@bugmole/cli 0.4.0 → 0.6.0

package/src/registry-worker/billing/subscriptions.ts

@@ -23,7 +23,7 @@ import { newId } from "../core.js";
 import { emailSender, escapeHtml } from "../email/sender.js";
 import { planChangedHooks } from "../hooks.js";
 import { actorOf, recordAudit } from "../org/audit.js";
-import { getWorkspacePlan, type WorkspacePlan } from "./entitlements.js";
+import { getEntitlements, getWorkspacePlan, type WorkspacePlan } from "./entitlements.js";
 import { periodAnchor, summarize, usagePeriod, usedInPeriod } from "./ledger.js";
 import {
   BillingUnavailableError,
@@ -156,7 +156,7 @@ async function sendBillingEmail(env: Env, workspaceId: string, subject: string,
   const recipients = await billingRecipients(env, workspaceId);
   if (row?.billing_email && !recipients.some((r) => r.email === row.billing_email)) recipients.push({ email: row.billing_email });
   if (!recipients.length) return;
-  const link = `${(env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "")}/billing`;
+  const link = `${(env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "")}/billing?${new URLSearchParams({ workspace: workspaceId })}`;
   try {
     await emailSender(env).send({
       to: recipients,
@@ -172,11 +172,14 @@ async function sendBillingEmail(env: Env, workspaceId: string, subject: string,
 
 // --- Projects over the limit -----------------------------------------------------------------
 
-/** Locks the newest projects beyond the plan's limit and unlocks what fits again. */
+/**
+ * Locks the projects beyond the plan's limit and unlocks what fits again. The
+ * projects an owner chose to keep come first; otherwise the oldest stay active.
+ */
 export async function applyProjectLimit(env: Env, workspaceId: string, entitlements: Entitlements): Promise<{ locked: number }> {
   const rows = await env.DB.prepare(`
     SELECT id, locked_at AS lockedAt FROM projects
-    WHERE workspace_id = ? AND deleted_at IS NULL ORDER BY created_at ASC, rowid ASC
+    WHERE workspace_id = ? AND deleted_at IS NULL AND inactive_at IS NULL ORDER BY kept_at IS NULL, created_at ASC, rowid ASC
   `).bind(workspaceId).all<{ id: string; lockedAt: string | null }>();
   const limit = entitlements.projects ?? Number.POSITIVE_INFINITY;
   const now = new Date().toISOString();
@@ -193,6 +196,47 @@ export async function applyProjectLimit(env: Env, workspaceId: string, entitleme
   return { locked };
 }
 
+/**
+ * An owner picks which projects stay active within the plan's limit; the rest
+ * become read-only (nothing is deleted). The choice is remembered, so a later
+ * downgrade locks the others rather than the newest.
+ */
+export async function chooseActiveProjects(
+  env: Env,
+  principal: Principal,
+  workspaceId: string,
+  projectIds: string[],
+  request?: Request,
+): Promise<{ active: string[]; locked: string[] }> {
+  const { projects: limit, plan } = await getEntitlements(env, workspaceId);
+  const rows = await env.DB.prepare("SELECT id FROM projects WHERE workspace_id = ? AND deleted_at IS NULL")
+    .bind(workspaceId).all<{ id: string }>();
+  const inWorkspace = new Set(rows.results.map((row) => row.id));
+  const chosen = [...new Set(projectIds)];
+  if (!chosen.length) throw new BillingError(422, "no_projects", "Choose at least one project to keep active.");
+  const foreign = chosen.find((id) => !inWorkspace.has(id));
+  if (foreign) throw new BillingError(422, "unknown_project", `Project ${foreign} isn't in this workspace.`);
+  if (limit !== null && chosen.length > limit) {
+    throw new BillingError(422, "over_limit", `Your plan includes ${limit} project${limit === 1 ? "" : "s"}; choose at most ${limit}.`);
+  }
+  const now = new Date().toISOString();
+  await env.DB.batch([
+    env.DB.prepare("UPDATE projects SET kept_at = NULL WHERE workspace_id = ?").bind(workspaceId),
+    ...chosen.map((id) => env.DB.prepare("UPDATE projects SET kept_at = ? WHERE id = ? AND workspace_id = ?").bind(now, id, workspaceId)),
+  ]);
+  await applyProjectLimit(env, workspaceId, entitlementsFor(plan.plan, plan.overrides));
+  const after = await env.DB.prepare("SELECT id, locked_at AS lockedAt FROM projects WHERE workspace_id = ? AND deleted_at IS NULL ORDER BY created_at ASC, rowid ASC")
+    .bind(workspaceId).all<{ id: string; lockedAt: string | null }>();
+  const result = {
+    active: after.results.filter((row) => !row.lockedAt).map((row) => row.id),
+    locked: after.results.filter((row) => row.lockedAt).map((row) => row.id),
+  };
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "billing.projects_chosen", targetType: "workspace", targetId: workspaceId, data: { kept: chosen, ...result },
+  }, request);
+  return result;
+}
+
 // --- Invoices --------------------------------------------------------------------------------
 
 async function nextInvoiceNumber(env: Env, workspaceId: string, at: Date): Promise<string> {
@@ -513,6 +557,70 @@ export async function cancelAtPeriodEnd(env: Env, principal: Principal, workspac
   return getWorkspacePlan(env, workspaceId);
 }
 
+export const RESUME_REASON = "Resumed on Bugmole";
+
+export type ResumeResult =
+  | { status: "resumed"; plan: WorkspacePlan }
+  | { status: "checkout_required"; plan: PaidPlan; interval: BillingInterval; message: string };
+
+/**
+ * Undoes a pending cancellation (or a scheduled plan change) before the paid
+ * period ends, so the current plan keeps renewing.
+ *
+ * Cancelling stops renewal at PayPal right away (POST .../cancel), and PayPal
+ * can't restart a CANCELLED subscription: only a SUSPENDED one can be
+ * activated again. So when the subscription is still live (or only paused) it
+ * is kept; when PayPal already ended it, the answer is "checkout_required":
+ * the customer approves a new subscription for the same plan that starts when
+ * the paid period ends, so nothing is charged twice.
+ */
+export async function resumeSubscription(env: Env, principal: Principal, workspaceId: string, request?: Request, now = new Date()): Promise<ResumeResult> {
+  const row = await planRow(env, workspaceId);
+  if (!row || !isPaidPlan(row.plan) || row.status === "canceled") throw new BillingError(409, "not_subscribed", "This workspace isn't on a paid plan.");
+  if (!row.cancel_at_period_end) throw new BillingError(409, "not_cancelled", "This plan is already set to renew.");
+  if (row.current_period_end && Date.parse(row.current_period_end) <= now.getTime()) {
+    throw new BillingError(409, "period_ended", "The paid period has ended. Choose a plan to subscribe again.");
+  }
+  const interval: BillingInterval = row.billing_interval === "year" ? "year" : "month";
+  const provider = row.provider && row.provider_subscription_id ? billingProvider(row.provider) : null;
+  if (provider) {
+    let remote = await provider.getSubscription(env, row.provider_subscription_id!);
+    if (remote?.status === "past_due") {
+      await provider.reactivateSubscription(env, remote.id, RESUME_REASON);
+      remote = await provider.getSubscription(env, remote.id);
+    }
+    if (remote?.status !== "active") {
+      await recordAudit(env, actorOf(principal), {
+        workspaceId, action: "billing.resume_needs_checkout", targetType: "workspace", targetId: workspaceId,
+        data: { plan: row.plan, interval, providerStatus: remote?.status ?? null },
+      }, request);
+      return {
+        status: "checkout_required",
+        plan: row.plan,
+        interval,
+        message: "PayPal ended the old subscription when the plan was cancelled, and a cancelled PayPal subscription can't be restarted. "
+          + `Approve a new ${PLANS[row.plan].name} subscription in PayPal; it starts when the current period ends, so nothing is charged twice.`,
+      };
+    }
+  }
+  // The subscription is still live: stop ending it, and drop any scheduled change.
+  const scheduled = await env.DB.prepare("SELECT id, provider, provider_subscription_id AS sub FROM billing_checkouts WHERE workspace_id = ? AND status = 'scheduled'")
+    .bind(workspaceId).all<{ id: string; provider: string; sub: string | null }>();
+  for (const change of scheduled.results) {
+    if (change.sub) await billingProvider(change.provider).cancelSubscription(env, change.sub, RESUME_REASON).catch(() => undefined);
+    await env.DB.prepare("UPDATE billing_checkouts SET status = 'abandoned' WHERE id = ?").bind(change.id).run();
+  }
+  await env.DB.prepare("UPDATE workspace_plans SET cancel_at_period_end = 0, pending_plan = NULL, updated_at = CURRENT_TIMESTAMP WHERE workspace_id = ?")
+    .bind(workspaceId).run();
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "billing.resumed", targetType: "workspace", targetId: workspaceId, data: { plan: row.plan, interval },
+  }, request);
+  await sendBillingEmail(env, workspaceId, "Your Bugmole plan will renew", [
+    `Your ${PLANS[row.plan].name} plan renews on ${row.current_period_end?.slice(0, 10) ?? "the end of the period"} as usual.`,
+  ], "billing-resumed");
+  return { status: "resumed", plan: await getWorkspacePlan(env, workspaceId) };
+}
+
 // --- Keeping in step with the provider -------------------------------------------------------
 
 async function moveToFree(env: Env, workspaceId: string, reason: string): Promise<void> {
@@ -552,8 +660,10 @@ export async function syncWorkspaceBilling(env: Env, workspaceId: string, now =
       if (remote.status === "past_due" && row.status === "active") {
         await env.DB.prepare("UPDATE workspace_plans SET status = 'past_due', grace_until = ?, updated_at = CURRENT_TIMESTAMP WHERE workspace_id = ?")
           .bind(new Date(now.getTime() + GRACE_DAYS * DAY).toISOString(), workspaceId).run();
+        const manage = provider.manageUrl(env);
         await sendBillingEmail(env, workspaceId, "Your Bugmole payment didn't go through", [
           `PayPal couldn't collect your renewal. Update your payment method in PayPal within ${GRACE_DAYS} days to keep using Bugmole Cloud.`,
+          ...(manage ? [`Change the card or bank for this subscription under PayPal's automatic payments: ${manage}`] : []),
           "Runs on your own machines and CI keep working either way.",
         ], "billing-payment-failed");
       }

package/src/registry-worker/core.ts

@@ -14,14 +14,38 @@ export interface Env extends EmailEnv {
   DASHBOARD_URL?: string;
   /** Signs the short-lived tokens hosted runners use; see runner/tokens.ts. */
   RUNNER_TOKEN_SECRET?: string;
+  /**
+   * Root key for project secrets (sign-in for cloud runs): 32 random bytes,
+   * base64. Without it the secrets routes answer 503. See secrets/crypto.ts.
+   */
+  PROJECT_SECRETS_KEY?: string;
+  /** Version of PROJECT_SECRETS_KEY (default 1); raise it when rotating. */
+  PROJECT_SECRETS_KEY_VERSION?: string;
+  /** The key being rotated away from, kept until no value still uses it. */
+  PROJECT_SECRETS_KEY_PREVIOUS?: string;
+  PROJECT_SECRETS_KEY_PREVIOUS_VERSION?: string;
+  /**
+   * RSA private key (PKCS#8 PEM) that signs runners' identity tokens, which
+   * customers' clouds trust instead of a stored key. See identity/oidc.ts.
+   */
+  OIDC_SIGNING_KEY?: string;
+  /** The issuer those tokens name (default https://api.bugmole.com). */
+  OIDC_ISSUER?: string;
   /** Service binding to the valkyrie-runner Worker that starts cloud-run containers. */
   RUNNER?: Fetcher;
+  /** Scents (bugmole-scents): checks that a typed referral code belongs to an affiliate. */
+  SCENTS?: Fetcher;
   /** Cloud runs executing at once across every workspace (default 20). */
   CLOUD_POOL_MAX?: string;
   /** Longest a cloud run may take before it is stopped, in minutes (default 60). */
   CLOUD_RUN_MAX_MINUTES?: string;
   /** This registry's public origin, handed to runners (e.g. https://api.bugmole.com). */
   REGISTRY_PUBLIC_URL?: string;
+  /**
+   * Bearer token for the platform-operator routes (/api/platform/…, see
+   * feature-flags/admin.ts). A secret; those routes answer 503 without it.
+   */
+  PLATFORM_ADMIN_TOKEN?: string;
   /** Rollout flags; see flags.ts. */
   [key: `FEATURE_${string}`]: string | undefined;
 }

package/src/registry-worker/devices/policy.ts

@@ -2,9 +2,8 @@
 import type { CloudDevice } from "../../runtime/device-clouds/types.js";
 import type { Env } from "../core.js";
 import { response } from "../core.js";
-import { getEntitlements } from "../billing/entitlements.js";
 import { canSpend } from "../billing/ledger.js";
-import { flagOn } from "../flags.js";
+import { blockedBy, featureState } from "../feature-access.js";
 
 export type BugmoleDeviceEnv = {
   BUGMOLE_DEVICE_FARM_ACCESS_KEY_ID?: string;
@@ -42,9 +41,9 @@ export async function deviceTargetsError(
   executionMode: "self" | "cloud",
 ): Promise<Response | null> {
   if (!workspaceId) return refused("This project isn't in a workspace", "no_workspace");
-  if (!(await flagOn(env, workspaceId, "device_clouds"))) return refused("Device clouds aren't available for this workspace yet.", "device_clouds_unavailable");
-  const { features } = await getEntitlements(env, workspaceId);
-  if (!features.deviceClouds) return refused("Real devices and device clouds are included in Business.", "plan_feature", 402);
+  const blocked = blockedBy(await featureState(env, workspaceId, "device_clouds"));
+  if (blocked === "rollout") return refused("Device clouds aren't available for this workspace yet.", "device_clouds_unavailable");
+  if (blocked === "plan") return refused("Real devices and device clouds are included in Business.", "plan_feature", 402);
   for (const target of targets) {
     if (target.provider === "bugmole") {
       if (executionMode !== "cloud") return refused("Bugmole's own devices are only used by runs on Bugmole Cloud.", "bugmole_devices_need_cloud");

package/src/registry-worker/devices/routes.ts

@@ -15,7 +15,7 @@ import {
 } from "../../integrations/device-farm.js";
 import type { Env, Principal } from "../core.js";
 import { memberOfProject, memberOfWorkspace, newId, requestJson, response, sha256 } from "../core.js";
-import { getEntitlements } from "../billing/entitlements.js";
+import { blockedBy, featureEnabled, featureState } from "../feature-access.js";
 import { canSpend, recordUsage } from "../billing/ledger.js";
 import { registerJob } from "../jobs/index.js";
 import { actorOf, auditProject, recordAudit } from "../org/audit.js";
@@ -37,8 +37,9 @@ function providerFetch(env: Env): Fetcher {
 
 async function manageable(env: Env, principal: Principal, workspaceId: string): Promise<Response | null> {
   if (!(await memberOfWorkspace(env, principal, workspaceId, "workspace.manage"))) return response({ error: "Only owners and admins can manage device clouds" }, 403);
-  const { features } = await getEntitlements(env, workspaceId);
-  if (!features.deviceClouds) return response({ error: "Device clouds are included in Business.", code: "plan_feature", upgradeUrl: "/billing" }, 402);
+  const blocked = blockedBy(await featureState(env, workspaceId, "device_clouds"));
+  if (blocked === "rollout") return response({ error: "Device clouds aren't available for this workspace yet.", code: "device_clouds_unavailable" }, 422);
+  if (blocked === "plan") return response({ error: "Device clouds are included in Business.", code: "plan_feature", upgradeUrl: "/billing" }, 402);
   if (!canStoreSecrets(env)) return response({ error: "Device clouds can't be connected right now." }, 503);
   return null;
 }
@@ -121,11 +122,11 @@ async function listConnections({ env, principal }: AuthedRouteContext, workspace
     SELECT id, provider, label, username, project_arn AS projectArn, created_at AS createdAt, last_verified_at AS lastVerifiedAt
     FROM device_cloud_credentials WHERE workspace_id = ? AND revoked_at IS NULL ORDER BY created_at ASC
   `).bind(workspaceId).all();
-  const { features } = await getEntitlements(env, workspaceId);
+  const available = await featureEnabled(env, workspaceId, "device_clouds");
   return response({
-    available: features.deviceClouds,
+    available,
     canManage: await memberOfWorkspace(env, principal, workspaceId, "workspace.manage"),
-    bugmole: { available: features.deviceClouds && Boolean(bugmoleDeviceCloud(env)) },
+    bugmole: { available: available && Boolean(bugmoleDeviceCloud(env)) },
     connections: rows.results,
   });
 }
@@ -175,8 +176,7 @@ async function devicesFor({ env, principal }: AuthedRouteContext, workspaceId: s
   try {
     if (id === "bugmole") {
       const own = bugmoleDeviceCloud(env);
-      const { features } = await getEntitlements(env, workspaceId);
-      if (!own || !features.deviceClouds) return response({ error: "Bugmole's device cloud isn't available for this workspace" }, 402);
+      if (!own || !(await featureEnabled(env, workspaceId, "device_clouds"))) return response({ error: "Bugmole's device cloud isn't available for this workspace" }, 402);
       return response({ devices: unique(await catalog(env, { provider: "aws_device_farm", username: own.credentials.accessKeyId, secret: own.credentials.secretAccessKey, projectArn: own.projectArn })) });
     }
     const credential = await credentialFor(env, workspaceId, id);

package/src/registry-worker/domains/domains.test.ts

@@ -4,6 +4,7 @@ import type { Env } from "../core.js";
 import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
 import {
   domainProvesToken,
+  fileProvesToken,
   hostMatchesVerifiedDomain,
   needsDomainVerification,
   normalizeDomain,
@@ -56,6 +57,31 @@ test("domainProvesToken only accepts the exact token at the exact record name",
   assert.deepEqual(calls, ["_bugmole-verify.example.com", "_bugmole-verify.other.com"]);
 });
 
+test("a published file only proves the exact token, served directly, on the exact host", async () => {
+  const token = "bugmole-domain-verify=abc123";
+  const asked: string[] = [];
+  const site = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    asked.push(url);
+    if (url === "https://app.example.com/.well-known/bugmole-verification.txt") return new Response(`# Bugmole\n${token}\n`);
+    if (url === "https://moved.example.com/.well-known/bugmole-verification.txt") return new Response(null, { status: 302, headers: { location: "https://app.example.com/.well-known/bugmole-verification.txt" } });
+    if (url === "https://inline.example.com/.well-known/bugmole-verification.txt") return new Response(`not-${token}`);
+    return new Response("Not found", { status: 404 });
+  }) as unknown as typeof fetch;
+  assert.equal(await fileProvesToken("app.example.com", token, site), true);
+  assert.equal(await fileProvesToken("moved.example.com", token, site), false, "a redirect could hand the proof to another host");
+  assert.equal(await fileProvesToken("inline.example.com", token, site), false, "the token must be a line of its own");
+  assert.equal(await fileProvesToken("other.example.com", token, site), false);
+  assert.equal(await fileProvesToken("app.example.com", token, (async () => { throw new Error("offline"); }) as unknown as typeof fetch), false);
+  assert.ok(asked.every((url) => url.startsWith("https://")), "only ever over HTTPS");
+});
+
+test("a file-verified host covers only itself; a DNS-verified domain covers its subdomains", () => {
+  assert.equal(hostMatchesVerifiedDomain("app.example.com", "app.example.com", "file"), true);
+  assert.equal(hostMatchesVerifiedDomain("admin.app.example.com", "app.example.com", "file"), false);
+  assert.equal(hostMatchesVerifiedDomain("admin.app.example.com", "app.example.com", "dns"), true);
+});
+
 // --- Routes and enforcement --------------------------------------------------------------------
 
 /** A fake DoH resolver that answers real (name -> token) pairs, like a real zone would. */
@@ -108,7 +134,8 @@ test("verification checks the real TXT record and rejects a stranger's guess", a
 
   const tooSoon = await call(env, "POST", `/api/workspaces/${workspaceId}/domains/${id}/verify`, { as: owner });
   assert.equal(tooSoon.status, 400);
-  assert.equal(tooSoon.json.error, "dns_verification_failed");
+  assert.equal(tooSoon.json.error, "verification_failed");
+  assert.match(tooSoon.json.message, /\.well-known\/bugmole-verification\.txt/);
 
   const wrongValue = await call(env, "POST", `/api/workspaces/${workspaceId}/domains/${id}/verify`, { as: "user_stranger" });
   assert.equal(wrongValue.status, 403, "verifying is also owner/admin-only");
@@ -208,3 +235,39 @@ test("adding a domain is limited so a workspace can't grow this table without bo
   const overLimit = await call(env, "POST", `/api/workspaces/${workspaceId}/domains`, { as: owner, body: { domain: "one-too-many.example.com" } });
   assert.equal(overLimit.status, 422);
 });
+
+test("someone without DNS access verifies one subdomain by publishing a file, and only that host opens up", async () => {
+  const files = new Map<string, string>();
+  const site = (async (input: RequestInfo | URL) => {
+    const url = new URL(String(input));
+    if (url.hostname === "cloudflare-dns.com") return Response.json({ Answer: [] });
+    const body = files.get(`${url.hostname}${url.pathname}`);
+    return body === undefined ? new Response("Not found", { status: 404 }) : new Response(body);
+  }) as unknown as typeof fetch;
+  const { env, workspaceId, owner, projectId } = await workspace({ DOMAIN_VERIFY_FETCH: site } as Partial<Env>);
+  await call(env, "POST", `/api/projects/${projectId}/environments`, { as: owner, body: { id: "prod", name: "Prod", baseUrl: "https://shop.example.com/" } });
+  await call(env, "POST", `/api/projects/${projectId}/environments`, { as: owner, body: { id: "admin", name: "Admin", baseUrl: "https://admin.shop.example.com/" } });
+
+  const added = await call(env, "POST", `/api/workspaces/${workspaceId}/domains`, { as: owner, body: { domain: "shop.example.com" } });
+  assert.deepEqual(added.json.domain.file, {
+    url: "https://shop.example.com/.well-known/bugmole-verification.txt",
+    content: added.json.domain.txtRecord.value,
+  });
+  files.set("shop.example.com/.well-known/bugmole-verification.txt", `${added.json.domain.file.content}\n`);
+  const verified = await call(env, "POST", `/api/workspaces/${workspaceId}/domains/${added.json.domain.id}/verify`, { as: owner });
+  assert.equal(verified.status, 200);
+  assert.equal(verified.json.method, "file");
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/domains`, { as: owner })).json.domains[0].verifiedBy, "file");
+
+  const allowed = await call(env, "POST", `/api/projects/${projectId}/runs`, {
+    as: owner,
+    body: { planId: "checkout", idempotencyKey: "f1", executionMode: "cloud", environmentId: "prod" },
+  });
+  assert.equal(allowed.status, 201, JSON.stringify(allowed.json));
+  const deeper = await call(env, "POST", `/api/projects/${projectId}/runs`, {
+    as: owner,
+    body: { planId: "checkout", idempotencyKey: "f2", executionMode: "cloud", environmentId: "admin" },
+  });
+  assert.equal(deeper.status, 403, "a file on one host says nothing about the hosts under it");
+  assert.equal(deeper.json.code, "domain_not_verified");
+});

package/src/registry-worker/domains/routes.ts

@@ -1,16 +1,20 @@
 // Workspace domain verification: prove control of a domain by DNS TXT record
+// (covers subdomains) or by publishing a file on the site (that host only)
 // before Bugmole Cloud will explore or run against a host on it. See
 // ../domains.ts for why, and the normalization/matching/DNS-lookup helpers.
 import {
   domainProvesToken,
   dohTxtLookupWith,
+  DOMAIN_VERIFY_FILE,
   DOMAIN_VERIFY_PREFIX,
+  fileProvesToken,
   hostMatchesVerifiedDomain,
   needsDomainVerification,
   newVerificationToken,
   normalizeDomain,
   targetHost,
   type TxtLookup,
+  type VerificationMethod,
 } from "../domains.js";
 import type { AuthedRouteContext } from "../routes/index.js";
 import { matchPath, registerRoutes } from "../routes/index.js";
@@ -20,27 +24,37 @@ import { actorOf, recordAudit } from "../org/audit.js";
 
 const MAX_DOMAINS_PER_WORKSPACE = 25;
 
+function fetchFor(env: Env): typeof fetch {
+  return (env as Env & { DOMAIN_VERIFY_FETCH?: typeof fetch }).DOMAIN_VERIFY_FETCH ?? fetch;
+}
+
 function lookupFor(env: Env): TxtLookup {
-  return dohTxtLookupWith((env as Env & { DOMAIN_VERIFY_FETCH?: typeof fetch }).DOMAIN_VERIFY_FETCH ?? fetch);
+  return dohTxtLookupWith(fetchFor(env));
 }
 
 type DomainRow = {
   id: string;
   domain: string;
   status: "pending" | "verified";
+  verifiedBy?: VerificationMethod | null;
   createdAt: string;
   verifiedAt: string | null;
   lastCheckError: string | null;
 };
 
 function withRecord(row: DomainRow, token: string) {
-  return { ...row, txtRecord: { name: `${DOMAIN_VERIFY_PREFIX}.${row.domain}`, value: token } };
+  return {
+    ...row,
+    txtRecord: { name: `${DOMAIN_VERIFY_PREFIX}.${row.domain}`, value: token },
+    // For a site whose DNS the person can't change, such as one subdomain.
+    file: { url: `https://${row.domain}${DOMAIN_VERIFY_FILE}`, content: token },
+  };
 }
 
 async function listDomains({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
   if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
   const rows = await env.DB.prepare(`
-    SELECT id, domain, verification_token AS verificationToken, status, created_at AS createdAt, verified_at AS verifiedAt, last_check_error AS lastCheckError
+    SELECT id, domain, verification_token AS verificationToken, status, verified_by AS verifiedBy, created_at AS createdAt, verified_at AS verifiedAt, last_check_error AS lastCheckError
     FROM workspace_domains WHERE workspace_id = ? ORDER BY created_at ASC
   `).bind(workspaceId).all<DomainRow & { verificationToken: string }>();
   return response({
@@ -62,7 +76,7 @@ async function addDomain({ env, principal, request }: AuthedRouteContext, worksp
   }
   const count = await env.DB.prepare("SELECT COUNT(*) AS count FROM workspace_domains WHERE workspace_id = ?").bind(workspaceId).first<{ count: number }>();
   if ((count?.count ?? 0) >= MAX_DOMAINS_PER_WORKSPACE) return response({ error: `A workspace can add at most ${MAX_DOMAINS_PER_WORKSPACE} domains.` }, 422);
-  const existing = await env.DB.prepare("SELECT id, verification_token AS verificationToken, status, created_at AS createdAt, verified_at AS verifiedAt, last_check_error AS lastCheckError FROM workspace_domains WHERE workspace_id = ? AND domain = ?")
+  const existing = await env.DB.prepare("SELECT id, verification_token AS verificationToken, status, verified_by AS verifiedBy, created_at AS createdAt, verified_at AS verifiedAt, last_check_error AS lastCheckError FROM workspace_domains WHERE workspace_id = ? AND domain = ?")
     .bind(workspaceId, domain).first<DomainRow & { verificationToken: string }>();
   if (existing) return response({ domain: withRecord({ ...existing, domain }, existing.verificationToken) }, 200);
   const id = newId("dom");
@@ -83,16 +97,19 @@ async function verifyDomain({ env, principal, request }: AuthedRouteContext, wor
     .bind(id, workspaceId).first<{ domain: string; verificationToken: string; status: string }>();
   if (!row) return response({ error: "Not found" }, 404);
   if (row.status === "verified") return response({ verified: true });
-  const proved = await domainProvesToken(row.domain, row.verificationToken, lookupFor(env));
-  if (!proved) {
-    const message = "We couldn't find that TXT record yet. DNS changes can take a while to propagate — try again shortly.";
+  // Either proof will do; DNS first, since it covers more.
+  const method: VerificationMethod | null = await domainProvesToken(row.domain, row.verificationToken, lookupFor(env))
+    ? "dns"
+    : await fileProvesToken(row.domain, row.verificationToken, fetchFor(env)) ? "file" : null;
+  if (!method) {
+    const message = `We couldn't find the TXT record or the file at https://${row.domain}${DOMAIN_VERIFY_FILE} yet. DNS changes can take a while to propagate — try again shortly.`;
     await env.DB.prepare("UPDATE workspace_domains SET last_check_error = ? WHERE id = ?").bind(message, id).run();
-    return response({ error: "dns_verification_failed", message }, 400);
+    return response({ error: "verification_failed", message }, 400);
   }
-  await env.DB.prepare("UPDATE workspace_domains SET status = 'verified', verified_at = ?, last_check_error = NULL WHERE id = ?")
-    .bind(new Date().toISOString(), id).run();
-  await recordAudit(env, actorOf(principal), { workspaceId, action: "domain.verified", targetType: "domain", targetId: id, data: { domain: row.domain } }, request);
-  return response({ verified: true });
+  await env.DB.prepare("UPDATE workspace_domains SET status = 'verified', verified_by = ?, verified_at = ?, last_check_error = NULL WHERE id = ?")
+    .bind(method, new Date().toISOString(), id).run();
+  await recordAudit(env, actorOf(principal), { workspaceId, action: "domain.verified", targetType: "domain", targetId: id, data: { domain: row.domain, method } }, request);
+  return response({ verified: true, method });
 }
 
 async function removeDomain({ env, principal, request }: AuthedRouteContext, workspaceId: string, id: string): Promise<Response> {
@@ -115,9 +132,9 @@ async function removeDomain({ env, principal, request }: AuthedRouteContext, wor
 export async function requireVerifiedDomainForCloud(env: Env, workspaceId: string, url: string): Promise<Response | null> {
   const host = targetHost(url);
   if (!host || !needsDomainVerification(host)) return null;
-  const rows = await env.DB.prepare("SELECT domain FROM workspace_domains WHERE workspace_id = ? AND status = 'verified'")
-    .bind(workspaceId).all<{ domain: string }>();
-  if (rows.results.some((row) => hostMatchesVerifiedDomain(host, row.domain))) return null;
+  const rows = await env.DB.prepare("SELECT domain, verified_by AS verifiedBy FROM workspace_domains WHERE workspace_id = ? AND status = 'verified'")
+    .bind(workspaceId).all<{ domain: string; verifiedBy: VerificationMethod | null }>();
+  if (rows.results.some((row) => hostMatchesVerifiedDomain(host, row.domain, row.verifiedBy ?? "dns"))) return null;
   return response({
     error: `Verify that this workspace owns ${host} before running it on Bugmole Cloud.`,
     code: "domain_not_verified",

package/src/registry-worker/domains.ts

@@ -1,5 +1,5 @@
 // Domain ownership: a workspace must prove it controls a domain, by DNS TXT
-// record, before Bugmole Cloud will explore or run against a host on it.
+// record or by publishing a file on the site, before Bugmole Cloud will explore or run against a host on it.
 // Without this, a workspace's cloud minutes could point Bugmole's own IPs
 // at any third-party site — using Bugmole as an anonymous crawler against a
 // domain nobody in the workspace actually owns. Self-hosted runs and
@@ -8,6 +8,10 @@
 import { randomToken } from "./core.js";
 
 export const DOMAIN_VERIFY_PREFIX = "_bugmole-verify";
+/** Where the file proof lives. Under /.well-known/ so an ordinary upload folder can't satisfy it. */
+export const DOMAIN_VERIFY_FILE = "/.well-known/bugmole-verification.txt";
+
+export type VerificationMethod = "dns" | "file";
 
 export function newVerificationToken(): string {
   return `bugmole-domain-verify=${randomToken(20)}`;
@@ -61,9 +65,15 @@ export function needsDomainVerification(host: string): boolean {
   return !isPrivateHost(host);
 }
 
-export function hostMatchesVerifiedDomain(host: string, domain: string): boolean {
+/**
+ * DNS proves the whole zone, so it covers subdomains. A published file only
+ * proves whoever runs that one host — on shared hosting, the next subdomain
+ * over may belong to someone else — so it covers exactly that host.
+ */
+export function hostMatchesVerifiedDomain(host: string, domain: string, method: VerificationMethod = "dns"): boolean {
   const h = host.toLowerCase();
   const d = domain.toLowerCase();
+  if (method === "file") return h === d;
   return h === d || h.endsWith(`.${d}`);
 }
 
@@ -86,3 +96,31 @@ export async function domainProvesToken(domain: string, token: string, lookup: T
   const records = await lookup(`${DOMAIN_VERIFY_PREFIX}.${domain}`).catch(() => [] as string[]);
   return records.includes(token);
 }
+
+/**
+ * The file proof: https://<domain>/.well-known/bugmole-verification.txt
+ * answers 200 itself (no redirect, which could hand the proof to another
+ * host) with the token on a line of its own. Bounded in time and size.
+ */
+export async function fileProvesToken(domain: string, token: string, doFetch: typeof fetch = fetch): Promise<boolean> {
+  try {
+    const res = await doFetch(`https://${domain}${DOMAIN_VERIFY_FILE}`, {
+      redirect: "manual",
+      headers: { accept: "text/plain", "user-agent": "Bugmole domain verification" },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (res.status !== 200 || !res.body) return false;
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    while (text.length < 4096) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      text += decoder.decode(value, { stream: true });
+    }
+    await reader.cancel().catch(() => undefined);
+    return text.slice(0, 4096).split(/\r?\n/).some((line) => line.trim() === token);
+  } catch {
+    return false;
+  }
+}