feat(domains): P5.1 — OpenSRS registration + Cloud DNS + Coolify attach

Adds end-to-end custom apex domain support: workspace-scoped
registration via OpenSRS (Tucows), authoritative DNS via Google
Cloud DNS, and one-call attach that wires registrar nameservers,
DNS records, and Coolify app routing in a single transactional
flow.

Schema (additive, idempotent — run /api/admin/migrate after deploy)
  - vibn_workspaces.dns_provider TEXT DEFAULT 'cloud_dns'
      Per-workspace DNS backend choice. Future: 'cira_dzone' for
      strict CA-only residency on .ca.
  - vibn_domains
      One row per registered/intended apex. Tracks status
      (pending|active|failed|expired), registrar order id, encrypted
      registrar manage-user creds (AES-256-GCM, VIBN_SECRETS_KEY),
      period, dates, dns_provider/zone_id/nameservers, and a
      created_by audit field.
  - vibn_domain_events
      Append-only lifecycle audit (register.attempt/success/fail,
      attach.success, ns.update, lock.toggle, etc).
  - vibn_billing_ledger
      Workspace-scoped money ledger (CAD by default) with
      ref_type/ref_id back to the originating row.

OpenSRS XML client (lib/opensrs.ts)
  - Mode-gated host/key (OPENSRS_MODE=test → horizon sandbox,
    rejectUnauthorized:false; live → rr-n1-tor, strict TLS).
  - MD5 double-hash signature.
  - Pure Node https module (no undici dep).
  - Verbs: lookupDomain, getDomainPrice, checkDomain, registerDomain,
    updateDomainNameservers, setDomainLock, getResellerBalance.
  - TLD policy: minPeriodFor() bumps .ai to 2y; CPR/legalType
    plumbed through for .ca; registrations default to UNLOCKED so
    immediate NS updates succeed without a lock toggle.

DNS provider abstraction (lib/dns/{provider,cloud-dns}.ts)
  - DnsProvider interface (createZone/getZone/setRecords/deleteZone)
    so the workspace residency knob can swap backends later.
  - cloudDnsProvider implementation against Google Cloud DNS using
    the existing vibn-workspace-provisioner SA (roles/dns.admin).
  - Idempotent zone creation, additions+deletions diff for rrsets.

Shared GCP auth (lib/gcp-auth.ts)
  - Single getGcpAccessToken() helper used by Cloud DNS today and
    future GCP integrations. Prefers GOOGLE_SERVICE_ACCOUNT_KEY_B64,
    falls back to ADC.

Workspace-scoped helpers (lib/domains.ts)
  - listDomainsForWorkspace, getDomainForWorkspace, createDomainIntent,
    markDomainRegistered, markDomainFailed, markDomainAttached,
    recordDomainEvent, recordLedgerEntry.

Attach orchestrator (lib/domain-attach.ts)
  Single function attachDomain() reused by REST + MCP. For one
  apex it:
    1. Resolves target → Coolify app uuid OR raw IP OR CNAME.
    2. Ensures Cloud DNS managed zone exists.
    3. Writes A / CNAME records (apex + requested subdomains).
    4. Updates registrar nameservers, with auto unlock-retry-relock
       fallback for TLDs that reject NS changes while locked.
    5. PATCHes the Coolify application's domain list so Traefik
       routes the new hostname.
    6. Persists dns_provider/zone_id/nameservers and emits an
       attach.success domain_event.
  AttachError carries a stable .tag + http status so the caller
  can map registrar/dns/coolify failures cleanly.

REST endpoints
  - POST   /api/workspaces/[slug]/domains/search
  - GET    /api/workspaces/[slug]/domains
  - POST   /api/workspaces/[slug]/domains
  - GET    /api/workspaces/[slug]/domains/[domain]
  - POST   /api/workspaces/[slug]/domains/[domain]/attach
  All routes go through requireWorkspacePrincipal (session OR
  Authorization: Bearer vibn_sk_...). Register is idempotent:
  re-issuing for an existing intent re-attempts at OpenSRS without
  duplicating the row or charging twice.

MCP bridge (app/api/mcp/route.ts → version 2.2.0)
  Adds five tools backed by the same library code:
    - domains.search    (batch availability + pricing)
    - domains.list      (workspace-owned)
    - domains.get       (single + recent events)
    - domains.register  (idempotent OpenSRS register)
    - domains.attach    (full Cloud DNS + registrar + Coolify)

Sandbox smoke tests (scripts/smoke-opensrs-*.ts)
  Standalone Node scripts validating each new opensrs.ts call against
  horizon.opensrs.net: balance + lookup + check, TLD policy
  (.ca/.ai/.io/.com), full register flow, NS update with systemdns
  nameservers, and the lock/unlock toggle that backs the attach
  fallback path.

Post-deploy checklist
  1. POST https://vibnai.com/api/admin/migrate
       -H "x-admin-secret: $ADMIN_MIGRATE_SECRET"
  2. Set OPENSRS_* env vars on the vibn-frontend Coolify app
     (RESELLER_USERNAME, API_KEY_LIVE, API_KEY_TEST, HOST_LIVE,
     HOST_TEST, PORT, MODE). Without them, only domains.list/get
     work; search/register/attach return 500.
  3. GCP_PROJECT_ID is read from env or defaults to master-ai-484822.
  4. Live attach end-to-end against a real apex is queued as a
     follow-up — sandbox path is fully proven.

Not in this commit (deliberate)
  - The 100+ unrelated in-flight files (mvp-setup wizard, justine
    homepage rework, BuildLivePlanPanel, etc) — kept local to keep
    blast radius minimal.

Made-with: Cursor

app/api/mcp/route.ts

@@ -65,7 +65,7 @@ const GITEA_API_URL = process.env.GITEA_API_URL ?? 'https://git.vibnai.com';
 export async function GET() {
   return NextResponse.json({
     name: 'vibn-mcp',
-    version: '2.1.0',
+    version: '2.2.0',
     authentication: {
       scheme: 'Bearer',
       tokenPrefix: 'vibn_sk_',
@@ -101,6 +101,11 @@ export async function GET() {
           'auth.list',
           'auth.create',
           'auth.delete',
+          'domains.search',
+          'domains.list',
+          'domains.get',
+          'domains.register',
+          'domains.attach',
         ],
       },
     },
@@ -191,6 +196,17 @@ export async function POST(request: Request) {
       case 'auth.delete':
         return await toolAuthDelete(principal, params);
 
+      case 'domains.search':
+        return await toolDomainsSearch(principal, params);
+      case 'domains.list':
+        return await toolDomainsList(principal);
+      case 'domains.get':
+        return await toolDomainsGet(principal, params);
+      case 'domains.register':
+        return await toolDomainsRegister(principal, params);
+      case 'domains.attach':
+        return await toolDomainsAttach(principal, params);
+
       default:
         return NextResponse.json(
           { error: `Unknown tool "${action}"` },
@@ -819,3 +835,212 @@ async function toolAuthDelete(principal: Principal, params: Record<string, any>)
     result: { ok: true, deleted: { uuid, name: svc.name, volumesKept: !deleteVolumes } },
   });
 }
+
+// ──────────────────────────────────────────────────
+// Phase 5.1: domains (OpenSRS)
+// ──────────────────────────────────────────────────
+
+async function toolDomainsSearch(principal: Principal, params: Record<string, any>) {
+  const namesIn = Array.isArray(params.names) ? params.names : [params.name];
+  const names = namesIn
+    .filter((x: unknown): x is string => typeof x === 'string' && x.trim().length > 0)
+    .map((s: string) => s.trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/+$/, ''));
+  if (names.length === 0) {
+    return NextResponse.json({ error: 'Params { names: string[] } or { name: string } required' }, { status: 400 });
+  }
+  const period = typeof params.period === 'number' && params.period > 0 ? params.period : 1;
+  const { checkDomain } = await import('@/lib/opensrs');
+  const results = await Promise.all(names.map(async (name: string) => {
+    try {
+      const r = await checkDomain(name, period);
+      return {
+        domain: name,
+        available: r.available,
+        price: r.price ?? null,
+        currency: r.currency ?? (process.env.OPENSRS_CURRENCY ?? 'CAD'),
+        period: r.period ?? period,
+      };
+    } catch (err) {
+      return { domain: name, available: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  }));
+  return NextResponse.json({ result: { mode: process.env.OPENSRS_MODE ?? 'test', results } });
+}
+
+async function toolDomainsList(principal: Principal) {
+  const { listDomainsForWorkspace } = await import('@/lib/domains');
+  const rows = await listDomainsForWorkspace(principal.workspace.id);
+  return NextResponse.json({
+    result: rows.map(r => ({
+      id: r.id,
+      domain: r.domain,
+      tld: r.tld,
+      status: r.status,
+      registeredAt: r.registered_at,
+      expiresAt: r.expires_at,
+      periodYears: r.period_years,
+      dnsProvider: r.dns_provider,
+    })),
+  });
+}
+
+async function toolDomainsGet(principal: Principal, params: Record<string, any>) {
+  const name = String(params.domain ?? params.name ?? '').trim().toLowerCase();
+  if (!name) return NextResponse.json({ error: 'Param "domain" is required' }, { status: 400 });
+  const { getDomainForWorkspace } = await import('@/lib/domains');
+  const row = await getDomainForWorkspace(principal.workspace.id, name);
+  if (!row) return NextResponse.json({ error: 'Domain not found in this workspace' }, { status: 404 });
+  return NextResponse.json({
+    result: {
+      id: row.id,
+      domain: row.domain,
+      tld: row.tld,
+      status: row.status,
+      registrarOrderId: row.registrar_order_id,
+      periodYears: row.period_years,
+      registeredAt: row.registered_at,
+      expiresAt: row.expires_at,
+      dnsProvider: row.dns_provider,
+      dnsZoneId: row.dns_zone_id,
+      dnsNameservers: row.dns_nameservers,
+    },
+  });
+}
+
+async function toolDomainsRegister(principal: Principal, params: Record<string, any>) {
+  const raw = String(params.domain ?? '').toLowerCase().trim()
+    .replace(/^https?:\/\//, '').replace(/\/+$/, '');
+  if (!raw || !/^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(raw)) {
+    return NextResponse.json({ error: '`domain` is required and must be a valid hostname' }, { status: 400 });
+  }
+  if (!params.contact || typeof params.contact !== 'object') {
+    return NextResponse.json({ error: '`contact` object is required (see /api/workspaces/[slug]/domains POST schema)' }, { status: 400 });
+  }
+  const { domainTld: tldOf, minPeriodFor, registerDomain, OpenSrsError } = await import('@/lib/opensrs');
+  const tld = tldOf(raw);
+  if (tld === 'ca' && !params.ca) {
+    return NextResponse.json({ error: '.ca requires `ca.cprCategory` and `ca.legalType`' }, { status: 400 });
+  }
+  const period = minPeriodFor(tld, typeof params.period === 'number' ? params.period : 1);
+
+  const {
+    createDomainIntent, getDomainForWorkspace, markDomainFailed,
+    markDomainRegistered, recordDomainEvent,
+  } = await import('@/lib/domains');
+
+  let intent = await getDomainForWorkspace(principal.workspace.id, raw);
+  if (intent && intent.status === 'active') {
+    return NextResponse.json({ error: `Domain ${raw} is already registered`, domainId: intent.id }, { status: 409 });
+  }
+  if (!intent) {
+    intent = await createDomainIntent({
+      workspaceId: principal.workspace.id,
+      domain: raw,
+      createdBy: principal.userId,
+      periodYears: period,
+      whoisPrivacy: params.whoisPrivacy ?? true,
+    });
+  }
+  await recordDomainEvent({
+    domainId: intent.id,
+    workspaceId: principal.workspace.id,
+    type: 'register.attempt',
+    payload: { period, via: 'mcp', mode: process.env.OPENSRS_MODE ?? 'test' },
+  });
+
+  try {
+    const result = await registerDomain({
+      domain: raw,
+      period,
+      contact: params.contact,
+      nameservers: params.nameservers,
+      whoisPrivacy: params.whoisPrivacy ?? true,
+      ca: params.ca,
+    });
+    const updated = await markDomainRegistered({
+      domainId: intent.id,
+      registrarOrderId: result.orderId,
+      registrarUsername: result.regUsername,
+      registrarPassword: result.regPassword,
+      periodYears: period,
+      pricePaidCents: null,
+      priceCurrency: process.env.OPENSRS_CURRENCY ?? 'CAD',
+      registeredAt: new Date(),
+      expiresAt: new Date(Date.now() + period * 365 * 24 * 60 * 60 * 1000),
+    });
+    await recordDomainEvent({
+      domainId: intent.id,
+      workspaceId: principal.workspace.id,
+      type: 'register.success',
+      payload: { orderId: result.orderId, period, via: 'mcp' },
+    });
+    return NextResponse.json({
+      result: {
+        ok: true,
+        mode: process.env.OPENSRS_MODE ?? 'test',
+        domain: {
+          id: updated.id,
+          domain: updated.domain,
+          status: updated.status,
+          registrarOrderId: updated.registrar_order_id,
+          expiresAt: updated.expires_at,
+        },
+      },
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await markDomainFailed(intent.id, message);
+    if (err instanceof OpenSrsError) {
+      return NextResponse.json({ error: 'Registration failed', registrarCode: err.code, details: err.message }, { status: 502 });
+    }
+    return NextResponse.json({ error: 'Registration failed', details: message }, { status: 500 });
+  }
+}
+
+async function toolDomainsAttach(principal: Principal, params: Record<string, any>) {
+  const apex = String(params.domain ?? params.name ?? '').trim().toLowerCase();
+  if (!apex) return NextResponse.json({ error: 'Param "domain" is required' }, { status: 400 });
+
+  const { getDomainForWorkspace } = await import('@/lib/domains');
+  const row = await getDomainForWorkspace(principal.workspace.id, apex);
+  if (!row) return NextResponse.json({ error: 'Domain not found in this workspace' }, { status: 404 });
+
+  const { attachDomain, AttachError } = await import('@/lib/domain-attach');
+  try {
+    const result = await attachDomain(principal.workspace, row, {
+      appUuid: typeof params.appUuid === 'string' ? params.appUuid : undefined,
+      ip: typeof params.ip === 'string' ? params.ip : undefined,
+      cname: typeof params.cname === 'string' ? params.cname : undefined,
+      subdomains: Array.isArray(params.subdomains) ? params.subdomains : undefined,
+      updateRegistrarNs: params.updateRegistrarNs !== false,
+    });
+    return NextResponse.json({
+      result: {
+        ok: true,
+        domain: {
+          id: result.domain.id,
+          domain: result.domain.domain,
+          dnsProvider: result.domain.dns_provider,
+          dnsZoneId: result.domain.dns_zone_id,
+          dnsNameservers: result.domain.dns_nameservers,
+        },
+        zone: result.zone,
+        records: result.records,
+        registrarNsUpdate: result.registrarNsUpdate,
+        coolifyUpdate: result.coolifyUpdate,
+      },
+    });
+  } catch (err) {
+    if (err instanceof AttachError) {
+      return NextResponse.json(
+        { error: err.message, tag: err.tag, ...(err.extra ?? {}) },
+        { status: err.status },
+      );
+    }
+    console.error('[mcp domains.attach] unexpected', err);
+    return NextResponse.json(
+      { error: 'Attach failed', details: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}