portal-mojo 0.2.20 → 0.2.21

package/src/client/maintenance-mock.ts

@@ -0,0 +1,285 @@
+/** Mock-owned Maintenance provider simulation. Never performs a provider request. */
+import { backendGlobalCan, type BackendGlobalUser } from '../admin/fleet/access';
+import type { Finding, Framework, Report } from '../admin/maintenance/data';
+export const MAINTENANCE_SCENARIOS = [
+    'findings',
+    'support-overdue', 'support-soon', 'later-target', 'status-missing', 'status-error',
+    'framework-cached', 'policy-lost-response', 'policy-refused', 'framework-converged', 'framework-converged-version-missing', 'framework-failed', 'framework-missing-deployment',
+    'empty',
+    'denied-inventory',
+    'unavailable',
+    'scanning-off',
+    'external',
+    'bootstrap-denied',
+    'bootstrap-malformed',
+    'next-window',
+    'target-before-settled',
+    'settled-old',
+    'mixed-cache',
+    'all-members-upgraded',
+    'provider-unknown',
+    'duplicate',
+    'cache-refusal',
+    'stale-target',
+    'reauth',
+    'framework-held',
+    'framework-pinned',
+    'framework-current',
+    'framework-unknown',
+    'framework-no-converged',
+    'framework-requires-superuser',
+    'framework-pin-cleared-503',
+    'framework-lost-response',
+] as const;
+export type MaintenanceScenario = (typeof MAINTENANCE_SCENARIOS)[number];
+let scenario: MaintenanceScenario = 'findings';
+const pending = new Map<string, { target: string; immediate: boolean; reads: number }>();
+let frameworkRequested = false;
+let policyValue: string | undefined;
+let deploymentReads = 0;
+const deploymentId = '92450000-0000-4000-8000-000000000001';
+export function setMockMaintenanceScenario(value: MaintenanceScenario) {
+    scenario = value;
+    pending.clear();
+    frameworkRequested = false; policyValue = undefined; deploymentReads = 0;
+}
+export function readMaintenanceBootstrapFacts(): {
+    mode: 'managed' | 'external';
+    infrastructureManaged: boolean;
+    bootstrap: 'ok' | 'denied' | 'malformed';
+} {
+    return {
+        mode: scenario === 'external' ? 'external' : 'managed',
+        infrastructureManaged: scenario !== 'external',
+        bootstrap:
+            scenario === 'bootstrap-denied'
+                ? 'denied'
+                : scenario === 'bootstrap-malformed'
+                  ? 'malformed'
+                  : 'ok',
+    };
+}
+const date = () => new Date().toISOString();
+const finding = (
+    kind: Finding['kind'],
+    resource_id: string,
+    engine: string,
+    current_version: string,
+    available_major: string,
+): Finding => ({
+    kind,
+    resource_id,
+    engine,
+    current_version,
+    available_major,
+    deadline: kind === 'elasticache' ? null : '2027-02-28T00:00:00Z',
+    extended_deadline: kind === 'elasticache' ? null : '2030-02-28T00:00:00Z',
+    days_remaining: kind === 'elasticache' ? null : scenario === 'support-overdue' ? -14 : scenario === 'support-soon' ? 30 : 130,
+    note:
+        kind === 'elasticache'
+            ? 'A replication group can contain mixed member versions.'
+            : 'Review engine compatibility and snapshot recovery before applying.',
+    release_notes_url: 'https://docs.aws.amazon.com/',
+    status: 'available',
+    pending_version: null,
+    settled: true,
+    ...(kind === 'elasticache' ? { members: 2, engine_versions: ['6.2', '6.0'] } : {}),
+});
+export function maintenanceMockReport(): Report {
+    return {
+        schema_version: 1,
+        generated_at: date(),
+        region: 'us-east-1',
+        status: scenario === 'unavailable' ? 'unavailable' : 'ok',
+        level: 5,
+        scheduled: scenario !== 'scanning-off',
+        findings: ['empty', 'unavailable'].includes(scenario)
+            ? []
+            : [
+                  { ...finding('rds-instance', 'orders-db', 'postgres', scenario === 'later-target' && (pending.get('rds-instance:orders-db')?.reads ?? 0) >= 2 ? pending.get('rds-instance:orders-db')!.target : '14.12', scenario === 'later-target' && (pending.get('rds-instance:orders-db')?.reads ?? 0) >= 2 ? '17.2' : '16.4') },
+                  finding('rds-cluster', 'analytics-cluster', 'aurora-postgresql', '13.12', '15.8'),
+                  finding('elasticache', 'session-cache', 'redis', '6.2', '7.1'),
+                  finding('elasticache', 'standalone-cache', 'redis', '6.0', '7.1'),
+              ],
+        warnings:
+            scenario === 'denied-inventory'
+                ? [
+                      { iam_action: 'rds:DescribeDBClusters', aws_code: 'AccessDenied' },
+                      { iam_action: 'elasticache:DescribeReplicationGroups', aws_code: 'AccessDenied' },
+                  ]
+                : [],
+        reason: scenario === 'unavailable' ? 'AWS credentials unavailable' : null,
+    };
+}
+export function maintenanceMockFramework(user: BackendGlobalUser): Framework {
+    const defaultPin = ['framework-held','framework-pin-cleared-503'].includes(scenario) ? 'hold' : scenario === 'framework-pinned' ? '4.0.0' : '';
+    const pin = policyValue ?? (frameworkRequested ? '' : defaultPin);
+    const mode = pin === '' ? 'latest' : pin === 'hold' ? 'hold' : 'pinned';
+    const unknown = scenario === 'framework-unknown';
+    const latest = unknown ? null : scenario === 'framework-current' ? '4.0.0' : '4.1.0';
+    const installed = '4.0.0';
+    const update_available = !!latest && latest !== installed && mode === 'latest';
+    const blocked_reason: Framework['blocked_reason'] = scenario === 'external' ? 'infrastructure_external' : !latest || !update_available && mode === 'latest' ? 'update_unavailable' : mode !== 'latest' && user.is_superuser !== true ? 'requires_superuser' : scenario === 'framework-no-converged' ? 'no_converged_deployment' : scenario === 'framework-requires-superuser' ? 'requires_superuser' : null;
+    return {schema_version:1, installed, latest, checked_at:date(), source:unknown?'unavailable':scenario==='framework-cached'?'cache':'pypi',update_available,pin:{mode,value:pin||null},can_update:blocked_reason===null,blocked_reason};
+}
+const ok = (data: unknown) => ({ status: true, data });
+const fail = (code: string, status: number, data?: unknown) => ({
+    status: false,
+    error: code.replaceAll('_', ' '),
+    error_code: code,
+    code: status,
+    ...(data ? { data } : {}),
+});
+export interface MaintenanceMockContext {
+    user?: (BackendGlobalUser & { is_active?: boolean; id?: number | string }) | null;
+    keyBacked?: boolean;
+    fresh?: boolean;
+}
+export function maintenanceMock(
+    path: string,
+    method: string,
+    body: Record<string, unknown> | undefined,
+    params: Record<string, unknown> = {},
+    context: MaintenanceMockContext = {},
+): unknown {
+    const aws = [
+            '/api/aws/maintenance/versions',
+            '/api/aws/maintenance/status',
+            '/api/aws/maintenance/apply',
+        ].includes(path),
+        framework =
+            path === '/api/account/admin/platform/framework' ||
+            path === '/api/account/admin/platform/framework/update';
+    const policy = path === '/api/account/admin/advanced/settings' && Object.hasOwn(body ?? {}, 'framework_pin');
+    const platform = path === '/api/account/admin/platform' && params.sections === 'deployments';
+    if (!aws && !framework && !policy && !platform) return undefined;
+    const user = context.user;
+    if (!user || user.is_active === false) return fail('permission_denied', 403);
+    if (!backendGlobalCan(user, aws ? 'manage_aws' : ['view_platform', 'manage_platform', 'admin']))
+        return fail('permission_denied', 403);
+    if (platform && method === 'GET') {
+        deploymentReads++;
+        const status = scenario === 'framework-failed' ? 'failed' : deploymentReads >= 2 ? 'converged' : 'fleet';
+        return ok({ schema_version: 1, sections: { deployments: { status: 'ok', data: { items: !frameworkRequested || scenario === 'framework-missing-deployment' ? [] : [{ id: deploymentId, sha: 'a'.repeat(40), status, framework_version: '4.1.0', frozen_roster: ['runner-maint-1'], node_evidence: [{runner: 'runner-maint-1', state: status === 'converged' ? 'proven' : 'dispatched', observed_at: date(), stale_after: new Date(Date.now()+60000).toISOString(), proof: {platform_deployment: deploymentId, platform_sha: 'a'.repeat(40), django_mojo_version: scenario === 'framework-converged-version-missing' ? null : '4.1.0'}}] }] } } } });
+    }
+    if (method === 'GET' && path === '/api/aws/maintenance/versions') return ok(maintenanceMockReport());
+    if (method === 'GET' && path === '/api/account/admin/platform/framework')
+        return ok(maintenanceMockFramework(user));
+    if (method === 'GET' && path === '/api/aws/maintenance/status') {
+        if (scenario === 'status-error') return fail('provider_unavailable',503);
+        if (scenario === 'status-missing') return ok({schema_version:1,kind:params.kind,resource:params.resource,target_version:params.target_version,found:false,status:null,engine_version:null,engine_versions:[],pending_version:null,settled:false,upgraded:false});
+        const f = maintenanceMockReport().findings.find(
+            (f) => f.kind === params.kind && f.resource_id === params.resource,
+        );
+        if (!f || typeof params.target_version !== 'string') return fail('invalid_request', 400);
+        const attempt = pending.get(`${f.kind}:${f.resource_id}`);
+        if (attempt) attempt.reads++;
+        const waiting =
+            ['next-window', 'settled-old', 'provider-unknown'].includes(scenario) ||
+            (!!attempt && !attempt.immediate);
+        const targetObserved = !!attempt && !waiting && attempt.reads >= 2;
+        const settled =
+            targetObserved && (scenario !== 'target-before-settled' || (attempt?.reads ?? 0) >= 4);
+        const mixed = scenario === 'mixed-cache' && f.kind === 'elasticache';
+        const versions = targetObserved
+            ? mixed
+                ? [params.target_version, f.current_version]
+                : [params.target_version, params.target_version]
+            : [f.current_version];
+        return ok({
+            schema_version: 1,
+            kind: f.kind,
+            resource: f.resource_id,
+            target_version: params.target_version,
+            found: true,
+            status: waiting || settled ? 'available' : 'modifying',
+            engine_version: versions[0],
+            engine_versions: versions,
+            pending_version: attempt && !settled ? attempt.target : null,
+            settled: waiting || settled,
+            upgraded: targetObserved && !mixed,
+        });
+    }
+    if (
+        method !== 'POST' ||
+        !['/api/aws/maintenance/apply', '/api/account/admin/platform/framework/update', '/api/account/admin/advanced/settings'].includes(path)
+    )
+        return fail('method_not_allowed', 405);
+    if (context.keyBacked) return fail('permission_denied', 403);
+    if (!context.fresh || scenario === 'reauth') return fail('fresh_auth_required', 440);
+    if (!backendGlobalCan(user, ['manage_platform', 'admin'])) return fail('permission_denied', 403);
+    if (policy) {
+        if (user.is_superuser !== true) return fail('permission_denied',403);
+        const value = body?.framework_pin;
+        if (typeof value !== 'string' || !(value === '' || value === 'hold' || /^[0-9][a-z0-9._!+-]{0,63}$/.test(value))) return fail('invalid_request',400);
+        if (scenario === 'policy-refused') return fail('invalid_request',400);
+        policyValue = value;
+        if (scenario === 'policy-lost-response') return fail('service_unavailable',503);
+        return ok({schema_version:1,saved:true,value});
+    }
+    if (scenario === 'external') return fail('infrastructure_external', 403);
+    if (!body) return fail('invalid_request', 400);
+    if (aws) {
+        const f = maintenanceMockReport().findings.find(
+            (f) => f.kind === body.kind && f.resource_id === body.resource,
+        );
+        if (!f || body.confirm_resource !== body.resource || typeof body.apply_immediately !== 'boolean')
+            return fail('invalid_request', 400);
+        if (body.target_version !== f.available_major || scenario === 'stale-target')
+            return fail('upgrade_not_offered', 409);
+        const key = `${f.kind}:${f.resource_id}`;
+        if (pending.has(key) && !(scenario === 'later-target' && pending.get(key)!.reads >= 2) || scenario === 'duplicate') return fail('upgrade_in_progress', 409);
+        if (scenario === 'cache-refusal') return fail('cache_unavailable', 503);
+        pending.set(key, { target: f.available_major, immediate: body.apply_immediately, reads: 0 });
+        if (scenario === 'provider-unknown')
+            return fail('provider_unavailable', 503, {
+                failure: {
+                    operation: 'rds.modify_db_instance',
+                    provider_code: 'RequestTimeout',
+                    retryable: true,
+                    mutation_state: 'unknown',
+                    iam_action: 'rds:ModifyDBInstance',
+                },
+            });
+        return ok({
+            schema_version: 1,
+            requested: true,
+            resource: f.resource_id,
+            kind: f.kind,
+            engine: f.engine,
+            from_version: f.current_version,
+            target_version: f.available_major,
+            apply_immediately: body.apply_immediately,
+            release_notes_url: f.release_notes_url,
+            operation:
+                f.kind === 'elasticache'
+                    ? f.resource_id === 'standalone-cache'
+                        ? 'elasticache.modify_cache_cluster'
+                        : 'elasticache.modify_replication_group'
+                    : f.kind === 'rds-cluster'
+                      ? 'rds.modify_db_cluster'
+                      : 'rds.modify_db_instance',
+        });
+    }
+    const fw = maintenanceMockFramework(user);
+    if (!fw.can_update || body.version !== fw.latest || body.confirm_version !== body.version)
+        return fail('update_unavailable', 409);
+    frameworkRequested = true; policyValue = ''; deploymentReads = 0;
+    if (['framework-pin-cleared-503', 'framework-lost-response'].includes(scenario))
+        return fail('deployment_coordination_unavailable', 503);
+    return ok({
+        schema_version: 1,
+        requested: true,
+        version: fw.latest,
+        cleared_pin: fw.pin.value,
+        deployment: { id: deploymentId, sha: 'a'.repeat(40), status: 'pending' },
+    });
+}
+
+export const getMockMaintenanceScenario = () => scenario;
+/** Demo-only provider passage: retain receipts and server operations; never replay a write. */
+export function advanceMockMaintenance() {
+    scenario = 'all-members-upgraded';
+    for (const operation of pending.values()) { operation.immediate = true; operation.reads = Math.max(2, operation.reads); }
+    deploymentReads = Math.max(2, deploymentReads);
+}

package/src/client/mock.ts

@@ -687,6 +687,7 @@ function buildSettings(): MockSetting[] {
         { id: 404, created: now - 5 * 86400, modified: now - 5 * 86400, key: 'SITE_NAME', value: 'NativeMojo fallback', is_secret: false, group: null, secretValue: null },
         // #7729: one rendition override so Media rendering shows a changed field beside greyed defaults on first load.
         { id: 405, created: now - 3 * 86400, modified: now - 3 * 86400, key: 'FILEMAN_RENDITIONS_VIDEO', value: JSON.stringify({ video_hevc: { crf: 24 } }), is_secret: false, group: null, secretValue: null },
+        { id: 406, created: now - 3 * 86400, modified: now - 3 * 86400, key: 'EDGE_FRAMEWORK_VERSION', value: '', is_secret: false, group: null, secretValue: null },
     ];
 }
 
@@ -2894,6 +2895,12 @@ function decorateUsers(users: MockUser[], groups: MockGroup[]): void {
     dnsPlatform.email = 'dns.platform@nativemojo.com';
     dnsPlatform.display_name = 'DNS Platform Operator';
     dnsPlatform.permissions = {};
+    for (const [offset, role, grants] of [
+        [53, 'viewer', { view_platform: true, view_dns: true }],
+        [54, 'platform', { view_admin: true, manage_platform: true }],
+        [55, 'webapp', { view_admin: true, manage_webapp: true, manage_dns: true, manage_groups: true }],
+        [56, 'group', {}], [57, 'denied', {}],
+    ] as const) Object.assign(at(offset), { is_active: true, is_superuser: false, username: `deployments.${role}`, email: `deployments.${role}@nativemojo.com`, display_name: `Deployments ${role}`, permissions: { ...grants } });
     const dnsTenant = at(23);
     dnsTenant.is_active = true;
     dnsTenant.is_superuser = false;
@@ -4109,6 +4116,7 @@ const deviceRows = buildDevices();
 const geoIpRows = buildGeoIps();
 const loginEventRows = linkLoginDevices(buildLoginEvents(users), deviceRows);
 const members = buildMembers(users, groups);
+members.push({ id: 192, created: groups[0]!.created, modified: groups[0]!.modified, is_active: true, permissions: { manage_webapp: true, manage_dns: true }, metadata: {}, user: 56, group: 1 });
 members.push({
     id: 190, created: groups[0]!.created, modified: groups[0]!.modified,
     is_active: true, permissions: { view_dns: true }, metadata: {},
@@ -6767,6 +6775,7 @@ let dnsConfigMalformed = false;
 let dnsAcmeMode: 'production' | 'staging' | 'unconfigured' = 'staging';
 let dnsRegistrarMode: 'ready' | 'disabled' | 'contact-missing' = 'ready';
 let dnsRegistrarFault: 'failed' | 'ambiguous' | null = null;
+let domainRegistrarSaveFault: 'warning' | 'ambiguous' | null = null;
 let dnsWriteFault: 'reject' | 'ambiguous' | 'reconcile' | null = null;
 let dnsFailNextRead = false;
 const mockRegistrantScopeState = new Map<string, 'saved' | 'cleared'>();
@@ -6895,6 +6904,7 @@ export function setMockDnsRegistrarMode(value: 'ready' | 'disabled' | 'contact-m
 
 /** Verifier-only one-shot result after a confirmation token is consumed. */
 export function armMockRegistrarPurchaseFault(value: 'failed' | 'ambiguous'): void { dnsRegistrarFault = value; }
+export function armMockDomainRegistrarSaveFault(value: 'warning' | 'ambiguous'): void { domainRegistrarSaveFault = value; }
 
 /** Verifier-only one-shot DNS transport outcomes; all state still lives in db.dnsRecords. */
 export function armMockDnsWriteFault(mode: 'reject' | 'ambiguous' | 'reconcile'): void {
@@ -9916,6 +9926,15 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         armedReauth = null;
         return { status: false, error: 'reauth_required', error_code: 440 };
     }
+    if (path === '/api/account/admin/bootstrap' || path === '/api/account/admin/settings' || path === '/api/account/admin/advanced/settings' && Object.hasOwn(opts.body ?? {}, 'framework_pin')
+        || path === '/api/account/admin/dashboard' || path.startsWith('/api/aws/capacity')
+        || path.startsWith('/api/aws/maintenance/') || path.startsWith('/api/account/admin/platform') || path === '/api/account/admin/setup/readiness'
+        || path.startsWith('/api/edge/webapp') || path.startsWith('/api/edge/release') || path === '/api/edge/deployment') {
+        const { operationsMock } = await import('./operations-mock');
+        const claims = decodeMockJwt((opts.headers?.Authorization ?? '').replace(/^Bearer /, ''));
+        const operationsResult = await operationsMock(path, opts, { user: userFromBearer(opts.headers), credentialKind: claims?.credential_kind ?? claims?.token_type, authTime: authTimeFromBearer(opts.headers), origin: opts.headers?.Origin });
+        if (operationsResult !== undefined) return operationsResult;
+    }
     const pushResult = await pushFetch(path, opts);
     if (pushResult !== undefined) return pushResult;
     const phoneHubResult = await phoneHubFetch(path, opts);
@@ -10428,6 +10447,8 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
 
     const credentialMatch = path.match(/^\/api\/dnsman\/credential(?:\/(\d+))?$/);
     if (credentialMatch) {
+        const { prepareMockDomainCredentials } = await import('./domain-operations-mock');
+        prepareMockDomainCredentials(db.dnsCredentials);
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
         const id = credentialMatch[1] ? Number(credentialMatch[1]) : null;
@@ -10477,6 +10498,11 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
                 if ('privacy' in opts.body) row.privacy = Boolean(opts.body.privacy);
                 if ('credential' in opts.body) row.credential = opts.body.credential == null ? null : Number(opts.body.credential);
                 row.modified = Math.floor(Date.now() / 1000);
+                if (row.provider === 'route53' && domainRegistrarSaveFault) {
+                    const fault = domainRegistrarSaveFault; domainRegistrarSaveFault = null;
+                    row.last_error = 'Registrar update was not confirmed. Inspect the registrar before changing this setting again.';
+                    if (fault === 'ambiguous') return { status: false, error: 'Registrar update acknowledgement unavailable', error_code: 503 };
+                }
             }
             return { status: true, data: serializeDnsDomain(row), graph: 'default' };
         }
@@ -10672,7 +10698,13 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         const action = path.slice('/api/dnsman/registrar/'.length);
         const body = opts.body ?? {};
         const houseAction = ['discover', 'adopt', 'assign-group'].includes(action);
-        if (houseAction && !caller.is_superuser) return permissionDenied();
+        if (houseAction && caller.is_superuser !== true) return permissionDenied();
+        if (houseAction || action === 'purchase') {
+            const { mockRegistrarSession } = await import('./domain-operations-mock');
+            const refusal = mockRegistrarSession(decodeMockJwt((opts.headers?.Authorization ?? '').replace(/^Bearer /, '')), action === 'purchase');
+            if (caller.is_active !== true || refusal === 'denied') return permissionDenied();
+            if (refusal === 'stale') return { status: false, error: 'reauth_required', error_code: 440 };
+        }
         if (!houseAction) {
             const groupId = Number(body.group ?? opts.params?.group ?? 0);
             if (groupId > 0 ? !dnsMemberCan(caller, groupId, action !== 'search' && action !== 'suggest')
@@ -10716,14 +10748,16 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             const now = Math.floor(Date.now() / 1000);
             const id = Math.max(8300, ...db.domainPurchases.map((candidate) => candidate.id)) + 1;
             const token = `mock-once-${id}-${Math.random().toString(36).slice(2)}`;
-            const purchase: MockDomainPurchase = { id, created: now, modified: now, group: groupId, user: caller.id, domain_name: String(body.domain).toLowerCase(), kind: 'register', status: 'quoted', price: '12.00', cost: '12.00', currency: 'USD', years, quote_expires: now + 900, operation_id: null, error: null, metadata: { confirm_digest: mockTokenDigest(token) } };
+            const purchase: MockDomainPurchase = { id, created: now, modified: now, group: groupId, user: caller.id, domain_name: answer.name, kind: 'register', status: 'quoted', price: '12.00', cost: '12.00', currency: 'USD', years, quote_expires: now + 900, operation_id: null, error: null, metadata: { confirm_digest: mockTokenDigest(token) } };
             db.domainPurchases.unshift(purchase);
             return { status: true, data: { purchase: id, name: purchase.domain_name, price: purchase.price, currency: purchase.currency, years: purchase.years, token, expires: purchase.quote_expires, privacy_supported: true } };
         }
         if (action === 'purchase') {
+            if (method !== 'POST') return { status: false, error: 'Method not allowed', error_code: 405 };
+            const { validMockPurchaseTuple } = await import('./domain-operations-mock');
             const purchase = db.domainPurchases.find((candidate) => candidate.id === Number(body.purchase));
             const digest = typeof purchase?.metadata.confirm_digest === 'string' ? purchase.metadata.confirm_digest : '';
-            if (!purchase || mockTokenDigest(String(body.confirm_token ?? '')) !== digest || purchase.status !== 'quoted' || (purchase.quote_expires ?? 0) <= Date.now() / 1000) return { status: false, error: 'That purchase confirmation is not valid. Request a new quote and try again.', error_code: 400 };
+            if (!purchase || !validMockPurchaseTuple(purchase, body, caller.id) || mockTokenDigest(String(body.confirm_token ?? '')) !== digest || purchase.status !== 'quoted' || (purchase.quote_expires ?? 0) <= Date.now() / 1000) return { status: false, error: 'That purchase confirmation is not valid. Request a new quote and try again.', error_code: 400 };
             delete purchase.metadata.confirm_digest;
             purchase.status = dnsRegistrarFault === 'failed' ? 'failed' : 'submitted'; purchase.error = dnsRegistrarFault === 'failed' ? 'Registrar rejected the operation after durable intent' : null; purchase.lifecycle_reads = dnsRegistrarFault === 'failed' ? undefined : 0; purchase.modified = Math.floor(Date.now() / 1000);
             const now = purchase.modified;
@@ -10735,10 +10769,15 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             return { status: true, data: { purchase: purchase.id, domain: domain.id, name: domain.name, status: domain.status, operation_id: null, privacy: true, privacy_downgraded: false } };
         }
         if (action === 'register-existing') {
+            const { mockDomainRegistrationName, prepareMockDomainCredentials } = await import('./domain-operations-mock');
+            prepareMockDomainCredentials(db.dnsCredentials);
+            const name = mockDomainRegistrationName(body.domain);
             const credential = db.dnsCredentials.find((candidate) => candidate.id === Number(body.credential));
-            if (!credential || !credential.is_active || !credential.verified || credential.group !== Number(body.group)) return { status: false, error: 'A verified credential is required', error_code: 400 };
+            if (method !== 'POST' || !name || !credential || credential.provider !== 'godaddy' || !credential.is_active || !credential.verified || credential.group !== Number(body.group)) return { status: false, error: 'A same-group verified GoDaddy credential and exact domain are required', error_code: 400 };
+            if (db.dnsDomains.some(row => row.name === name)) return { status: false, error: 'Domain is already registered', error_code: 400 };
+            if (name.includes('provider-failure')) return { status: false, error: 'Provider ownership could not be verified', error_code: 400 };
             const now = Math.floor(Date.now() / 1000);
-            const domain: MockDnsDomain = { id: Math.max(8200, ...db.dnsDomains.map((candidate) => candidate.id)) + 1, created: now, modified: now, group: credential.group, user: caller.id, name: String(body.domain).toLowerCase(), provider: credential.provider, credential: credential.id, status: 'active', hosted_zone_id: null, auto_renew: false, privacy: false, verified: true, registered_on: null, expires: null, last_error: null, metadata: {} };
+            const domain: MockDnsDomain = { id: Math.max(8200, ...db.dnsDomains.map((candidate) => candidate.id)) + 1, created: now, modified: now, group: credential.group, user: caller.id, name, provider: credential.provider, credential: credential.id, status: 'active', hosted_zone_id: null, auto_renew: false, privacy: false, verified: true, registered_on: null, expires: null, last_error: null, metadata: {} };
             db.dnsDomains.push(domain); db.dnsRecords.set(domain.id, []);
             return { status: true, data: serializeDnsDomain(domain) };
         }
@@ -10822,11 +10861,6 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         return { status: true, data: { name: domain.name, registrant: transientContact, admin: transientContact, tech: transientContact, privacy: domain.privacy, admin_privacy: domain.privacy, registrant_privacy: domain.privacy, tech_privacy: domain.privacy, auto_renew: domain.auto_renew, nameservers: ['ns-1.example.invalid', 'ns-2.example.invalid'], registrar: 'Amazon Registrar, Inc.', registered_on: domain.registered_on, expires: domain.expires, status_list: ['ok'], privacy_supported: true } };
     }
     // ══ end DNSMan wire ═══════════════════════════════════════════════
-    if (path === '/api/account/admin/bootstrap') {
-        const caller = userFromBearer(opts.headers); if (!caller) return permissionDenied(401);
-        if (!caller.is_superuser) return permissionDenied();
-        return { status: true, data: { admin_path: '/admin/', capabilities: { setup: true }, infrastructure: { mode: 'managed' }, features: { platform: { enabled: true, capabilities: { setup: true, view: true, capacity: true } }, settings: { enabled: true, capabilities: { owner_edit: true } } } } };
-    }
     if (path === '/api/account/admin/fleet/shared-validation/recipient') {
         const caller = userFromBearer(opts.headers); if (!caller) return permissionDenied(401);
         if (caller.is_superuser !== true) return permissionDenied();
@@ -10858,11 +10892,18 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
         if (!hasGlobalPermission(caller, ['manage_settings', 'groups'])) return permissionDenied();
+        if (method === 'GET') {
+            const { maintenanceMockFramework } = await import('./maintenance-mock');
+            const pin = maintenanceMockFramework(caller).pin;
+            const row = db.settings.find(row => row.key === 'EDGE_FRAMEWORK_VERSION');
+            if (row) row.value = pin.mode === 'latest' ? '' : pin.mode === 'hold' ? 'hold' : pin.value ?? '';
+        }
         if (oneSetting) {
             const row = db.settings.find((candidate) => candidate.id === Number(oneSetting[1]));
             if (!row) return { status: false, error: 'Setting not found', error_code: 404 };
             if (opts.method === 'DELETE') return { status: false, error: 'DELETE not allowed: Setting', error_code: 403 };
             if (opts.method === 'POST' && opts.body) {
+                if (row.key === 'EDGE_FRAMEWORK_VERSION' || opts.body.key === 'EDGE_FRAMEWORK_VERSION') return {status:false,error:'Framework policy is protected; use its dedicated owner writer.',error_code:400};
                 if ('value' in opts.body && !row.is_secret) {
                     // Registered validators run before the row mutates (Setting.on_rest_pre_save → config.validate).
                     const refusal = validateRenditionSetting(typeof opts.body.key === 'string' ? opts.body.key : row.key, opts.body.value);
@@ -10881,6 +10922,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             return { status: true, data: serializeSetting(row), graph: 'default' };
         }
         if (opts.method === 'POST' && opts.body) {
+            if (opts.body.key === 'EDGE_FRAMEWORK_VERSION') return {status:false,error:'Framework policy is protected; use its dedicated owner writer.',error_code:400};
             const now = Math.floor(Date.now() / 1000);
             const row: MockSetting = { id: Math.max(0, ...db.settings.map((candidate) => candidate.id)) + 1, created: now, modified: now, key: '', value: '', is_secret: false, group: null, secretValue: null };
             for (const [field, value] of Object.entries(opts.body)) {