it current means the apt chain, not `bun update -g`
+ * (that path is `system update`'s self-update, for npm-global installs).
+ *
+ * Steps (ISS-0100 — the postinst does NOT auto-apply migrations):
+ *   1. apt-get update
+ *   2. apt-get -y --only-upgrade install celilo celilo-bootstrap
+ *   3. a FRESH `celilo system migrate` — spawned as the just-installed binary so
+ *      the new version's migrations run, not the ones loaded in this process.
+ *
+ * This is the RW target behind the MCP's `celilo_apt_upgrade` tool. It runs as
+ * the celilo user (via api-serve); the apt steps sudo to root, gated by the
+ * scoped /etc/sudoers.d/celilo-apt-upgrade grant that celilo-bootstrap ships.
+ */
+
+import { spawnSync } from 'node:child_process';
+import type { CommandResult } from '../types';
+
+/** Wrapper the deb installs; the fresh migrate step runs the upgraded binary. */
+const CELILO_BIN = '/usr/local/bin/celilo';
+
+/** One command to run in the chain — argv plus a human label for output. */
+interface Step {
+  label: string;
+  argv: string[];
+}
+
+const STEPS: Step[] = [
+  { label: 'apt-get update', argv: ['sudo', 'apt-get', 'update'] },
+  {
+    label: 'apt-get upgrade celilo, celilo-bootstrap',
+    argv: ['sudo', 'apt-get', '-y', '--only-upgrade', 'install', 'celilo', 'celilo-bootstrap'],
+  },
+  { label: 'apply DB migrations', argv: [CELILO_BIN, 'system', 'migrate'] },
+];
+
+/** Run one argv, inheriting stdio so its output streams through api-serve. */
+export type StepRunner = (argv: string[]) => { status: number | null };
+
+const defaultRunner: StepRunner = (argv) => spawnSync(argv[0], argv.slice(1), { stdio: 'inherit' });
+
+export async function handleAptUpgrade(
+  _args: string[],
+  _flags: Record<string, string | boolean>,
+  runStep: StepRunner = defaultRunner,
+): Promise<CommandResult> {
+  for (const step of STEPS) {
+    process.stdout.write(`\n▸ ${step.label}\n`);
+    const { status } = runStep(step.argv);
+    if (status !== 0) {
+      return {
+        success: false,
+        error: `apt-upgrade failed at "${step.label}" (exit ${status ?? 'signal'}). Nothing further was run.`,
+      };
+    }
+  }
+  return {
+    success: true,
+    message: 'celilo apt packages upgraded and migrations applied.',
+  };
+}

package/src/cli/commands/commands-json.ts

@@ -0,0 +1,29 @@
+/**
+ * Commands Command
+ *
+ * Serializes the CLI command registry (`COMMANDS`) as JSON so an external
+ * consumer — `@celilo/mcp` above all — can fetch the *live* surface of whatever
+ * celilo version this server runs and generate its tool set from it, rather than
+ * compiling a copy that drifts (design D3). The registry is already structured
+ * data; this just prints it.
+ */
+
+import { COMMANDS } from '@celilo/core';
+import type { CommandResult } from '../types';
+
+/**
+ * Handle `celilo commands [--json]`.
+ *
+ * The only useful output is the JSON tree, so we emit it whether or not `--json`
+ * is passed; the flag exists to make the intent explicit and completable.
+ */
+export async function handleCommands(
+  _args: string[],
+  _flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  return {
+    success: true,
+    message: JSON.stringify(COMMANDS),
+    rawOutput: true,
+  };
+}

package/src/cli/commands/completion.ts

@@ -3,7 +3,7 @@
  * Generate shell completion scripts for bash/zsh
  */
 
-import { COMMANDS } from '../command-registry';
+import { COMMANDS } from '@celilo/core';
 import { generateBashCompletion, generateFishCompletion } from '../completion';
 import { generateRichZshCompletion } from '../generate-zsh-completion';
 import { celiloIntro } from '../prompts';

package/src/cli/commands/module-list.ts

@@ -1,20 +1,34 @@
 import { getDb } from '../../db/client';
 import { modules } from '../../db/schema';
+import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
 
 /**
  * Handle module list command
  *
- * Usage: celilo module list
+ * Usage: celilo module list [--json]
  *
  * @returns Command result
  */
-export async function handleModuleList(): Promise<CommandResult> {
+export async function handleModuleList(
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
   const db = getDb();
 
   // Query all modules
   const moduleRows = db.select().from(modules).all();
 
+  // Stable machine-readable roster — the backbone the MCP composite
+  // troubleshooting tools correlate audit findings against (ce-77i.5).
+  if (hasFlag(flags, 'json')) {
+    return {
+      success: true,
+      message: JSON.stringify({ modules: moduleRows }, null, 2),
+      rawOutput: true,
+      data: moduleRows,
+    };
+  }
+
   if (moduleRows.length === 0) {
     return {
       success: true,

package/src/cli/commands/service-list.ts

@@ -22,8 +22,6 @@ export async function handleServiceList(
   flags: Record<string, boolean | string> = {},
 ): Promise<CommandResult> {
   try {
-    celiloIntro('Container Services');
-
     // Apply zone filter if provided
     const filters: ContainerServiceFilters = {};
     if (flags.zone && typeof flags.zone === 'string') {
@@ -32,6 +30,21 @@ export async function handleServiceList(
 
     const services = await listContainerServices(filters);
 
+    // Machine-readable output (consumed by @celilo/mcp auto-detect). Emit the
+    // fields detection needs — provider drives which tool groups surface.
+    if (flags.json) {
+      const payload = services.map((s) => ({
+        serviceId: s.serviceId,
+        name: s.name,
+        provider: s.providerName,
+        zones: s.zones,
+        verified: s.verified,
+      }));
+      return { success: true, message: JSON.stringify(payload), rawOutput: true };
+    }
+
+    celiloIntro('Container Services');
+
     if (services.length === 0) {
       console.log('No container services configured.\n');
       console.log('Add a service:');

package/src/cli/completion.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import { getDb } from '../db/client';
 import { capabilities, modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { listPrincipals } from '../services/api-access';
 import { listBackups } from '../services/backup-metadata';
 import { listBackupStorages } from '../services/backup-storage';
 import { listContainerServices } from '../services/container-service';
@@ -28,9 +29,12 @@ export async function getCompletions(words: string[], current: number): Promise<
   // currentIndex === 0 means we're completing the first word (the command)
   if (currentIndex === 0) {
     const commands = [
+      'api',
+      'apt-upgrade',
       'audit',
       'backup',
       'capability',
+      'commands',
       'dns',
       'completion',
       'events',
@@ -332,6 +336,26 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(configKeys, args[4] || '');
   }
 
+  // API subcommands
+  if (command === 'api' && currentIndex === 1) {
+    const subcommands = ['grant', 'list', 'revoke', 'authorized-keys', 'key'];
+    return filterSuggestions(subcommands, args[1] || '');
+  }
+
+  // API revoke - complete with principal names
+  if (command === 'api' && args[1] === 'revoke' && currentIndex === 2) {
+    const principals = await listPrincipals();
+    return filterSuggestions(
+      principals.map((p) => p.name),
+      args[2] || '',
+    );
+  }
+
+  // API key subcommands
+  if (command === 'api' && args[1] === 'key' && currentIndex === 2) {
+    return filterSuggestions(['new'], args[2] || '');
+  }
+
   // Machine subcommands
   if (command === 'machine' && currentIndex === 1) {
     const subcommands = ['add', 'list', 'status', 'remove', 'earmark', 'detect'];

package/src/cli/generate-zsh-completion.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'bun:test';
-import { COMMANDS } from './command-registry';
-import type { CommandDef } from './command-registry';
+import { COMMANDS } from '@celilo/core';
+import type { CommandDef } from '@celilo/core';
 import { generateRichZshCompletion } from './generate-zsh-completion';
 
 describe('Zsh Completion Generator', () => {
@@ -79,12 +79,15 @@ describe('Zsh Completion Generator', () => {
   });
 
   test('all subcommand descriptions are present', () => {
+    function escapeDesc(text: string): string {
+      return text.replace(/\\/g, '\\\\').replace(/:/g, '\\:').replace(/'/g, "'\\''");
+    }
     function checkDescriptions(commands: CommandDef[]): void {
       for (const cmd of commands) {
         if (cmd.subcommands) {
           for (const sub of cmd.subcommands) {
-            // Description should appear in the _commands function
-            expect(output).toContain(sub.description.replace(/:/g, '\\:'));
+            // Description should appear (escaped) in the _commands function
+            expect(output).toContain(escapeDesc(sub.description));
           }
           checkDescriptions(cmd.subcommands);
         }
@@ -92,4 +95,19 @@ describe('Zsh Completion Generator', () => {
     }
     checkDescriptions(COMMANDS);
   });
+
+  test('generated completion is valid zsh syntax', () => {
+    // Recurrence gate: any unescaped quote/redirect in a description breaks the
+    // whole file (an apostrophe in "account's" once did). zsh -n parses without
+    // executing. Skip cleanly where zsh is unavailable (minimal CI images).
+    let zsh: ReturnType<typeof Bun.spawnSync>;
+    try {
+      zsh = Bun.spawnSync(['zsh', '-nc', output]);
+    } catch {
+      return; // ponytail: no zsh here — nothing to check
+    }
+    if (zsh.exitCode === null) return;
+    expect(zsh.stderr?.toString() ?? '').toBe('');
+    expect(zsh.exitCode).toBe(0);
+  });
 });

package/src/cli/generate-zsh-completion.ts

@@ -9,14 +9,18 @@
  * should never be hand-edited.
  */
 
-import type { ArgDef, CommandDef, FlagDef } from './command-registry';
+import type { ArgDef, CommandDef, FlagDef } from '@celilo/core';
 
 /**
  * Escape a string for use in zsh completion descriptions.
- * Colons and backslashes need escaping in _describe arrays.
+ * Descriptions are emitted inside single-quoted zsh strings, so:
+ *  - backslash and colon need escaping in _describe / _arguments specs
+ *  - a literal apostrophe must close-quote, emit an escaped quote, and reopen
+ *    ('...'\''...') — otherwise it terminates the string early and the rest of
+ *    the file mis-parses (e.g. "account's" broke completion at the next `->`).
  */
 function escapeZshDescription(text: string): string {
-  return text.replace(/\\/g, '\\\\').replace(/:/g, '\\:');
+  return text.replace(/\\/g, '\\\\').replace(/:/g, '\\:').replace(/'/g, "'\\''");
 }
 
 /**

package/src/cli/index.ts

@@ -4,11 +4,20 @@
  * Orchestration function (Rule 10.1) - routes commands to handlers
  */
 
+import { COMMANDS, type CommandDef, resolveRemote, runRemoteClient } from '@celilo/core';
 import * as p from '@clack/prompts';
 import { CLIServerRequestSchema, parseJsonWithValidation } from '../validation/schemas';
-import { COMMANDS, type CommandDef } from './command-registry';
+import {
+  handleApiAuthorizedKeys,
+  handleApiGrant,
+  handleApiKeyNew,
+  handleApiList,
+  handleApiRevoke,
+} from './commands/api';
+import { handleAptUpgrade } from './commands/apt-upgrade';
 import { handleCapabilityInfo } from './commands/capability-info';
 import { handleCapabilityList } from './commands/capability-list';
+import { handleCommands } from './commands/commands-json';
 import { handleCompletion } from './commands/completion';
 import { handleDnsRegistrations } from './commands/dns';
 import {
@@ -180,14 +189,20 @@ Commands:
   restore                  Restore a celilo-mgmt backup from a local file (fresh-bootstrap path)
   machine                  Manage machine pool (bring-your-own-hardware)
   system                   Manage system configuration
+  apt-upgrade              Upgrade the deb-installed celilo packages + apply migrations
   ipam                     Manage IP address and VMID allocations and reservations
   proxmox                  Proxmox cluster introspection (proxmox node list)
   publish                  Publish workspace packages to npm and modules to celilo.computer
   subscribers              Manage build-bus subscribers (cross-machine publish-event delivery)
+  api                      Manage remote-API access (principals, grants, authorized_keys)
   completion               Generate shell completion scripts (bash/zsh)
+  commands                 Print the CLI command registry as JSON (drives @celilo/mcp)
 
   help, --help, -h         Show this help message
 
+Run any command on a remote celilo-mgr over SSH:
+  celilo --remote <ssh-dest> <command>     (or set CELILO_REMOTE=<ssh-dest>)
+
 For command-specific help:
   celilo package --help
   celilo module --help
@@ -1015,6 +1030,24 @@ Using Vault Password:
 export async function runCli(argv: string[]): Promise<CommandResult> {
   const parsed = parseArguments(argv);
 
+  // Remote API server: the sshd forced-command entry point
+  // (`celilo api-serve --principal=<id>`). Not an operator command — kept out
+  // of the registry/completion on purpose. Runs a persistent NDJSON protocol
+  // loop until stdin closes, then exits the process; never returns here.
+  if (parsed.command === 'api-serve') {
+    const principal = typeof parsed.flags.principal === 'string' ? parsed.flags.principal : '';
+    if (!principal) {
+      return {
+        success: false,
+        error:
+          'api-serve requires --principal <name> (normally supplied by the forced command in authorized_keys)',
+      };
+    }
+    const { apiServeMode } = await import('../api/serve');
+    await apiServeMode(principal);
+    return { success: true, message: '' };
+  }
+
   // Handle --get-completions for shell completion (must be before other processing)
   if (parsed.flags['get-completions']) {
     try {
@@ -1066,11 +1099,20 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     return handleStatus();
   }
 
+  // Handle commands command (serialize the registry; drives @celilo/mcp)
+  if (parsed.command === 'commands') {
+    return handleCommands(parsed.args, parsed.flags);
+  }
+
   // Top-level alias: `celilo audit` → `celilo system audit`
   if (parsed.command === 'audit') {
     return handleSystemAudit(parsed.args, parsed.flags);
   }
 
+  if (parsed.command === 'apt-upgrade') {
+    return handleAptUpgrade(parsed.args, parsed.flags);
+  }
+
   // Route commands
   if (parsed.command === 'package') {
     // Handle package --help
@@ -1261,7 +1303,7 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       case 'import':
         return handleModuleImport(parsed.args, parsed.flags);
       case 'list':
-        return handleModuleList();
+        return handleModuleList(parsed.flags);
       case 'status':
         return handleModuleStatus(parsed.args);
       case 'logs':
@@ -1673,6 +1715,64 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     return handleRestore(restoreArgs, parsed.flags);
   }
 
+  if (parsed.command === 'api') {
+    if (parsed.flags.help || parsed.flags.h) {
+      return {
+        success: true,
+        message: [
+          'celilo api — manage remote-API access',
+          '',
+          'Usage:',
+          '  celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>',
+          '  celilo api list',
+          '  celilo api revoke <principal>',
+          '  celilo api authorized-keys',
+          '  celilo api key new <name>',
+          '',
+          'Grants are command:subcommand (module:deploy), command:* (service:*), or * (all).',
+        ].join('\n'),
+      };
+    }
+
+    if (!parsed.subcommand) {
+      return {
+        success: false,
+        error: 'API subcommand required\n\nRun "celilo api --help" for usage',
+      };
+    }
+
+    const apiFlagError = checkFlags('api', parsed.subcommand, parsed.flags, parsed.args);
+    if (apiFlagError) return apiFlagError;
+
+    if (parsed.subcommand === 'grant') {
+      return handleApiGrant(parsed.args, parsed.flags);
+    }
+
+    if (parsed.subcommand === 'list') {
+      return handleApiList();
+    }
+
+    if (parsed.subcommand === 'revoke') {
+      return handleApiRevoke(parsed.args);
+    }
+
+    if (parsed.subcommand === 'authorized-keys') {
+      return handleApiAuthorizedKeys();
+    }
+
+    if (parsed.subcommand === 'key') {
+      if (parsed.args[0] === 'new') {
+        return handleApiKeyNew(parsed.args.slice(1));
+      }
+      return { success: false, error: 'Usage: celilo api key new <name>' };
+    }
+
+    return {
+      success: false,
+      error: `Unknown api subcommand: ${parsed.subcommand}\n\nRun "celilo api --help" for usage`,
+    };
+  }
+
   if (parsed.command === 'machine') {
     // Handle machine --help
     if (parsed.flags.help || parsed.flags.h) {
@@ -2084,6 +2184,13 @@ export async function main(): Promise<void> {
     return;
   }
 
+  // Remote execution: `celilo --remote <dest> <cmd>` or CELILO_REMOTE=<dest>.
+  // SSH to the remote celilo-mgr and drive its api-serve over the wire.
+  const remote = resolveRemote(process.argv);
+  if (remote) {
+    process.exit(await runRemoteClient(remote.dest, remote.commandArgv));
+  }
+
   // Normal single-command execution
   try {
     const result = await runCli(process.argv);

package/src/cli/parser.test.ts

@@ -107,6 +107,19 @@ describe('CLI Parser', () => {
       expect(result.flags).toEqual({ json: true, verbose: true });
     });
 
+    test('should parse --flag=value inline form', () => {
+      const result = parseArguments([
+        'node',
+        'celilo',
+        'api-serve',
+        '--principal=alice',
+        '--empty=',
+      ]);
+
+      expect(result.command).toBe('api-serve');
+      expect(result.flags).toEqual({ principal: 'alice', empty: '' });
+    });
+
     test('should not consume key=value args as flag values', () => {
       const result = parseArguments([
         'node',

package/src/cli/parser.ts

@@ -4,7 +4,7 @@
  * Policy functions (Rule 10.1) - parsing and validation only
  */
 
-import type { CommandDef } from './command-registry';
+import type { CommandDef } from '@celilo/core';
 import type { ParsedCommand } from './types';
 
 /**
@@ -82,8 +82,17 @@ export function parseArguments(argv: string[]): ParsedCommand {
     if (!arg) continue;
 
     if (arg.startsWith('--')) {
-      // Long flag (--help, --output, etc.)
-      const flagName = arg.slice(2);
+      const body = arg.slice(2);
+      const eqIndex = body.indexOf('=');
+
+      // Inline-value form: --flag=value (everything after the first `=`).
+      if (eqIndex >= 0) {
+        flags[body.slice(0, eqIndex)] = body.slice(eqIndex + 1);
+        continue;
+      }
+
+      // Space-separated form: --flag value
+      const flagName = body;
       const nextArg = restArgs[i + 1];
 
       // Check if next arg is a value (not another flag, not a key=value pair)

package/src/db/schema.ts

@@ -654,6 +654,34 @@ export const aspectApprovals = sqliteTable(
   }),
 );
 
+/**
+ * Remote API principals (see v2/API_COMMUNICATION.md).
+ *
+ * Each row is one API identity: a name, one SSH public key, and the set of
+ * operations it may run. celilo renders these into the API account's
+ * `authorized_keys` (one forced-command line per row) and authz keys off the
+ * principal → `grants`.
+ *
+ * ponytail: one key per principal (a person wanting a second device makes a
+ * second principal, e.g. `alice-laptop`). If multiple keys per identity is ever
+ * needed, split into an `api_keys` child table — not worth it yet.
+ */
+export const apiPrincipals = sqliteTable('api_principals', {
+  id: text('id').primaryKey(), // UUID
+  /** Human-readable principal name, kebab-case (e.g. "alice", "ci-deployer"). */
+  name: text('name').notNull().unique(),
+  /** SSH public key line: `<type> <base64> [comment]`. */
+  publicKey: text('public_key').notNull(),
+  /**
+   * Operations this principal may run, as `command:subcommand` grants
+   * (`module:deploy`), `command:*` wildcards (`service:*`), or `*` (all).
+   * Deny-by-default: an operation not matched by any grant is refused.
+   */
+  grants: text('grants', { mode: 'json' }).$type<string[]>().notNull().default(sql`'[]'`),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+});
+
 /**
  * Type exports for use in application code
  */
@@ -695,3 +723,5 @@ export type ModuleOperation = typeof moduleOperations.$inferSelect;
 export type NewModuleOperation = typeof moduleOperations.$inferInsert;
 export type AspectApproval = typeof aspectApprovals.$inferSelect;
 export type NewAspectApproval = typeof aspectApprovals.$inferInsert;
+export type ApiPrincipal = typeof apiPrincipals.$inferSelect;
+export type NewApiPrincipal = typeof apiPrincipals.$inferInsert;

package/src/hooks/capability-loader.test.ts

@@ -126,4 +126,81 @@ describe('Capability Loader', () => {
     const consumer = await loadCapabilityFunctions('apt-repo', db, noopLogger);
     expect(consumer).not.toHaveProperty('web_routes');
   });
+
+  // ce-iku regression: public_web's managed-domain check must reflect the
+  // registrar's DECLARED `domain_list` computed field (namecheap:
+  // keys(secret.ddns_passwords)) — the same live set DDNS validation sees —
+  // NOT a stale `config.domains` row that survived an older manifest version.
+  // Without the fix the config-shape heuristic short-circuits on the stale
+  // config.domains and a just-added domain (present only in the secret) is
+  // silently excluded, dead-ending register_route forever.
+  test('public_web managed-domains come from the registrar domain_list computed field, not a stale config.domains', async () => {
+    const { encryptSecret } = await import('../secrets/encryption');
+    const { getOrCreateMasterKey } = await import('../secrets/master-key');
+    const { isMissingProviderInputError } = await import('@celilo/capabilities');
+    const masterKey = await getOrCreateMasterKey();
+
+    // Provider: caddy (public_web). Needs ≥1 configured hostname + target_ip
+    // for createPublicWeb to build.
+    const caddyPath = join(tempDir, 'caddy');
+    mkdirSync(caddyPath, { recursive: true });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('caddy', 'Caddy', '1.0.0', '${caddyPath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('caddy', 'public_web', '1.0.0', '{}', unixepoch())`,
+    );
+    upsertModuleConfig(db, 'caddy', 'hostnames', ['seed.celilo.computer']);
+    upsertModuleConfig(db, 'caddy', 'target_ip', '10.0.20.10');
+
+    // Provider: namecheap (dns_registrar). Its `data` declares the canonical
+    // domain_list computed field. config.domains is STALE (missing the newly
+    // onboarded domain); the SECRET holds the real, current set.
+    const ncPath = join(tempDir, 'namecheap');
+    mkdirSync(ncPath, { recursive: true });
+    const registrarData = JSON.stringify({
+      provider: 'namecheap',
+      domain_list: { __celilo_computed__: 'keys(secret.ddns_passwords)' },
+    });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('namecheap', 'Namecheap', '3.2.0', '${ncPath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('namecheap', 'dns_registrar', '4.0.0', '${registrarData}', unixepoch())`,
+    );
+    // Stale config that must be IGNORED — omits buildyourowninternet.dev.
+    upsertModuleConfig(db, 'namecheap', 'domains', ['celilo.computer']);
+    // Live secret — the source of truth — includes the new domain.
+    const ddnsEnc = encryptSecret(
+      JSON.stringify({ 'celilo.computer': 'pw1', 'buildyourowninternet.dev': 'pw2' }),
+      masterKey,
+    );
+    db.$client.run(
+      `INSERT INTO secrets (module_id, name, encrypted_value, iv, auth_tag) VALUES ('namecheap', 'ddns_passwords', '${ddnsEnc.encryptedValue}', '${ddnsEnc.iv}', '${ddnsEnc.authTag}')`,
+    );
+
+    const consumer = await loadCapabilityFunctions('byoi', db, noopLogger);
+    const publicWeb = consumer.public_web as {
+      register_route: (r: { type: string; path: string; hostname: string }) => Promise<unknown>;
+    };
+    expect(publicWeb).toBeTruthy();
+
+    // Does register_route reject specifically because the hostname's apex
+    // isn't in any managed domain? (Later reconcile errors are a different
+    // failure — the domain check already passed by then.)
+    async function rejectsAsMissingProvider(hostname: string): Promise<boolean> {
+      try {
+        await publicWeb.register_route({ type: 'static', path: '/', hostname });
+        return false;
+      } catch (err) {
+        return isMissingProviderInputError(err);
+      }
+    }
+
+    // In the secret (domain_list) but NOT in the stale config.domains — must
+    // pass the managed-domain check.
+    expect(await rejectsAsMissingProvider('www.buildyourowninternet.dev')).toBe(false);
+    // In neither the secret nor config — control: must still be rejected.
+    expect(await rejectsAsMissingProvider('app.notmanaged.example')).toBe(true);
+  });
 });