feat(deploy): sequence DNS verification feedback per component

Replace the single-spinner pollDeployStatus loop with a chained
mail/dns/ssl spinner sequence that emits a per-component success
line as each boolean flips true. Add a defensive status === "complete"
check after all three components succeed so the proxy_ok server-side
case fails closed rather than reporting verified. When all DNS
components are resolved but the server has not yet marked the
deployment complete, exit the verification path without reaching
finishDeploy.

Author: wyattjoh

packages/cli-core/src/commands/deploy/index.test.ts

@@ -477,6 +477,80 @@ describe("deploy", () => {
       expect(err).toContain("Production ready at https://example.com");
     });
 
+    test("DNS verification emits per-component spinner labels in mail/dns/ssl order", async () => {
+      await linkedProject();
+      mockIsAgent.mockReturnValue(false);
+      mockConfirm
+        .mockResolvedValueOnce(true) // Proceed?
+        .mockResolvedValueOnce(true) // Create production instance?
+        .mockResolvedValueOnce(false); // Export BIND zone file? (wired in Task 5; harmless when not yet consumed)
+      mockInput
+        .mockResolvedValueOnce("example.com")
+        .mockResolvedValueOnce("google-client-id.apps.googleusercontent.com");
+      mockSelect.mockResolvedValueOnce("check").mockResolvedValueOnce("have-credentials");
+      mockPassword.mockResolvedValueOnce("google-secret");
+      mockGetDeployStatus
+        .mockResolvedValueOnce({
+          status: "incomplete",
+          dns_ok: false,
+          ssl_ok: false,
+          mail_ok: false,
+        })
+        .mockResolvedValueOnce({
+          status: "incomplete",
+          dns_ok: false,
+          ssl_ok: false,
+          mail_ok: true,
+        })
+        .mockResolvedValueOnce({
+          status: "incomplete",
+          dns_ok: true,
+          ssl_ok: false,
+          mail_ok: true,
+        })
+        .mockResolvedValueOnce({ status: "complete", dns_ok: true, ssl_ok: true, mail_ok: true });
+      mockPatchInstanceConfig.mockResolvedValueOnce({});
+
+      await runDeploy({});
+      const err = stripAnsi(captured.err);
+
+      const mailIdx = err.indexOf("Mail sender verified");
+      const dnsIdx = err.indexOf("DNS verified for example.com");
+      const sslIdx = err.indexOf("SSL certificate issued for example.com");
+      expect(mailIdx).toBeGreaterThan(-1);
+      expect(dnsIdx).toBeGreaterThan(-1);
+      expect(sslIdx).toBeGreaterThan(-1);
+      expect(mailIdx).toBeLessThan(dnsIdx);
+      expect(dnsIdx).toBeLessThan(sslIdx);
+    });
+
+    test("DNS verification fails closed when status stays incomplete despite all exposed booleans true (proxy_ok case)", async () => {
+      await linkedProject({
+        instances: { development: "ins_dev_123", production: "ins_prod_123" },
+      });
+      mockIsAgent.mockReturnValue(false);
+      mockLiveProduction({
+        instanceId: "ins_prod_123",
+        developmentConfig: {},
+        productionConfig: {},
+      });
+      // Every poll returns dns/ssl/mail all true but status incomplete (proxy_ok = false on server).
+      mockGetDeployStatus.mockResolvedValue({
+        status: "incomplete",
+        dns_ok: true,
+        ssl_ok: true,
+        mail_ok: true,
+      });
+      mockConfirm.mockResolvedValueOnce(false); // BIND export prompt: skip (wired in Task 5)
+      mockSelect.mockResolvedValueOnce("check").mockResolvedValueOnce("skip");
+
+      await runDeploy({});
+      const err = stripAnsi(captured.err);
+
+      expect(err).toContain("Production setup for example.com is still finalizing.");
+      expect(err).not.toContain("Production ready at");
+    });
+
     test("uses existing wizard framing and concise plan confirmation", async () => {
       await linkedProject();
       mockHumanFlow();

packages/cli-core/src/commands/deploy/index.ts

@@ -25,13 +25,14 @@ import {
   OAUTH_SECTION_INTRO,
   type DeployComponentStatus,
   type DeployPlanStep,
+  DEPLOY_COMPONENT_ORDER,
+  deployComponentLabels,
   deployComponentStatus,
   deployStatusPendingFooter,
   domainAssociationSummary,
   dnsDashboardHandoff,
   dnsIntro,
   dnsRecords,
-  dnsVerified,
   pausedOperationNotice,
   printPlan,
   productionSummary,
@@ -581,7 +582,7 @@ async function runExistingDomainDnsVerification(
 async function runDnsVerification(
   ctx: DeployContext,
   state: DeployOperationState,
-): Promise<DnsVerificationResult> {
+): Promise<DnsVerificationResult | false> {
   const productionInstanceId =
     state.productionInstanceId ?? ctx.productionInstanceId ?? ctx.profile.instances.production;
   if (!productionInstanceId) {
@@ -592,13 +593,10 @@ async function runDnsVerification(
 
   await requestDomainDnsCheck(ctx.appId, state.productionDomainId ?? state.domain);
 
-  const outcome = await withSpinner(`Verifying production setup for ${state.domain}...`, () =>
-    pollDeployStatus(ctx.appId, productionInstanceId),
-  );
+  const outcome = await pollDeployStatus(ctx.appId, productionInstanceId, state.domain);
 
   if (outcome.verified) {
     log.blank();
-    for (const line of dnsVerified(state.domain)) log.success(line);
     log.info(deployComponentStatus(outcome.status));
     return "verified";
   }
@@ -609,6 +607,15 @@ async function runDnsVerification(
   for (const line of deployStatusPendingFooter(state.domain, outcome.status)) {
     log.warn(line);
   }
+
+  // When all DNS components are verified but the server has not yet marked the
+  // deployment complete (proxy_ok or another server-side gate is still pending),
+  // do not offer a retry — the user cannot influence the remaining wait. Fail
+  // closed so the caller exits without reaching finishDeploy.
+  if (outcome.status.dns && outcome.status.ssl && outcome.status.mail) {
+    return false;
+  }
+
   if (state.cnameTargets && state.cnameTargets.length > 0) {
     log.blank();
     for (const line of dnsRecords(state.cnameTargets)) log.info(line);
@@ -630,15 +637,41 @@ type DeployStatusOutcome =
 async function pollDeployStatus(
   appId: string,
   productionInstanceId: string,
+  domain: string,
 ): Promise<DeployStatusOutcome> {
-  let status: DeployComponentStatus = { dns: false, ssl: false, mail: false };
-  for (let attempt = 0; attempt < DEPLOY_STATUS_MAX_POLLS; attempt++) {
-    const result = await mapDeployError(getDeployStatus(appId, productionInstanceId));
-    status = { dns: result.dns_ok, ssl: result.ssl_ok, mail: result.mail_ok };
-    if (result.status === "complete") return { verified: true, status };
-    await sleep(DEPLOY_STATUS_POLL_INTERVAL_MS);
-  }
-  return { verified: false, status };
+  let response = await mapDeployError(getDeployStatus(appId, productionInstanceId));
+  let status: DeployComponentStatus = {
+    dns: response.dns_ok,
+    ssl: response.ssl_ok,
+    mail: response.mail_ok,
+  };
+  let pollsRemaining = DEPLOY_STATUS_MAX_POLLS - 1;
+
+  for (const component of DEPLOY_COMPONENT_ORDER) {
+    const labels = deployComponentLabels(component, domain);
+    const flipped = await withSpinner(labels.progress, async () => {
+      if (status[component]) return true;
+      while (pollsRemaining > 0) {
+        await sleep(DEPLOY_STATUS_POLL_INTERVAL_MS);
+        pollsRemaining--;
+        response = await mapDeployError(getDeployStatus(appId, productionInstanceId));
+        status = {
+          dns: response.dns_ok,
+          ssl: response.ssl_ok,
+          mail: response.mail_ok,
+        };
+        if (status[component]) return true;
+      }
+      return false;
+    });
+    if (!flipped) return { verified: false, status };
+    log.success(labels.done);
+  }
+
+  if (response.status !== "complete") {
+    return { verified: false, status };
+  }
+  return { verified: true, status };
 }
 
 async function requestDomainDnsCheck(appId: string, domainIdOrName: string): Promise<void> {