@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3278.1.a4d26475e4

package/dist/modules/customer_accounts/services/domainMappingService.js

@@ -0,0 +1,497 @@
+import { Resolver, promises as dnsPromises } from "node:dns";
+import { request as httpsRequest } from "node:https";
+import { setTimeout as delay } from "node:timers/promises";
+import {
+  DomainMapping
+} from "@open-mercato/core/modules/customer_accounts/data/entities";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
+import { emitCustomerAccountsEvent } from "@open-mercato/core/modules/customer_accounts/events";
+import { normalizeHostname, tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
+import { platformDomains } from "@open-mercato/core/modules/customer_accounts/lib/platformDomains";
+import { detectProxy, isInKnownProxyRange } from "@open-mercato/core/modules/customer_accounts/lib/proxyRanges";
+const DOMAIN_ROUTING_TAG = "domain_routing";
+const RESOLVE_KEY_PREFIX = "domain_routing:resolve";
+const ACTIVE_BY_ORG_KEY_PREFIX = "domain_routing:active-by-org";
+const RESOLVE_TTL_MS = 5 * 6e4;
+const TLS_HEALTH_CHECK_TIMEOUT_MS = 1e4;
+const TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1e3, 4e3, 16e3];
+const DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 6e4;
+const DEFAULT_TLS_MAX_RETRIES = 6;
+const defaultDnsResolver = {
+  async resolveCname(hostname) {
+    try {
+      return await dnsPromises.resolveCname(hostname);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENODATA" || code === "ENOTFOUND") return [];
+      throw err;
+    }
+  },
+  async resolve4(hostname) {
+    try {
+      return await dnsPromises.resolve4(hostname);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENODATA" || code === "ENOTFOUND") return [];
+      throw err;
+    }
+  }
+};
+const defaultHealthCheck = (hostname, timeoutMs) => new Promise((resolve) => {
+  const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin").toLowerCase();
+  const req = httpsRequest(
+    {
+      host: hostname,
+      port: 443,
+      path: "/api/customer_accounts/domain-check",
+      method: "GET",
+      headers: { "X-Domain-Check-Secret": process.env.DOMAIN_CHECK_SECRET ?? "" },
+      timeout: timeoutMs
+    },
+    (res) => {
+      const headerValue = res.headers[headerName];
+      const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+      const originHeaderPresent = typeof originHeader === "string" && originHeader === "1";
+      const status = res.statusCode ?? 0;
+      res.resume();
+      resolve({
+        ok: status >= 200 && status < 400,
+        originHeaderPresent,
+        reason: status >= 200 && status < 400 ? void 0 : `HTTP ${status}`
+      });
+    }
+  );
+  req.on("timeout", () => {
+    req.destroy(new Error("TLS health check timed out"));
+  });
+  req.on("error", (err) => {
+    resolve({ ok: false, originHeaderPresent: false, reason: err.message });
+  });
+  req.end();
+});
+class DomainMappingService {
+  constructor(em, deps) {
+    this.em = em;
+    this.cache = deps?.cacheService ?? null;
+    this.dns = deps?.dnsResolver ?? defaultDnsResolver;
+    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck;
+  }
+  // -------------------------------------------------------------------------
+  // Read paths
+  // -------------------------------------------------------------------------
+  async findById(id, scope) {
+    const where = { id };
+    if (scope?.tenantId) where.tenantId = scope.tenantId;
+    return this.em.findOne(DomainMapping, where);
+  }
+  async findByOrganization(organizationId, scope) {
+    const where = { organizationId };
+    if (scope?.tenantId) where.tenantId = scope.tenantId;
+    return this.em.find(DomainMapping, where, { orderBy: { createdAt: "asc" } });
+  }
+  async resolveByHostname(input) {
+    const hostname = tryNormalizeHostname(input);
+    if (!hostname) return null;
+    if (platformDomains().includes(hostname)) return null;
+    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`;
+    if (this.cache) {
+      const cached = await this.cache.get(cacheKey);
+      if (cached !== void 0 && cached !== null) return cached;
+    }
+    const result = await this.lookupResolveResult(hostname);
+    if (this.cache) {
+      await this.cache.set(cacheKey, result, {
+        ttl: RESOLVE_TTL_MS,
+        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]
+      });
+    }
+    return result;
+  }
+  async isAllowedForTls(input) {
+    const hostname = tryNormalizeHostname(input);
+    if (!hostname) return null;
+    if (platformDomains().includes(hostname)) return null;
+    const row = await this.em.findOne(DomainMapping, {
+      hostname,
+      status: { $in: ["active", "verified"] }
+    });
+    if (!row) return null;
+    return { organizationId: row.organizationId, status: row.status };
+  }
+  async resolveActiveByOrg(organizationId) {
+    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`;
+    if (this.cache) {
+      const cached = await this.cache.get(cacheKey);
+      if (cached !== void 0 && cached !== null) return cached;
+    }
+    const row = await this.em.findOne(DomainMapping, {
+      organizationId,
+      status: "active"
+    });
+    const result = row ? { hostname: row.hostname, status: row.status } : null;
+    if (this.cache) {
+      await this.cache.set(cacheKey, result, {
+        ttl: RESOLVE_TTL_MS,
+        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`]
+      });
+    }
+    return result;
+  }
+  async resolveAll() {
+    const rows = await this.em.find(DomainMapping, { status: "active" });
+    if (rows.length === 0) return [];
+    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)));
+    const orgs = await this.em.find(Organization, { id: { $in: orgIds } });
+    const slugByOrg = new Map(orgs.map((o) => [o.id, o.slug ?? null]));
+    return rows.map((row) => ({
+      domainMappingId: row.id,
+      hostname: row.hostname,
+      tenantId: row.tenantId,
+      organizationId: row.organizationId,
+      orgSlug: slugByOrg.get(row.organizationId) ?? null,
+      status: row.status
+    }));
+  }
+  // -------------------------------------------------------------------------
+  // Worker queries
+  // -------------------------------------------------------------------------
+  async findPendingVerification(threshold) {
+    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS;
+    const cutoff = new Date(Date.now() - olderThan);
+    return this.em.find(
+      DomainMapping,
+      {
+        status: { $in: ["pending", "dns_failed"] },
+        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }]
+      },
+      { orderBy: { lastDnsCheckAt: "asc" } }
+    );
+  }
+  async findPendingTls(options) {
+    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES;
+    const limit = options?.batchSize ?? 50;
+    return this.em.find(
+      DomainMapping,
+      {
+        $or: [
+          { status: "verified" },
+          { status: "tls_failed", tlsRetryCount: { $lt: maxRetries } }
+        ]
+      },
+      { orderBy: { updatedAt: "asc" }, limit }
+    );
+  }
+  // -------------------------------------------------------------------------
+  // Write paths
+  // -------------------------------------------------------------------------
+  async register(input) {
+    const hostname = normalizeHostname(input.hostname);
+    let replacesDomain = null;
+    if (input.replacesDomainId) {
+      replacesDomain = await this.em.findOne(DomainMapping, {
+        id: input.replacesDomainId,
+        tenantId: input.tenantId
+      });
+    }
+    const entity = this.em.create(DomainMapping, {
+      hostname,
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+      replacesDomain: replacesDomain ?? null,
+      provider: "traefik",
+      status: "pending",
+      tlsRetryCount: 0,
+      createdAt: /* @__PURE__ */ new Date()
+    });
+    await this.em.persist(entity).flush();
+    await emitCustomerAccountsEvent("customer_accounts.domain_mapping.created", {
+      id: entity.id,
+      hostname: entity.hostname,
+      organizationId: entity.organizationId,
+      tenantId: entity.tenantId,
+      status: entity.status
+    });
+    await this.invalidateCacheFor(entity.hostname, entity.organizationId);
+    return entity;
+  }
+  async verify(id) {
+    const entity = await this.em.findOne(DomainMapping, { id });
+    if (!entity) throw new Error(`DomainMapping ${id} not found`);
+    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? "";
+    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null;
+    const now = /* @__PURE__ */ new Date();
+    entity.lastDnsCheckAt = now;
+    const verification = await this.runDnsVerification(entity.hostname, {
+      expectedCname,
+      expectedARecord
+    });
+    if (verification.ok) {
+      entity.status = "verified";
+      entity.verifiedAt = now;
+      entity.dnsFailureReason = null;
+      entity.tlsRetryCount = 0;
+      entity.tlsFailureReason = null;
+      await this.em.persist(entity).flush();
+      await emitCustomerAccountsEvent("customer_accounts.domain_mapping.verified", {
+        id: entity.id,
+        hostname: entity.hostname,
+        organizationId: entity.organizationId,
+        tenantId: entity.tenantId
+      });
+      await this.invalidateCacheFor(entity.hostname, entity.organizationId);
+      return { domainMapping: entity };
+    }
+    entity.status = "dns_failed";
+    entity.dnsFailureReason = verification.reason;
+    await this.em.persist(entity).flush();
+    await emitCustomerAccountsEvent("customer_accounts.domain_mapping.dns_failed", {
+      id: entity.id,
+      hostname: entity.hostname,
+      organizationId: entity.organizationId,
+      tenantId: entity.tenantId,
+      reason: verification.reason,
+      detectedRecords: verification.diagnostics.detectedRecords
+    });
+    await this.invalidateCacheFor(entity.hostname, entity.organizationId);
+    return { domainMapping: entity, diagnostics: verification.diagnostics };
+  }
+  async activate(id) {
+    const entity = await this.em.findOne(DomainMapping, { id });
+    if (!entity) throw new Error(`DomainMapping ${id} not found`);
+    if (entity.status === "active") return entity;
+    if (entity.status !== "verified" && entity.status !== "tls_failed") {
+      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`);
+    }
+    entity.status = "active";
+    entity.tlsRetryCount = 0;
+    entity.tlsFailureReason = null;
+    await this.em.persist(entity).flush();
+    await emitCustomerAccountsEvent("customer_accounts.domain_mapping.activated", {
+      id: entity.id,
+      hostname: entity.hostname,
+      organizationId: entity.organizationId,
+      tenantId: entity.tenantId
+    });
+    if (entity.replacesDomain) {
+      const replaced = await this.em.findOne(DomainMapping, {
+        id: entity.replacesDomain.id
+      });
+      if (replaced) {
+        const replacedHostname = replaced.hostname;
+        const replacedOrg = replaced.organizationId;
+        this.em.remove(replaced);
+        await this.em.flush();
+        await emitCustomerAccountsEvent("customer_accounts.domain_mapping.replaced", {
+          id: entity.id,
+          hostname: entity.hostname,
+          organizationId: entity.organizationId,
+          tenantId: entity.tenantId,
+          replacedDomainId: replaced.id,
+          replacedHostname
+        });
+        await emitCustomerAccountsEvent("customer_accounts.domain_mapping.deleted", {
+          id: replaced.id,
+          hostname: replacedHostname,
+          organizationId: replacedOrg,
+          tenantId: replaced.tenantId
+        });
+        await this.invalidateCacheFor(replacedHostname, replacedOrg);
+      }
+    }
+    await this.invalidateCacheFor(entity.hostname, entity.organizationId);
+    return entity;
+  }
+  async remove(id, scope) {
+    const where = { id };
+    if (scope?.tenantId) where.tenantId = scope.tenantId;
+    const entity = await this.em.findOne(DomainMapping, where);
+    if (!entity) return;
+    const hostname = entity.hostname;
+    const organizationId = entity.organizationId;
+    const tenantId = entity.tenantId;
+    this.em.remove(entity);
+    await this.em.flush();
+    await emitCustomerAccountsEvent("customer_accounts.domain_mapping.deleted", {
+      id,
+      hostname,
+      organizationId,
+      tenantId
+    });
+    await this.invalidateCacheFor(hostname, organizationId);
+  }
+  async healthCheck(id) {
+    const entity = await this.em.findOne(DomainMapping, { id });
+    if (!entity) throw new Error(`DomainMapping ${id} not found`);
+    if (entity.status === "active") return entity;
+    if (entity.status !== "verified" && entity.status !== "tls_failed") {
+      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`);
+    }
+    let lastReason = null;
+    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {
+      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS);
+      if (result.ok) {
+        return this.activate(entity.id);
+      }
+      lastReason = result.reason ?? "TLS health check failed";
+      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {
+        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt]);
+      }
+    }
+    entity.status = "tls_failed";
+    entity.tlsFailureReason = lastReason ?? "TLS health check failed";
+    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1;
+    await this.em.persist(entity).flush();
+    await emitCustomerAccountsEvent("customer_accounts.domain_mapping.tls_failed", {
+      id: entity.id,
+      hostname: entity.hostname,
+      organizationId: entity.organizationId,
+      tenantId: entity.tenantId,
+      reason: entity.tlsFailureReason,
+      retryCount: entity.tlsRetryCount
+    });
+    await this.invalidateCacheFor(entity.hostname, entity.organizationId);
+    return entity;
+  }
+  // -------------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------------
+  async lookupResolveResult(hostname) {
+    const row = await this.em.findOne(DomainMapping, { hostname, status: "active" });
+    if (!row) return null;
+    const org = await this.em.findOne(Organization, { id: row.organizationId });
+    return {
+      domainMappingId: row.id,
+      hostname: row.hostname,
+      tenantId: row.tenantId,
+      organizationId: row.organizationId,
+      orgSlug: org?.slug ?? null,
+      status: row.status
+    };
+  }
+  async invalidateCacheFor(hostname, organizationId) {
+    if (!this.cache) return;
+    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`];
+    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`);
+    try {
+      await this.cache.deleteByTags(tags);
+    } catch {
+    }
+  }
+  async runDnsVerification(hostname, expected) {
+    const detectedRecords = [];
+    const baseDiag = (overrides) => ({
+      expectedCnameTarget: expected.expectedCname,
+      expectedARecordTarget: expected.expectedARecord,
+      detectedRecords,
+      suggestion: overrides?.suggestion ?? "",
+      reverseResolve: overrides?.reverseResolve
+    });
+    let cnameRecords = [];
+    try {
+      cnameRecords = await this.dns.resolveCname(hostname);
+    } catch (err) {
+      return {
+        ok: false,
+        reason: `DNS lookup error (CNAME): ${err.message}`,
+        diagnostics: baseDiag({
+          suggestion: "DNS lookup failed unexpectedly. Try again in a few minutes."
+        })
+      };
+    }
+    for (const cname of cnameRecords) detectedRecords.push({ type: "CNAME", value: cname });
+    if (expected.expectedCname && cnameRecords.length > 0) {
+      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase();
+      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname);
+      if (match) {
+        return {
+          ok: true,
+          method: "cname",
+          diagnostics: baseDiag({
+            suggestion: "CNAME record matches the expected target."
+          })
+        };
+      }
+      return {
+        ok: false,
+        reason: `CNAME points to ${cnameRecords.join(", ")} instead of ${expected.expectedCname}`,
+        diagnostics: baseDiag({
+          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`
+        })
+      };
+    }
+    let aRecords = [];
+    try {
+      aRecords = await this.dns.resolve4(hostname);
+    } catch (err) {
+      return {
+        ok: false,
+        reason: `DNS lookup error (A): ${err.message}`,
+        diagnostics: baseDiag({ suggestion: "DNS lookup failed unexpectedly. Try again in a few minutes." })
+      };
+    }
+    for (const a of aRecords) {
+      const proxy = detectProxy(a);
+      detectedRecords.push({ type: "A", value: a, ...proxy ? { proxy } : {} });
+    }
+    if (aRecords.length === 0) {
+      return {
+        ok: false,
+        reason: `No CNAME or A record found for ${hostname}`,
+        diagnostics: baseDiag({
+          suggestion: expected.expectedARecord ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.` : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`
+        })
+      };
+    }
+    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {
+      return {
+        ok: true,
+        method: "a-record",
+        diagnostics: baseDiag({ suggestion: "A record matches the expected target." })
+      };
+    }
+    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip));
+    if (proxiedRecords.length > 0) {
+      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS);
+      if (probe.ok && probe.originHeaderPresent) {
+        return {
+          ok: true,
+          method: "reverse-resolve",
+          diagnostics: baseDiag({
+            reverseResolve: { attempted: true, originHeaderPresent: true },
+            suggestion: "Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin."
+          })
+        };
+      }
+      return {
+        ok: false,
+        reason: "A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server",
+        diagnostics: baseDiag({
+          reverseResolve: { attempted: true, originHeaderPresent: false },
+          suggestion: expected.expectedCname ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.` : "Disable the DNS proxy or configure it to forward traffic to our platform."
+        })
+      };
+    }
+    return {
+      ok: false,
+      reason: expected.expectedARecord ? `A record points to ${aRecords.join(", ")} instead of ${expected.expectedARecord}` : `A record points to ${aRecords.join(", ")} but apex-domain registration is not enabled on this deployment`,
+      diagnostics: baseDiag({
+        suggestion: expected.expectedARecord ? `Update your A record to point to ${expected.expectedARecord}.` : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`
+      })
+    };
+  }
+}
+const __testing__ = {
+  DEFAULT_DNS_RECHECK_THRESHOLD_MS,
+  DEFAULT_TLS_MAX_RETRIES,
+  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,
+  RESOLVE_TTL_MS,
+  DOMAIN_ROUTING_TAG,
+  defaultHealthCheck,
+  defaultDnsResolver,
+  Resolver
+};
+export {
+  DomainMappingService,
+  __testing__
+};
+//# sourceMappingURL=domainMappingService.js.map

package/dist/modules/customer_accounts/services/domainMappingService.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/services/domainMappingService.ts"],
+  "sourcesContent": ["import { Resolver, promises as dnsPromises } from 'node:dns'\nimport { request as httpsRequest } from 'node:https'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  DomainMapping,\n  type DomainStatus,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'\n\nconst DOMAIN_ROUTING_TAG = 'domain_routing'\nconst RESOLVE_KEY_PREFIX = 'domain_routing:resolve'\nconst ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'\nconst RESOLVE_TTL_MS = 5 * 60_000\nconst TLS_HEALTH_CHECK_TIMEOUT_MS = 10_000\nconst TLS_HEALTH_CHECK_RETRY_DELAYS_MS = [1_000, 4_000, 16_000]\nconst DEFAULT_DNS_RECHECK_THRESHOLD_MS = 5 * 60_000\nconst DEFAULT_TLS_MAX_RETRIES = 6\n\nexport type ResolveResult = {\n  domainMappingId: string\n  hostname: string\n  tenantId: string\n  organizationId: string\n  orgSlug: string | null\n  status: DomainStatus\n}\n\nexport type DnsDiagnostics = {\n  expectedCnameTarget: string\n  expectedARecordTarget: string | null\n  detectedRecords: Array<{ type: 'CNAME' | 'A'; value: string; proxy?: string }>\n  reverseResolve?: { attempted: boolean; originHeaderPresent: boolean }\n  suggestion: string\n}\n\nexport type VerifyResult = {\n  domainMapping: DomainMapping\n  diagnostics?: DnsDiagnostics\n}\n\nexport type RegisterInput = {\n  hostname: string\n  organizationId: string\n  tenantId: string\n  replacesDomainId?: string\n}\n\ntype CacheService = {\n  get(key: string, options?: unknown): Promise<unknown>\n  set(key: string, value: unknown, options?: { ttl?: number; tags?: string[] }): Promise<void>\n  deleteByTags(tags: string[]): Promise<number>\n}\n\ntype DnsResolverContract = {\n  resolveCname(hostname: string): Promise<string[]>\n  resolve4(hostname: string): Promise<string[]>\n}\n\ntype HealthCheckContract = (hostname: string, timeoutMs: number) => Promise<{\n  ok: boolean\n  originHeaderPresent: boolean\n  reason?: string\n}>\n\nconst defaultDnsResolver: DnsResolverContract = {\n  async resolveCname(hostname) {\n    try {\n      return await dnsPromises.resolveCname(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n  async resolve4(hostname) {\n    try {\n      return await dnsPromises.resolve4(hostname)\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code\n      if (code === 'ENODATA' || code === 'ENOTFOUND') return []\n      throw err\n    }\n  },\n}\n\nconst defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>\n  new Promise((resolve) => {\n    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()\n    const req = httpsRequest(\n      {\n        host: hostname,\n        port: 443,\n        path: '/api/customer_accounts/domain-check',\n        method: 'GET',\n        headers: { 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },\n        timeout: timeoutMs,\n      },\n      (res) => {\n        const headerValue = res.headers[headerName]\n        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue\n        const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'\n        const status = res.statusCode ?? 0\n        res.resume() // discard body\n        resolve({\n          ok: status >= 200 && status < 400,\n          originHeaderPresent,\n          reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,\n        })\n      },\n    )\n    req.on('timeout', () => {\n      req.destroy(new Error('TLS health check timed out'))\n    })\n    req.on('error', (err) => {\n      resolve({ ok: false, originHeaderPresent: false, reason: (err as Error).message })\n    })\n    req.end()\n  })\n\nexport class DomainMappingService {\n  private cache: CacheService | null\n  private dns: DnsResolverContract\n  private healthCheckImpl: HealthCheckContract\n\n  constructor(\n    private em: EntityManager,\n    deps?: {\n      cacheService?: CacheService\n      dnsResolver?: DnsResolverContract\n      healthCheck?: HealthCheckContract\n    },\n  ) {\n    this.cache = deps?.cacheService ?? null\n    this.dns = deps?.dnsResolver ?? defaultDnsResolver\n    this.healthCheckImpl = deps?.healthCheck ?? defaultHealthCheck\n  }\n\n  // -------------------------------------------------------------------------\n  // Read paths\n  // -------------------------------------------------------------------------\n\n  async findById(id: string, scope?: { tenantId?: string }): Promise<DomainMapping | null> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.findOne(DomainMapping, where as never)\n  }\n\n  async findByOrganization(\n    organizationId: string,\n    scope?: { tenantId?: string },\n  ): Promise<DomainMapping[]> {\n    const where: Record<string, unknown> = { organizationId }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    return this.em.find(DomainMapping, where as never, { orderBy: { createdAt: 'asc' } })\n  }\n\n  async resolveByHostname(input: string): Promise<ResolveResult | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n\n    const cacheKey = `${RESOLVE_KEY_PREFIX}:${hostname}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as ResolveResult | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const result = await this.lookupResolveResult(hostname)\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`],\n      })\n    }\n    return result\n  }\n\n  async isAllowedForTls(input: string): Promise<{ organizationId: string; status: DomainStatus } | null> {\n    const hostname = tryNormalizeHostname(input)\n    if (!hostname) return null\n    if (platformDomains().includes(hostname)) return null\n    const row = await this.em.findOne(DomainMapping, {\n      hostname,\n      status: { $in: ['active', 'verified'] },\n    } as never)\n    if (!row) return null\n    return { organizationId: row.organizationId, status: row.status }\n  }\n\n  async resolveActiveByOrg(organizationId: string): Promise<{ hostname: string; status: DomainStatus } | null> {\n    const cacheKey = `${ACTIVE_BY_ORG_KEY_PREFIX}:${organizationId}`\n    if (this.cache) {\n      const cached = (await this.cache.get(cacheKey)) as { hostname: string; status: DomainStatus } | null | undefined\n      if (cached !== undefined && cached !== null) return cached\n    }\n\n    const row = await this.em.findOne(DomainMapping, {\n      organizationId,\n      status: 'active',\n    } as never)\n    const result = row ? { hostname: row.hostname, status: row.status } : null\n\n    if (this.cache) {\n      await this.cache.set(cacheKey, result, {\n        ttl: RESOLVE_TTL_MS,\n        tags: [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:org:${organizationId}`],\n      })\n    }\n    return result\n  }\n\n  async resolveAll(): Promise<ResolveResult[]> {\n    const rows = await this.em.find(DomainMapping, { status: 'active' } as never)\n    if (rows.length === 0) return []\n    const orgIds = Array.from(new Set(rows.map((r) => r.organizationId)))\n    const orgs = await this.em.find(Organization, { id: { $in: orgIds } } as never)\n    const slugByOrg = new Map<string, string | null>(orgs.map((o) => [o.id, o.slug ?? null]))\n\n    return rows.map<ResolveResult>((row) => ({\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: slugByOrg.get(row.organizationId) ?? null,\n      status: row.status,\n    }))\n  }\n\n  // -------------------------------------------------------------------------\n  // Worker queries\n  // -------------------------------------------------------------------------\n\n  async findPendingVerification(threshold?: { olderThanMs?: number }): Promise<DomainMapping[]> {\n    const olderThan = threshold?.olderThanMs ?? DEFAULT_DNS_RECHECK_THRESHOLD_MS\n    const cutoff = new Date(Date.now() - olderThan)\n    return this.em.find(\n      DomainMapping,\n      {\n        status: { $in: ['pending', 'dns_failed'] },\n        $or: [{ lastDnsCheckAt: null }, { lastDnsCheckAt: { $lt: cutoff } }],\n      } as never,\n      { orderBy: { lastDnsCheckAt: 'asc' } },\n    )\n  }\n\n  async findPendingTls(options?: { maxRetries?: number; batchSize?: number }): Promise<DomainMapping[]> {\n    const maxRetries = options?.maxRetries ?? DEFAULT_TLS_MAX_RETRIES\n    const limit = options?.batchSize ?? 50\n    return this.em.find(\n      DomainMapping,\n      {\n        $or: [\n          { status: 'verified' },\n          { status: 'tls_failed', tlsRetryCount: { $lt: maxRetries } },\n        ],\n      } as never,\n      { orderBy: { updatedAt: 'asc' }, limit },\n    )\n  }\n\n  // -------------------------------------------------------------------------\n  // Write paths\n  // -------------------------------------------------------------------------\n\n  async register(input: RegisterInput): Promise<DomainMapping> {\n    const hostname = normalizeHostname(input.hostname)\n\n    let replacesDomain: DomainMapping | null = null\n    if (input.replacesDomainId) {\n      replacesDomain = await this.em.findOne(DomainMapping, {\n        id: input.replacesDomainId,\n        tenantId: input.tenantId,\n      } as never)\n    }\n\n    const entity = this.em.create(DomainMapping, {\n      hostname,\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n      replacesDomain: replacesDomain ?? null,\n      provider: 'traefik',\n      status: 'pending',\n      tlsRetryCount: 0,\n      createdAt: new Date(),\n    } as never)\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.created', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      status: entity.status,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n\n    return entity\n  }\n\n  async verify(id: string): Promise<VerifyResult> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n\n    const expectedCname = process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? ''\n    const expectedARecord = process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null\n    const now = new Date()\n    entity.lastDnsCheckAt = now\n\n    const verification = await this.runDnsVerification(entity.hostname, {\n      expectedCname,\n      expectedARecord,\n    })\n\n    if (verification.ok) {\n      entity.status = 'verified'\n      entity.verifiedAt = now\n      entity.dnsFailureReason = null\n      entity.tlsRetryCount = 0\n      entity.tlsFailureReason = null\n      await this.em.persist(entity).flush()\n      await emitCustomerAccountsEvent('customer_accounts.domain_mapping.verified', {\n        id: entity.id,\n        hostname: entity.hostname,\n        organizationId: entity.organizationId,\n        tenantId: entity.tenantId,\n      } as never)\n      await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n      return { domainMapping: entity }\n    }\n\n    entity.status = 'dns_failed'\n    entity.dnsFailureReason = verification.reason\n    await this.em.persist(entity).flush()\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.dns_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: verification.reason,\n      detectedRecords: verification.diagnostics.detectedRecords,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return { domainMapping: entity, diagnostics: verification.diagnostics }\n  }\n\n  async activate(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot transition to active from ${entity.status}`)\n    }\n\n    entity.status = 'active'\n    entity.tlsRetryCount = 0\n    entity.tlsFailureReason = null\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.activated', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n    } as never)\n\n    if (entity.replacesDomain) {\n      const replaced = await this.em.findOne(DomainMapping, {\n        id: (entity.replacesDomain as unknown as { id: string }).id,\n      } as never)\n      if (replaced) {\n        const replacedHostname = replaced.hostname\n        const replacedOrg = replaced.organizationId\n        this.em.remove(replaced)\n        await this.em.flush()\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.replaced', {\n          id: entity.id,\n          hostname: entity.hostname,\n          organizationId: entity.organizationId,\n          tenantId: entity.tenantId,\n          replacedDomainId: replaced.id,\n          replacedHostname,\n        } as never)\n        await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n          id: replaced.id,\n          hostname: replacedHostname,\n          organizationId: replacedOrg,\n          tenantId: replaced.tenantId,\n        } as never)\n        await this.invalidateCacheFor(replacedHostname, replacedOrg)\n      }\n    }\n\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  async remove(id: string, scope?: { tenantId?: string }): Promise<void> {\n    const where: Record<string, unknown> = { id }\n    if (scope?.tenantId) where.tenantId = scope.tenantId\n    const entity = await this.em.findOne(DomainMapping, where as never)\n    if (!entity) return\n\n    const hostname = entity.hostname\n    const organizationId = entity.organizationId\n    const tenantId = entity.tenantId\n\n    this.em.remove(entity)\n    await this.em.flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.deleted', {\n      id,\n      hostname,\n      organizationId,\n      tenantId,\n    } as never)\n    await this.invalidateCacheFor(hostname, organizationId)\n  }\n\n  async healthCheck(id: string): Promise<DomainMapping> {\n    const entity = await this.em.findOne(DomainMapping, { id } as never)\n    if (!entity) throw new Error(`DomainMapping ${id} not found`)\n    if (entity.status === 'active') return entity\n    if (entity.status !== 'verified' && entity.status !== 'tls_failed') {\n      throw new Error(`DomainMapping ${id} cannot run health check from status ${entity.status}`)\n    }\n\n    let lastReason: string | null = null\n    for (let attempt = 0; attempt < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length; attempt++) {\n      const result = await this.healthCheckImpl(entity.hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (result.ok) {\n        return this.activate(entity.id)\n      }\n      lastReason = result.reason ?? 'TLS health check failed'\n      if (attempt + 1 < TLS_HEALTH_CHECK_RETRY_DELAYS_MS.length) {\n        await delay(TLS_HEALTH_CHECK_RETRY_DELAYS_MS[attempt])\n      }\n    }\n\n    entity.status = 'tls_failed'\n    entity.tlsFailureReason = lastReason ?? 'TLS health check failed'\n    entity.tlsRetryCount = (entity.tlsRetryCount ?? 0) + 1\n    await this.em.persist(entity).flush()\n\n    await emitCustomerAccountsEvent('customer_accounts.domain_mapping.tls_failed', {\n      id: entity.id,\n      hostname: entity.hostname,\n      organizationId: entity.organizationId,\n      tenantId: entity.tenantId,\n      reason: entity.tlsFailureReason,\n      retryCount: entity.tlsRetryCount,\n    } as never)\n    await this.invalidateCacheFor(entity.hostname, entity.organizationId)\n    return entity\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async lookupResolveResult(hostname: string): Promise<ResolveResult | null> {\n    const row = await this.em.findOne(DomainMapping, { hostname, status: 'active' } as never)\n    if (!row) return null\n    const org = await this.em.findOne(Organization, { id: row.organizationId } as never)\n    return {\n      domainMappingId: row.id,\n      hostname: row.hostname,\n      tenantId: row.tenantId,\n      organizationId: row.organizationId,\n      orgSlug: org?.slug ?? null,\n      status: row.status,\n    }\n  }\n\n  private async invalidateCacheFor(hostname: string, organizationId: string | null): Promise<void> {\n    if (!this.cache) return\n    const tags = [DOMAIN_ROUTING_TAG, `${DOMAIN_ROUTING_TAG}:${hostname}`]\n    if (organizationId) tags.push(`${DOMAIN_ROUTING_TAG}:org:${organizationId}`)\n    try {\n      await this.cache.deleteByTags(tags)\n    } catch {\n      // Cache invalidation is best-effort \u2014 TTL backstop ensures eventual consistency.\n    }\n  }\n\n  private async runDnsVerification(\n    hostname: string,\n    expected: { expectedCname: string; expectedARecord: string | null },\n  ): Promise<\n    | {\n        ok: true\n        method: 'cname' | 'a-record' | 'reverse-resolve'\n        diagnostics: DnsDiagnostics\n      }\n    | { ok: false; reason: string; diagnostics: DnsDiagnostics }\n  > {\n    const detectedRecords: DnsDiagnostics['detectedRecords'] = []\n    const baseDiag = (overrides?: Partial<DnsDiagnostics>): DnsDiagnostics => ({\n      expectedCnameTarget: expected.expectedCname,\n      expectedARecordTarget: expected.expectedARecord,\n      detectedRecords,\n      suggestion: overrides?.suggestion ?? '',\n      reverseResolve: overrides?.reverseResolve,\n    })\n\n    // Phase 1: CNAME\n    let cnameRecords: string[] = []\n    try {\n      cnameRecords = await this.dns.resolveCname(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (CNAME): ${(err as Error).message}`,\n        diagnostics: baseDiag({\n          suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.',\n        }),\n      }\n    }\n    for (const cname of cnameRecords) detectedRecords.push({ type: 'CNAME', value: cname })\n\n    if (expected.expectedCname && cnameRecords.length > 0) {\n      const expectedCname = tryNormalizeHostname(expected.expectedCname) ?? expected.expectedCname.toLowerCase()\n      const match = cnameRecords.some((c) => (tryNormalizeHostname(c) ?? c.toLowerCase()) === expectedCname)\n      if (match) {\n        return {\n          ok: true,\n          method: 'cname',\n          diagnostics: baseDiag({\n            suggestion: 'CNAME record matches the expected target.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: `CNAME points to ${cnameRecords.join(', ')} instead of ${expected.expectedCname}`,\n        diagnostics: baseDiag({\n          suggestion: `Update your CNAME record to point to ${expected.expectedCname}.`,\n        }),\n      }\n    }\n\n    // Phase 2: A record\n    let aRecords: string[] = []\n    try {\n      aRecords = await this.dns.resolve4(hostname)\n    } catch (err) {\n      return {\n        ok: false,\n        reason: `DNS lookup error (A): ${(err as Error).message}`,\n        diagnostics: baseDiag({ suggestion: 'DNS lookup failed unexpectedly. Try again in a few minutes.' }),\n      }\n    }\n    for (const a of aRecords) {\n      const proxy = detectProxy(a)\n      detectedRecords.push({ type: 'A', value: a, ...(proxy ? { proxy } : {}) })\n    }\n\n    if (aRecords.length === 0) {\n      return {\n        ok: false,\n        reason: `No CNAME or A record found for ${hostname}`,\n        diagnostics: baseDiag({\n          suggestion: expected.expectedARecord\n            ? `For a subdomain, add a CNAME record pointing to ${expected.expectedCname}. For an apex domain, add an A record pointing to ${expected.expectedARecord}. DNS propagation can take up to 48 hours.`\n            : `Add a CNAME record pointing to ${expected.expectedCname}. DNS propagation can take up to 48 hours.`,\n        }),\n      }\n    }\n\n    if (expected.expectedARecord && aRecords.includes(expected.expectedARecord)) {\n      return {\n        ok: true,\n        method: 'a-record',\n        diagnostics: baseDiag({ suggestion: 'A record matches the expected target.' }),\n      }\n    }\n\n    // Phase 3: reverse-resolve through proxy\n    const proxiedRecords = aRecords.filter((ip) => isInKnownProxyRange(ip))\n    if (proxiedRecords.length > 0) {\n      const probe = await this.healthCheckImpl(hostname, TLS_HEALTH_CHECK_TIMEOUT_MS)\n      if (probe.ok && probe.originHeaderPresent) {\n        return {\n          ok: true,\n          method: 'reverse-resolve',\n          diagnostics: baseDiag({\n            reverseResolve: { attempted: true, originHeaderPresent: true },\n            suggestion: 'Domain is proxied \u2014 reverse-resolve confirmed traffic reaches our origin.',\n          }),\n        }\n      }\n      return {\n        ok: false,\n        reason: 'A record points to a known proxy IP, but reverse-resolve over HTTPS did not reach our server',\n        diagnostics: baseDiag({\n          reverseResolve: { attempted: true, originHeaderPresent: false },\n          suggestion: expected.expectedCname\n            ? `Your DNS uses a proxy. Either disable the proxy and add a CNAME \u2192 ${expected.expectedCname}, or configure your proxy to forward traffic to ${expected.expectedCname}.`\n            : 'Disable the DNS proxy or configure it to forward traffic to our platform.',\n        }),\n      }\n    }\n\n    return {\n      ok: false,\n      reason: expected.expectedARecord\n        ? `A record points to ${aRecords.join(', ')} instead of ${expected.expectedARecord}`\n        : `A record points to ${aRecords.join(', ')} but apex-domain registration is not enabled on this deployment`,\n      diagnostics: baseDiag({\n        suggestion: expected.expectedARecord\n          ? `Update your A record to point to ${expected.expectedARecord}.`\n          : `Apex-domain registration is not enabled on this deployment. Use a subdomain (e.g., shop.${hostname}) and add a CNAME pointing to ${expected.expectedCname}.`,\n      }),\n    }\n  }\n}\n\n// Re-exported for tests; allow injection of fakes.\nexport const __testing__ = {\n  DEFAULT_DNS_RECHECK_THRESHOLD_MS,\n  DEFAULT_TLS_MAX_RETRIES,\n  TLS_HEALTH_CHECK_RETRY_DELAYS_MS,\n  RESOLVE_TTL_MS,\n  DOMAIN_ROUTING_TAG,\n  defaultHealthCheck,\n  defaultDnsResolver,\n  Resolver,\n}\n"],
+  "mappings": "AAAA,SAAS,UAAU,YAAY,mBAAmB;AAClD,SAAS,WAAW,oBAAoB;AACxC,SAAS,cAAc,aAAa;AAEpC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,uBAAuB;AAChC,SAAS,aAAa,2BAA2B;AAEjD,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,8BAA8B;AACpC,MAAM,mCAAmC,CAAC,KAAO,KAAO,IAAM;AAC9D,MAAM,mCAAmC,IAAI;AAC7C,MAAM,0BAA0B;AAgDhC,MAAM,qBAA0C;AAAA,EAC9C,MAAM,aAAa,UAAU;AAC3B,QAAI;AACF,aAAO,MAAM,YAAY,aAAa,QAAQ;AAAA,IAChD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU;AACvB,QAAI;AACF,aAAO,MAAM,YAAY,SAAS,QAAQ;AAAA,IAC5C,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,aAAa,SAAS,YAAa,QAAO,CAAC;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,qBAA0C,CAAC,UAAU,cACzD,IAAI,QAAQ,CAAC,YAAY;AACvB,QAAM,cAAc,QAAQ,IAAI,iCAAiC,yBAAyB,YAAY;AACtG,QAAM,MAAM;AAAA,IACV;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,EAAE,yBAAyB,QAAQ,IAAI,uBAAuB,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,cAAc,IAAI,QAAQ,UAAU;AAC1C,YAAM,eAAe,MAAM,QAAQ,WAAW,IAAI,YAAY,CAAC,IAAI;AACnE,YAAM,sBAAsB,OAAO,iBAAiB,YAAY,iBAAiB;AACjF,YAAM,SAAS,IAAI,cAAc;AACjC,UAAI,OAAO;AACX,cAAQ;AAAA,QACN,IAAI,UAAU,OAAO,SAAS;AAAA,QAC9B;AAAA,QACA,QAAQ,UAAU,OAAO,SAAS,MAAM,SAAY,QAAQ,MAAM;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,GAAG,WAAW,MAAM;AACtB,QAAI,QAAQ,IAAI,MAAM,4BAA4B,CAAC;AAAA,EACrD,CAAC;AACD,MAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAQ,EAAE,IAAI,OAAO,qBAAqB,OAAO,QAAS,IAAc,QAAQ,CAAC;AAAA,EACnF,CAAC;AACD,MAAI,IAAI;AACV,CAAC;AAEI,MAAM,qBAAqB;AAAA,EAKhC,YACU,IACR,MAKA;AANQ;AAOR,SAAK,QAAQ,MAAM,gBAAgB;AACnC,SAAK,MAAM,MAAM,eAAe;AAChC,SAAK,kBAAkB,MAAM,eAAe;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,IAAY,OAA8D;AACvF,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,QAAQ,eAAe,KAAc;AAAA,EACtD;AAAA,EAEA,MAAM,mBACJ,gBACA,OAC0B;AAC1B,UAAM,QAAiC,EAAE,eAAe;AACxD,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,WAAO,KAAK,GAAG,KAAK,eAAe,OAAgB,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,kBAAkB,OAA8C;AACpE,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AAEjD,UAAM,WAAW,GAAG,kBAAkB,IAAI,QAAQ;AAClD,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,SAAS,MAAM,KAAK,oBAAoB,QAAQ;AACtD,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AAAA,MAChE,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,OAAiF;AACrG,UAAM,WAAW,qBAAqB,KAAK;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO;AACjD,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,UAAU,UAAU,EAAE;AAAA,IACxC,CAAU;AACV,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,EAAE,gBAAgB,IAAI,gBAAgB,QAAQ,IAAI,OAAO;AAAA,EAClE;AAAA,EAEA,MAAM,mBAAmB,gBAAoF;AAC3G,UAAM,WAAW,GAAG,wBAAwB,IAAI,cAAc;AAC9D,QAAI,KAAK,OAAO;AACd,YAAM,SAAU,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC7C,UAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AAAA,IACtD;AAEA,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,MAC/C;AAAA,MACA,QAAQ;AAAA,IACV,CAAU;AACV,UAAM,SAAS,MAAM,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,IAAI;AAEtE,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,MAAM,IAAI,UAAU,QAAQ;AAAA,QACrC,KAAK;AAAA,QACL,MAAM,CAAC,oBAAoB,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAAA,MAC1E,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAuC;AAC3C,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,eAAe,EAAE,QAAQ,SAAS,CAAU;AAC5E,QAAI,KAAK,WAAW,EAAG,QAAO,CAAC;AAC/B,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,UAAM,OAAO,MAAM,KAAK,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,CAAU;AAC9E,UAAM,YAAY,IAAI,IAA2B,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;AAExF,WAAO,KAAK,IAAmB,CAAC,SAAS;AAAA,MACvC,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,UAAU,IAAI,IAAI,cAAc,KAAK;AAAA,MAC9C,QAAQ,IAAI;AAAA,IACd,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,WAAgE;AAC5F,UAAM,YAAY,WAAW,eAAe;AAC5C,UAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;AAC9C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,EAAE;AAAA,QACzC,KAAK,CAAC,EAAE,gBAAgB,KAAK,GAAG,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,CAAC;AAAA,MACrE;AAAA,MACA,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAiF;AACpG,UAAM,aAAa,SAAS,cAAc;AAC1C,UAAM,QAAQ,SAAS,aAAa;AACpC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,KAAK;AAAA,UACH,EAAE,QAAQ,WAAW;AAAA,UACrB,EAAE,QAAQ,cAAc,eAAe,EAAE,KAAK,WAAW,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,GAAG,MAAM;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,OAA8C;AAC3D,UAAM,WAAW,kBAAkB,MAAM,QAAQ;AAEjD,QAAI,iBAAuC;AAC3C,QAAI,MAAM,kBAAkB;AAC1B,uBAAiB,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,MAClB,CAAU;AAAA,IACZ;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,eAAe;AAAA,MAC3C;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,gBAAgB,kBAAkB;AAAA,MAClC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAU;AACV,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AAEpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAmC;AAC9C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAE5D,UAAM,gBAAgB,QAAQ,IAAI,8BAA8B;AAChE,UAAM,kBAAkB,QAAQ,IAAI,iCAAiC;AACrE,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,iBAAiB;AAExB,UAAM,eAAe,MAAM,KAAK,mBAAmB,OAAO,UAAU;AAAA,MAClE;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,IAAI;AACnB,aAAO,SAAS;AAChB,aAAO,aAAa;AACpB,aAAO,mBAAmB;AAC1B,aAAO,gBAAgB;AACvB,aAAO,mBAAmB;AAC1B,YAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,YAAM,0BAA0B,6CAA6C;AAAA,QAC3E,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,UAAU,OAAO;AAAA,MACnB,CAAU;AACV,YAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,aAAO,EAAE,eAAe,OAAO;AAAA,IACjC;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,aAAa;AACvC,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AACpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,aAAa;AAAA,MACrB,iBAAiB,aAAa,YAAY;AAAA,IAC5C,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO,EAAE,eAAe,QAAQ,aAAa,aAAa,YAAY;AAAA,EACxE;AAAA,EAEA,MAAM,SAAS,IAAoC;AACjD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,qCAAqC,OAAO,MAAM,EAAE;AAAA,IACzF;AAEA,WAAO,SAAS;AAChB,WAAO,gBAAgB;AACvB,WAAO,mBAAmB;AAC1B,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,8CAA8C;AAAA,MAC5E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,IACnB,CAAU;AAEV,QAAI,OAAO,gBAAgB;AACzB,YAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,eAAe;AAAA,QACpD,IAAK,OAAO,eAA6C;AAAA,MAC3D,CAAU;AACV,UAAI,UAAU;AACZ,cAAM,mBAAmB,SAAS;AAClC,cAAM,cAAc,SAAS;AAC7B,aAAK,GAAG,OAAO,QAAQ;AACvB,cAAM,KAAK,GAAG,MAAM;AACpB,cAAM,0BAA0B,6CAA6C;AAAA,UAC3E,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,gBAAgB,OAAO;AAAA,UACvB,UAAU,OAAO;AAAA,UACjB,kBAAkB,SAAS;AAAA,UAC3B;AAAA,QACF,CAAU;AACV,cAAM,0BAA0B,4CAA4C;AAAA,UAC1E,IAAI,SAAS;AAAA,UACb,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,UAAU,SAAS;AAAA,QACrB,CAAU;AACV,cAAM,KAAK,mBAAmB,kBAAkB,WAAW;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAAY,OAA8C;AACrE,UAAM,QAAiC,EAAE,GAAG;AAC5C,QAAI,OAAO,SAAU,OAAM,WAAW,MAAM;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,KAAc;AAClE,QAAI,CAAC,OAAQ;AAEb,UAAM,WAAW,OAAO;AACxB,UAAM,iBAAiB,OAAO;AAC9B,UAAM,WAAW,OAAO;AAExB,SAAK,GAAG,OAAO,MAAM;AACrB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,0BAA0B,4CAA4C;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAU;AACV,UAAM,KAAK,mBAAmB,UAAU,cAAc;AAAA,EACxD;AAAA,EAEA,MAAM,YAAY,IAAoC;AACpD,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,GAAG,CAAU;AACnE,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iBAAiB,EAAE,YAAY;AAC5D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI,OAAO,WAAW,cAAc,OAAO,WAAW,cAAc;AAClE,YAAM,IAAI,MAAM,iBAAiB,EAAE,wCAAwC,OAAO,MAAM,EAAE;AAAA,IAC5F;AAEA,QAAI,aAA4B;AAChC,aAAS,UAAU,GAAG,UAAU,iCAAiC,QAAQ,WAAW;AAClF,YAAM,SAAS,MAAM,KAAK,gBAAgB,OAAO,UAAU,2BAA2B;AACtF,UAAI,OAAO,IAAI;AACb,eAAO,KAAK,SAAS,OAAO,EAAE;AAAA,MAChC;AACA,mBAAa,OAAO,UAAU;AAC9B,UAAI,UAAU,IAAI,iCAAiC,QAAQ;AACzD,cAAM,MAAM,iCAAiC,OAAO,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,WAAO,SAAS;AAChB,WAAO,mBAAmB,cAAc;AACxC,WAAO,iBAAiB,OAAO,iBAAiB,KAAK;AACrD,UAAM,KAAK,GAAG,QAAQ,MAAM,EAAE,MAAM;AAEpC,UAAM,0BAA0B,+CAA+C;AAAA,MAC7E,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,MACf,YAAY,OAAO;AAAA,IACrB,CAAU;AACV,UAAM,KAAK,mBAAmB,OAAO,UAAU,OAAO,cAAc;AACpE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,UAAiD;AACjF,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAU;AACxF,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,IAAI,IAAI,eAAe,CAAU;AACnF,WAAO;AAAA,MACL,iBAAiB,IAAI;AAAA,MACrB,UAAU,IAAI;AAAA,MACd,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,KAAK,QAAQ;AAAA,MACtB,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,UAAkB,gBAA8C;AAC/F,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO,CAAC,oBAAoB,GAAG,kBAAkB,IAAI,QAAQ,EAAE;AACrE,QAAI,eAAgB,MAAK,KAAK,GAAG,kBAAkB,QAAQ,cAAc,EAAE;AAC3E,QAAI;AACF,YAAM,KAAK,MAAM,aAAa,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,UACA,UAQA;AACA,UAAM,kBAAqD,CAAC;AAC5D,UAAM,WAAW,CAAC,eAAyD;AAAA,MACzE,qBAAqB,SAAS;AAAA,MAC9B,uBAAuB,SAAS;AAAA,MAChC;AAAA,MACA,YAAY,WAAW,cAAc;AAAA,MACrC,gBAAgB,WAAW;AAAA,IAC7B;AAGA,QAAI,eAAyB,CAAC;AAC9B,QAAI;AACF,qBAAe,MAAM,KAAK,IAAI,aAAa,QAAQ;AAAA,IACrD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,6BAA8B,IAAc,OAAO;AAAA,QAC3D,aAAa,SAAS;AAAA,UACpB,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AACA,eAAW,SAAS,aAAc,iBAAgB,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,CAAC;AAEtF,QAAI,SAAS,iBAAiB,aAAa,SAAS,GAAG;AACrD,YAAM,gBAAgB,qBAAqB,SAAS,aAAa,KAAK,SAAS,cAAc,YAAY;AACzG,YAAM,QAAQ,aAAa,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAAK,EAAE,YAAY,OAAO,aAAa;AACrG,UAAI,OAAO;AACT,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,mBAAmB,aAAa,KAAK,IAAI,CAAC,eAAe,SAAS,aAAa;AAAA,QACvF,aAAa,SAAS;AAAA,UACpB,YAAY,wCAAwC,SAAS,aAAa;AAAA,QAC5E,CAAC;AAAA,MACH;AAAA,IACF;AAGA,QAAI,WAAqB,CAAC;AAC1B,QAAI;AACF,iBAAW,MAAM,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC7C,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,yBAA0B,IAAc,OAAO;AAAA,QACvD,aAAa,SAAS,EAAE,YAAY,8DAA8D,CAAC;AAAA,MACrG;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,QAAQ,YAAY,CAAC;AAC3B,sBAAgB,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AAAA,IAC3E;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,kCAAkC,QAAQ;AAAA,QAClD,aAAa,SAAS;AAAA,UACpB,YAAY,SAAS,kBACjB,mDAAmD,SAAS,aAAa,qDAAqD,SAAS,eAAe,+CACtJ,kCAAkC,SAAS,aAAa;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,SAAS,mBAAmB,SAAS,SAAS,SAAS,eAAe,GAAG;AAC3E,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS,EAAE,YAAY,wCAAwC,CAAC;AAAA,MAC/E;AAAA,IACF;AAGA,UAAM,iBAAiB,SAAS,OAAO,CAAC,OAAO,oBAAoB,EAAE,CAAC;AACtE,QAAI,eAAe,SAAS,GAAG;AAC7B,YAAM,QAAQ,MAAM,KAAK,gBAAgB,UAAU,2BAA2B;AAC9E,UAAI,MAAM,MAAM,MAAM,qBAAqB;AACzC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,aAAa,SAAS;AAAA,YACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,KAAK;AAAA,YAC7D,YAAY;AAAA,UACd,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,aAAa,SAAS;AAAA,UACpB,gBAAgB,EAAE,WAAW,MAAM,qBAAqB,MAAM;AAAA,UAC9D,YAAY,SAAS,gBACjB,0EAAqE,SAAS,aAAa,mDAAmD,SAAS,aAAa,MACpK;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,SAAS,kBACb,sBAAsB,SAAS,KAAK,IAAI,CAAC,eAAe,SAAS,eAAe,KAChF,sBAAsB,SAAS,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,SAAS;AAAA,QACpB,YAAY,SAAS,kBACjB,oCAAoC,SAAS,eAAe,MAC5D,2FAA2F,QAAQ,iCAAiC,SAAS,aAAa;AAAA,MAChK,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,MAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/setup.js

@@ -6,6 +6,47 @@ import {
   CustomerUser,
   CustomerUserRole
 } from "@open-mercato/core/modules/customer_accounts/data/entities";
+const DOMAIN_VERIFICATION_SCHEDULE_ID = "5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001";
+const DOMAIN_TLS_RETRY_SCHEDULE_ID = "5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002";
+function intervalSecondsFromEnv(envName, fallbackSeconds) {
+  const parsed = Number.parseInt(process.env[envName] ?? "", 10);
+  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds;
+  return `${seconds}s`;
+}
+async function registerDomainSchedules(container) {
+  if (typeof container.hasRegistration !== "function" || !container.hasRegistration("schedulerService")) {
+    return;
+  }
+  const schedulerService = container.resolve("schedulerService");
+  await schedulerService.register({
+    id: DOMAIN_VERIFICATION_SCHEDULE_ID,
+    name: "Custom domain \u2014 DNS auto-verification",
+    description: "Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.",
+    scopeType: "system",
+    scheduleType: "interval",
+    scheduleValue: intervalSecondsFromEnv("DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS", 300),
+    timezone: "UTC",
+    targetType: "queue",
+    targetQueue: "domain-verification",
+    sourceType: "module",
+    sourceModule: "customer_accounts",
+    isEnabled: true
+  });
+  await schedulerService.register({
+    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,
+    name: "Custom domain \u2014 TLS retry",
+    description: "Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let's Encrypt rate limits.",
+    scopeType: "system",
+    scheduleType: "interval",
+    scheduleValue: intervalSecondsFromEnv("DOMAIN_TLS_RETRY_INTERVAL_SECONDS", 1800),
+    timezone: "UTC",
+    targetType: "queue",
+    targetQueue: "domain-tls-retry",
+    sourceType: "module",
+    sourceModule: "customer_accounts",
+    isEnabled: true
+  });
+}
 const DEFAULT_ROLES = [
   {
     name: "Portal Admin",
@@ -124,7 +165,7 @@ const setup = {
   async onTenantCreated({ em, tenantId, organizationId }) {
     await seedDefaultRoles(em, { tenantId, organizationId });
   },
-  async seedDefaults({ em, tenantId, organizationId }) {
+  async seedDefaults({ em, tenantId, organizationId, container }) {
     await seedDefaultRoles(em, { tenantId, organizationId });
     try {
       const { getModules } = await import("@open-mercato/shared/lib/modules/registry");
@@ -132,6 +173,12 @@ const setup = {
       await ensureDefaultCustomerRoleAcls(em, tenantId, allModules);
     } catch {
     }
+    try {
+      await registerDomainSchedules(
+        container
+      );
+    } catch {
+    }
   },
   async seedExamples({ em, tenantId, organizationId }) {
     const BCRYPT_COST = 10;