Skip dashboard SSL hosts without DNS and shorten sync errors.

Dashboard cert renewal no longer fails when unrelated tenants lack business/customer DNS records; Issue SSL errors summarize blocked hostnames instead of dumping certbot logs.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/common/dns-resolve.ts

@@ -0,0 +1,43 @@
+import { lookup } from 'node:dns/promises';
+
+/** True when the hostname has at least one A or AAAA record. */
+export async function hostDnsResolves(hostRaw: string): Promise<boolean> {
+  const host = hostRaw.trim().toLowerCase();
+  if (!host || host.includes(':') || host.endsWith('.local')) {
+    return false;
+  }
+
+  try {
+    await lookup(host);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Keep only hosts that resolve in public DNS (parallel, chunked). */
+export async function filterHostsWithDns(
+  hosts: Array<string | null | undefined>,
+  chunkSize = 20,
+): Promise<string[]> {
+  const unique = [
+    ...new Set(
+      hosts
+        .map((h) => h?.trim().toLowerCase())
+        .filter((h): h is string => !!h),
+    ),
+  ];
+
+  const resolved: string[] = [];
+  for (let i = 0; i < unique.length; i += chunkSize) {
+    const chunk = unique.slice(i, i + chunkSize);
+    const probed = await Promise.all(
+      chunk.map(async (host) => ({ host, ok: await hostDnsResolves(host) })),
+    );
+    for (const { host, ok } of probed) {
+      if (ok) resolved.push(host);
+    }
+  }
+
+  return resolved.sort();
+}