authflow-cli 0.4.1 → 0.5.0

package/dist/resource-urls.js

@@ -0,0 +1,56 @@
+/**
+ * Where a resource actually answers, for the checks that probe it.
+ *
+ * doctor and the Google check used to build `{issuer}/{slug}/mcp` and the matching PRM URL
+ * themselves. That is only true for a resource on the gateway host. A resource on its own hostname
+ * answers only there, and its canonical resource URI is the tenant's URL, so the receipt is the
+ * source of truth and the issuer-plus-slug form is the fallback for when there is no receipt.
+ */
+const wellKnownPrefix = "/.well-known/oauth-protected-resource";
+/**
+ * RFC 9728 §3.1: the well-known suffix is inserted between the host and the path of the resource
+ * identifier, and a terminating slash after a bare host is dropped. `https://h/mcp` therefore has
+ * its metadata at `https://h/.well-known/oauth-protected-resource/mcp`, and `https://h` at
+ * `https://h/.well-known/oauth-protected-resource`.
+ */
+export function protectedResourceMetadataUrl(resource) {
+    let url;
+    try {
+        url = new URL(resource);
+    }
+    catch {
+        return undefined;
+    }
+    const path = url.pathname === "/" ? "" : url.pathname;
+    return `${url.origin}${wellKnownPrefix}${path}${url.search}`;
+}
+/** The canonical URI of a resource served on a tenant host. */
+export function publicResourceUrl(host, path) {
+    return `https://${host}${path}`;
+}
+/** What a resource on the gateway host answers at: `{issuer}/{slug}/mcp` and its PRM. */
+export function slugEndpoints(base, slug) {
+    const encoded = encodeURIComponent(slug);
+    return {
+        gatewayUrl: `${base}/${encoded}/mcp`,
+        prmUrl: `${base}${wellKnownPrefix}/${encoded}/mcp`,
+    };
+}
+/**
+ * Endpoints from the receipt when it supplies them, per field, falling back to the slug form.
+ * `base` is the issuer with no trailing slash.
+ */
+export function resolveResourceEndpoints(base, slug, receipt) {
+    const fallback = slugEndpoints(base, slug);
+    const resource = receipt?.resource?.trim() || undefined;
+    const gateway = receipt?.gateway_url?.trim() || undefined;
+    const prm = receipt?.prm_url?.trim() || undefined;
+    const source = resource ?? gateway;
+    return {
+        resource,
+        gatewayUrl: gateway ?? resource ?? fallback.gatewayUrl,
+        prmUrl: prm ?? (source ? protectedResourceMetadataUrl(source) : undefined) ?? fallback.prmUrl,
+        publicHost: receipt?.public_host?.trim().toLowerCase() || undefined,
+    };
+}
+//# sourceMappingURL=resource-urls.js.map

package/dist/resource-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-urls.js","sourceRoot":"","sources":["../src/resource-urls.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAahE;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IAC1D,OAAO,WAAW,IAAI,GAAG,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,GAAG,IAAI,IAAI,OAAO,MAAM;QACpC,MAAM,EAAE,GAAG,IAAI,GAAG,eAAe,IAAI,OAAO,MAAM;KACnD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,IAAY,EACZ,OAA6B;IAE7B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,CAAC;IAEnC,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,OAAO,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,MAAM;QAC7F,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS;KACpE,CAAC;AACJ,CAAC"}

package/dist/status.d.ts

@@ -1,4 +1,4 @@
-import type { RegistrationReceipt } from "./config.js";
+import type { CustomDomainRecord, RegistrationReceipt } from "./config.js";
 /**
  * Turning a receipt into "what is done, what is left, and what do I type next".
  *
@@ -20,14 +20,28 @@ export type ReadinessStep = {
     name: string;
     done: boolean;
     detail: string;
+    /** Extra lines printed under the detail, such as the DNS records still to add. */
+    lines?: string[];
     /** What to run next. Absent once the step is done. */
     command?: string;
 };
+/** The custom-domain claim, structured for `status --json` and for agents. */
+export type ReadinessCustomDomain = {
+    host?: string;
+    path: string;
+    state?: string;
+    cnameTarget?: string;
+    records: CustomDomainRecord[];
+    lastError?: string;
+    checkedAt?: string;
+};
 export type Readiness = {
     slug: string;
     status: string;
     ready: boolean;
     gatewayUrl?: string;
+    /** Present when the resource is, or is becoming, served on the tenant's own hostname. */
+    customDomain?: ReadinessCustomDomain;
     steps: ReadinessStep[];
 };
 export declare function resourceReadiness(receipt: RegistrationReceipt): Readiness;

package/dist/status.js

@@ -1,3 +1,4 @@
+import { customDomainState, defaultPublicPath, formatDnsRecords, registrarNameHint, setDomainCommandLine, summarizeCustomDomain, } from "./custom-domain.js";
 /**
  * Turning a receipt into "what is done, what is left, and what do I type next".
  *
@@ -77,14 +78,41 @@ export function resourceReadiness(receipt) {
                     : undefined,
         },
     ];
-    // Conformance is not a receipt field: the rail records registration state, not whether the origin
-    // has been exercised. Prompt for it whenever the origin exists so it is not silently skipped.
+    // A custom host is a requirement of its own: until the tenant's DNS is in place and the edge has
+    // a certificate, the resource's URL does not answer, and from the outside that looks exactly like
+    // an origin that was never wired up.
+    const customDomain = customDomainReadiness(receipt);
+    if (customDomain || blocked("custom_domain_dns")) {
+        const done = customDomain?.state === "ready" && !blocked("custom_domain_dns");
+        const records = customDomain?.records ?? [];
+        steps.push({
+            name: "custom domain DNS",
+            done,
+            detail: `${customDomain?.host ?? "(host not reported)"}: ${summarizeCustomDomain(receipt)}`,
+            lines: records.length > 0
+                ? [
+                    "",
+                    ...formatDnsRecords(records),
+                    ...(!done && customDomain?.host ? ["", ...registrarNameHint(customDomain.host)] : []),
+                ]
+                : undefined,
+            command: done ? undefined : setDomainCommandLine(slug),
+        });
+    }
+    // Conformance is recorded on the receipt after POST /origin/v1/conformance. Prompt until
+    // a run has passed so it is not silently skipped, and stop prompting after a pass.
     if (receipt.origin_base_uri) {
+        const probed = receipt.last_probe_passed === true;
+        const at = receipt.last_probe_at_utc?.trim();
         steps.push({
             name: "conformance probed",
-            done: false,
-            detail: "run the probe to confirm the origin fails closed on a bad identity header",
-            command: "authflow probe",
+            done: probed,
+            detail: probed
+                ? `passed${at ? ` at ${at}` : ""}`
+                : at
+                    ? `last run failed at ${at}`
+                    : "run the probe to confirm the origin fails closed on a bad identity header",
+            command: probed ? undefined : "authflow probe",
         });
     }
     return {
@@ -92,9 +120,27 @@ export function resourceReadiness(receipt) {
         status: receipt.status ?? (pending.length === 0 ? "live" : "draft"),
         ready: pending.length === 0 && receipt.status === "live",
         gatewayUrl: receipt.gateway_url ?? receipt.resource,
+        customDomain,
         steps,
     };
 }
+/** Undefined for a resource on the gateway host, so its status output does not change at all. */
+function customDomainReadiness(receipt) {
+    const domain = receipt.custom_domain;
+    const host = receipt.public_host?.trim();
+    if (!domain && !host) {
+        return undefined;
+    }
+    return {
+        host,
+        path: receipt.public_path?.trim() || defaultPublicPath,
+        state: customDomainState(receipt),
+        cnameTarget: domain?.cname_target ?? undefined,
+        records: domain?.records ?? [],
+        lastError: domain?.last_error ?? undefined,
+        checkedAt: domain?.checked_at ?? undefined,
+    };
+}
 function attachStripeCommand(slug) {
     return (`authflow connect --slug ${slug}` +
         `  (or authflow set-connected-account --slug ${slug} --account acct_…)`);
@@ -111,7 +157,15 @@ export function formatReadiness(readiness) {
     for (const step of readiness.steps) {
         lines.push(`  ${step.done ? "[x]" : "[ ]"} ${step.name}`);
         lines.push(`      ${step.detail}`);
+        const extras = step.lines ?? [];
+        for (const extra of extras) {
+            lines.push(extra ? `      ${extra}` : "");
+        }
         if (step.command) {
+            // Keep the command visually apart from a block of records it refers to.
+            if (extras.length > 0) {
+                lines.push("");
+            }
             lines.push(`      next: ${step.command}`);
         }
     }

package/dist/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,kGAAkG;IAClG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,2EAA2E;YACnF,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,EAAE;QACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;KAC3F,CAAC;AACJ,CAAC;AAiCD,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvE,MAAM,KAAK,GAAoB;QAC7B;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB;SAC7C;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACrE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,mDAAmD;YACtF,OAAO,EAAE,OAAO,CAAC,eAAe;gBAC9B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8BAA8B,IAAI,2CAA2C;SAClF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,+CAA+C;YACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;SAC9E;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EACF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBAChC,CAAC,OAAO,CAAC,4BAA4B,CAAC;YACxC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACnC,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,iBAAiB;YACvB,OAAO,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACpC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;oBACrC,CAAC,CAAC,2BAA2B,IAAI,EAAE;oBACnC,CAAC,CAAC,SAAS;SAChB;KACF,CAAC;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,qCAAqC;IACrC,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,mBAAmB;YACzB,IAAI;YACJ,MAAM,EAAE,GAAG,YAAY,EAAE,IAAI,IAAI,qBAAqB,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE;YAC3F,KAAK,EACH,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC;oBACE,EAAE;oBACF,GAAG,gBAAgB,CAAC,OAAO,CAAC;oBAC5B,GAAG,CAAC,CAAC,IAAI,IAAI,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;gBACH,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAClD,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,CAAC,CAAC,EAAE;oBACF,CAAC,CAAC,sBAAsB,EAAE,EAAE;oBAC5B,CAAC,CAAC,2EAA2E;YACjF,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACxD,UAAU,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ;QACnD,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB;QACtD,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACjC,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,SAAS;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;QAC1C,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,2BAA2B,IAAI,EAAE;QACjC,+CAA+C,IAAI,oBAAoB,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAoB;IAClD,MAAM,KAAK,GAAa;QACtB,aAAa,SAAS,CAAC,IAAI,EAAE;QAC7B,aAAa,SAAS,CAAC,MAAM,EAAE;KAChC,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,wEAAwE;YACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,KAAK;QACb,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,+EAA+E,CACpF,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/surface.d.ts

@@ -15,6 +15,7 @@ export declare const mcpToolToCliCommand: {
     readonly authflow_start_stripe_connect: "connect";
     readonly authflow_set_connected_account: "set-connected-account";
     readonly authflow_set_origin: "set-origin";
+    readonly authflow_set_custom_domain: "set-domain";
     readonly authflow_probe: "probe";
     readonly authflow_mint_test_header: "mint-header";
     readonly authflow_rotate_origin_key: "rotate-origin-key";

package/dist/surface.js

@@ -15,6 +15,7 @@ export const mcpToolToCliCommand = {
     authflow_start_stripe_connect: "connect",
     authflow_set_connected_account: "set-connected-account",
     authflow_set_origin: "set-origin",
+    authflow_set_custom_domain: "set-domain",
     authflow_probe: "probe",
     authflow_mint_test_header: "mint-header",
     authflow_rotate_origin_key: "rotate-origin-key",

package/dist/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,0BAA0B,EAAE,UAAU;IACtC,qBAAqB,EAAE,KAAK;IAC5B,uBAAuB,EAAE,MAAM;IAC/B,eAAe,EAAE,QAAQ;IACzB,yBAAyB,EAAE,MAAM;IACjC,6BAA6B,EAAE,SAAS;IACxC,8BAA8B,EAAE,uBAAuB;IACvD,mBAAmB,EAAE,YAAY;IACjC,0BAA0B,EAAE,YAAY;IACxC,cAAc,EAAE,OAAO;IACvB,yBAAyB,EAAE,aAAa;IACxC,0BAA0B,EAAE,mBAAmB;CACvC,CAAC"}

package/dist/tenant-host.d.ts

@@ -0,0 +1,49 @@
+import { type PeerCertificate } from "node:tls";
+import { type DoctorCheck } from "./checks.js";
+import type { RegistrationReceipt } from "./config.js";
+/**
+ * `authflow doctor --host`: does a tenant's own hostname work, end to end, from outside?
+ *
+ * The rail can report a custom domain as ready while a tenant's registrar still serves a stale
+ * record, and a rail-side check cannot tell, because the rail is not the one resolving the name.
+ * These checks look the way a client does: resolve the three records, handshake TLS, follow a plain
+ * http request, then fetch the discovery documents and the 401 challenge on the tenant host.
+ *
+ * Every lookup goes through an injectable seam (DNS, TLS) or the shared fetch, so none of this
+ * needs a network to test.
+ */
+export type DnsResolver = {
+    resolveCname(hostname: string): Promise<string[]>;
+    resolveTxt(hostname: string): Promise<string[][]>;
+};
+export declare const systemDnsResolver: DnsResolver;
+export type TlsPeer = {
+    authorized: boolean;
+    /** Why the certificate is not trusted, as Node reports it (a code such as CERT_HAS_EXPIRED). */
+    authorizationError?: string;
+    issuer: string;
+    subject: string;
+    validTo: Date;
+};
+export type TlsProbe = (host: string, port: number) => Promise<TlsPeer>;
+/** The network seams, injectable so tests never touch DNS or open a socket. */
+export type HostProbes = {
+    dns?: DnsResolver;
+    tls?: TlsProbe;
+    now?: () => Date;
+};
+export type TenantHostOptions = HostProbes & {
+    /** Lowercase hostname, already validated. */
+    host: string;
+    /** The receipt to compare against. Without one, records are checked for presence only. */
+    receipt?: RegistrationReceipt;
+    /**
+     * Why there is no receipt, as a short phrase ("no admin key to read it"), so the report says so
+     * instead of quietly comparing nothing.
+     */
+    receiptNote?: string;
+};
+export declare function runTenantHostChecks(options: TenantHostOptions): Promise<DoctorCheck[]>;
+/** The certificate a server presents, whether or not Node trusts it. */
+export declare const probeTls: TlsProbe;
+export declare function describePeer(cert: PeerCertificate, authorized: boolean, authorizationError?: string): TlsPeer;

package/dist/tenant-host.js

@@ -0,0 +1,367 @@
+import { resolveCname, resolveTxt } from "node:dns/promises";
+import { connect as tlsConnect } from "node:tls";
+import { fetchOrNull, unauthenticatedInitialize } from "./checks.js";
+import { customDomainState, defaultPublicPath, setDomainCommandLine, summarizeCustomDomain, } from "./custom-domain.js";
+import { publicResourceUrl } from "./resource-urls.js";
+export const systemDnsResolver = { resolveCname, resolveTxt };
+const tlsTimeoutMs = 15_000;
+const httpsPort = 443;
+const msPerDay = 86_400_000;
+/**
+ * Renewal is automatic once the _acme-challenge CNAME validates, and starts well before expiry. A
+ * certificate this close to the end means it has been failing to renew for weeks.
+ */
+const certExpiryFailDays = 7;
+const prmRootPath = "/.well-known/oauth-protected-resource";
+export async function runTenantHostChecks(options) {
+    const host = options.host;
+    const dns = options.dns ?? systemDnsResolver;
+    const tls = options.tls ?? probeTls;
+    const now = options.now ?? (() => new Date());
+    // A receipt registered on a different host says nothing about this one, so it supplies no
+    // expectations; the first check reports the mismatch.
+    const receipt = options.receipt?.public_host?.trim().toLowerCase() === host ? options.receipt : undefined;
+    const expected = expectations(host, receipt);
+    const note = options.receiptNote ?? "no receipt for this host";
+    const checks = [checkRegistration(host, options.receipt, receipt, options.receiptNote)];
+    checks.push(...(await checkDns(host, expected, dns, note)));
+    const handshake = await checkTls(host, tls, now, receipt);
+    checks.push(handshake.check);
+    checks.push(await checkHttpRedirect(host, expected.path));
+    // Fetch refuses an untrusted certificate, so with a failed handshake every https check below
+    // would fail with the same unhelpful "fetch failed". The TLS check already says why.
+    if (!handshake.usable) {
+        checks.push({
+            name: "host https checks",
+            pass: true,
+            skipped: true,
+            detail: `Skipped the PRM and 401 checks: the TLS check failed, so https requests to ${host} would ` +
+                "fail with misleading errors.",
+        });
+        return checks;
+    }
+    checks.push(await checkPrm("path", `https://${host}${prmRootPath}${expected.path}`, expected.resource), await checkPrm("root", `https://${host}${prmRootPath}`, expected.resource), await checkChallenge(host, expected.path));
+    return checks;
+}
+function expectations(host, receipt) {
+    const path = receipt?.public_path?.trim() || defaultPublicPath;
+    const records = receipt?.custom_domain?.records ?? [];
+    return {
+        path,
+        resource: receipt?.resource?.trim() || publicResourceUrl(host, path),
+        fromReceipt: receipt !== undefined,
+        state: receipt ? customDomainState(receipt) : undefined,
+        cnameTarget: receipt?.custom_domain?.cname_target?.trim() ||
+            records.find((record) => record.purpose === "traffic")?.value,
+        ownership: records.find((record) => record.purpose === "ownership"),
+        certificate: records.find((record) => record.purpose === "certificate"),
+    };
+}
+function checkRegistration(host, given, matched, note) {
+    const name = "host custom domain";
+    if (!given) {
+        return skip(name, `No receipt for ${host} (${note ?? "none was supplied"}), so the expected DNS targets are ` +
+            "unknown: records are checked for presence only, not compared.");
+    }
+    const slug = given.slug ?? "<slug>";
+    if (!matched) {
+        const registeredOn = given.public_host ? `'${given.public_host}'` : "the gateway host";
+        return fail(name, `Resource '${slug}' is registered on ${registeredOn}, not on ${host}.`, `Check --host, or point the resource at this host: authflow set-domain --slug ${slug} --host ${host}`);
+    }
+    const summary = summarizeCustomDomain(matched);
+    if (customDomainState(matched) === "ready") {
+        return pass(name, `${host} is registered on '${slug}': ${summary}.`);
+    }
+    return fail(name, `${host} is registered on '${slug}', but the rail reports ${summary}.`, `Finish the DNS records, then have the rail re-check: ${setDomainCommandLine(slug)}`);
+}
+async function checkDns(host, expected, dns, note) {
+    return [
+        await checkTrafficCname(host, expected, dns, note),
+        await checkCertificateCname(host, expected, dns, note),
+        await checkOwnershipTxt(host, expected, dns, note),
+    ];
+}
+async function checkTrafficCname(host, expected, dns, note) {
+    const name = "host DNS: traffic CNAME";
+    const lookup = await lookupCname(dns, host);
+    if (lookup.kind === "error") {
+        return dnsLookupFailed(name, `CNAME for ${host}`, lookup.message);
+    }
+    if (lookup.kind === "missing") {
+        return fail(name, `${host} has no CNAME record.`, `Add a CNAME for ${host} pointing at ${expected.cnameTarget ?? "the cname_target in your receipt (authflow status shows it)"}. ` +
+            "Until it points at the edge, traffic never reaches Authflow.");
+    }
+    const target = expected.cnameTarget ? normalizeDnsName(expected.cnameTarget) : undefined;
+    if (!target) {
+        return skip(name, `${host} CNAME -> ${lookup.values[0]}. Not compared: ${note}.`);
+    }
+    if (lookup.values.includes(target)) {
+        return pass(name, `${host} CNAME -> ${target}.`);
+    }
+    return fail(name, `${host} CNAME points at ${lookup.values.join(", ")}, expected ${target}.`, `Change the CNAME for ${host} to ${target}. A CNAME to anywhere else sends traffic past Authflow.`);
+}
+async function checkCertificateCname(host, expected, dns, note) {
+    const name = "host DNS: _acme-challenge CNAME";
+    const record = expected.certificate;
+    const recordName = record?.name ?? `_acme-challenge.${host}`;
+    // The rail issues this record only once provisioning has begun. Until then there is nothing for
+    // the tenant to have added, and calling its absence a failure would send them hunting for it.
+    if (expected.fromReceipt && !record) {
+        return skip(name, `The rail has not issued a certificate record yet (state: ${expected.state ?? "unknown"}), so there is nothing to check.`);
+    }
+    const lookup = await lookupCname(dns, recordName);
+    if (lookup.kind === "error") {
+        return dnsLookupFailed(name, `CNAME for ${recordName}`, lookup.message);
+    }
+    if (lookup.kind === "missing") {
+        return fail(name, `${recordName} has no CNAME record.`, record
+            ? `Add CNAME ${recordName} -> ${record.value}. Without it the certificate cannot be validated or renewed.`
+            : "Add the certificate CNAME the rail issued (authflow status lists it). Without it the certificate " +
+                "cannot be validated or renewed.");
+    }
+    if (!record) {
+        return skip(name, `${recordName} CNAME -> ${lookup.values[0]}. Not compared: ${note}.`);
+    }
+    const target = normalizeDnsName(record.value);
+    if (lookup.values.includes(target)) {
+        return pass(name, `${recordName} CNAME -> ${target}.`);
+    }
+    return fail(name, `${recordName} CNAME points at ${lookup.values.join(", ")}, expected ${target}.`, `Change it to ${target}, exactly as the rail issued it.`);
+}
+async function checkOwnershipTxt(host, expected, dns, note) {
+    const name = "host DNS: _authflow-verify TXT";
+    const record = expected.ownership;
+    const recordName = record?.name ?? `_authflow-verify.${host}`;
+    let values;
+    try {
+        values = (await dns.resolveTxt(recordName)).map((chunks) => chunks.join(""));
+    }
+    catch (err) {
+        if (!isMissingRecord(err)) {
+            return dnsLookupFailed(name, `TXT for ${recordName}`, errorMessage(err));
+        }
+        values = [];
+    }
+    if (values.length === 0) {
+        return fail(name, `${recordName} has no TXT record.`, record
+            ? `Add TXT ${recordName} = ${record.value}. It proves you own the host, and the rail will not provision it without.`
+            : "Add the ownership TXT record the rail issued (authflow status lists it).");
+    }
+    if (record) {
+        return values.some((value) => value.trim() === record.value.trim())
+            ? pass(name, `${recordName} TXT matches the receipt.`)
+            : fail(name, `${recordName} has TXT ${values.map((value) => `'${value}'`).join(", ")}, expected '${record.value}'.`, `Replace it with exactly ${record.value}.`);
+    }
+    return values.some((value) => value.trim().startsWith("authflow-verify="))
+        ? skip(name, `${recordName} has an authflow-verify= TXT record. Not compared: ${note}.`)
+        : fail(name, `${recordName} has TXT records, but none starts with authflow-verify=.`, "Add the ownership TXT record the rail issued (authflow status lists it).");
+}
+async function lookupCname(dns, name) {
+    try {
+        const values = (await dns.resolveCname(name)).map(normalizeDnsName);
+        return values.length > 0 ? { kind: "found", values } : { kind: "missing" };
+    }
+    catch (err) {
+        return isMissingRecord(err) ? { kind: "missing" } : { kind: "error", message: errorMessage(err) };
+    }
+}
+function dnsLookupFailed(name, what, message) {
+    return fail(name, `Looking up the ${what} failed: ${message}`, "This is a resolver problem, not proof the record is missing. Retry, or check the domain's nameservers.");
+}
+/** NXDOMAIN and "name exists, no such record" both mean the record is not there. */
+function isMissingRecord(err) {
+    const code = err?.code;
+    return code === "ENODATA" || code === "ENOTFOUND";
+}
+function normalizeDnsName(value) {
+    return value.trim().toLowerCase().replace(/\.$/, "");
+}
+// ---------------------------------------------------------------------------------------------
+// TLS
+// ---------------------------------------------------------------------------------------------
+async function checkTls(host, probe, now, receipt) {
+    const name = "host TLS certificate";
+    let peer;
+    try {
+        peer = await probe(host, httpsPort);
+    }
+    catch (err) {
+        return {
+            usable: false,
+            check: fail(name, `Could not complete a TLS handshake with ${host}:${httpsPort}: ${errorMessage(err)}`, "Either DNS does not point at the edge yet, or the edge has no certificate for the host. " +
+                "Check the DNS results above, then wait for the certificate."),
+        };
+    }
+    const days = Math.floor((peer.validTo.getTime() - now().getTime()) / msPerDay);
+    const expiry = describeExpiry(peer.validTo, days);
+    const who = `issuer ${peer.issuer}, subject ${peer.subject}`;
+    if (!peer.authorized) {
+        return {
+            usable: false,
+            check: fail(name, `The certificate ${host} presents is not trusted: ${peer.authorizationError ?? "unknown error"} (${who}; expires ${expiry}).`, tlsRemedy(host, peer.authorizationError, receipt)),
+        };
+    }
+    if (days < certExpiryFailDays) {
+        return {
+            usable: true,
+            check: fail(name, `The certificate is about to expire (${who}; expires ${expiry}).`, "Renewal is automatic once the _acme-challenge CNAME validates. A certificate this close to " +
+                "expiry means that record is missing or wrong."),
+        };
+    }
+    return { usable: true, check: pass(name, `Issued by ${peer.issuer} to ${peer.subject}; expires ${expiry}.`) };
+}
+/** `2027-01-01, in 89 days` or, for a lapsed certificate, `2026-01-01, 3 days ago`. */
+function describeExpiry(validTo, days) {
+    const date = validTo.toISOString().slice(0, 10);
+    const unit = Math.abs(days) === 1 ? "day" : "days";
+    return days >= 0 ? `${date}, in ${days} ${unit}` : `${date}, ${-days} ${unit} ago`;
+}
+function tlsRemedy(host, code, receipt) {
+    const recheck = receipt ? ` Then: ${setDomainCommandLine(receipt.slug ?? "<slug>")}` : "";
+    if (code === "ERR_TLS_CERT_ALTNAME_INVALID") {
+        return (`The edge answered with a certificate that does not cover ${host}. Its certificate for the host ` +
+            `is not active yet, or the traffic CNAME does not point at the edge. Check the DNS results above.${recheck}`);
+    }
+    if (code === "CERT_HAS_EXPIRED") {
+        return "The certificate has expired. Renewal is automatic once the _acme-challenge CNAME validates; check that record.";
+    }
+    return `Clients will refuse this certificate. Check the DNS results above, then wait for the edge to issue one.${recheck}`;
+}
+/** The certificate a server presents, whether or not Node trusts it. */
+export const probeTls = (host, port) => new Promise((resolve, reject) => {
+    // Untrusted certificates are the finding here, not a reason to refuse the connection.
+    const socket = tlsConnect({ host, port, servername: host, rejectUnauthorized: false });
+    socket.setTimeout(tlsTimeoutMs, () => {
+        socket.destroy(new Error(`timed out after ${tlsTimeoutMs / 1000}s`));
+    });
+    socket.once("error", reject);
+    socket.once("secureConnect", () => {
+        try {
+            resolve(describePeer(socket.getPeerCertificate(), socket.authorized, socket.authorized ? undefined : String(socket.authorizationError)));
+        }
+        catch (err) {
+            reject(err);
+        }
+        finally {
+            socket.end();
+        }
+    });
+});
+export function describePeer(cert, authorized, authorizationError) {
+    const validTo = new Date(cert.valid_to);
+    if (!cert.valid_to || Number.isNaN(validTo.getTime())) {
+        throw new Error("the server presented no usable certificate");
+    }
+    return {
+        authorized,
+        authorizationError,
+        issuer: describeName(cert.issuer),
+        subject: describeName(cert.subject),
+        validTo,
+    };
+}
+/** `Let's Encrypt (E8)`: organisation and common name, whichever the certificate has. */
+function describeName(name) {
+    const first = (value) => {
+        const single = Array.isArray(value) ? value[0] : value;
+        return typeof single === "string" && single.length > 0 ? single : undefined;
+    };
+    const organisation = first(name?.O);
+    const common = first(name?.CN);
+    if (organisation && common) {
+        return `${organisation} (${common})`;
+    }
+    return common ?? organisation ?? "unknown";
+}
+// ---------------------------------------------------------------------------------------------
+// HTTP
+// ---------------------------------------------------------------------------------------------
+async function checkHttpRedirect(host, path) {
+    const name = "host http redirects to https";
+    const url = `http://${host}${path}`;
+    const response = await fetchOrNull(url, { redirect: "manual" });
+    if (!response.ok) {
+        return fail(name, `GET ${url} could not be reached: ${response.error}`, "Port 80 is not answering. The edge redirects plain http for proxied hostnames, so the traffic " +
+            "CNAME is probably not in place yet.");
+    }
+    const status = response.status ?? 0;
+    if ([301, 302, 303, 307, 308].includes(status)) {
+        const target = parseUrl(response.location ?? "", url);
+        return target?.protocol === "https:" && target.host === host
+            ? pass(name, `GET ${url} returned ${status} to ${response.location}.`)
+            : fail(name, `GET ${url} returned ${status} to '${response.location ?? ""}', not to https://${host}.`, "The redirect has to stay on the tenant host and switch to https, or a client following it " +
+                "connects somewhere else or stays unencrypted.");
+    }
+    return fail(name, `GET ${url} returned ${status} over plain http instead of redirecting to https.`, "Enable Always Use HTTPS on the edge zone. Without it, a client configured with an http:// URL " +
+        "talks to the server unencrypted.");
+}
+async function checkPrm(label, url, expectedResource) {
+    const name = `host PRM (${label})`;
+    const response = await fetchOrNull(url);
+    if (!response.ok) {
+        return fail(name, `GET ${url} could not be reached: ${response.error}`, "Check the host's DNS and certificate above.");
+    }
+    if (response.status !== 200) {
+        return fail(name, `GET ${url} returned ${response.status}, expected 200.`, response.status === 404
+            ? "The host answers but the rail does not recognise it: the custom domain is not ready, or the " +
+                "edge is not forwarding the host. Clients discover the authorization server here (Claude Code " +
+                "probes the root path)."
+            : "Clients discover the authorization server from this document. File a rail bug.");
+    }
+    let resource;
+    try {
+        resource = JSON.parse(response.body ?? "").resource;
+    }
+    catch {
+        return fail(name, `${url} did not return JSON.`, "Something other than the rail is answering on the host.");
+    }
+    if (resource !== expectedResource) {
+        return fail(name, `${url} names resource '${String(resource)}', expected '${expectedResource}'.`, "Tokens are audience-bound to this value. A client that connected at the host would be refused at " +
+            "/authorize as invalid_target.");
+    }
+    return pass(name, `GET ${url} returned 200 with resource ${resource}.`);
+}
+async function checkChallenge(host, path) {
+    const name = "host 401 challenge";
+    const url = `https://${host}${path}`;
+    const response = await fetchOrNull(url, unauthenticatedInitialize());
+    if (!response.ok) {
+        return fail(name, `Unauthenticated POST ${url} could not be reached: ${response.error}`, "Check the host's DNS and certificate above.");
+    }
+    if (response.status !== 401) {
+        return fail(name, `Unauthenticated POST ${url} returned ${response.status}, expected 401.`, response.status === 404
+            ? "The host answers but the rail does not recognise it: the custom domain is not ready, or the edge is not forwarding the host."
+            : "An unauthenticated connect that does not 401 means clients will never start OAuth.");
+    }
+    const challenge = response.headers?.get("www-authenticate") ?? "";
+    const metadata = resourceMetadataValue(challenge);
+    if (!metadata) {
+        return fail(name, `401 returned, but WWW-Authenticate has no resource_metadata parameter: '${challenge}'.`, "MCP clients cannot discover the authorization server. File a rail bug.");
+    }
+    const target = parseUrl(metadata);
+    if (target?.protocol !== "https:" || target.host !== host) {
+        return fail(name, `The 401's resource_metadata is '${metadata}', which is not an https URL on ${host}.`, "Clients fetch protected resource metadata from this URL. It has to name the host they connected " +
+            "to; pointing it at the gateway host sends them to the wrong audience.");
+    }
+    return pass(name, `401 with resource_metadata=${metadata}.`);
+}
+/** The `resource_metadata` parameter of a Bearer challenge, quoted or bare. */
+function resourceMetadataValue(challenge) {
+    const match = /resource_metadata\s*=\s*(?:"([^"]*)"|([^\s,]+))/i.exec(challenge);
+    return match?.[1] ?? match?.[2] ?? undefined;
+}
+function parseUrl(value, base) {
+    try {
+        return new URL(value, base);
+    }
+    catch {
+        return undefined;
+    }
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+const pass = (name, detail) => ({ name, pass: true, detail });
+const skip = (name, detail) => ({ name, pass: true, skipped: true, detail });
+const fail = (name, detail, remedy) => ({ name, pass: false, detail, remedy });
+//# sourceMappingURL=tenant-host.js.map