@rakay-technology/kraft 0.7.8 → 0.7.9

package/dist/{chunk-S7UU7WAK.js → chunk-7O6MARHJ.js}

@@ -43,7 +43,7 @@ import {
   resolvePorts,
   sourceBuildDir,
   verifyHostChannel
-} from "./chunk-OTBBNOIV.js";
+} from "./chunk-ULEEWX5M.js";
 import {
   startUnitHint,
   thisHost
@@ -1942,7 +1942,7 @@ async function runForeground(opts, source) {
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: source ? "local" : opts.uiVersion || `v${"0.7.8"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.7.9"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;

package/dist/{chunk-OTBBNOIV.js → chunk-ULEEWX5M.js}

@@ -1776,7 +1776,7 @@ function operatorEnvPassthrough(managed, prev) {
 }
 var PRESERVED_ENV_HEADER = "# Preserved from your existing .env \u2014 set by you, not by `kraft up` (#485).";
 function resolveImageVersion(opts) {
-  return opts.version?.trim() || process.env.KRAFT_VERSION?.trim() || (true ? "0.7.8" : "latest");
+  return opts.version?.trim() || process.env.KRAFT_VERSION?.trim() || (true ? "0.7.9" : "latest");
 }
 function managedEnvLines(opts, host, cfg, prev) {
   const lines = [

package/dist/{host-channel-preflight-IWQHVFG5.js → host-channel-preflight-Z64G3NIM.js}

@@ -5,7 +5,7 @@ const require = __ospCreateRequire(import.meta.url);
 import {
   checkHostChannel,
   verifyHostChannel
-} from "./chunk-OTBBNOIV.js";
+} from "./chunk-ULEEWX5M.js";
 import "./chunk-2UQFOUSZ.js";
 import "./chunk-5GPXMTE4.js";
 import "./chunk-XZYFZ6A5.js";

package/dist/index.js

@@ -38,7 +38,7 @@ import {
   upCommand,
   validateGithubToken,
   writeCliInstall
-} from "./chunk-S7UU7WAK.js";
+} from "./chunk-7O6MARHJ.js";
 import {
   bootstrapAdmin,
   detectPublicIp,
@@ -92,7 +92,7 @@ import {
   sourceBuildDir,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-OTBBNOIV.js";
+} from "./chunk-ULEEWX5M.js";
 import {
   startUnitHint
 } from "./chunk-2UQFOUSZ.js";
@@ -330,7 +330,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `kraft-cli/${true ? "0.7.8" : "dev"}`;
+var USER_AGENT = `kraft-cli/${true ? "0.7.9" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -1276,7 +1276,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-IWQHVFG5.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-Z64G3NIM.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1835,7 +1835,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-IWQHVFG5.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-Z64G3NIM.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed")
         log2.success("Host control is reachable now.");
@@ -5495,7 +5495,7 @@ function printMonitoringNextSteps() {
   info("    kraft edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-7WW25O2I.js");
+  const up = await import("./up-TU7622HW.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -8069,7 +8069,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-IWQHVFG5.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-Z64G3NIM.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -8169,7 +8169,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.kraft.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.7.8";
+  const current = "0.7.9";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -8290,7 +8290,7 @@ var updateCommand = new Command26("update").description("Update the Kraft CLI +
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball")
     return runTarballUpdate(cliInstall, opts);
-  const current = "0.7.8";
+  const current = "0.7.9";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -9137,7 +9137,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.7.8"}`;
+  const uiTag = `v${"0.7.9"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Kraft dist from GitHub");
@@ -9205,7 +9205,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.7.8" })) {
+    if (!pinnedImagesReady({ version: "0.7.9" })) {
       cancel4(
         "The pinned Kraft image tag isn't in the registry yet \u2014 nothing on this box was changed."
       );
@@ -9256,7 +9256,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.8",
+      version: "0.7.9",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -9287,7 +9287,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.8",
+      version: "0.7.9",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -9379,7 +9379,7 @@ async function runWizard() {
     if (!result.domainRegistered)
       liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-IWQHVFG5.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-Z64G3NIM.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -9683,7 +9683,7 @@ function attachCompletion(program2) {
 
 // src/index.ts
 var program = new Command29();
-program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.8").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.9").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";

package/dist/server/index.js

@@ -5033,6 +5033,14 @@ var init_kraft_config = __esm(() => {
   init_parse();
 });
 // ../../packages/core/src/mail-server/routing/build-routes.ts
+function buildMailServerRoutes(input) {
+  const normalized = normalizeInput(input);
+  return {
+    input: normalized,
+    routes: buildRoutes(normalized),
+    dns: buildDnsRecords(normalized)
+  };
+}
 function mailServerRouteHostnames(userDomain) {
   return [
     mailHostname(userDomain),
@@ -5061,6 +5069,164 @@ function mailHostBaseDomain(hostname) {
   const base = host.slice(prefix.length);
   return base.includes(".") ? base : null;
 }
+function buildRoutes(input) {
+  const d = input.userDomain;
+  const [clientHost, apiHost, autodiscoverHost, autoconfigHost] = mailServerRouteHostnames(d);
+  return [
+    {
+      id: "mail-client",
+      hostname: clientHost,
+      targetUrl: input.zeroClientOrigin,
+      tls: true,
+      description: "Zero web client - the user-facing webmail UI."
+    },
+    {
+      id: "mail-api",
+      hostname: apiHost,
+      targetUrl: input.zeroServerOrigin,
+      tls: true,
+      description: "Zero server - tRPC API consumed by the Zero client (auth via Dovecot IMAP)."
+    },
+    {
+      id: "autodiscover",
+      hostname: autodiscoverHost,
+      targetUrl: input.kraftApiOrigin,
+      tls: true,
+      description: "Outlook / Thunderbird autodiscover XML - served by kraft's API controller."
+    },
+    {
+      id: "autoconfig",
+      hostname: autoconfigHost,
+      targetUrl: input.kraftApiOrigin,
+      tls: true,
+      description: "Thunderbird / Apple / K-9 autoconfig XML - served by kraft's API controller."
+    }
+  ];
+}
+function buildDnsRecords(input) {
+  const d = input.userDomain;
+  const apex = d;
+  return [
+    {
+      id: "mailservice-a",
+      type: "A",
+      name: `mailservice.${d}`,
+      value: input.mailServerIp,
+      description: `Points to the mail VPS itself. The MX record (next row) references this host so external mail servers know where to deliver mail for ${apex}.`,
+      required: true
+    },
+    {
+      id: "apex-mx",
+      type: "MX",
+      name: apex,
+      value: `mailservice.${d}.`,
+      priority: 10,
+      description: `Tells the world: mail for any @${apex} address should be delivered to mailservice.${d}.`,
+      required: true
+    },
+    {
+      id: "spf",
+      type: "TXT",
+      name: apex,
+      value: "v=spf1 mx -all",
+      description: `SPF: only the IP behind mailservice.${d} is authorized to send mail from @${apex}. Without this, your mail will be marked spam by Gmail/Outlook.`,
+      required: false
+    },
+    {
+      id: "dkim",
+      type: "TXT",
+      name: `dkim._domainkey.${d}`,
+      value: "<DKIM public key - generated during mail server install; copy from kraft dashboard once provisioning completes>",
+      description: `DKIM signs outgoing mail with a private key the mail server holds; recipients verify against this public key. Critical for deliverability to Gmail/Outlook.`,
+      required: false
+    },
+    {
+      id: "dmarc",
+      type: "TXT",
+      name: `_dmarc.${d}`,
+      value: `v=DMARC1; p=quarantine; rua=mailto:dmarc@${apex}`,
+      description: `DMARC: tells recipient servers what to do if SPF + DKIM fail (quarantine = send to spam). Reports of failures get mailed to dmarc@${apex}.`,
+      required: false
+    },
+    {
+      id: "mail-client-cname",
+      type: "CNAME",
+      name: mailHostname(d),
+      value: hostnameFromUrl(input.zeroClientOrigin),
+      description: `Routes ${mailHostname(d)} (the webmail UI) to kraft's app-deploy ingress where the Zero client is hosted.`,
+      required: true
+    },
+    {
+      id: "mail-api-cname",
+      type: "CNAME",
+      name: apiMailHostname(d),
+      value: hostnameFromUrl(input.zeroServerOrigin),
+      description: `Routes ${apiMailHostname(d)} (the Zero server's tRPC API) to the mail VPS via kraft's routing layer.`,
+      required: true
+    },
+    {
+      id: "autodiscover-cname",
+      type: "CNAME",
+      name: `autodiscover.${d}`,
+      value: hostnameFromUrl(input.kraftApiOrigin),
+      description: `Routes autodiscover.${d} to kraft's API, which serves the XML mail clients use to auto-configure (Outlook, Thunderbird).`,
+      required: true
+    },
+    {
+      id: "autoconfig-cname",
+      type: "CNAME",
+      name: `autoconfig.${d}`,
+      value: hostnameFromUrl(input.kraftApiOrigin),
+      description: `Routes autoconfig.${d} to kraft's API, which serves the Thunderbird-style XML mail clients use to auto-configure (Thunderbird, Apple Mail, K-9).`,
+      required: true
+    },
+    {
+      id: "srv-imaps",
+      type: "SRV",
+      name: `_imaps._tcp.${d}`,
+      value: mailHostname(d),
+      priority: 0,
+      port: 993,
+      description: `Directs IMAP clients to ${mailHostname(d)} port 993 (RFC 6186).`,
+      required: false
+    },
+    {
+      id: "srv-submission",
+      type: "SRV",
+      name: `_submission._tcp.${d}`,
+      value: mailHostname(d),
+      priority: 0,
+      port: 587,
+      description: `Directs SMTP-submission clients to ${mailHostname(d)} port 587 (RFC 6186).`,
+      required: false
+    },
+    {
+      id: "srv-autodiscover",
+      type: "SRV",
+      name: `_autodiscover._tcp.${d}`,
+      value: `autodiscover.${d}`,
+      priority: 0,
+      port: 443,
+      description: `Outlook's last-resort lookup: HTTPS config service on autodiscover.${d} port 443.`,
+      required: false
+    }
+  ];
+}
+function normalizeInput(input) {
+  return {
+    userDomain: input.userDomain.trim().toLowerCase().replace(/^\.+|\.+$/g, ""),
+    mailServerIp: input.mailServerIp.trim(),
+    zeroServerOrigin: input.zeroServerOrigin.trim(),
+    zeroClientOrigin: input.zeroClientOrigin.trim(),
+    kraftApiOrigin: input.kraftApiOrigin.trim()
+  };
+}
+function hostnameFromUrl(value) {
+  const noScheme = value.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+  const noPath = noScheme.split("/", 1)[0];
+  const noPort = noPath.split(":", 1)[0];
+  return noPort;
+}
 var MAIL_HOST_LABEL = "mail";
 
 // ../../packages/core/src/mail-server/routing/index.ts
@@ -126602,7 +126768,7 @@ var require_es5 = __commonJS((exports, module2) => {
 
 // ../../node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry = require_retry();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();
@@ -186084,7 +186250,7 @@ WD9f
 
 // ../../node_modules/ioredis/built/utils/index.js
 var require_utils4 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/ioredis/built/utils";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/ioredis/built/utils";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.noop = exports.defaults = exports.Debug = exports.getPackageMeta = exports.zipMap = exports.CONNECTION_CLOSED_ERROR_MSG = exports.shuffle = exports.sample = exports.resolveTLSProfile = exports.parseURL = exports.optimizeErrorStack = exports.toArg = exports.convertMapToArray = exports.convertObjectToArray = exports.timeout = exports.packObject = exports.isInt = exports.wrapMultiResult = exports.convertBufferToString = undefined;
   var fs_1 = __require("fs");
@@ -186370,7 +186536,7 @@ var require_argumentParsers = __commonJS((exports) => {
 
 // ../../node_modules/ioredis/built/Command.js
 var require_Command = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/ioredis/built";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/ioredis/built";
   Object.defineProperty(exports, "__esModule", { value: true });
   var commands_1 = require_built();
   var calculateSlot = require_lib3();
@@ -268837,22 +269003,6 @@ var init_mail_port_reachability_service = __esm(() => {
   healthCache = new Map;
 });
 
-// ../api/src/lib/container-ref.ts
-function usableRef(ref) {
-  const trimmed3 = ref?.trim();
-  if (!trimmed3 || trimmed3 === COMPOSE_SENTINEL)
-    return null;
-  return trimmed3;
-}
-function isRealContainerRef(ref) {
-  return usableRef(ref) !== null;
-}
-function isArtifactRef(ref) {
-  const usable = usableRef(ref);
-  return usable !== null && usable.startsWith("/");
-}
-var COMPOSE_SENTINEL = "compose";
-
 // ../api/src/lib/acme-config.ts
 function resolveAcmeProviderOptions() {
   return {
@@ -268924,6 +269074,55 @@ var init_controller_helpers = __esm(async () => {
   await init_src3();
 });
 
+// ../api/src/modules/mail-server/routing/register.service.ts
+async function registerMailServerRoutes(input, opts) {
+  const plan = buildMailServerRoutes(input);
+  const { routing: routing2 } = getPlatform();
+  const wanted = opts?.only ? new Set(opts.only) : null;
+  const results = [];
+  for (const route of plan.routes) {
+    if (wanted && !wanted.has(route.id))
+      continue;
+    try {
+      await routing2.registerRoute({
+        domain: route.hostname,
+        tls: route.tls,
+        terminatesTlsLocally: route.tls,
+        targetUrl: route.targetUrl
+      });
+      results.push({ routeId: route.id, hostname: route.hostname, ok: true });
+    } catch (err2) {
+      results.push({
+        routeId: route.id,
+        hostname: route.hostname,
+        ok: false,
+        error: safeErrorMessage(err2)
+      });
+    }
+  }
+  return { plan, routes: results };
+}
+var init_register_service = __esm(async () => {
+  init_src();
+  await init_controller_helpers();
+});
+
+// ../api/src/lib/container-ref.ts
+function usableRef(ref) {
+  const trimmed3 = ref?.trim();
+  if (!trimmed3 || trimmed3 === COMPOSE_SENTINEL)
+    return null;
+  return trimmed3;
+}
+function isRealContainerRef(ref) {
+  return usableRef(ref) !== null;
+}
+function isArtifactRef(ref) {
+  const usable = usableRef(ref);
+  return usable !== null && usable.startsWith("/");
+}
+var COMPOSE_SENTINEL = "compose";
+
 // ../api/src/lib/remote-state.ts
 function isConnectionLoss(err2) {
   if (isRemoteConnectionError(err2))
@@ -272098,6 +272297,23 @@ async function stepEnsureReverseProxy(exec2, _domain, log11) {
     };
   }
   log11(stepId, "info", "The kraft edge holds :80 / :443");
+  try {
+    const reg = await registerMailServerRoutes({
+      userDomain: _domain,
+      mailServerIp: "",
+      zeroServerOrigin: "",
+      zeroClientOrigin: "",
+      kraftApiOrigin: internalApiUrl
+    }, { only: ["autodiscover", "autoconfig"] });
+    for (const r of reg.routes) {
+      if (r.ok)
+        log11(stepId, "info", `Client-config route ready: ${r.hostname}`);
+      else
+        log11(stepId, "warn", `Client-config route skipped for ${r.hostname}: ${r.error ?? "unknown error"}`);
+    }
+  } catch (err2) {
+    log11(stepId, "warn", `Client-config routes not registered (${errMsg(err2)}). Mail works without them; Thunderbird/Outlook auto-configuration will not.`);
+  }
   return {
     stepId,
     success: true,
@@ -272611,6 +272827,7 @@ var init_mail_service = __esm(async () => {
   init_src2();
   await __promiseAll([
     init_mail_health_service(),
+    init_register_service(),
     init_mail_engine()
   ]);
   STEP_TIMEOUT_MS = {
@@ -273497,6 +273714,21 @@ var init_mailboxes_service = __esm(async () => {
 });
 
 // ../api/src/modules/mail/admin/domains.service.ts
+var exports_domains_service = {};
+__export(exports_domains_service, {
+  validateDomain: () => validateDomain,
+  updateDomain: () => updateDomain,
+  retryDomainDkim: () => retryDomainDkim,
+  recountDomain: () => recountDomain,
+  listDomains: () => listDomains,
+  getDomain: () => getDomain,
+  deleteDomain: () => deleteDomain,
+  createDomain: () => createDomain,
+  countDomainDependents: () => countDomainDependents,
+  DomainNotFoundError: () => DomainNotFoundError,
+  DomainHasDependentsError: () => DomainHasDependentsError,
+  DomainExistsError: () => DomainExistsError
+});
 function validateDomain(domain4) {
   const d2 = domain4.trim().toLowerCase();
   if (!DOMAIN_RE4.test(d2) || d2.length > 255) {
@@ -279155,7 +279387,7 @@ WD9f
 
 // ../../node_modules/bullmq/node_modules/ioredis/built/utils/index.js
 var require_utils5 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/bullmq/node_modules/ioredis/built/utils";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/bullmq/node_modules/ioredis/built/utils";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.noop = exports.defaults = exports.Debug = exports.getPackageMeta = exports.zipMap = exports.CONNECTION_CLOSED_ERROR_MSG = exports.shuffle = exports.sample = exports.resolveTLSProfile = exports.parseURL = exports.optimizeErrorStack = exports.toArg = exports.convertMapToArray = exports.convertObjectToArray = exports.timeout = exports.packObject = exports.isInt = exports.wrapMultiResult = exports.convertBufferToString = undefined;
   var fs_1 = __require("fs");
@@ -279441,7 +279673,7 @@ var require_argumentParsers2 = __commonJS((exports) => {
 
 // ../../node_modules/bullmq/node_modules/ioredis/built/Command.js
 var require_Command2 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/bullmq/node_modules/ioredis/built";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/bullmq/node_modules/ioredis/built";
   Object.defineProperty(exports, "__esModule", { value: true });
   var commands_1 = require_built4();
   var calculateSlot = require_lib3();
@@ -287169,7 +287401,7 @@ var require_node_gyp_build_optional_packages = __commonJS((exports, module2) =>
 
 // ../../node_modules/msgpackr-extract/index.js
 var require_msgpackr_extract = __commonJS((exports, module2) => {
-  var __dirname = "/home/runner/work/kraft/kraft/node_modules/msgpackr-extract";
+  var __dirname = "/home/runner/work/kraft-ci/kraft-ci/node_modules/msgpackr-extract";
   module2.exports = require_node_gyp_build_optional_packages()(__dirname);
 });
 
@@ -321505,7 +321737,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@repo/api",
-    version: "0.7.8",
+    version: "0.7.9",
     license: "Apache-2.0",
     private: true,
     type: "module",
@@ -348253,12 +348485,12 @@ async function collectKnownHostnames() {
     for (const h3 of mailServerRouteHostnames(d2))
       out2.add(normalizeServedHostname(h3));
   }
-  const publicHost = hostnameFromUrl(env.KRAFT_PUBLIC_URL);
+  const publicHost = hostnameFromUrl2(env.KRAFT_PUBLIC_URL);
   if (publicHost)
     out2.add(publicHost);
   return [...out2];
 }
-function hostnameFromUrl(value2) {
+function hostnameFromUrl2(value2) {
   if (!value2)
     return null;
   try {
@@ -384446,6 +384678,165 @@ var init_restore_verify_service = __esm(async () => {
   ]);
 });
 
+// ../api/src/modules/mail/admin/client-config-routes.service.ts
+function poxProbeBody(domain4) {
+  return `<?xml version="1.0" encoding="utf-8"?>` + `<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">` + `<Request><EMailAddress>probe@${domain4}</EMailAddress>` + `<AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>` + `</Request></Autodiscover>`;
+}
+async function fetchText(url3, init3) {
+  const res = await fetch(url3, {
+    ...init3,
+    redirect: "manual",
+    signal: AbortSignal.timeout(20000),
+    headers: { "User-Agent": "kraft-client-config-probe", ...init3?.headers }
+  });
+  const contentType = res.headers.get("content-type") ?? "";
+  const body2 = await res.text().catch(() => "");
+  return { status: res.status, contentType, body: body2 };
+}
+function classifyFetchError(err2) {
+  const msg = err2 instanceof Error ? err2.message : String(err2);
+  if (/certificate|self.signed|unable to verify|UNABLE_TO_VERIFY|CERT_|DEPTH_ZERO_SELF_SIGNED/i.test(msg))
+    return `TLS failed (${msg.slice(0, 160)}): no valid certificate for this hostname — the edge serves its default cert, so no vhost exists yet.`;
+  if (/timeout|timed out|abort/i.test(msg))
+    return `No answer within 20s (${msg.slice(0, 120)}): DNS, firewall, or nothing listening on :443.`;
+  if (/ENOTFOUND|EAI_AGAIN|getaddrinfo/i.test(msg))
+    return `DNS does not resolve this hostname (${msg.slice(0, 120)}). Publish the CNAME first.`;
+  if (/ECONNREFUSED|ECONNRESET|EHOSTUNREACH|ENETUNREACH/i.test(msg))
+    return `TCP refused/reset (${msg.slice(0, 120)}): nothing serves :443 there — firewall or no edge.`;
+  return `Probe failed: ${msg.slice(0, 200)}`;
+}
+async function checkClientConfigRoutes(domain4) {
+  const d2 = domain4.trim().toLowerCase();
+  const checks8 = [];
+  const adHost = autodiscoverHostname(d2);
+  const adUrl = `https://${adHost}/autodiscover/autodiscover.xml`;
+  try {
+    const res = await fetchText(adUrl, {
+      method: "POST",
+      headers: { "Content-Type": "text/xml" },
+      body: poxProbeBody(d2)
+    });
+    if (res.status === 200 && res.body.includes("<Action>settings</Action>")) {
+      checks8.push({
+        id: "autodiscover",
+        hostname: adHost,
+        url: adUrl,
+        ok: true,
+        detail: "Outlook autodiscover answers with account settings."
+      });
+    } else {
+      checks8.push({
+        id: "autodiscover",
+        hostname: adHost,
+        url: adUrl,
+        ok: false,
+        detail: res.status !== 200 ? `HTTP ${res.status} — the edge answers, but not the XML responder (missing vhost or dashboard fallback page).` : `HTTP 200 without account settings — the responder refused (unmanaged domain?) or a proxy page sits in front.`
+      });
+    }
+  } catch (err2) {
+    checks8.push({
+      id: "autodiscover",
+      hostname: adHost,
+      url: adUrl,
+      ok: false,
+      detail: classifyFetchError(err2)
+    });
+  }
+  const acHost = autoconfigHostname(d2);
+  const acUrl = `https://${acHost}/mail/config-v1.1.xml?emailaddress=${encodeURIComponent(`probe@${d2}`)}`;
+  try {
+    const res = await fetchText(acUrl);
+    if (res.status === 200 && res.body.includes("<clientConfig") && res.body.includes(d2)) {
+      checks8.push({
+        id: "autoconfig",
+        hostname: acHost,
+        url: acUrl,
+        ok: true,
+        detail: "Thunderbird autoconfig answers for this domain."
+      });
+    } else {
+      checks8.push({
+        id: "autoconfig",
+        hostname: acHost,
+        url: acUrl,
+        ok: false,
+        detail: res.status !== 200 ? `HTTP ${res.status} — the edge answers, but not the XML responder (missing vhost or dashboard fallback page).` : `HTTP 200 without this domain's config — wrong responder or proxy page in front.`
+      });
+    }
+  } catch (err2) {
+    checks8.push({
+      id: "autoconfig",
+      hostname: acHost,
+      url: acUrl,
+      ok: false,
+      detail: classifyFetchError(err2)
+    });
+  }
+  return checks8;
+}
+async function repairClientConfigRoutes(serverId, domain4, organizationId) {
+  const d2 = domain4.trim().toLowerCase();
+  const { validateDomain: validateDomain2 } = await init_domains_service().then(() => exports_domains_service);
+  validateDomain2(d2);
+  const { resolveTargetPlatform: resolveTargetPlatform2, disposePlatform: disposePlatform2 } = await init_deployment_runtime().then(() => exports_deployment_runtime);
+  const results = [];
+  try {
+    const reg = await registerMailServerRoutes({
+      userDomain: d2,
+      mailServerIp: "",
+      zeroServerOrigin: "",
+      zeroClientOrigin: "",
+      kraftApiOrigin: internalApiUrl
+    }, { only: ["autodiscover", "autoconfig"] });
+    const byId = new Map(reg.routes.map((r29) => [r29.routeId, r29]));
+    const platform = await resolveTargetPlatform2("server", "bare", serverId, organizationId);
+    disposePlatform2(platform);
+    const { recordMailCertDomain: recordMailCertDomain2 } = await init_domain_ssl().then(() => exports_domain_ssl);
+    for (const id2 of ["autodiscover", "autoconfig"]) {
+      const hostname7 = id2 === "autodiscover" ? autodiscoverHostname(d2) : autoconfigHostname(d2);
+      const route = byId.get(id2);
+      const entry = {
+        hostname: hostname7,
+        routeOk: route?.ok ?? false,
+        certOk: false
+      };
+      if (!route?.ok) {
+        entry.routeError = route?.error ?? "route registration failed";
+        results.push(entry);
+        continue;
+      }
+      try {
+        const cert = await platform.ssl.provisionCert(hostname7, {});
+        if (cert.verified) {
+          entry.certOk = true;
+          await recordMailCertDomain2(hostname7, cert).catch(() => {});
+        } else {
+          entry.certError = cert.reason ?? "certificate not confirmed";
+        }
+      } catch (err2) {
+        entry.certError = err2 instanceof Error ? err2.message.slice(0, 300) : String(err2);
+      }
+      results.push(entry);
+    }
+  } catch (err2) {
+    const message2 = err2 instanceof Error ? err2.message : String(err2);
+    for (const id2 of ["autodiscover", "autoconfig"]) {
+      results.push({
+        hostname: id2 === "autodiscover" ? autodiscoverHostname(d2) : autoconfigHostname(d2),
+        routeOk: false,
+        routeError: message2.slice(0, 300),
+        certOk: false
+      });
+    }
+  }
+  return results;
+}
+var init_client_config_routes_service = __esm(async () => {
+  init_src();
+  init_config();
+  await init_register_service();
+});
+
 // ../api/src/modules/mail/admin/sending-policy.service.ts
 function parseIredApdSettings(text4) {
   const plugins = (PLUGINS_RE.exec(text4)?.[1] ?? "").split(",").map((p4) => p4.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
@@ -386041,6 +386432,55 @@ async function getComponentLogsHandler(c2) {
     return errorJson(c2, err2);
   }
 }
+async function getClientConfigStatusHandler(c2) {
+  const guard4 = assertNotCloud(c2);
+  if (guard4)
+    return guard4;
+  const serverId = param(c2, "serverId");
+  await permission.assert(getRequestContext(c2), {
+    resourceType: "mail_server",
+    resourceId: serverId,
+    action: "read"
+  });
+  const ctx2 = getRequestContext(c2);
+  if (!await isServerInOrg(ctx2, serverId)) {
+    return c2.json({ error: "Server not found" }, 404);
+  }
+  const domain4 = c2.req.query("domain")?.trim().toLowerCase();
+  if (!domain4)
+    return c2.json({ error: "domain query is required" }, 400);
+  try {
+    const routes = await checkClientConfigRoutes(domain4);
+    return c2.json({ domain: domain4, routes });
+  } catch (err2) {
+    return errorJson(c2, err2);
+  }
+}
+async function repairClientConfigRoutesHandler(c2) {
+  const guard4 = assertNotCloud(c2);
+  if (guard4)
+    return guard4;
+  const serverId = param(c2, "serverId");
+  await permission.assert(getRequestContext(c2), {
+    resourceType: "mail_server",
+    resourceId: serverId,
+    action: "write"
+  });
+  const ctx2 = getRequestContext(c2);
+  if (!await isServerInOrg(ctx2, serverId)) {
+    return c2.json({ error: "Server not found" }, 404);
+  }
+  const body2 = await c2.req.json().catch(() => ({}));
+  const domain4 = typeof body2.domain === "string" ? body2.domain.trim().toLowerCase() : "";
+  if (!domain4)
+    return c2.json({ error: "domain is required" }, 400);
+  try {
+    const routes = await repairClientConfigRoutes(serverId, domain4, ctx2.organizationId);
+    return c2.json({ domain: domain4, routes });
+  } catch (err2) {
+    return errorJson(c2, err2);
+  }
+}
 function errorJson(c2, err2) {
   if (err2 instanceof AppError)
     return handleApiError(err2, c2);
@@ -386065,6 +386505,7 @@ var init_admin_controller = __esm(async () => {
     init_dmarc_ingest_service(),
     init_av_policy_service(),
     init_restore_verify_service(),
+    init_client_config_routes_service(),
     init_sending_policy_service(),
     init_test_email_service(),
     init_components_service(),
@@ -386471,6 +386912,8 @@ var init_mail_routes = __esm(async () => {
   r29.get("/admin/:serverId/domains", { tag: "mail_server:list" }, listDomainsHandler);
   r29.post("/admin/:serverId/domains", { tag: "mail_server:write" }, createDomainHandler);
   r29.post("/admin/:serverId/domains/:domain/dkim", { tag: "mail_server:write" }, retryDomainDkimHandler);
+  r29.get("/admin/:serverId/client-config", { tag: "mail_server:read" }, getClientConfigStatusHandler);
+  r29.post("/admin/:serverId/client-config/repair", { tag: "mail_server:write" }, repairClientConfigRoutesHandler);
   r29.get("/admin/:serverId/dmarc/summary", { tag: "mail_server:read" }, getDmarcSummaryHandler);
   r29.post("/admin/:serverId/dmarc/ingest", { tag: "mail_server:write" }, runDmarcIngestHandler);
   r29.get("/admin/:serverId/av-policy", { tag: "mail_server:read" }, getAvPolicyHandler);

package/dist/{up-7WW25O2I.js → up-TU7622HW.js}

@@ -7,10 +7,10 @@ import {
   runHeadlessProvision,
   startService,
   upCommand
-} from "./chunk-S7UU7WAK.js";
+} from "./chunk-7O6MARHJ.js";
 import "./chunk-JK7KKBXI.js";
 import "./chunk-IGTODKUA.js";
-import "./chunk-OTBBNOIV.js";
+import "./chunk-ULEEWX5M.js";
 import "./chunk-2UQFOUSZ.js";
 import "./chunk-5GPXMTE4.js";
 import "./chunk-XZYFZ6A5.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rakay-technology/kraft",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Kraft CLI - deploy, manage, and open your Kraft platform from the terminal",
   "license": "Apache-2.0",
   "repository": {