@k2b/cloud 0.47.0 → 0.49.0

package/src/_internal/registry.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { EphemeralConfig, MutexConfig } from "@k2b/sync";
 import type { AppAppearanceColor } from "../contracts/app";
+import { appStatusIssues } from "../contracts/app-status";
 import { calendarSourceIssues } from "../contracts/calendar-source";
 import type { CapabilityManifest, CapabilityPresentationCatalog } from "../contracts/capabilities";
 import { discussionsIssues } from "../contracts/discussions";
@@ -16,6 +17,7 @@ import {
   WIDGET_TITLE_MAX_LENGTH,
   type WidgetSettingsDeclaration,
 } from "../contracts/widgets";
+import type { PlatformBootstrapMetadata } from "../runtime/connections";
 import { resolveAppPresentations } from "../shared/app-presentation";
 import { compileCapabilityPresentation, parseCapabilityManifest } from "./capabilities";
 import { lazySync } from "./process-sync";
@@ -63,6 +65,8 @@ export type AppInstanceRecord = {
   hostname: string;
   startedAt: number;
   entries: Record<string, string>;
+  /** Missing on older instances means unknown, never env or successful bootstrap. */
+  bootstrap?: PlatformBootstrapMetadata;
 };
 
 // The id and owner are a cross-version contract: all replicas must use the same lock.
@@ -103,6 +107,8 @@ export type AppRegistryDetail = AppRegistryEntry & {
   updatedAt: number;
   expiresAt: number;
   version: string;
+  /** Per-process startup metadata for admin readers. null means an older/unknown producer. */
+  instances?: { instanceId: string; hostname: string; startedAt: number; bootstrap: PlatformBootstrapMetadata | null }[];
 };
 
 export type AppRegistryIssue = {
@@ -238,6 +244,7 @@ const reportLeftOutEntries = (sent: unknown, manifest: CapabilityManifest): void
   });
   if (groups.calendarSource !== undefined && !manifest.calendarSource) leftOut.push("calendarSource");
   if (groups.fileProvider !== undefined && !manifest.fileProvider) leftOut.push("fileProvider");
+  if (groups.appStatus !== undefined && !manifest.appStatus) leftOut.push("appStatus");
   if (groups.discussions !== undefined && !manifest.discussions) leftOut.push("discussions");
   if (leftOut.length === 0) return;
   console.warn(
@@ -348,6 +355,32 @@ const withValidDiscussions = (manifest: CapabilityManifest): CapabilityManifest
   return rest;
 };
 
+const checkedAppStatus = new Map<string, { manifestHash: string; valid: boolean }>();
+const withValidAppStatus = (manifest: CapabilityManifest): CapabilityManifest => {
+  if (!manifest.appStatus) return manifest;
+  const checked = checkedAppStatus.get(manifest.appId);
+  let valid = checked?.manifestHash === manifest.manifestHash ? checked.valid : undefined;
+  if (valid === undefined) {
+    const issues = appStatusIssues(manifest);
+    valid = issues.length === 0;
+    checkedAppStatus.set(manifest.appId, { manifestHash: manifest.manifestHash, valid });
+    if (!valid)
+      console.error(
+        JSON.stringify({
+          level: "error",
+          source: "capability-registry",
+          message: "Ignored an incompatible appStatus provider",
+          appId: manifest.appId,
+          manifestHash: manifest.manifestHash,
+          issues,
+        }),
+      );
+  }
+  if (valid) return manifest;
+  const { appStatus: _ignored, ...rest } = manifest;
+  return rest;
+};
+
 /** Ignores record fields from a newer release; the endpoint always comes from the live app registry. */
 export const resolveLiveCapabilityRegistryEntry = (
   key: string,
@@ -362,7 +395,7 @@ export const resolveLiveCapabilityRegistryEntry = (
   if (!endpoint) return null;
   try {
     const read = parseCapabilityManifest(record.manifest, app.id);
-    const supported = withValidDiscussions(withValidCalendarSource(withValidFileProvider(read)));
+    const supported = withValidAppStatus(withValidDiscussions(withValidCalendarSource(withValidFileProvider(read))));
     const manifest = supported.resourcePages
       ? {
           ...supported,
@@ -411,8 +444,21 @@ export const getCapability = async (appId: string): Promise<CapabilityRegistryEn
  * Same as `listApps` but returns registry metadata for admin observability.
  */
 export const listAppsDetailed = async (): Promise<AppRegistryDetail[]> => {
-  const snapshot = await readAppRegistrySnapshot();
-  return snapshot.apps;
+  const [snapshot, instances] = await Promise.all([
+    readAppRegistrySnapshot(),
+    appInstanceRegistry().snapshot({ prefix: APP_INSTANCE_PREFIX }),
+  ]);
+  return snapshot.apps.map((app) => ({
+    ...app,
+    instances: instances.entries
+      .filter(({ value }) => value.appId === app.id)
+      .map(({ value }) => ({
+        instanceId: value.instanceId,
+        hostname: value.hostname,
+        startedAt: value.startedAt,
+        bootstrap: value.bootstrap ?? null,
+      })),
+  }));
 };
 
 /**

package/src/_internal/workload-credential.ts

@@ -1,4 +1,5 @@
 import { env } from "../config/env";
+import { connections } from "../runtime/connections";
 import { getProcessApplicationId } from "./process-identity";
 import { getProcessNats } from "./process-sync";
 import {
@@ -50,7 +51,7 @@ export const createAppWorkloadCredential = (options: {
   const request =
     options.request ??
     (async (input: WorkloadRequest) => {
-      const response = await getProcessNats().request(workloadSubject(env.SYNC_NAMESPACE), JSON.stringify(input), {
+      const response = await getProcessNats().request(workloadSubject(connections().nats.namespace), JSON.stringify(input), {
         timeout: WORKLOAD_REQUEST_TIMEOUT_MS,
       });
       return response.json<unknown>();

package/src/ai/app-skill-store.ts

@@ -1,8 +1,9 @@
-import { type SQL, sql, type TransactionSQL } from "bun";
+import type { SQL, TransactionSQL } from "bun";
 import { z } from "zod";
 import { appAudienceRoles } from "../_internal/app-roles";
 import { APP_REGISTRY_TTL_MS } from "../_internal/registry";
 import type { AppRegistryEntry } from "../contracts/registry";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
 import { type AppSkillDefinition, parseStoredAppSkill } from "./app-skills";

package/src/ai/app-skills.ts

@@ -1,5 +1,6 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { AI_SKILL_CATALOG_MAX_CHARS, aiSkillCatalogChars } from "./skill-catalog";
 import { type AiSkillContent, canonicalHash, contentHash, validateSkillContent } from "./skill-content";

package/src/ai/approvals.ts

@@ -1,5 +1,6 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { AccessSubject } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import type { RequestActor } from "../server/middleware/auth";
 import { type AuditActor, type AuditRecordParams, audit } from "../services/audit";
 import { toPgTextArray } from "../services/postgres";

package/src/ai/chat-tasks.ts

@@ -1,7 +1,8 @@
 import type { Message } from "@k2b/nessi";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { getCapability } from "../_internal/registry";
 import { type CapabilityActionPolicy, capabilityActionPolicy } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import {
   createMandate,

package/src/ai/credentials.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { decryptValue, encryptValue } from "../services/settings/crypto";
 
 type SqlClient = typeof sql;

package/src/ai/dictation-runtime.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { lazySync } from "../_internal/process-sync";
+import { sql } from "../runtime/clients";
 import { get as getUser } from "../services/accounts/users";
 import { logger, trace } from "../services/logging";
 import { superviseRuntimeTask } from "../services/runtime-lifecycle";

package/src/ai/dictations.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import { inspectAiAudio } from "./audio-format";
 import { createUniqueAiFileInTransaction } from "./files-store";
 import { AiSaveConversationDraftInputSchema } from "./http";

package/src/ai/files-store.ts

@@ -1,4 +1,5 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
+import { sql } from "../runtime/clients";
 import { stripImageMetadata } from "../services/image-metadata";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 import { isAiImage } from "./file-media-type";

package/src/ai/inference-calls.ts

@@ -1,4 +1,5 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
+import { sql } from "../runtime/clients";
 import type { AccessSubject } from "../server/services/access";
 import { aiBudgetUnits, aiCostDecimal, aiCostUnits, aiDecimalUnits, hasBillableAiPricing } from "../shared/ai-costs";
 import { AiQuotaError, aiQuotas, quotaWindow } from "./quotas";

package/src/ai/map-store.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import { toPgTextArray } from "../services/postgres";
 import type { AiMap, AiMapCommand } from "./map-contracts";
 import { AiMapSchema, aiMapToolResult } from "./map-contracts";

package/src/ai/map-tool.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { CapabilityCaller } from "../capabilities/server";
+import { sql } from "../runtime/clients";
 import { resolveAiCapabilityActor } from "./capability-execution";
 import { AiMapToolInputSchema, AiMapToolResultSchema, aiMapToolResult } from "./map-contracts";
 import { executeStoredAiMap } from "./map-execution";

package/src/ai/memories.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { type CloudResourceRef, CloudResourceRefSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { withAiShortId } from "./short-id";
 

package/src/ai/memory-learning-runs.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { CloudResourceRef } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import type { AiMemoryKind } from "./memories";
 import { withAiShortId } from "./short-id";
 

package/src/ai/memory-learning.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import { z } from "zod";
 import { CloudResourceRefSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { coreSettings } from "../services";
 import { logger } from "../services/logging";
 import { normalizeLocale } from "../shared/locale";

package/src/ai/memory-workflow-evidence.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { type CloudResourceRef, CloudResourceRefSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 
 const MAX_RECEIPT_RESOURCES = 20;

package/src/ai/message-queue.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { logger } from "../services/logging";
 import { aiChatAccessSubject, isAssistantChatTurn } from "./assistant-models";
 import { editAiDraftText } from "./draft-content";

package/src/ai/migrate.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { CapabilityActionReviewDataSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { APPROVAL_MAX_WAIT_MS, approvalAssurance, approvalScopeFromToolName, approvals, migrateApprovals } from "../services/approvals";
 import { migrateChatTaskReasons } from "./chat-task-reasons-migrate";
 import { migrateAiMaps } from "./map-store";

package/src/ai/model-access-migrate.ts

@@ -1,4 +1,4 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
 
 export const migrateAiModelAccess = async (): Promise<void> => {
   await sql.begin(async (tx) => {

package/src/ai/model-access.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { AccessEntry, Principal, ServiceAccountKind } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import { type AccessSubject, buildAccessPrincipalCondition, createAccess } from "../server/services/access";
 import { toPgTextArray } from "../services/postgres";
 import type { AiModelAccessDraft } from "../shared/ai-models";

package/src/ai/model-catalog.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import { ConfigConflict } from "../services/config-conflict";
 import { stripImageDataUrlMetadata } from "../services/image-metadata";
 import {

package/src/ai/model-delete.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
 import { toPgTextArray } from "../services/postgres";
 import { type AiDeleteModelInput, type AiModel, type AiModelSlot, type AiProvider, aiReplacementProblem } from "../shared/ai-models";

package/src/ai/model-usage.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { toPgTextArray } from "../services/postgres";
 import type { AiModelUsage } from "../shared/ai-models";
 import { aiModelCatalog } from "./model-catalog";

package/src/ai/open-questions.ts

@@ -1,7 +1,7 @@
-import { sql } from "bun";
 import { z } from "zod";
 import { APPROVALS_PAGE_SIZE } from "../contracts/approvals";
 import { CapabilityActionReviewPresentationSchema, CapabilitySemanticLinkSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { openRequests } from "../services/approvals/content";
 import { logger } from "../services/logging";
 import { reviewShortText, toolActionCard, toolBlockReview } from "./chat/action-card";

package/src/ai/openai-api-slots.ts

@@ -1,4 +1,5 @@
-import { redis } from "bun";
+import { redis } from "../runtime/clients";
+
 import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
 

package/src/ai/prefs.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import type { RequestActor } from "../server";
 import { type AiModelRequest, AiModelRequestSchema } from "../shared/ai-models";
 

package/src/ai/projects.ts

@@ -1,6 +1,7 @@
-import { type SQL, type SQLQuery, sql } from "bun";
+import type { SQL, SQLQuery } from "bun";
 import type { CloudResourceRef } from "../contracts/capabilities";
 import { AuthenticatedPrincipalSchema, type ServiceAccountKind } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import {
   buildAccessPrincipalCondition,
   createAccess,

package/src/ai/provider-connections.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../runtime/clients";
 import type { AiProvider } from "../shared/ai-models";
 import { getAiCredential } from "./credentials";
 import { getAiRequestHeaders } from "./request-headers";

package/src/ai/quota-limits.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
 import { toPgTextArray } from "../services/postgres";
 import { hasBillableAiPricing } from "../shared/ai-costs";

package/src/ai/quota-provider.ts

@@ -1,6 +1,7 @@
 import { setTimeout as delay } from "node:timers/promises";
 import { estimateTokens, type Provider } from "@k2b/nessi";
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
 import type { AiResolvedModelRef } from "../shared/ai-models";

package/src/ai/quota-report.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { resolveDisplayNames } from "../server/services/access";
 import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
 import { toPgTextArray } from "../services/postgres";

package/src/ai/quotas-migrate.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 export async function migrateAiQuotas() {
   await sql.begin(async (db) => {
     await db`CREATE TABLE IF NOT EXISTS ai.cost_config (

package/src/ai/quotas.ts

@@ -1,4 +1,5 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
+import { sql } from "../runtime/clients";
 import { type AccessSubject, buildAccessPrincipalCondition } from "../server/services/access";
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import { type AiQuotaConfig, AiQuotaConfigSchema, type AiQuotaIdentity, type AiQuotaSnapshot } from "../shared/ai-quotas";

package/src/ai/request-headers.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { decryptValue, encryptValue } from "../services/settings/crypto";
 import { AiRequestHeadersSchema, patchAiRequestHeaders } from "../shared/ai-request-options";
 

package/src/ai/review-content.ts

@@ -1,7 +1,8 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { capabilityRequestHash } from "../capabilities/claims";
 import { parseStoredReviewContent } from "../capabilities/review-storage";
 import { CAPABILITY_MAX_REVIEW_CONTENT_BYTES, type CapabilityActionReviewPresentation } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import type { AiStoredActionReview } from "./action-review";
 
 export type ReviewContentLocation = { conversationId: string; turnId: string; callId: string };

package/src/ai/skill-search.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { toPgTextArray } from "../services/postgres";
 
 const BM25_INDEX = "ai.skills_search_bm25_idx";

package/src/ai/skills.ts

@@ -1,6 +1,7 @@
-import { type SQL, type SQLQuery, sql } from "bun";
+import type { SQL, SQLQuery } from "bun";
 import { listApps } from "../_internal/registry";
 import { AuthenticatedPrincipalSchema, type ServiceAccountKind } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import type { RequestAuthority } from "../server/middleware/auth";
 import {
   buildAccessPrincipalCondition,

package/src/ai/store.ts

@@ -1,9 +1,10 @@
 import type { DoneReason, InboundEvent, LoopAggregate, Message, SessionStore, StoreEntry } from "@k2b/nessi";
 import type { Usage } from "@k2b/nessi/ai";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { capabilityRequestHash } from "../capabilities/claims";
 import { restoreReviewSnapshot, serializeReviewSnapshot } from "../capabilities/review-storage";
 import { type CapabilityActionReviewPresentation, CapabilityActionReviewPresentationSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
 import { AI_TOOL_CHECK_STALE_MS, type AiActionCheck, type AiStoredActionReview } from "./action-review";

package/src/ai/structured-runs.ts

@@ -1,5 +1,6 @@
 import type { Usage } from "@k2b/nessi";
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { logger } from "../services/logging";
 
 export type AiUsageAttribution = {

package/src/ai/tool-audit.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import type { ApprovalDecisionChannel } from "../services/approvals";
 
 /**

package/src/ai/turn-timing.ts

@@ -1,5 +1,5 @@
 import type { LoopAggregate, OutboundEvent } from "@k2b/nessi";
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
 
 export type TimingInterval = { start: number; end: number };
 const union = (intervals: TimingInterval[]): TimingInterval[] => {

package/src/ai/usage.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { type AiUsageQuery, AiUsageQuerySchema } from "../shared/ai-usage";
 import { aiQuotas } from "./quotas";
 

package/src/ai/web-provenance.ts

@@ -1,5 +1,6 @@
 import { domainToUnicode } from "node:url";
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { toPgTextArray } from "../services/postgres";
 
 /** The longest address web_extract and fetch_file accept; a longer one can never be read, so it is never recorded. */

package/src/api/admin-ai-quotas.ts

@@ -1,9 +1,9 @@
-import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
 import { AiBackgroundCostError, backgroundCostState, releaseBackgroundCostStop } from "../ai/inference-calls";
 import { quotaAdminConfig, quotaReport } from "../ai/quota-report";
 import { AiQuotaError, aiQuotas } from "../ai/quotas";
 import { readAiSettingsState } from "../ai/settings";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, v } from "../server";
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import {

package/src/api/admin-ai.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { setAiCredential } from "../ai/credentials";
@@ -15,6 +14,7 @@ import {
   testAiProvider,
 } from "../ai/provider-connections";
 import { getAiRequestHeaders, setAiRequestHeaders } from "../ai/request-headers";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, v } from "../server";
 import { ConfigConflict } from "../services/config-conflict";
 import { ImageMetadataError } from "../services/image-metadata";

package/src/api/admin-app-domains.ts

@@ -0,0 +1,62 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { type AuthContext, auth, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
+import { appDomains } from "../services/app-domains";
+import { logger } from "../services/logging";
+
+const appParams = z.object({ appId: z.string().regex(/^[a-z][a-z0-9-]{0,79}$/) });
+const domainParams = appParams.extend({ host: z.string().max(1024) });
+const host = z.string().max(1024);
+const addInput = z.object({ host, redirectTo: host.optional() }).strict();
+const setInput = z.object({ redirectTo: host.nullable() }).strict();
+const describe = (summary: string) => describeRoute({ tags: ["App domains"], summary });
+
+export const createAdminAppDomainRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service: typeof appDomains = appDomains,
+) =>
+  new Hono<AuthContext>()
+    .use("/:appId/domains/*", noTransform())
+    .use("/:appId/domains/*", authenticate)
+    .use("/:appId/domains/*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      if (c.req.method !== "GET") return auth.requireOAuthScope("admin")(c, next);
+      return next();
+    })
+    .get("/:appId/domains", describe("List assigned domains and their last check"), v("param", appParams), (c) =>
+      respond(c, () => service.list({ actor: c.get("user"), ...c.req.valid("param") })),
+    )
+    .post(
+      "/:appId/domains",
+      describe("Assign a domain and start its first check in the background"),
+      v("param", appParams),
+      v("json", addInput),
+      async (c) => {
+        const input = { actor: c.get("user"), ...c.req.valid("param"), ...c.req.valid("json") };
+        const result = await service.add(input);
+        if (result.ok)
+          void service.check({ ...input, host: result.data.host }).catch((error: unknown) => {
+            logger("core:app-domains").error("Initial domain check failed; retry through the domain check endpoint", {
+              host: result.data.host,
+              error: error instanceof Error ? error.message : String(error),
+            });
+          });
+        return respond(c, result, 201);
+      },
+    )
+    .patch("/:appId/domains/:host", describe("Change or clear the domain redirect"), v("param", domainParams), v("json", setInput), (c) =>
+      respond(c, () => service.set({ actor: c.get("user"), ...c.req.valid("param"), ...c.req.valid("json") })),
+    )
+    .delete("/:appId/domains/:host", describe("Remove an unreferenced domain assignment"), v("param", domainParams), (c) =>
+      respond(c, () => service.remove({ actor: c.get("user"), ...c.req.valid("param") })),
+    )
+    .post(
+      "/:appId/domains/:host/check",
+      describe("Check DNS, certificate and gateway reachability, at most once per 60 seconds"),
+      v("param", domainParams),
+      (c) => respond(c, () => service.check({ actor: c.get("user"), ...c.req.valid("param") })),
+    );
+
+export default createAdminAppDomainRoutes();