Advanced: promote to a custom domain

Once your app is authored (see author a platform app), you can promote it to a domain you own instead of the shared /<namespace>/<app> path:

1. DNS - point your domain at the platform edge (a CNAME to the platform's edge CNAME, or an A/AAAA record to a platform edge IP).

2. Descriptor - re-publish your app's descriptor with the domain added:

   "promotion": {
     "domains": ["notes.acme.example"],
     "distSlug": "acme-notes",
     "allowedOrigins": ["https://notes.acme.example"]
   }

   The engine claims the domain for your app the moment it sees the update - a domain already owned by a different app is refused, never hijacked. With in-process TLS enabled, the host proves DNS ownership before issuing (and before every renewal); with a TLS-terminating edge in front, the edge handles the certificate instead.

3. Reach it - https://notes.acme.example/apps/config now vends the same auth-mode-gated session credential your /<namespace>/<app>/config path did.

Cross-host member sign-in

A promoted domain can also accept member sign-in from your main tinkaria account - so a teammate who already has a t.tini.works session can sign into your custom-domain app without a second password. This is a platform-signed redirect handshake between the two hosts; ask your operator whether it's enabled for your namespace, since it requires the promoted-domain subsystem and the platform's SSO wiring to be provisioned together.