@open-mercato/core 0.6.1-develop.3260.1.dc719cac84 → 0.6.1-develop.3278.1.a4d26475e4

package/dist/modules/customer_accounts/api/admin/domain-mappings/[id]/health-check.js

@@ -0,0 +1,110 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const FEATURE = "customer_accounts.domain.manage";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [FEATURE] }
+};
+async function POST(req, ctx) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const rbac = container.resolve("rbacService");
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
+  const { id } = await ctx.params;
+  const service = container.resolve("domainMappingService");
+  const record = await service.findById(id, { tenantId: auth.tenantId });
+  if (!record) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+    userId: auth.sub,
+    resourceKind: "customer_accounts.domain_mapping",
+    resourceId: id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
+  let updated;
+  try {
+    updated = await service.healthCheck(id);
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : "Health check failed" },
+      { status: 500 }
+    );
+  }
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: record.organizationId,
+      userId: auth.sub,
+      resourceKind: "customer_accounts.domain_mapping",
+      resourceId: id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  return NextResponse.json({
+    ok: true,
+    domainMapping: {
+      id: updated.id,
+      hostname: updated.hostname,
+      status: updated.status,
+      tlsRetryCount: updated.tlsRetryCount,
+      tlsFailureReason: updated.tlsFailureReason ?? null
+    }
+  });
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "TLS health check for a custom domain mapping",
+  methods: {
+    POST: {
+      summary: "Trigger TLS health check",
+      description: "Runs an HTTPS probe to verify Traefik has provisioned a certificate. On success: transitions the mapping to active.",
+      responses: [
+        {
+          status: 200,
+          description: "OK",
+          schema: z.object({
+            ok: z.literal(true),
+            domainMapping: z.object({
+              id: z.string().uuid(),
+              hostname: z.string(),
+              status: z.string(),
+              tlsRetryCount: z.number().int().nonnegative(),
+              tlsFailureReason: z.string().nullable()
+            })
+          })
+        }
+      ],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 404, description: "Not found", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=health-check.js.map

package/dist/modules/customer_accounts/api/admin/domain-mappings/[id]/health-check.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/customer_accounts/api/admin/domain-mappings/%5Bid%5D/health-check.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nconst FEATURE = 'customer_accounts.domain.manage'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve('rbacService') as RbacService\n  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })\n\n  const { id } = await ctx.params\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const record = await service.findById(id, { tenantId: auth.tenantId })\n  if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: record.organizationId,\n    userId: auth.sub,\n    resourceKind: 'customer_accounts.domain_mapping',\n    resourceId: id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let updated\n  try {\n    updated = await service.healthCheck(id)\n  } catch (err) {\n    return NextResponse.json(\n      { ok: false, error: err instanceof Error ? err.message : 'Health check failed' },\n      { status: 500 },\n    )\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: record.organizationId,\n      userId: auth.sub,\n      resourceKind: 'customer_accounts.domain_mapping',\n      resourceId: id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    domainMapping: {\n      id: updated.id,\n      hostname: updated.hostname,\n      status: updated.status,\n      tlsRetryCount: updated.tlsRetryCount,\n      tlsFailureReason: updated.tlsFailureReason ?? null,\n    },\n  })\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'TLS health check for a custom domain mapping',\n  methods: {\n    POST: {\n      summary: 'Trigger TLS health check',\n      description:\n        'Runs an HTTPS probe to verify Traefik has provisioned a certificate. On success: transitions the mapping to active.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK',\n          schema: z.object({\n            ok: z.literal(true),\n            domainMapping: z.object({\n              id: z.string().uuid(),\n              hostname: z.string(),\n              status: z.string(),\n              tlsRetryCount: z.number().int().nonnegative(),\n              tlsFailureReason: z.string().nullable(),\n            }),\n          }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 404, description: 'Not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,UAAU;AAET,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACxD;AAEA,eAAsB,KAAK,KAAc,KAA0C;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,EAAE,GAAG,IAAI,MAAM,IAAI;AACzB,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC;AACrE,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExF,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,YAAY,EAAE;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,IAAI,OAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,sBAAsB;AAAA,MAC/E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO;AAAA,MACvB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,eAAe;AAAA,MACb,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,eAAe,QAAQ;AAAA,MACvB,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,eAAe,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,UAAU,EAAE,OAAO;AAAA,cACnB,QAAQ,EAAE,OAAO;AAAA,cACjB,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,cAC5C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,YACxC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/admin/domain-mappings/[id]/verify.js

@@ -0,0 +1,114 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const FEATURE = "customer_accounts.domain.manage";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [FEATURE] }
+};
+async function POST(req, ctx) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const rbac = container.resolve("rbacService");
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
+  const { id } = await ctx.params;
+  const service = container.resolve("domainMappingService");
+  const record = await service.findById(id, { tenantId: auth.tenantId });
+  if (!record) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+    userId: auth.sub,
+    resourceKind: "customer_accounts.domain_mapping",
+    resourceId: id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
+  let result;
+  try {
+    result = await service.verify(id);
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : "DNS verification failed" },
+      { status: 500 }
+    );
+  }
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: record.organizationId,
+      userId: auth.sub,
+      resourceKind: "customer_accounts.domain_mapping",
+      resourceId: id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  return NextResponse.json({
+    ok: true,
+    domainMapping: {
+      id: result.domainMapping.id,
+      hostname: result.domainMapping.hostname,
+      status: result.domainMapping.status,
+      verifiedAt: result.domainMapping.verifiedAt?.toISOString() ?? null,
+      lastDnsCheckAt: result.domainMapping.lastDnsCheckAt?.toISOString() ?? null,
+      dnsFailureReason: result.domainMapping.dnsFailureReason ?? null
+    },
+    diagnostics: result.diagnostics ?? null
+  });
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "Verify a custom domain mapping (DNS check)",
+  methods: {
+    POST: {
+      summary: "Trigger DNS verification",
+      description: "Runs DNS verification (CNAME \u2192 A \u2192 reverse-resolve fallback) for the domain mapping. Returns diagnostics on failure.",
+      responses: [
+        {
+          status: 200,
+          description: "OK \u2014 see status",
+          schema: z.object({
+            ok: z.literal(true),
+            domainMapping: z.object({
+              id: z.string().uuid(),
+              hostname: z.string(),
+              status: z.string(),
+              verifiedAt: z.string().nullable(),
+              lastDnsCheckAt: z.string().nullable(),
+              dnsFailureReason: z.string().nullable()
+            }),
+            diagnostics: z.unknown().nullable()
+          })
+        }
+      ],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 404, description: "Not found", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=verify.js.map

package/dist/modules/customer_accounts/api/admin/domain-mappings/[id]/verify.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/customer_accounts/api/admin/domain-mappings/%5Bid%5D/verify.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nconst FEATURE = 'customer_accounts.domain.manage'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve('rbacService') as RbacService\n  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })\n\n  const { id } = await ctx.params\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const record = await service.findById(id, { tenantId: auth.tenantId })\n  if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: record.organizationId,\n    userId: auth.sub,\n    resourceKind: 'customer_accounts.domain_mapping',\n    resourceId: id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let result\n  try {\n    result = await service.verify(id)\n  } catch (err) {\n    return NextResponse.json(\n      { ok: false, error: err instanceof Error ? err.message : 'DNS verification failed' },\n      { status: 500 },\n    )\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: record.organizationId,\n      userId: auth.sub,\n      resourceKind: 'customer_accounts.domain_mapping',\n      resourceId: id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    domainMapping: {\n      id: result.domainMapping.id,\n      hostname: result.domainMapping.hostname,\n      status: result.domainMapping.status,\n      verifiedAt: result.domainMapping.verifiedAt?.toISOString() ?? null,\n      lastDnsCheckAt: result.domainMapping.lastDnsCheckAt?.toISOString() ?? null,\n      dnsFailureReason: result.domainMapping.dnsFailureReason ?? null,\n    },\n    diagnostics: result.diagnostics ?? null,\n  })\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Verify a custom domain mapping (DNS check)',\n  methods: {\n    POST: {\n      summary: 'Trigger DNS verification',\n      description:\n        'Runs DNS verification (CNAME \u2192 A \u2192 reverse-resolve fallback) for the domain mapping. Returns diagnostics on failure.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK \u2014 see status',\n          schema: z.object({\n            ok: z.literal(true),\n            domainMapping: z.object({\n              id: z.string().uuid(),\n              hostname: z.string(),\n              status: z.string(),\n              verifiedAt: z.string().nullable(),\n              lastDnsCheckAt: z.string().nullable(),\n              dnsFailureReason: z.string().nullable(),\n            }),\n            diagnostics: z.unknown().nullable(),\n          }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 404, description: 'Not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAGP,MAAM,UAAU;AAET,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACxD;AAEA,eAAsB,KAAK,KAAc,KAA0C;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,EAAE,GAAG,IAAI,MAAM,IAAI;AACzB,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC;AACrE,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAExF,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,QAAQ,OAAO,EAAE;AAAA,EAClC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,IAAI,OAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO;AAAA,MACvB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,eAAe;AAAA,MACb,IAAI,OAAO,cAAc;AAAA,MACzB,UAAU,OAAO,cAAc;AAAA,MAC/B,QAAQ,OAAO,cAAc;AAAA,MAC7B,YAAY,OAAO,cAAc,YAAY,YAAY,KAAK;AAAA,MAC9D,gBAAgB,OAAO,cAAc,gBAAgB,YAAY,KAAK;AAAA,MACtE,kBAAkB,OAAO,cAAc,oBAAoB;AAAA,IAC7D;AAAA,IACA,aAAa,OAAO,eAAe;AAAA,EACrC,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,eAAe,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,UAAU,EAAE,OAAO;AAAA,cACnB,QAAQ,EAAE,OAAO;AAAA,cACjB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,cAChC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,cACpC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,YACxC,CAAC;AAAA,YACD,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/admin/domain-mappings.js

@@ -0,0 +1,271 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { UniqueConstraintViolationException } from "@mikro-orm/core";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+import { registerDomainSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import { DomainMapping } from "@open-mercato/core/modules/customer_accounts/data/entities";
+const FEATURE = "customer_accounts.domain.manage";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [FEATURE] },
+  POST: { requireAuth: true, requireFeatures: [FEATURE] },
+  DELETE: { requireAuth: true, requireFeatures: [FEATURE] }
+};
+function isUniqueViolation(error) {
+  if (error instanceof UniqueConstraintViolationException) return true;
+  if (!error || typeof error !== "object") return false;
+  const code = error.code;
+  if (code === "23505") return true;
+  const messageRaw = error.message;
+  const message = typeof messageRaw === "string" ? messageRaw : "";
+  return message.toLowerCase().includes("duplicate key");
+}
+function serializeRecord(record) {
+  return {
+    id: record.id,
+    hostname: record.hostname,
+    organizationId: record.organizationId,
+    tenantId: record.tenantId,
+    provider: record.provider,
+    status: record.status,
+    verifiedAt: record.verifiedAt?.toISOString() ?? null,
+    lastDnsCheckAt: record.lastDnsCheckAt?.toISOString() ?? null,
+    dnsFailureReason: record.dnsFailureReason ?? null,
+    tlsFailureReason: record.tlsFailureReason ?? null,
+    tlsRetryCount: record.tlsRetryCount,
+    cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,
+    aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt?.toISOString() ?? null
+  };
+}
+async function GET(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const rbac = container.resolve("rbacService");
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
+  const url = new URL(req.url);
+  const orgFilter = url.searchParams.get("organizationId");
+  const em = container.resolve("em");
+  const where = { tenantId: auth.tenantId };
+  if (orgFilter) where.organizationId = orgFilter;
+  const records = await em.find(DomainMapping, where, { orderBy: { createdAt: "desc" } });
+  return NextResponse.json({
+    ok: true,
+    domainMappings: records.map(serializeRecord),
+    config: {
+      cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,
+      aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null
+    }
+  });
+}
+async function POST(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const rbac = container.resolve("rbacService");
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
+  const body = await readJsonSafe(req, {});
+  const parsed = registerDomainSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { ok: false, error: "Invalid request", issues: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: parsed.data.organizationId,
+    userId: auth.sub,
+    resourceKind: "customer_accounts.domain_mapping",
+    resourceId: parsed.data.organizationId,
+    operation: "create",
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
+  const service = container.resolve("domainMappingService");
+  let entity;
+  try {
+    entity = await service.register({
+      hostname: parsed.data.hostname,
+      organizationId: parsed.data.organizationId,
+      tenantId: auth.tenantId,
+      replacesDomainId: parsed.data.replacesDomainId
+    });
+  } catch (err) {
+    if (isUniqueViolation(err)) {
+      return NextResponse.json(
+        { ok: false, error: "This domain is not available. Please choose a different hostname." },
+        { status: 409 }
+      );
+    }
+    const message = err instanceof Error ? err.message : "Failed to register domain";
+    return NextResponse.json({ ok: false, error: message }, { status: 500 });
+  }
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: parsed.data.organizationId,
+      userId: auth.sub,
+      resourceKind: "customer_accounts.domain_mapping",
+      resourceId: entity.id,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  return NextResponse.json({ ok: true, domainMapping: serializeRecord(entity) }, { status: 201 });
+}
+async function DELETE(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
+  const container = await createRequestContainer();
+  const rbac = container.resolve("rbacService");
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
+  const url = new URL(req.url);
+  const id = url.searchParams.get("id");
+  if (!id) return NextResponse.json({ ok: false, error: "id is required" }, { status: 400 });
+  const service = container.resolve("domainMappingService");
+  const existing = await service.findById(id, { tenantId: auth.tenantId });
+  if (!existing) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: existing.organizationId,
+    userId: auth.sub,
+    resourceKind: "customer_accounts.domain_mapping",
+    resourceId: id,
+    operation: "delete",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
+  await service.remove(id, { tenantId: auth.tenantId });
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: existing.organizationId,
+      userId: auth.sub,
+      resourceKind: "customer_accounts.domain_mapping",
+      resourceId: id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  return NextResponse.json({ ok: true });
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const domainMappingSchema = z.object({
+  id: z.string().uuid(),
+  hostname: z.string(),
+  organizationId: z.string().uuid(),
+  tenantId: z.string().uuid(),
+  provider: z.literal("traefik"),
+  status: z.enum(["pending", "verified", "active", "dns_failed", "tls_failed"]),
+  verifiedAt: z.string().nullable(),
+  lastDnsCheckAt: z.string().nullable(),
+  dnsFailureReason: z.string().nullable(),
+  tlsFailureReason: z.string().nullable(),
+  tlsRetryCount: z.number().int().nonnegative(),
+  cnameTarget: z.string().nullable(),
+  aRecordTarget: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string().nullable()
+});
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "Custom portal domain mappings (admin)",
+  methods: {
+    GET: {
+      summary: "List domain mappings",
+      description: "Returns all custom-domain mappings for the current tenant, optionally filtered by organization.",
+      responses: [
+        {
+          status: 200,
+          description: "OK",
+          schema: z.object({
+            ok: z.literal(true),
+            domainMappings: z.array(domainMappingSchema),
+            config: z.object({
+              cnameTarget: z.string().nullable(),
+              aRecordTarget: z.string().nullable()
+            })
+          })
+        }
+      ],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema }
+      ]
+    },
+    POST: {
+      summary: "Register a custom domain",
+      description: "Registers a new custom domain mapping for an organization. Verifies via DNS asynchronously.",
+      requestBody: {
+        contentType: "application/json",
+        schema: z.object({
+          hostname: z.string(),
+          organizationId: z.string().uuid(),
+          replacesDomainId: z.string().uuid().optional()
+        })
+      },
+      responses: [
+        {
+          status: 201,
+          description: "Created",
+          schema: z.object({ ok: z.literal(true), domainMapping: domainMappingSchema })
+        }
+      ],
+      errors: [
+        { status: 400, description: "Validation error", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 409, description: "Conflict", schema: errorSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Remove a custom domain",
+      description: "Removes the domain mapping identified by ?id=. Cache and Traefik routing drain within TTL.",
+      responses: [{ status: 200, description: "OK", schema: z.object({ ok: z.literal(true) }) }],
+      errors: [
+        { status: 400, description: "Bad request", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=domain-mappings.js.map

package/dist/modules/customer_accounts/api/admin/domain-mappings.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customer_accounts/api/admin/domain-mappings.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { UniqueConstraintViolationException } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { registerDomainSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport {\n  DomainMappingService,\n  type ResolveResult,\n} from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { DomainMapping } from '@open-mercato/core/modules/customer_accounts/data/entities'\n\nconst FEATURE = 'customer_accounts.domain.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  if (error instanceof UniqueConstraintViolationException) return true\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: string }).code\n  if (code === '23505') return true\n  const messageRaw = (error as { message?: string }).message\n  const message = typeof messageRaw === 'string' ? messageRaw : ''\n  return message.toLowerCase().includes('duplicate key')\n}\n\nfunction serializeRecord(record: DomainMapping) {\n  return {\n    id: record.id,\n    hostname: record.hostname,\n    organizationId: record.organizationId,\n    tenantId: record.tenantId,\n    provider: record.provider,\n    status: record.status,\n    verifiedAt: record.verifiedAt?.toISOString() ?? null,\n    lastDnsCheckAt: record.lastDnsCheckAt?.toISOString() ?? null,\n    dnsFailureReason: record.dnsFailureReason ?? null,\n    tlsFailureReason: record.tlsFailureReason ?? null,\n    tlsRetryCount: record.tlsRetryCount,\n    cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,\n    aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null,\n    createdAt: record.createdAt.toISOString(),\n    updatedAt: record.updatedAt?.toISOString() ?? null,\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve('rbacService') as RbacService\n  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })\n\n  const url = new URL(req.url)\n  const orgFilter = url.searchParams.get('organizationId')\n\n  const em = container.resolve('em') as EntityManager\n  const where: Record<string, unknown> = { tenantId: auth.tenantId }\n  if (orgFilter) where.organizationId = orgFilter\n  const records = await em.find(DomainMapping, where as never, { orderBy: { createdAt: 'desc' } })\n\n  return NextResponse.json({\n    ok: true,\n    domainMappings: records.map(serializeRecord),\n    config: {\n      cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,\n      aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null,\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve('rbacService') as RbacService\n  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })\n\n  const body = await readJsonSafe(req, {})\n  const parsed = registerDomainSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { ok: false, error: 'Invalid request', issues: parsed.error.flatten() },\n      { status: 400 },\n    )\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: parsed.data.organizationId,\n    userId: auth.sub,\n    resourceKind: 'customer_accounts.domain_mapping',\n    resourceId: parsed.data.organizationId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data as unknown as Record<string, unknown>,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const service = container.resolve('domainMappingService') as DomainMappingService\n\n  let entity: DomainMapping\n  try {\n    // service.register normalizes hostname internally \u2014 guards may have\n    // returned modifiedPayload but the typed runner doesn't expose it,\n    // so we rely on the service for the canonical form.\n    entity = await service.register({\n      hostname: parsed.data.hostname,\n      organizationId: parsed.data.organizationId,\n      tenantId: auth.tenantId,\n      replacesDomainId: parsed.data.replacesDomainId,\n    })\n  } catch (err: unknown) {\n    if (isUniqueViolation(err)) {\n      return NextResponse.json(\n        { ok: false, error: 'This domain is not available. Please choose a different hostname.' },\n        { status: 409 },\n      )\n    }\n    const message = err instanceof Error ? err.message : 'Failed to register domain'\n    return NextResponse.json({ ok: false, error: message }, { status: 500 })\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: parsed.data.organizationId,\n      userId: auth.sub,\n      resourceKind: 'customer_accounts.domain_mapping',\n      resourceId: entity.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, domainMapping: serializeRecord(entity) }, { status: 201 })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve('rbacService') as RbacService\n  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })\n\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id')\n  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })\n\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const existing = await service.findById(id, { tenantId: auth.tenantId })\n  if (!existing) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: existing.organizationId,\n    userId: auth.sub,\n    resourceKind: 'customer_accounts.domain_mapping',\n    resourceId: id,\n    operation: 'delete',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  await service.remove(id, { tenantId: auth.tenantId })\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: existing.organizationId,\n      userId: auth.sub,\n      resourceKind: 'customer_accounts.domain_mapping',\n      resourceId: id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\nconst domainMappingSchema = z.object({\n  id: z.string().uuid(),\n  hostname: z.string(),\n  organizationId: z.string().uuid(),\n  tenantId: z.string().uuid(),\n  provider: z.literal('traefik'),\n  status: z.enum(['pending', 'verified', 'active', 'dns_failed', 'tls_failed']),\n  verifiedAt: z.string().nullable(),\n  lastDnsCheckAt: z.string().nullable(),\n  dnsFailureReason: z.string().nullable(),\n  tlsFailureReason: z.string().nullable(),\n  tlsRetryCount: z.number().int().nonnegative(),\n  cnameTarget: z.string().nullable(),\n  aRecordTarget: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string().nullable(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Custom portal domain mappings (admin)',\n  methods: {\n    GET: {\n      summary: 'List domain mappings',\n      description: 'Returns all custom-domain mappings for the current tenant, optionally filtered by organization.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK',\n          schema: z.object({\n            ok: z.literal(true),\n            domainMappings: z.array(domainMappingSchema),\n            config: z.object({\n              cnameTarget: z.string().nullable(),\n              aRecordTarget: z.string().nullable(),\n            }),\n          }),\n        },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Register a custom domain',\n      description: 'Registers a new custom domain mapping for an organization. Verifies via DNS asynchronously.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: z.object({\n          hostname: z.string(),\n          organizationId: z.string().uuid(),\n          replacesDomainId: z.string().uuid().optional(),\n        }),\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Created',\n          schema: z.object({ ok: z.literal(true), domainMapping: domainMappingSchema }),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 409, description: 'Conflict', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Remove a custom domain',\n      description: 'Removes the domain mapping identified by ?id=. Cache and Traefik routing drain within TTL.',\n      responses: [{ status: 200, description: 'OK', schema: z.object({ ok: z.literal(true) }) }],\n      errors: [\n        { status: 400, description: 'Bad request', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n      ],\n    },\n  },\n}\n\n// Re-export resolve type so tests can import without indirect lookup\nexport type { ResolveResult }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0CAA0C;AAGnD,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AAKrC,SAAS,qBAAqB;AAE9B,MAAM,UAAU;AAET,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACrD,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACtD,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAC1D;AAEA,SAAS,kBAAkB,OAAyB;AAClD,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA4B;AAC1C,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,aAAc,MAA+B;AACnD,QAAM,UAAU,OAAO,eAAe,WAAW,aAAa;AAC9D,SAAO,QAAQ,YAAY,EAAE,SAAS,eAAe;AACvD;AAEA,SAAS,gBAAgB,QAAuB;AAC9C,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO,YAAY,YAAY,KAAK;AAAA,IAChD,gBAAgB,OAAO,gBAAgB,YAAY,KAAK;AAAA,IACxD,kBAAkB,OAAO,oBAAoB;AAAA,IAC7C,kBAAkB,OAAO,oBAAoB;AAAA,IAC7C,eAAe,OAAO;AAAA,IACtB,aAAa,QAAQ,IAAI,8BAA8B;AAAA,IACvD,eAAe,QAAQ,IAAI,iCAAiC;AAAA,IAC5D,WAAW,OAAO,UAAU,YAAY;AAAA,IACxC,WAAW,OAAO,WAAW,YAAY,KAAK;AAAA,EAChD;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,YAAY,IAAI,aAAa,IAAI,gBAAgB;AAEvD,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAiC,EAAE,UAAU,KAAK,SAAS;AACjE,MAAI,UAAW,OAAM,iBAAiB;AACtC,QAAM,UAAU,MAAM,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE,CAAC;AAE/F,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,gBAAgB,QAAQ,IAAI,eAAe;AAAA,IAC3C,QAAQ;AAAA,MACN,aAAa,QAAQ,IAAI,8BAA8B;AAAA,MACvD,eAAe,QAAQ,IAAI,iCAAiC;AAAA,IAC9D;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC;AACvC,QAAM,SAAS,qBAAqB,UAAU,IAAI;AAClD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,IAAI,OAAO,OAAO,mBAAmB,QAAQ,OAAO,MAAM,QAAQ,EAAE;AAAA,MACtE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,OAAO,KAAK;AAAA,IAC5B,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,OAAO,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AAExD,MAAI;AACJ,MAAI;AAIF,aAAS,MAAM,QAAQ,SAAS;AAAA,MAC9B,UAAU,OAAO,KAAK;AAAA,MACtB,gBAAgB,OAAO,KAAK;AAAA,MAC5B,UAAU,KAAK;AAAA,MACf,kBAAkB,OAAO,KAAK;AAAA,IAChC,CAAC;AAAA,EACH,SAAS,KAAc;AACrB,QAAI,kBAAkB,GAAG,GAAG;AAC1B,aAAO,aAAa;AAAA,QAClB,EAAE,IAAI,OAAO,OAAO,oEAAoE;AAAA,QACxF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,KAAK;AAAA,MAC5B,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,eAAe,gBAAgB,MAAM,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,UAAU,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG;AAAA,IACjE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI;AACpC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC;AACvE,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,SAAS;AAAA,IACzB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,QAAQ,OAAO,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC;AAEpD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,SAAS;AAAA,MACzB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACxE,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,UAAU,EAAE,QAAQ,SAAS;AAAA,EAC7B,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,cAAc,YAAY,CAAC;AAAA,EAC5E,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,gBAAgB,EAAE,MAAM,mBAAmB;AAAA,YAC3C,QAAQ,EAAE,OAAO;AAAA,cACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,cACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,YACrC,CAAC;AAAA,UACH,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,EAAE,OAAO;AAAA,UACf,UAAU,EAAE,OAAO;AAAA,UACnB,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,UAChC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,eAAe,oBAAoB,CAAC;AAAA,QAC9E;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,YAAY;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,MAAM,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,YAAY;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/domain-check.js

@@ -0,0 +1,70 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
+import { secretEqual } from "@open-mercato/core/modules/customer_accounts/lib/secretCompare";
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin";
+const metadata = {
+  GET: { requireAuth: false }
+};
+function withOriginHeader(response) {
+  response.headers.set(ORIGIN_HEADER_NAME, "1");
+  return response;
+}
+function unauthorized(message) {
+  return withOriginHeader(NextResponse.json({ ok: false, error: message }, { status: 403 }));
+}
+function notFound() {
+  return withOriginHeader(NextResponse.json({ ok: false, error: "Not found" }, { status: 404 }));
+}
+function ok() {
+  return withOriginHeader(NextResponse.json({ ok: true }));
+}
+async function GET(req) {
+  const expected = process.env.DOMAIN_CHECK_SECRET;
+  if (!expected) {
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: "DOMAIN_CHECK_SECRET is not configured on the server" },
+        { status: 503 }
+      )
+    );
+  }
+  const supplied = req.headers.get("x-domain-check-secret");
+  if (!secretEqual(supplied, expected)) return unauthorized("Forbidden");
+  const url = new URL(req.url);
+  const rawHost = url.searchParams.get("host") ?? req.headers.get("x-forwarded-host");
+  if (!rawHost) return notFound();
+  const hostname = tryNormalizeHostname(rawHost);
+  if (!hostname) return notFound();
+  const container = await createRequestContainer();
+  const service = container.resolve("domainMappingService");
+  const result = await service.isAllowedForTls(hostname);
+  if (!result) return notFound();
+  return ok();
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "Traefik domain-check gate",
+  methods: {
+    GET: {
+      summary: "Verify a hostname is allowed for TLS provisioning",
+      description: "Called by Traefik before issuing a Let's Encrypt certificate. Requires the X-Domain-Check-Secret header to match DOMAIN_CHECK_SECRET.",
+      responses: [
+        { status: 200, description: "Hostname allowed", schema: z.object({ ok: z.literal(true) }) }
+      ],
+      errors: [
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 404, description: "Hostname not registered or not yet verified", schema: errorSchema },
+        { status: 503, description: "Server misconfiguration", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=domain-check.js.map