@faable/faable 4.12.0 → 4.14.0

package/dist/commands/deploy/domains/add.js

@@ -2,7 +2,7 @@ import { requireApi } from '../../../api/context.js';
 import { print_json, json_option } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
-import { cname_target } from './format.js';
+import { acme_record, cname_target } from './format.js';
 
 const domains_add = {
     command: 'add <fqdn>',
@@ -37,7 +37,11 @@ const domains_add = {
         // Same shape as `domains check --json`: the record plus the CNAME to
         // create, which is the whole next step.
         if (args.json) {
-            return print_json({ ...domain, expected_cname: cname_target(domain) });
+            return print_json({
+                ...domain,
+                expected_cname: cname_target(domain),
+                ...(args.tls ? { prevalidation_cname: acme_record(domain) } : {})
+            });
         }
         log.info(`🌐 Domain ${domain.fqdn} added to ${app.name} (${app_id}).`);
         log.info(``);
@@ -45,6 +49,13 @@ const domains_add = {
         log.info(`  ${domain.fqdn} → ${cname_target(domain)}`);
         log.info(``);
         log.info(`Faable verifies the record automatically once DNS propagates${args.tls ? ' and then provisions the TLS certificate' : ''}.`);
+        if (args.tls) {
+            const acme = acme_record(domain);
+            log.info(``);
+            log.info(`Already serving ${domain.fqdn} somewhere else? Create this record FIRST and leave the CNAME above for later:`);
+            log.info(`  ${acme.name} → ${acme.target}`);
+            log.info(`Faable then issues the certificate before any traffic moves, and switching the CNAME has no TLS gap.`);
+        }
         log.info(`Track it with: faable deploy domains check ${domain.fqdn}`);
     }
 };

package/dist/commands/deploy/domains/check.js

@@ -2,7 +2,7 @@ import { requireApi } from '../../../api/context.js';
 import { print_json, json_option } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
-import { find_by_fqdn, cname_target, dns_badge } from './format.js';
+import { find_by_fqdn, acme_record, cname_target, dns_badge, tls_line } from './format.js';
 
 const domains_check = {
     command: 'check <fqdn>',
@@ -30,7 +30,11 @@ const domains_check = {
         }
         // The record plus the one thing it does not carry: the CNAME to create.
         if (args.json) {
-            return print_json({ ...domain, expected_cname: cname_target(domain) });
+            return print_json({
+                ...domain,
+                expected_cname: cname_target(domain),
+                ...(domain.tls ? { prevalidation_cname: acme_record(domain) } : {})
+            });
         }
         const status = domain.status;
         log.info(`🌐 ${domain.fqdn} — ${dns_badge(domain)}`);
@@ -44,6 +48,13 @@ const domains_check = {
         if (status?.dns_message) {
             log.info(`  Diagnostic:     ${status.dns_message}`);
         }
+        if (domain.tls) {
+            const acme = acme_record(domain);
+            log.info(`  Pre-validation: ${acme.name} → ${acme.target} ${acme.ready
+                ? '✅ in place: the certificate is issued without waiting for the CNAME'
+                : '(optional; for a domain live elsewhere, so the move has no TLS gap)'}`);
+        }
+        log.info(`  Certificate:    ${tls_line(domain)}`);
         if (status?.dns_checked_at) {
             log.info(`  Last checked:   ${status.dns_checked_at}`);
         }

package/dist/commands/deploy/domains/format.js

@@ -19,6 +19,27 @@ const dns_badge = (domain) => {
 // value); fall back to deriving it from the id so `add` can print
 // instructions even before the first DNS check populates the status.
 const cname_target = (domain) => domain.status?.dns_expected?.[0] ?? `${domain.id}.faable.link`;
+// The optional record that gets the certificate issued BEFORE the domain
+// points here: a domain that is live somewhere else moves without a TLS gap.
+// Published by the api in `status.acme_expected`; derived from the id until
+// the first check fills it in, like the CNAME above.
+const acme_record = (domain) => ({
+    name: `_acme-challenge.${domain.fqdn}`,
+    target: domain.status?.acme_expected?.[0] ?? `${domain.id}.acme.faable.com`,
+    ready: domain.status?.acme_state === 'ok'
+});
+// The certificate line of `domains check`: what the edge serves today.
+const tls_line = (domain) => {
+    if (!domain.tls)
+        return 'off (tls: false)';
+    if (domain.status?.tls_state === 'ok') {
+        const until = domain.status.tls_expires_at?.slice(0, 10);
+        return `✅ served${until ? `, valid until ${until}` : ''}`;
+    }
+    return domain.status?.acme_state === 'ok' || domain.status?.dns_state === 'ok'
+        ? '⏳ being issued — usually a couple of minutes'
+        : '⏳ issued once the CNAME (or the pre-validation record) is in place';
+};
 const find_by_fqdn = (domains, fqdn) => domains.find(d => d.fqdn.toLowerCase() === fqdn.toLowerCase());
 
-export { cname_target, dns_badge, find_by_fqdn };
+export { acme_record, cname_target, dns_badge, find_by_fqdn, tls_line };

package/dist/mcp/tools.js

@@ -352,7 +352,7 @@ const TOOLS = [
     {
         name: 'check_domain',
         title: 'Check a domain',
-        description: 'DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet.',
+        description: 'DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet. `prevalidation_cname.ready` says whether the optional `_acme-challenge` record is in place, so the certificate is issued without waiting for the CNAME; `status.tls_state` is `ok` once the edge serves a valid certificate for the domain (`status.tls_expires_at`).',
         input: {
             app,
             project,
@@ -782,7 +782,7 @@ const TOOLS = [
     {
         name: 'add_domain',
         title: 'Add a custom domain',
-        description: 'Attach a custom domain to an app. Returns the CNAME record the user must create at their DNS provider; Faable verifies it and issues the certificate on its own.',
+        description: "Attach a custom domain to an app. Returns the CNAME record the user must create at their DNS provider; Faable verifies it and issues the certificate on its own. If the domain already serves traffic somewhere else, tell the user to create `prevalidation_cname` (`_acme-challenge.<fqdn>` CNAME) FIRST and switch the main CNAME only once check_domain shows it ready: the certificate then exists before traffic moves, with no TLS gap.",
         input: { app, project, fqdn: z.string().describe('e.g. www.example.com') },
         command: ['deploy', 'domains', 'add'],
         flags: a => [a.fqdn, ...target(a)],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.12.0",
+  "version": "4.14.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",