portal-mojo 0.1.0

package/src/admin/dns/index.ts

@@ -0,0 +1,86 @@
+import type { AdminSection } from '../index';
+import { ProviderCredentialsPage } from './ProviderCredentialsPage';
+import { DomainsPage } from './DomainsPage';
+import { DnsRecordsPage } from './DnsRecordsPage';
+import { CertificatesPage } from './CertificatesPage';
+import { DomainPurchasesPage } from './DomainPurchasesPage';
+import { RegistrantContactPage } from './RegistrantContactPage';
+import { resolveDnsDomainByName } from './api';
+import { registerDnsAdminIntegration } from './dns-integration';
+import { DNS_MANAGE_PERMISSIONS, DNS_VIEW_PERMISSIONS } from './models';
+import { registerDnsDomainLinks } from './domain-links';
+
+export * from './models';
+export * from './api';
+export * from './data';
+export * from './ProviderCredentialsPage';
+export * from './dns-data';
+export * from './dns-integration';
+export * from './domain-links';
+export * from './DomainsPage';
+export * from './DomainDetail';
+export * from './DnsRecordsPage';
+export * from './DnsRecordsPanel';
+export * from './DnsRecordEditor';
+export * from './certificate-data';
+export * from './CertificateLifecyclePoller';
+export * from './CertificatesPage';
+export * from './CertificateDetail';
+export * from './CertificateRequestDialog';
+export * from './DomainCertificatesSection';
+export * from './purchase-data';
+export * from './registrant-data';
+export * from './DomainPurchaseWizard';
+export * from './DomainOnboardingDialog';
+export * from './DomainPurchaseDetail';
+export * from './DomainPurchasesPage';
+export * from './RegistrantContactPage';
+
+registerDnsAdminIntegration({
+    resolveDomainByName: resolveDnsDomainByName,
+    recordsHref: (domainId) => `dns/records?domain=${encodeURIComponent(domainId)}`,
+});
+
+registerDnsDomainLinks(
+    { key: 'domains', label: 'Domains', icon: 'bi-globe2', route: 'domains' },
+    { key: 'records', label: 'DNS Records', icon: 'bi-list-columns', route: (domain) => `records?domain=${encodeURIComponent(domain.id)}` },
+    { key: 'certificates', label: 'Certificates', icon: 'bi-patch-check', route: (domain) => `certificates?domain__exact=${encodeURIComponent(domain.id)}` },
+    { key: 'purchases', label: 'Domain Purchases', icon: 'bi-receipt', route: 'purchases' },
+    { key: 'registrant', label: 'Registrant Contact', icon: 'bi-person-vcard', route: 'registrant' },
+    { key: 'credentials', label: 'Provider Credentials', icon: 'bi-key', route: 'credentials' },
+);
+
+export const DNS_ADMIN_SECTION = {
+    id: 'dns',
+    title: 'DNS',
+    icon: 'bi-globe2',
+    navigationGroup: 'infrastructure' as const,
+    basePath: 'dns',
+    permissions: DNS_VIEW_PERMISSIONS,
+    routes: [
+        {
+            path: 'domains', label: 'Domains',
+            component: DomainsPage, permissions: DNS_VIEW_PERMISSIONS,
+        },
+        {
+            path: 'records', label: 'DNS Records',
+            component: DnsRecordsPage, permissions: DNS_VIEW_PERMISSIONS,
+        },
+        {
+            path: 'certificates', label: 'Certificates',
+            component: CertificatesPage, permissions: DNS_VIEW_PERMISSIONS,
+        },
+        {
+            path: 'purchases', label: 'Domain Purchases',
+            component: DomainPurchasesPage, permissions: DNS_VIEW_PERMISSIONS,
+        },
+        {
+            path: 'registrant', label: 'Registrant Contact',
+            component: RegistrantContactPage, permissions: DNS_MANAGE_PERMISSIONS,
+        },
+        {
+            path: 'credentials', label: 'Provider Credentials',
+            component: ProviderCredentialsPage, permissions: DNS_VIEW_PERMISSIONS,
+        },
+    ],
+} satisfies AdminSection;

package/src/admin/dns/models.ts

@@ -0,0 +1,418 @@
+import { defineModel, type Params } from '../../client';
+import { sanitizeCertificateRow } from './certificate-data';
+
+export { sanitizeCertificateRow } from './certificate-data';
+
+export const DNS_VIEW_PERMISSIONS = ['sys.view_dns', 'sys.manage_dns', 'sys.security'];
+export const DNS_MANAGE_PERMISSIONS = ['sys.manage_dns', 'sys.security'];
+
+export interface DnsGroupChoice extends Record<string, unknown> { id: number; name: string }
+export interface DnsGroupBasic extends DnsGroupChoice { is_active?: boolean; kind?: string }
+
+export interface DnsUserBasic {
+    id: number;
+    display_name?: string;
+    username?: string;
+    last_login?: number | null;
+    last_activity?: number | null;
+    is_active?: boolean;
+    is_email_verified?: boolean;
+    is_phone_verified?: boolean;
+    is_dob_verified?: boolean;
+    avatar?: string | null;
+}
+
+export interface DnsProviderCapability {
+    name: string;
+    purchase: boolean;
+    requires_credential: boolean;
+}
+
+export interface DnsCapabilities {
+    purchase_enabled: boolean;
+    registrant_contact_configured: boolean;
+    max_domain_price: string;
+    currency: string;
+    quote_ttl_minutes: number;
+    allowed_record_types: string[];
+    search_batch_limit: number;
+    suggestions_enabled: boolean;
+    providers: DnsProviderCapability[];
+    acme: { configured: boolean; staging: boolean };
+    delegated_acme: {
+        available: boolean;
+        record_type: string;
+        target_suffix: string | null;
+        profile: string;
+        requires_provider_credentials: boolean;
+    };
+    cert_renew_days: number;
+}
+
+export interface DnsCredentialRow {
+    id: number;
+    created: number;
+    modified: number;
+    name: string;
+    provider: string;
+    is_active: boolean;
+    verified: boolean;
+    verified_at: number | null;
+    domain_count: number;
+    last_error: string | null;
+    api_key_masked: string;
+    api_secret_masked: string;
+    group: DnsGroupBasic | number | null;
+}
+
+export interface DomainRow {
+    id: number;
+    created: number;
+    modified?: number;
+    name: string;
+    provider: string;
+    status: string;
+    expires: number | null;
+    hosted_zone_id?: string | null;
+    auto_renew?: boolean;
+    privacy?: boolean;
+    verified?: boolean;
+    registered_on?: number | null;
+    last_error?: string | null;
+    group: DnsGroupBasic | number | null;
+    user?: DnsUserBasic | null;
+    credential?: Pick<DnsCredentialRow, 'id' | 'name' | 'provider' | 'is_active' | 'verified'> | number | null;
+}
+
+export interface DomainPurchaseRow {
+    id: number;
+    created: number;
+    modified: number;
+    domain_name: string;
+    kind: string;
+    status: string;
+    price: string | number | null;
+    cost: string | number | null;
+    currency: string;
+    years: number;
+    quote_expires: number | null;
+    operation_id: string | null;
+    error: string | null;
+    group: DnsGroupBasic | number | null;
+    user: DnsUserBasic | null;
+}
+
+export interface CertificateRow {
+    id: number;
+    created: number;
+    modified: number;
+    common_name: string;
+    sans: string[];
+    status: string;
+    issuer: string | null;
+    serial: string | null;
+    not_before: number | null;
+    not_after: number | null;
+    renew_after: number | null;
+    last_error: string | null;
+    attempts: number;
+    days_remaining: number | null;
+    domain: Pick<DomainRow, 'id' | 'name' | 'provider' | 'status' | 'expires'> | number;
+}
+
+export interface DnsRecordRow {
+    type: string;
+    name: string;
+    record_values: string[];
+    ttl: number;
+}
+
+export interface DnsRecordSetResponse {
+    domain: string;
+    provider: string;
+    records: DnsRecordRow[];
+}
+
+export interface RegistrarSearchRow {
+    name: string;
+    available: boolean | null;
+    status: string | null;
+    price: string | number | null;
+    currency: string | null;
+    tld: string | null;
+    tld_supported: boolean | null;
+    privacy_supported: boolean | null;
+    reason: string | null;
+}
+
+export interface RegistrarQuote {
+    purchase: number;
+    name: string;
+    price: string | number;
+    currency: string;
+    years: number;
+    /** One-use value. Keep in local call flow only; never Query-cache it. */
+    token: string;
+    expires: number;
+    privacy_supported: boolean;
+}
+
+export interface RegistrarPurchaseResult {
+    purchase: number;
+    domain: number;
+    name: string;
+    status: string;
+    operation_id: string | null;
+    privacy: boolean;
+    privacy_downgraded: boolean;
+}
+
+export interface RegistrarDiscoveryRow {
+    name: string;
+    registered: boolean;
+    hosted_zone: boolean;
+    hosted_zone_id: string | null;
+    record_count: number | null;
+    expires: number | null;
+    auto_renew: boolean | null;
+    tracked: boolean;
+    domain: number | null;
+    adoptable: boolean;
+    reason: string | null;
+}
+
+export interface RegistrarDiscoveryResponse {
+    count: number;
+    truncated: boolean;
+    domains: RegistrarDiscoveryRow[];
+}
+
+export interface RegistrantExtraParam { Name: string; Value: string }
+export interface RegistrantContact {
+    FirstName?: string; LastName?: string; ContactType?: string; OrganizationName?: string;
+    AddressLine1?: string; AddressLine2?: string; City?: string; State?: string;
+    CountryCode?: string; ZipCode?: string; PhoneNumber?: string; Email?: string;
+    Fax?: string; ExtraParams?: RegistrantExtraParam[];
+}
+
+export interface RegistrantContactResponse {
+    scope: 'group' | 'global';
+    group: number | null;
+    contact: RegistrantContact | null;
+    source: 'database' | 'settings_file' | 'none';
+    inherited: boolean;
+    effective_configured: boolean;
+    problems: string[];
+}
+
+export interface WhoisResponse {
+    name: string;
+    registrant: RegistrantContact;
+    admin: RegistrantContact;
+    tech: RegistrantContact;
+    privacy: boolean;
+    admin_privacy: boolean;
+    registrant_privacy: boolean;
+    tech_privacy: boolean;
+    auto_renew: boolean;
+    nameservers: string[];
+    registrar: string | null;
+    registered_on: number | null;
+    expires: number | null;
+    status_list: string[];
+    privacy_supported: boolean;
+}
+
+function rowObject(value: unknown): Record<string, unknown> {
+    return value != null && typeof value === 'object' && !Array.isArray(value)
+        ? value as Record<string, unknown>
+        : {};
+}
+
+function projectGroup(value: unknown): DnsGroupBasic | number | null {
+    if (value == null || typeof value === 'number') return value as number | null;
+    const raw = rowObject(value);
+    return {
+        id: raw.id as number,
+        name: raw.name as string,
+        ...(typeof raw.is_active === 'boolean' ? { is_active: raw.is_active } : {}),
+        ...(typeof raw.kind === 'string' ? { kind: raw.kind } : {}),
+    };
+}
+
+function projectUser(value: unknown): DnsUserBasic | null {
+    if (value == null) return null;
+    const raw = rowObject(value);
+    return {
+        id: raw.id as number,
+        ...(typeof raw.display_name === 'string' ? { display_name: raw.display_name } : {}),
+        ...(typeof raw.username === 'string' ? { username: raw.username } : {}),
+        ...(typeof raw.last_login === 'number' || raw.last_login === null ? { last_login: raw.last_login } : {}),
+        ...(typeof raw.last_activity === 'number' || raw.last_activity === null ? { last_activity: raw.last_activity } : {}),
+        ...(typeof raw.is_active === 'boolean' ? { is_active: raw.is_active } : {}),
+        ...(typeof raw.is_email_verified === 'boolean' ? { is_email_verified: raw.is_email_verified } : {}),
+        ...(typeof raw.is_phone_verified === 'boolean' ? { is_phone_verified: raw.is_phone_verified } : {}),
+        ...(typeof raw.is_dob_verified === 'boolean' ? { is_dob_verified: raw.is_dob_verified } : {}),
+        ...(typeof raw.avatar === 'string' || raw.avatar === null ? { avatar: raw.avatar } : {}),
+    };
+}
+
+function projectCredentialRelation(value: unknown): DomainRow['credential'] {
+    if (value == null || typeof value === 'number') return value as number | null;
+    const raw = rowObject(value);
+    return {
+        id: raw.id as number,
+        name: raw.name as string,
+        provider: raw.provider as string,
+        is_active: raw.is_active as boolean,
+        verified: raw.verified as boolean,
+    };
+}
+
+/** Explicit safe graph projectors: unknown/equivalent secret containers drop by default. */
+export function sanitizeDnsCredentialRow(row: unknown): DnsCredentialRow {
+    const raw = rowObject(row);
+    return {
+        id: raw.id as number, created: raw.created as number, modified: raw.modified as number,
+        name: raw.name as string, provider: raw.provider as string,
+        is_active: raw.is_active as boolean, verified: raw.verified as boolean,
+        verified_at: raw.verified_at as number | null, domain_count: raw.domain_count as number,
+        last_error: raw.last_error as string | null,
+        api_key_masked: raw.api_key_masked as string,
+        api_secret_masked: raw.api_secret_masked as string,
+        group: projectGroup(raw.group),
+    };
+}
+
+export function sanitizeDomainRow(row: unknown): DomainRow {
+    const raw = rowObject(row);
+    return {
+        id: raw.id as number, created: raw.created as number,
+        ...(typeof raw.modified === 'number' ? { modified: raw.modified } : {}),
+        name: raw.name as string, provider: raw.provider as string, status: raw.status as string,
+        expires: raw.expires as number | null, group: projectGroup(raw.group),
+        ...(typeof raw.hosted_zone_id === 'string' || raw.hosted_zone_id === null ? { hosted_zone_id: raw.hosted_zone_id } : {}),
+        ...(typeof raw.auto_renew === 'boolean' ? { auto_renew: raw.auto_renew } : {}),
+        ...(typeof raw.privacy === 'boolean' ? { privacy: raw.privacy } : {}),
+        ...(typeof raw.verified === 'boolean' ? { verified: raw.verified } : {}),
+        ...(typeof raw.registered_on === 'number' || raw.registered_on === null ? { registered_on: raw.registered_on } : {}),
+        ...(typeof raw.last_error === 'string' || raw.last_error === null ? { last_error: raw.last_error } : {}),
+        ...('user' in raw ? { user: projectUser(raw.user) } : {}),
+        ...('credential' in raw ? { credential: projectCredentialRelation(raw.credential) } : {}),
+    };
+}
+
+export function sanitizeDomainPurchaseRow(row: unknown): DomainPurchaseRow {
+    const raw = rowObject(row);
+    return {
+        id: raw.id as number, created: raw.created as number, modified: raw.modified as number,
+        domain_name: raw.domain_name as string, kind: raw.kind as string, status: raw.status as string,
+        price: raw.price as string | number | null, cost: raw.cost as string | number | null,
+        currency: raw.currency as string, years: raw.years as number,
+        quote_expires: raw.quote_expires as number | null,
+        operation_id: raw.operation_id as string | null, error: raw.error as string | null,
+        group: projectGroup(raw.group), user: projectUser(raw.user),
+    };
+}
+
+export function sanitizeRegistrarDiscoveryResponse(value: unknown): RegistrarDiscoveryResponse {
+    const raw = rowObject(value);
+    const domains = Array.isArray(raw.domains) ? raw.domains.map((value): RegistrarDiscoveryRow => {
+        const row = rowObject(value);
+        return {
+            name: row.name as string, registered: row.registered as boolean,
+            hosted_zone: row.hosted_zone as boolean, hosted_zone_id: row.hosted_zone_id as string | null,
+            record_count: row.record_count as number | null, expires: row.expires as number | null,
+            auto_renew: row.auto_renew as boolean | null, tracked: row.tracked as boolean,
+            domain: row.domain as number | null, adoptable: row.adoptable as boolean,
+            reason: row.reason as string | null,
+        };
+    }) : [];
+    return { count: raw.count as number, truncated: raw.truncated as boolean, domains };
+}
+
+const COMMON = new Set(['start', 'size', 'search']);
+
+function normalizeListParams(params: Params, filters: ReadonlySet<string>, sorts: ReadonlySet<string>, graph: string): Params {
+    const safe: Params = { graph };
+    for (const [key, value] of Object.entries(params)) {
+        if (value == null || value === '') continue;
+        if (COMMON.has(key) || filters.has(key)) safe[key] = value;
+    }
+    if (typeof params.sort === 'string' && sorts.has(params.sort.replace(/^-/, ''))) safe.sort = params.sort;
+    return safe;
+}
+
+export function normalizeCredentialListParams(params: Params): Params {
+    return normalizeListParams(
+        params,
+        new Set(['group', 'provider', 'provider__in', 'verified', 'is_active']),
+        new Set(['name', 'provider', 'verified', 'is_active', 'domain_count', 'created', 'modified']),
+        'default',
+    );
+}
+
+export function normalizeDomainListParams(params: Params): Params {
+    return normalizeListParams(
+        params,
+        new Set(['group', 'provider', 'status']),
+        new Set(['name', 'provider', 'status', 'expires', 'created']),
+        'list',
+    );
+}
+
+export function normalizePurchaseListParams(params: Params): Params {
+    if (params.graph != null && params.graph !== '' && params.graph !== 'basic') throw new Error('Purchase lists support only graph=basic');
+    for (const key of ['download_format', 'filename', 'export', 'download']) {
+        if (params[key] != null && params[key] !== '') throw new Error('Purchase export and download are not available');
+    }
+    return normalizeListParams(
+        params,
+        new Set(['group', 'kind', 'status', 'status__in', 'created__gte', 'created__lte']),
+        new Set(['domain_name', 'kind', 'status', 'price', 'created']),
+        'basic',
+    );
+}
+
+export function normalizeCertificateListParams(params: Params): Params {
+    if (params.graph != null && params.graph !== '' && params.graph !== 'default') {
+        throw new Error('Certificate lists support only graph=default');
+    }
+    for (const key of ['download_format', 'filename', 'export', 'download']) {
+        if (params[key] != null && params[key] !== '') throw new Error('Certificate export and download are not available');
+    }
+    return normalizeListParams(
+        params,
+        new Set(['domain', 'domain__exact', 'domain__group', 'status', 'status__in', 'not_after__gte', 'not_after__lte']),
+        new Set(['common_name', 'status', 'not_after', 'renew_after', 'created']),
+        'default',
+    );
+}
+
+export const DomainModel = defineModel<DomainRow>({
+    name: 'dns_domain', endpoint: '/api/dnsman/domain',
+    permissions: { view: DNS_VIEW_PERMISSIONS, manage: DNS_MANAGE_PERMISSIONS },
+    normalizeListParams: normalizeDomainListParams,
+    sanitizeRow: sanitizeDomainRow,
+});
+
+export const DnsCredentialModel = defineModel<DnsCredentialRow>({
+    name: 'dns_credential', endpoint: '/api/dnsman/credential',
+    permissions: { view: DNS_VIEW_PERMISSIONS, manage: DNS_MANAGE_PERMISSIONS, delete: DNS_MANAGE_PERMISSIONS },
+    normalizeListParams: normalizeCredentialListParams,
+    sanitizeRow: sanitizeDnsCredentialRow,
+});
+
+export const DomainPurchaseModel = defineModel<DomainPurchaseRow>({
+    name: 'domain_purchase', endpoint: '/api/dnsman/purchase',
+    permissions: { view: DNS_VIEW_PERMISSIONS },
+    normalizeListParams: normalizePurchaseListParams,
+    sanitizeRow: sanitizeDomainPurchaseRow,
+});
+
+export const CertificateModel = defineModel<CertificateRow>({
+    name: 'dns_certificate', endpoint: '/api/dnsman/certificate',
+    permissions: { view: DNS_VIEW_PERMISSIONS, manage: DNS_MANAGE_PERMISSIONS },
+    normalizeListParams: normalizeCertificateListParams,
+    sanitizeRow: sanitizeCertificateRow,
+});

package/src/admin/dns/purchase-data.ts

@@ -0,0 +1,67 @@
+import type { DomainPurchaseRow, RegistrarPurchaseResult, RegistrarQuote, RegistrarSearchRow } from './models';
+
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export const PURCHASE_MAY_HAVE_MOVED = 'Money may have moved. Do not retry or request another quote. Check the AWS Route 53 Domains operations console and this purchase ledger first.';
+
+export function normalizePurchaseDomain(value: unknown): string {
+    const domain = String(value ?? '').trim().toLowerCase().replace(/\.+$/, '');
+    if (!DOMAIN_RE.test(domain)) throw new Error('Enter a complete domain name, including its TLD');
+    return domain;
+}
+
+/** TLDs stay caller-authored; the backend is the only supported-TLD authority. */
+export function normalizeTypedTlds(value: string, limit: number): string[] {
+    const tlds = [...new Set(value.split(/[\s,]+/).map((item) => item.trim().toLowerCase().replace(/^\.+|\.+$/g, '')).filter(Boolean))];
+    if (!tlds.length) throw new Error('Enter at least one TLD');
+    if (tlds.length > limit) throw new Error(`Search is limited to ${limit} TLDs`);
+    if (tlds.some((tld) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(tld))) throw new Error('Enter valid TLD labels');
+    return tlds;
+}
+
+export function searchAvailabilityLabel(row: RegistrarSearchRow): string {
+    return row.available === true ? 'Available' : row.available === false ? 'Unavailable' : 'Registry did not answer';
+}
+
+export function decimalTupleEqual(left: string | number, right: string | number): boolean {
+    const normalize = (value: string | number) => {
+        const match = String(value).trim().match(/^(\d+)(?:\.(\d{1,2}))?$/);
+        if (!match) return null;
+        return BigInt(match[1]!) * 100n + BigInt((match[2] ?? '').padEnd(2, '0'));
+    };
+    const a = normalize(left); const b = normalize(right);
+    return a != null && b != null && a === b;
+}
+
+export interface QuoteIdentity { purchase: number; group: number; domain: string; years: number; price: string; currency: string; expires: number }
+export function quoteIdentity(quote: RegistrarQuote, group: number): QuoteIdentity {
+    return { purchase: quote.purchase, group, domain: normalizePurchaseDomain(quote.name), years: quote.years, price: String(quote.price), currency: quote.currency, expires: quote.expires };
+}
+export function quoteMatches(identity: QuoteIdentity, input: { group: number; domain: string; years: number; price: string | number; currency: string }, now = Date.now() / 1000): boolean {
+    return identity.group === input.group && identity.domain === normalizePurchaseDomain(input.domain) && identity.years === input.years
+        && identity.currency === input.currency && decimalTupleEqual(identity.price, input.price) && identity.expires > now;
+}
+
+export function redactRegistrarError(error: unknown): string {
+    const text = error instanceof Error ? error.message : String(error ?? 'Registrar operation failed');
+    return text.slice(0, 600).replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, '$1 [redacted]')
+        .replace(/([?&;](?:token|confirm_token|api_key|secret|password)=)[^&#;\s]*/gi, '$1[redacted]')
+        .replace(/\b(confirm[_ -]?token|secret|password)(\s*(?:is|:|=)?\s+)[A-Za-z0-9._~+/=-]{6,}/gi, '$1$2[redacted]');
+}
+
+export function sanitizePurchaseResult(value: unknown): RegistrarPurchaseResult {
+    const row = value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+    if (!Number.isInteger(row.purchase) || !Number.isInteger(row.domain) || typeof row.name !== 'string' || typeof row.status !== 'string') throw new Error('Registrar returned a malformed purchase acknowledgement');
+    return { purchase: Number(row.purchase), domain: Number(row.domain), name: normalizePurchaseDomain(row.name), status: row.status.slice(0, 32), operation_id: typeof row.operation_id === 'string' ? row.operation_id.slice(0, 128) : null, privacy: row.privacy === true, privacy_downgraded: row.privacy_downgraded === true };
+}
+
+export function purchaseTerminal(row: Pick<DomainPurchaseRow, 'status'>): boolean { return ['completed', 'failed', 'expired'].includes(row.status); }
+export const PURCHASE_POLL_DELAYS_MS = [1_000, 2_000, 3_000, 5_000, 8_000, 13_000] as const;
+export async function pollPurchaseLedger(options: { purchase: number; fetch: (id: number) => Promise<DomainPurchaseRow>; isCurrent?: () => boolean; delays?: readonly number[] }): Promise<DomainPurchaseRow | null> {
+    for (const delay of [0, ...(options.delays ?? PURCHASE_POLL_DELAYS_MS)]) {
+        if (delay) await new Promise((resolve) => setTimeout(resolve, delay));
+        if (options.isCurrent?.() === false) return null;
+        const row = await options.fetch(options.purchase);
+        if (purchaseTerminal(row)) return row;
+    }
+    return null;
+}

package/src/admin/dns/registrant-data.ts

@@ -0,0 +1,52 @@
+import type { RegistrantContact, RegistrantContactResponse } from './models';
+
+export const CONTACT_STRING_FIELDS = ['FirstName', 'LastName', 'ContactType', 'OrganizationName', 'AddressLine1', 'AddressLine2', 'City', 'State', 'CountryCode', 'ZipCode', 'PhoneNumber', 'Email', 'Fax'] as const;
+const CONTACT_TYPES = new Set(['PERSON', 'COMPANY', 'ASSOCIATION', 'PUBLIC_BODY', 'RESELLER']);
+
+export function sanitizeRegistrantResponse(value: unknown): RegistrantContactResponse {
+    const raw = value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+    if (!['group', 'global'].includes(String(raw.scope)) || !(raw.group == null || Number.isInteger(raw.group)) || !['database', 'settings_file', 'none'].includes(String(raw.source)) || typeof raw.inherited !== 'boolean' || typeof raw.effective_configured !== 'boolean' || !Array.isArray(raw.problems)) throw new Error('Registrant contact response is malformed');
+    let contact: RegistrantContact | null = null;
+    if (raw.contact != null) {
+        if (typeof raw.contact !== 'object' || Array.isArray(raw.contact)) throw new Error('Registrant contact response is malformed');
+        const source = raw.contact as Record<string, unknown>; contact = {};
+        for (const key of CONTACT_STRING_FIELDS) if (typeof source[key] === 'string') contact[key] = source[key].slice(0, 500);
+        if (Array.isArray(source.ExtraParams)) contact.ExtraParams = source.ExtraParams.slice(0, 25).flatMap((item) => {
+            if (!item || typeof item !== 'object' || Array.isArray(item)) return [];
+            const entry = item as Record<string, unknown>;
+            return typeof entry.Name === 'string' && typeof entry.Value === 'string' ? [{ Name: entry.Name.slice(0, 100), Value: entry.Value.slice(0, 500) }] : [];
+        });
+    }
+    return { scope: raw.scope as 'group' | 'global', group: raw.group as number | null, contact, source: String(raw.source) as RegistrantContactResponse['source'], inherited: raw.inherited, effective_configured: raw.effective_configured, problems: raw.problems.filter((item): item is string => typeof item === 'string').slice(0, 20).map((item) => item.slice(0, 300)) };
+}
+
+export function contactDraft(response: RegistrantContactResponse): RegistrantContact {
+    if (!response.contact || response.inherited) return {};
+    const draft: RegistrantContact = {};
+    for (const key of CONTACT_STRING_FIELDS) {
+        if (key === 'Fax' && response.source !== 'database') continue;
+        if (typeof response.contact[key] === 'string') draft[key] = response.contact[key];
+    }
+    if (response.source === 'database' && response.contact.ExtraParams) draft.ExtraParams = response.contact.ExtraParams.map((entry) => ({ ...entry }));
+    return draft;
+}
+export function contactPayload(draft: RegistrantContact, original: RegistrantContactResponse, scope: { group: number | null }): RegistrantContact {
+    const payload: RegistrantContact = {};
+    const sameScopeDatabase = original.source === 'database' && original.scope === (scope.group == null ? 'global' : 'group') && original.group === scope.group;
+    for (const key of CONTACT_STRING_FIELDS) {
+        if (key === 'Fax' && !sameScopeDatabase) continue;
+        const value = draft[key]; if (typeof value === 'string' && value.trim()) payload[key] = key === 'CountryCode' || key === 'ContactType' ? value.trim().toUpperCase() : value.trim();
+    }
+    if (sameScopeDatabase && original.contact?.ExtraParams) payload.ExtraParams = original.contact.ExtraParams.map((entry) => ({ ...entry }));
+    return payload;
+}
+export function validateContactDraft(contact: RegistrantContact): string[] {
+    const required = ['FirstName', 'LastName', 'ContactType', 'AddressLine1', 'City', 'CountryCode', 'ZipCode', 'PhoneNumber', 'Email'] as const;
+    const problems = required.filter((key) => !String(contact[key] ?? '').trim()).map((key) => `${key} is required`);
+    if (contact.ContactType && !CONTACT_TYPES.has(contact.ContactType.toUpperCase())) problems.push('ContactType is invalid');
+    if (contact.CountryCode && !/^[A-Za-z]{2}$/.test(contact.CountryCode)) problems.push('CountryCode must be two letters');
+    if (contact.PhoneNumber && !/^\+\d{1,3}\.\d{4,15}$/.test(contact.PhoneNumber)) problems.push('PhoneNumber must use +country.number format');
+    if (contact.Email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(contact.Email)) problems.push('Email is invalid');
+    if (['US', 'CA'].includes(String(contact.CountryCode ?? '').toUpperCase()) && !String(contact.State ?? '').trim()) problems.push('State is required for US and CA contacts');
+    return problems;
+}

package/src/admin/identity/index.ts

@@ -0,0 +1,5 @@
+export * from './users';
+export * from './members';
+
+export { USERS_ADMIN_SECTION } from './users';
+export { MEMBERS_ADMIN_SECTION } from './members';