@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/domain-provider-vercel.js

@@ -0,0 +1,298 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The Vercel driver — how Aglyn's own hosting registers a name.
+ *
+ * One implementation of the call, one deadline, one never-throws contract. It
+ * was five copies before this file existed: `workspace-domains.ts`, three
+ * console routes and `subdomain-redirect.ts` each held their own `fetch` to
+ * `api.vercel.com`, which is how two copies of a constant drift apart — the
+ * bug AGL-1135 was, one layer down.
+ *
+ * ## The two projects
+ *
+ * The console and the tenant runtime are separate Vercel projects, so the
+ * scope picks the id. One token and one team serve both: a second variable for
+ * the same token is the drift this file exists to prevent.
+ */ import { abortedDetail, domainDeadline, domainStatus, normalizeHost, redirectHostname } from "./domain-provider.js";
+/** Mirrors the app-level canonical redirect: revocable, method-preserving. */ const REDIRECT_STATUS_CODE = 307;
+function settingsFor(scope) {
+    const token = process.env.VERCEL_TOKEN;
+    const projectId = scope === 'tenant' ? process.env.VERCEL_TENANT_PROJECT_ID : process.env.VERCEL_CONSOLE_PROJECT_ID;
+    if (!token || !projectId) return null;
+    return {
+        token,
+        projectId,
+        teamId: process.env.VERCEL_TEAM_ID
+    };
+}
+function query(teamId) {
+    return teamId ? `?teamId=${encodeURIComponent(teamId)}` : '';
+}
+function authHeaders(settings) {
+    return {
+        Authorization: `Bearer ${settings.token}`
+    };
+}
+/**
+ * Attach one fully-qualified name to the scope's project.
+ *
+ * Idempotent: Vercel answers `domain_already_in_use` when the name is already
+ * on the project, which is success for our purposes — the reconcile script and
+ * the create path can both run without coordinating.
+ *
+ * ⚠️ Tolerating `domain_already_in_use` is only safe while **every** name this
+ * is asked to attach is also claimed in Firestore. Without that, a second org
+ * attaches a name someone else already holds, reads `already-exists` as
+ * success, and gets a console that looks healthy while its visitors are served
+ * — or redirected — somewhere else. That is the AGL-743 shape, and
+ * `console-domains.ts` is where the claim is kept in step.
+ */ async function attach(scope, name, options = {}) {
+    const domain = normalizeHost(name);
+    const settings = settingsFor(scope);
+    if (!settings || !domain) return {
+        outcome: 'skipped',
+        domain
+    };
+    const redirect = options.redirectTo ? redirectHostname(options.redirectTo) : null;
+    if (options.redirectTo && !redirect) {
+        console.error('[domain-provider:vercel] refusing a non-hostname redirect', options.redirectTo);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: 'invalid-redirect'
+        };
+    }
+    const body = redirect ? {
+        name: domain,
+        redirect,
+        redirectStatusCode: REDIRECT_STATUS_CODE
+    } : {
+        name: domain
+    };
+    try {
+        var _ref;
+        var _payload_error;
+        const response = await fetch(`https://api.vercel.com/v10/projects/${settings.projectId}/domains${query(settings.teamId)}`, {
+            method: 'POST',
+            headers: _extends({}, authHeaders(settings), {
+                'Content-Type': 'application/json'
+            }),
+            body: JSON.stringify(body),
+            signal: domainDeadline()
+        });
+        if (response.ok) return {
+            outcome: 'attached',
+            domain
+        };
+        const payload = await response.json().catch(()=>null);
+        const code = String((_ref = payload == null ? void 0 : (_payload_error = payload.error) == null ? void 0 : _payload_error.code) != null ? _ref : '');
+        if (code === 'domain_already_in_use' || response.status === 409) {
+            // An entry that already exists still has to CARRY the redirect, or the
+            // twin quietly serves the console instead of forwarding to the primary.
+            if (redirect) return patchRedirect(settings, domain, redirect);
+            return {
+                outcome: 'already-exists',
+                domain
+            };
+        }
+        console.error('[domain-provider:vercel] attach failed', domain, code);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: code || String(response.status)
+        };
+    } catch (error) {
+        console.error('[domain-provider:vercel] attach threw', domain, error);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: abortedDetail(error)
+        };
+    }
+}
+/** Point an already-attached name at `redirect`. Same never-throws contract. */ async function patchRedirect(settings, domain, redirect) {
+    try {
+        const response = await fetch(`https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${query(settings.teamId)}`, {
+            method: 'PATCH',
+            headers: _extends({}, authHeaders(settings), {
+                'Content-Type': 'application/json'
+            }),
+            body: JSON.stringify({
+                redirect,
+                redirectStatusCode: REDIRECT_STATUS_CODE
+            }),
+            signal: domainDeadline()
+        });
+        if (response.ok) return {
+            outcome: 'already-exists',
+            domain
+        };
+        console.error('[domain-provider:vercel] redirect patch failed', domain, response.status);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: String(response.status)
+        };
+    } catch (error) {
+        console.error('[domain-provider:vercel] redirect patch threw', domain, error);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: abortedDetail(error)
+        };
+    }
+}
+async function detach(scope, name) {
+    const domain = normalizeHost(name);
+    const settings = settingsFor(scope);
+    if (!settings || !domain) return {
+        outcome: 'skipped',
+        domain
+    };
+    try {
+        const response = await fetch(`https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${query(settings.teamId)}`, {
+            method: 'DELETE',
+            headers: authHeaders(settings),
+            signal: domainDeadline()
+        });
+        if (response.ok) return {
+            outcome: 'detached',
+            domain
+        };
+        if (response.status === 404) return {
+            outcome: 'not-found',
+            domain
+        };
+        console.error('[domain-provider:vercel] detach failed', domain, response.status);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: String(response.status)
+        };
+    } catch (error) {
+        console.error('[domain-provider:vercel] detach threw', domain, error);
+        return {
+            outcome: 'failed',
+            domain,
+            detail: abortedDetail(error)
+        };
+    }
+}
+/** Whether any issued certificate's names cover `domain`, wildcards included. */ function certificateCovers(cns, domain) {
+    if (!Array.isArray(cns)) return false;
+    const parent = domain.split('.').slice(1).join('.');
+    return cns.some((name)=>{
+        const cn = normalizeHost(String(name != null ? name : ''));
+        return cn === domain || cn.startsWith('*.') && cn.slice(2) === parent;
+    });
+}
+/**
+ * What a name is ACTUALLY doing on the project, right now.
+ *
+ * `attach` answers "did the POST succeed", which is a different question and a
+ * much weaker one. A domain can be on the project and still serve nothing:
+ * Vercel accepts the name, then withholds routing and the certificate until
+ * ownership is proven (when the apex is registered to another Vercel account)
+ * or until DNS actually points here. Both states return a successful POST.
+ *
+ * That is the gap this closes (AGL-1913): the site custom-domain wizard
+ * reported `attached: true` off the POST alone, so "certificate is still
+ * issuing" and "this will never work" rendered as the same green chip.
+ *
+ * Three reads, cheapest first, each of which can end the walk:
+ *
+ *  1. `GET /v9/projects/{project}/domains/{name}` — 404 means the name is not
+ *     on this project at all, and `verified: false` means Vercel is holding it
+ *     pending the `verification` challenge it returns alongside.
+ *  2. `GET /v6/domains/{name}/config` — the platform's own DNS check.
+ *     `misconfigured` is authoritative in a way our resolver check is not, and
+ *     `conflicts` names the records answering for the domain that are NOT ours
+ *     — the stale-A-record-shadowing-an-ALIAS case, reported rather than
+ *     inferred.
+ *  3. `GET /v5/certs?domain={name}` — whether a certificate covers the name
+ *     yet. Only consulted once the first two are clean, and a FAILED cert read
+ *     reports `serving` rather than inventing a problem: an unreachable certs
+ *     API must never turn a healthy domain amber.
+ */ async function status(scope, name) {
+    const domain = normalizeHost(name);
+    const settings = settingsFor(scope);
+    if (!settings || !domain) return domainStatus(domain, 'skipped');
+    const headers = authHeaders(settings);
+    const team = query(settings.teamId);
+    try {
+        const attached = await fetch(`https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${team}`, {
+            headers,
+            signal: domainDeadline()
+        });
+        if (attached.status === 404) return domainStatus(domain, 'not-attached');
+        if (!attached.ok) {
+            return domainStatus(domain, 'unknown', {
+                detail: String(attached.status)
+            });
+        }
+        const payload = await attached.json().catch(()=>null);
+        if ((payload == null ? void 0 : payload.verified) === false) {
+            return domainStatus(domain, 'ownership-pending', {
+                verification: Array.isArray(payload == null ? void 0 : payload.verification) ? payload.verification : []
+            });
+        }
+        const configured = await fetch(`https://api.vercel.com/v6/domains/${encodeURIComponent(domain)}/config${team}`, {
+            headers,
+            signal: domainDeadline()
+        });
+        if (!configured.ok) {
+            return domainStatus(domain, 'unknown', {
+                detail: String(configured.status)
+            });
+        }
+        const dns = await configured.json().catch(()=>null);
+        const conflicts = Array.isArray(dns == null ? void 0 : dns.conflicts) ? dns.conflicts : [];
+        if ((dns == null ? void 0 : dns.misconfigured) === true) {
+            return domainStatus(domain, 'dns-misconfigured', {
+                conflicts
+            });
+        }
+        const certs = await fetch(`https://api.vercel.com/v5/certs?domain=${encodeURIComponent(domain)}${settings.teamId ? `&teamId=${encodeURIComponent(settings.teamId)}` : ''}`, {
+            headers,
+            signal: domainDeadline()
+        });
+        // A certs read that did not answer must not turn a healthy domain amber.
+        if (!certs.ok) return domainStatus(domain, 'serving', {
+            conflicts
+        });
+        const issued = await certs.json().catch(()=>null);
+        const covered = Array.isArray(issued == null ? void 0 : issued.certs) && issued.certs.some((cert)=>certificateCovers(cert == null ? void 0 : cert.cns, domain));
+        return domainStatus(domain, covered ? 'serving' : 'certificate-pending', {
+            conflicts
+        });
+    } catch (error) {
+        console.error('[domain-provider:vercel] status threw', domain, error);
+        return domainStatus(domain, 'unknown', {
+            detail: abortedDetail(error)
+        });
+    }
+}
+export const VERCEL_DOMAIN_PROVIDER = {
+    id: 'vercel',
+    configured: (scope)=>settingsFor(scope) !== null,
+    attach,
+    detach,
+    status
+};
+
+//# sourceMappingURL=domain-provider-vercel.js.map

package/src/lib/server/domain-provider-vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/domain-provider-vercel.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Vercel driver — how Aglyn's own hosting registers a name.\n *\n * One implementation of the call, one deadline, one never-throws contract. It\n * was five copies before this file existed: `workspace-domains.ts`, three\n * console routes and `subdomain-redirect.ts` each held their own `fetch` to\n * `api.vercel.com`, which is how two copies of a constant drift apart — the\n * bug AGL-1135 was, one layer down.\n *\n * ## The two projects\n *\n * The console and the tenant runtime are separate Vercel projects, so the\n * scope picks the id. One token and one team serve both: a second variable for\n * the same token is the drift this file exists to prevent.\n */\n\nimport {\n  abortedDetail,\n  domainDeadline,\n  domainStatus,\n  normalizeHost,\n  redirectHostname,\n  type DomainAttachOptions,\n  type DomainProvider,\n  type DomainResult,\n  type DomainScope,\n  type ProjectDomainStatus,\n} from './domain-provider'\n\n/** Mirrors the app-level canonical redirect: revocable, method-preserving. */\nconst REDIRECT_STATUS_CODE = 307\n\ninterface VercelSettings {\n  token: string\n  projectId: string\n  teamId?: string\n}\n\nfunction settingsFor(scope: DomainScope): VercelSettings | null {\n  const token = process.env.VERCEL_TOKEN\n  const projectId =\n    scope === 'tenant'\n      ? process.env.VERCEL_TENANT_PROJECT_ID\n      : process.env.VERCEL_CONSOLE_PROJECT_ID\n  if (!token || !projectId) return null\n  return { token, projectId, teamId: process.env.VERCEL_TEAM_ID }\n}\n\nfunction query(teamId?: string): string {\n  return teamId ? `?teamId=${encodeURIComponent(teamId)}` : ''\n}\n\nfunction authHeaders(settings: VercelSettings): Record<string, string> {\n  return { Authorization: `Bearer ${settings.token}` }\n}\n\n/**\n * Attach one fully-qualified name to the scope's project.\n *\n * Idempotent: Vercel answers `domain_already_in_use` when the name is already\n * on the project, which is success for our purposes — the reconcile script and\n * the create path can both run without coordinating.\n *\n * ⚠️ Tolerating `domain_already_in_use` is only safe while **every** name this\n * is asked to attach is also claimed in Firestore. Without that, a second org\n * attaches a name someone else already holds, reads `already-exists` as\n * success, and gets a console that looks healthy while its visitors are served\n * — or redirected — somewhere else. That is the AGL-743 shape, and\n * `console-domains.ts` is where the claim is kept in step.\n */\nasync function attach(\n  scope: DomainScope,\n  name: string,\n  options: DomainAttachOptions = {},\n): Promise<DomainResult> {\n  const domain = normalizeHost(name)\n  const settings = settingsFor(scope)\n  if (!settings || !domain) return { outcome: 'skipped', domain }\n\n  const redirect = options.redirectTo\n    ? redirectHostname(options.redirectTo)\n    : null\n  if (options.redirectTo && !redirect) {\n    console.error('[domain-provider:vercel] refusing a non-hostname redirect', options.redirectTo)\n    return { outcome: 'failed', domain, detail: 'invalid-redirect' }\n  }\n  const body = redirect\n    ? { name: domain, redirect, redirectStatusCode: REDIRECT_STATUS_CODE }\n    : { name: domain }\n\n  try {\n    const response = await fetch(\n      `https://api.vercel.com/v10/projects/${settings.projectId}/domains${query(settings.teamId)}`,\n      {\n        method: 'POST',\n        headers: { ...authHeaders(settings), 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n        signal: domainDeadline(),\n      },\n    )\n    if (response.ok) return { outcome: 'attached', domain }\n    const payload = await response.json().catch(() => null)\n    const code = String(payload?.error?.code ?? '')\n    if (code === 'domain_already_in_use' || response.status === 409) {\n      // An entry that already exists still has to CARRY the redirect, or the\n      // twin quietly serves the console instead of forwarding to the primary.\n      if (redirect) return patchRedirect(settings, domain, redirect)\n      return { outcome: 'already-exists', domain }\n    }\n    console.error('[domain-provider:vercel] attach failed', domain, code)\n    return { outcome: 'failed', domain, detail: code || String(response.status) }\n  } catch (error) {\n    console.error('[domain-provider:vercel] attach threw', domain, error)\n    return { outcome: 'failed', domain, detail: abortedDetail(error) }\n  }\n}\n\n/** Point an already-attached name at `redirect`. Same never-throws contract. */\nasync function patchRedirect(\n  settings: VercelSettings,\n  domain: string,\n  redirect: string,\n): Promise<DomainResult> {\n  try {\n    const response = await fetch(\n      `https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${query(settings.teamId)}`,\n      {\n        method: 'PATCH',\n        headers: { ...authHeaders(settings), 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          redirect,\n          redirectStatusCode: REDIRECT_STATUS_CODE,\n        }),\n        signal: domainDeadline(),\n      },\n    )\n    if (response.ok) return { outcome: 'already-exists', domain }\n    console.error('[domain-provider:vercel] redirect patch failed', domain, response.status)\n    return { outcome: 'failed', domain, detail: String(response.status) }\n  } catch (error) {\n    console.error('[domain-provider:vercel] redirect patch threw', domain, error)\n    return { outcome: 'failed', domain, detail: abortedDetail(error) }\n  }\n}\n\nasync function detach(\n  scope: DomainScope,\n  name: string,\n): Promise<DomainResult> {\n  const domain = normalizeHost(name)\n  const settings = settingsFor(scope)\n  if (!settings || !domain) return { outcome: 'skipped', domain }\n  try {\n    const response = await fetch(\n      `https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${query(settings.teamId)}`,\n      {\n        method: 'DELETE',\n        headers: authHeaders(settings),\n        signal: domainDeadline(),\n      },\n    )\n    if (response.ok) return { outcome: 'detached', domain }\n    if (response.status === 404) return { outcome: 'not-found', domain }\n    console.error('[domain-provider:vercel] detach failed', domain, response.status)\n    return { outcome: 'failed', domain, detail: String(response.status) }\n  } catch (error) {\n    console.error('[domain-provider:vercel] detach threw', domain, error)\n    return { outcome: 'failed', domain, detail: abortedDetail(error) }\n  }\n}\n\n/** Whether any issued certificate's names cover `domain`, wildcards included. */\nfunction certificateCovers(cns: unknown, domain: string): boolean {\n  if (!Array.isArray(cns)) return false\n  const parent = domain.split('.').slice(1).join('.')\n  return cns.some((name) => {\n    const cn = normalizeHost(String(name ?? ''))\n    return cn === domain || (cn.startsWith('*.') && cn.slice(2) === parent)\n  })\n}\n\n/**\n * What a name is ACTUALLY doing on the project, right now.\n *\n * `attach` answers \"did the POST succeed\", which is a different question and a\n * much weaker one. A domain can be on the project and still serve nothing:\n * Vercel accepts the name, then withholds routing and the certificate until\n * ownership is proven (when the apex is registered to another Vercel account)\n * or until DNS actually points here. Both states return a successful POST.\n *\n * That is the gap this closes (AGL-1913): the site custom-domain wizard\n * reported `attached: true` off the POST alone, so \"certificate is still\n * issuing\" and \"this will never work\" rendered as the same green chip.\n *\n * Three reads, cheapest first, each of which can end the walk:\n *\n *  1. `GET /v9/projects/{project}/domains/{name}` — 404 means the name is not\n *     on this project at all, and `verified: false` means Vercel is holding it\n *     pending the `verification` challenge it returns alongside.\n *  2. `GET /v6/domains/{name}/config` — the platform's own DNS check.\n *     `misconfigured` is authoritative in a way our resolver check is not, and\n *     `conflicts` names the records answering for the domain that are NOT ours\n *     — the stale-A-record-shadowing-an-ALIAS case, reported rather than\n *     inferred.\n *  3. `GET /v5/certs?domain={name}` — whether a certificate covers the name\n *     yet. Only consulted once the first two are clean, and a FAILED cert read\n *     reports `serving` rather than inventing a problem: an unreachable certs\n *     API must never turn a healthy domain amber.\n */\nasync function status(\n  scope: DomainScope,\n  name: string,\n): Promise<ProjectDomainStatus> {\n  const domain = normalizeHost(name)\n  const settings = settingsFor(scope)\n  if (!settings || !domain) return domainStatus(domain, 'skipped')\n  const headers = authHeaders(settings)\n  const team = query(settings.teamId)\n\n  try {\n    const attached = await fetch(\n      `https://api.vercel.com/v9/projects/${settings.projectId}/domains/${encodeURIComponent(domain)}${team}`,\n      { headers, signal: domainDeadline() },\n    )\n    if (attached.status === 404) return domainStatus(domain, 'not-attached')\n    if (!attached.ok) {\n      return domainStatus(domain, 'unknown', { detail: String(attached.status) })\n    }\n    const payload = await attached.json().catch(() => null)\n    if (payload?.verified === false) {\n      return domainStatus(domain, 'ownership-pending', {\n        verification: Array.isArray(payload?.verification)\n          ? payload.verification\n          : [],\n      })\n    }\n\n    const configured = await fetch(\n      `https://api.vercel.com/v6/domains/${encodeURIComponent(domain)}/config${team}`,\n      { headers, signal: domainDeadline() },\n    )\n    if (!configured.ok) {\n      return domainStatus(domain, 'unknown', { detail: String(configured.status) })\n    }\n    const dns = await configured.json().catch(() => null)\n    const conflicts = Array.isArray(dns?.conflicts) ? dns.conflicts : []\n    if (dns?.misconfigured === true) {\n      return domainStatus(domain, 'dns-misconfigured', { conflicts })\n    }\n\n    const certs = await fetch(\n      `https://api.vercel.com/v5/certs?domain=${encodeURIComponent(domain)}${\n        settings.teamId ? `&teamId=${encodeURIComponent(settings.teamId)}` : ''\n      }`,\n      { headers, signal: domainDeadline() },\n    )\n    // A certs read that did not answer must not turn a healthy domain amber.\n    if (!certs.ok) return domainStatus(domain, 'serving', { conflicts })\n    const issued = await certs.json().catch(() => null)\n    const covered =\n      Array.isArray(issued?.certs) &&\n      issued.certs.some((cert: { cns?: unknown }) =>\n        certificateCovers(cert?.cns, domain),\n      )\n    return domainStatus(domain, covered ? 'serving' : 'certificate-pending', {\n      conflicts,\n    })\n  } catch (error) {\n    console.error('[domain-provider:vercel] status threw', domain, error)\n    return domainStatus(domain, 'unknown', { detail: abortedDetail(error) })\n  }\n}\n\nexport const VERCEL_DOMAIN_PROVIDER: DomainProvider = {\n  id: 'vercel',\n  configured: (scope) => settingsFor(scope) !== null,\n  attach,\n  detach,\n  status,\n}\n"],"names":["abortedDetail","domainDeadline","domainStatus","normalizeHost","redirectHostname","REDIRECT_STATUS_CODE","settingsFor","scope","token","process","env","VERCEL_TOKEN","projectId","VERCEL_TENANT_PROJECT_ID","VERCEL_CONSOLE_PROJECT_ID","teamId","VERCEL_TEAM_ID","query","encodeURIComponent","authHeaders","settings","Authorization","attach","name","options","domain","outcome","redirect","redirectTo","console","error","detail","body","redirectStatusCode","payload","response","fetch","method","headers","JSON","stringify","signal","ok","json","catch","code","String","status","patchRedirect","detach","certificateCovers","cns","Array","isArray","parent","split","slice","join","some","cn","startsWith","team","attached","verified","verification","configured","dns","conflicts","misconfigured","certs","issued","covered","cert","VERCEL_DOMAIN_PROVIDER","id"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;CAcC,GAED,SACEA,aAAa,EACbC,cAAc,EACdC,YAAY,EACZC,aAAa,EACbC,gBAAgB,QAMX,uBAAmB;AAE1B,4EAA4E,GAC5E,MAAMC,uBAAuB;AAQ7B,SAASC,YAAYC,KAAkB;IACrC,MAAMC,QAAQC,QAAQC,GAAG,CAACC,YAAY;IACtC,MAAMC,YACJL,UAAU,WACNE,QAAQC,GAAG,CAACG,wBAAwB,GACpCJ,QAAQC,GAAG,CAACI,yBAAyB;IAC3C,IAAI,CAACN,SAAS,CAACI,WAAW,OAAO;IACjC,OAAO;QAAEJ;QAAOI;QAAWG,QAAQN,QAAQC,GAAG,CAACM,cAAc;IAAC;AAChE;AAEA,SAASC,MAAMF,MAAe;IAC5B,OAAOA,SAAS,CAAC,QAAQ,EAAEG,mBAAmBH,SAAS,GAAG;AAC5D;AAEA,SAASI,YAAYC,QAAwB;IAC3C,OAAO;QAAEC,eAAe,CAAC,OAAO,EAAED,SAASZ,KAAK,EAAE;IAAC;AACrD;AAEA;;;;;;;;;;;;;CAaC,GACD,eAAec,OACbf,KAAkB,EAClBgB,IAAY,EACZC,UAA+B,CAAC,CAAC;IAEjC,MAAMC,SAAStB,cAAcoB;IAC7B,MAAMH,WAAWd,YAAYC;IAC7B,IAAI,CAACa,YAAY,CAACK,QAAQ,OAAO;QAAEC,SAAS;QAAWD;IAAO;IAE9D,MAAME,WAAWH,QAAQI,UAAU,GAC/BxB,iBAAiBoB,QAAQI,UAAU,IACnC;IACJ,IAAIJ,QAAQI,UAAU,IAAI,CAACD,UAAU;QACnCE,QAAQC,KAAK,CAAC,6DAA6DN,QAAQI,UAAU;QAC7F,OAAO;YAAEF,SAAS;YAAUD;YAAQM,QAAQ;QAAmB;IACjE;IACA,MAAMC,OAAOL,WACT;QAAEJ,MAAME;QAAQE;QAAUM,oBAAoB5B;IAAqB,IACnE;QAAEkB,MAAME;IAAO;IAEnB,IAAI;;YAYkBS;QAXpB,MAAMC,WAAW,MAAMC,MACrB,CAAC,oCAAoC,EAAEhB,SAASR,SAAS,CAAC,QAAQ,EAAEK,MAAMG,SAASL,MAAM,GAAG,EAC5F;YACEsB,QAAQ;YACRC,SAAS,aAAKnB,YAAYC;gBAAW,gBAAgB;;YACrDY,MAAMO,KAAKC,SAAS,CAACR;YACrBS,QAAQxC;QACV;QAEF,IAAIkC,SAASO,EAAE,EAAE,OAAO;YAAEhB,SAAS;YAAYD;QAAO;QACtD,MAAMS,UAAU,MAAMC,SAASQ,IAAI,GAAGC,KAAK,CAAC,IAAM;QAClD,MAAMC,OAAOC,eAAOZ,4BAAAA,iBAAAA,QAASJ,KAAK,qBAAdI,eAAgBW,IAAI,mBAAI;QAC5C,IAAIA,SAAS,2BAA2BV,SAASY,MAAM,KAAK,KAAK;YAC/D,uEAAuE;YACvE,wEAAwE;YACxE,IAAIpB,UAAU,OAAOqB,cAAc5B,UAAUK,QAAQE;YACrD,OAAO;gBAAED,SAAS;gBAAkBD;YAAO;QAC7C;QACAI,QAAQC,KAAK,CAAC,0CAA0CL,QAAQoB;QAChE,OAAO;YAAEnB,SAAS;YAAUD;YAAQM,QAAQc,QAAQC,OAAOX,SAASY,MAAM;QAAE;IAC9E,EAAE,OAAOjB,OAAO;QACdD,QAAQC,KAAK,CAAC,yCAAyCL,QAAQK;QAC/D,OAAO;YAAEJ,SAAS;YAAUD;YAAQM,QAAQ/B,cAAc8B;QAAO;IACnE;AACF;AAEA,8EAA8E,GAC9E,eAAekB,cACb5B,QAAwB,EACxBK,MAAc,EACdE,QAAgB;IAEhB,IAAI;QACF,MAAMQ,WAAW,MAAMC,MACrB,CAAC,mCAAmC,EAAEhB,SAASR,SAAS,CAAC,SAAS,EAAEM,mBAAmBO,UAAUR,MAAMG,SAASL,MAAM,GAAG,EACzH;YACEsB,QAAQ;YACRC,SAAS,aAAKnB,YAAYC;gBAAW,gBAAgB;;YACrDY,MAAMO,KAAKC,SAAS,CAAC;gBACnBb;gBACAM,oBAAoB5B;YACtB;YACAoC,QAAQxC;QACV;QAEF,IAAIkC,SAASO,EAAE,EAAE,OAAO;YAAEhB,SAAS;YAAkBD;QAAO;QAC5DI,QAAQC,KAAK,CAAC,kDAAkDL,QAAQU,SAASY,MAAM;QACvF,OAAO;YAAErB,SAAS;YAAUD;YAAQM,QAAQe,OAAOX,SAASY,MAAM;QAAE;IACtE,EAAE,OAAOjB,OAAO;QACdD,QAAQC,KAAK,CAAC,iDAAiDL,QAAQK;QACvE,OAAO;YAAEJ,SAAS;YAAUD;YAAQM,QAAQ/B,cAAc8B;QAAO;IACnE;AACF;AAEA,eAAemB,OACb1C,KAAkB,EAClBgB,IAAY;IAEZ,MAAME,SAAStB,cAAcoB;IAC7B,MAAMH,WAAWd,YAAYC;IAC7B,IAAI,CAACa,YAAY,CAACK,QAAQ,OAAO;QAAEC,SAAS;QAAWD;IAAO;IAC9D,IAAI;QACF,MAAMU,WAAW,MAAMC,MACrB,CAAC,mCAAmC,EAAEhB,SAASR,SAAS,CAAC,SAAS,EAAEM,mBAAmBO,UAAUR,MAAMG,SAASL,MAAM,GAAG,EACzH;YACEsB,QAAQ;YACRC,SAASnB,YAAYC;YACrBqB,QAAQxC;QACV;QAEF,IAAIkC,SAASO,EAAE,EAAE,OAAO;YAAEhB,SAAS;YAAYD;QAAO;QACtD,IAAIU,SAASY,MAAM,KAAK,KAAK,OAAO;YAAErB,SAAS;YAAaD;QAAO;QACnEI,QAAQC,KAAK,CAAC,0CAA0CL,QAAQU,SAASY,MAAM;QAC/E,OAAO;YAAErB,SAAS;YAAUD;YAAQM,QAAQe,OAAOX,SAASY,MAAM;QAAE;IACtE,EAAE,OAAOjB,OAAO;QACdD,QAAQC,KAAK,CAAC,yCAAyCL,QAAQK;QAC/D,OAAO;YAAEJ,SAAS;YAAUD;YAAQM,QAAQ/B,cAAc8B;QAAO;IACnE;AACF;AAEA,+EAA+E,GAC/E,SAASoB,kBAAkBC,GAAY,EAAE1B,MAAc;IACrD,IAAI,CAAC2B,MAAMC,OAAO,CAACF,MAAM,OAAO;IAChC,MAAMG,SAAS7B,OAAO8B,KAAK,CAAC,KAAKC,KAAK,CAAC,GAAGC,IAAI,CAAC;IAC/C,OAAON,IAAIO,IAAI,CAAC,CAACnC;QACf,MAAMoC,KAAKxD,cAAc2C,OAAOvB,eAAAA,OAAQ;QACxC,OAAOoC,OAAOlC,UAAWkC,GAAGC,UAAU,CAAC,SAASD,GAAGH,KAAK,CAAC,OAAOF;IAClE;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GACD,eAAeP,OACbxC,KAAkB,EAClBgB,IAAY;IAEZ,MAAME,SAAStB,cAAcoB;IAC7B,MAAMH,WAAWd,YAAYC;IAC7B,IAAI,CAACa,YAAY,CAACK,QAAQ,OAAOvB,aAAauB,QAAQ;IACtD,MAAMa,UAAUnB,YAAYC;IAC5B,MAAMyC,OAAO5C,MAAMG,SAASL,MAAM;IAElC,IAAI;QACF,MAAM+C,WAAW,MAAM1B,MACrB,CAAC,mCAAmC,EAAEhB,SAASR,SAAS,CAAC,SAAS,EAAEM,mBAAmBO,UAAUoC,MAAM,EACvG;YAAEvB;YAASG,QAAQxC;QAAiB;QAEtC,IAAI6D,SAASf,MAAM,KAAK,KAAK,OAAO7C,aAAauB,QAAQ;QACzD,IAAI,CAACqC,SAASpB,EAAE,EAAE;YAChB,OAAOxC,aAAauB,QAAQ,WAAW;gBAAEM,QAAQe,OAAOgB,SAASf,MAAM;YAAE;QAC3E;QACA,MAAMb,UAAU,MAAM4B,SAASnB,IAAI,GAAGC,KAAK,CAAC,IAAM;QAClD,IAAIV,CAAAA,2BAAAA,QAAS6B,QAAQ,MAAK,OAAO;YAC/B,OAAO7D,aAAauB,QAAQ,qBAAqB;gBAC/CuC,cAAcZ,MAAMC,OAAO,CAACnB,2BAAAA,QAAS8B,YAAY,IAC7C9B,QAAQ8B,YAAY,GACpB,EAAE;YACR;QACF;QAEA,MAAMC,aAAa,MAAM7B,MACvB,CAAC,kCAAkC,EAAElB,mBAAmBO,QAAQ,OAAO,EAAEoC,MAAM,EAC/E;YAAEvB;YAASG,QAAQxC;QAAiB;QAEtC,IAAI,CAACgE,WAAWvB,EAAE,EAAE;YAClB,OAAOxC,aAAauB,QAAQ,WAAW;gBAAEM,QAAQe,OAAOmB,WAAWlB,MAAM;YAAE;QAC7E;QACA,MAAMmB,MAAM,MAAMD,WAAWtB,IAAI,GAAGC,KAAK,CAAC,IAAM;QAChD,MAAMuB,YAAYf,MAAMC,OAAO,CAACa,uBAAAA,IAAKC,SAAS,IAAID,IAAIC,SAAS,GAAG,EAAE;QACpE,IAAID,CAAAA,uBAAAA,IAAKE,aAAa,MAAK,MAAM;YAC/B,OAAOlE,aAAauB,QAAQ,qBAAqB;gBAAE0C;YAAU;QAC/D;QAEA,MAAME,QAAQ,MAAMjC,MAClB,CAAC,uCAAuC,EAAElB,mBAAmBO,UAC3DL,SAASL,MAAM,GAAG,CAAC,QAAQ,EAAEG,mBAAmBE,SAASL,MAAM,GAAG,GAAG,IACrE,EACF;YAAEuB;YAASG,QAAQxC;QAAiB;QAEtC,yEAAyE;QACzE,IAAI,CAACoE,MAAM3B,EAAE,EAAE,OAAOxC,aAAauB,QAAQ,WAAW;YAAE0C;QAAU;QAClE,MAAMG,SAAS,MAAMD,MAAM1B,IAAI,GAAGC,KAAK,CAAC,IAAM;QAC9C,MAAM2B,UACJnB,MAAMC,OAAO,CAACiB,0BAAAA,OAAQD,KAAK,KAC3BC,OAAOD,KAAK,CAACX,IAAI,CAAC,CAACc,OACjBtB,kBAAkBsB,wBAAAA,KAAMrB,GAAG,EAAE1B;QAEjC,OAAOvB,aAAauB,QAAQ8C,UAAU,YAAY,uBAAuB;YACvEJ;QACF;IACF,EAAE,OAAOrC,OAAO;QACdD,QAAQC,KAAK,CAAC,yCAAyCL,QAAQK;QAC/D,OAAO5B,aAAauB,QAAQ,WAAW;YAAEM,QAAQ/B,cAAc8B;QAAO;IACxE;AACF;AAEA,OAAO,MAAM2C,yBAAyC;IACpDC,IAAI;IACJT,YAAY,CAAC1D,QAAUD,YAAYC,WAAW;IAC9Ce;IACA2B;IACAF;AACF,EAAC"}

package/src/lib/server/domain-provider-webhook.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The webhook driver — the layer an operator supplies.
+ *
+ * Aglyn asks one endpoint the three questions in the provider contract and
+ * takes its word for the answer. What is on the other side is entirely the
+ * operator's business: Caddy's admin API, a Traefik dynamic-config file, a
+ * cert-manager `Certificate`, a registrar's API, or twenty lines of shell.
+ *
+ * This is the extension point rather than a module path the app imports,
+ * because a module path does not survive the product. Both apps are bundled by
+ * Next, so a path resolved at runtime is not in the bundle, and an operator
+ * running the published image has no build step in which to add one. A webhook
+ * needs no rebuild and works from the shipped image unchanged.
+ *
+ * ## The wire format
+ *
+ * `POST $AGLYN_DOMAIN_WEBHOOK_URL`, `Content-Type: application/json`, and
+ * `Authorization: Bearer $AGLYN_DOMAIN_WEBHOOK_TOKEN` when that is set:
+ *
+ * ```json
+ * { "action": "attach", "scope": "tenant", "domain": "shop.acme.com",
+ *   "redirectTo": "acme.com" }
+ * ```
+ *
+ * `action` is `attach`, `detach` or `status`. `scope` says which app should
+ * answer for the name — `console` for the admin app and its workspace
+ * subdomains, `tenant` for published sites. `redirectTo` appears only when the
+ * name should forward rather than serve, and is always a bare hostname.
+ *
+ * Answer `200` with either an outcome:
+ *
+ * ```json
+ * { "outcome": "attached", "detail": "added to caddy" }
+ * ```
+ *
+ * or, for `status`, a state:
+ *
+ * ```json
+ * { "state": "ownership-pending",
+ *   "verification": [{ "type": "TXT", "domain": "_acme-challenge.shop.acme.com",
+ *                      "value": "…" }] }
+ * ```
+ *
+ * ## What Aglyn does with a bad answer
+ *
+ * An unrecognized `outcome` is `failed` and an unrecognized `state` is
+ * `unknown`, both logged with what arrived. A typo must not read as success —
+ * an endpoint that answers `{"outcome":"attach"}` has registered nothing, and
+ * accepting it would leave a workspace advertising a URL that resolves
+ * nowhere.
+ *
+ * ⚠️ Send this to a service on your own network. The request carries the
+ * bearer token and the names of your customers' domains, and the reply decides
+ * whether the console tells someone their site is live.
+ */
+import { type DomainProvider } from './domain-provider';
+export declare function webhookDomainProvider(): DomainProvider;

package/src/lib/server/domain-provider-webhook.js

@@ -0,0 +1,223 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The webhook driver — the layer an operator supplies.
+ *
+ * Aglyn asks one endpoint the three questions in the provider contract and
+ * takes its word for the answer. What is on the other side is entirely the
+ * operator's business: Caddy's admin API, a Traefik dynamic-config file, a
+ * cert-manager `Certificate`, a registrar's API, or twenty lines of shell.
+ *
+ * This is the extension point rather than a module path the app imports,
+ * because a module path does not survive the product. Both apps are bundled by
+ * Next, so a path resolved at runtime is not in the bundle, and an operator
+ * running the published image has no build step in which to add one. A webhook
+ * needs no rebuild and works from the shipped image unchanged.
+ *
+ * ## The wire format
+ *
+ * `POST $AGLYN_DOMAIN_WEBHOOK_URL`, `Content-Type: application/json`, and
+ * `Authorization: Bearer $AGLYN_DOMAIN_WEBHOOK_TOKEN` when that is set:
+ *
+ * ```json
+ * { "action": "attach", "scope": "tenant", "domain": "shop.acme.com",
+ *   "redirectTo": "acme.com" }
+ * ```
+ *
+ * `action` is `attach`, `detach` or `status`. `scope` says which app should
+ * answer for the name — `console` for the admin app and its workspace
+ * subdomains, `tenant` for published sites. `redirectTo` appears only when the
+ * name should forward rather than serve, and is always a bare hostname.
+ *
+ * Answer `200` with either an outcome:
+ *
+ * ```json
+ * { "outcome": "attached", "detail": "added to caddy" }
+ * ```
+ *
+ * or, for `status`, a state:
+ *
+ * ```json
+ * { "state": "ownership-pending",
+ *   "verification": [{ "type": "TXT", "domain": "_acme-challenge.shop.acme.com",
+ *                      "value": "…" }] }
+ * ```
+ *
+ * ## What Aglyn does with a bad answer
+ *
+ * An unrecognized `outcome` is `failed` and an unrecognized `state` is
+ * `unknown`, both logged with what arrived. A typo must not read as success —
+ * an endpoint that answers `{"outcome":"attach"}` has registered nothing, and
+ * accepting it would leave a workspace advertising a URL that resolves
+ * nowhere.
+ *
+ * ⚠️ Send this to a service on your own network. The request carries the
+ * bearer token and the names of your customers' domains, and the reply decides
+ * whether the console tells someone their site is live.
+ */ import { abortedDetail, domainDeadline, domainStatus, normalizeHost, redirectHostname } from "./domain-provider.js";
+const OUTCOMES = [
+    'attached',
+    'detached',
+    'already-exists',
+    'not-found',
+    'skipped',
+    'failed'
+];
+const STATES = [
+    'serving',
+    'certificate-pending',
+    'ownership-pending',
+    'dns-misconfigured',
+    'not-attached',
+    'skipped',
+    'unknown'
+];
+function settings() {
+    var _process_env_AGLYN_DOMAIN_WEBHOOK_URL;
+    var _process_env_AGLYN_DOMAIN_WEBHOOK_TOKEN;
+    const url = String((_process_env_AGLYN_DOMAIN_WEBHOOK_URL = process.env.AGLYN_DOMAIN_WEBHOOK_URL) != null ? _process_env_AGLYN_DOMAIN_WEBHOOK_URL : '').trim();
+    if (!url) return null;
+    return {
+        url,
+        token: ((_process_env_AGLYN_DOMAIN_WEBHOOK_TOKEN = process.env.AGLYN_DOMAIN_WEBHOOK_TOKEN) == null ? void 0 : _process_env_AGLYN_DOMAIN_WEBHOOK_TOKEN.trim()) || undefined
+    };
+}
+async function call(config, action, scope, domain, redirectTo) {
+    try {
+        const response = await fetch(config.url, {
+            method: 'POST',
+            headers: _extends({
+                'Content-Type': 'application/json'
+            }, config.token ? {
+                Authorization: `Bearer ${config.token}`
+            } : {}),
+            body: JSON.stringify(_extends({
+                action,
+                scope,
+                domain
+            }, redirectTo ? {
+                redirectTo
+            } : {})),
+            signal: domainDeadline()
+        });
+        const body = await response.json().catch(()=>null);
+        if (!response.ok) {
+            console.error(`[domain-provider:webhook] ${action} answered ${response.status}`, domain);
+            return {
+                ok: false,
+                body,
+                detail: String(response.status)
+            };
+        }
+        return {
+            ok: true,
+            body,
+            detail: ''
+        };
+    } catch (error) {
+        console.error(`[domain-provider:webhook] ${action} threw`, domain, error);
+        return {
+            ok: false,
+            body: null,
+            detail: abortedDetail(error)
+        };
+    }
+}
+/** The endpoint's `detail`, kept short — it reaches operator-facing logs. */ function detailFrom(body) {
+    const raw = body == null ? void 0 : body['detail'];
+    if (typeof raw !== 'string') return undefined;
+    const trimmed = raw.trim().slice(0, 200);
+    return trimmed || undefined;
+}
+function recordList(value) {
+    return Array.isArray(value) ? value : [];
+}
+export function webhookDomainProvider() {
+    const act = async (action, scope, name, options = {})=>{
+        const domain = normalizeHost(name);
+        const config = settings();
+        if (!config || !domain) return {
+            outcome: 'skipped',
+            domain
+        };
+        // Normalized before the wire, so an operator's endpoint receives the same
+        // bare hostname Vercel demands and no two drivers disagree on the shape.
+        const redirect = options.redirectTo ? redirectHostname(options.redirectTo) : null;
+        if (options.redirectTo && !redirect) {
+            console.error('[domain-provider:webhook] refusing a non-hostname redirect', options.redirectTo);
+            return {
+                outcome: 'failed',
+                domain,
+                detail: 'invalid-redirect'
+            };
+        }
+        const { ok, body, detail } = await call(config, action, scope, domain, redirect != null ? redirect : undefined);
+        if (!ok) return {
+            outcome: 'failed',
+            domain,
+            detail: detail || 'webhook'
+        };
+        const outcome = body == null ? void 0 : body['outcome'];
+        if (typeof outcome !== 'string' || !OUTCOMES.includes(outcome)) {
+            console.error(`[domain-provider:webhook] ${action} returned an unknown outcome`, domain, outcome);
+            return {
+                outcome: 'failed',
+                domain,
+                detail: 'bad-outcome'
+            };
+        }
+        return _extends({
+            outcome: outcome,
+            domain
+        }, detailFrom(body) ? {
+            detail: detailFrom(body)
+        } : {});
+    };
+    return {
+        id: 'webhook',
+        configured: ()=>settings() !== null,
+        attach: (scope, name, options)=>act('attach', scope, name, options),
+        detach: (scope, name)=>act('detach', scope, name),
+        status: async (scope, name)=>{
+            const domain = normalizeHost(name);
+            const config = settings();
+            if (!config || !domain) return domainStatus(domain, 'skipped');
+            const { ok, body, detail } = await call(config, 'status', scope, domain);
+            // Not `not-attached`: an endpoint that did not answer is not evidence
+            // that the name is missing, and reporting one as the other would strand
+            // every live domain the moment the operator's service restarted.
+            if (!ok) return domainStatus(domain, 'unknown', {
+                detail: detail || 'webhook'
+            });
+            const state = body == null ? void 0 : body['state'];
+            if (typeof state !== 'string' || !STATES.includes(state)) {
+                console.error('[domain-provider:webhook] status returned an unknown state', domain, state);
+                return domainStatus(domain, 'unknown', {
+                    detail: 'bad-state'
+                });
+            }
+            return domainStatus(domain, state, _extends({
+                verification: recordList(body == null ? void 0 : body['verification']),
+                conflicts: recordList(body == null ? void 0 : body['conflicts'])
+            }, detailFrom(body) ? {
+                detail: detailFrom(body)
+            } : {}));
+        }
+    };
+}
+
+//# sourceMappingURL=domain-provider-webhook.js.map

package/src/lib/server/domain-provider-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/domain-provider-webhook.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The webhook driver — the layer an operator supplies.\n *\n * Aglyn asks one endpoint the three questions in the provider contract and\n * takes its word for the answer. What is on the other side is entirely the\n * operator's business: Caddy's admin API, a Traefik dynamic-config file, a\n * cert-manager `Certificate`, a registrar's API, or twenty lines of shell.\n *\n * This is the extension point rather than a module path the app imports,\n * because a module path does not survive the product. Both apps are bundled by\n * Next, so a path resolved at runtime is not in the bundle, and an operator\n * running the published image has no build step in which to add one. A webhook\n * needs no rebuild and works from the shipped image unchanged.\n *\n * ## The wire format\n *\n * `POST $AGLYN_DOMAIN_WEBHOOK_URL`, `Content-Type: application/json`, and\n * `Authorization: Bearer $AGLYN_DOMAIN_WEBHOOK_TOKEN` when that is set:\n *\n * ```json\n * { \"action\": \"attach\", \"scope\": \"tenant\", \"domain\": \"shop.acme.com\",\n *   \"redirectTo\": \"acme.com\" }\n * ```\n *\n * `action` is `attach`, `detach` or `status`. `scope` says which app should\n * answer for the name — `console` for the admin app and its workspace\n * subdomains, `tenant` for published sites. `redirectTo` appears only when the\n * name should forward rather than serve, and is always a bare hostname.\n *\n * Answer `200` with either an outcome:\n *\n * ```json\n * { \"outcome\": \"attached\", \"detail\": \"added to caddy\" }\n * ```\n *\n * or, for `status`, a state:\n *\n * ```json\n * { \"state\": \"ownership-pending\",\n *   \"verification\": [{ \"type\": \"TXT\", \"domain\": \"_acme-challenge.shop.acme.com\",\n *                      \"value\": \"…\" }] }\n * ```\n *\n * ## What Aglyn does with a bad answer\n *\n * An unrecognized `outcome` is `failed` and an unrecognized `state` is\n * `unknown`, both logged with what arrived. A typo must not read as success —\n * an endpoint that answers `{\"outcome\":\"attach\"}` has registered nothing, and\n * accepting it would leave a workspace advertising a URL that resolves\n * nowhere.\n *\n * ⚠️ Send this to a service on your own network. The request carries the\n * bearer token and the names of your customers' domains, and the reply decides\n * whether the console tells someone their site is live.\n */\n\nimport {\n  abortedDetail,\n  domainDeadline,\n  domainStatus,\n  normalizeHost,\n  redirectHostname,\n  type DomainAttachOptions,\n  type DomainOutcome,\n  type DomainProvider,\n  type DomainResult,\n  type DomainScope,\n  type ProjectDomainState,\n  type ProjectDomainStatus,\n} from './domain-provider'\n\nconst OUTCOMES: readonly DomainOutcome[] = [\n  'attached',\n  'detached',\n  'already-exists',\n  'not-found',\n  'skipped',\n  'failed',\n]\n\nconst STATES: readonly ProjectDomainState[] = [\n  'serving',\n  'certificate-pending',\n  'ownership-pending',\n  'dns-misconfigured',\n  'not-attached',\n  'skipped',\n  'unknown',\n]\n\ninterface WebhookSettings {\n  url: string\n  token?: string\n}\n\nfunction settings(): WebhookSettings | null {\n  const url = String(process.env.AGLYN_DOMAIN_WEBHOOK_URL ?? '').trim()\n  if (!url) return null\n  return { url, token: process.env.AGLYN_DOMAIN_WEBHOOK_TOKEN?.trim() || undefined }\n}\n\nasync function call(\n  config: WebhookSettings,\n  action: 'attach' | 'detach' | 'status',\n  scope: DomainScope,\n  domain: string,\n  redirectTo?: string,\n): Promise<{ ok: boolean; body: Record<string, unknown> | null; detail: string }> {\n  try {\n    const response = await fetch(config.url, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),\n      },\n      body: JSON.stringify({\n        action,\n        scope,\n        domain,\n        ...(redirectTo ? { redirectTo } : {}),\n      }),\n      signal: domainDeadline(),\n    })\n    const body = (await response.json().catch(() => null)) as\n      | Record<string, unknown>\n      | null\n    if (!response.ok) {\n      console.error(\n        `[domain-provider:webhook] ${action} answered ${response.status}`,\n        domain,\n      )\n      return { ok: false, body, detail: String(response.status) }\n    }\n    return { ok: true, body, detail: '' }\n  } catch (error) {\n    console.error(`[domain-provider:webhook] ${action} threw`, domain, error)\n    return { ok: false, body: null, detail: abortedDetail(error) }\n  }\n}\n\n/** The endpoint's `detail`, kept short — it reaches operator-facing logs. */\nfunction detailFrom(body: Record<string, unknown> | null): string | undefined {\n  const raw = body?.['detail']\n  if (typeof raw !== 'string') return undefined\n  const trimmed = raw.trim().slice(0, 200)\n  return trimmed || undefined\n}\n\nfunction recordList(\n  value: unknown,\n): { type?: string; name?: string; value?: string }[] {\n  return Array.isArray(value) ? (value as { type?: string }[]) : []\n}\n\nexport function webhookDomainProvider(): DomainProvider {\n  const act = async (\n    action: 'attach' | 'detach',\n    scope: DomainScope,\n    name: string,\n    options: DomainAttachOptions = {},\n  ): Promise<DomainResult> => {\n    const domain = normalizeHost(name)\n    const config = settings()\n    if (!config || !domain) return { outcome: 'skipped', domain }\n\n    // Normalized before the wire, so an operator's endpoint receives the same\n    // bare hostname Vercel demands and no two drivers disagree on the shape.\n    const redirect = options.redirectTo\n      ? redirectHostname(options.redirectTo)\n      : null\n    if (options.redirectTo && !redirect) {\n      console.error(\n        '[domain-provider:webhook] refusing a non-hostname redirect',\n        options.redirectTo,\n      )\n      return { outcome: 'failed', domain, detail: 'invalid-redirect' }\n    }\n\n    const { ok, body, detail } = await call(\n      config,\n      action,\n      scope,\n      domain,\n      redirect ?? undefined,\n    )\n    if (!ok) return { outcome: 'failed', domain, detail: detail || 'webhook' }\n\n    const outcome = body?.['outcome']\n    if (typeof outcome !== 'string' || !OUTCOMES.includes(outcome as DomainOutcome)) {\n      console.error(\n        `[domain-provider:webhook] ${action} returned an unknown outcome`,\n        domain,\n        outcome,\n      )\n      return { outcome: 'failed', domain, detail: 'bad-outcome' }\n    }\n    return {\n      outcome: outcome as DomainOutcome,\n      domain,\n      ...(detailFrom(body) ? { detail: detailFrom(body) } : {}),\n    }\n  }\n\n  return {\n    id: 'webhook',\n    configured: () => settings() !== null,\n    attach: (scope, name, options) => act('attach', scope, name, options),\n    detach: (scope, name) => act('detach', scope, name),\n    status: async (scope, name): Promise<ProjectDomainStatus> => {\n      const domain = normalizeHost(name)\n      const config = settings()\n      if (!config || !domain) return domainStatus(domain, 'skipped')\n\n      const { ok, body, detail } = await call(config, 'status', scope, domain)\n      // Not `not-attached`: an endpoint that did not answer is not evidence\n      // that the name is missing, and reporting one as the other would strand\n      // every live domain the moment the operator's service restarted.\n      if (!ok) return domainStatus(domain, 'unknown', { detail: detail || 'webhook' })\n\n      const state = body?.['state']\n      if (\n        typeof state !== 'string' ||\n        !STATES.includes(state as ProjectDomainState)\n      ) {\n        console.error(\n          '[domain-provider:webhook] status returned an unknown state',\n          domain,\n          state,\n        )\n        return domainStatus(domain, 'unknown', { detail: 'bad-state' })\n      }\n      return domainStatus(domain, state as ProjectDomainState, {\n        verification: recordList(body?.['verification']) as never,\n        conflicts: recordList(body?.['conflicts']),\n        ...(detailFrom(body) ? { detail: detailFrom(body) } : {}),\n      })\n    },\n  }\n}\n"],"names":["abortedDetail","domainDeadline","domainStatus","normalizeHost","redirectHostname","OUTCOMES","STATES","settings","process","url","String","env","AGLYN_DOMAIN_WEBHOOK_URL","trim","token","AGLYN_DOMAIN_WEBHOOK_TOKEN","undefined","call","config","action","scope","domain","redirectTo","response","fetch","method","headers","Authorization","body","JSON","stringify","signal","json","catch","ok","console","error","status","detail","detailFrom","raw","trimmed","slice","recordList","value","Array","isArray","webhookDomainProvider","act","name","options","outcome","redirect","includes","id","configured","attach","detach","state","verification","conflicts"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDC,GAED,SACEA,aAAa,EACbC,cAAc,EACdC,YAAY,EACZC,aAAa,EACbC,gBAAgB,QAQX,uBAAmB;AAE1B,MAAMC,WAAqC;IACzC;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,SAAwC;IAC5C;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAOD,SAASC;QACYC;QAEEA;IAFrB,MAAMC,MAAMC,QAAOF,wCAAAA,QAAQG,GAAG,CAACC,wBAAwB,YAApCJ,wCAAwC,IAAIK,IAAI;IACnE,IAAI,CAACJ,KAAK,OAAO;IACjB,OAAO;QAAEA;QAAKK,OAAON,EAAAA,0CAAAA,QAAQG,GAAG,CAACI,0BAA0B,qBAAtCP,wCAAwCK,IAAI,OAAMG;IAAU;AACnF;AAEA,eAAeC,KACbC,MAAuB,EACvBC,MAAsC,EACtCC,KAAkB,EAClBC,MAAc,EACdC,UAAmB;IAEnB,IAAI;QACF,MAAMC,WAAW,MAAMC,MAAMN,OAAOT,GAAG,EAAE;YACvCgB,QAAQ;YACRC,SAAS;gBACP,gBAAgB;eACZR,OAAOJ,KAAK,GAAG;gBAAEa,eAAe,CAAC,OAAO,EAAET,OAAOJ,KAAK,EAAE;YAAC,IAAI,CAAC;YAEpEc,MAAMC,KAAKC,SAAS,CAAC;gBACnBX;gBACAC;gBACAC;eACIC,aAAa;gBAAEA;YAAW,IAAI,CAAC;YAErCS,QAAQ9B;QACV;QACA,MAAM2B,OAAQ,MAAML,SAASS,IAAI,GAAGC,KAAK,CAAC,IAAM;QAGhD,IAAI,CAACV,SAASW,EAAE,EAAE;YAChBC,QAAQC,KAAK,CACX,CAAC,0BAA0B,EAAEjB,OAAO,UAAU,EAAEI,SAASc,MAAM,EAAE,EACjEhB;YAEF,OAAO;gBAAEa,IAAI;gBAAON;gBAAMU,QAAQ5B,OAAOa,SAASc,MAAM;YAAE;QAC5D;QACA,OAAO;YAAEH,IAAI;YAAMN;YAAMU,QAAQ;QAAG;IACtC,EAAE,OAAOF,OAAO;QACdD,QAAQC,KAAK,CAAC,CAAC,0BAA0B,EAAEjB,OAAO,MAAM,CAAC,EAAEE,QAAQe;QACnE,OAAO;YAAEF,IAAI;YAAON,MAAM;YAAMU,QAAQtC,cAAcoC;QAAO;IAC/D;AACF;AAEA,2EAA2E,GAC3E,SAASG,WAAWX,IAAoC;IACtD,MAAMY,MAAMZ,wBAAAA,IAAM,CAAC,SAAS;IAC5B,IAAI,OAAOY,QAAQ,UAAU,OAAOxB;IACpC,MAAMyB,UAAUD,IAAI3B,IAAI,GAAG6B,KAAK,CAAC,GAAG;IACpC,OAAOD,WAAWzB;AACpB;AAEA,SAAS2B,WACPC,KAAc;IAEd,OAAOC,MAAMC,OAAO,CAACF,SAAUA,QAAgC,EAAE;AACnE;AAEA,OAAO,SAASG;IACd,MAAMC,MAAM,OACV7B,QACAC,OACA6B,MACAC,UAA+B,CAAC,CAAC;QAEjC,MAAM7B,SAASlB,cAAc8C;QAC7B,MAAM/B,SAASX;QACf,IAAI,CAACW,UAAU,CAACG,QAAQ,OAAO;YAAE8B,SAAS;YAAW9B;QAAO;QAE5D,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM+B,WAAWF,QAAQ5B,UAAU,GAC/BlB,iBAAiB8C,QAAQ5B,UAAU,IACnC;QACJ,IAAI4B,QAAQ5B,UAAU,IAAI,CAAC8B,UAAU;YACnCjB,QAAQC,KAAK,CACX,8DACAc,QAAQ5B,UAAU;YAEpB,OAAO;gBAAE6B,SAAS;gBAAU9B;gBAAQiB,QAAQ;YAAmB;QACjE;QAEA,MAAM,EAAEJ,EAAE,EAAEN,IAAI,EAAEU,MAAM,EAAE,GAAG,MAAMrB,KACjCC,QACAC,QACAC,OACAC,QACA+B,mBAAAA,WAAYpC;QAEd,IAAI,CAACkB,IAAI,OAAO;YAAEiB,SAAS;YAAU9B;YAAQiB,QAAQA,UAAU;QAAU;QAEzE,MAAMa,UAAUvB,wBAAAA,IAAM,CAAC,UAAU;QACjC,IAAI,OAAOuB,YAAY,YAAY,CAAC9C,SAASgD,QAAQ,CAACF,UAA2B;YAC/EhB,QAAQC,KAAK,CACX,CAAC,0BAA0B,EAAEjB,OAAO,4BAA4B,CAAC,EACjEE,QACA8B;YAEF,OAAO;gBAAEA,SAAS;gBAAU9B;gBAAQiB,QAAQ;YAAc;QAC5D;QACA,OAAO;YACLa,SAASA;YACT9B;WACIkB,WAAWX,QAAQ;YAAEU,QAAQC,WAAWX;QAAM,IAAI,CAAC;IAE3D;IAEA,OAAO;QACL0B,IAAI;QACJC,YAAY,IAAMhD,eAAe;QACjCiD,QAAQ,CAACpC,OAAO6B,MAAMC,UAAYF,IAAI,UAAU5B,OAAO6B,MAAMC;QAC7DO,QAAQ,CAACrC,OAAO6B,OAASD,IAAI,UAAU5B,OAAO6B;QAC9CZ,QAAQ,OAAOjB,OAAO6B;YACpB,MAAM5B,SAASlB,cAAc8C;YAC7B,MAAM/B,SAASX;YACf,IAAI,CAACW,UAAU,CAACG,QAAQ,OAAOnB,aAAamB,QAAQ;YAEpD,MAAM,EAAEa,EAAE,EAAEN,IAAI,EAAEU,MAAM,EAAE,GAAG,MAAMrB,KAAKC,QAAQ,UAAUE,OAAOC;YACjE,sEAAsE;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAACa,IAAI,OAAOhC,aAAamB,QAAQ,WAAW;gBAAEiB,QAAQA,UAAU;YAAU;YAE9E,MAAMoB,QAAQ9B,wBAAAA,IAAM,CAAC,QAAQ;YAC7B,IACE,OAAO8B,UAAU,YACjB,CAACpD,OAAO+C,QAAQ,CAACK,QACjB;gBACAvB,QAAQC,KAAK,CACX,8DACAf,QACAqC;gBAEF,OAAOxD,aAAamB,QAAQ,WAAW;oBAAEiB,QAAQ;gBAAY;YAC/D;YACA,OAAOpC,aAAamB,QAAQqC,OAA6B;gBACvDC,cAAchB,WAAWf,wBAAAA,IAAM,CAAC,eAAe;gBAC/CgC,WAAWjB,WAAWf,wBAAAA,IAAM,CAAC,YAAY;eACrCW,WAAWX,QAAQ;gBAAEU,QAAQC,WAAWX;YAAM,IAAI,CAAC;QAE3D;IACF;AACF"}