@faable/faable 4.13.0 → 4.15.0

package/dist/commands/deploy/domains/check.js

@@ -2,7 +2,7 @@ import { requireApi } from '../../../api/context.js';
 import { print_json, json_option } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
-import { find_by_fqdn, acme_record, cname_target, dns_badge } from './format.js';
+import { find_by_fqdn, acme_record, cname_target, dns_badge, tls_line } from './format.js';
 
 const domains_check = {
     command: 'check <fqdn>',
@@ -54,6 +54,7 @@ const domains_check = {
                 ? '✅ in place: the certificate is issued without waiting for the CNAME'
                 : '(optional; for a domain live elsewhere, so the move has no TLS gap)'}`);
         }
+        log.info(`  Certificate:    ${tls_line(domain)}`);
         if (status?.dns_checked_at) {
             log.info(`  Last checked:   ${status.dns_checked_at}`);
         }

package/dist/commands/deploy/domains/format.js

@@ -28,6 +28,18 @@ const acme_record = (domain) => ({
     target: domain.status?.acme_expected?.[0] ?? `${domain.id}.acme.faable.com`,
     ready: domain.status?.acme_state === 'ok'
 });
+// The certificate line of `domains check`: what the edge serves today.
+const tls_line = (domain) => {
+    if (!domain.tls)
+        return 'off (tls: false)';
+    if (domain.status?.tls_state === 'ok') {
+        const until = domain.status.tls_expires_at?.slice(0, 10);
+        return `✅ served${until ? `, valid until ${until}` : ''}`;
+    }
+    return domain.status?.acme_state === 'ok' || domain.status?.dns_state === 'ok'
+        ? '⏳ being issued — usually a couple of minutes'
+        : '⏳ issued once the CNAME (or the pre-validation record) is in place';
+};
 const find_by_fqdn = (domains, fqdn) => domains.find(d => d.fqdn.toLowerCase() === fqdn.toLowerCase());
 
-export { acme_record, cname_target, dns_badge, find_by_fqdn };
+export { acme_record, cname_target, dns_badge, find_by_fqdn, tls_line };

package/dist/commands/deploy/launch.js

@@ -7,6 +7,7 @@ import { log } from '../../log.js';
 import { requireProject } from '../../api/project.js';
 import { git_context } from './git_context.js';
 import { show_deploy_help } from './help.js';
+import { reachable_timeout_ms, wait_reachable } from './reachable.js';
 import { propose_release } from './release_version.js';
 import { assert_name_free } from './apps/name_free.js';
 import { deploy_remote } from './remote/index.js';
@@ -221,6 +222,13 @@ const launch = {
                     log.debug(`Polling app status failed, retrying...`);
                 }
             }
+            // Promoted is not yet answering: wait for the edge to route the URL
+            // (F9). `undefined` when the check is off (FAABLE_REACHABLE_TIMEOUT_MS=0).
+            let reachable;
+            if (promoted && reachable_timeout_ms() > 0) {
+                log.info(`⏳ Live — waiting for https://${app.url} to answer...`);
+                reachable = await wait_reachable(`https://${app.url}`, reachable_timeout_ms());
+            }
             if (args.json) {
                 const outcome = promoted
                     ? 'live'
@@ -239,6 +247,7 @@ const launch = {
                     deployment_id: deployment.id,
                     outcome,
                     url: `https://${app.url}`,
+                    ...(reachable !== undefined ? { reachable } : {}),
                     ...(failure
                         ? {
                             phase: failure.phase,
@@ -262,6 +271,9 @@ const launch = {
             }
             if (promoted) {
                 log.info(`🌍 Deployment promoted and live, visit: https://${app.url}`);
+                if (reachable === false) {
+                    log.warn(`⚠️ The URL still answers "app not found" — the edge is picking up the route. Try again in a minute.`);
+                }
             }
             else if (superseded) {
                 // Not a failure: the app IS live, just on a sibling deployment (e.g.

package/dist/commands/deploy/reachable.js

@@ -0,0 +1,52 @@
+// A promoted deployment is not yet a URL that answers: the edge picks up a
+// new app's route a little later, and until then it says `APP_NOT_FOUND`
+// (header `x-faable-error`, cacheable for 120 s). On 2026-10-16 a deploy
+// reported `outcome: live` and the URL gave 404 for about a minute — an agent
+// checking it right away would conclude the deploy was broken
+// (arch/deploy/cli-mcp-fallos-2026-10-16-plan.md, F9).
+//
+// Only the edge's own "no app here" counts as not served: an app is free to
+// answer 404 (or anything) on `/`, and that is its answer, not ours.
+const NOT_FOUND = 'APP_NOT_FOUND';
+// FAABLE_REACHABLE_TIMEOUT_MS: how long to wait for the edge (default 120 s);
+// `0` skips the check — a stub API in tests, or a caller that only wants the
+// deployment's phase.
+const reachable_timeout_ms = (env = process.env) => {
+    const raw = env.FAABLE_REACHABLE_TIMEOUT_MS;
+    const n = raw === undefined || raw === '' ? 120_000 : Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : 120_000;
+};
+/**
+ * Wait until `url` is served by the app rather than the edge's "no app here".
+ * True as soon as it is; false when `timeout_ms` runs out (the deploy is
+ * still live — the route is just late). Never throws: a failed request is one
+ * more "not yet".
+ */
+const wait_reachable = async (url, timeout_ms, deps = {}) => {
+    const fetch_ = deps.fetch ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise(r => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
+    const deadline = now() + timeout_ms;
+    for (;;) {
+        try {
+            // The not-found answer is cacheable: bust it, or we would read our own
+            // first answer back for two minutes.
+            const probe = `${url}${url.includes('?') ? '&' : '?'}_faable_probe=${now()}`;
+            const res = await fetch_(probe, {
+                method: 'GET',
+                redirect: 'manual',
+                headers: { 'cache-control': 'no-cache' }
+            });
+            if (res.headers.get('x-faable-error') !== NOT_FOUND)
+                return true;
+        }
+        catch {
+            // not reachable yet
+        }
+        if (now() >= deadline)
+            return false;
+        await sleep(3_000);
+    }
+};
+
+export { reachable_timeout_ms, wait_reachable };

package/dist/commands/deploy/wait.js

@@ -1,3 +1,5 @@
+import { reachable_timeout_ms, wait_reachable } from './reachable.js';
+
 // The phases a deployment does not leave on its own. READY is the good one.
 const TERMINAL_PHASES = new Set([
     'READY',
@@ -27,8 +29,15 @@ const wait_for_deployment = async (api, deployment_id, opts, deps = {}) => {
                 done: true,
                 ok: phase === 'READY'
             };
-            if (phase === 'READY' && opts.app_url)
+            if (phase === 'READY' && opts.app_url) {
                 result.url = opts.app_url;
+                const check = deps.reachable ??
+                    (reachable_timeout_ms() > 0
+                        ? (url) => wait_reachable(url, reachable_timeout_ms())
+                        : undefined);
+                if (check)
+                    result.reachable = await check(opts.app_url);
+            }
             if (phase !== 'READY' && d?.status?.reason) {
                 result.reason = d.status.reason;
             }

package/dist/mcp/tools.js

@@ -352,7 +352,7 @@ const TOOLS = [
     {
         name: 'check_domain',
         title: 'Check a domain',
-        description: 'DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet. `prevalidation_cname.ready` says whether the optional `_acme-challenge` record is in place, so the certificate is issued without waiting for the CNAME.',
+        description: 'DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet. `prevalidation_cname.ready` says whether the optional `_acme-challenge` record is in place, so the certificate is issued without waiting for the CNAME; `status.tls_state` is `ok` once the edge serves a valid certificate for the domain (`status.tls_expires_at`).',
         input: {
             app,
             project,
@@ -854,6 +854,25 @@ const TOOLS = [
         },
         example: { app: 'web', repo: 'acme/web', branch: 'main' }
     },
+    {
+        name: 'delete_app',
+        title: 'Delete an app',
+        description: "Delete an app, as the dashboard's Delete app does: its deployments, domains and secrets go with it and its URL stops being served. It cannot be undone — confirm with the user which app (get_app) before calling it. Only on the local server with `faable mcp --writes`.",
+        input: { app, project },
+        command: ['deploy', 'apps', 'rm'],
+        flags: a => ['--yes', ...target(a)],
+        write: true,
+        // The hosted server promises its users nothing destructive (the consent
+        // screen and docs/cli.md say so): deleting stays with whoever runs the
+        // MCP on their own machine and passed --writes.
+        local_only: true,
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            openWorldHint: true
+        },
+        example: { app: 'web' }
+    },
     {
         name: 'deploy_directory',
         title: 'Deploy a local directory',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.13.0",
+  "version": "4.15.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",