create-snapify-app 0.0.0-stage → 1.1.0

package/template/server/platform/hostingProviders.ts

@@ -0,0 +1,143 @@
+/**
+ * Snapify — référentiel hébergeurs (formulaire de commande licence)
+ * Tunisie : bureaux d'enregistrement .tn accrédités ATI (registre.tn) + hébergeurs locaux.
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ */
+
+export type HostingProvider = {
+  id: string;
+  name: string;
+  website?: string;
+  group: 'tn' | 'intl' | 'other';
+};
+
+const TN: Array<Omit<HostingProvider, 'group'>> = [
+  { id: 'ati', name: 'ATI — At-Tounessya Internet', website: 'ati.tn' },
+  { id: 'tunisie-telecom', name: 'Tunisie Telecom', website: 'tunisietelecom.tn' },
+  { id: 'orange-tn', name: 'Orange Tunisie', website: 'orange.tn' },
+  { id: 'ooredoo-tn', name: 'Ooredoo Tunisie', website: 'ooredoo.tn' },
+  { id: 'topnet', name: 'Topnet', website: 'topnet.tn' },
+  { id: 'globalnet', name: '3S Globalnet', website: 'globalnet.tn' },
+  { id: 'hexabyte', name: 'Hexabyte', website: 'hexabyte.tn' },
+  { id: 'bee', name: 'BEE — Internet Smart Solutions', website: 'bee.tn' },
+  { id: 'tunet', name: 'Tunet', website: 'tunet.tn' },
+  { id: 'localhost-tn', name: 'Localhost (cloud.tn)', website: 'cloud.tn' },
+  { id: 'atlax', name: 'ATLAX', website: 'atlax.com' },
+  { id: 'oxabox', name: 'OXABOX (Tanit Web)', website: 'oxabox.com' },
+  { id: 'oxahost', name: 'OxaHost', website: 'oxahost.tn' },
+  { id: 'novahoster', name: 'NovaHoster', website: 'novahoster.tn' },
+  { id: 'sjr', name: 'SJR', website: 'sjr.tn' },
+  { id: 'proxiweb', name: 'Proxiweb', website: 'proxiweb.tn' },
+  { id: 'eo-datacenter', name: 'EO Datacenter' },
+  { id: 'elb', name: 'ELB' },
+  { id: 'vip-domaine', name: 'VIP Domaine' },
+  { id: 'cnte', name: 'CNTE' },
+  { id: 'safozi', name: 'SAFOZI' },
+  { id: 'next-step-it', name: 'Next Step IT' },
+  { id: 'dyxis', name: 'Dyxis' },
+  { id: 'point-com', name: 'Point Com Développement' },
+  { id: 'mind-hosting', name: 'Mind Hosting' },
+  { id: 'focus-ts', name: 'Focus Technology Solutions' },
+  { id: 'experts-company', name: 'Experts Company' },
+];
+
+const INTL: Array<Omit<HostingProvider, 'group'>> = [
+  { id: 'ovh', name: 'OVHcloud', website: 'ovhcloud.com' },
+  { id: 'hostinger', name: 'Hostinger', website: 'hostinger.fr' },
+  { id: 'o2switch', name: 'o2switch', website: 'o2switch.fr' },
+  { id: 'lws', name: 'LWS', website: 'lws.fr' },
+  { id: 'ionos', name: 'IONOS', website: 'ionos.fr' },
+  { id: 'gandi', name: 'Gandi', website: 'gandi.net' },
+  { id: 'hetzner', name: 'Hetzner', website: 'hetzner.com' },
+  { id: 'contabo', name: 'Contabo', website: 'contabo.com' },
+  { id: 'digitalocean', name: 'DigitalOcean', website: 'digitalocean.com' },
+  { id: 'aws', name: 'Amazon Web Services (Lightsail / EC2)', website: 'aws.amazon.com' },
+  { id: 'gcp', name: 'Google Cloud', website: 'cloud.google.com' },
+  { id: 'azure', name: 'Microsoft Azure', website: 'azure.microsoft.com' },
+  { id: 'godaddy', name: 'GoDaddy', website: 'godaddy.com' },
+  { id: 'namecheap', name: 'Namecheap', website: 'namecheap.com' },
+];
+
+const OTHER: Array<Omit<HostingProvider, 'group'>> = [
+  { id: 'none', name: 'Pas encore d’hébergement — conseillez-moi' },
+  { id: 'other', name: 'Autre hébergeur' },
+];
+
+export const HOSTING_PROVIDERS: HostingProvider[] = [
+  ...[...TN].sort((a, b) => a.name.localeCompare(b.name, 'fr')).map((p) => ({ ...p, group: 'tn' as const })),
+  ...[...INTL].sort((a, b) => a.name.localeCompare(b.name, 'fr')).map((p) => ({ ...p, group: 'intl' as const })),
+  ...OTHER.map((p) => ({ ...p, group: 'other' as const })),
+];
+
+export const GOUVERNORATS = [
+  'Ariana', 'Béja', 'Ben Arous', 'Bizerte', 'Gabès', 'Gafsa', 'Jendouba', 'Kairouan',
+  'Kasserine', 'Kébili', 'Le Kef', 'Mahdia', 'La Manouba', 'Médenine', 'Monastir', 'Nabeul',
+  'Sfax', 'Sidi Bouzid', 'Siliana', 'Sousse', 'Tataouine', 'Tozeur', 'Tunis', 'Zaghouan',
+];
+
+/** Régions administratives France (marché .fr / intl). */
+export const FR_REGIONS = [
+  'Auvergne-Rhône-Alpes',
+  'Bourgogne-Franche-Comté',
+  'Bretagne',
+  'Centre-Val de Loire',
+  'Corse',
+  'Grand Est',
+  'Hauts-de-France',
+  'Île-de-France',
+  'Normandie',
+  'Nouvelle-Aquitaine',
+  'Occitanie',
+  'Pays de la Loire',
+  "Provence-Alpes-Côte d'Azur",
+  'Guadeloupe',
+  'Guyane',
+  'Martinique',
+  'Mayotte',
+  'La Réunion',
+  'Autre / UE',
+  'International',
+];
+
+export const SITE_TYPES = [
+  { id: 'vitrine', label: 'Site vitrine' },
+  { id: 'boutique', label: 'Boutique en ligne' },
+  { id: 'blog', label: 'Blog / média' },
+  { id: 'multi', label: 'Multi-sites / agence' },
+] as const;
+
+export const HOSTING_TYPES = [
+  { id: 'mutualise', label: 'Mutualisé' },
+  { id: 'vps', label: 'VPS' },
+  { id: 'dedie', label: 'Serveur dédié' },
+  { id: 'cloud', label: 'Cloud' },
+  { id: 'unknown', label: 'Je ne sais pas' },
+] as const;
+
+export const ACCESS_TYPES = [
+  { id: 'cpanel', label: 'cPanel' },
+  { id: 'plesk', label: 'Plesk' },
+  { id: 'directadmin', label: 'DirectAdmin' },
+  { id: 'ssh', label: 'SSH / root' },
+  { id: 'unknown', label: 'Je ne sais pas' },
+] as const;
+
+export function providerById(id: string) {
+  return HOSTING_PROVIDERS.find((p) => p.id === id) || null;
+}
+
+export function orderFormOptions(market: 'tn' | 'fr' = 'tn') {
+  const providers =
+    market === 'fr'
+      ? HOSTING_PROVIDERS.filter((p) => p.group !== 'tn')
+      : HOSTING_PROVIDERS;
+  return {
+    market,
+    regionLabel: market === 'fr' ? 'Région' : 'Gouvernorat',
+    providers,
+    gouvernorats: market === 'fr' ? FR_REGIONS : GOUVERNORATS,
+    siteTypes: SITE_TYPES,
+    hostingTypes: HOSTING_TYPES,
+    accessTypes: ACCESS_TYPES,
+  };
+}

package/template/server/platform/licenseOrders.ts

@@ -0,0 +1,291 @@
+/**
+ * Snapify — commandes licence annuelle (699 DT)
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ */
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { generatePayment } from './flouci';
+import { formatDt } from './settings';
+import { HttpError } from '../http';
+import { ACCESS_TYPES, FR_REGIONS, GOUVERNORATS, HOSTING_TYPES, SITE_TYPES, providerById } from './hostingProviders';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const FILE = path.resolve(__dirname, '../../data/license-orders.json');
+
+export type LicenseOrderDetails = {
+  company?: string;
+  phone: string;
+  gouvernorat: string;
+  city?: string;
+  siteType: string;
+  domainStatus: 'owned' | 'to-register';
+  providerId: string;
+  providerName: string;
+  hostingType: string;
+  accessType: string;
+  serverIp?: string;
+  theme?: string;
+  message?: string;
+};
+
+export type LicenseOrder = {
+  id: string;
+  name: string;
+  email: string;
+  domain: string;
+  hostingNotes: string;
+  details?: LicenseOrderDetails;
+  amountMillimes: number;
+  status: 'pending' | 'paid' | 'failed';
+  paymentId?: string;
+  createdAt: string;
+  paidAt?: string;
+};
+
+export type LicenseCheckoutInput = {
+  name: string;
+  email: string;
+  domain: string;
+  company?: string;
+  phone: string;
+  gouvernorat: string;
+  city?: string;
+  siteType: string;
+  domainStatus: string;
+  providerId: string;
+  providerOther?: string;
+  hostingType: string;
+  accessType: string;
+  serverIp?: string;
+  theme?: string;
+  message?: string;
+  acceptTerms: boolean;
+  publicBase: string;
+  /** Marché TN / FR pour la fiche client + CGU. */
+  market?: 'tn' | 'fr';
+  country?: string;
+};
+
+async function load(): Promise<LicenseOrder[]> {
+  try {
+    return JSON.parse(await fs.readFile(FILE, 'utf8')) as LicenseOrder[];
+  } catch {
+    return [];
+  }
+}
+
+async function save(rows: LicenseOrder[]) {
+  await fs.mkdir(path.dirname(FILE), { recursive: true });
+  await fs.writeFile(FILE, JSON.stringify(rows, null, 2));
+}
+
+export function licensePriceMillimes(): number {
+  return Math.max(1_000, Number(process.env.LICENSE_PRICE_MILLIMES) || 699_000);
+}
+
+const clean = (v: string | undefined, max: number) => (v || '').trim().slice(0, max);
+
+function validateCheckout(input: LicenseCheckoutInput) {
+  const name = clean(input.name, 120);
+  const email = clean(input.email, 160).toLowerCase();
+  const domain = clean(input.domain, 120)
+    .toLowerCase()
+    .replace(/^https?:\/\//, '')
+    .replace(/\/.*$/, '');
+  const phone = clean(input.phone, 30);
+  const gouvernorat = clean(input.gouvernorat, 40);
+  const siteType = clean(input.siteType, 20);
+  const providerId = clean(input.providerId, 40);
+  const provider = providerById(providerId);
+  const providerOther = clean(input.providerOther, 120);
+  const hostingType = clean(input.hostingType, 20) || 'unknown';
+  const accessType = clean(input.accessType, 20) || 'unknown';
+  const serverIp = clean(input.serverIp, 64);
+
+  const fail = (msg: string) => {
+    throw new HttpError(422, msg);
+  };
+  if (name.length < 3) fail('Nom complet requis');
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) fail('Adresse e-mail invalide');
+  if (phone.replace(/\D/g, '').length < 8) fail('Numéro de téléphone invalide');
+  const regionsOk = GOUVERNORATS.includes(gouvernorat) || FR_REGIONS.includes(gouvernorat);
+  if (!regionsOk) fail(input.market === 'fr' ? 'Région requise' : 'Gouvernorat requis');
+  if (!SITE_TYPES.some((s) => s.id === siteType)) fail('Type de site requis');
+  if (!/^([a-z0-9-]+\.)+[a-z]{2,}$/.test(domain)) fail('Nom de domaine invalide (ex. maboutique.tn)');
+  if (!provider) fail('Hébergeur requis');
+  if (providerId === 'other' && providerOther.length < 2) fail('Précisez le nom de votre hébergeur');
+  if (!HOSTING_TYPES.some((h) => h.id === hostingType)) fail('Type d’hébergement invalide');
+  if (!ACCESS_TYPES.some((a) => a.id === accessType)) fail('Type d’accès invalide');
+  if (!input.acceptTerms) fail('Veuillez accepter les conditions');
+
+  const details: LicenseOrderDetails = {
+    company: clean(input.company, 120) || undefined,
+    phone,
+    gouvernorat,
+    city: clean(input.city, 80) || undefined,
+    siteType,
+    domainStatus: input.domainStatus === 'to-register' ? 'to-register' : 'owned',
+    providerId,
+    providerName: providerId === 'other' ? providerOther : provider!.name,
+    hostingType,
+    accessType,
+    serverIp: serverIp || undefined,
+    theme: clean(input.theme, 40) || undefined,
+    message: clean(input.message, 2000) || undefined,
+  };
+
+  const label = (list: readonly { id: string; label: string }[], id: string) => list.find((x) => x.id === id)?.label || id;
+  const hostingNotes = [
+    `Hébergeur : ${details.providerName}`,
+    `Type : ${label(HOSTING_TYPES, hostingType)} · Accès : ${label(ACCESS_TYPES, accessType)}`,
+    details.serverIp ? `IP serveur : ${details.serverIp}` : '',
+    details.message ? `Notes : ${details.message}` : '',
+  ]
+    .filter(Boolean)
+    .join('\n');
+
+  return { name, email, domain, details, hostingNotes };
+}
+
+export async function startLicenseCheckout(input: LicenseCheckoutInput) {
+  const { name, email, domain, details, hostingNotes } = validateCheckout(input);
+
+  const id = crypto.randomUUID();
+  const amountMillimes = licensePriceMillimes();
+  const base = input.publicBase.replace(/\/$/, '');
+  const payment = await generatePayment({
+    amountMillimes,
+    trackingId: `license_${id}`,
+    successLink: `${base}/commander/success`,
+    failLink: `${base}/commander/fail`,
+    webhook: `${base}/api/platform/flouci/webhook`,
+  });
+
+  const order: LicenseOrder = {
+    id,
+    name,
+    email,
+    domain,
+    hostingNotes,
+    details,
+    amountMillimes,
+    status: 'pending',
+    paymentId: payment.paymentId,
+    createdAt: new Date().toISOString(),
+  };
+  const rows = await load();
+  rows.unshift(order);
+  await save(rows.slice(0, 500));
+
+  // Fiche client + compte + e-mail de bienvenue (identifiants)
+  try {
+    const { ensureClientFromLicenseOrder } = await import('./clients');
+    const market = input.market === 'fr' ? 'fr' : 'tn';
+    const profile = await ensureClientFromLicenseOrder(order, {
+      market,
+      country: input.country,
+    });
+    const { provisionClientAndWelcome } = await import('./clientWelcome');
+    const mail = await provisionClientAndWelcome(profile, order, { market });
+    console.log(`[license] fiche ${profile.id} · compte=${mail.createdAccount} · mail=${mail.mailed}`);
+  } catch (e) {
+    console.warn('[license] fiche / bienvenue client', e);
+  }
+
+  return { orderId: id, link: payment.link, amountLabel: formatDt(amountMillimes) };
+}
+
+export async function markLicensePaidByPaymentId(paymentId: string) {
+  const rows = await load();
+  const idx = rows.findIndex((r) => r.paymentId === paymentId || `license_${r.id}` === paymentId.replace(/^mock_/, ''));
+  // tracking mock_license_<uuid>
+  let order = idx >= 0 ? rows[idx] : null;
+  if (!order && paymentId.startsWith('mock_license_')) {
+    const id = paymentId.slice('mock_license_'.length);
+    order = rows.find((r) => r.id === id) || null;
+  }
+  if (!order && paymentId.startsWith('mock_')) {
+    const tracking = paymentId.slice(5);
+    if (tracking.startsWith('license_')) {
+      const id = tracking.slice('license_'.length);
+      order = rows.find((r) => r.id === id) || null;
+    }
+  }
+  if (!order) return null;
+  order.status = 'paid';
+  order.paidAt = new Date().toISOString();
+  await save(rows);
+  try {
+    const { ensureClientFromLicenseOrder } = await import('./clients');
+    await ensureClientFromLicenseOrder(order);
+  } catch (e) {
+    console.warn('[license] fiche client paid', e);
+  }
+  console.log(`[license] payée : ${order.email} · ${order.domain}`);
+  return order;
+}
+
+export async function listLicenseOrders() {
+  return load();
+}
+
+/** Mise à jour manuelle du statut (superadmin) — virement reçu, annulation, etc. */
+export async function setLicenseOrderStatus(id: string, status: 'pending' | 'paid' | 'failed') {
+  const rows = await load();
+  const order = rows.find((r) => r.id === id);
+  if (!order) return null;
+  order.status = status;
+  if (status === 'paid') order.paidAt = order.paidAt || new Date().toISOString();
+  else if (status === 'pending') delete order.paidAt;
+  await save(rows);
+  return order;
+}
+
+/** Édition manuelle des champs client / projet (superadmin). */
+export async function updateLicenseOrder(
+  id: string,
+  patch: Partial<Pick<LicenseOrder, 'name' | 'email' | 'domain' | 'hostingNotes' | 'amountMillimes' | 'status'>> & {
+    details?: Partial<LicenseOrderDetails>;
+  }
+) {
+  const rows = await load();
+  const order = rows.find((r) => r.id === id);
+  if (!order) return null;
+  if (typeof patch.name === 'string') order.name = clean(patch.name, 120) || order.name;
+  if (typeof patch.email === 'string') {
+    const email = clean(patch.email, 160).toLowerCase();
+    if (email) order.email = email;
+  }
+  if (typeof patch.domain === 'string') {
+    const domain = clean(patch.domain, 120)
+      .toLowerCase()
+      .replace(/^https?:\/\//, '')
+      .replace(/\/.*$/, '');
+    if (domain) order.domain = domain;
+  }
+  if (typeof patch.hostingNotes === 'string') order.hostingNotes = clean(patch.hostingNotes, 2000);
+  if (typeof patch.amountMillimes === 'number' && Number.isFinite(patch.amountMillimes)) {
+    order.amountMillimes = Math.max(1_000, Math.round(patch.amountMillimes));
+  }
+  if (patch.status === 'pending' || patch.status === 'paid' || patch.status === 'failed') {
+    order.status = patch.status;
+    if (patch.status === 'paid') order.paidAt = order.paidAt || new Date().toISOString();
+    else if (patch.status === 'pending') delete order.paidAt;
+  }
+  if (patch.details && typeof patch.details === 'object') {
+    order.details = { ...(order.details || { phone: '', gouvernorat: '', siteType: '', domainStatus: 'owned', providerId: '', providerName: '', hostingType: 'unknown', accessType: 'unknown' }), ...patch.details };
+  }
+  await save(rows);
+  return order;
+}
+
+export async function deleteLicenseOrder(id: string) {
+  const rows = await load();
+  const idx = rows.findIndex((r) => r.id === id);
+  if (idx < 0) return null;
+  const [removed] = rows.splice(idx, 1);
+  await save(rows);
+  return removed;
+}

package/template/server/platform/money.ts

@@ -0,0 +1,42 @@
+/**
+ * Affichage monétaire marketplace / plateforme.
+ * Source de vérité = millimes DT ; hors Tunisie → conversion affichage en EUR.
+ * Aligné landing : ~699 DT ≈ 99 € → 7 DT = 1 €.
+ */
+export const DT_PER_EUR = 7;
+
+export function isTunisiaCountry(country?: string | null): boolean {
+  return (country || '').trim().toUpperCase() === 'TN';
+}
+
+export function formatDt(millimes: number): string {
+  const n = Math.max(0, Number(millimes) || 0);
+  return `${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 3)} DT`;
+}
+
+export function formatEurFromMillimes(millimes: number): string {
+  const n = Math.max(0, Number(millimes) || 0);
+  const eur = n / 1000 / DT_PER_EUR;
+  const rounded = Math.round(eur * 100) / 100;
+  return `${rounded.toFixed(rounded % 1 === 0 ? 0 : 2).replace('.', ',')} €`;
+}
+
+/** Gratuit reste « Gratuit » ; sinon DT (TN) ou € (reste du monde). */
+export function formatMoney(millimes: number, country?: string | null): string {
+  const n = Math.max(0, Number(millimes) || 0);
+  if (n === 0) return 'Gratuit';
+  return isTunisiaCountry(country) ? formatDt(n) : formatEurFromMillimes(n);
+}
+
+export function moneyCurrency(country?: string | null): 'TND' | 'EUR' {
+  return isTunisiaCountry(country) ? 'TND' : 'EUR';
+}
+
+export function countryFromRequest(req: { headers: Record<string, unknown>; ip?: string }, clientIpFn: (req: unknown) => string, resolveGeo: (ip: string) => { country?: string | null }): string {
+  try {
+    const geo = resolveGeo(clientIpFn(req));
+    return (geo.country || '').toUpperCase();
+  } catch {
+    return '';
+  }
+}

package/template/server/platform/passwords.ts

@@ -0,0 +1,41 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import crypto from 'crypto';
+
+export function hashPassword(password: string, salt?: string): { hash: string; salt: string } {
+  const s = salt || crypto.randomBytes(16).toString('hex');
+  const hash = crypto.scryptSync(password, s, 64).toString('hex');
+  return { hash, salt: s };
+}
+
+function safeEqual(a: Buffer, b: Buffer): boolean {
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+export function verifyPassword(password: string, passwordHash: string, salt: string): boolean {
+  const { hash } = hashPassword(password, salt);
+  return safeEqual(Buffer.from(hash, 'hex'), Buffer.from(passwordHash, 'hex'));
+}
+
+export function validatePlatformPassword(password: string): string | null {
+  if (password.length < 8) return 'Le mot de passe doit contenir au moins 8 caractères.';
+  if (password.length > 200) return 'Le mot de passe est trop long.';
+  if (!/[A-Za-z]/.test(password) || !/\d/.test(password)) {
+    return 'Le mot de passe doit contenir au moins une lettre et un chiffre.';
+  }
+  return null;
+}
+
+export function slugify(input: string): string {
+  return input
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-|-$/g, '')
+    .slice(0, 80) || 'item';
+}

package/template/server/platform/region.ts

@@ -0,0 +1,86 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import type { NextFunction, Request, Response } from 'express';
+import { clientIp } from '../security/ip';
+import { resolveGeoFromIp } from '../geoip';
+
+/** Paires apex / sous-domaines Tunisie ↔ international. */
+const REGION_HOST_PAIRS: Array<[tn: string, fr: string]> = [
+  ['snapify.tn', 'snapify.fr'],
+  ['www.snapify.tn', 'www.snapify.fr'],
+  ['marketplace.snapify.tn', 'marketplace.snapify.fr'],
+  ['community.snapify.tn', 'community.snapify.fr'],
+  ['developers.snapify.tn', 'developers.snapify.fr'],
+];
+
+const TN_TO_FR = new Map(REGION_HOST_PAIRS);
+const FR_TO_TN = new Map(REGION_HOST_PAIRS.map(([tn, fr]) => [fr, tn]));
+
+function requestHost(req: Request): string {
+  const xf = String(req.headers['x-forwarded-host'] || '')
+    .split(',')[0]
+    .trim();
+  const raw = xf || String(req.headers.host || '');
+  return raw.split(':')[0].toLowerCase();
+}
+
+/** Domaine de cookie plateforme selon le TLD courant (.snapify.tn ou .snapify.fr). */
+export function platformCookieDomainForHost(host: string): string | undefined {
+  const h = host.toLowerCase();
+  if (h === 'snapify.tn' || h.endsWith('.snapify.tn')) return '.snapify.tn';
+  if (h === 'snapify.fr' || h.endsWith('.snapify.fr')) return '.snapify.fr';
+  const env = process.env.PLATFORM_COOKIE_DOMAIN?.trim();
+  return env || undefined;
+}
+
+const SEARCH_CRAWLER_RE =
+  /googlebot|bingbot|yandex|duckduckbot|slurp|baiduspider|facebookexternalhit|twitterbot|linkedinbot|applebot|semrush|ahrefs|dotbot|mj12bot/i;
+
+function skipGeoRedirect(req: Request): boolean {
+  if (req.method !== 'GET' && req.method !== 'HEAD') return true;
+  const p = req.path || '';
+  if (p.startsWith('/api/') || p.startsWith('/uploads/') || p.startsWith('/assets/') || p.startsWith('/sdk/')) return true;
+  if (/\.(js|css|map|ico|png|jpe?g|webp|svg|woff2?|ttf|txt|xml|json)$/i.test(p)) return true;
+  // Sitemap / SEO : jamais de redirect géo (évite GSC « Sitemap is HTML » et perte d’index .tn)
+  if (
+    p === '/sitemap' ||
+    p === '/sitemap.xml.gz' ||
+    p === '/sitemap_index.xml' ||
+    p === '/sitemap-landing.xml' ||
+    p === '/robots.txt' ||
+    p === '/llms.txt'
+  ) {
+    return true;
+  }
+  // Crawlers : laisser indexer .tn et .fr indépendamment (sinon Googlebot US ne voit jamais .tn)
+  if (SEARCH_CRAWLER_RE.test(String(req.headers['user-agent'] || ''))) return true;
+  // Opt-out ponctuel : ?region=stay
+  if (String((req.query as Record<string, unknown>)?.region || '') === 'stay') return true;
+  return false;
+}
+
+/**
+ * Tunisie → *.snapify.tn ; hors Tunisie → *.snapify.fr.
+ * 302 (pas 301) pour ne pas figer le géo dans les caches SEO / navigateurs.
+ * Jamais pour les crawlers ni les URLs sitemap/robots.
+ */
+export function geoRegionRedirect(req: Request, res: Response, next: NextFunction): void {
+  if (skipGeoRedirect(req)) return next();
+
+  const host = requestHost(req);
+  const country = (resolveGeoFromIp(clientIp(req)).country || '').toUpperCase();
+  // IP locale / inconnue : laisser le host tel quel
+  if (!country) return next();
+
+  const target = country === 'TN' ? FR_TO_TN.get(host) : TN_TO_FR.get(host);
+  if (!target) return next();
+
+  const proto = String(req.headers['x-forwarded-proto'] || (req.secure ? 'https' : 'http')).split(',')[0].trim() || 'https';
+  const dest = `${proto}://${target}${req.originalUrl || '/'}`;
+  res.setHeader('Cache-Control', 'no-store');
+  res.redirect(302, dest);
+}