@rubytech/create-realagent 1.0.615 → 1.0.617

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -12,134 +12,80 @@ const server = new McpServer({
     version: "0.2.0",
 });
 // ===================================================================
-// Token management
+// Authentication — cert.pem only
+//
+// The plugin recognises exactly one CF account identity: the one
+// cert.pem was bound to via OAuth. `tunnel-login` is the only auth
+// path; the binding written on success is the device's record of
+// which account it currently speaks to.
 // ===================================================================
-server.tool("cf-set-token", "Set the Cloudflare API token. Validates the token against the Cloudflare API, discovers the account ID, and persists both to ~/{configDir}/cloudflare/api-token. Required scopes: Zone:DNS:Edit, Account:Cloudflare Tunnel:Edit, Zone:Zone:Edit.", {
-    token: z
-        .string()
-        .describe("The Cloudflare API token to store"),
-}, async ({ token }) => {
-    const trimmed = token.trim();
-    if (!trimmed) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "No token provided. Paste an existing Cloudflare API token as the token argument. If the user does not have a token, use tunnel-login instead — it handles authentication automatically.",
-                },
-            ],
-            isError: true,
-        };
-    }
-    try {
-        const result = await cloudflared.validateToken(trimmed);
-        if (!result.valid) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Token validation failed: ${result.error}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        if (!result.accountId) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `${result.error}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        cloudflared.writeToken(trimmed, result.accountId);
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `API token validated and saved.\n\n  Account: ${result.accountName ?? result.accountId}\n  Token stored: ~/{configDir}/cloudflare/api-token (mode 0600)\n\nReady for tunnel operations.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Token validation failed: ${err instanceof Error ? err.message : String(err)}`,
-                },
-            ],
-            isError: true,
-        };
-    }
-});
-server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunnel login`. Three phases: (1) if already authenticated, reports status; (2) if cert.pem exists, derives API credentials; (3) if no cert.pem, spawns login process and returns auth URL. Detects existing login processes — safe to call repeatedly without spawning duplicates. Pass force=true to delete stored credentials and restart authentication (use when the current token has insufficient permissions).", {
+server.tool("tunnel-login", "Authenticate with Cloudflare via `cloudflared tunnel login`. Three phases: (1) if cert.pem exists and matches the recorded account binding, reports status; (2) if cert.pem exists but no binding has been recorded, materializes the binding from the cert (migration path); (3) if no cert.pem, spawns login process and returns the auth URL. Detects existing login processes — safe to call repeatedly without spawning duplicates. Pass force=true to delete cert.pem (both brand-specific and legacy paths) and account-binding.json before re-authenticating — required when switching Cloudflare accounts.", {
     force: z
         .boolean()
         .optional()
-        .describe("Delete stored API token and cert.pem before re-authenticating. Use when the current token lacks permissions for the needed operation (e.g. cfut_* cert-derived tokens that cannot manage zones)."),
+        .describe("Delete cert.pem (brand path + legacy ~/.cloudflared/cert.pem) and account-binding.json before re-authenticating. Required when switching Cloudflare accounts (e.g. after the prior account was scrubbed or the cert was rotated under a different account)."),
 }, async ({ force }) => {
     try {
-        // Force: delete stored credentials and restart from scratch
+        // Force: delete cert.pem (both paths) and binding before restarting
         if (force) {
-            console.error("[tunnel-login] force=true — deleting stored token and cert.pem before re-auth");
+            console.error("[tunnel-login] force=true — clearing cert.pem and account binding before re-auth");
             cloudflared.resetAuth();
         }
-        // Phase: Already authenticated
-        const auth = await cloudflared.validateAuth();
-        if (auth.hasToken && auth.tokenValid) {
-            console.error("[tunnel-login] short-circuit: hasToken=true tokenValid=true — returning 'already authenticated'");
+        const auth = cloudflared.validateAuth();
+        // Phase: Already bound — cert + binding present and accountIds agree
+        if (auth.bound) {
+            console.error(`[tunnel-login] short-circuit: cert and binding agree on account ${auth.boundAccountId}`);
             return {
                 content: [
                     {
                         type: "text",
-                        text: `Already authenticated. API token is valid.\n\nTo re-authenticate with different permissions, call tunnel-login with force=true. This deletes the stored credentials and restarts the authentication flow.`,
+                        text: `Already authenticated. cert.pem and account binding agree on account ${auth.boundAccountId}.\n\nTo switch Cloudflare accounts, call tunnel-login with force=true. This deletes cert.pem (both paths) and the account binding, then restarts the authentication flow.`,
                     },
                 ],
             };
         }
-        // Phase: cert.pem exists — derive credentials
-        if (cloudflared.hasCert()) {
+        // Phase: cert.pem exists — derive credentials and either materialize
+        // or reconcile the binding.
+        if (auth.hasCert) {
             const creds = cloudflared.parseCertPem();
             if (!creds) {
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `cert.pem exists but could not extract API credentials from it. The file format may have changed.\n\nFallback: ask the user to paste an existing connection key and use cf-set-token to store it.`,
+                            text: `cert.pem exists but could not extract API credentials from it. The file format may have changed.\n\nRecovery: run tunnel-login with force=true to clear cert.pem and re-authenticate.`,
                         },
                     ],
                     isError: true,
                 };
             }
-            // Validate the cert-derived token
-            const validation = await cloudflared.validateToken(creds.apiToken);
-            if (!validation.valid) {
+            // Migration path: cert exists, no binding yet — silently materialize
+            // (the operator already trusted this cert by completing the prior
+            // OAuth flow; we don't re-confirm).
+            if (!auth.hasBinding) {
+                const binding = cloudflared.materializeBinding("migration");
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `cert.pem credentials were extracted but the token was rejected by Cloudflare: ${validation.error}\n\nFallback: ask the user to paste an existing connection key and use cf-set-token to store it.`,
+                            text: `Account binding materialized from existing cert.pem.\n\n  Account: ${binding.accountId}\n  Bound at: ${binding.boundAt}\n\nReady for tunnel operations.`,
+                        },
+                    ],
+                };
+            }
+            // Drift: cert says account X, binding says account Y — refuse with
+            // recovery instruction (force=true will clear both).
+            if (auth.certAccountId !== auth.boundAccountId) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `cert.pem is bound to account ${auth.certAccountId} but the recorded binding is account ${auth.boundAccountId}. The cert was rotated under a different Cloudflare account since the binding was established.\n\n${cloudflared.recoveryMessage()}`,
                         },
                     ],
                     isError: true,
                 };
             }
-            // Use the account ID from validation (more reliable) or fall back to cert
-            const accountId = validation.accountId ?? creds.accountId;
-            cloudflared.writeToken(creds.apiToken, accountId);
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Credentials derived from cert.pem and validated.\n\n  Account: ${validation.accountName ?? accountId}\n  Token stored: ~/{configDir}/cloudflare/api-token (mode 0600)\n\nReady for tunnel operations.`,
-                    },
-                ],
-            };
         }
         // Phase: Login process already running — wait for authorization
         const activeLogin = cloudflared.getActiveLogin();
@@ -225,22 +171,11 @@ server.tool("cf-zone-status", "List all zones (domains) on the Cloudflare accoun
         };
     }
 });
-server.tool("cf-add-zone", "Add a domain to the Cloudflare account via the official API. Returns the zone status and assigned nameservers. Idempotent — returns existing zone info if the domain is already on the account. Requires a valid API token with Zone:Zone:Edit scope (set via cf-set-token).", {
+server.tool("cf-add-zone", "Add a domain to the bound Cloudflare account via the official API. Idempotent: returns existing zone info if already on the account. Requires a successful tunnel-login (cert.pem + account-binding.json present and matching). The bound account must have permission to create zones; if not, the operator must add the zone via the Cloudflare dashboard.", {
     domain: z
         .string()
-        .describe("The bare domain to add (e.g. 'mybusiness.com'). Must be a registrable domain, not a subdomain."),
+        .describe("Registrable domain to add to the bound Cloudflare account (e.g. 'mybusiness.com')."),
 }, async ({ domain }) => {
-    if (!cloudflared.hasToken()) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "No API token configured. Run cf-set-token first.",
-                },
-            ],
-            isError: true,
-        };
-    }
     try {
         const start = Date.now();
         const result = await cloudflared.createZone(domain);
@@ -264,35 +199,23 @@ server.tool("cf-add-zone", "Add a domain to the Cloudflare account via the offic
         };
     }
     catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[cf-add-zone] failed for ${domain}: ${msg}`);
-        // Detect scope/permission errors and guide the user
-        const lower = msg.toLowerCase();
-        if (lower.includes("403") || lower.includes("permission") || lower.includes("forbidden")) {
-            const tokenPrefix = cloudflared.getTokenPrefix();
-            const isCertDerived = tokenPrefix?.startsWith("cfut_") ?? false;
-            console.error(`[cf-add-zone] permission denied for ${domain} — token prefix=${tokenPrefix ?? "unknown"} (${isCertDerived ? "cert-derived, limited scope" : "API token"})`);
-            const scopeExplanation = isCertDerived
-                ? "The current token was derived from cloudflared's cert.pem (cfut_* prefix). Cert-derived tokens carry Zone:Zone:Read but NOT Zone:Zone:Edit — they cannot create zones or manage DNS. This is a Cloudflare limitation, not a configuration error."
-                : "The current API token does not have the Zone:Zone:Edit scope required to add domains.";
-            const recoveryNote = isCertDerived
-                ? "\n\nDo NOT re-run tunnel-login — it produces the same cert-derived token with the same limited scope."
-                : "\n\nAlternatively, call tunnel-login with force=true to re-authenticate and derive new credentials.";
+        // Refusal-shaped errors thrown by getClient() carry structured detail —
+        // surface them as agent-facing refusals with the same single recovery path.
+        if (err instanceof cloudflared.CloudflareRefusalError) {
             return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Zone creation failed — insufficient permissions.\n\n${scopeExplanation}\n\nRecovery options:\n  1. Use cf-set-token with a user-created API token that has these scopes: Zone:Zone:Edit, Zone:DNS:Edit, Account:Cloudflare Tunnel:Edit. The user can create one at dash.cloudflare.com → My Profile → API Tokens.\n  2. Add the domain directly through the Cloudflare dashboard in the VNC browser.${recoveryNote}`,
-                    },
-                ],
+                content: [{ type: "text", text: err.refusal.message }],
                 isError: true,
             };
         }
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[cf-add-zone] failed for ${domain}: ${msg}`);
         return {
             content: [
                 {
                     type: "text",
-                    text: `Zone creation failed: ${msg}`,
+                    text: `Zone creation failed: ${msg}\n\n` +
+                        `If this looks like a permissions error, the cert.pem account may not own ` +
+                        `this brand's zones. ${cloudflared.recoveryMessage()}`,
                 },
             ],
             isError: true,
@@ -412,17 +335,6 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         .optional()
         .describe("Human-readable tunnel name (default: derived from domain)"),
 }, async ({ domain, adminSubdomain, publicSubdomain, tunnelName }) => {
-    if (!cloudflared.hasCert()) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "Not authenticated. Run tunnel-login first.",
-                },
-            ],
-            isError: true,
-        };
-    }
     // Validate: admin and public subdomains must differ
     if (publicSubdomain && adminSubdomain === publicSubdomain) {
         return {
@@ -443,32 +355,9 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         const publicHostname = publicSubdomain ? `${publicSubdomain}.${domain}` : null;
         const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
         console.error(`[tunnel-create] hostnames=${JSON.stringify(hostnames)} domain=${domain}`);
-        // Step 0: Zone-account pre-flight. cloudflared CLI routes DNS against
-        // cert.pem's account and silently falls back to a sibling zone if the
-        // target zone is absent. Two-layer check by design: (a) this early
-        // check fails fast before any Argo tunnel resource is created; (b) the
-        // authoritative choke-point check inside routeDnsCli guards all three
-        // callers including tunnel-add-hostname's CLI fallback. The duplicate
-        // listZones() call is intentional — the inner check is the guarantee,
-        // this outer check is the UX optimisation.
-        const accountZones = await cloudflared.listZones();
-        for (const h of hostnames) {
-            const match = cloudflared.verifyZoneOnAccount(h, accountZones);
-            if (!match.zone) {
-                const availableList = match.availableZones.length > 0
-                    ? match.availableZones.join(", ")
-                    : "none";
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `Cannot create tunnel for ${h} — the zone that owns this hostname is not on the Cloudflare account bound to this device.\n\n  Best guess at missing zone: "${match.missingParent}" (derived from the last two labels of ${h}; for multi-label TLDs such as .co.uk the real zone may be longer)\n  Available zones on this account: ${availableList}\n\nRecovery: run tunnel-login while signed into the Cloudflare account that owns the zone for ${h}. This rebinds cert.pem to the correct account. Do not use cf-set-token with a token from a different account — zone routing uses cert.pem, not the API token.`,
-                        },
-                    ],
-                    isError: true,
-                };
-            }
-        }
+        // Live account-zone check happens inside routeDnsCli (Step 4 below).
+        // getClient() inside routeDnsCli enforces auth pre-conditions
+        // (cert + binding + accountId match).
         // Step 1: Create tunnel via CLI (idempotent — reuses if name exists)
         const tunnel = cloudflared.createTunnelCli(name);
         // Step 2: Collision guard — check each hostname before creating DNS records
@@ -540,6 +429,12 @@ server.tool("tunnel-create", "Create a Cloudflare Tunnel and route DNS for the s
         };
     }
     catch (err) {
+        if (err instanceof cloudflared.CloudflareRefusalError) {
+            return {
+                content: [{ type: "text", text: err.refusal.message }],
+                isError: true,
+            };
+        }
         return {
             content: [
                 {
@@ -651,13 +546,17 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
                 isError: true,
             };
         }
-        // GATE 3: cert.pem must exist
-        if (!cloudflared.hasCert()) {
+        // GATE 3: auth pre-conditions — cert + binding + accountId match.
+        // We use validateAuth (non-throwing) so we can produce a uniform
+        // refusal message regardless of which condition failed.
+        const enableAuth = cloudflared.validateAuth();
+        if (!enableAuth.bound) {
+            const missing = !enableAuth.hasCert ? "cert.pem" : !enableAuth.hasBinding ? "account binding" : "matching cert/binding";
             return {
                 content: [
                     {
                         type: "text",
-                        text: `REFUSED: Not authenticated. Run tunnel-login first.`,
+                        text: `REFUSED: Cannot start tunnel — ${missing} is missing or mismatched. ${cloudflared.recoveryMessage()}`,
                     },
                 ],
                 isError: true,
@@ -757,6 +656,12 @@ server.tool("tunnel-enable", "Start the Cloudflare Tunnel process. The tunnel mu
         };
     }
     catch (err) {
+        if (err instanceof cloudflared.CloudflareRefusalError) {
+            return {
+                content: [{ type: "text", text: err.refusal.message }],
+                isError: true,
+            };
+        }
         return {
             content: [
                 {
@@ -800,45 +705,16 @@ server.tool("tunnel-add-hostname", "Add an alias hostname to an existing Cloudfl
         .string()
         .describe("The tunnel UUID. Get this from tunnel-status."),
 }, async ({ hostname, tunnelId }) => {
-    if (!cloudflared.hasToken()) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "No API token configured. Run cf-set-token first.",
-                },
-            ],
-            isError: true,
-        };
-    }
     try {
-        // Step 1: Verify the alias domain's zone exists and is accessible
+        // getZoneId enforces auth pre-conditions and refuses if the alias
+        // domain isn't a zone on the bound account.
         const zoneId = await cloudflared.getZoneId(hostname);
         // Step 2: Add hostname to tunnel ingress (read-then-append)
         const ingress = await cloudflared.addHostnameToIngress(tunnelId, hostname);
-        // Step 3: Create CNAME in the alias domain's zone — SDK first, CLI fallback
-        let dns;
-        try {
-            dns = await cloudflared.createDnsRecord(zoneId, hostname, tunnelId);
-        }
-        catch (dnsErr) {
-            const dnsMsg = dnsErr instanceof Error ? dnsErr.message : String(dnsErr);
-            const isPermissionError = dnsMsg.toLowerCase().includes("403") ||
-                dnsMsg.toLowerCase().includes("permission") ||
-                dnsMsg.toLowerCase().includes("forbidden");
-            if (isPermissionError && cloudflared.hasCert()) {
-                console.error(`[tunnel-add-hostname] SDK DNS failed (${dnsMsg}), falling back to cloudflared CLI`);
-                const cliResult = await cloudflared.routeDnsCli(tunnelId, hostname);
-                dns = {
-                    created: cliResult.created,
-                    existing: !cliResult.created,
-                    updated: false,
-                };
-            }
-            else {
-                throw dnsErr;
-            }
-        }
+        // Step 3: Create CNAME via SDK. The cert-bound credential carries
+        // Zone:DNS:Edit for zones owned by the bound account. On any error,
+        // surface as failure — no fallback path remains.
+        const dns = await cloudflared.createDnsRecord(zoneId, hostname, tunnelId);
         // Step 4: Persist alias domain for web server recognition
         cloudflared.saveAliasDomain(hostname);
         // Build response
@@ -860,6 +736,12 @@ server.tool("tunnel-add-hostname", "Add an alias hostname to an existing Cloudfl
         };
     }
     catch (err) {
+        if (err instanceof cloudflared.CloudflareRefusalError) {
+            return {
+                content: [{ type: "text", text: err.refusal.message }],
+                isError: true,
+            };
+        }
         return {
             content: [
                 {
@@ -963,6 +845,67 @@ server.tool("dns-lookup", "Resolve DNS records for a hostname. Replaces dig/nslo
         };
     }
 });
+// ===================================================================
+// cf-verify / cf-rebuild — account-state report + nuclear cleanup
+// ===================================================================
+server.tool("cf-verify", "Read the bound Cloudflare account and the device's local state, return a JSON snapshot. Account section: zones, tunnels, CNAMEs (grouped by zone). Device section: cert.pem, account-binding.json, tunnel.state, config.yml, alias-domains.json. Orphans section: account artefacts not referenced by the device's current intended state (tunnels, CNAMEs, zones not used by any intended hostname). Non-mutating. Runs in any state including fresh-install-before-login.", {}, async () => {
+    try {
+        const report = await cloudflared.cfVerifyCore();
+        return {
+            content: [{ type: "text", text: JSON.stringify(report, null, 2) }],
+        };
+    }
+    catch (err) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `cf-verify failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+server.tool("cf-rebuild", "Nuclear cleanup of the bound Cloudflare account. Deletes every tunnel, CNAME, and (where the account permits) zone NOT in the `preserve` set. With no preserve args, infers what to keep from the device's `tunnel.state` and `alias-domains.json`. Pass `preserve.zones`, `preserve.tunnelIds`, or `preserve.cnames` to override. `dryRun=true` plans without mutating. The agent owns the bound account absolutely — anything not in preserve is treated as junk.", {
+    dryRun: z
+        .boolean()
+        .optional()
+        .describe("If true, report what cf-rebuild WOULD delete without performing any mutations."),
+    preserve: z
+        .object({
+        zones: z.array(z.string()).optional().describe("Zone names to keep (whole zones; all CNAMEs under them survive unless preserve.cnames overrides)."),
+        tunnelIds: z.array(z.string()).optional().describe("Tunnel UUIDs to keep."),
+        cnames: z.array(z.object({ zone: z.string(), name: z.string() })).optional().describe("Per-CNAME preserve list. When set, ONLY these CNAMEs survive within preserved zones."),
+    })
+        .optional()
+        .describe("Preservation set. Anything on the account not listed here is deleted. Defaults to whatever the device's tunnel.state and alias-domains.json reference."),
+}, async ({ dryRun, preserve }) => {
+    try {
+        const report = await cloudflared.cfRebuildCore({ dryRun: dryRun ?? false, preserve });
+        return {
+            content: [{ type: "text", text: JSON.stringify(report, null, 2) }],
+            isError: report.halted,
+        };
+    }
+    catch (err) {
+        if (err instanceof cloudflared.CloudflareRefusalError) {
+            return {
+                content: [{ type: "text", text: err.refusal.message }],
+                isError: true,
+            };
+        }
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `cf-rebuild failed: ${err instanceof Error ? err.message : String(err)}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+});
 const LABEL_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 function sanitizedDomain(domain) {
     return domain.replace(/\./g, "-");
@@ -1015,32 +958,32 @@ server.tool("cloudflare-setup", "Deterministic, UI-driven state machine for Clou
         }
         // ── Step 2: Authentication ──────────────────────────────────────
         log("checking authentication");
-        const auth = await cloudflared.validateAuth();
-        if (auth.hasToken && auth.tokenValid) {
-            log("authenticated — token valid");
+        const auth = cloudflared.validateAuth();
+        if (auth.bound) {
+            log(`authenticated — cert and binding agree on account ${auth.boundAccountId}`);
         }
-        else if (cloudflared.hasCert()) {
-            // cert.pem exists — derive credentials
-            log("cert.pem found — deriving credentials");
+        else if (auth.hasCert) {
+            // cert.pem exists — materialize binding (migration path) or surface
+            // drift if the binding disagrees with the cert.
             const creds = cloudflared.parseCertPem();
             if (!creds) {
                 log("cert.pem exists but could not extract credentials");
                 return result({
                     status: "error",
-                    message: "Found a Cloudflare certificate but could not extract credentials from it. Try signing in again — I'll clear the old certificate and start fresh.",
+                    message: "Found a Cloudflare certificate but could not extract credentials from it. Sign in again — I'll clear the old certificate and start fresh.",
                 });
             }
-            const validation = await cloudflared.validateToken(creds.apiToken);
-            if (!validation.valid) {
-                log(`cert-derived token rejected: ${validation.error}`);
+            if (!auth.hasBinding) {
+                const binding = cloudflared.materializeBinding("migration");
+                log(`materialized binding from existing cert — account ${binding.accountId}`);
+            }
+            else if (auth.certAccountId !== auth.boundAccountId) {
+                log(`account drift: cert=${auth.certAccountId} binding=${auth.boundAccountId}`);
                 return result({
                     status: "error",
-                    message: `The credentials from your Cloudflare certificate were rejected: ${validation.error}. Try signing in again.`,
+                    message: `Your Cloudflare certificate is bound to a different account than this device's recorded binding. ${cloudflared.recoveryMessage()}`,
                 });
             }
-            const accountId = validation.accountId ?? creds.accountId;
-            cloudflared.writeToken(creds.apiToken, accountId);
-            log(`credentials derived and stored — account: ${validation.accountName ?? accountId}`);
         }
         else {
             // No cert, no token — need login
@@ -1310,6 +1253,9 @@ server.tool("cloudflare-setup", "Deterministic, UI-driven state machine for Clou
         const adminHostname = `${resolvedAdminLabel}.${domain}`;
         const publicHostname = resolvedPublicLabel ? `${resolvedPublicLabel}.${domain}` : null;
         const hostnames = publicHostname ? [adminHostname, publicHostname] : [adminHostname];
+        // Account-zone scope check happens inside routeDnsCli (Step 6) — the
+        // domain was picked from the live account zone list, so by construction
+        // it is on the bound account. No pre-flight needed here.
         // ── Step 5: Resolve or create tunnel (idempotent on re-entry) ───
         let tunnelId = existingState?.tunnelId ?? null;
         let tunnelName = existingState?.tunnelName ?? null;