feat(domains): P5.1 — OpenSRS registration + Cloud DNS + Coolify attach

Adds end-to-end custom apex domain support: workspace-scoped
registration via OpenSRS (Tucows), authoritative DNS via Google
Cloud DNS, and one-call attach that wires registrar nameservers,
DNS records, and Coolify app routing in a single transactional
flow.

Schema (additive, idempotent — run /api/admin/migrate after deploy)
  - vibn_workspaces.dns_provider TEXT DEFAULT 'cloud_dns'
      Per-workspace DNS backend choice. Future: 'cira_dzone' for
      strict CA-only residency on .ca.
  - vibn_domains
      One row per registered/intended apex. Tracks status
      (pending|active|failed|expired), registrar order id, encrypted
      registrar manage-user creds (AES-256-GCM, VIBN_SECRETS_KEY),
      period, dates, dns_provider/zone_id/nameservers, and a
      created_by audit field.
  - vibn_domain_events
      Append-only lifecycle audit (register.attempt/success/fail,
      attach.success, ns.update, lock.toggle, etc).
  - vibn_billing_ledger
      Workspace-scoped money ledger (CAD by default) with
      ref_type/ref_id back to the originating row.

OpenSRS XML client (lib/opensrs.ts)
  - Mode-gated host/key (OPENSRS_MODE=test → horizon sandbox,
    rejectUnauthorized:false; live → rr-n1-tor, strict TLS).
  - MD5 double-hash signature.
  - Pure Node https module (no undici dep).
  - Verbs: lookupDomain, getDomainPrice, checkDomain, registerDomain,
    updateDomainNameservers, setDomainLock, getResellerBalance.
  - TLD policy: minPeriodFor() bumps .ai to 2y; CPR/legalType
    plumbed through for .ca; registrations default to UNLOCKED so
    immediate NS updates succeed without a lock toggle.

DNS provider abstraction (lib/dns/{provider,cloud-dns}.ts)
  - DnsProvider interface (createZone/getZone/setRecords/deleteZone)
    so the workspace residency knob can swap backends later.
  - cloudDnsProvider implementation against Google Cloud DNS using
    the existing vibn-workspace-provisioner SA (roles/dns.admin).
  - Idempotent zone creation, additions+deletions diff for rrsets.

Shared GCP auth (lib/gcp-auth.ts)
  - Single getGcpAccessToken() helper used by Cloud DNS today and
    future GCP integrations. Prefers GOOGLE_SERVICE_ACCOUNT_KEY_B64,
    falls back to ADC.

Workspace-scoped helpers (lib/domains.ts)
  - listDomainsForWorkspace, getDomainForWorkspace, createDomainIntent,
    markDomainRegistered, markDomainFailed, markDomainAttached,
    recordDomainEvent, recordLedgerEntry.

Attach orchestrator (lib/domain-attach.ts)
  Single function attachDomain() reused by REST + MCP. For one
  apex it:
    1. Resolves target → Coolify app uuid OR raw IP OR CNAME.
    2. Ensures Cloud DNS managed zone exists.
    3. Writes A / CNAME records (apex + requested subdomains).
    4. Updates registrar nameservers, with auto unlock-retry-relock
       fallback for TLDs that reject NS changes while locked.
    5. PATCHes the Coolify application's domain list so Traefik
       routes the new hostname.
    6. Persists dns_provider/zone_id/nameservers and emits an
       attach.success domain_event.
  AttachError carries a stable .tag + http status so the caller
  can map registrar/dns/coolify failures cleanly.

REST endpoints
  - POST   /api/workspaces/[slug]/domains/search
  - GET    /api/workspaces/[slug]/domains
  - POST   /api/workspaces/[slug]/domains
  - GET    /api/workspaces/[slug]/domains/[domain]
  - POST   /api/workspaces/[slug]/domains/[domain]/attach
  All routes go through requireWorkspacePrincipal (session OR
  Authorization: Bearer vibn_sk_...). Register is idempotent:
  re-issuing for an existing intent re-attempts at OpenSRS without
  duplicating the row or charging twice.

MCP bridge (app/api/mcp/route.ts → version 2.2.0)
  Adds five tools backed by the same library code:
    - domains.search    (batch availability + pricing)
    - domains.list      (workspace-owned)
    - domains.get       (single + recent events)
    - domains.register  (idempotent OpenSRS register)
    - domains.attach    (full Cloud DNS + registrar + Coolify)

Sandbox smoke tests (scripts/smoke-opensrs-*.ts)
  Standalone Node scripts validating each new opensrs.ts call against
  horizon.opensrs.net: balance + lookup + check, TLD policy
  (.ca/.ai/.io/.com), full register flow, NS update with systemdns
  nameservers, and the lock/unlock toggle that backs the attach
  fallback path.

Post-deploy checklist
  1. POST https://vibnai.com/api/admin/migrate
       -H "x-admin-secret: $ADMIN_MIGRATE_SECRET"
  2. Set OPENSRS_* env vars on the vibn-frontend Coolify app
     (RESELLER_USERNAME, API_KEY_LIVE, API_KEY_TEST, HOST_LIVE,
     HOST_TEST, PORT, MODE). Without them, only domains.list/get
     work; search/register/attach return 500.
  3. GCP_PROJECT_ID is read from env or defaults to master-ai-484822.
  4. Live attach end-to-end against a real apex is queued as a
     follow-up — sandbox path is fully proven.

Not in this commit (deliberate)
  - The 100+ unrelated in-flight files (mvp-setup wizard, justine
    homepage rework, BuildLivePlanPanel, etc) — kept local to keep
    blast radius minimal.

Made-with: Cursor

lib/domains.ts

@@ -0,0 +1,221 @@
+/**
+ * Workspace-scoped domain helpers.
+ *
+ * Thin DB accessor layer on top of vibn_domains / vibn_domain_events /
+ * vibn_billing_ledger. All inserts are idempotent by `(workspace_id, domain)`
+ * so an accidental double-POST from an agent can't charge twice.
+ */
+
+import { query, queryOne } from '@/lib/db-postgres';
+import { encryptSecret } from '@/lib/auth/secret-box';
+import { domainTld } from '@/lib/opensrs';
+
+export type DomainStatus =
+  | 'pending'       // intent recorded, not yet sent to registrar
+  | 'registering'   // OpenSRS call in flight
+  | 'active'        // registered, on our books
+  | 'failed'        // registrar rejected
+  | 'expired'
+  | 'deleted';
+
+export interface VibnDomain {
+  id: string;
+  workspace_id: string;
+  domain: string;
+  tld: string;
+  status: DomainStatus;
+  registrar: string;
+  registrar_order_id: string | null;
+  registrar_username: string | null;
+  /** Encrypted; call `getDomainRegistrarPassword` to decrypt. */
+  registrar_password_enc: string | null;
+  period_years: number;
+  whois_privacy: boolean;
+  auto_renew: boolean;
+  registered_at: Date | null;
+  expires_at: Date | null;
+  dns_provider: string | null;
+  dns_zone_id: string | null;
+  dns_nameservers: string[] | null;
+  price_paid_cents: number | null;
+  price_currency: string | null;
+  created_by: string;
+  created_at: Date;
+  updated_at: Date;
+}
+
+export async function listDomainsForWorkspace(workspaceId: string): Promise<VibnDomain[]> {
+  return query<VibnDomain>(
+    `SELECT * FROM vibn_domains
+      WHERE workspace_id = $1
+      ORDER BY created_at DESC`,
+    [workspaceId],
+  );
+}
+
+export async function getDomainForWorkspace(
+  workspaceId: string,
+  domain: string,
+): Promise<VibnDomain | null> {
+  const row = await queryOne<VibnDomain>(
+    `SELECT * FROM vibn_domains
+      WHERE workspace_id = $1 AND domain = $2
+      LIMIT 1`,
+    [workspaceId, domain.toLowerCase()],
+  );
+  return row ?? null;
+}
+
+export interface CreateDomainIntentInput {
+  workspaceId: string;
+  domain: string;
+  createdBy: string;
+  periodYears?: number;
+  whoisPrivacy?: boolean;
+}
+
+export async function createDomainIntent(input: CreateDomainIntentInput): Promise<VibnDomain> {
+  const normalized = input.domain.toLowerCase().trim();
+  const tld = domainTld(normalized);
+  const existing = await getDomainForWorkspace(input.workspaceId, normalized);
+  if (existing) return existing;
+
+  const rows = await query<VibnDomain>(
+    `INSERT INTO vibn_domains
+       (workspace_id, domain, tld, status, registrar, period_years, whois_privacy, created_by)
+     VALUES ($1, $2, $3, 'pending', 'opensrs', $4, $5, $6)
+     RETURNING *`,
+    [
+      input.workspaceId,
+      normalized,
+      tld,
+      input.periodYears ?? 1,
+      input.whoisPrivacy ?? true,
+      input.createdBy,
+    ],
+  );
+  return rows[0];
+}
+
+export interface MarkRegisteredInput {
+  domainId: string;
+  registrarOrderId: string;
+  registrarUsername: string;
+  registrarPassword: string;
+  periodYears: number;
+  pricePaidCents: number | null;
+  priceCurrency: string | null;
+  registeredAt?: Date;
+  /** Days from registeredAt to expiry (365*years). */
+  expiresAt?: Date;
+}
+
+export async function markDomainRegistered(input: MarkRegisteredInput): Promise<VibnDomain> {
+  const encPw = encryptSecret(input.registrarPassword);
+  const rows = await query<VibnDomain>(
+    `UPDATE vibn_domains
+        SET status = 'active',
+            registrar_order_id = $2,
+            registrar_username = $3,
+            registrar_password_enc = $4,
+            period_years = $5,
+            price_paid_cents = $6,
+            price_currency = $7,
+            registered_at = COALESCE($8, now()),
+            expires_at = $9,
+            updated_at = now()
+      WHERE id = $1
+      RETURNING *`,
+    [
+      input.domainId,
+      input.registrarOrderId,
+      input.registrarUsername,
+      encPw,
+      input.periodYears,
+      input.pricePaidCents,
+      input.priceCurrency,
+      input.registeredAt ?? null,
+      input.expiresAt ?? null,
+    ],
+  );
+  return rows[0];
+}
+
+export interface AttachDomainDnsInput {
+  domainId: string;
+  dnsProvider: string;
+  dnsZoneId: string;
+  dnsNameservers: string[];
+}
+
+export async function markDomainAttached(input: AttachDomainDnsInput): Promise<VibnDomain> {
+  const rows = await query<VibnDomain>(
+    `UPDATE vibn_domains
+        SET dns_provider = $2,
+            dns_zone_id = $3,
+            dns_nameservers = $4::jsonb,
+            updated_at = now()
+      WHERE id = $1
+      RETURNING *`,
+    [input.domainId, input.dnsProvider, input.dnsZoneId, JSON.stringify(input.dnsNameservers)],
+  );
+  return rows[0];
+}
+
+export async function markDomainFailed(domainId: string, reason: string): Promise<void> {
+  const row = await queryOne<{ workspace_id: string }>(
+    `UPDATE vibn_domains SET status = 'failed', updated_at = now()
+      WHERE id = $1
+      RETURNING workspace_id`,
+    [domainId],
+  );
+  if (!row) return;
+  await recordDomainEvent({
+    domainId,
+    workspaceId: row.workspace_id,
+    type: 'register.failed',
+    payload: { reason },
+  });
+}
+
+export interface RecordDomainEventInput {
+  domainId: string;
+  workspaceId: string;
+  type: string;
+  payload?: Record<string, unknown>;
+}
+
+export async function recordDomainEvent(input: RecordDomainEventInput): Promise<void> {
+  await query(
+    `INSERT INTO vibn_domain_events (domain_id, workspace_id, type, payload)
+     VALUES ($1, $2, $3, $4::jsonb)`,
+    [input.domainId, input.workspaceId, input.type, JSON.stringify(input.payload ?? {})],
+  );
+}
+
+export interface RecordLedgerInput {
+  workspaceId: string;
+  kind: 'debit' | 'credit';
+  amountCents: number;
+  currency?: string;
+  refType?: string;
+  refId?: string;
+  note?: string;
+}
+
+export async function recordLedgerEntry(input: RecordLedgerInput): Promise<void> {
+  await query(
+    `INSERT INTO vibn_billing_ledger
+       (workspace_id, kind, amount_cents, currency, ref_type, ref_id, note)
+     VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+    [
+      input.workspaceId,
+      input.kind,
+      input.amountCents,
+      input.currency ?? 'CAD',
+      input.refType ?? null,
+      input.refId ?? null,
+      input.note ?? null,
+    ],
+  );
+}