chore: merge main into release for new releases

Author: tofikwest

apps/api/src/trust-portal/dto/domain-status.dto.ts

@@ -44,4 +44,11 @@ export class DomainStatusResponseDto {
     required: false,
   })
   verification?: DomainVerificationDto[];
+
+  @ApiProperty({
+    description: 'The recommended CNAME target for this domain from Vercel',
+    example: 'cname.vercel-dns.com',
+    required: false,
+  })
+  cnameTarget?: string;
 }

apps/api/src/trust-portal/trust-portal.service.ts

@@ -47,6 +47,17 @@ interface VercelDomainResponse {
   verification?: VercelDomainVerification[];
 }
 
+interface VercelRecommendedCNAME {
+  rank: number;
+  value: string;
+}
+
+interface VercelDomainConfigResponse {
+  configuredBy?: 'CNAME' | 'A' | 'http' | 'dns-01' | null;
+  misconfigured: boolean;
+  recommendedCNAME?: VercelRecommendedCNAME[];
+}
+
 @Injectable()
 export class TrustPortalService {
   private readonly logger = new Logger(TrustPortalService.name);
@@ -170,16 +181,33 @@ export class TrustPortalService {
 
       // Get domain information including verification status
       // Vercel API endpoint: GET /v9/projects/{projectId}/domains/{domain}
-      const response = await this.vercelApi.get<VercelDomainResponse>(
-        `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}`,
-        {
-          params: {
-            teamId: process.env.VERCEL_TEAM_ID,
+      const [domainResponse, configResponse] = await Promise.all([
+        this.vercelApi.get<VercelDomainResponse>(
+          `/v9/projects/${process.env.TRUST_PORTAL_PROJECT_ID}/domains/${domain}`,
+          {
+            params: {
+              teamId: process.env.VERCEL_TEAM_ID,
+            },
           },
-        },
-      );
-
-      const domainInfo = response.data;
+        ),
+        // Get domain config to retrieve the actual CNAME target
+        // Vercel API endpoint: GET /v6/domains/{domain}/config
+        this.vercelApi
+          .get<VercelDomainConfigResponse>(`/v6/domains/${domain}/config`, {
+            params: {
+              teamId: process.env.VERCEL_TEAM_ID,
+            },
+          })
+          .catch((err) => {
+            this.logger.warn(
+              `Failed to get domain config for ${domain}: ${err.message}`,
+            );
+            return null;
+          }),
+      ]);
+
+      const domainInfo = domainResponse.data;
+      const configInfo = configResponse?.data;
 
       const verification: DomainVerificationDto[] | undefined =
         domainInfo.verification?.map((v) => ({
@@ -189,10 +217,18 @@ export class TrustPortalService {
           reason: v.reason,
         }));
 
+      // Extract the CNAME target from the config response
+      // Prefer rank=1 (preferred value), fallback to first available
+      const recommendedCNAMEs = configInfo?.recommendedCNAME;
+      const cnameTarget =
+        recommendedCNAMEs?.find((c) => c.rank === 1)?.value ||
+        recommendedCNAMEs?.[0]?.value;
+
       return {
         domain: domainInfo.name,
         verified: domainInfo.verified ?? false,
         verification,
+        cnameTarget,
       };
     } catch (error) {
       this.logger.error(

apps/app/src/app/(app)/[orgId]/components/AppShellWrapper.tsx

@@ -1,17 +1,13 @@
 'use client';
 
+import { updateSidebarState } from '@/actions/sidebar';
 import Chat from '@/components/ai/chat';
 import { CheckoutCompleteDialog } from '@/components/dialogs/checkout-complete-dialog';
 import { NotificationBell } from '@/components/notifications/notification-bell';
 import { OrganizationSwitcher } from '@/components/organization-switcher';
-import { updateSidebarState } from '@/actions/sidebar';
 import { SidebarProvider, useSidebar } from '@/context/sidebar-context';
 import { authClient } from '@/utils/auth-client';
-import {
-  CertificateCheck,
-  Logout,
-  Settings,
-} from '@carbon/icons-react';
+import { CertificateCheck, Logout, Settings } from '@carbon/icons-react';
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -40,16 +36,16 @@ import {
   HStack,
   Logo,
   Text,
-  ThemeToggle,
+  ThemeSwitcher,
 } from '@trycompai/design-system';
 import { useAction } from 'next-safe-action/hooks';
 import { useTheme } from 'next-themes';
 import Link from 'next/link';
 import { usePathname, useRouter } from 'next/navigation';
 import { Suspense, useCallback, useRef } from 'react';
 import { SettingsSidebar } from '../settings/components/SettingsSidebar';
-import { AppSidebar } from './AppSidebar';
 import { getAppShellSearchGroups } from './app-shell-search-groups';
+import { AppSidebar } from './AppSidebar';
 import { ConditionalOnboardingTracker } from './ConditionalOnboardingTracker';
 
 interface AppShellWrapperProps {
@@ -94,7 +90,7 @@ function AppShellWrapperContent({
   isOnlyAuditor,
   user,
 }: AppShellWrapperContentProps) {
-  const { resolvedTheme, setTheme } = useTheme();
+  const { theme, resolvedTheme, setTheme } = useTheme();
   const pathname = usePathname();
   const router = useRouter();
   const { isCollapsed, setIsCollapsed } = useSidebar();
@@ -144,7 +140,11 @@ function AppShellWrapperContent({
               />
             </Link>
             <span className="pl-3 pr-1 text-muted-foreground">/</span>
-            <OrganizationSwitcher organizations={organizations} organization={organization} logoUrls={logoUrls} />
+            <OrganizationSwitcher
+              organizations={organizations}
+              organization={organization}
+              logoUrls={logoUrls}
+            />
           </HStack>
         }
         centerContent={<CommandSearch groups={searchGroups} placeholder="Search..." />}
@@ -182,10 +182,12 @@ function AppShellWrapperContent({
                 <DropdownMenuSeparator />
                 <div className="flex items-center justify-between px-2 py-1.5">
                   <Text size="sm">Theme</Text>
-                  <ThemeToggle
+                  <ThemeSwitcher
                     size="sm"
-                    isDark={resolvedTheme === 'dark'}
-                    onChange={(isDark) => setTheme(isDark ? 'dark' : 'light')}
+                    value={(theme ?? 'system') as 'light' | 'dark' | 'system'}
+                    defaultValue="system"
+                    onChange={(value) => setTheme(value)}
+                    showSystem
                   />
                 </div>
                 <DropdownMenuSeparator />

apps/app/src/app/(app)/[orgId]/trust/portal-settings/actions/check-dns-record.ts

@@ -7,6 +7,21 @@ import { Vercel } from '@vercel/sdk';
 import { revalidatePath, revalidateTag } from 'next/cache';
 import { z } from 'zod';
 
+/**
+ * Strict pattern to match known Vercel DNS CNAME targets.
+ * Matches formats like:
+ * - cname.vercel-dns.com
+ * - 3a69a5bb27875189.vercel-dns-016.com
+ * - With or without trailing dot
+ */
+const VERCEL_DNS_CNAME_PATTERN = /\.vercel-dns(-\d+)?\.com\.?$/i;
+
+/**
+ * Fallback pattern - more lenient, catches any vercel-dns variation.
+ * Used if strict pattern fails, with logging for monitoring.
+ */
+const VERCEL_DNS_FALLBACK_PATTERN = /vercel-dns[^.]*\.com\.?$/i;
+
 const checkDnsSchema = z.object({
   domain: z
     .string()
@@ -80,16 +95,31 @@ export const checkDnsRecordAction = authActionClient
         vercelVerification: true,
       },
     });
-    const expectedCnameValue = 'cname.vercel-dns.com';
     const expectedTxtValue = `compai-domain-verification=${activeOrgId}`;
     const expectedVercelTxtValue = isVercelDomain?.vercelVerification;
 
     let isCnameVerified = false;
 
     if (cnameRecords) {
-      isCnameVerified = cnameRecords.some(
-        (record: { address: string }) => record.address.toLowerCase() === expectedCnameValue,
+      // First try strict pattern
+      isCnameVerified = cnameRecords.some((record: { address: string }) =>
+        VERCEL_DNS_CNAME_PATTERN.test(record.address),
       );
+
+      // If strict fails, try fallback pattern (catches new Vercel patterns we haven't seen)
+      if (!isCnameVerified) {
+        const fallbackMatch = cnameRecords.find((record: { address: string }) =>
+          VERCEL_DNS_FALLBACK_PATTERN.test(record.address),
+        );
+
+        if (fallbackMatch) {
+          console.warn(
+            `[DNS Check] CNAME matched fallback pattern but not strict pattern. ` +
+              `Address: ${fallbackMatch.address}. Consider updating VERCEL_DNS_CNAME_PATTERN.`,
+          );
+          isCnameVerified = true;
+        }
+      }
     }
 
     let isTxtVerified = false;

apps/app/src/app/(app)/[orgId]/trust/portal-settings/actions/custom-domain.ts

@@ -69,6 +69,8 @@ export const customDomainAction = authActionClient
         }
       }
 
+      console.log(`Adding domain to Vercel project: ${domain}`);
+
       const addDomainToProject = await vercel.projects.addProjectDomain({
         idOrName: env.TRUST_PORTAL_PROJECT_ID!,
         teamId: env.VERCEL_TEAM_ID!,
@@ -78,6 +80,8 @@ export const customDomainAction = authActionClient
         },
       });
 
+      console.log(`Vercel response for ${domain}:`, JSON.stringify(addDomainToProject, null, 2));
+
       const isVercelDomain = addDomainToProject.verified === false;
 
       // Store the verification details from Vercel if available
@@ -109,7 +113,25 @@ export const customDomainAction = authActionClient
         needsVerification: !domainVerified,
       };
     } catch (error) {
-      console.error(error);
-      throw new Error('Failed to update custom domain');
+      console.error('Custom domain error:', error);
+
+      // Extract meaningful error message from Vercel SDK errors
+      let errorMessage = 'Failed to update custom domain';
+
+      if (error instanceof Error) {
+        // Check for Vercel API error responses
+        const vercelError = error as Error & {
+          body?: { error?: { code?: string; message?: string } };
+          code?: string;
+        };
+
+        if (vercelError.body?.error?.message) {
+          errorMessage = vercelError.body.error.message;
+        } else if (vercelError.message) {
+          errorMessage = vercelError.message;
+        }
+      }
+
+      throw new Error(errorMessage);
     }
   });

apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/TrustPortalDomain.tsx

@@ -1,6 +1,6 @@
 'use client';
 
-import { useDomain } from '@/hooks/use-domain';
+import { DEFAULT_CNAME_TARGET, useDomain } from '@/hooks/use-domain';
 import { Button } from '@comp/ui/button';
 import {
   Card,
@@ -63,6 +63,13 @@ export function TrustPortalDomain({
     return null;
   }, [domainStatus]);
 
+  // Get the actual CNAME target from Vercel, with fallback
+  // Normalize to include trailing dot for DNS record display
+  const cnameTarget = useMemo(() => {
+    const target = domainStatus?.data?.cnameTarget || DEFAULT_CNAME_TARGET;
+    return target.endsWith('.') ? target : `${target}.`;
+  }, [domainStatus?.data?.cnameTarget]);
+
   useEffect(() => {
     const isCnameVerified = localStorage.getItem(`${initialDomain}-isCnameVerified`);
     const isTxtVerified = localStorage.getItem(`${initialDomain}-isTxtVerified`);
@@ -74,6 +81,11 @@ export function TrustPortalDomain({
 
   const updateCustomDomain = useAction(customDomainAction, {
     onSuccess: (data) => {
+      // Check if the action returned an error (e.g., domain already in use)
+      if (data?.data?.success === false) {
+        toast.error(data.data.error || 'Failed to update custom domain.');
+        return;
+      }
       toast.success('Custom domain update submitted, please verify your DNS records.');
     },
     onError: (error) => {
@@ -286,12 +298,12 @@ export function TrustPortalDomain({
                               </td>
                               <td>
                                 <div className="flex items-center justify-between gap-2">
-                                  <span className="min-w-0 break-words">cname.vercel-dns.com.</span>
+                                  <span className="min-w-0 break-words">{cnameTarget}</span>
                                   <Button
                                     variant="ghost"
                                     size="icon"
                                     type="button"
-                                    onClick={() => handleCopy('cname.vercel-dns.com.', 'Value')}
+                                    onClick={() => handleCopy(cnameTarget, 'Value')}
                                     className="h-6 w-6 shrink-0"
                                   >
                                     <ClipboardCopy className="h-4 w-4" />
@@ -411,12 +423,12 @@ export function TrustPortalDomain({
                           <div>
                             <div className="mb-1 font-medium">Value:</div>
                             <div className="flex items-center justify-between gap-2">
-                              <span className="min-w-0 break-words">cname.vercel-dns.com.</span>
+                              <span className="min-w-0 break-words">{cnameTarget}</span>
                               <Button
                                 variant="ghost"
                                 size="icon"
                                 type="button"
-                                onClick={() => handleCopy('cname.vercel-dns.com.', 'Value')}
+                                onClick={() => handleCopy(cnameTarget, 'Value')}
                                 className="h-6 w-6 shrink-0"
                               >
                                 <ClipboardCopy className="h-4 w-4" />