portal-mojo 0.2.20 → 0.2.21

package/src/admin/deployments/types.ts

@@ -0,0 +1,238 @@
+/** Safe display DTOs. Raw server objects and upload/key material never reach Query. */
+export interface Release {
+    id: number;
+    version: string;
+    status: string;
+    source: string;
+    created: string;
+}
+export interface WebApp {
+    id: number;
+    slug: string;
+    display_name: string;
+    environment: string;
+    deployment_ref: string;
+    repository: string;
+    build_output: string;
+}
+export interface WebAppObject extends WebApp {
+    group: {
+        id: number;
+        name: string;
+    };
+}
+export interface Certificate {
+    status: string;
+    not_after: string;
+}
+export interface Attempt {
+    id: number;
+    started?: string;
+    detail?: string;
+    status: string;
+    created: string;
+    finished: string;
+    release: Release | null;
+}
+export interface WebAppSummary {
+    webapp: WebApp;
+    address: {
+        hostname: string;
+        certificate: Certificate | null;
+        aliases: {
+            hostname: string;
+            certificate: Certificate | null;
+        }[];
+    } | null;
+    current_release: Release | null;
+    latest_deployment: Attempt | null;
+    onboarding: {
+        status: string;
+        cursor: string;
+    };
+    deployment_key: {
+        linked: boolean;
+        active: boolean;
+    };
+}
+export interface WebAppList {
+    items: WebAppSummary[];
+    count: number;
+    limit: number;
+    truncated: boolean;
+}
+export interface Proof {
+    runner: string;
+    status: string;
+    detail: string;
+    sha: string;
+    deployment: string;
+    stderr_tail: string;
+}
+export interface PlatformAttempt {
+    id: string;
+    sha: string;
+    framework_version: string;
+    status: string;
+    source: string;
+    actor: string;
+    retry_of: string;
+    created: string;
+    started: string;
+    finished: string;
+    duration_seconds: number | null;
+    desired_commit: string;
+    current_commits: string[];
+    frozen_roster: string[];
+    transitions: Proof[];
+    node_evidence: Proof[];
+    diagnosis: Proof[];
+    detail: string;
+    node_summary: Record<'expected' | 'proven' | 'reported' | 'failed' | 'dispatched' | 'other', number>;
+}
+export interface Collector<T> {
+    status: string;
+    observed_at: string;
+    stale_after: string;
+    reason: string;
+    data: T | null;
+}
+export interface PlatformSnapshot {
+    deployments: Collector<{
+        items: PlatformAttempt[];
+        limit: number;
+        desired_commit: string;
+        desired_deployment: string;
+        currently_serving: {
+            deployment: string;
+            sha: string;
+            framework_version: string;
+            converged_at: string;
+        } | null;
+        coordination: {
+            state: string;
+            deployment: string;
+            sha: string;
+            at: string;
+        };
+        framework_pin: {
+            mode: string;
+            resolved: string;
+        };
+    }>;
+    api: Collector<{
+        version: string;
+        commit: string;
+    }>;
+}
+export interface Bootstrap {
+    groups: {
+        id: number;
+        name: string;
+        can_manage_dns: boolean;
+    }[];
+    can_create_webapp_group: boolean;
+    setup: boolean;
+}
+export interface DeploymentStatus {
+    deployment: number;
+    webapp: number;
+    release: number;
+    version: string;
+    status: string;
+    terminal: boolean;
+    success: boolean;
+    detail: string;
+    created: string;
+    started: string;
+    finished: string;
+    targets: Proof[];
+    rollback_targets: Proof[];
+}
+export interface CreateProfile {
+    operation_id: string;
+    group?: number;
+    group_intent?: 'new';
+    slug: string;
+    display_name: string;
+    environment: string;
+    bucket: string;
+    github_repository: string;
+    deployment_ref: string;
+    build_output: string;
+}
+export interface OnboardingOperation {
+    operation_id: string;
+    group: {
+        id: number;
+        name: string;
+    };
+    status: string;
+    cursor: string;
+    revision: number;
+    profile: {
+        slug: string;
+        display_name: string;
+    };
+    evidence: {
+        app: {
+            status: string;
+        };
+        address: {
+            status: string;
+            hostname: string;
+        };
+        github: {
+            status: string;
+            reason: string;
+        };
+        verify: {
+            status: string;
+            detail: string;
+        };
+    };
+    activity: {
+        message: string;
+        kind: string;
+        at: string;
+    }[];
+    resources: {
+        webapp: number | null;
+    };
+    next_attempt_at: string;
+    last_error: string;
+    modified: string;
+}
+export interface OnboardingOptions {
+    buckets: string[];
+    environments: string[];
+    destination: boolean;
+    destination_error: string;
+    apps_domain: {
+        id: number;
+        name: string;
+    } | null;
+    apps_domain_error: string;
+    github_connected: boolean;
+}
+export interface AddressPrecheck {
+    verdict: string;
+    hostname: string;
+    reason: string;
+    domain: {
+        id: number;
+        name: string;
+    } | null;
+    label: string;
+}
+export interface ManifestEntry {
+    path: string;
+    sha256: string;
+    size: number;
+}
+export type ApiAction = 'retry' | 'verify' | 'converge';
+/** Registered router paths supplied by the host, already checked against its section roster. */
+export interface DeploymentsDestinations {
+    domains?: string;
+    serving?: string;
+}

package/src/admin/deployments/upload.ts

@@ -0,0 +1,53 @@
+import type { ManifestEntry } from './types';
+export function normalizeUploadPath(path: string): string { const p = path.normalize('NFC'); if (!p || p.length > 1024 || p.startsWith('/') || p.includes('\\') || /[\u0000-\u001f]/.test(p) || p.split('/').some(x => !x || x === '.' || x === '..') || /^[a-z]:/i.test(p))
+    throw new Error('Choose normalized relative file paths without traversal or empty segments'); return p; }
+export async function buildManifest(files: File[], signal?: AbortSignal, limits = { files: 5000, bytes: 1024 ** 3 }): Promise<ManifestEntry[]> { if (!files.length || files.length > limits.files || files.reduce((n, f) => n + f.size, 0) > limits.bytes)
+    throw new Error(`Select 1–${limits.files} files, at most ${limits.bytes} bytes. This installation may impose lower limits.`); const seen = new Set<string>(), manifest: ManifestEntry[] = []; for (const file of files) {
+    signal?.throwIfAborted();
+    const path = normalizeUploadPath(file.webkitRelativePath || file.name);
+    if (seen.has(path))
+        throw new Error(`Duplicate normalized file path: ${path}`);
+    seen.add(path);
+    const hash = await crypto.subtle.digest('SHA-256', await file.arrayBuffer());
+    signal?.throwIfAborted();
+    manifest.push({
+        path, sha256: [...new Uint8Array(hash)].map(x => x.toString(16).padStart(2, '0')).join(''), size: file.size
+    });
+} return manifest.sort((a, b) => a.path.localeCompare(b.path)); }
+export function manifestEqual(a: ManifestEntry[], b: ManifestEntry[]): boolean { return JSON.stringify(a) === JSON.stringify(b); }
+export async function putReleaseFiles(files: File[], manifest: ManifestEntry[], uploads: {
+    path: string;
+    url: string;
+    headers: Record<string, string>;
+}[], signal: AbortSignal, onProgress: (n: number) => void, put: typeof fetch = fetch): Promise<void> { if (uploads.length === 0)
+    return; if (uploads.length !== manifest.length)
+    throw new Error('Incomplete signed upload manifest'); const source = new Map(files.map(f => [normalizeUploadPath(f.webkitRelativePath || f.name), f])), seen = new Set<string>(); let completed = 0; for (const upload of uploads) {
+    signal.throwIfAborted();
+    const entry = manifest.find(x => x.path === upload.path), file = source.get(upload.path);
+    if (!entry || !file || seen.has(upload.path))
+        throw new Error('Upload path does not match the selected manifest');
+    seen.add(upload.path);
+    let url: URL;
+    try {
+        url = new URL(upload.url);
+    }
+    catch {
+        throw new Error('Invalid storage upload destination');
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        throw new Error('Storage requires an HTTPS signed destination');
+    const expected = btoa(String.fromCharCode(...Uint8Array.from(entry.sha256.match(/../g) ?? [], x => parseInt(x, 16))));
+    if (Object.keys(upload.headers).length !== 1 || upload.headers['x-amz-checksum-sha256'] !== expected)
+        throw new Error('Storage checksum headers do not match this file');
+    try {
+        const response = await put(url.href, {
+            method: 'PUT', headers: upload.headers, body: file, credentials: 'omit', redirect: 'error', referrerPolicy: 'no-referrer', signal
+        });
+        if (!response.ok)
+            throw new Error('upload refused');
+    }
+    catch {
+        throw new Error('Storage upload failed. Check the bucket CORS policy permits anonymous PUT and x-amz-checksum-sha256 from this Admin origin. Completion was not sent.');
+    }
+    onProgress(++completed);
+} }

package/src/admin/deployments/useDeploymentObservation.ts

@@ -0,0 +1,104 @@
+import { useCallback, useEffect, useMemo, useRef, useLayoutEffect, useState } from 'react';
+import { getAuthSessionRevision, useAuthSnapshot, useMe } from '../../client/runtime';
+import { backendGlobalCan } from '../fleet/access';
+import { assertOwner, deploymentOwner, ownerKey, type DeploymentOwner } from './permissions';
+/** One identity/scope lifetime, including React's development-only effect replay. */
+export function useDeploymentOwner() {
+    const auth = useAuthSnapshot(), me = useMe(), revision = getAuthSessionRevision();
+    const base = useMemo(() => deploymentOwner(), [auth.uid, auth.authenticated, revision]);
+    const authority = [me.data?.is_active !== false, ...[
+        'view_platform', 'manage_platform', 'admin', 'view_dns', 'manage_dns',
+        'security', 'manage_webapp', 'view_admin', 'manage_users', 'manage_settings',
+    ].map(permission => backendGlobalCan(me.data, permission))].join(':');
+    const key = `${ownerKey(base)}:${authority}`;
+    const lifetime = useMemo(() => ({ controller: new AbortController() }), [key]);
+    const [, renderLiveSignal] = useState(0);
+    useLayoutEffect(() => {
+        // StrictMode replays setup after cleanup without replacing query keys.
+        // Renew this same scope before its read effects resume, and publish the
+        // new signal to consumers that capture a concrete signal during render.
+        if (lifetime.controller.signal.aborted) {
+            lifetime.controller = new AbortController();
+            renderLiveSignal(generation => generation + 1);
+        }
+        const mountedController = lifetime.controller;
+        return () => mountedController.abort();
+    }, [lifetime]);
+    // Query callbacks from the first render must see the controller belonging
+    // to the current setup, rather than a permanently aborted render snapshot.
+    // A genuine unmount has no following setup; its lifetime remains aborted.
+    // A different actor/session/authority receives a separate lifetime object.
+    const owner = useMemo<DeploymentOwner>(() => ({
+        ...base,
+        get signal() { return lifetime.controller.signal; },
+    }), [base, lifetime]);
+    return { owner, signal: lifetime.controller.signal, key };
+}
+export interface Observation<T> {
+    value: T | null;
+    state: 'idle' | 'observing' | 'stopped' | 'terminal' | 'error';
+    observedAt: number | null;
+    refresh: () => void;
+}
+/** Known identity only; bounded, owner-fenced, hidden/blur aware; refresh only reads. */
+export function useDeploymentObservation<T>(owner: DeploymentOwner, identity: string | null, read: (signal: AbortSignal) => Promise<T>, terminal: (value: T) => boolean, pollable: (value: T) => boolean = () => true, budgetMs = 60000, intervalMs = 2000): Observation<T> {
+    const [generation, setGeneration] = useState(0), [value, setValue] = useState<T | null>(null), [state, setState] = useState<Observation<T>['state']>('idle'), [observedAt, setObservedAt] = useState<number | null>(null);
+    const current = useRef({
+        read, terminal, pollable
+    });
+    current.current = {
+        read, terminal, pollable
+    };
+    const key = ownerKey(owner), slot = `${key}:${identity}:${generation}`;
+    const seen = useRef('');
+    useEffect(() => {
+        seen.current = slot;
+        if (!identity) {
+            setValue(null);
+            setState('idle');
+            return;
+        }
+        const controller = new AbortController();
+        let timer: ReturnType<typeof setTimeout> | undefined;
+        let cancelled = false;
+        const started = Date.now();
+        setValue(null);
+        setObservedAt(null);
+        setState('observing');
+        const tick = async () => { if (cancelled)
+            return; if (Date.now() - started >= budgetMs) {
+            setState('stopped');
+            return;
+        } if (typeof document !== 'undefined' && (document.visibilityState === 'hidden' || !document.hasFocus())) {
+            timer = setTimeout(tick, intervalMs);
+            return;
+        } try {
+            assertOwner(owner, controller.signal);
+            const next = await current.current.read(controller.signal);
+            assertOwner(owner, controller.signal);
+            if (cancelled)
+                return;
+            setValue(next);
+            setObservedAt(Date.now());
+            if (current.current.terminal(next)) {
+                setState('terminal');
+                return;
+            }
+            if (!current.current.pollable(next)) {
+                setState('stopped');
+                return;
+            }
+            timer = setTimeout(tick, intervalMs);
+        }
+        catch {
+            if (!cancelled)
+                setState('error');
+        } };
+        void tick();
+        return () => { cancelled = true; controller.abort(); clearTimeout(timer); };
+    }, [key, owner.signal, identity, generation, budgetMs, intervalMs]);
+    const matching = seen.current === slot;
+    return {
+        value: matching ? value : null, state: matching ? state : identity ? 'observing' : 'idle', observedAt: matching ? observedAt : null, refresh: useCallback(() => setGeneration(n => n + 1), [])
+    };
+}

package/src/admin/dns/DomainDetail.tsx

@@ -9,7 +9,9 @@ import { DomainCertificatesSection } from './DomainCertificatesSection';
 import { SharedValidationPanel } from './SharedValidationPanel';
 import { openSharedValidation } from './SharedValidationDialog';
 import { useValidationPlan } from './shared-validation-api';
-import { DNS_MANAGE_PERMISSIONS, DomainModel } from './models';
+import { domainRecordsHref, domainScopeLabel, dnsAdminMount, supportsDomainRecords } from './domain-navigation';
+import { redactRegistrarError } from './purchase-data';
+import { DNS_MANAGE_PERMISSIONS, DNS_VIEW_PERMISSIONS, DomainModel } from './models';
 
 export function DomainDetail({ id, onClose }: { id: number; onClose: () => void }) {
     const query = DomainModel.useOne(id);
@@ -30,18 +32,20 @@ export function DomainDetail({ id, onClose }: { id: number; onClose: () => void
         onClose();
         navigate(`${mount}/dns/${route.replace(/^\/?dns\//, '').replace(/^\//, '')}`);
     };
-    const groupLabel = typeof domain.group === 'object' ? domain.group?.name ?? 'Platform' : domain.group ?? 'Platform';
+    const groupLabel = domainScopeLabel(domain.group);
+    const canManage = hasPermission(me ?? null, DNS_MANAGE_PERMISSIONS, null);
+    const openDestination = (href: string) => { onClose(); navigate(href); };
     const credential = typeof domain.credential === 'object' ? domain.credential : null;
     return <DetailView
-        icon="bi-globe2" title={domain.name} subtitle={`${providerLabel(domain.provider)}${domain.hosted_zone_id ? ` · ${domain.hosted_zone_id}` : ''}`}
+        icon="bi-globe2" title={domain.name} subtitle={providerLabel(domain.provider)}
         chips={[{ text: domain.status, tone: fmt.inferTone(domain.status) }, ...(domain.verified ? [{ text: 'Verified', tone: 'success' as const }] : [])]}
         sections={[
-            { key: 'overview', label: 'Overview', icon: 'bi-grid-1x2', render: () => <div className="dns-domain-overview"><Eyebrow>Domain</Eyebrow><FlatRow label="Name"><code>{domain.name}</code></FlatRow><FlatRow label="Provider">{providerLabel(domain.provider)}</FlatRow><FlatRow label="Status">{domain.status}</FlatRow><FlatRow label="Group">{groupLabel}</FlatRow>{domain.hosted_zone_id && <FlatRow label="Hosted zone"><code>{domain.hosted_zone_id}</code></FlatRow>}<FlatRow label="Registered">{fmt.date(domain.registered_on)}</FlatRow><FlatRow label="Expires">{fmt.date(domain.expires)}</FlatRow><FlatRow label="Verified">{domain.verified ? 'Yes' : 'No'}</FlatRow><FlatRow label="Auto-renew">{domain.auto_renew ? 'Enabled' : 'Disabled'}</FlatRow><FlatRow label="WHOIS privacy">{domain.privacy ? 'Enabled' : 'Disabled'}</FlatRow><FlatRow label="Credential">{credential ? `${credential.name} · ${credential.is_active && credential.verified ? 'usable' : 'unavailable'}` : '—'}</FlatRow>{domain.last_error && <div className="dns-error">{domain.last_error}</div>}{domain.provider === 'godaddy' && <div className="dns-provider-note">DNS is managed here; purchase, renewal, privacy, and WHOIS remain in the GoDaddy account.</div>}{domain.provider === 'mojo' && <div className="dns-blocked">Mojo is certificate-only and cannot use generic DNS CRUD.</div>}{availableLinks.length > 0 && <><Eyebrow>Related</Eyebrow><div className="dns-domain-links">{availableLinks.map((link) => <button className="btn" type="button" key={link.key} onClick={() => navigateLink(typeof link.route === 'function' ? link.route(domain) : link.route)}><i className={`bi ${link.icon}`} /> {link.label}</button>)}</div></>}</div> },
-            { key: 'validation', label: 'Validation', icon: 'bi-diagram-2', render: () => <SharedValidationPanel domain={domain} /> },
+            { key: 'overview', label: 'Overview', icon: 'bi-grid-1x2', render: () => <div className="dns-domain-overview"><div className="domains-overview-actions">{supportsDomainRecords(domain.provider) && <button className="btn btn-primary" onClick={() => openDestination(domainRecordsHref(location.pathname, domain.id))}>DNS Records <i className="bi bi-arrow-right" /></button>}{canManage && domain.provider === 'route53' && <button className="btn" onClick={() => void import('./DomainRegistrarSettings').then(({ showDomainRegistrarSettings }) => showDomainRegistrarSettings(domain))}>Registrar settings</button>}{hasPermission(me ?? null, DNS_VIEW_PERMISSIONS, null) && <button className="btn" onClick={() => openDestination(`${dnsAdminMount(location.pathname)}/edge/vhosts`)}>Serving <i className="bi bi-arrow-right" /></button>}</div><Eyebrow>Domain</Eyebrow><FlatRow label="Scope">{groupLabel}</FlatRow><FlatRow label="Expires">{fmt.date(domain.expires)}</FlatRow><FlatRow label="Auto-renew">{domain.auto_renew ? 'Enabled' : 'Disabled'}</FlatRow><FlatRow label="WHOIS privacy">{domain.privacy ? 'Enabled' : 'Disabled'}</FlatRow><details className="ops-details"><summary>Registration details</summary>{domain.hosted_zone_id && <FlatRow label="Hosted zone"><code>{domain.hosted_zone_id}</code></FlatRow>}<FlatRow label="Registered">{fmt.date(domain.registered_on)}</FlatRow><FlatRow label="Credential">{credential ? `${credential.name} · ${credential.is_active && credential.verified ? 'usable' : 'unavailable'}` : '—'}</FlatRow></details>{domain.last_error && <div className="dns-error">{redactRegistrarError(domain.last_error)}</div>}{domain.provider === 'godaddy' && <div className="dns-provider-note">DNS is managed here; purchase, renewal, privacy, and WHOIS remain in the GoDaddy account.</div>}{domain.provider === 'mojo' && <div className="dns-blocked">Mojo is certificate-only and cannot use generic DNS CRUD.</div>}{availableLinks.length > 0 && <><Eyebrow>Related</Eyebrow><div className="dns-domain-links">{availableLinks.filter((link) => link.key !== 'records' || supportsDomainRecords(domain.provider)).map((link) => <button className="btn" type="button" key={link.key} onClick={() => navigateLink(typeof link.route === 'function' ? link.route(domain) : link.route)}><i className={`bi ${link.icon}`} /> {link.label}</button>)}</div></>}</div> },
+            { key: 'validation', label: 'Advanced validation', icon: 'bi-diagram-2', render: () => <SharedValidationPanel domain={domain} /> },
             { key: 'records', label: 'DNS Records', icon: 'bi-list-columns', render: () => <DnsRecordsPanel domain={domain} /> },
             { key: 'certificates', label: 'Certificates', icon: 'bi-patch-check', render: () => <DomainCertificatesSection domain={domain} /> },
         ]}
         initialSection="overview" onClose={onClose}
-        contextMenu={hasPermission(me ?? null, DNS_MANAGE_PERMISSIONS, null) && shared.data?.capabilities.group_choices ? [{ label: 'Set up shared validation', icon: 'bi-diagram-2', onSelect: () => void openSharedValidation(domain) }] : []}
+        contextMenu={canManage && shared.data?.capabilities.group_choices ? [{ label: 'Set up shared validation', icon: 'bi-diagram-2', onSelect: () => void openSharedValidation(domain) }] : []}
     />;
 }

package/src/admin/dns/DomainOnboardingContent.tsx

@@ -0,0 +1,44 @@
+import { useRef, useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { hasPermission, useMe } from '../../client/runtime';
+import { toast } from '../../ui';
+import { adoptHouseDomain } from './api';
+import { DNS_MANAGE_PERMISSIONS, DomainModel } from './models';
+import { normalizePurchaseDomain, redactRegistrarError } from './purchase-data';
+import { DomainPurchaseWizard } from './DomainPurchaseWizard';
+import { DomainRegisterExisting } from './DomainRegisterExisting';
+
+export type OnboardingMode = 'menu' | 'register' | 'purchase' | 'adopt';
+
+export function DomainOnboardingDialog({ close, setBusyGate, initialMode = 'menu' }: { close: () => void; setBusyGate: (busy: boolean) => void; initialMode?: OnboardingMode }) {
+    const { data: me } = useMe(); const queryClient = useQueryClient();
+    const [mode, setMode] = useState<OnboardingMode>(initialMode);
+    const [name, setName] = useState(''); const [review, setReview] = useState<string | null>(null);
+    const [busy, setBusy] = useState(false); const [attempted, setAttempted] = useState(false); const [error, setError] = useState('');
+    const inFlight = useRef(false);
+    const canManage = hasPermission(me ?? null, DNS_MANAGE_PERMISSIONS, null);
+    const prepareAdoption = () => {
+        if (inFlight.current || attempted || me?.is_superuser !== true) return;
+        try { setReview(normalizePurchaseDomain(name)); setError(''); setBusyGate(true); }
+        catch (reason) { setError(redactRegistrarError(reason)); }
+    };
+    const cancelReview = () => { if (inFlight.current) return; setReview(null); setBusyGate(false); };
+    const adopt = async () => {
+        if (inFlight.current || attempted || !review || me?.is_superuser !== true || !canManage) return;
+        inFlight.current = true; setBusy(true); setBusyGate(true); setAttempted(true); setError('');
+        try { const domain = await adoptHouseDomain({ domain: review }); await DomainModel.invalidate(queryClient); toast.success(`${domain.name} adopted at Platform scope`); close(); }
+        catch (reason) { await DomainModel.invalidate(queryClient); setError(`${redactRegistrarError(reason)} Review the domain inventory before another adoption.`); }
+        finally { inFlight.current = false; setBusy(false); setReview(null); setBusyGate(false); }
+    };
+    if (!me) return <div className="modal-pad dim">Checking DNS authority…</div>;
+    if (!canManage) return <div className="modal-pad domain-onboarding"><h2 className="modal-title">DNS management required</h2><p className="dim">A global DNS management permission is required.</p><button className="btn" onClick={close}>Close</button></div>;
+    if (mode === 'purchase') return <div className="modal-pad domain-onboarding"><h2 className="modal-title">Buy domain</h2><DomainPurchaseWizard onDone={close} onBusyChange={setBusyGate} /></div>;
+    if (mode === 'register') return <DomainRegisterExisting close={close} back={() => setMode('menu')} setBusyGate={setBusyGate} />;
+    if (mode === 'adopt') {
+        if (me.is_superuser !== true) return <div className="modal-pad domain-onboarding"><h2 className="modal-title">Platform superuser required</h2><button className="btn" onClick={close}>Close</button></div>;
+        return <div className="modal-pad domain-onboarding"><h2 className="modal-title">Adopt a House domain</h2><p className="dim">Adopt one existing public hosted zone at Platform scope. No account discovery, new zone, or tenant assignment.</p>{error && <div className="form-alert" role="alert">{error}</div>}
+            {review ? <div className="dns-quote-card"><h3>Review exact adoption</h3><div><span>Domain</span><code>{review}</code></div><div><span>Scope</span><b>Platform</b></div><div className="modal-actions"><button className="btn" disabled={busy} onClick={cancelReview}>Cancel review</button><button className="btn btn-primary" disabled={busy} onClick={() => void adopt()}>{busy ? 'Adopting…' : 'Confirm adoption'}</button></div></div> : <><label className="field"><span className="field-label">Existing House domain</span><input className="input" value={name} disabled={busy || attempted} onChange={(event) => setName(event.target.value)} /></label><div className="modal-actions"><button className="btn" disabled={busy} onClick={attempted ? close : () => setMode('menu')}>{attempted ? 'Close and review inventory' : 'Back'}</button><button className="btn btn-primary" disabled={busy || attempted || !name.trim()} onClick={prepareAdoption}>Review adoption</button></div></>}
+        </div>;
+    }
+    return <div className="modal-pad domain-onboarding"><h2 className="modal-title">Add a domain</h2><p className="dim">Choose one explicit workflow.</p><div className="dns-onboarding-options"><button className="panel panel-pad" onClick={() => setMode('register')}><i className="bi bi-globe2" /><b>Register existing</b><span>Prove ownership of one GoDaddy domain using a verified group credential.</span></button>{me.is_superuser === true && <button className="panel panel-pad" onClick={() => setMode('adopt')}><i className="bi bi-house-add" /><b>Adopt a House domain</b><span>Type an existing public zone name; keep it at Platform scope.</span></button>}<button className="panel panel-pad" onClick={() => setMode('purchase')}><i className="bi bi-cart-check" /><b>Buy domain</b><span>Search, quote, confirm once, and reconcile against the durable ledger.</span></button></div><div className="modal-actions"><button className="btn" onClick={close}>Cancel</button></div></div>;
+}

package/src/admin/dns/DomainOnboardingDialog.tsx

@@ -1,27 +1,8 @@
-import { useState } from 'react';
-import { useQueryClient } from '@tanstack/react-query';
-import { useMe } from '../../client/runtime';
-import { modal, toast } from '../../ui';
-import { adoptHouseDomain } from './api';
-import { DomainModel } from './models';
-import { normalizePurchaseDomain, redactRegistrarError } from './purchase-data';
-import { DomainPurchaseWizard } from './DomainPurchaseWizard';
+import { modal } from '../../ui';
+import { DomainOnboardingDialog, type OnboardingMode } from './DomainOnboardingContent';
 
-function DomainOnboardingDialog({ close, setBusyGate }: { close: () => void; setBusyGate: (busy: boolean) => void }) {
-    const { data: me } = useMe(); const queryClient = useQueryClient();
-    const [mode, setMode] = useState<'menu' | 'purchase' | 'adopt'>('menu'); const [name, setName] = useState(''); const [busy, setBusy] = useState(false); const [error, setError] = useState('');
-    const adopt = async () => {
-        if (busy || me?.is_superuser !== true) return; setBusy(true); setBusyGate(true); setError('');
-        try { const domain = await adoptHouseDomain({ domain: normalizePurchaseDomain(name) }); await DomainModel.invalidate(queryClient); toast.success(`${domain.name} adopted at House scope`); close(); }
-        catch (reason) { setError(redactRegistrarError(reason)); }
-        finally { setBusy(false); setBusyGate(false); }
-    };
-    if (mode === 'purchase') return <div className="modal-pad"><h2 className="modal-title">Purchase a domain</h2><DomainPurchaseWizard onDone={close} onBusyChange={setBusyGate} /></div>;
-    if (mode === 'adopt') return <div className="modal-pad"><h2 className="modal-title">Adopt a House domain</h2><p className="dim">Manual, exact-name adoption only. This does not enumerate the House account and creates no tenant assignment.</p>{error && <div className="form-alert">{error}</div>}<label className="field"><span className="field-label">Existing House domain</span><input className="input" value={name} disabled={busy} onChange={(event) => setName(event.target.value)} /></label><div className="modal-actions"><button className="btn" disabled={busy} onClick={() => setMode('menu')}>Back</button><button className="btn btn-primary" disabled={busy || !name.trim()} onClick={() => void adopt()}>{busy ? 'Adopting…' : 'Adopt exact name'}</button></div></div>;
-    return <div className="modal-pad"><h2 className="modal-title">Add a domain</h2><p className="dim">Choose one explicit workflow.</p><div className="dns-onboarding-options"><button className="panel panel-pad" onClick={() => setMode('purchase')}><i className="bi bi-cart-check" /><b>Purchase a new domain</b><span>Search, quote, confirm once, and reconcile against the durable ledger.</span></button>{me?.is_superuser === true && <button className="panel panel-pad" onClick={() => setMode('adopt')}><i className="bi bi-house-add" /><b>Adopt a House domain</b><span>Type an existing name manually; no account discovery.</span></button>}</div><div className="modal-actions"><button className="btn" onClick={close}>Cancel</button></div></div>;
-}
-
-export function showDomainOnboarding(): Promise<unknown> {
+/** No-argument callers retain the original menu. */
+export function showDomainOnboarding({ initialMode = 'menu' }: { initialMode?: OnboardingMode } = {}): Promise<unknown> {
     let busy = false;
-    return modal.open((close) => <DomainOnboardingDialog close={() => close(null)} setBusyGate={(value) => { busy = value; }} />, { size: 'lg', canDismiss: () => !busy });
+    return modal.open((close) => <DomainOnboardingDialog initialMode={initialMode} close={() => close(null)} setBusyGate={(value) => { busy = value; }} />, { size: 'lg', canDismiss: () => !busy });
 }

package/src/admin/dns/DomainPurchaseWizard.tsx

@@ -89,7 +89,7 @@ export function DomainPurchaseWizard({ onDone, onBusyChange }: { onDone?: () =>
                 inFlight.current = true; attempted.current = true; const accepted = ++generation.current;
                 const token = transient.token; quoteRef.current = null;
                 try {
-                    const acknowledgement = await purchaseDomain({ group: transient.identity.group, purchase: transient.identity.purchase, confirm_token: token });
+                    const acknowledgement = await purchaseDomain({ group: transient.identity.group, purchase: transient.identity.purchase, confirm_token: token, confirm_domain: transient.identity.domain, confirm_price: transient.identity.price });
                     const settled = await pollPurchaseLedger({ purchase: acknowledgement.purchase, isCurrent: () => generation.current === accepted, fetch: fetchPurchaseDetail });
                     if (!settled) setTerminalMessage(`Purchase acknowledgement was received, but bounded polling did not settle. ${PURCHASE_MAY_HAVE_MOVED}`);
                     else { setReceipt(settled); setTerminalMessage(settled.status === 'completed' ? 'Registration completed.' : `${redactRegistrarError(settled.error)} ${PURCHASE_MAY_HAVE_MOVED}`); }

package/src/admin/dns/DomainRegisterExisting.tsx

@@ -0,0 +1,63 @@
+import { useRef, useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { CollectionSelect, toast } from '../../ui';
+import { OperationsHelp } from '../core/OperationsHelp';
+import { DNS_GROUP_CHOICE_ENDPOINT, registerExistingDomain } from './api';
+import { DnsCredentialModel, DomainModel, type DnsCredentialRow, type DnsGroupChoice } from './models';
+import { normalizePurchaseDomain, redactRegistrarError } from './purchase-data';
+
+export function usableRegistrationCredential(row: DnsCredentialRow | null, group: number): row is DnsCredentialRow {
+    return !!row && row.provider === 'godaddy' && row.is_active === true && row.verified === true
+        && (typeof row.group === 'number' ? row.group : row.group?.id) === group;
+}
+
+export function DomainRegisterExisting({ close, back, setBusyGate }: { close: () => void; back: () => void; setBusyGate: (busy: boolean) => void }) {
+    const queryClient = useQueryClient();
+    const [group, setGroup] = useState<DnsGroupChoice | null>(null);
+    const [credential, setCredential] = useState<DnsCredentialRow | null>(null);
+    const [name, setName] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [attempted, setAttempted] = useState(false);
+    const [error, setError] = useState('');
+    const inFlight = useRef(false);
+    // Both picker remounting and this ref reject responses/events from old scope.
+    const scope = useRef<number | null>(null);
+    const changeGroup = (selected: DnsGroupChoice | null) => {
+        if (inFlight.current || attempted) return;
+        scope.current = selected?.id ?? null; setGroup(selected); setCredential(null); setError('');
+    };
+    const submit = async (event: React.FormEvent) => {
+        event.preventDefault();
+        if (inFlight.current || attempted) return;
+        if (!group || !usableRegistrationCredential(credential, group.id) || scope.current !== group.id) { setError('Choose an active, verified GoDaddy credential in the selected group'); return; }
+        let domain: string;
+        try { domain = normalizePurchaseDomain(name); } catch (reason) { setError(redactRegistrarError(reason)); return; }
+        inFlight.current = true; setBusy(true); setBusyGate(true); setError('');
+        // An unknown outcome is terminal for this mounted form: inspect inventory.
+        setAttempted(true);
+        try {
+            const saved = await registerExistingDomain({ group: group.id, domain, credential: credential.id });
+            await DomainModel.invalidate(queryClient); toast.success(`${saved.name} registered`); close();
+        } catch (reason) {
+            await DomainModel.invalidate(queryClient);
+            setError(`${redactRegistrarError(reason)} Refresh the domain inventory and review the provider account before starting another registration.`);
+        } finally { inFlight.current = false; setBusy(false); setBusyGate(false); }
+    };
+    const groupId = group?.id;
+    return <form className="modal-pad domain-onboarding" onSubmit={(event) => void submit(event)} noValidate>
+        <h2 className="modal-title">Register existing domain</h2>
+        <p className="dim">Connect a GoDaddy domain you already own. <OperationsHelp label="domain registration">The provider checks ownership of this exact name without charging or listing the provider account. Choose an authorized group and an active, verified GoDaddy credential belonging to it. If no credentials appear, link and verify one in Provider Credentials.</OperationsHelp></p>
+        {error && <div className="form-alert" role="alert">{error}</div>}
+        <div className="dns-registrar-grid">
+            <CollectionSelect<DnsGroupChoice> endpoint={DNS_GROUP_CHOICE_ENDPOINT} value={group} onChange={(_id, row) => changeGroup(row ?? null)} label="Authorized group" help="Choose the group that owns this domain." required maxItems={25} defaultParams={{ start: 0 }} disabled={busy || attempted} placeholder="Search eligible groups…" />
+            <label className="field"><span className="field-label">Domain name <em>*</em></span><input className="input" value={name} disabled={busy || attempted} onChange={(event) => setName(event.target.value)} placeholder="example.com" /></label>
+            {groupId ? <CollectionSelect<DnsCredentialRow> key={groupId} model={DnsCredentialModel} value={credential ? { ...credential } : null} label="GoDaddy credential" required maxItems={25} defaultParams={{ group: groupId, provider: 'godaddy', is_active: true, verified: true, start: 0 }} disabled={busy || attempted} placeholder="Search verified GoDaddy credentials…" help="An active, verified credential in the selected group." onChange={(_id, row) => {
+                if (scope.current !== groupId || inFlight.current || attempted) return;
+                if (!row) { setCredential(null); return; }
+                if (!usableRegistrationCredential(row, groupId)) { setCredential(null); setError('That credential is not usable in the selected group'); return; }
+                setCredential(row); setError('');
+            }} /> : <p className="dim">Choose an authorized group before selecting its GoDaddy credential.</p>}
+        </div>
+        <div className="modal-actions"><button className="btn" type="button" disabled={busy} onClick={attempted ? close : back}>{attempted ? 'Close and review inventory' : 'Back'}</button><button className="btn btn-primary" type="submit" disabled={busy || attempted || !group || !credential || !name.trim()}>{busy ? 'Checking ownership…' : 'Register existing'}</button></div>
+    </form>;
+}