@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/tenant/domain-handler.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * Tenant Domain Handler
+ *
+ * Handles CRUD + DNS verification for tenant-claimed domains.
+ *
+ * Routes:
+ *   POST   /api/tenants/:id/domains              — claim domain
+ *   GET    /api/tenants/:id/domains              — list domains
+ *   DELETE /api/tenants/:id/domains/:domainId    — remove domain
+ *   POST   /api/tenants/:id/domains/:domainId/verify — trigger DNS check
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DomainHandler = void 0;
+const node_crypto_1 = require("node:crypto");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const require_1 = require("../auth/require");
+const domain_validator_1 = require("./domain-validator");
+const domain_verifier_1 = require("./domain-verifier");
+// ─── Constants ───────────────────────────────────────────────────────────────
+const TOKEN_EXPIRY_DAYS = 7;
+const RATE_LIMIT_WINDOW_SECONDS = 3600; // 1 hour
+const RATE_LIMIT_MAX_ATTEMPTS = 10;
+const FAILURE_ROTATION_WINDOW_SECONDS = 86400; // 24 hours
+const FAILURE_ROTATION_THRESHOLD = 10;
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function generateToken() {
+    return (0, node_crypto_1.randomBytes)(16).toString("hex");
+}
+function tokenExpiresAt() {
+    const d = new Date();
+    d.setDate(d.getDate() + TOKEN_EXPIRY_DAYS);
+    return d;
+}
+function makeRateLimitKey(tenantId, domainId) {
+    return `domain-rate:${tenantId}:${domainId}`;
+}
+function makeFailureCountKey(tenantId, domainId) {
+    return `domain-fail:${tenantId}:${domainId}`;
+}
+function json(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+// ─── Handler ─────────────────────────────────────────────────────────────────
+class DomainHandler {
+    /**
+     * POST /api/tenants/:id/domains
+     * Claim a domain. Returns 201 + token on first claim, 200 + existing record
+     * if the same tenant re-claims the same domain (idempotent).
+     * Returns 409 if the domain is already claimed by another tenant.
+     */
+    async handleClaim(tenantId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireRole)(auth, "ADMIN");
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return json({ error: "INVALID_JSON", message: "Request body must be valid JSON" }, 400);
+        }
+        const schema = z.object({ domain: z.string() });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return json({ error: "VALIDATION_ERROR", message: "domain is required" }, 400);
+        }
+        const validation = (0, domain_validator_1.validateDomain)(parsed.data.domain);
+        if (!validation.ok) {
+            return json({ error: validation.code, message: validation.message }, 400);
+        }
+        const { domain } = validation;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        // Check for existing record globally (without tenantId filter) to enforce
+        // the "domain can only belong to one tenant" rule.
+        const existing = await db.tenantDomain.findUnique({
+            where: { domain },
+        });
+        if (existing) {
+            if (existing.tenantId === tenantId) {
+                // Idempotent re-claim: check if token has expired and re-issue if so.
+                if (!existing.verifiedAt && existing.tokenExpiresAt < new Date()) {
+                    // Expired unverified token — rotate it.
+                    const updated = await db.tenantDomain.update({
+                        where: { id: existing.id },
+                        data: {
+                            verificationToken: generateToken(),
+                            tokenExpiresAt: tokenExpiresAt(),
+                            verifyAttempts: 0,
+                        },
+                    });
+                    return json(formatDomainRecord(updated), 200);
+                }
+                // Return existing record as-is.
+                return json(formatDomainRecord(existing), 200);
+            }
+            // Another tenant owns it — don't leak which tenant.
+            return json({ error: "DOMAIN_CONFLICT", message: "Domain is already claimed" }, 409);
+        }
+        // Create new record.
+        const record = await db.tenantDomain.create({
+            data: {
+                tenantId,
+                domain,
+                verificationToken: generateToken(),
+                tokenExpiresAt: tokenExpiresAt(),
+            },
+        });
+        return json(formatDomainRecord(record), 201);
+    }
+    /**
+     * GET /api/tenants/:id/domains
+     * Lists tenant's domains. Tokens are included for unverified records
+     * (so the admin can copy the required TXT value).
+     */
+    async handleList(tenantId, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId);
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const domains = await db.tenantDomain.findMany({
+            where: { tenantId },
+            orderBy: { createdAt: "asc" },
+        });
+        return json({ domains: domains.map(formatDomainRecord) }, 200);
+    }
+    /**
+     * DELETE /api/tenants/:id/domains/:domainId
+     * Removes a domain. Blocked if the domain is the only verified domain and
+     * the tenant has an ACTIVE IdP (removing it would break SSO logins).
+     */
+    async handleDelete(tenantId, domainId, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireRole)(auth, "ADMIN");
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const record = await db.tenantDomain.findUnique({
+            where: { id: domainId, tenantId },
+        });
+        if (!record) {
+            return json({ error: "NOT_FOUND", message: "Domain not found" }, 404);
+        }
+        if (record.verifiedAt) {
+            // Check whether this is the last verified domain and there's an active IdP.
+            const verifiedCount = await db.tenantDomain.count({
+                where: { tenantId, verifiedAt: { not: null } },
+            });
+            if (verifiedCount === 1) {
+                const idp = await db.tenantIdentityProvider.findUnique({
+                    where: { tenantId },
+                    select: { status: true },
+                });
+                if (idp?.status === "ACTIVE") {
+                    return json({
+                        error: "DOMAIN_IN_USE",
+                        message: "Cannot remove the only verified domain while an IdP is active",
+                        remediation: "Disable the identity provider first, or add another verified domain",
+                    }, 409);
+                }
+            }
+        }
+        await db.tenantDomain.delete({ where: { id: domainId } });
+        return json({ ok: true }, 200);
+    }
+    /**
+     * POST /api/tenants/:id/domains/:domainId/verify
+     * Performs a DNS TXT lookup to verify domain ownership.
+     */
+    async handleVerify(tenantId, domainId, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireRole)(auth, "ADMIN");
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const record = await db.tenantDomain.findUnique({
+            where: { id: domainId, tenantId },
+        });
+        if (!record) {
+            return json({ error: "NOT_FOUND", message: "Domain not found" }, 404);
+        }
+        // Already verified — return success immediately.
+        if (record.verifiedAt) {
+            return json({ ok: true, domain: record.domain, verifiedAt: record.verifiedAt }, 200);
+        }
+        // Check token expiry (sec finding #5).
+        if (record.tokenExpiresAt < new Date()) {
+            return json({
+                error: "TOKEN_EXPIRED",
+                message: "Verification token has expired",
+                remediation: "Re-claim the domain to get a new token",
+            }, 422);
+        }
+        // Rate limit: 10 verify attempts per hour per (tenantId, domainId).
+        const rateLimitKey = makeRateLimitKey(tenantId, domainId);
+        const rateLimitCheckResult = await this.checkAndIncrementRateLimit(env, rateLimitKey, RATE_LIMIT_MAX_ATTEMPTS, RATE_LIMIT_WINDOW_SECONDS);
+        if (rateLimitCheckResult.limited) {
+            return new Response(JSON.stringify({ error: "RATE_LIMITED", message: "Too many verify attempts" }), {
+                status: 429,
+                headers: {
+                    "content-type": "application/json",
+                    "Retry-After": String(rateLimitCheckResult.retryAfter),
+                },
+            });
+        }
+        // Perform DNS lookup.
+        const dnsResult = await (0, domain_verifier_1.verifyDomainToken)(record.domain, record.verificationToken);
+        if (dnsResult.verified) {
+            const updated = await db.tenantDomain.update({
+                where: { id: domainId },
+                data: {
+                    verifiedAt: new Date(),
+                    verifyAttemptedAt: new Date(),
+                    verifyAttempts: { increment: 1 },
+                },
+            });
+            return json({ ok: true, domain: updated.domain, verifiedAt: updated.verifiedAt }, 200);
+        }
+        // Failed — increment failure counter in DynamoDB.
+        await db.tenantDomain.update({
+            where: { id: domainId },
+            data: {
+                verifyAttemptedAt: new Date(),
+                verifyAttempts: { increment: 1 },
+            },
+        });
+        // Check for auto-rotation after 10 failures in 24h.
+        const failKey = makeFailureCountKey(tenantId, domainId);
+        const newFailCount = await this.incrementFailureCount(env, failKey, FAILURE_ROTATION_WINDOW_SECONDS);
+        let rotated = false;
+        let newToken;
+        if (newFailCount >= FAILURE_ROTATION_THRESHOLD) {
+            newToken = generateToken();
+            await db.tenantDomain.update({
+                where: { id: domainId },
+                data: {
+                    verificationToken: newToken,
+                    tokenExpiresAt: tokenExpiresAt(),
+                    verifyAttempts: 0,
+                },
+            });
+            await env.RATE_LIMIT_KV.delete(failKey);
+            rotated = true;
+        }
+        const reason = dnsResult.reason;
+        const messages = {
+            TOKEN_MISMATCH: "TXT record found but token did not match",
+            NO_RECORDS: "No TXT record found at the verification hostname",
+            DNS_ERROR: "DNS lookup failed — please try again later",
+        };
+        const body = {
+            error: "VERIFICATION_FAILED",
+            message: messages[reason] ?? "DNS verification failed",
+            remediation: `Add TXT record: _skybber-verify.${record.domain} = skybber-verify=${record.verificationToken}`,
+        };
+        if (rotated && newToken) {
+            body.tokenRotated = true;
+            body.remediation = `Token rotated after repeated failures. Add TXT record: _skybber-verify.${record.domain} = skybber-verify=${newToken}`;
+        }
+        return json(body, 422);
+    }
+    // ─── Internal helpers ───────────────────────────────────────────────────────
+    async checkAndIncrementRateLimit(env, key, maxAttempts, windowSeconds) {
+        const raw = await env.RATE_LIMIT_KV.get(key);
+        const current = raw ? parseInt(raw, 10) : 0;
+        if (current >= maxAttempts) {
+            return { limited: true, retryAfter: windowSeconds };
+        }
+        await env.RATE_LIMIT_KV.put(key, String(current + 1), {
+            expirationTtl: windowSeconds,
+        });
+        return { limited: false };
+    }
+    async incrementFailureCount(env, key, windowSeconds) {
+        const raw = await env.RATE_LIMIT_KV.get(key);
+        const current = raw ? parseInt(raw, 10) : 0;
+        const next = current + 1;
+        await env.RATE_LIMIT_KV.put(key, String(next), {
+            expirationTtl: windowSeconds,
+        });
+        return next;
+    }
+}
+exports.DomainHandler = DomainHandler;
+function formatDomainRecord(r) {
+    return {
+        id: r.id,
+        tenantId: r.tenantId,
+        domain: r.domain,
+        verifiedAt: r.verifiedAt,
+        tokenExpiresAt: r.tokenExpiresAt,
+        verifyAttempts: r.verifyAttempts,
+        createdAt: r.createdAt,
+        // Only include token for unverified records so admin knows the TXT value to set.
+        ...(r.verifiedAt ? {} : {
+            verificationToken: r.verificationToken,
+            txtRecord: `skybber-verify=${r.verificationToken}`,
+            txtHost: `_skybber-verify.${r.domain}`,
+        }),
+    };
+}
+//# sourceMappingURL=domain-handler.js.map

package/dist/lib/tenant/domain-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-handler.js","sourceRoot":"","sources":["../../../src/lib/tenant/domain-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,6CAA0C;AAG1C,6DAA8D;AAC9D,6CAA8C;AAC9C,yDAAoD;AACpD,uDAAsD;AAEtD,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,yBAAyB,GAAG,IAAI,CAAC,CAAC,SAAS;AACjD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,+BAA+B,GAAG,KAAK,CAAC,CAAC,WAAW;AAC1D,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,gFAAgF;AAEhF,SAAS,aAAa;IACpB,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;IAC1D,OAAO,eAAe,QAAQ,IAAI,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IAC7D,OAAO,eAAe,QAAQ,IAAI,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,MAAc;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,MAAa,aAAa;IACxB;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,QAAgB,EAChB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,qBAAW,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,iCAAc,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YAChD,KAAK,EAAE,EAAE,MAAM,EAAE;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBACjE,wCAAwC;oBACxC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;wBAC1B,IAAI,EAAE;4BACJ,iBAAiB,EAAE,aAAa,EAAE;4BAClC,cAAc,EAAE,cAAc,EAAE;4BAChC,cAAc,EAAE,CAAC;yBAClB;qBACF,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChD,CAAC;gBACD,gCAAgC;gBAChC,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,oDAAoD;YACpD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE;gBACJ,QAAQ;gBACR,MAAM;gBACN,iBAAiB,EAAE,aAAa,EAAE;gBAClC,cAAc,EAAE,cAAc,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GAAG,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC7C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC9B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,QAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,qBAAW,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,4EAA4E;YAC5E,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBAChD,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;aAC/C,CAAC,CAAC;YAEH,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,UAAU,CAAC;oBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE;oBACnB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC7B,OAAO,IAAI,CACT;wBACE,KAAK,EAAE,eAAe;wBACtB,OAAO,EAAE,+DAA+D;wBACxE,WAAW,EAAE,qEAAqE;qBACnF,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,QAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,qBAAW,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,iDAAiD;QACjD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,IAAI,CACT;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,gCAAgC;gBACzC,WAAW,EAAE,wCAAwC;aACtD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAChE,GAAG,EACH,YAAY,EACZ,uBAAuB,EACvB,yBAAyB,CAC1B,CAAC;QACF,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAC9E;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC;iBACvD;aACF,CACF,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,SAAS,GAAG,MAAM,IAAA,mCAAiB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAEnF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;gBACvB,IAAI,EAAE;oBACJ,UAAU,EAAE,IAAI,IAAI,EAAE;oBACtB,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;iBACjC;aACF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QAED,kDAAkD;QAClD,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACvB,IAAI,EAAE;gBACJ,iBAAiB,EAAE,IAAI,IAAI,EAAE;gBAC7B,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;aACjC;SACF,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACnD,GAAG,EACH,OAAO,EACP,+BAA+B,CAChC,CAAC;QAEF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAA4B,CAAC;QACjC,IAAI,YAAY,IAAI,0BAA0B,EAAE,CAAC;YAC/C,QAAQ,GAAG,aAAa,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;gBACvB,IAAI,EAAE;oBACJ,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,cAAc,EAAE;oBAChC,cAAc,EAAE,CAAC;iBAClB;aACF,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,QAAQ,GAA2B;YACvC,cAAc,EAAE,0CAA0C;YAC1D,UAAU,EAAE,kDAAkD;YAC9D,SAAS,EAAE,4CAA4C;SACxD,CAAC;QAEF,MAAM,IAAI,GAA4B;YACpC,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,yBAAyB;YACtD,WAAW,EAAE,mCAAmC,MAAM,CAAC,MAAM,qBAAqB,MAAM,CAAC,iBAAiB,EAAE;SAC7G,CAAC;QACF,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,0EAA0E,MAAM,CAAC,MAAM,qBAAqB,QAAQ,EAAE,CAAC;QAC5I,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,+EAA+E;IAEvE,KAAK,CAAC,0BAA0B,CACtC,GAAQ,EACR,GAAW,EACX,WAAmB,EACnB,aAAqB;QAErB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5C,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE;YACpD,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,GAAQ,EACR,GAAW,EACX,aAAqB;QAErB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YAC7C,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxUD,sCAwUC;AAMD,SAAS,kBAAkB,CAAC,CAAkB;IAC5C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,iFAAiF;QACjF,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,SAAS,EAAE,kBAAkB,CAAC,CAAC,iBAAiB,EAAE;YAClD,OAAO,EAAE,mBAAmB,CAAC,CAAC,MAAM,EAAE;SACvC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/lib/tenant/domain-validator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Domain Validator
+ *
+ * Validates domain strings for tenant domain claims:
+ * - Format: valid hostname, no protocol, no path, lowercase
+ * - PSL check: rejects registrable-domain roots and public suffixes themselves
+ * - Skybber namespace: rejects *.skybber.com sub-claims
+ *
+ * Uses a bundled PSL snapshot to avoid runtime network fetches.
+ */
+export interface DomainValidationResult {
+    ok: true;
+    domain: string;
+}
+export interface DomainValidationError {
+    ok: false;
+    code: string;
+    message: string;
+}
+export type DomainValidationOutcome = DomainValidationResult | DomainValidationError;
+/**
+ * Validates and normalises a domain string for tenant claiming.
+ *
+ * Returns `{ ok: true, domain }` with the normalised domain on success,
+ * or `{ ok: false, code, message }` with a rejection reason on failure.
+ */
+export declare function validateDomain(raw: string): DomainValidationOutcome;
+//# sourceMappingURL=domain-validator.d.ts.map

package/dist/lib/tenant/domain-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-validator.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/domain-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkGH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,qBAAqB,CAAC;AAIrF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAoDnE"}

package/dist/lib/tenant/domain-validator.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * Domain Validator
+ *
+ * Validates domain strings for tenant domain claims:
+ * - Format: valid hostname, no protocol, no path, lowercase
+ * - PSL check: rejects registrable-domain roots and public suffixes themselves
+ * - Skybber namespace: rejects *.skybber.com sub-claims
+ *
+ * Uses a bundled PSL snapshot to avoid runtime network fetches.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateDomain = validateDomain;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+let pslCache = null;
+function loadPsl() {
+    if (pslCache)
+        return pslCache;
+    const snapshotPath = (0, node_path_1.join)(__dirname, "psl-snapshot.txt");
+    const lines = (0, node_fs_1.readFileSync)(snapshotPath, "utf-8").split("\n");
+    const exact = new Set();
+    const wildcards = new Set();
+    const exceptions = new Set();
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith("//"))
+            continue;
+        if (line.startsWith("!")) {
+            exceptions.add(line.slice(1).toLowerCase());
+        }
+        else if (line.startsWith("*.")) {
+            wildcards.add(line.slice(2).toLowerCase());
+        }
+        else {
+            exact.add(line.toLowerCase());
+        }
+    }
+    pslCache = { exact, wildcards, exceptions };
+    return pslCache;
+}
+// ─── Public suffix check ─────────────────────────────────────────────────────
+/**
+ * Returns true when `domain` is itself a public suffix or would be "owned"
+ * by a wildcard rule (i.e. not enough labels to form a registrable domain).
+ *
+ * Examples:
+ *   isPublicSuffix("com")        → true
+ *   isPublicSuffix("co.uk")      → true
+ *   isPublicSuffix("example.com") → false  (has a registrable label)
+ *   isPublicSuffix("foo.*.ck")   → false   (exception *.ck: !www.ck applies)
+ */
+function isPublicSuffix(domain) {
+    const psl = loadPsl();
+    const labels = domain.split(".");
+    if (psl.exact.has(domain))
+        return true;
+    // Check wildcard: if parent suffix matches a wildcard rule, this domain is
+    // itself just the minimum-registrable level — only subdomains of it are
+    // "registrable" beyond the PSL boundary.
+    if (labels.length >= 2) {
+        const parent = labels.slice(1).join(".");
+        if (psl.wildcards.has(parent)) {
+            if (!psl.exceptions.has(domain))
+                return true;
+        }
+    }
+    return false;
+}
+// ─── Basic hostname format check ─────────────────────────────────────────────
+const LABEL_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const MAX_DOMAIN_LENGTH = 253;
+function isValidHostname(domain) {
+    if (!domain || domain.length > MAX_DOMAIN_LENGTH)
+        return false;
+    if (domain.startsWith("-") || domain.endsWith("-"))
+        return false;
+    if (domain.startsWith(".") || domain.endsWith("."))
+        return false;
+    const labels = domain.split(".");
+    if (labels.length < 2)
+        return false;
+    for (const label of labels) {
+        if (!LABEL_RE.test(label))
+            return false;
+    }
+    const tld = labels[labels.length - 1];
+    if (!tld || /^\d+$/.test(tld))
+        return false;
+    return true;
+}
+const SKYBBER_SUFFIX = ".skybber.com";
+/**
+ * Validates and normalises a domain string for tenant claiming.
+ *
+ * Returns `{ ok: true, domain }` with the normalised domain on success,
+ * or `{ ok: false, code, message }` with a rejection reason on failure.
+ */
+function validateDomain(raw) {
+    if (typeof raw !== "string" || !raw) {
+        return { ok: false, code: "INVALID_DOMAIN", message: "Domain must be a non-empty string" };
+    }
+    // Strip leading/trailing whitespace and convert to lowercase.
+    // Handle IDN: Node's URL parser supports punycode implicitly via WHATWG URL.
+    let domain = raw.trim().toLowerCase();
+    // Reject if it looks like a URL.
+    if (domain.includes("://") || domain.includes("/") || domain.includes("?")) {
+        return { ok: false, code: "INVALID_DOMAIN", message: "Domain must not include a protocol or path" };
+    }
+    // Strip port if present (e.g. "example.com:8080").
+    const colonIdx = domain.indexOf(":");
+    if (colonIdx !== -1) {
+        domain = domain.slice(0, colonIdx);
+    }
+    // Attempt IDN normalisation via WHATWG URL.
+    try {
+        const url = new URL(`http://${domain}`);
+        domain = url.hostname;
+    }
+    catch {
+        return { ok: false, code: "INVALID_DOMAIN", message: "Domain is not a valid hostname" };
+    }
+    // Check for public suffix before hostname validation so single-label TLDs
+    // ("com", "net") return PUBLIC_SUFFIX rather than INVALID_DOMAIN.
+    if (isPublicSuffix(domain)) {
+        return {
+            ok: false,
+            code: "PUBLIC_SUFFIX",
+            message: "Cannot claim a public suffix domain (e.g. com, co.uk, gmail.com is fine but co.uk is not)",
+        };
+    }
+    if (!isValidHostname(domain)) {
+        return { ok: false, code: "INVALID_DOMAIN", message: "Domain is not a valid hostname" };
+    }
+    // Reject *.skybber.com sub-claims.
+    if (domain.endsWith(SKYBBER_SUFFIX) || domain === "skybber.com") {
+        return {
+            ok: false,
+            code: "RESERVED_DOMAIN",
+            message: "Cannot claim a skybber.com subdomain",
+        };
+    }
+    return { ok: true, domain };
+}
+//# sourceMappingURL=domain-validator.js.map

package/dist/lib/tenant/domain-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-validator.js","sourceRoot":"","sources":["../../../src/lib/tenant/domain-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAuHH,wCAoDC;AAzKD,qCAAuC;AACvC,yCAAiC;AAUjC,IAAI,QAAQ,GAAmB,IAAI,CAAC;AAEpC,SAAS,OAAO;IACd,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,QAAQ,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,2EAA2E;IAC3E,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AACxD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAC7F,CAAC;IAED,8DAA8D;IAC9D,6EAA6E;IAC7E,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEtC,iCAAiC;IACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACtG,CAAC;IAED,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAC1F,CAAC;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,2FAA2F;SACrG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAC1F,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/lib/tenant/domain-verifier.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Domain Verifier
+ *
+ * Performs DNS TXT record lookups to confirm that a tenant controls a domain.
+ *
+ * Protocol:
+ *   1. Tenant claims a domain → receives a token.
+ *   2. Tenant adds TXT record: `_skybber-verify.{domain}` = `skybber-verify={token}`
+ *   3. POST …/verify → this module resolves the TXT record and checks for the token.
+ *
+ * Fail-closed: any DNS error (NXDOMAIN, timeout, network failure) returns
+ * { verified: false, reason: "DNS_ERROR" }. The token must match exactly.
+ */
+export interface VerifyResult {
+    verified: true;
+}
+export interface VerifyFailure {
+    verified: false;
+    reason: "TOKEN_MISMATCH" | "NO_RECORDS" | "DNS_ERROR";
+}
+export type DnsVerifyOutcome = VerifyResult | VerifyFailure;
+/**
+ * Resolves the TXT record at `_skybber-verify.{domain}` and checks whether
+ * any value equals `skybber-verify={token}` exactly.
+ *
+ * Uses `dns.promises.resolveTxt` which does not follow HTTP redirects —
+ * there is no SSRF vector here.
+ */
+export declare function verifyDomainToken(domain: string, token: string): Promise<DnsVerifyOutcome>;
+//# sourceMappingURL=domain-verifier.d.ts.map

package/dist/lib/tenant/domain-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-verifier.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/domain-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;CACvD;AAED,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;AAI5D;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,CAAC,CA6B3B"}

package/dist/lib/tenant/domain-verifier.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Domain Verifier
+ *
+ * Performs DNS TXT record lookups to confirm that a tenant controls a domain.
+ *
+ * Protocol:
+ *   1. Tenant claims a domain → receives a token.
+ *   2. Tenant adds TXT record: `_skybber-verify.{domain}` = `skybber-verify={token}`
+ *   3. POST …/verify → this module resolves the TXT record and checks for the token.
+ *
+ * Fail-closed: any DNS error (NXDOMAIN, timeout, network failure) returns
+ * { verified: false, reason: "DNS_ERROR" }. The token must match exactly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyDomainToken = verifyDomainToken;
+const node_dns_1 = require("node:dns");
+const TXT_PREFIX = "_skybber-verify.";
+/**
+ * Resolves the TXT record at `_skybber-verify.{domain}` and checks whether
+ * any value equals `skybber-verify={token}` exactly.
+ *
+ * Uses `dns.promises.resolveTxt` which does not follow HTTP redirects —
+ * there is no SSRF vector here.
+ */
+async function verifyDomainToken(domain, token) {
+    const lookupName = `${TXT_PREFIX}${domain}`;
+    const expected = `skybber-verify=${token}`;
+    let txtRecords;
+    try {
+        txtRecords = await node_dns_1.promises.resolveTxt(lookupName);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENODATA" || code === "ENOTFOUND") {
+            return { verified: false, reason: "NO_RECORDS" };
+        }
+        return { verified: false, reason: "DNS_ERROR" };
+    }
+    if (!txtRecords || txtRecords.length === 0) {
+        return { verified: false, reason: "NO_RECORDS" };
+    }
+    // TXT records are returned as arrays of strings (chunks). Join each record's
+    // chunks and compare against the expected value.
+    for (const chunks of txtRecords) {
+        const value = chunks.join("");
+        if (value === expected) {
+            return { verified: true };
+        }
+    }
+    return { verified: false, reason: "TOKEN_MISMATCH" };
+}
+//# sourceMappingURL=domain-verifier.js.map

package/dist/lib/tenant/domain-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-verifier.js","sourceRoot":"","sources":["../../../src/lib/tenant/domain-verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAwBH,8CAgCC;AAtDD,uCAA2C;AAa3C,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,KAAa;IAEb,MAAM,UAAU,GAAG,GAAG,UAAU,GAAG,MAAM,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAE3C,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,mBAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IAED,6EAA6E;IAC7E,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACvD,CAAC"}