@devrouter/cli 0.0.76 → 0.0.77

package/dist/devrouter-lifecycle-worker.js

@@ -4683,7 +4683,7 @@ var ControllerStore = class {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.76" : "0.0.0-dev";
+  return true ? "0.0.77" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6383,7 +6383,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.77" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -13911,6 +13911,14 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             "Claimed network repair requires exact retained-network reconciliation; automatic repair is unavailable."
           );
       }
+      let earlyTlsRefreshed = false;
+      if (!options.repair) {
+        claimLifecycleEffect();
+        earlyTlsRefreshed = (await ensureTLSHostsCovered(
+          apps.map((app) => app.host),
+          { repoPath }
+        )).refreshed;
+      }
       if (managedPlan && !options.repair && !network) {
         if (!target.hadExactDevpod && devpodId && inspectLegacyNetworkCapacity({
           provider: resolveWorkspaceRuntimeOrDefault(repoPath),
@@ -14333,7 +14341,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         devpodId,
         urls,
         recreated,
-        tlsRefreshed: publication.tlsRefreshed,
+        tlsRefreshed: earlyTlsRefreshed || publication.tlsRefreshed,
         ...applicationReadiness ? { applicationReadiness } : {},
         ...managedRuntimeStatus ? { managedRuntime: managedRuntimeStatus } : {}
       };

package/dist/devrouter.js

@@ -4256,7 +4256,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.77" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5509,7 +5509,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.76" : "0.0.0-dev";
+  return true ? "0.0.77" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -15261,6 +15261,7 @@ var init_workspace_ensure = __esm({
     init_repo_config();
     init_route_publication();
     init_router();
+    init_tls();
     init_traefik_route_health();
     init_workspace();
     init_workspace_ownership();
@@ -21122,7 +21123,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.76" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.77" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -26563,7 +26564,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.76" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.77" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.76",
+  "version": "0.0.77",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.77.md

@@ -0,0 +1,35 @@
+# Upgrade to devrouter 0.0.77
+
+Ordinary ensure now prepares TLS coverage for resolved HTTP and TCP proxy hosts
+before provider startup and container-side repository hooks. The existing
+certificate lock preserves coverage for other checkouts. Late publication checks
+remain, and retained-runtime repair keeps its infrastructure-free behavior.
+No schema, command, flag, or environment-variable migration is needed.
+
+## Task
+
+Use the published 0.0.77 CLI. Update `.devrouter.yml` devrouter.version only when
+consumer source changes are authorized. Preserve staged work owned by another
+task. Refresh generated agent guidance only with the repository owner's authority.
+No generated runtime configuration or journal rewrite is needed.
+
+For an affected checkout, retain one owner for its supported ensure/check/stop
+sequence. Historical degraded state can select retained-runtime repair, which
+skips shared infrastructure. If certificate coverage is missing, reconcile it
+through the supported TLS setup or refresh path with the relevant machine-change
+authority; do not bypass TLS verification or repeat lifecycle mutations blindly.
+
+## Validation
+
+Verify the installed version and exact checkout ownership. Check that the served
+certificate validates the resolved hostname using the trusted local CA; certificate
+file coverage alone does not prove live serving. Verify application readiness
+separately. Finish with canonical stop and exact provider-stopped/zero-route proof
+unless the owner explicitly retains the runtime. Preserve live-worker, ownership,
+configuration and surviving-resource refusals.
+
+## Report
+
+Report release revision, installed executable, exact checkout and producing-run
+results. Separate source/CI and TLS proof from application readiness and runtime
+shutdown. A trusted TLS handshake or an HTTP404 is not successful app recovery.