Fix SSL list badges, labeled AI prompt URLs, and product-category migrate.

Storefront SSL now follows apex expiry instead of requiring www, prompt links include domain and prompt name, and extra color variations merge instead of aborting migrate.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/domain-admin/domain-admin.service.ts

@@ -98,12 +98,14 @@ export class DomainAdminService {
 
     const now = Date.now();
     const items = rows.map((row) => {
-      const certStillValid =
-        !row.sslExpiresAt || row.sslExpiresAt.getTime() > now;
+      const expiryMs = row.sslExpiresAt?.getTime() ?? null;
+      const certStillValid = expiryMs == null || expiryMs > now;
+      // Prefer stored notAfter when present (daily probe is only a writer).
+      const sslEnabled =
+        expiryMs != null ? expiryMs > now : row.sslEnabled && certStillValid;
       return {
         ...row,
-        // List badge: issued/probed OK and cert not past notAfter.
-        sslEnabled: row.sslEnabled && certStillValid,
+        sslEnabled,
         sslExpiresAt: row.sslExpiresAt,
       };
     });
@@ -208,8 +210,9 @@ export class DomainAdminService {
         ? domain.host
         : `www.${domain.host}`;
       const wwwProbe = await probeTlsHostDetailed(wwwHost);
-      const ok = apexProbe.ok && wwwProbe.ok;
-      if (ok) {
+      const apexOk = apexProbe.ok;
+      const bothOk = apexOk && wwwProbe.ok;
+      if (apexOk) {
         const sslExpiresAt = earliestTlsExpiry(apexProbe, wwwProbe);
         await this.prisma.domain.update({
           where: { id: domain.id },
@@ -218,10 +221,8 @@ export class DomainAdminService {
             ...(sslExpiresAt ? { sslExpiresAt } : {}),
           },
         });
-        continue;
-      }
-
-      if (domain.sslEnabled) {
+        if (bothOk) continue;
+      } else if (domain.sslEnabled) {
         await this.prisma.domain.update({
           where: { id: domain.id },
           data: { sslEnabled: false, sslExpiresAt: null },
@@ -253,23 +254,23 @@ export class DomainAdminService {
           ? domain.host
           : `www.${domain.host}`;
         const wwwProbe = await probeTlsHostDetailed(wwwHost);
-        const wwwOk = apexProbe.ok && wwwProbe.ok;
-        const sslExpiresAt = wwwOk
+        const apexOk = apexProbe.ok;
+        const sslExpiresAt = apexOk
           ? earliestTlsExpiry(apexProbe, wwwProbe)
           : null;
         await this.prisma.domain.update({
           where: { id: domain.id },
           data: {
-            sslEnabled: wwwOk,
+            sslEnabled: apexOk,
             sslExpiresAt,
           },
         });
-        if (wwwOk) {
+        if (apexOk) {
           issued.push(domain.host);
         } else {
           failed.push({
             host: domain.host,
-            error: 'Certbot finished but TLS probe still failed (apex or www)',
+            error: 'Certbot finished but TLS probe still failed on apex',
           });
         }
       } catch (err) {
@@ -446,22 +447,20 @@ export class DomainAdminService {
       }
     }
 
-    const storefrontOk = apexOk && wwwOk;
-    // Re-probe apex/www once more when already-ok so we persist current cert expiry.
-    if (storefrontOk && (!apexProbe.expiresAt || !wwwProbe.expiresAt)) {
+    // List badge follows apex. www can still fail (no DNS) without marking Invalid.
+    if (apexOk && !apexProbe.expiresAt) {
       apexProbe = await probeTlsHostDetailed(apex);
-      wwwProbe = await probeTlsHostDetailed(wwwHost);
       apexOk = apexProbe.ok;
-      wwwOk = wwwProbe.ok;
     }
-    const sslExpiresAt =
-      apexOk && wwwOk ? earliestTlsExpiry(apexProbe, wwwProbe) : null;
+    const sslExpiresAt = apexOk
+      ? earliestTlsExpiry(apexProbe, wwwOk ? wwwProbe : apexProbe)
+      : null;
 
     const updated = await this.prisma.domain.update({
       where: { id: domainId },
       data: {
-        sslEnabled: storefrontOk && apexOk && wwwOk,
-        sslExpiresAt: storefrontOk && apexOk && wwwOk ? sslExpiresAt : null,
+        sslEnabled: apexOk,
+        sslExpiresAt: apexOk ? sslExpiresAt : null,
       },
     });