@utopia-studio-design/design-system-cli 0.6.2 → 0.7.0

package/data/docs/designer-agent-backend-contract.md

@@ -0,0 +1,552 @@
+# Ceramic Designer Agent Backend and API Contract
+
+Status: implemented in the Convex development deployment  
+Owner: Ceramic Design System  
+Backend: Convex + Clerk + `@convex-dev/agent` + Convex file storage
+
+### Provider configuration
+
+Designer Agent generation uses OpenAI through `@convex-dev/agent` and the
+server-only `@ai-sdk/openai` provider. The only enabled production model is
+`gpt-5.6-luna`; a client-supplied model identifier outside the server allowlist
+is replaced by that model. Store the credential only in each Convex deployment:
+
+```bash
+npx convex env set OPENAI_API_KEY "$OPENAI_API_KEY"
+```
+
+Never use a `VITE_` prefix, commit the value, place it in Brand Room data, or
+send it to the browser. If the variable is absent, `sendMessage` records a
+failed run and returns `errorCode: "PROVIDER_UNAVAILABLE"`; it does not create a
+fixture response that could be mistaken for model output.
+
+## 1. Purpose
+
+This contract makes every Designer Agent session durable, resumable, reactive,
+auditable, and safe to approve. The Brand Room remains the control plane. The
+conversation is not the source of truth for approved work: artifacts, versions,
+decisions, approvals, connections, and execution records are stored as governed
+Brand Room data.
+
+The browser must be able to close, reload, switch device, or switch model without
+losing accepted state. Preview mode may remain browser-local, but it must be
+visibly labeled and must never impersonate a server-backed save.
+
+## 2. System boundaries
+
+```text
+Clerk identity
+    ↓ authenticated JWT
+Convex public API
+    ├── Brand Room ownership and membership
+    ├── Designer Agent session state
+    ├── artifacts, versions, decisions, approvals
+    ├── connections, operations, audit events
+    └── file storage metadata
+        ↓ internal functions only
+@convex-dev/agent
+    ├── durable thread and messages
+    ├── streaming model execution
+    └── governed tool calls
+        ↓ explicit approval gates
+Ceramic MCP / GitHub / Figma / media providers / publishing
+```
+
+The web client calls typed Convex functions. It does not write directly to
+tables, store provider secrets, or treat local reducer state as saved state.
+Ceramic MCP and external provider adapters call the same authorization and
+domain rules rather than maintaining a parallel source of truth.
+
+## 3. Required platform components
+
+- `@convex-dev/agent`: one durable thread per Designer Agent session. Do not
+  create a hand-written messages table.
+- Convex file storage: source uploads, generated previews, editable masters,
+  exports, and review attachments.
+- `@convex-dev/workpool`: bounded asynchronous execution for provider calls,
+  generation, validation, packaging, and retries.
+- `@convex-dev/rate-limiter`: limits by owner, Room, provider, and operation.
+- Optional `@convex-dev/presence`: only when collaborative viewing, typing, or
+  multi-user editing is introduced. Presence is never stored on session rows.
+
+## 4. Identity and authorization
+
+All public functions derive the actor from `ctx.auth.getUserIdentity()` and use
+`identity.tokenIdentifier`. No public API accepts an owner or user ID for
+authorization.
+
+Initial release keeps the existing owner-only Brand Room policy. The data model
+must support these future Room roles without changing artifact ownership:
+
+| Role | Read | Draft | Run tools | Review | Publish/manage |
+| --- | --- | --- | --- | --- | --- |
+| owner | yes | yes | yes | yes | yes |
+| editor | yes | yes | yes | no | no |
+| reviewer | yes | no | no | yes | no |
+| viewer | yes | no | no | no | no |
+
+Every write requires active membership, Room access, and a server-side action
+policy check. Approval and publishing permissions are checked independently.
+Unauthorized and missing Room responses are intentionally indistinguishable.
+
+## 5. Data model
+
+### 5.1 Existing tables retained
+
+- `brandRooms`: owner, slug, names, source mode, agent target, lifecycle.
+- `brandRoomSources`: managed, repository, uploaded, or blank sources.
+- `brandRoomApprovals`: onboarding-level source, agent, and publishing gates.
+
+These tables do not store live Designer Agent work.
+
+### 5.2 `designerAgentSessions`
+
+One row per resumable work session.
+
+| Field | Type | Contract |
+| --- | --- | --- |
+| `roomId` | `Id<'brandRooms'>` | owning Room |
+| `ownerTokenIdentifier` | string | denormalized authorization index |
+| `agentThreadId` | string | `@convex-dev/agent` thread ID |
+| `title` | string | user-readable session title |
+| `status` | `active \| paused \| completed \| archived` | lifecycle |
+| `currentStage` | journey stage enum | derived checkpoint, not display copy |
+| `locale` | `en \| ko \| ar` | session language |
+| `modelProvider` | approved provider enum | no credentials |
+| `modelId` | string | exact execution model |
+| `revision` | number | optimistic concurrency counter |
+| `lastActivityAt` | number | material activity time |
+| `createdAt`, `updatedAt` | number | mutation timestamps |
+
+Indexes:
+
+- `by_room_id_and_updated_at: [roomId, updatedAt]`
+- `by_owner_token_identifier_and_updated_at: [ownerTokenIdentifier, updatedAt]`
+- `by_room_id_and_status: [roomId, status]`
+- unique lookup by `agentThreadId`
+
+### 5.3 `designerAgentDrafts`
+
+Small, replaceable editor state. Never store an unbounded transcript here.
+
+| Field | Type | Contract |
+| --- | --- | --- |
+| `sessionId` | session ID | parent |
+| `roomId` | Room ID | authorization/index |
+| `draftKey` | enum/string | `discovery`, `logo-brief`, `workspace-url`, etc. |
+| `value` | validated object/string | bounded draft payload |
+| `clientRevision` | number | conflict detection |
+| `updatedByTokenIdentifier` | string | actor |
+| `updatedAt` | number | last save |
+
+Index `by_session_id_and_draft_key` must be unique. Draft payloads are limited to
+64 KB. Large binaries and generated output use file storage.
+
+### 5.4 `designerAgentArtifacts`
+
+Stable artifact identity independent of versions.
+
+| Field | Type | Contract |
+| --- | --- | --- |
+| `roomId`, `sessionId` | IDs | ownership and origin |
+| `kind` | governed enum | brief, identity, theme, PRD, workspace, package, template, app, site, presentation, marketing, report |
+| `name` | string | human-readable identity |
+| `status` | `draft \| review \| approved \| rejected \| archived` | lifecycle |
+| `currentVersionId` | artifact-version ID or null | current pointer |
+| `createdBy` | `user \| agent \| imported` | provenance |
+| `createdByTokenIdentifier` | optional string | actor when applicable |
+| `createdAt`, `updatedAt` | number | timestamps |
+
+Indexes:
+
+- `by_room_id_and_status`
+- `by_session_id_and_updated_at`
+- `by_room_id_and_kind`
+
+### 5.5 `designerAgentArtifactVersions`
+
+Immutable versions. Approval points to a version, never only to an artifact.
+
+| Field | Type | Contract |
+| --- | --- | --- |
+| `artifactId`, `roomId`, `sessionId` | IDs | ownership |
+| `version` | number | monotonic per artifact |
+| `format` | governed enum | json, markdown, svg, png, webp, pdf, pptx, zip, git-ref, figma-ref |
+| `content` | optional bounded object/string | small structured output |
+| `storageId` | optional storage ID | large/binary output |
+| `previewStorageId` | optional storage ID | optimized preview |
+| `sourceRunId` | optional run ID | generation provenance |
+| `themeId`, `themeVersion` | optional strings | visual contract |
+| `assetManifestCommit` | optional string | governed input revision |
+| `checksum` | string | integrity/idempotency |
+| `provenance` | validated object | model, provider, prompt ref, sources, license, cost |
+| `createdAt` | number | immutable timestamp |
+
+Unique index: `by_artifact_id_and_version`. Lists must be paginated.
+
+### 5.6 `designerAgentRuns`
+
+One record per tool, model, validation, import, or export execution.
+
+Fields: `roomId`, `sessionId`, `operationId`, `kind`, `toolId`, `status`,
+`provider`, `modelId`, `inputSummary`, `outputSummary`, `progress`, `attempt`,
+`startedAt`, `completedAt`, `errorCode`, `sanitizedError`, `costAmount`,
+`costCurrency`, `requiresApproval`, `approvalId`.
+
+Statuses: `queued`, `running`, `waiting-for-approval`, `succeeded`, `failed`,
+`cancelled`. Raw prompts, raw tool output, stack traces, and secrets are not
+stored in this table.
+
+Indexes:
+
+- `by_session_id_and_started_at`
+- `by_room_id_and_status`
+- `by_operation_id`
+
+### 5.7 `designerAgentApprovals`
+
+Fine-grained approvals for artifact versions and actions. This is separate from
+the existing onboarding gates.
+
+Fields: `roomId`, `sessionId`, `subjectKind`, `subjectId`, `action`, `status`,
+`requestedBy`, `requestedAt`, `resolvedByTokenIdentifier`, `resolvedAt`,
+`reason`, `expectedRevision`, `expiresAt`.
+
+Statuses: `pending`, `approved`, `rejected`, `expired`, `cancelled`.
+Publishing, deployment, repository writes, paid generation, and external human
+service requests always require an approval unless a later explicit policy
+allows otherwise.
+
+### 5.8 `designerAgentConnections`
+
+Versioned connection metadata, never secrets.
+
+Fields: `roomId`, `kind`, `status`, `label`, `repositoryUrl`, `defaultBranch`,
+`figmaFileKey`, `assetWorkspaceRef`, `providerAccountRef`, `capabilities`,
+`verifiedAt`, `createdAt`, `updatedAt`.
+
+Kinds: `git`, `figma`, `assets`, `mcp`, `media-provider`. Provider credentials
+remain in a server-side secret system. The database may store only a revocable
+opaque provider account reference.
+
+### 5.9 `designerAgentOperations`
+
+Idempotency and retry boundary for client commands and external callbacks.
+
+Fields: `roomId`, `sessionId`, `clientOperationId`, `kind`, `status`, `resultRef`,
+`createdByTokenIdentifier`, `createdAt`, `completedAt`.
+
+Unique index `by_session_id_and_client_operation_id` prevents double-send,
+double-generation, double-approval, and double-publish after retries.
+
+### 5.10 `designerAgentDecisions` and `designerAgentAuditEvents`
+
+`designerAgentDecisions` stores durable product/brand decisions with scope,
+statement, rationale, evidence references, status, superseded decision, and
+actor. It is the compact Room memory injected into future sessions.
+
+Before discovery decisions are split into that compact register, the latest
+approved discovery brief is stored as an immutable `markdown` artifact version
+and injected into later model turns as bounded Brand Room memory. Draft composer
+state and unapproved artifact versions never enter this durable context.
+
+`designerAgentAuditEvents` is append-only and stores sanitized event type,
+actor, subject, operation ID, timestamp, and bounded metadata. It never stores
+message bodies, secrets, raw prompts, raw provider responses, or stack traces.
+Audit queries are paginated and owner/reviewer restricted.
+
+## 6. Public Convex API
+
+### Queries
+
+| Function | Arguments | Result |
+| --- | --- | --- |
+| `designerAgent.getWorkspace` | `roomId` | active session summary, current stage, drafts, connections, current artifacts, pending approvals, active runs |
+| `designerAgent.getSession` | `sessionId` | authorized session metadata |
+| `designerAgent.listSessions` | `roomId`, pagination | newest Room sessions |
+| `designerAgent.listMessages` | agent thread + pagination | delegated to `@convex-dev/agent` |
+| `designerAgent.listArtifacts` | `roomId`, status/kind, pagination | artifact summaries |
+| `designerAgent.getArtifact` | `artifactId` | artifact plus current version and approval state |
+| `designerAgent.listArtifactVersions` | `artifactId`, pagination | immutable version history |
+| `designerAgent.listRuns` | `sessionId`, pagination | bounded execution history |
+| `designerAgent.listAuditEvents` | `roomId`, pagination | authorized sanitized audit log |
+
+`getWorkspace` is the initial reactive read and must avoid a client request
+waterfall. Long histories remain separate paginated queries.
+
+### Mutations
+
+| Function | Purpose |
+| --- | --- |
+| `designerAgent.startSession` | create a session and agent thread, or return an idempotent existing session |
+| `designerAgent.resumeSession` | reactivate a paused session and return the current revision |
+| `designerAgent.pauseSession` | explicit close/pause checkpoint |
+| `designerAgent.saveDraft` | upsert one bounded draft with expected client revision |
+| `designerAgent.clearDraft` | clear a saved composer/tool draft |
+| `designerAgent.updateStage` | internal/domain-validated stage transition only |
+| `designerAgent.requestApproval` | create a pending approval for a version/action |
+| `designerAgent.resolveApproval` | approve/reject with expected revision and role check |
+| `designerAgent.registerUpload` | attach uploaded source or artifact storage to the Room |
+| `designerAgent.connectWorkspace` | create/update a verified connection after server validation |
+| `designerAgent.disconnectWorkspace` | revoke metadata and dependent capabilities |
+| `designerAgent.cancelRun` | request cancellation for a cancellable run |
+| `designerAgent.archiveSession` | recoverable archive, never destructive deletion |
+
+### Actions
+
+| Function | Purpose |
+| --- | --- |
+| `designerAgent.sendMessage` | idempotently append user input, invoke the agent, stream response/tool activity, checkpoint results |
+| `designerAgent.runTool` | execute one registered governed tool through the work pool |
+| `designerAgent.retryRun` | retry an idempotent failed operation |
+| `designerAgent.verifyConnection` | server-side Git/Figma/provider capability check |
+| `designerAgent.exportArtifact` | create a governed binary export in storage |
+| `designerAgent.createHandoff` | create an MCP/Codex/Claude handoff containing approved context only |
+
+Provider-specific calls are internal actions. Public clients select a registered
+capability, not an arbitrary function name, URL, command, model endpoint, or
+prompt template.
+
+### Logo Maker through MCP
+
+The browser and MCP read `manifests/logo-skills.json` as the same Logo Maker
+source of truth. An MCP conversation calls `get_room_context`,
+`list_logo_skills` or `get_logo_skill`, and then `prepare_logo_maker_run` with
+the selected skill id, brief, and up to three optional reference ids. The
+prepared response includes the governed prompt and review sequence; it is a
+proposal handoff, not proof that generation, approval, checkpointing, or
+publishing occurred. An authenticated remote MCP adapter may submit that exact
+input to `designerAgent.runTool`, but it must preserve Room authorization,
+idempotency, audit events, artifact provenance, and the explicit human approval
+gate rather than writing around Convex.
+
+The prepared response also exposes the manifest's `qualityFramework`, including
+the shared Logo Quality Check gates and the canonical
+`docs/design-system/logo-maker-methodology.md` reference. Browser and MCP
+clients must render artifact-backed evidence for those gates; receiving the
+framework or a model-authored assessment does not by itself constitute a pass.
+
+The initial production provider is OpenAI through the server-side
+`OPENAI_API_KEY`, with `gpt-5.6-luna` as the cost-sensitive default model.
+Provider credentials never cross the Convex action boundary and are never
+written to Room state, messages, operations, or audit metadata.
+
+### File-storage mutations
+
+- `designerAgent.generateUploadUrl({ roomId, purpose })`
+- `designerAgent.attachUpload({ roomId, sessionId, storageId, purpose,
+  fileName, contentType, size, checksum })`
+- `designerAgent.getDownloadUrl({ artifactVersionId })`
+
+The attach mutation validates Room access, declared purpose, metadata, maximum
+size, actual `_storage` metadata, checksum policy, and allowed MIME type.
+
+## 7. Internal API and execution transaction
+
+Each tool execution follows this sequence:
+
+1. Public action validates identity, membership, Room access, capability, and
+   `clientOperationId`.
+2. Internal mutation creates or reuses the operation and queued run.
+3. Work pool performs the provider/tool call.
+4. Internal mutation atomically records sanitized run output, new artifact
+   version(s), current artifact pointers, decisions, audit event, and stage
+   transition.
+5. If approval is required, the run becomes `waiting-for-approval`; no external
+   write or publication occurs.
+6. Approval mutation validates the exact subject version and expected revision.
+7. An internal scheduled action performs the approved external side effect and
+   records its final reference.
+
+Failure before step 4 creates no partial approved artifact. Retried operations
+reuse the same operation ID and never duplicate side effects.
+
+## 8. Autosave and recovery contract
+
+### Save points
+
+- Message send: durable before model execution begins.
+- Composer/tool draft: debounce after 750 ms of inactivity and save on blur.
+- Selection/reference changes: save immediately as a draft.
+- Artifact/run transition: server checkpoint in the same mutation as the
+  transition.
+- Approval: transactional save before any dependent action is scheduled.
+- Navigation or explicit exit: call `pauseSession`; unsent text remains a draft.
+
+`pagehide` is best-effort only and is not the primary save mechanism.
+
+### Client state
+
+- Convex reactive queries are the server truth.
+- Optimistic UI is allowed for drafts and message submission.
+- Every mutation carries `clientOperationId` and, where applicable,
+  `expectedRevision`.
+- Revision conflict returns a typed conflict with the current server revision;
+  the client preserves both draft values and asks the user to reconcile when an
+  automatic merge is unsafe.
+- Preview mode may use local storage under a preview-only namespace. Production
+  state must never silently fall back to local storage.
+
+### Reload recovery
+
+On load, the client obtains `getWorkspace` and the agent thread messages,
+restores saved drafts, subscribes to active runs, and scrolls to the latest
+meaningful message. A `running` operation without a live worker is reconciled by
+a scheduled recovery job to `queued`, `failed`, or `waiting-for-approval` based
+on its durable checkpoint.
+
+## 9. Agent tool contract
+
+Every registered tool declares:
+
+- stable ID and version;
+- input and output validators;
+- required Room capabilities;
+- reversible or irreversible classification;
+- approval policy;
+- cost policy and currency;
+- artifact kinds it may read/write;
+- timeout, retry, and idempotency behavior;
+- sanitized progress and error vocabulary;
+- audit event types.
+
+Tools may read only approved Room context plus explicitly selected drafts and
+sources. They do not receive the entire raw conversation by default. Outputs
+cannot directly mutate approved artifacts, publish, deploy, or write to Git.
+
+## 10. Streaming and real-time behavior
+
+- Agent messages and tool steps stream through `@convex-dev/agent`.
+- Substantive designer replies persist as a bounded Markdown contract: short
+  summary, proposed directions with form/typography/palette cues, decisions
+  needed, and one next step. Browser clients may render those sections as
+  visual comparison cards and lists; API and MCP clients
+  retain the same readable source instead of receiving presentation-only JSON.
+- Artifact, approval, run, and connection panels update through reactive Convex
+  queries.
+- Streaming text is not considered an approved artifact.
+- A completed tool result is committed as a version before the UI labels it
+  saved.
+- The right output rail renders only durable or explicitly marked transient
+  results. Transient previews identify their unsaved state.
+
+## 11. Errors
+
+Public APIs return stable error codes with localized client copy:
+
+- `AUTH_REQUIRED`
+- `MEMBERSHIP_REQUIRED`
+- `ROOM_NOT_FOUND`
+- `FORBIDDEN`
+- `REVISION_CONFLICT`
+- `VALIDATION_FAILED`
+- `APPROVAL_REQUIRED`
+- `CAPABILITY_MISSING`
+- `RATE_LIMITED`
+- `PROVIDER_UNAVAILABLE`
+- `OPERATION_NOT_RETRYABLE`
+- `FILE_REJECTED`
+
+Server logs may contain an internal correlation ID. Client-visible and stored
+errors are sanitized and contain no credential, raw provider response, stack,
+or unrelated Room data.
+
+## 12. Privacy, retention, and deletion
+
+- No API keys, OAuth tokens, cookies, raw authorization headers, or local paths
+  enter messages, artifacts, audit metadata, analytics, or client storage.
+- Provider prompts and responses are retained only according to the visible
+  Room policy. Approved decisions and artifact provenance remain durable.
+- Archived sessions remain recoverable. Permanent Room deletion requires an
+  explicit destructive flow that batches child deletion and storage cleanup.
+- Export includes messages, decisions, approvals, artifacts, versions,
+  provenance, and audit events that the actor is authorized to read.
+- Analytics remains separate from operational persistence and follows consent.
+
+## 13. Limits and abuse controls
+
+- Paginate all messages, sessions, runs, versions, and audit events.
+- No unbounded arrays or `.collect()` on growing tables.
+- Draft payload: 64 KB maximum.
+- Individual structured artifact content: 256 KB maximum; larger output uses
+  storage.
+- Upload limits depend on purpose and MIME policy; current Brand source maximum
+  remains 25 MB until explicitly changed.
+- Rate limits apply to messages, provider execution, uploads, approvals, and
+  exports separately.
+- Paid operations disclose estimated cost and require an approval record before
+  execution.
+
+## 14. Client service contract
+
+The React page must consume a service/orchestration interface rather than Convex
+references directly:
+
+```ts
+type DesignerAgentService = {
+  startSession(input: StartSessionInput): Promise<SessionRef>
+  saveDraft(input: SaveDraftInput): Promise<SavedDraft>
+  sendMessage(input: SendMessageInput): Promise<OperationRef>
+  resolveApproval(input: ResolveApprovalInput): Promise<ApprovalResult>
+  connectWorkspace(input: ConnectWorkspaceInput): Promise<ConnectionResult>
+  cancelRun(input: CancelRunInput): Promise<void>
+}
+```
+
+Domain transition and approval rules remain pure in `src/domain/`. Convex
+function references live in `src/services/`. `src/utopia-os.tsx` orchestrates
+authentication and reactive data. Pages bind content, routing, and composition
+only.
+
+## 15. Test contract
+
+### Convex tests
+
+- owner and non-owner access for every public function;
+- active membership enforcement;
+- session start idempotency;
+- message operation idempotency;
+- draft save and revision conflict;
+- immutable artifact versions and monotonic version number;
+- approval of the exact expected version;
+- no publish/deploy/write before approval;
+- run retry/cancel rules;
+- connection verification and revocation;
+- storage metadata and file limits;
+- bounded and indexed pagination;
+- sanitized errors and audit events;
+- interrupted-run recovery.
+
+### Browser tests
+
+- refresh restores conversation, stage, drafts, output, and artifacts;
+- another authenticated browser receives reactive updates;
+- duplicate submission does not duplicate a message, artifact, or operation;
+- offline/failed save remains visibly unsaved and recovers;
+- revision conflict preserves both drafts;
+- approval changes the exact version shown in the output rail;
+- preview mode remains visibly local;
+- desktop/mobile and English/Arabic RTL preserve the same saved state.
+
+## 16. Delivery sequence
+
+1. Mount `@convex-dev/agent`, work pool, and rate limiter.
+2. Add session, draft, operation, run, artifact/version, approval, connection,
+   decision, and audit schemas with indexes.
+3. Implement owner-only authorization helpers and snapshot/session APIs.
+4. Implement durable agent thread, send, autosave, idempotency, and reload.
+5. Move discovery brief and Logo Maker output from React reducer state into
+   artifact versions and approvals.
+6. Move workspace connection into verified durable connections.
+7. Add recovery jobs, export/archive, and storage cleanup.
+8. Add Room collaboration roles only after owner flow passes security and
+   recovery tests.
+
+## 17. Definition of done
+
+The backend is complete only when a signed-in user can create a session, send a
+message, close the browser during execution, return from another browser, and
+recover the same conversation, stage, draft, run status, output, artifact
+version, decision, connection, and pending approval. No UI may display “saved,”
+“approved,” “connected,” or “completed” until the corresponding durable server
+record exists.

package/data/docs/email-resend.md

@@ -0,0 +1,29 @@
+# Resend newsletter integration
+
+Ceramic's homepage newsletter posts to `/api/subscribe`. The Vercel function
+registers the subscriber directly with Resend Contacts; the browser never sees
+the Resend API key.
+
+## Required configuration
+
+Set these server-side environment variables in the Vercel project:
+
+- `RESEND_API_KEY`: restricted Resend API key with Contacts access.
+- `RESEND_NEWSLETTER_SEGMENT_ID`: optional Segment ID for Ceramic subscribers.
+
+Do not prefix either variable with `VITE_`. After changing a production
+environment variable, redeploy the site so the serverless function receives it.
+
+## Runtime behavior
+
+1. Reject malformed addresses and submissions without explicit consent.
+2. Quietly accept honeypot submissions without contacting Resend.
+3. Create an opted-in Resend contact and add it to the configured Segment.
+4. If the contact already exists, restore its opted-in state and ensure Segment
+   membership instead of treating the duplicate as an error.
+5. Return only generic errors to the browser. Provider payloads and API keys are
+   never logged or returned.
+
+The endpoint currently registers contacts only. Broadcasts, templates, and
+transactional welcome emails remain controlled from Resend and require a
+verified sending domain before activation.