feat(domains): P5.1 — OpenSRS registration + Cloud DNS + Coolify attach

Adds end-to-end custom apex domain support: workspace-scoped
registration via OpenSRS (Tucows), authoritative DNS via Google
Cloud DNS, and one-call attach that wires registrar nameservers,
DNS records, and Coolify app routing in a single transactional
flow.

Schema (additive, idempotent — run /api/admin/migrate after deploy)
  - vibn_workspaces.dns_provider TEXT DEFAULT 'cloud_dns'
      Per-workspace DNS backend choice. Future: 'cira_dzone' for
      strict CA-only residency on .ca.
  - vibn_domains
      One row per registered/intended apex. Tracks status
      (pending|active|failed|expired), registrar order id, encrypted
      registrar manage-user creds (AES-256-GCM, VIBN_SECRETS_KEY),
      period, dates, dns_provider/zone_id/nameservers, and a
      created_by audit field.
  - vibn_domain_events
      Append-only lifecycle audit (register.attempt/success/fail,
      attach.success, ns.update, lock.toggle, etc).
  - vibn_billing_ledger
      Workspace-scoped money ledger (CAD by default) with
      ref_type/ref_id back to the originating row.

OpenSRS XML client (lib/opensrs.ts)
  - Mode-gated host/key (OPENSRS_MODE=test → horizon sandbox,
    rejectUnauthorized:false; live → rr-n1-tor, strict TLS).
  - MD5 double-hash signature.
  - Pure Node https module (no undici dep).
  - Verbs: lookupDomain, getDomainPrice, checkDomain, registerDomain,
    updateDomainNameservers, setDomainLock, getResellerBalance.
  - TLD policy: minPeriodFor() bumps .ai to 2y; CPR/legalType
    plumbed through for .ca; registrations default to UNLOCKED so
    immediate NS updates succeed without a lock toggle.

DNS provider abstraction (lib/dns/{provider,cloud-dns}.ts)
  - DnsProvider interface (createZone/getZone/setRecords/deleteZone)
    so the workspace residency knob can swap backends later.
  - cloudDnsProvider implementation against Google Cloud DNS using
    the existing vibn-workspace-provisioner SA (roles/dns.admin).
  - Idempotent zone creation, additions+deletions diff for rrsets.

Shared GCP auth (lib/gcp-auth.ts)
  - Single getGcpAccessToken() helper used by Cloud DNS today and
    future GCP integrations. Prefers GOOGLE_SERVICE_ACCOUNT_KEY_B64,
    falls back to ADC.

Workspace-scoped helpers (lib/domains.ts)
  - listDomainsForWorkspace, getDomainForWorkspace, createDomainIntent,
    markDomainRegistered, markDomainFailed, markDomainAttached,
    recordDomainEvent, recordLedgerEntry.

Attach orchestrator (lib/domain-attach.ts)
  Single function attachDomain() reused by REST + MCP. For one
  apex it:
    1. Resolves target → Coolify app uuid OR raw IP OR CNAME.
    2. Ensures Cloud DNS managed zone exists.
    3. Writes A / CNAME records (apex + requested subdomains).
    4. Updates registrar nameservers, with auto unlock-retry-relock
       fallback for TLDs that reject NS changes while locked.
    5. PATCHes the Coolify application's domain list so Traefik
       routes the new hostname.
    6. Persists dns_provider/zone_id/nameservers and emits an
       attach.success domain_event.
  AttachError carries a stable .tag + http status so the caller
  can map registrar/dns/coolify failures cleanly.

REST endpoints
  - POST   /api/workspaces/[slug]/domains/search
  - GET    /api/workspaces/[slug]/domains
  - POST   /api/workspaces/[slug]/domains
  - GET    /api/workspaces/[slug]/domains/[domain]
  - POST   /api/workspaces/[slug]/domains/[domain]/attach
  All routes go through requireWorkspacePrincipal (session OR
  Authorization: Bearer vibn_sk_...). Register is idempotent:
  re-issuing for an existing intent re-attempts at OpenSRS without
  duplicating the row or charging twice.

MCP bridge (app/api/mcp/route.ts → version 2.2.0)
  Adds five tools backed by the same library code:
    - domains.search    (batch availability + pricing)
    - domains.list      (workspace-owned)
    - domains.get       (single + recent events)
    - domains.register  (idempotent OpenSRS register)
    - domains.attach    (full Cloud DNS + registrar + Coolify)

Sandbox smoke tests (scripts/smoke-opensrs-*.ts)
  Standalone Node scripts validating each new opensrs.ts call against
  horizon.opensrs.net: balance + lookup + check, TLD policy
  (.ca/.ai/.io/.com), full register flow, NS update with systemdns
  nameservers, and the lock/unlock toggle that backs the attach
  fallback path.

Post-deploy checklist
  1. POST https://vibnai.com/api/admin/migrate
       -H "x-admin-secret: $ADMIN_MIGRATE_SECRET"
  2. Set OPENSRS_* env vars on the vibn-frontend Coolify app
     (RESELLER_USERNAME, API_KEY_LIVE, API_KEY_TEST, HOST_LIVE,
     HOST_TEST, PORT, MODE). Without them, only domains.list/get
     work; search/register/attach return 500.
  3. GCP_PROJECT_ID is read from env or defaults to master-ai-484822.
  4. Live attach end-to-end against a real apex is queued as a
     follow-up — sandbox path is fully proven.

Not in this commit (deliberate)
  - The 100+ unrelated in-flight files (mvp-setup wizard, justine
    homepage rework, BuildLivePlanPanel, etc) — kept local to keep
    blast radius minimal.

Made-with: Cursor

scripts/smoke-opensrs-lock.ts

@@ -0,0 +1,21 @@
+/**
+ * Smoke: register unlocked, lock it, then unlock. Proves setDomainLock().
+ */
+import { registerDomain, setDomainLock, type RegistrationContact } from '../lib/opensrs';
+
+const CONTACT: RegistrationContact = {
+  first_name: 'Mark', last_name: 'Henderson', org_name: 'Get Acquired Inc',
+  address1: '123 King St W', city: 'Toronto', state: 'ON',
+  country: 'CA', postal_code: 'M5H 1A1',
+  phone: '+1.4165551234', email: 'mark@getacquired.com',
+};
+
+async function main() {
+  const domain = `vibnai-lock-${Date.now()}.com`;
+  const reg = await registerDomain({ domain, period: 1, contact: CONTACT });
+  console.log('[lock-smoke] registered', domain, 'order=', reg.orderId);
+  console.log('[lock-smoke] lock ->', await setDomainLock(domain, true));
+  console.log('[lock-smoke] unlock ->', await setDomainLock(domain, false));
+}
+
+main().catch(err => { console.error('[lock-smoke] FAILED:', err); process.exit(1); });

scripts/smoke-opensrs-ns-update.ts

@@ -0,0 +1,45 @@
+/**
+ * Smoke: register a sandbox domain, then update its nameservers to a
+ * fake-but-valid set. Proves the full attach-time registrar flow.
+ *
+ * Usage:  source .opensrs.env && npx tsx scripts/smoke-opensrs-ns-update.ts
+ */
+
+import {
+  registerDomain,
+  updateDomainNameservers,
+  type RegistrationContact,
+} from '../lib/opensrs';
+
+const CONTACT: RegistrationContact = {
+  first_name: 'Mark',
+  last_name: 'Henderson',
+  org_name: 'Get Acquired Inc',
+  address1: '123 King St W',
+  city: 'Toronto',
+  state: 'ON',
+  country: 'CA',
+  postal_code: 'M5H 1A1',
+  phone: '+1.4165551234',
+  email: 'mark@getacquired.com',
+};
+
+async function main() {
+  const domain = `vibnai-ns-${Date.now()}.com`;
+  console.log('[ns-smoke] register', domain);
+  const reg = await registerDomain({ domain, period: 1, contact: CONTACT });
+  console.log('[ns-smoke] registered. order=', reg.orderId);
+
+  // Cloud DNS nameservers follow this format — use real-looking values.
+  // Horizon only knows about nameservers that already exist at the registry
+  // it talks to. Its built-in ones are ns1/ns2.systemdns.com, and they're
+  // the ones every sandbox domain registers with by default. In production
+  // we'll point at the Cloud DNS nameservers returned from createZone, which
+  // are publicly resolvable and accepted by every upstream registry.
+  const ns = ['ns1.systemdns.com', 'ns2.systemdns.com', 'ns3.systemdns.com', 'ns4.systemdns.com'];
+  console.log('[ns-smoke] updating NS to', ns);
+  const upd = await updateDomainNameservers(domain, ns);
+  console.log('[ns-smoke] NS update response:', upd);
+}
+
+main().catch(err => { console.error('[ns-smoke] FAILED:', err); process.exit(1); });

scripts/smoke-opensrs-register.ts

@@ -0,0 +1,38 @@
+/**
+ * Live sandbox registration smoke.
+ *
+ * Runs sw_register against Horizon (test mode) with the Vibn corporate
+ * contact. Horizon doesn't actually allocate a name at any registry — it's
+ * purely a protocol simulator — so this is safe to run repeatedly.
+ *
+ * Usage:  source .opensrs.env && npx tsx scripts/smoke-opensrs-register.ts
+ */
+
+import { registerDomain, type RegistrationContact } from '../lib/opensrs';
+
+const CONTACT: RegistrationContact = {
+  first_name: 'Mark',
+  last_name: 'Henderson',
+  org_name: 'Get Acquired Inc',
+  address1: '123 King St W',
+  city: 'Toronto',
+  state: 'ON',
+  country: 'CA',
+  postal_code: 'M5H 1A1',
+  phone: '+1.4165551234',
+  email: 'mark@getacquired.com',
+};
+
+async function main() {
+  const domain = `vibnai-smoke-${Date.now()}.com`;
+  console.log('[register-smoke] registering', domain);
+  const result = await registerDomain({
+    domain,
+    period: 1,
+    contact: CONTACT,
+    whoisPrivacy: true,
+  });
+  console.log('[register-smoke] result:', result);
+}
+
+main().catch(err => { console.error('[register-smoke] FAILED:', err); process.exit(1); });

scripts/smoke-opensrs-tlds.ts

@@ -0,0 +1,28 @@
+/**
+ * TLD-quirk smoke test: verify that .ca, .ai, .io all return sensible
+ * availability + price through lib/opensrs.ts.
+ *
+ * Usage:  source .opensrs.env && npx tsx scripts/smoke-opensrs-tlds.ts
+ */
+
+import { checkDomain } from '../lib/opensrs';
+
+async function main() {
+  const stamp = Date.now();
+  const cases = [
+    { domain: `vibnai-${stamp}.ca`, period: 1 },
+    { domain: `vibnai-${stamp}.ai`, period: 1 }, // should auto-bump to 2y
+    { domain: `vibnai-${stamp}.io`, period: 1 },
+    { domain: `vibnai-${stamp}.com`, period: 1 },
+  ];
+  for (const c of cases) {
+    try {
+      const r = await checkDomain(c.domain, c.period);
+      console.log(c.domain.padEnd(32), '->', JSON.stringify(r));
+    } catch (err) {
+      console.log(c.domain.padEnd(32), '-> ERR', err instanceof Error ? err.message : err);
+    }
+  }
+}
+
+main().catch(err => { console.error(err); process.exit(1); });

scripts/smoke-opensrs.ts

@@ -0,0 +1,31 @@
+/**
+ * Smoke test for lib/opensrs.ts against the OpenSRS Horizon sandbox.
+ *
+ * Usage (from repo root):
+ *   source .opensrs.env
+ *   cd vibn-frontend && npx tsx scripts/smoke-opensrs.ts vibnai-smoke-$(date +%s).com
+ *
+ * - Prints availability + price for the given domain.
+ * - Does NOT attempt registration (that belongs to a separate manual test).
+ */
+
+import { checkDomain, getResellerBalance, lookupDomain } from '../lib/opensrs';
+
+async function main() {
+  const domain = process.argv[2] ?? `vibnai-smoke-${Date.now()}.com`;
+  console.log(`[smoke-opensrs] mode=${process.env.OPENSRS_MODE ?? 'test'} domain=${domain}`);
+
+  const balance = await getResellerBalance();
+  console.log('[smoke-opensrs] reseller balance:', balance);
+
+  const avail = await lookupDomain(domain);
+  console.log('[smoke-opensrs] lookup:', avail);
+
+  const check = await checkDomain(domain, 1);
+  console.log('[smoke-opensrs] check (availability + price):', check);
+}
+
+main().catch(err => {
+  console.error('[smoke-opensrs] FAILED:', err);
+  process.exit(1);
+});