@celilo/cli 0.9.1 → 0.11.0

package/src/cli/commands/publish/workspace.ts

@@ -17,18 +17,8 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  statSync,
-  unlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { join, relative } from 'node:path';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import {
   ALPHA_TAG,
   alphaSkipDecision,
@@ -36,7 +26,7 @@ import {
   prereleaseDistTag,
   stripAlphaSuffix,
 } from './alpha';
-import { REPO_ROOT, isPublished, readPkg } from './helpers';
+import { REPO_ROOT, isPublished, readNpmPublishTarget, readPkg } from './helpers';
 import type {
   PackageJson,
   PublishMode,
@@ -74,13 +64,15 @@ export interface PlanWorkspaceOutput {
 
 /**
  * Pre-publish hooks that fire for @celilo/e2e (the only package that
- * needs them today). Listed in the WorkspaceItem so dry-run can show
- * "@celilo/e2e (will rebuild netapps, stage caches)" without executing
- * anything.
+ * needs one today): refresh the bundled npm-compat registry-server source.
+ * Sim-content caches and standard-module netapps are no longer staged into
+ * the tarball at publish — a monorepo-free consumer fetches them from the
+ * public celilo sources at `cele2e build-infra` time (ce-qwz Decisions
+ * 2B + 3, ce-i2i).
  */
 function workspaceHooksFor(pkg: string): WorkspaceItem['hooks'] {
   if (pkg !== 'packages/e2e') return [];
-  return ['registryServerBundle', 'rebuildE2eNetapps', 'stageE2ePublishCaches'];
+  return ['registryServerBundle'];
 }
 
 /**
@@ -328,147 +320,23 @@ export async function verifyPublishedDeps(
   }
 }
 
-// ─── Per-package pre-publish hooks ─────────────────────────────────
-
-/**
- * Modules excluded from the @celilo/e2e netapps shipment:
- *   - celilo-registry: bundles the bun-compiled registry server
- *     binaries (~76 MB packed). Not used by typical consumer e2e
- *     tests; including it would bloat the npm tarball past the SSL
- *     transport's reliable window.
- *   - archive: not a real module dir.
- */
-const E2E_NETAPP_EXCLUDES = new Set(['archive', 'celilo-registry']);
-
-/**
- * Pre-publish step for @celilo/e2e: package each (non-excluded)
- * module under `<root>/modules/` into `packages/e2e/netapps/`. Replaces
- * whatever was last left there by a local `cele2e build-infra` so the
- * shipped tarball is always built from the current branch, not the
- * publisher's last local development build.
- */
-export function rebuildE2eNetapps(repoRoot: string): void {
-  const modulesDir = join(repoRoot, 'modules');
-  const netappsDir = join(repoRoot, 'packages/e2e/netapps');
-  const celiloWrapper = join(repoRoot, 'celilo');
-
-  if (!existsSync(modulesDir)) {
-    console.warn(
-      `⚠ ${modulesDir} not found — skipping netapp rebuild. The published tarball will reuse whatever's currently in packages/e2e/netapps/.`,
-    );
-    return;
-  }
-  if (!existsSync(celiloWrapper)) {
-    console.warn(
-      `⚠ ${celiloWrapper} not found — skipping netapp rebuild. Same staleness risk as above.`,
-    );
-    return;
-  }
-
-  console.log('Rebuilding packages/e2e/netapps/ from infra/modules/...');
-
-  for (const existing of readdirSync(netappsDir).filter((f) => f.endsWith('.netapp'))) {
-    try {
-      unlinkSync(join(netappsDir, existing));
-    } catch {
-      // Best effort
-    }
-  }
-
-  const moduleDirs = readdirSync(modulesDir).filter((name) => {
-    if (E2E_NETAPP_EXCLUDES.has(name)) return false;
-    const dir = join(modulesDir, name);
-    try {
-      return statSync(dir).isDirectory() && existsSync(join(dir, 'manifest.yml'));
-    } catch {
-      return false;
-    }
-  });
-
-  let okCount = 0;
-  const failures: Array<{ name: string; stderr: string }> = [];
-  for (const name of moduleDirs) {
-    const moduleDir = join(modulesDir, name);
-    const out = join(netappsDir, `${name}.netapp`);
-    const r = spawnSync(celiloWrapper, ['package', moduleDir, '--output', out], {
-      cwd: repoRoot,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      encoding: 'utf-8',
-    });
-    if (r.status === 0) {
-      okCount++;
-    } else {
-      failures.push({ name, stderr: (r.stderr ?? '').trim() || `exit ${r.status}` });
-    }
-  }
-
-  if (failures.length > 0) {
-    console.error(`✗ Failed to package ${failures.length} module(s):`);
-    for (const f of failures) {
-      console.error(`  ${f.name}: ${f.stderr}`);
-    }
-    console.error(
-      'Aborting publish — shipping with missing netapps would silently break consumer e2e tests.',
-    );
-    process.exit(1);
-  }
-
-  console.log(
-    `Refreshed ${okCount} netapp(s) in packages/e2e/netapps/ (excluded: ${[...E2E_NETAPP_EXCLUDES].join(', ')}).\n`,
-  );
-}
-
 /**
- * Pre-publish step for @celilo/e2e: stage `.celilo-website-cache/` and
- * `.npm-registry-cache/` inside packages/e2e/ so the tarball ships with
- * everything Dockerfile.celilo-website-sim and Dockerfile.npm-registry-sim
- * need to COPY at docker-build time.
+ * Build the `bun publish` argv for a workspace item. When a private
+ * registry target is configured (a deployed npm-cache-node) AND the
+ * package is @celilo/*-scoped, point bun at it via --registry; otherwise
+ * publish to the default registry (npmjs — current behavior).
+ * v2/NPM_CACHE_NODE.md Phase 3.1 / v2/PUBLILO_CLI.md decision 10.
  */
-export function stageE2ePublishCaches(repoRoot: string): void {
-  const websiteSrc = join(repoRoot, 'modules', 'celilo-website', 'site');
-  const e2eDir = join(repoRoot, 'packages', 'e2e');
-  const websiteCache = join(e2eDir, '.celilo-website-cache');
-  const npmCache = join(e2eDir, '.npm-registry-cache');
-  const packScript = join(e2eDir, 'scripts', 'pack-celilo-packages.ts');
-
-  if (!existsSync(websiteSrc)) {
-    console.error(`✗ ${websiteSrc} not found — cannot stage .celilo-website-cache.`);
-    process.exit(1);
+export function buildPublishArgs(
+  item: Pick<WorkspaceItem, 'name' | 'tag'>,
+  registryTarget: string | null,
+): string[] {
+  const args = ['publish', '--access', 'public'];
+  if (item.tag) args.push('--tag', item.tag);
+  if (registryTarget && item.name.startsWith('@celilo/')) {
+    args.push('--registry', registryTarget);
   }
-  if (!existsSync(packScript)) {
-    console.error(`✗ ${packScript} not found — cannot stage .npm-registry-cache.`);
-    process.exit(1);
-  }
-
-  console.log('Staging .celilo-website-cache/ from modules/celilo-website/site/...');
-  const installResult = spawnSync('bun', ['install'], { cwd: websiteSrc, stdio: 'pipe' });
-  if (installResult.status !== 0) {
-    console.error('✗ bun install for celilo-website failed:');
-    console.error(installResult.stderr?.toString());
-    process.exit(1);
-  }
-  const buildResult = spawnSync('bun', ['run', 'build'], { cwd: websiteSrc, stdio: 'pipe' });
-  if (buildResult.status !== 0) {
-    console.error('✗ bun run build for celilo-website failed:');
-    console.error(buildResult.stderr?.toString());
-    process.exit(1);
-  }
-  rmSync(websiteCache, { recursive: true, force: true });
-  mkdirSync(websiteCache, { recursive: true });
-  cpSync(join(websiteSrc, 'dist'), websiteCache, { recursive: true });
-  console.log(`✓ Staged .celilo-website-cache/ (from ${relative(repoRoot, websiteSrc)}/dist/)\n`);
-
-  console.log('Staging .npm-registry-cache/ from @celilo/* workspace tarballs...');
-  const packResult = spawnSync('bun', ['run', packScript], { cwd: repoRoot, stdio: 'pipe' });
-  if (packResult.status !== 0) {
-    console.error('✗ pack-celilo-packages.ts failed:');
-    console.error(packResult.stderr?.toString());
-    process.exit(1);
-  }
-  const packed = existsSync(npmCache)
-    ? readdirSync(npmCache).filter((f) => f.endsWith('.tgz'))
-    : [];
-  console.log(`✓ Staged .npm-registry-cache/ with ${packed.length} workspace tarball(s)\n`);
+  return args;
 }
 
 // ─── Executor ──────────────────────────────────────────────────────
@@ -486,6 +354,13 @@ export async function executeWorkspace(input: ExecuteWorkspaceInput): Promise<Pu
   const published: PublishResult['published'] = [];
   const skipped: string[] = [];
 
+  // When an npm-cache-node is configured, @celilo/* tarballs go there
+  // (the cache forwards upstream under policy); unset → npmjs.
+  const registryTarget = readNpmPublishTarget();
+  if (registryTarget) {
+    console.log(`\nPublishing @celilo/* to configured registry: ${registryTarget}`);
+  }
+
   for (const item of items) {
     const { pkg, name, baseVersion, versionToPublish } = item;
 
@@ -511,12 +386,6 @@ export async function executeWorkspace(input: ExecuteWorkspaceInput): Promise<Pu
         'Refreshed packages/e2e/registry-server/ bundle from packages/registry-server.\n',
       );
     }
-    if (item.hooks.includes('rebuildE2eNetapps')) {
-      rebuildE2eNetapps(REPO_ROOT);
-    }
-    if (item.hooks.includes('stageE2ePublishCaches')) {
-      stageE2ePublishCaches(REPO_ROOT);
-    }
 
     const { original: pkgJsonOriginal, rewrites: workspaceRewrites } = rewriteWorkspaceDeps(
       pkg,
@@ -548,8 +417,7 @@ export async function executeWorkspace(input: ExecuteWorkspaceInput): Promise<Pu
       process.exit(1);
     }
 
-    const publishArgs = ['publish', '--access', 'public'];
-    if (item.tag) publishArgs.push('--tag', item.tag);
+    const publishArgs = buildPublishArgs(item, registryTarget);
 
     let publishStatus: number | null = null;
     let publishError: unknown = null;
@@ -591,7 +459,15 @@ export async function executeWorkspace(input: ExecuteWorkspaceInput): Promise<Pu
     }
 
     if (workspaceRewrites.length > 0) {
-      await verifyPublishedDeps(name, versionToPublish, workspaceRewrites);
+      // Verify against the same registry we published to — a cache node
+      // forwards upstream under policy, so the version may not be on
+      // npmjs yet.
+      await verifyPublishedDeps(
+        name,
+        versionToPublish,
+        workspaceRewrites,
+        registryTarget ?? undefined,
+      );
     }
 
     // Silence the unused-var warning on baseVersion — we keep the value

package/src/cli/completion.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import { getDb } from '../db/client';
 import { capabilities, modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { listPrincipals } from '../services/api-access';
 import { listBackups } from '../services/backup-metadata';
 import { listBackupStorages } from '../services/backup-storage';
 import { listContainerServices } from '../services/container-service';
@@ -28,6 +29,7 @@ export async function getCompletions(words: string[], current: number): Promise<
   // currentIndex === 0 means we're completing the first word (the command)
   if (currentIndex === 0) {
     const commands = [
+      'api',
       'audit',
       'backup',
       'capability',
@@ -332,6 +334,26 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(configKeys, args[4] || '');
   }
 
+  // API subcommands
+  if (command === 'api' && currentIndex === 1) {
+    const subcommands = ['grant', 'list', 'revoke', 'authorized-keys', 'key'];
+    return filterSuggestions(subcommands, args[1] || '');
+  }
+
+  // API revoke - complete with principal names
+  if (command === 'api' && args[1] === 'revoke' && currentIndex === 2) {
+    const principals = await listPrincipals();
+    return filterSuggestions(
+      principals.map((p) => p.name),
+      args[2] || '',
+    );
+  }
+
+  // API key subcommands
+  if (command === 'api' && args[1] === 'key' && currentIndex === 2) {
+    return filterSuggestions(['new'], args[2] || '');
+  }
+
   // Machine subcommands
   if (command === 'machine' && currentIndex === 1) {
     const subcommands = ['add', 'list', 'status', 'remove', 'earmark', 'detect'];

package/src/cli/index.ts

@@ -5,8 +5,16 @@
  */
 
 import * as p from '@clack/prompts';
+import { resolveRemote, runRemoteClient } from '../api/remote-client';
 import { CLIServerRequestSchema, parseJsonWithValidation } from '../validation/schemas';
 import { COMMANDS, type CommandDef } from './command-registry';
+import {
+  handleApiAuthorizedKeys,
+  handleApiGrant,
+  handleApiKeyNew,
+  handleApiList,
+  handleApiRevoke,
+} from './commands/api';
 import { handleCapabilityInfo } from './commands/capability-info';
 import { handleCapabilityList } from './commands/capability-list';
 import { handleCompletion } from './commands/completion';
@@ -184,10 +192,14 @@ Commands:
   proxmox                  Proxmox cluster introspection (proxmox node list)
   publish                  Publish workspace packages to npm and modules to celilo.computer
   subscribers              Manage build-bus subscribers (cross-machine publish-event delivery)
+  api                      Manage remote-API access (principals, grants, authorized_keys)
   completion               Generate shell completion scripts (bash/zsh)
 
   help, --help, -h         Show this help message
 
+Run any command on a remote celilo-mgr over SSH:
+  celilo --remote <ssh-dest> <command>     (or set CELILO_REMOTE=<ssh-dest>)
+
 For command-specific help:
   celilo package --help
   celilo module --help
@@ -1015,6 +1027,24 @@ Using Vault Password:
 export async function runCli(argv: string[]): Promise<CommandResult> {
   const parsed = parseArguments(argv);
 
+  // Remote API server: the sshd forced-command entry point
+  // (`celilo api-serve --principal=<id>`). Not an operator command — kept out
+  // of the registry/completion on purpose. Runs a persistent NDJSON protocol
+  // loop until stdin closes, then exits the process; never returns here.
+  if (parsed.command === 'api-serve') {
+    const principal = typeof parsed.flags.principal === 'string' ? parsed.flags.principal : '';
+    if (!principal) {
+      return {
+        success: false,
+        error:
+          'api-serve requires --principal <name> (normally supplied by the forced command in authorized_keys)',
+      };
+    }
+    const { apiServeMode } = await import('../api/serve');
+    await apiServeMode(principal);
+    return { success: true, message: '' };
+  }
+
   // Handle --get-completions for shell completion (must be before other processing)
   if (parsed.flags['get-completions']) {
     try {
@@ -1673,6 +1703,64 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     return handleRestore(restoreArgs, parsed.flags);
   }
 
+  if (parsed.command === 'api') {
+    if (parsed.flags.help || parsed.flags.h) {
+      return {
+        success: true,
+        message: [
+          'celilo api — manage remote-API access',
+          '',
+          'Usage:',
+          '  celilo api grant <principal> --key <pubkey|path> --can <grant[,grant...]>',
+          '  celilo api list',
+          '  celilo api revoke <principal>',
+          '  celilo api authorized-keys',
+          '  celilo api key new <name>',
+          '',
+          'Grants are command:subcommand (module:deploy), command:* (service:*), or * (all).',
+        ].join('\n'),
+      };
+    }
+
+    if (!parsed.subcommand) {
+      return {
+        success: false,
+        error: 'API subcommand required\n\nRun "celilo api --help" for usage',
+      };
+    }
+
+    const apiFlagError = checkFlags('api', parsed.subcommand, parsed.flags, parsed.args);
+    if (apiFlagError) return apiFlagError;
+
+    if (parsed.subcommand === 'grant') {
+      return handleApiGrant(parsed.args, parsed.flags);
+    }
+
+    if (parsed.subcommand === 'list') {
+      return handleApiList();
+    }
+
+    if (parsed.subcommand === 'revoke') {
+      return handleApiRevoke(parsed.args);
+    }
+
+    if (parsed.subcommand === 'authorized-keys') {
+      return handleApiAuthorizedKeys();
+    }
+
+    if (parsed.subcommand === 'key') {
+      if (parsed.args[0] === 'new') {
+        return handleApiKeyNew(parsed.args.slice(1));
+      }
+      return { success: false, error: 'Usage: celilo api key new <name>' };
+    }
+
+    return {
+      success: false,
+      error: `Unknown api subcommand: ${parsed.subcommand}\n\nRun "celilo api --help" for usage`,
+    };
+  }
+
   if (parsed.command === 'machine') {
     // Handle machine --help
     if (parsed.flags.help || parsed.flags.h) {
@@ -2084,6 +2172,13 @@ export async function main(): Promise<void> {
     return;
   }
 
+  // Remote execution: `celilo --remote <dest> <cmd>` or CELILO_REMOTE=<dest>.
+  // SSH to the remote celilo-mgr and drive its api-serve over the wire.
+  const remote = resolveRemote(process.argv);
+  if (remote) {
+    process.exit(await runRemoteClient(remote.dest, remote.commandArgv));
+  }
+
   // Normal single-command execution
   try {
     const result = await runCli(process.argv);

package/src/cli/parser.test.ts

@@ -107,6 +107,19 @@ describe('CLI Parser', () => {
       expect(result.flags).toEqual({ json: true, verbose: true });
     });
 
+    test('should parse --flag=value inline form', () => {
+      const result = parseArguments([
+        'node',
+        'celilo',
+        'api-serve',
+        '--principal=alice',
+        '--empty=',
+      ]);
+
+      expect(result.command).toBe('api-serve');
+      expect(result.flags).toEqual({ principal: 'alice', empty: '' });
+    });
+
     test('should not consume key=value args as flag values', () => {
       const result = parseArguments([
         'node',

package/src/cli/parser.ts

@@ -82,8 +82,17 @@ export function parseArguments(argv: string[]): ParsedCommand {
     if (!arg) continue;
 
     if (arg.startsWith('--')) {
-      // Long flag (--help, --output, etc.)
-      const flagName = arg.slice(2);
+      const body = arg.slice(2);
+      const eqIndex = body.indexOf('=');
+
+      // Inline-value form: --flag=value (everything after the first `=`).
+      if (eqIndex >= 0) {
+        flags[body.slice(0, eqIndex)] = body.slice(eqIndex + 1);
+        continue;
+      }
+
+      // Space-separated form: --flag value
+      const flagName = body;
       const nextArg = restArgs[i + 1];
 
       // Check if next arg is a value (not another flag, not a key=value pair)

package/src/db/schema.ts

@@ -654,6 +654,34 @@ export const aspectApprovals = sqliteTable(
   }),
 );
 
+/**
+ * Remote API principals (see v2/API_COMMUNICATION.md).
+ *
+ * Each row is one API identity: a name, one SSH public key, and the set of
+ * operations it may run. celilo renders these into the API account's
+ * `authorized_keys` (one forced-command line per row) and authz keys off the
+ * principal → `grants`.
+ *
+ * ponytail: one key per principal (a person wanting a second device makes a
+ * second principal, e.g. `alice-laptop`). If multiple keys per identity is ever
+ * needed, split into an `api_keys` child table — not worth it yet.
+ */
+export const apiPrincipals = sqliteTable('api_principals', {
+  id: text('id').primaryKey(), // UUID
+  /** Human-readable principal name, kebab-case (e.g. "alice", "ci-deployer"). */
+  name: text('name').notNull().unique(),
+  /** SSH public key line: `<type> <base64> [comment]`. */
+  publicKey: text('public_key').notNull(),
+  /**
+   * Operations this principal may run, as `command:subcommand` grants
+   * (`module:deploy`), `command:*` wildcards (`service:*`), or `*` (all).
+   * Deny-by-default: an operation not matched by any grant is refused.
+   */
+  grants: text('grants', { mode: 'json' }).$type<string[]>().notNull().default(sql`'[]'`),
+  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),
+});
+
 /**
  * Type exports for use in application code
  */
@@ -695,3 +723,5 @@ export type ModuleOperation = typeof moduleOperations.$inferSelect;
 export type NewModuleOperation = typeof moduleOperations.$inferInsert;
 export type AspectApproval = typeof aspectApprovals.$inferSelect;
 export type NewAspectApproval = typeof aspectApprovals.$inferInsert;
+export type ApiPrincipal = typeof apiPrincipals.$inferSelect;
+export type NewApiPrincipal = typeof apiPrincipals.$inferInsert;

package/src/hooks/capability-loader.test.ts

@@ -126,4 +126,81 @@ describe('Capability Loader', () => {
     const consumer = await loadCapabilityFunctions('apt-repo', db, noopLogger);
     expect(consumer).not.toHaveProperty('web_routes');
   });
+
+  // ce-iku regression: public_web's managed-domain check must reflect the
+  // registrar's DECLARED `domain_list` computed field (namecheap:
+  // keys(secret.ddns_passwords)) — the same live set DDNS validation sees —
+  // NOT a stale `config.domains` row that survived an older manifest version.
+  // Without the fix the config-shape heuristic short-circuits on the stale
+  // config.domains and a just-added domain (present only in the secret) is
+  // silently excluded, dead-ending register_route forever.
+  test('public_web managed-domains come from the registrar domain_list computed field, not a stale config.domains', async () => {
+    const { encryptSecret } = await import('../secrets/encryption');
+    const { getOrCreateMasterKey } = await import('../secrets/master-key');
+    const { isMissingProviderInputError } = await import('@celilo/capabilities');
+    const masterKey = await getOrCreateMasterKey();
+
+    // Provider: caddy (public_web). Needs ≥1 configured hostname + target_ip
+    // for createPublicWeb to build.
+    const caddyPath = join(tempDir, 'caddy');
+    mkdirSync(caddyPath, { recursive: true });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('caddy', 'Caddy', '1.0.0', '${caddyPath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('caddy', 'public_web', '1.0.0', '{}', unixepoch())`,
+    );
+    upsertModuleConfig(db, 'caddy', 'hostnames', ['seed.celilo.computer']);
+    upsertModuleConfig(db, 'caddy', 'target_ip', '10.0.20.10');
+
+    // Provider: namecheap (dns_registrar). Its `data` declares the canonical
+    // domain_list computed field. config.domains is STALE (missing the newly
+    // onboarded domain); the SECRET holds the real, current set.
+    const ncPath = join(tempDir, 'namecheap');
+    mkdirSync(ncPath, { recursive: true });
+    const registrarData = JSON.stringify({
+      provider: 'namecheap',
+      domain_list: { __celilo_computed__: 'keys(secret.ddns_passwords)' },
+    });
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('namecheap', 'Namecheap', '3.2.0', '${ncPath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('namecheap', 'dns_registrar', '4.0.0', '${registrarData}', unixepoch())`,
+    );
+    // Stale config that must be IGNORED — omits buildyourowninternet.dev.
+    upsertModuleConfig(db, 'namecheap', 'domains', ['celilo.computer']);
+    // Live secret — the source of truth — includes the new domain.
+    const ddnsEnc = encryptSecret(
+      JSON.stringify({ 'celilo.computer': 'pw1', 'buildyourowninternet.dev': 'pw2' }),
+      masterKey,
+    );
+    db.$client.run(
+      `INSERT INTO secrets (module_id, name, encrypted_value, iv, auth_tag) VALUES ('namecheap', 'ddns_passwords', '${ddnsEnc.encryptedValue}', '${ddnsEnc.iv}', '${ddnsEnc.authTag}')`,
+    );
+
+    const consumer = await loadCapabilityFunctions('byoi', db, noopLogger);
+    const publicWeb = consumer.public_web as {
+      register_route: (r: { type: string; path: string; hostname: string }) => Promise<unknown>;
+    };
+    expect(publicWeb).toBeTruthy();
+
+    // Does register_route reject specifically because the hostname's apex
+    // isn't in any managed domain? (Later reconcile errors are a different
+    // failure — the domain check already passed by then.)
+    async function rejectsAsMissingProvider(hostname: string): Promise<boolean> {
+      try {
+        await publicWeb.register_route({ type: 'static', path: '/', hostname });
+        return false;
+      } catch (err) {
+        return isMissingProviderInputError(err);
+      }
+    }
+
+    // In the secret (domain_list) but NOT in the stale config.domains — must
+    // pass the managed-domain check.
+    expect(await rejectsAsMissingProvider('www.buildyourowninternet.dev')).toBe(false);
+    // In neither the secret nor config — control: must still be rejected.
+    expect(await rejectsAsMissingProvider('app.notmanaged.example')).toBe(true);
+  });
 });