feat(worker): add autosync scheduler, endpoint, locking and UI controls

Merge pull request 'feat(logging): add best-effort requested/succeeded/failed action logs' (#22 ) from feature/cl5-action-logging into master
Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/22
2026-03-05 17:33:14 +00:00 · 2026-03-05 17:19:05 +00:00 · 2026-03-05 17:13:18 +00:00 · 2026-03-05 17:07:48 +00:00 · 2026-03-05 17:06:29 +00:00 · 2026-03-05 17:03:55 +00:00
20 changed files with 2299 additions and 103 deletions
--- a/.env.example
+++ b/.env.example
@@ -4,6 +4,7 @@ SUPABASE_SERVICE_ROLE_KEY=

 NEXT_PUBLIC_APP_URL=http://localhost:3000
 JOB_SECRET=
+CRON_SECRET=

 ENCRYPTION_KEY=
 PLESK_CRED_ENC_KEY=
--- a/README.md
+++ b/README.md
@@ -63,7 +63,9 @@ values ('<agency_uuid>', '<auth_user_uuid>', 'owner');

 - `POST /api/plesk/instances` — create + validate Plesk connection
 - `POST /api/plesk/instances/:id/sync` — pull/sync subscriptions + domains from one Plesk instance
+- `POST /api/plesk/instances/:id/autosync` — update auto-sync enabled/frequency for one Plesk instance
 - `POST /api/jobs/plesk-sync-all` — background sync job for all connected instances (requires `X-JOB-SECRET`)
+- `POST /api/cron/autosync` — scheduled auto-sync tick (requires `X-CRON-SECRET`)
 - `POST /api/plesk/subscriptions/:id/action` — suspend or unsuspend
 - `POST /api/stripe/checkout` — create Stripe Checkout session
 - `POST /api/stripe/portal` — create Stripe Customer Portal session
@@ -74,6 +76,7 @@ values ('<agency_uuid>', '<auth_user_uuid>', 'owner');
 - Set a strong `ENCRYPTION_KEY`; it encrypts stored Plesk auth secrets.
 - Set a strong `PLESK_CRED_ENC_KEY` (32-byte base64 or 64-char hex) for Plesk credential encryption.
 - Set `JOB_SECRET` for internal cron-triggered job auth.
+- Set `CRON_SECRET` for `/api/cron/autosync` auth.
 - `/api/stripe/webhook` is excluded from auth middleware for Stripe signature verification.
 - Current implementation is intentionally MVP-focused; add stronger validation, retries, idempotency keys, and richer error observability for production.

@@ -97,3 +100,37 @@ Notes:
 - Job uses DB lock (`job_locks`) to avoid overlapping runs.
 - Job processes at most 10 connected instances per run.
 - Instances synced in the last 3 minutes are skipped.
+
+## 6) Auto Sync Worker (CL6)
+
+New scheduler fields live on `plesk_instances`:
+
+- `auto_sync_enabled`
+- `auto_sync_frequency_minutes`
+- `last_auto_sync_at`
+- `next_auto_sync_at`
+- `auto_sync_lock_until`
+- `auto_sync_lock_token`
+
+Endpoint for periodic worker ticks:
+
+```bash
+curl -sS -X POST http://localhost:3000/api/cron/autosync \
+  -H "X-CRON-SECRET: <CRON_SECRET>"
+```
+
+Recommended system cron (every 5 minutes):
+
+```cron
+*/5 * * * * curl -sS -X POST https://<your-host>/api/cron/autosync -H "X-CRON-SECRET: ${CRON_SECRET}"
+```
+
+Or schedule the same call from Jenkins.
+
+Worker safety behavior:
+
+- processes at most 5 instances per tick
+- concurrency limited to 2 at a time
+- per-instance lock lease 15 minutes
+- per-instance timeout guard 14 minutes
+- per-instance failures are isolated and logged to `actions_log`
--- a/app/api/cron/autosync/route.ts
+++ b/app/api/cron/autosync/route.ts
@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+
+import { env } from "@/lib/env";
+import { runAutoSyncTick } from "@/lib/plesk/auto-sync";
+import { createSupabaseAdminClient } from "@/lib/supabase/admin";
+
+export async function POST(req: Request) {
+  const startedAt = Date.now();
+
+  try {
+    const secret = req.headers.get("x-cron-secret");
+    if (!env.cronSecret || !secret || secret !== env.cronSecret) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const supabase = createSupabaseAdminClient() as any;
+    const summary = await runAutoSyncTick(supabase);
+
+    return NextResponse.json({
+      ...summary,
+      duration_ms: Date.now() - startedAt,
+    });
+  } catch (error) {
+    console.error("[autosync cron] failed", error);
+
+    return NextResponse.json(
+      {
+        error: "Auto-sync job failed",
+        instances_considered: 0,
+        locks_acquired: 0,
+        succeeded: 0,
+        failed: 0,
+        duration_ms: Date.now() - startedAt,
+      },
+      { status: 500 },
+    );
+  }
+}
--- a/app/api/plesk/domains/[id]/action/route.ts
+++ b/app/api/plesk/domains/[id]/action/route.ts
@@ -0,0 +1,304 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import {
+  parseSubscriptionStatusDetailsFromInfo,
+  pleskCliCall,
+} from "@/lib/plesk/client";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+const actionSchema = z.object({
+  action: z.enum(["suspend", "unsuspend"]),
+  subscription_id: z.string().uuid().optional(),
+});
+
+const LOG_EXCERPT_LIMIT = 500;
+
+const DOMAIN_ACTION_EVENTS = {
+  suspend: {
+    requested: "domain_suspend_requested",
+    succeeded: "domain_suspend_succeeded",
+    failed: "domain_suspend_failed",
+  },
+  unsuspend: {
+    requested: "domain_unsuspend_requested",
+    succeeded: "domain_unsuspend_succeeded",
+    failed: "domain_unsuspend_failed",
+  },
+} as const;
+
+function excerpt(value: string | null | undefined) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return trimmed.length > LOG_EXCERPT_LIMIT
+    ? `${trimmed.slice(0, LOG_EXCERPT_LIMIT)}…`
+    : trimmed;
+}
+
+async function insertActionLogBestEffort(
+  supabase: any,
+  payload: Record<string, unknown>,
+) {
+  try {
+    const { error } = await supabase.from("actions_log").insert(payload);
+    if (error) {
+      console.error("[actions_log] insert failed", error.message);
+    }
+  } catch (error) {
+    console.error("[actions_log] insert threw", error);
+  }
+}
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  const supabase = createSupabaseRouteClient() as any;
+  let context: Awaited<ReturnType<typeof getRouteAgencyContextOrThrow>> | null =
+    null;
+  let domain: { id: string; subscription_id: string | null } | null = null;
+  let subscription: {
+    id: string;
+    plesk_subscription_id: string;
+    plesk_instance_id: string;
+  } | null = null;
+  let requestedAction: "suspend" | "unsuspend" | null = null;
+  const startedAt = Date.now();
+
+  try {
+    assertSameOrigin(req);
+
+    context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-domain-action:${context.userId}`, 10, 60_000);
+
+    const payload = actionSchema.parse(await req.json());
+    const { action } = payload;
+    requestedAction = action;
+
+    const { data: domainRow, error: domainError } = await supabase
+      .from("plesk_domains")
+      .select("id, agency_id, plesk_instance_id, subscription_id")
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (domainError || !domainRow) {
+      throw new Error("Domain not found");
+    }
+
+    const resolvedSubscriptionId =
+      payload.subscription_id ??
+      (domainRow.subscription_id ? String(domainRow.subscription_id) : null);
+
+    domain = {
+      id: String(domainRow.id),
+      subscription_id: resolvedSubscriptionId,
+    };
+
+    if (!resolvedSubscriptionId) {
+      throw new Error("Domain is not linked to a subscription");
+    }
+
+    const { data: subscriptionRow, error: subscriptionError } = await supabase
+      .from("plesk_subscriptions")
+      .select("id, plesk_subscription_id, plesk_instance_id")
+      .eq("id", resolvedSubscriptionId)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (subscriptionError || !subscriptionRow) {
+      throw new Error("Subscription not found");
+    }
+
+    subscription = {
+      id: String(subscriptionRow.id),
+      plesk_subscription_id: String(subscriptionRow.plesk_subscription_id),
+      plesk_instance_id: String(subscriptionRow.plesk_instance_id),
+    };
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select("id, base_url, auth_type, encrypted_secret")
+      .eq("id", subscriptionRow.plesk_instance_id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) {
+      throw new Error("Plesk instance not found");
+    }
+
+    const connection = {
+      baseUrl: instance.base_url,
+      authType: instance.auth_type,
+      encryptedSecret: instance.encrypted_secret,
+    } as const;
+
+    const domainIdentifier = subscription.plesk_subscription_id;
+    const siteArgs =
+      action === "suspend"
+        ? ["--suspend", domainIdentifier]
+        : ["--on", domainIdentifier];
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_domain",
+      target_id: domain.id,
+      action: DOMAIN_ACTION_EVENTS[action].requested,
+      status: "pending",
+      metadata: {
+        domain_id: domain.id,
+        subscription_id: subscription.id,
+        plesk_instance_id: subscription.plesk_instance_id,
+        plesk_subscription_id: subscription.plesk_subscription_id,
+        cli_command: "site",
+        cli_args: siteArgs,
+      },
+    });
+
+    const siteResult = await pleskCliCall(connection, "site", siteArgs);
+
+    const fallbackStatus = action === "suspend" ? "suspended" : "active";
+    let refreshedStatus = fallbackStatus;
+    let refreshedStatusRaw: string | null = null;
+    let refreshErrorMessage: string | null = null;
+
+    try {
+      const infoResult = await pleskCliCall(connection, "subscription", [
+        "--info",
+        domainIdentifier,
+      ]);
+
+      const parsed = parseSubscriptionStatusDetailsFromInfo(
+        infoResult.stdout ?? "",
+      );
+      refreshedStatus = parsed.status;
+      refreshedStatusRaw = parsed.statusRaw;
+
+      if (
+        action === "unsuspend" &&
+        refreshedStatus === "suspended" &&
+        (refreshedStatusRaw ?? "").toLowerCase().includes("subscriber")
+      ) {
+        throw new Error(
+          "Domain remains suspended because its subscriber/customer account is suspended.",
+        );
+      }
+    } catch (refreshError) {
+      refreshErrorMessage =
+        refreshError instanceof Error
+          ? refreshError.message.slice(0, 1000)
+          : "subscription_status_refresh_failed";
+
+      await insertActionLogBestEffort(supabase, {
+        agency_id: context.agencyId,
+        actor_user_id: context.userId,
+        target_type: "plesk_subscription",
+        target_id: subscription.id,
+        action: "subscription_status_refresh_failed",
+        status: "failed",
+        error_message: refreshErrorMessage,
+        metadata: {
+          subscription_id: subscription.id,
+          plesk_subscription_id: subscription.plesk_subscription_id,
+          plesk_instance_id: subscription.plesk_instance_id,
+          source: "domain_action",
+          domain_id: domain.id,
+        },
+      });
+    }
+
+    await supabase
+      .from("plesk_subscriptions")
+      .update({
+        status: refreshedStatus,
+        status_raw: refreshedStatusRaw,
+        last_status_sync_at: new Date().toISOString(),
+      })
+      .eq("id", subscription.id)
+      .eq("agency_id", context.agencyId);
+
+    await supabase
+      .from("plesk_domains")
+      .update({ status: refreshedStatus })
+      .eq("agency_id", context.agencyId)
+      .eq("subscription_id", subscription.id);
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_domain",
+      target_id: domain.id,
+      action: DOMAIN_ACTION_EVENTS[action].succeeded,
+      status: "success",
+      metadata: {
+        duration_ms: Date.now() - startedAt,
+        domain_id: domain.id,
+        subscription_id: subscription.id,
+        plesk_instance_id: subscription.plesk_instance_id,
+        plesk_subscription_id: subscription.plesk_subscription_id,
+        cli_command: "site",
+        cli_args: siteArgs,
+        cli_exit_code: siteResult.code,
+        cli_stdout_excerpt: excerpt(siteResult.stdout),
+        cli_stderr_excerpt: excerpt(siteResult.stderr),
+        refreshed_status: refreshedStatus,
+        refresh_error: refreshErrorMessage,
+      },
+    });
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    if (context && domain) {
+      const message =
+        error instanceof Error ? error.message : "Domain action failed";
+      if (requestedAction) {
+        await insertActionLogBestEffort(supabase, {
+          agency_id: context.agencyId,
+          actor_user_id: context.userId,
+          target_type: "plesk_domain",
+          target_id: domain.id,
+          action: DOMAIN_ACTION_EVENTS[requestedAction].failed,
+          status: "failed",
+          error_message: message,
+          metadata: {
+            duration_ms: Date.now() - startedAt,
+            domain_id: domain.id,
+            subscription_id: subscription?.id ?? domain.subscription_id,
+            plesk_instance_id: subscription?.plesk_instance_id ?? null,
+            plesk_subscription_id: subscription?.plesk_subscription_id ?? null,
+          },
+        });
+      } else {
+        await insertActionLogBestEffort(supabase, {
+          agency_id: context.agencyId,
+          actor_user_id: context.userId,
+          target_type: "plesk_domain",
+          target_id: domain.id,
+          action: "domain_action_failed",
+          status: "failed",
+          error_message: message,
+          metadata: {
+            duration_ms: Date.now() - startedAt,
+            domain_id: domain.id,
+            subscription_id: subscription?.id ?? domain.subscription_id,
+            plesk_instance_id: subscription?.plesk_instance_id ?? null,
+            plesk_subscription_id: subscription?.plesk_subscription_id ?? null,
+          },
+        });
+      }
+    }
+
+    return NextResponse.json(
+      {
+        error: error instanceof Error ? error.message : "Domain action failed",
+      },
+      { status: 400 },
+    );
+  }
+}
--- a/app/api/plesk/instances/[id]/autosync/route.ts
+++ b/app/api/plesk/instances/[id]/autosync/route.ts
@@ -0,0 +1,87 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+const autosyncSchema = z.object({
+  auto_sync_enabled: z.boolean(),
+  auto_sync_frequency_minutes: z.number().int().min(5).max(10080).optional(),
+});
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-autosync-settings:${context.userId}`, 20, 60_000);
+
+    const input = autosyncSchema.parse(await req.json());
+    const frequency = input.auto_sync_frequency_minutes ?? 60;
+    const nowIso = new Date().toISOString();
+    const nextAtIso = new Date(
+      Date.now() + frequency * 60 * 1000,
+    ).toISOString();
+
+    const supabase = createSupabaseRouteClient() as any;
+
+    const updates = {
+      auto_sync_enabled: input.auto_sync_enabled,
+      auto_sync_frequency_minutes: frequency,
+      next_auto_sync_at: input.auto_sync_enabled ? nextAtIso : null,
+      auto_sync_lock_until: null,
+      auto_sync_lock_token: null,
+      last_auto_sync_at: input.auto_sync_enabled ? undefined : null,
+    } as Record<string, unknown>;
+
+    const { data: instance, error } = await supabase
+      .from("plesk_instances")
+      .update(updates)
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .select(
+        "id, auto_sync_enabled, auto_sync_frequency_minutes, last_auto_sync_at, next_auto_sync_at, auto_sync_lock_until",
+      )
+      .single();
+
+    if (error || !instance) {
+      throw new Error(error?.message ?? "Plesk instance not found");
+    }
+
+    try {
+      await supabase.from("actions_log").insert({
+        agency_id: context.agencyId,
+        actor_user_id: context.userId,
+        target_type: "plesk_instance",
+        target_id: params.id,
+        action: "autosync_settings_updated",
+        status: "success",
+        metadata: {
+          auto_sync_enabled: input.auto_sync_enabled,
+          auto_sync_frequency_minutes: frequency,
+          updated_at: nowIso,
+        },
+      });
+    } catch {
+      // best effort logging
+    }
+
+    return NextResponse.json({ instance });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Failed to update auto-sync settings",
+      },
+      { status: 400 },
+    );
+  }
+}
--- a/app/api/plesk/instances/[id]/backfill-domain-links/route.ts
+++ b/app/api/plesk/instances/[id]/backfill-domain-links/route.ts
@@ -0,0 +1,51 @@
+import { NextResponse } from "next/server";
+
+import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
+import { assertRateLimit } from "@/lib/api/rate-limit";
+import { assertSameOrigin } from "@/lib/api/security";
+import { backfillDomainSubscriptionLinks } from "@/lib/plesk/sync";
+import { createSupabaseRouteClient } from "@/lib/supabase/route";
+
+export async function POST(
+  req: Request,
+  { params }: { params: { id: string } },
+) {
+  try {
+    assertSameOrigin(req);
+
+    const context = await getRouteAgencyContextOrThrow();
+    assertAgencyAdmin(context);
+    assertRateLimit(`plesk-backfill-links:${context.userId}`, 5, 60_000);
+
+    const supabase = createSupabaseRouteClient() as any;
+
+    const { data: instance, error: instanceError } = await supabase
+      .from("plesk_instances")
+      .select("id")
+      .eq("id", params.id)
+      .eq("agency_id", context.agencyId)
+      .single();
+
+    if (instanceError || !instance) {
+      throw new Error("Plesk instance not found");
+    }
+
+    const result = await backfillDomainSubscriptionLinks(supabase, {
+      agencyId: context.agencyId,
+      instanceId: params.id,
+      actorUserId: context.userId,
+    });
+
+    return NextResponse.json({ ok: true, ...result });
+  } catch (error) {
+    return NextResponse.json(
+      {
+        error:
+          error instanceof Error
+            ? error.message
+            : "Backfill domain links failed",
+      },
+      { status: 400 },
+    );
+  }
+}
--- a/app/api/plesk/subscriptions/[id]/action/route.ts
+++ b/app/api/plesk/subscriptions/[id]/action/route.ts
@@ -5,6 +5,8 @@ import { assertAgencyAdmin, getRouteAgencyContextOrThrow } from "@/lib/agency";
 import { assertRateLimit } from "@/lib/api/rate-limit";
 import { assertSameOrigin } from "@/lib/api/security";
 import {
+  parseSubscriptionStatusDetailsFromInfo,
+  pleskCliCall,
  suspendPleskSubscription,
  unsuspendPleskSubscription,
 } from "@/lib/plesk/client";
@@ -14,6 +16,44 @@ const actionSchema = z.object({
  action: z.enum(["suspend", "unsuspend"]),
 });

+const LOG_EXCERPT_LIMIT = 500;
+
+const SUBSCRIPTION_ACTION_EVENTS = {
+  suspend: {
+    requested: "subscription_suspend_requested",
+    succeeded: "subscription_suspend_succeeded",
+    failed: "subscription_suspend_failed",
+  },
+  unsuspend: {
+    requested: "subscription_unsuspend_requested",
+    succeeded: "subscription_unsuspend_succeeded",
+    failed: "subscription_unsuspend_failed",
+  },
+} as const;
+
+function excerpt(value: string | null | undefined) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return trimmed.length > LOG_EXCERPT_LIMIT
+    ? `${trimmed.slice(0, LOG_EXCERPT_LIMIT)}…`
+    : trimmed;
+}
+
+async function insertActionLogBestEffort(
+  supabase: any,
+  payload: Record<string, unknown>,
+) {
+  try {
+    const { error } = await supabase.from("actions_log").insert(payload);
+    if (error) {
+      console.error("[actions_log] insert failed", error.message);
+    }
+  } catch (error) {
+    console.error("[actions_log] insert threw", error);
+  }
+}
+
 export async function POST(
  req: Request,
  { params }: { params: { id: string } },
@@ -27,6 +67,7 @@ export async function POST(
    plesk_subscription_id: string;
    plesk_instance_id: string;
  } | null = null;
+  const startedAt = Date.now();

  try {
    assertSameOrigin(req);
@@ -68,58 +109,153 @@ export async function POST(
      encryptedSecret: instance.encrypted_secret,
    } as const;

-    if (payload.action === "suspend") {
-      await suspendPleskSubscription(
-        connection,
-        subscription.plesk_subscription_id,
-      );
-    } else {
-      await unsuspendPleskSubscription(
-        connection,
-        subscription.plesk_subscription_id,
-      );
-    }
+    const cliArgs =
+      payload.action === "suspend"
+        ? ["--webspace-off", subscription.plesk_subscription_id]
+        : ["--unsuspend", subscription.plesk_subscription_id];

-    const newStatus = payload.action === "suspend" ? "suspended" : "active";
-    const { error: updateError } = await supabase
-      .from("plesk_subscriptions")
-      .update({ status: newStatus })
-      .eq("id", subscription.id);
-
-    await supabase.from("actions_log").insert({
+    await insertActionLogBestEffort(supabase, {
      agency_id: context.agencyId,
      actor_user_id: context.userId,
      target_type: "plesk_subscription",
      target_id: subscription.id,
-      action: payload.action,
+      action: SUBSCRIPTION_ACTION_EVENTS[payload.action].requested,
+      status: "pending",
+      metadata: {
+        subscription_id: subscription.id,
+        plesk_instance_id: subscription.plesk_instance_id,
+        plesk_subscription_id: subscription.plesk_subscription_id,
+        cli_command: "subscription",
+        cli_args: cliArgs,
+      },
+    });
+
+    const actionCliResult =
+      payload.action === "suspend"
+        ? await suspendPleskSubscription(
+            connection,
+            subscription.plesk_subscription_id,
+          )
+        : await unsuspendPleskSubscription(
+            connection,
+            subscription.plesk_subscription_id,
+          );
+
+    const fallbackStatus =
+      payload.action === "suspend" ? "suspended" : "active";
+    let refreshedStatus = fallbackStatus;
+    let refreshedStatusRaw: string | null = null;
+    let refreshErrorMessage: string | null = null;
+
+    try {
+      const infoResult = await pleskCliCall(connection, "subscription", [
+        "--info",
+        subscription.plesk_subscription_id,
+      ]);
+      const parsed = parseSubscriptionStatusDetailsFromInfo(
+        infoResult.stdout ?? "",
+      );
+      refreshedStatus = parsed.status;
+      refreshedStatusRaw = parsed.statusRaw;
+    } catch (refreshError) {
+      refreshErrorMessage =
+        refreshError instanceof Error
+          ? refreshError.message.slice(0, 1000)
+          : "subscription_status_refresh_failed";
+
+      await insertActionLogBestEffort(supabase, {
+        agency_id: context.agencyId,
+        actor_user_id: context.userId,
+        target_type: "plesk_subscription",
+        target_id: subscription.id,
+        action: "subscription_status_refresh_failed",
+        status: "failed",
+        error_message: refreshErrorMessage,
+        metadata: {
+          subscription_id: subscription.id,
+          plesk_subscription_id: subscription.plesk_subscription_id,
+          plesk_instance_id: subscription.plesk_instance_id,
+        },
+      });
+    }
+
+    const { error: updateError } = await supabase
+      .from("plesk_subscriptions")
+      .update({
+        status: refreshedStatus,
+        status_raw: refreshedStatusRaw,
+        last_status_sync_at: new Date().toISOString(),
+      })
+      .eq("id", subscription.id);
+
+    await supabase
+      .from("plesk_domains")
+      .update({ status: refreshedStatus })
+      .eq("agency_id", context.agencyId)
+      .eq("subscription_id", subscription.id);
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: context.agencyId,
+      actor_user_id: context.userId,
+      target_type: "plesk_subscription",
+      target_id: subscription.id,
+      action: SUBSCRIPTION_ACTION_EVENTS[payload.action].succeeded,
      status: "success",
      metadata: {
+        duration_ms: Date.now() - startedAt,
+        cli_command: "subscription",
+        cli_args: cliArgs,
        plesk_subscription_id: subscription.plesk_subscription_id,
+        refreshed_status: refreshedStatus,
+        refresh_error: refreshErrorMessage,
+        cli_exit_code: actionCliResult.code,
+        cli_stdout_excerpt: excerpt(actionCliResult.stdout),
+        cli_stderr_excerpt: excerpt(actionCliResult.stderr),
        db_status_update_error: updateError?.message ?? null,
      },
    });

    return NextResponse.json({
      ok: true,
-      status: newStatus,
+      status: refreshedStatus,
      dbStatusUpdated: !updateError,
+      refreshError: refreshErrorMessage,
    });
  } catch (error) {
    if (supabase && context && subscription) {
      const message =
        error instanceof Error ? error.message : "Subscription action failed";
-      await supabase.from("actions_log").insert({
+      if (requestedAction) {
+        await insertActionLogBestEffort(supabase, {
          agency_id: context.agencyId,
          actor_user_id: context.userId,
          target_type: "plesk_subscription",
          target_id: subscription.id,
-        action: requestedAction ?? "subscription_action",
+          action: SUBSCRIPTION_ACTION_EVENTS[requestedAction].failed,
          status: "failed",
          error_message: message,
          metadata: {
+            duration_ms: Date.now() - startedAt,
            plesk_subscription_id: subscription.plesk_subscription_id,
+            plesk_instance_id: subscription.plesk_instance_id,
          },
        });
+      } else {
+        await insertActionLogBestEffort(supabase, {
+          agency_id: context.agencyId,
+          actor_user_id: context.userId,
+          target_type: "plesk_subscription",
+          target_id: subscription.id,
+          action: "subscription_action_failed",
+          status: "failed",
+          error_message: message,
+          metadata: {
+            duration_ms: Date.now() - startedAt,
+            plesk_subscription_id: subscription.plesk_subscription_id,
+            plesk_instance_id: subscription.plesk_instance_id,
+          },
+        });
+      }
    }

    return NextResponse.json(
--- a/app/dashboard/page.tsx
+++ b/app/dashboard/page.tsx
@@ -3,7 +3,6 @@ import { DashboardControls } from "@/components/dashboard/dashboard-controls";
 import { getServerAgencyContextOrRedirect } from "@/lib/agency";
 import type { Database } from "@/lib/types";
 import { createSupabaseServerClient } from "@/lib/supabase/server";
-import type { PostgrestError } from "@supabase/supabase-js";

 type AgencySummary = Pick<
  Database["public"]["Tables"]["agencies"]["Row"],
@@ -18,6 +17,26 @@ type ActionLogSummary = Pick<
  "target_id" | "status" | "action" | "created_at" | "error_message"
 >;

+function normalizeDomainLike(value: string) {
+  return value.trim().toLowerCase().replace(/\.$/, "");
+}
+
+function findBestSuffixStatusMatch(
+  normalizedDomain: string,
+  candidates: Array<{ normalizedName: string; status: string | null }>,
+) {
+  let best: { normalizedName: string; status: string | null } | null = null;
+
+  for (const candidate of candidates) {
+    if (!normalizedDomain.endsWith(`.${candidate.normalizedName}`)) continue;
+    if (!best || candidate.normalizedName.length > best.normalizedName.length) {
+      best = candidate;
+    }
+  }
+
+  return best?.status ?? null;
+}
+
 export default async function DashboardPage() {
  const context = await getServerAgencyContextOrRedirect();
  const supabase = createSupabaseServerClient() as any;
@@ -38,7 +57,7 @@ export default async function DashboardPage() {
    supabase
      .from("plesk_instances")
      .select(
-        "id, name, base_url, auth_type, status, error_message, last_connected_at, last_sync_at, last_sync_status, last_sync_error, last_sync_subscriptions, last_sync_domains",
+        "id, name, base_url, auth_type, status, error_message, last_connected_at, last_sync_at, last_sync_status, last_sync_error, last_sync_subscriptions, last_sync_domains, auto_sync_enabled, auto_sync_frequency_minutes, last_auto_sync_at, next_auto_sync_at, auto_sync_lock_until",
      )
      .eq("agency_id", context.agencyId)
      .order("created_at", { ascending: false }),
@@ -51,7 +70,7 @@ export default async function DashboardPage() {
    supabase
      .from("plesk_domains")
      .select(
-        "id, plesk_instance_id, domain_name, status, hosting_type, source_created_at, aliases_count, updated_at",
+        "id, plesk_instance_id, subscription_id, external_subscription_id, status, domain_name, hosting_type, source_created_at, aliases_count, updated_at",
      )
      .eq("agency_id", context.agencyId)
      .order("updated_at", { ascending: false })
@@ -85,6 +104,11 @@ export default async function DashboardPage() {
        last_sync_error: string | null;
        last_sync_subscriptions: number;
        last_sync_domains: number;
+        auto_sync_enabled: boolean;
+        auto_sync_frequency_minutes: number;
+        last_auto_sync_at: string | null;
+        next_auto_sync_at: string | null;
+        auto_sync_lock_until: string | null;
      }> | null;
      error: { message: string } | null;
    },
@@ -101,6 +125,8 @@ export default async function DashboardPage() {
      data: Array<{
        id: string;
        plesk_instance_id: string;
+        subscription_id: string | null;
+        external_subscription_id: string | null;
        domain_name: string;
        status: string | null;
        hosting_type: string | null;
@@ -113,6 +139,82 @@ export default async function DashboardPage() {
    { data: ActionLogSummary[] | null },
  ];

+  const domainInstanceIds = Array.from(
+    new Set((domains ?? []).map((domain) => domain.plesk_instance_id)),
+  );
+
+  const { data: domainSubscriptions } =
+    domainInstanceIds.length > 0
+      ? await supabase
+          .from("plesk_subscriptions")
+          .select("id, plesk_instance_id, plesk_subscription_id, name, status")
+          .eq("agency_id", context.agencyId)
+          .in("plesk_instance_id", domainInstanceIds)
+      : { data: [] };
+
+  const subscriptionStatusById = new Map<string, string | null>(
+    (domainSubscriptions ?? []).map((subscription: any) => [
+      String(subscription.id),
+      subscription?.status ? String(subscription.status) : null,
+    ]),
+  );
+
+  const subscriptionDisplayNameById = new Map<string, string>(
+    (domainSubscriptions ?? [])
+      .filter((subscription: any) => subscription?.id)
+      .map((subscription: any) => [
+        String(subscription.id),
+        String(
+          subscription?.name ||
+            subscription?.plesk_subscription_id ||
+            subscription?.id,
+        ),
+      ]),
+  );
+
+  const subscriptionStatusByExternalId = new Map<string, string | null>(
+    (domainSubscriptions ?? [])
+      .filter((subscription: any) =>
+        Boolean(
+          subscription?.plesk_instance_id &&
+          subscription?.plesk_subscription_id,
+        ),
+      )
+      .map((subscription: any) => [
+        `${String(subscription.plesk_instance_id)}:${String(subscription.plesk_subscription_id)}`,
+        subscription?.status ? String(subscription.status) : null,
+      ]),
+  );
+
+  const subscriptionStatusByInstanceAndName = new Map<string, string | null>(
+    (domainSubscriptions ?? [])
+      .filter((subscription: any) =>
+        Boolean(subscription?.plesk_instance_id && subscription?.name),
+      )
+      .map((subscription: any) => [
+        `${String(subscription.plesk_instance_id)}:${normalizeDomainLike(String(subscription.name))}`,
+        subscription?.status ? String(subscription.status) : null,
+      ]),
+  );
+
+  const subscriptionStatusNameCandidatesByInstance = new Map<
+    string,
+    Array<{ normalizedName: string; status: string | null }>
+  >();
+
+  for (const subscription of domainSubscriptions ?? []) {
+    if (!subscription?.plesk_instance_id || !subscription?.name) continue;
+
+    const instanceId = String(subscription.plesk_instance_id);
+    const existing =
+      subscriptionStatusNameCandidatesByInstance.get(instanceId) ?? [];
+    existing.push({
+      normalizedName: normalizeDomainLike(String(subscription.name)),
+      status: subscription?.status ? String(subscription.status) : null,
+    });
+    subscriptionStatusNameCandidatesByInstance.set(instanceId, existing);
+  }
+
  const autoSyncByInstance = new Map<
    string,
    { status: string; created_at: string; error_message: string | null }
@@ -167,7 +269,39 @@ export default async function DashboardPage() {
      <DashboardControls
        instances={instances ?? []}
        subscriptions={subscriptions ?? []}
-        domains={domains ?? []}
+        domains={(domains ?? []).map((domain) => {
+          const joinedStatusByLocalId = domain.subscription_id
+            ? subscriptionStatusById.get(domain.subscription_id)
+            : null;
+          const joinedStatusByExternalId = domain.external_subscription_id
+            ? subscriptionStatusByExternalId.get(
+                `${domain.plesk_instance_id}:${domain.external_subscription_id}`,
+              )
+            : null;
+          const joinedStatusByName = subscriptionStatusByInstanceAndName.get(
+            `${domain.plesk_instance_id}:${normalizeDomainLike(domain.domain_name)}`,
+          );
+          const joinedStatusBySuffix = findBestSuffixStatusMatch(
+            normalizeDomainLike(domain.domain_name),
+            subscriptionStatusNameCandidatesByInstance.get(
+              domain.plesk_instance_id,
+            ) ?? [],
+          );
+          const joinedStatus =
+            joinedStatusByLocalId ??
+            joinedStatusByExternalId ??
+            joinedStatusByName ??
+            joinedStatusBySuffix;
+
+          return {
+            ...domain,
+            status: joinedStatus ?? "unknown",
+            subscription_name: domain.subscription_id
+              ? (subscriptionDisplayNameById.get(domain.subscription_id) ??
+                null)
+              : null,
+          };
+        })}
        autoSyncByInstance={Object.fromEntries(autoSyncByInstance.entries())}
      />
    </main>
--- a/components/dashboard/dashboard-controls.tsx
+++ b/components/dashboard/dashboard-controls.tsx
@@ -18,6 +18,11 @@ type Instance = {
  last_sync_error: string | null;
  last_sync_subscriptions: number;
  last_sync_domains: number;
+  auto_sync_enabled: boolean;
+  auto_sync_frequency_minutes: number;
+  last_auto_sync_at: string | null;
+  next_auto_sync_at: string | null;
+  auto_sync_lock_until: string | null;
 };

 type Subscription = {
@@ -31,6 +36,8 @@ type Subscription = {
 type Domain = {
  id: string;
  plesk_instance_id: string;
+  subscription_id: string | null;
+  subscription_name?: string | null;
  domain_name: string;
  status: string | null;
  hosting_type: string | null;
@@ -49,12 +56,72 @@ type Props = {
  >;
 };

+function getDomainStatusBadge(status: string | null) {
+  const normalized = (status ?? "unknown").toLowerCase();
+
+  if (normalized.includes("suspend") || normalized.includes("disabled")) {
+    return "bg-rose-100 text-rose-700";
+  }
+
+  if (normalized.includes("expired")) {
+    return "bg-amber-100 text-amber-700";
+  }
+
+  if (normalized.includes("active") || normalized.includes("enabled")) {
+    return "bg-emerald-100 text-emerald-700";
+  }
+
+  if (normalized.includes("ok")) {
+    return "bg-emerald-100 text-emerald-700";
+  }
+
+  return "bg-slate-100 text-slate-600";
+}
+
+function formatDomainStatusLabel(status: string | null) {
+  const normalized = (status ?? "unknown").toLowerCase();
+
+  if (normalized.includes("suspend")) return "Suspended";
+  if (normalized.includes("disabled")) return "Disabled";
+  if (normalized.includes("expired")) return "Expired";
+  if (
+    normalized.includes("active") ||
+    normalized.includes("ok") ||
+    normalized.includes("enabled")
+  ) {
+    return "Active";
+  }
+
+  return "Unknown";
+}
+
+function isDomainSuspended(status: string | null) {
+  const normalized = (status ?? "unknown").toLowerCase();
+  return normalized.includes("suspend") || normalized.includes("disabled");
+}
+
+function isDomainActive(status: string | null) {
+  const normalized = (status ?? "unknown").toLowerCase();
+  return (
+    normalized.includes("active") ||
+    normalized.includes("ok") ||
+    normalized.includes("enabled")
+  );
+}
+
+function getDomainHref(domainName: string) {
+  const normalized = domainName.trim();
+  if (/^https?:\/\//i.test(normalized)) return normalized;
+  return `https://${normalized}`;
+}
+
 export function DashboardControls({
  instances,
  subscriptions,
  domains,
  autoSyncByInstance,
 }: Props) {
+  const autoSyncFrequencyOptions = [15, 30, 60, 180, 360, 1440];
  const [instanceName, setInstanceName] = useState("");
  const [baseUrl, setBaseUrl] = useState("");
  const [authType, setAuthType] = useState<"api_key" | "basic">("api_key");
@@ -178,6 +245,25 @@ export function DashboardControls({
    }
  }

+  async function onUpdateAutoSync(
+    instanceId: string,
+    input: { auto_sync_enabled: boolean; auto_sync_frequency_minutes: number },
+  ) {
+    setLoading(true);
+    setMessage(null);
+    try {
+      await runRequest(`/api/plesk/instances/${instanceId}/autosync`, input);
+      setMessage("Auto-sync settings updated.");
+      window.location.reload();
+    } catch (error) {
+      setMessage(
+        error instanceof Error ? error.message : "Auto-sync update failed",
+      );
+    } finally {
+      setLoading(false);
+    }
+  }
+
  async function onSubscriptionAction() {
    if (!actionSubId) return;
    setLoading(true);
@@ -195,6 +281,35 @@ export function DashboardControls({
    }
  }

+  async function onDomainAction(
+    domain: Domain,
+    action: "suspend" | "unsuspend",
+  ) {
+    if (!domain.subscription_id) {
+      setMessage(
+        "Domain is not linked to a subscription yet. Run Sync Now (or backfill links) and try again.",
+      );
+      return;
+    }
+
+    setLoading(true);
+    setMessage(null);
+    try {
+      await runRequest(`/api/plesk/domains/${domain.id}/action`, {
+        action,
+        subscription_id: domain.subscription_id,
+      });
+      setMessage("Domain action completed.");
+      window.location.reload();
+    } catch (error) {
+      setMessage(
+        error instanceof Error ? error.message : "Domain action failed",
+      );
+    } finally {
+      setLoading(false);
+    }
+  }
+
  async function onCheckout() {
    setLoading(true);
    try {
@@ -351,14 +466,28 @@ export function DashboardControls({
                        <span className="font-medium">{instance.status}</span>
                      </p>
                      <p className="text-xs text-slate-500">
-                        Last sync: {formatDateTime(instance.last_sync_at)}
-                        {instance.last_sync_status
-                          ? ` (${instance.last_sync_status})`
-                          : ""}
+                        Subscriptions: {instance.last_sync_subscriptions ?? 0}
                      </p>
                      <p className="text-xs text-slate-500">
-                        Last counts: {instance.last_sync_subscriptions ?? 0}{" "}
-                        subscriptions, {instance.last_sync_domains ?? 0} domains
+                        Domains: {instance.last_sync_domains ?? 0}
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Last sync status:{" "}
+                        <span
+                          className={`inline-flex rounded px-2 py-0.5 text-[11px] font-medium ${
+                            instance.last_sync_status === "success"
+                              ? "bg-emerald-100 text-emerald-700"
+                              : instance.last_sync_status === "failed" ||
+                                  instance.last_sync_status === "error"
+                                ? "bg-rose-100 text-rose-700"
+                                : "bg-slate-100 text-slate-600"
+                          }`}
+                        >
+                          {instance.last_sync_status ?? "unknown"}
+                        </span>
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Last sync time: {formatDateTime(instance.last_sync_at)}
                      </p>
                      <p className="text-xs text-slate-500">
                        Last connected:{" "}
@@ -366,6 +495,30 @@ export function DashboardControls({
                          ? formatDateTime(instance.last_connected_at)
                          : "never"}
                      </p>
+                      <p className="text-xs text-slate-500">
+                        Auto-sync:{" "}
+                        {instance.auto_sync_enabled ? "Enabled" : "Disabled"}
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Auto-sync frequency:{" "}
+                        {instance.auto_sync_frequency_minutes ?? 60} min
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Last auto-sync:{" "}
+                        {formatDateTime(instance.last_auto_sync_at)}
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Next auto-sync:{" "}
+                        {formatDateTime(instance.next_auto_sync_at)}
+                      </p>
+                      <p className="text-xs text-slate-500">
+                        Lock status:{" "}
+                        {instance.auto_sync_lock_until &&
+                        new Date(instance.auto_sync_lock_until).getTime() >
+                          Date.now()
+                          ? "Sync in progress"
+                          : "Idle"}
+                      </p>
                      {autoSyncByInstance[instance.id] ? (
                        <p className="text-xs text-slate-500">
                          Last auto-sync:{" "}
@@ -392,6 +545,42 @@ export function DashboardControls({
                      ) : null}
                    </div>
                    <div className="flex flex-col gap-2">
+                      <div className="flex items-center gap-2">
+                        <label className="text-xs text-slate-600">
+                          Auto-sync
+                        </label>
+                        <input
+                          type="checkbox"
+                          checked={instance.auto_sync_enabled}
+                          onChange={(e: ChangeEvent<HTMLInputElement>) =>
+                            onUpdateAutoSync(instance.id, {
+                              auto_sync_enabled: e.target.checked,
+                              auto_sync_frequency_minutes:
+                                instance.auto_sync_frequency_minutes ?? 60,
+                            })
+                          }
+                          disabled={loading}
+                        />
+                      </div>
+                      <select
+                        value={String(
+                          instance.auto_sync_frequency_minutes ?? 60,
+                        )}
+                        onChange={(e: ChangeEvent<HTMLSelectElement>) =>
+                          onUpdateAutoSync(instance.id, {
+                            auto_sync_enabled: instance.auto_sync_enabled,
+                            auto_sync_frequency_minutes: Number(e.target.value),
+                          })
+                        }
+                        disabled={loading}
+                        className="rounded border px-2 py-1 text-xs"
+                      >
+                        {autoSyncFrequencyOptions.map((minutes) => (
+                          <option key={minutes} value={minutes}>
+                            Every {minutes} min
+                          </option>
+                        ))}
+                      </select>
                      <button
                        onClick={() => onTestConnection(instance.id)}
                        disabled={loading}
@@ -467,7 +656,7 @@ export function DashboardControls({
          {message ? <p className="text-sm text-slate-600">{message}</p> : null}
        </div>

-        <div className="space-y-3 rounded-xl border border-slate-200 bg-white p-4">
+        <div className="space-y-3 rounded-xl border border-slate-200 bg-white p-4 lg:col-span-2">
          <div className="flex flex-wrap items-end gap-2">
            <div className="flex-1 min-w-[220px]">
              <label className="text-sm font-medium">Search domains</label>
@@ -504,17 +693,18 @@ export function DashboardControls({
              <thead>
                <tr className="border-b border-slate-200 text-xs uppercase text-slate-500">
                  <th className="px-2 py-2">Domain</th>
-                  <th className="px-2 py-2">Status</th>
+                  <th className="px-2 py-2">Subscription Status</th>
                  <th className="px-2 py-2">Hosting</th>
                  <th className="px-2 py-2">Created</th>
                  <th className="px-2 py-2">Aliases</th>
                  <th className="px-2 py-2">Last seen</th>
+                  <th className="px-2 py-2">Actions</th>
                </tr>
              </thead>
              <tbody>
                {filteredDomains.length === 0 ? (
                  <tr>
-                    <td className="px-2 py-3 text-slate-500" colSpan={6}>
+                    <td className="px-2 py-3 text-slate-500" colSpan={7}>
                      No domains found.
                    </td>
                  </tr>
@@ -522,10 +712,36 @@ export function DashboardControls({
                  filteredDomains.map((domain) => (
                    <tr key={domain.id} className="border-b border-slate-100">
                      <td className="px-2 py-2 font-medium text-slate-900">
+                        <a
+                          href={getDomainHref(domain.domain_name)}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                          className="underline decoration-slate-300 underline-offset-2 hover:text-brand-700"
+                        >
                          {domain.domain_name}
+                        </a>
+                        {domain.subscription_id ? (
+                          <p
+                            className="text-xs font-normal text-slate-500"
+                            title={`Subscription UUID: ${domain.subscription_id}`}
+                          >
+                            Subscription: {domain.subscription_name ?? "Linked"}
+                          </p>
+                        ) : (
+                          <p
+                            className="text-xs font-normal text-amber-700"
+                            title="Run sync to link this domain to a subscription"
+                          >
+                            Subscription: Unlinked
+                          </p>
+                        )}
                      </td>
                      <td className="px-2 py-2">
-                        {domain.status ?? "unknown"}
+                        <span
+                          className={`inline-flex rounded px-2 py-0.5 text-xs font-medium ${getDomainStatusBadge(domain.status)}`}
+                        >
+                          {formatDomainStatusLabel(domain.status)}
+                        </span>
                      </td>
                      <td className="px-2 py-2">
                        {domain.hosting_type ?? "unknown"}
@@ -537,6 +753,42 @@ export function DashboardControls({
                      <td className="px-2 py-2">
                        {formatDateTime(domain.updated_at)}
                      </td>
+                      <td className="px-2 py-2">
+                        <div className="flex gap-2">
+                          <button
+                            onClick={() => onDomainAction(domain, "suspend")}
+                            disabled={
+                              loading ||
+                              !domain.subscription_id ||
+                              isDomainSuspended(domain.status)
+                            }
+                            title={
+                              !domain.subscription_id
+                                ? "Not linked to a subscription yet — run sync"
+                                : undefined
+                            }
+                            className="rounded border border-rose-300 px-2 py-1 text-xs text-rose-700 disabled:cursor-not-allowed disabled:opacity-60"
+                          >
+                            Suspend
+                          </button>
+                          <button
+                            onClick={() => onDomainAction(domain, "unsuspend")}
+                            disabled={
+                              loading ||
+                              !domain.subscription_id ||
+                              isDomainActive(domain.status)
+                            }
+                            title={
+                              !domain.subscription_id
+                                ? "Not linked to a subscription yet — run sync"
+                                : undefined
+                            }
+                            className="rounded border border-emerald-300 px-2 py-1 text-xs text-emerald-700 disabled:cursor-not-allowed disabled:opacity-60"
+                          >
+                            Unsuspend
+                          </button>
+                        </div>
+                      </td>
                    </tr>
                  ))
                )}
--- a/docs/ai-project-context.md
+++ b/docs/ai-project-context.md
@@ -0,0 +1,230 @@
+# Project: Plesk Agency Portal
+
+This project is a multi-tenant SaaS platform that allows agencies to manage multiple Plesk servers from a single dashboard.
+
+The application synchronizes subscriptions and domains from Plesk instances and allows administrators to manage hosting accounts.
+
+---
+
+# Technology Stack
+
+Frontend
+
+- Next.js (App Router)
+- React
+- TypeScript
+
+Backend
+
+- Next.js API routes
+- Node runtime
+
+Database
+
+- Supabase Postgres
+
+Authentication
+
+- Supabase Auth (magic link)
+
+External Integrations
+
+- Plesk REST API
+- Plesk CLI
+- Stripe (future billing integration)
+
+Development Tools
+
+- Git
+- Docker (for some services)
+- Jenkins (future CI/CD)
+
+---
+
+# Core Database Tables
+
+agencies
+
+agency_members
+
+plesk_instances
+
+plesk_subscriptions
+
+plesk_domains
+
+actions_log
+
+billing_accounts
+
+---
+
+# Multi-Tenant Model
+
+Each user belongs to an agency.
+
+Agency relationships:
+
+user  
+→ agency_members  
+→ agencies  
+→ plesk_instances  
+→ plesk_subscriptions  
+→ plesk_domains
+
+Row Level Security in Supabase ensures users can only access rows belonging to their agency.
+
+Never bypass or remove RLS policies.
+
+---
+
+# Plesk Integration
+
+The system integrates with Plesk using both:
+
+Plesk REST API  
+Plesk CLI
+
+Common CLI commands used:
+
+subscription --info  
+subscription --suspend  
+subscription --unsuspend
+
+CLI output must always be parsed defensively because formatting can vary between Plesk versions.
+
+---
+
+# Sync System
+
+The platform supports manual synchronization of Plesk instances.
+
+During sync the system:
+
+1. Connects to a Plesk instance
+2. Retrieves subscriptions and domains
+3. Updates records in Supabase
+4. Updates the dashboard
+
+Future development will include background sync workers.
+
+---
+
+# Dashboard Features
+
+Current features include:
+
+Connecting Plesk instances  
+Testing connections  
+Manual sync  
+Listing domains and subscriptions  
+Suspending subscriptions  
+Unsuspending subscriptions
+
+---
+
+# Logging
+
+Operational actions are written to:
+
+actions_log
+
+Examples include:
+
+instance_connected  
+sync_started  
+sync_completed  
+subscription_suspended  
+subscription_unsuspended
+
+Logging should never block primary workflows.
+
+---
+
+# Development Rules
+
+When implementing features:
+
+Search the repository before modifying code.
+
+Extend existing architecture rather than rewriting systems.
+
+Avoid introducing breaking database schema changes.
+
+Prefer small modular functions.
+
+Keep API routes thin.
+
+Place integration logic inside lib folders.
+
+---
+
+# Git Workflow
+
+Default branch:
+
+master
+
+All work must be done on feature branches.
+
+Example:
+
+git checkout master  
+git pull  
+git checkout -b feature/<feature-name>
+
+Never commit directly to master.
+
+---
+
+# Error Handling
+
+External integrations must always fail gracefully.
+
+If a single subscription fails during sync, the rest of the sync must continue.
+
+All failures should be logged.
+
+---
+
+# UI Safety
+
+Dashboard components must:
+
+Handle null values safely  
+Avoid crashing if API responses change  
+Use status badges instead of raw text for statuses
+
+---
+
+# Future Roadmap
+
+Upcoming development milestones include:
+
+CL4 – Subscription status ingestion via CLI
+
+CL5 – Action logging and retry queue
+
+CL6 – Automatic sync worker
+
+CL7 – Stripe billing enforcement
+
+CL8 – Instance health monitoring
+
+CL9 – Observability and audit improvements
+
+---
+
+# AI Agent Instructions
+
+Before modifying code:
+
+Search the repository for related implementations.
+
+Avoid rewriting working systems.
+
+Implement minimal safe modifications.
+
+Always verify that existing features continue working.
+
+If unsure about a change, prefer logging rather than failing.
--- a/docs/system-architecture.md
+++ b/docs/system-architecture.md
@@ -0,0 +1,179 @@
+# System Architecture
+
+This document describes the architecture of the Plesk Agency Portal SaaS platform.
+
+The platform allows agencies to connect multiple Plesk servers and manage hosting subscriptions from a single dashboard.
+
+---
+
+# High Level Components
+
+The system consists of the following components:
+
+Frontend Dashboard  
+Backend API  
+Supabase Database  
+Plesk Servers  
+Future Worker Services  
+Future Billing Integration
+
+At a high level, users interact with the Frontend Dashboard, which sends authenticated requests to the Backend API (Next.js API routes). The backend reads and writes persistent state in Supabase, and executes remote operations against connected Plesk servers via API/CLI integrations. Future worker services will run asynchronous sync and retry workflows, while future billing integration will enforce plan limits and subscription state.
+
+---
+
+# Frontend
+
+The frontend is a Next.js application using the App Router.
+
+Responsibilities include:
+
+User authentication  
+Dashboard interface  
+Displaying domains and subscriptions  
+Triggering sync operations  
+Sending management actions (suspend / unsuspend)
+
+The frontend communicates with backend API routes.
+
+---
+
+# Backend
+
+The backend uses Next.js API routes.
+
+Responsibilities include:
+
+Handling authenticated requests  
+Connecting to Supabase  
+Executing Plesk API and CLI commands  
+Processing sync operations  
+Writing operational logs
+
+Business logic should be implemented in reusable modules inside the lib directory.
+
+---
+
+# Database
+
+Supabase Postgres is used for persistent storage.
+
+Key tables include:
+
+agencies  
+agency_members  
+plesk_instances  
+plesk_subscriptions  
+plesk_domains  
+actions_log  
+billing_accounts
+
+Relationship overview:
+
+- `agencies` is the tenant root.
+- `agency_members` associates users to agencies and roles.
+- `plesk_instances` stores connected remote Plesk endpoints per agency.
+- `plesk_subscriptions` stores subscription-level records linked to instances.
+- `plesk_domains` stores domain-level records linked to subscriptions/instances.
+- `actions_log` stores operational/audit events.
+- `billing_accounts` stores plan/subscription billing state per agency.
+
+The multi-tenant model is enforced using Supabase Row Level Security policies so users can only read/write rows that belong to their agency.
+
+---
+
+# Plesk Integration
+
+The platform communicates with remote Plesk servers.
+
+Integration methods:
+
+Plesk REST API  
+Plesk CLI commands
+
+Typical operations include:
+
+Listing subscriptions  
+Retrieving domain data  
+Suspending subscriptions  
+Unsuspending subscriptions
+
+CLI parsing must be defensive due to formatting differences between Plesk versions.
+
+---
+
+# Sync System
+
+The system supports synchronization of Plesk servers.
+
+Manual sync is triggered from the dashboard.
+
+During sync:
+
+The backend connects to a Plesk instance  
+Subscription and domain data are retrieved  
+Records are updated in Supabase  
+The dashboard displays updated data
+
+Future development will add automated background sync workers.
+
+---
+
+# Logging System
+
+Operational actions are recorded in the actions_log table.
+
+Examples:
+
+instance_connected  
+sync_started  
+sync_completed  
+subscription_suspended  
+subscription_unsuspended
+
+Logging supports debugging and auditability.
+
+---
+
+# Future Worker Architecture
+
+Future versions of the system will include background workers for:
+
+Automatic instance synchronization  
+Retry queues  
+Monitoring tasks
+
+Workers may run as:
+
+Cron jobs  
+Queue processors  
+Dedicated worker services
+
+---
+
+# Billing Architecture (Future)
+
+Stripe will be integrated for SaaS billing.
+
+Billing responsibilities will include:
+
+Agency subscription plans  
+Usage limits  
+Payment handling
+
+Billing enforcement will eventually control:
+
+Number of connected Plesk instances  
+Number of managed domains
+
+---
+
+# Development Philosophy
+
+The system prioritizes:
+
+Stability  
+Security  
+Multi-tenant isolation  
+Safe integrations with external systems
+
+Developers should extend existing systems rather than rewriting them.
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -14,6 +14,7 @@ for (const key of requiredEnvs) {
 export const env = {
  appUrl: process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000",
  jobSecret: process.env.JOB_SECRET ?? "",
+  cronSecret: process.env.CRON_SECRET ?? "",
  encryptionKey: process.env.ENCRYPTION_KEY ?? "",
  pleskCredEncKey: process.env.PLESK_CRED_ENC_KEY ?? "",
  stripeSecretKey: process.env.STRIPE_SECRET_KEY ?? "",
--- a/lib/plesk/auto-sync.ts
+++ b/lib/plesk/auto-sync.ts
@@ -0,0 +1,232 @@
+import { randomUUID } from "crypto";
+
+import { syncPleskInstance } from "@/lib/plesk/sync";
+
+type SupabaseLike = any;
+
+type AutoSyncInstance = {
+  id: string;
+  agency_id: string;
+  base_url: string;
+  auth_type: "api_key" | "basic";
+  encrypted_secret: string;
+  last_connected_at: string | null;
+  auto_sync_enabled: boolean;
+  auto_sync_frequency_minutes: number | null;
+  next_auto_sync_at: string | null;
+  auto_sync_lock_until: string | null;
+};
+
+type AutoSyncSummary = {
+  instances_considered: number;
+  locks_acquired: number;
+  succeeded: number;
+  failed: number;
+  duration_ms: number;
+};
+
+const MAX_INSTANCES_PER_TICK = 5;
+const MAX_CONCURRENCY = 2;
+const LOCK_LEASE_SECONDS = 15 * 60;
+const INSTANCE_TIMEOUT_MS = 14 * 60 * 1000;
+
+function isDue(instance: AutoSyncInstance, now: number) {
+  if (!instance.next_auto_sync_at) return true;
+  const dueAt = new Date(instance.next_auto_sync_at).getTime();
+  return Number.isFinite(dueAt) && dueAt <= now;
+}
+
+function isUnlocked(instance: AutoSyncInstance, now: number) {
+  if (!instance.auto_sync_lock_until) return true;
+  const lockUntil = new Date(instance.auto_sync_lock_until).getTime();
+  return !Number.isFinite(lockUntil) || lockUntil <= now;
+}
+
+async function insertActionLogBestEffort(
+  supabase: SupabaseLike,
+  payload: Record<string, unknown>,
+) {
+  try {
+    const { error } = await supabase.from("actions_log").insert(payload);
+    if (error) {
+      console.error("[autosync] actions_log insert failed", error.message);
+    }
+  } catch (error) {
+    console.error("[autosync] actions_log insert threw", error);
+  }
+}
+
+async function withTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+): Promise<T> {
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeout = setTimeout(() => {
+      reject(new Error("Auto-sync timed out"));
+    }, timeoutMs);
+  });
+
+  try {
+    return await Promise.race([promise, timeoutPromise]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+
+export async function runAutoSyncTick(
+  supabase: SupabaseLike,
+): Promise<AutoSyncSummary> {
+  const startedAt = Date.now();
+  const now = Date.now();
+
+  const { data: rows, error } = await supabase
+    .from("plesk_instances")
+    .select(
+      "id, agency_id, base_url, auth_type, encrypted_secret, last_connected_at, auto_sync_enabled, auto_sync_frequency_minutes, next_auto_sync_at, auto_sync_lock_until",
+    )
+    .eq("status", "connected")
+    .eq("auto_sync_enabled", true)
+    .order("next_auto_sync_at", { ascending: true, nullsFirst: true })
+    .limit(50);
+
+  if (error) {
+    throw new Error(error.message);
+  }
+
+  const eligible = ((rows ?? []) as AutoSyncInstance[])
+    .filter((instance) => isDue(instance, now) && isUnlocked(instance, now))
+    .slice(0, MAX_INSTANCES_PER_TICK);
+
+  let locksAcquired = 0;
+  let succeeded = 0;
+  let failed = 0;
+
+  const queue = [...eligible];
+
+  async function processInstance(instance: AutoSyncInstance) {
+    const lockToken = randomUUID();
+    const { data: lockAcquired, error: lockError } = await supabase.rpc(
+      "acquire_instance_auto_sync_lock",
+      {
+        p_instance_id: instance.id,
+        p_lock_token: lockToken,
+        p_ttl_seconds: LOCK_LEASE_SECONDS,
+      },
+    );
+
+    if (lockError || !lockAcquired) return;
+    locksAcquired += 1;
+
+    const perInstanceStartedAt = Date.now();
+    const frequencyMinutes = Math.max(
+      instance.auto_sync_frequency_minutes ?? 60,
+      5,
+    );
+
+    await insertActionLogBestEffort(supabase, {
+      agency_id: instance.agency_id,
+      actor_user_id: null,
+      target_type: "plesk_instance",
+      target_id: instance.id,
+      action: "autosync_started",
+      status: "pending",
+      metadata: {
+        instance_id: instance.id,
+        lock_token: lockToken,
+        frequency_minutes: frequencyMinutes,
+      },
+    });
+
+    try {
+      await withTimeout(
+        syncPleskInstance(supabase, instance, null, "autosync"),
+        INSTANCE_TIMEOUT_MS,
+      );
+
+      succeeded += 1;
+
+      await insertActionLogBestEffort(supabase, {
+        agency_id: instance.agency_id,
+        actor_user_id: null,
+        target_type: "plesk_instance",
+        target_id: instance.id,
+        action: "autosync_completed",
+        status: "success",
+        metadata: {
+          instance_id: instance.id,
+          lock_token: lockToken,
+          duration_ms: Date.now() - perInstanceStartedAt,
+        },
+      });
+    } catch (syncError) {
+      failed += 1;
+
+      const errorMessage =
+        syncError instanceof Error
+          ? syncError.message.slice(0, 500)
+          : "autosync_failed";
+
+      await insertActionLogBestEffort(supabase, {
+        agency_id: instance.agency_id,
+        actor_user_id: null,
+        target_type: "plesk_instance",
+        target_id: instance.id,
+        action: "autosync_failed",
+        status: "failed",
+        error_message: errorMessage,
+        metadata: {
+          instance_id: instance.id,
+          lock_token: lockToken,
+          duration_ms: Date.now() - perInstanceStartedAt,
+          error_summary: errorMessage,
+        },
+      });
+    } finally {
+      const nowIso = new Date().toISOString();
+      const nextAutoSyncAtIso = new Date(
+        Date.now() + frequencyMinutes * 60 * 1000,
+      ).toISOString();
+
+      const { error: scheduleError } = await supabase
+        .from("plesk_instances")
+        .update({
+          last_auto_sync_at: nowIso,
+          next_auto_sync_at: nextAutoSyncAtIso,
+          auto_sync_lock_until: null,
+          auto_sync_lock_token: null,
+        })
+        .eq("id", instance.id)
+        .eq("auto_sync_lock_token", lockToken);
+
+      if (scheduleError) {
+        console.error(
+          "[autosync] schedule update failed",
+          scheduleError.message,
+        );
+      }
+    }
+  }
+
+  const workers = Array.from(
+    { length: Math.min(MAX_CONCURRENCY, queue.length) },
+    async () => {
+      while (queue.length > 0) {
+        const instance = queue.shift();
+        if (!instance) break;
+        await processInstance(instance);
+      }
+    },
+  );
+
+  await Promise.all(workers);
+
+  return {
+    instances_considered: eligible.length,
+    locks_acquired: locksAcquired,
+    succeeded,
+    failed,
+    duration_ms: Date.now() - startedAt,
+  };
+}
--- a/lib/plesk/client.ts
+++ b/lib/plesk/client.ts
@@ -9,12 +9,15 @@ export type PleskConnection = {
 };

 export type PleskSubscription = {
+  plesk_subscription_id?: string;
  id?: string | number;
  guid?: string;
  subscription_id?: string | number;
  external_id?: string;
  name?: string;
  status?: string;
+  status_raw?: string | null;
+  status_sync_error?: string | null;
  owner_login?: string;
  owner?: { login?: string };
  plan_name?: string;
@@ -137,51 +140,95 @@ export async function testPleskConnection(connection: PleskConnection) {
 }

 export async function listPleskSubscriptions(connection: PleskConnection) {
-  try {
-    const all: PleskSubscription[] = [];
+  const listResult = await pleskCliCall(connection, "subscription", ["--list"]);

-    for (let page = 1; page <= 20; page += 1) {
-      const payload = await pleskRequest<PleskSubscription[]>(
-        connection,
-        `/api/v2/subscriptions?page=${page}&per_page=100`,
-      );
-      const rows = Array.isArray(payload) ? payload : [];
-      all.push(...rows);
-      if (rows.length < 100) break;
-    }
-
-    return all;
-  } catch {
-    const cli = await pleskRequest<PleskCliResult>(
-      connection,
-      "/api/v2/cli/subscription/call",
-      {
-        method: "POST",
-        body: JSON.stringify({ params: ["--list"] }),
-      },
-    );
-
-    const stdout = cli?.stdout ?? "";
-    if (!stdout.trim()) {
-      return [];
-    }
-
-    return stdout
+  const subscriptionNames = (listResult.stdout ?? "")
    .split(/\r?\n/)
    .map((line) => line.trim())
-      .filter(Boolean)
-      .map((line) => {
-        const columns = line.split(/\s+/);
-        const externalId = columns[0] ?? line;
-        return {
-          id: externalId,
-          subscription_id: externalId,
-          external_id: externalId,
-          name: columns.slice(1).join(" ") || externalId,
-          status: null,
-        };
+    .filter(Boolean);
+
+  const subscriptions: PleskSubscription[] = [];
+
+  for (const subscriptionName of subscriptionNames.slice(0, 500)) {
+    let status: "active" | "suspended" | "disabled" | "expired" | "unknown" =
+      "unknown";
+    let statusRaw: string | null = null;
+    let statusSyncError: string | null = null;
+
+    try {
+      const infoResult = await pleskCliCall(connection, "subscription", [
+        "--info",
+        subscriptionName,
+      ]);
+      const parsed = parseSubscriptionStatusDetailsFromInfo(
+        infoResult.stdout ?? "",
+      );
+      status = parsed.status;
+      statusRaw = parsed.statusRaw;
+    } catch (error) {
+      status = "unknown";
+      statusSyncError =
+        error instanceof Error
+          ? error.message.slice(0, 1000)
+          : "status_sync_failed";
+    }
+
+    subscriptions.push({
+      plesk_subscription_id: subscriptionName,
+      subscription_id: subscriptionName,
+      name: subscriptionName,
+      status,
+      status_raw: statusRaw,
+      status_sync_error: statusSyncError,
    });
  }
+
+  return subscriptions;
+}
+
+export function parseSubscriptionStatusDetailsFromInfo(stdout: string): {
+  status: "active" | "suspended" | "disabled" | "expired" | "unknown";
+  statusRaw: string | null;
+} {
+  const line = stdout
+    .split(/\r?\n/)
+    .map((entry) => entry.trim())
+    .find((entry) => /^domain\s+status\s*:/i.test(entry));
+
+  if (!line) {
+    return { status: "unknown", statusRaw: null };
+  }
+
+  const value = line.replace(/^domain\s+status\s*:/i, "").trim();
+  const normalized = value.toLowerCase();
+
+  if (normalized.includes("expired")) {
+    return { status: "expired", statusRaw: value };
+  }
+
+  if (normalized.includes("disabled")) {
+    return { status: "disabled", statusRaw: value };
+  }
+
+  if (normalized.includes("suspend")) {
+    return { status: "suspended", statusRaw: value };
+  }
+
+  if (
+    normalized.includes("ok") ||
+    normalized.includes("active") ||
+    normalized.includes("enabled")
+  ) {
+    return { status: "active", statusRaw: value };
+  }
+
+  return { status: "unknown", statusRaw: value };
+}
+
+export function parseSubscriptionStatusFromInfo(
+  stdout: string,
+): "active" | "suspended" | "disabled" | "expired" | "unknown" {
+  return parseSubscriptionStatusDetailsFromInfo(stdout).status;
 }

 export async function pleskCliCall(
@@ -242,7 +289,7 @@ export async function unsuspendPleskSubscription(
  subscriptionName: string,
 ) {
  return pleskCliCall(connection, "subscription", [
-    "--webspace-on",
+    "--unsuspend",
    subscriptionName,
  ]);
 }
--- a/lib/plesk/sync.ts
+++ b/lib/plesk/sync.ts
@@ -22,8 +22,34 @@ type InstanceRow = Pick<
  | "last_connected_at"
 >;

+type LocalSubscriptionLookupRow = {
+  id: string;
+  plesk_subscription_id: string;
+  name: string | null;
+  status: string | null;
+};
+
 const MIN_INTERVAL_MS = 3 * 60 * 1000;

+function normalizeDomainLike(value: string) {
+  return value.trim().toLowerCase().replace(/\.$/, "");
+}
+
+function findBestSuffixSubscriptionMatch<
+  T extends { normalizedName: string; id: string; status: string | null },
+>(normalizedDomain: string, candidates: T[]) {
+  let best: T | undefined;
+
+  for (const candidate of candidates) {
+    if (!normalizedDomain.endsWith(`.${candidate.normalizedName}`)) continue;
+    if (!best || candidate.normalizedName.length > best.normalizedName.length) {
+      best = candidate;
+    }
+  }
+
+  return best;
+}
+
 export async function syncPleskInstance(
  supabase: SupabaseLike,
  instance: InstanceRow,
@@ -32,6 +58,31 @@ export async function syncPleskInstance(
 ): Promise<SyncResult> {
  const startedAtIso = new Date().toISOString();

+  const logStatusSyncEvent = async (
+    eventAction:
+      | "subscription_status_sync_started"
+      | "subscription_status_sync_completed"
+      | "subscription_status_sync_failed",
+    metadata?: Record<string, unknown>,
+    status: "success" | "failed" = "success",
+    errorMessage?: string | null,
+  ) => {
+    try {
+      await supabase.from("actions_log").insert({
+        agency_id: instance.agency_id,
+        actor_user_id: actorUserId ?? null,
+        target_type: "plesk_instance",
+        target_id: instance.id,
+        action: eventAction,
+        status,
+        error_message: errorMessage ?? null,
+        metadata: metadata ?? {},
+      });
+    } catch {
+      // Logging should never block sync flow.
+    }
+  };
+
  await supabase
    .from("plesk_instances")
    .update({
@@ -67,6 +118,10 @@ export async function syncPleskInstance(
  }

  try {
+    await logStatusSyncEvent("subscription_status_sync_started", {
+      started_at: startedAtIso,
+    });
+
    const [subscriptionsRaw, domainsRaw] = await Promise.all([
      listPleskSubscriptions({
        baseUrl: instance.base_url,
@@ -82,14 +137,21 @@ export async function syncPleskInstance(

    const subscriptionsForUpsert = subscriptionsRaw
      .map((item: any) => {
-        const sourceId = item?.id ?? item?.guid ?? item?.subscription_id;
+        const sourceId =
+          item?.plesk_subscription_id ??
+          item?.name ??
+          item?.id ??
+          item?.guid ??
+          item?.subscription_id;
        if (!sourceId) return null;
        return {
          agency_id: instance.agency_id,
          plesk_instance_id: instance.id,
          plesk_subscription_id: String(sourceId),
-          name: item?.name ? String(item.name) : null,
-          status: item?.status ? String(item.status) : null,
+          name: item?.name ? String(item.name) : String(sourceId),
+          status: item?.status ? String(item.status) : "unknown",
+          status_raw: item?.status_raw ? String(item.status_raw) : null,
+          last_status_sync_at: startedAtIso,
          owner_login: item?.owner_login
            ? String(item.owner_login)
            : item?.owner?.login
@@ -104,6 +166,10 @@ export async function syncPleskInstance(
      })
      .filter(Boolean) as Array<Record<string, unknown>>;

+    const subscriptionStatusSyncFailures = subscriptionsRaw.filter(
+      (item: any) => Boolean(item?.status_sync_error),
+    );
+
    if (subscriptionsForUpsert.length > 0) {
      const { error } = await supabase
        .from("plesk_subscriptions")
@@ -113,12 +179,127 @@ export async function syncPleskInstance(
      if (error) throw new Error(error.message);
    }

+    const { data: localSubscriptions, error: localSubscriptionsError } =
+      await supabase
+        .from("plesk_subscriptions")
+        .select("id, plesk_subscription_id, name, status")
+        .eq("agency_id", instance.agency_id)
+        .eq("plesk_instance_id", instance.id);
+
+    if (localSubscriptionsError) {
+      throw new Error(localSubscriptionsError.message);
+    }
+
+    const subscriptionsIndexed = ((localSubscriptions ?? []) as Array<any>)
+      .filter((row): row is LocalSubscriptionLookupRow =>
+        Boolean(row?.plesk_subscription_id && row?.id),
+      )
+      .map((row) => ({
+        id: String(row.id),
+        pleskSubscriptionId: String(row.plesk_subscription_id),
+        status: row?.status ? String(row.status) : null,
+        name: row?.name ? String(row.name) : null,
+      }));
+
+    const subscriptionByExternalId = new Map<
+      string,
+      {
+        id: string;
+        pleskSubscriptionId: string;
+        status: string | null;
+        name: string | null;
+      }
+    >(subscriptionsIndexed.map((row) => [row.pleskSubscriptionId, row]));
+
+    const subscriptionByLocalId = new Map<
+      string,
+      {
+        id: string;
+        pleskSubscriptionId: string;
+        status: string | null;
+        name: string | null;
+      }
+    >(subscriptionsIndexed.map((row) => [row.id, row]));
+
+    const subscriptionByName = new Map<
+      string,
+      {
+        id: string;
+        pleskSubscriptionId: string;
+        status: string | null;
+        name: string | null;
+      }
+    >(
+      subscriptionsIndexed
+        .filter((row) => row.name)
+        .map((row) => [normalizeDomainLike(String(row.name)), row]),
+    );
+
+    const subscriptionNameCandidates: Array<{
+      id: string;
+      pleskSubscriptionId: string;
+      status: string | null;
+      normalizedName: string;
+    }> = subscriptionsIndexed
+      .filter((row) => row.name)
+      .map((row) => ({
+        id: row.id,
+        pleskSubscriptionId: row.pleskSubscriptionId,
+        status: row.status,
+        normalizedName: normalizeDomainLike(String(row.name)),
+      }));
+
    const domainsForUpsert = domainsRaw
      .map((item: any) => {
        const domainId = item?.id ?? item?.guid ?? item?.name;
        const domainName = item?.name ?? item?.domain_name ?? item?.domain;
-        const externalSubscriptionId =
+        const normalizedDomainName = domainName
+          ? normalizeDomainLike(String(domainName))
+          : null;
+        const subExternalId =
          item?.subscription?.id ?? item?.subscription_id ?? item?.webspace_id;
+        const rawExternalSubscriptionId = subExternalId
+          ? String(subExternalId)
+          : null;
+        const subscriptionNameHint =
+          item?.subscription?.name ??
+          item?.subscription_name ??
+          item?.webspace_name ??
+          item?.webspace ??
+          null;
+
+        const localSubscriptionByExternal = rawExternalSubscriptionId
+          ? subscriptionByExternalId.get(rawExternalSubscriptionId)
+          : undefined;
+        const localSubscriptionByLocalId = rawExternalSubscriptionId
+          ? subscriptionByLocalId.get(rawExternalSubscriptionId)
+          : undefined;
+        const localSubscriptionByName = subscriptionNameHint
+          ? subscriptionByName.get(
+              normalizeDomainLike(String(subscriptionNameHint)),
+            )
+          : undefined;
+        const localSubscriptionByDomainName = normalizedDomainName
+          ? subscriptionByName.get(normalizedDomainName)
+          : undefined;
+        const localSubscriptionBySuffix = normalizedDomainName
+          ? findBestSuffixSubscriptionMatch(
+              normalizedDomainName,
+              subscriptionNameCandidates,
+            )
+          : undefined;
+        const localSubscription =
+          localSubscriptionByExternal ??
+          localSubscriptionByLocalId ??
+          localSubscriptionByName ??
+          localSubscriptionByDomainName ??
+          localSubscriptionBySuffix;
+
+        const externalSubscriptionId = localSubscription
+          ? localSubscription.pleskSubscriptionId
+          : subscriptionNameHint
+            ? String(subscriptionNameHint)
+            : rawExternalSubscriptionId;
        const rawCreated = item?.created_at ?? item?.created;
        const sourceCreatedAt = rawCreated
          ? new Date(String(rawCreated)).toISOString()
@@ -135,24 +316,22 @@ export async function syncPleskInstance(
        return {
          agency_id: instance.agency_id,
          plesk_instance_id: instance.id,
-          subscription_id: null,
-          external_subscription_id: externalSubscriptionId
-            ? String(externalSubscriptionId)
-            : null,
+          subscription_id: localSubscription?.id ?? null,
+          external_subscription_id: externalSubscriptionId,
          plesk_domain_id: String(domainId),
          domain_name: String(domainName),
-          status: item?.status ? String(item.status) : null,
-          hosting_type: item?.hosting_type
-            ? String(item.hosting_type)
-            : item?.hosting?.type
-              ? String(item.hosting.type)
-              : null,
+          status: localSubscription?.status ?? "unknown",
+          hosting_type: item?.hosting_type ? String(item.hosting_type) : null,
          source_created_at: sourceCreatedAt,
          aliases_count: aliasesCount,
        };
      })
      .filter(Boolean) as Array<Record<string, unknown>>;

+    const unlinkedDomains = domainsForUpsert.filter(
+      (domain) => !domain.subscription_id,
+    );
+
    if (domainsForUpsert.length > 0) {
      const { error } = await supabase
        .from("plesk_domains")
@@ -187,9 +366,47 @@ export async function syncPleskInstance(
      metadata: {
        subscriptions_seen: subscriptionsRaw.length,
        domains_seen: domainsRaw.length,
+        unlinked_domains: unlinkedDomains.length,
+        unlinked_domain_samples: unlinkedDomains
+          .slice(0, 25)
+          .map((domain) => String(domain.domain_name ?? "unknown")),
      },
    });

+    await logStatusSyncEvent("subscription_status_sync_completed", {
+      synced_subscriptions: subscriptionsRaw.length,
+      failed_subscriptions: subscriptionStatusSyncFailures.length,
+      failed_subscription_ids: subscriptionStatusSyncFailures
+        .slice(0, 50)
+        .map((item: any) =>
+          String(
+            item?.plesk_subscription_id ?? item?.subscription_id ?? "unknown",
+          ),
+        ),
+      completed_at: new Date().toISOString(),
+    });
+
+    if (subscriptionStatusSyncFailures.length > 0) {
+      await logStatusSyncEvent(
+        "subscription_status_sync_failed",
+        {
+          failed_subscriptions: subscriptionStatusSyncFailures.length,
+          sample_errors: subscriptionStatusSyncFailures
+            .slice(0, 20)
+            .map((item: any) => ({
+              subscription: String(
+                item?.plesk_subscription_id ??
+                  item?.subscription_id ??
+                  "unknown",
+              ),
+              error: String(item?.status_sync_error ?? "status_sync_failed"),
+            })),
+        },
+        "failed",
+        `${subscriptionStatusSyncFailures.length} subscription status sync failures`,
+      );
+    }
+
    return {
      instanceId: instance.id,
      agencyId: instance.agency_id,
@@ -201,6 +418,15 @@ export async function syncPleskInstance(
    const message =
      error instanceof Error ? error.message.slice(0, 1000) : "Sync failed";

+    await logStatusSyncEvent(
+      "subscription_status_sync_failed",
+      {
+        failed_at: new Date().toISOString(),
+      },
+      "failed",
+      message,
+    );
+
    await supabase
      .from("plesk_instances")
      .update({
@@ -216,3 +442,146 @@ export async function syncPleskInstance(
    throw error;
  }
 }
+
+export async function backfillDomainSubscriptionLinks(
+  supabase: SupabaseLike,
+  input: {
+    agencyId: string;
+    instanceId: string;
+    actorUserId?: string | null;
+  },
+) {
+  const { agencyId, instanceId, actorUserId } = input;
+
+  const { data: subscriptions, error: subscriptionsError } = await supabase
+    .from("plesk_subscriptions")
+    .select("id, plesk_subscription_id, name, status")
+    .eq("agency_id", agencyId)
+    .eq("plesk_instance_id", instanceId);
+
+  if (subscriptionsError) {
+    throw new Error(subscriptionsError.message);
+  }
+
+  const { data: domains, error: domainsError } = await supabase
+    .from("plesk_domains")
+    .select("id, domain_name, external_subscription_id, subscription_id")
+    .eq("agency_id", agencyId)
+    .eq("plesk_instance_id", instanceId)
+    .is("subscription_id", null);
+
+  if (domainsError) {
+    throw new Error(domainsError.message);
+  }
+
+  const subscriptionByExternalId = new Map<
+    string,
+    { id: string; status: string }
+  >(
+    (subscriptions ?? [])
+      .filter((subscription: any) => subscription?.plesk_subscription_id)
+      .map((subscription: any) => [
+        String(subscription.plesk_subscription_id),
+        {
+          id: String(subscription.id),
+          status: subscription?.status
+            ? String(subscription.status)
+            : "unknown",
+        },
+      ]),
+  );
+
+  const subscriptionByName = new Map<string, { id: string; status: string }>(
+    (subscriptions ?? [])
+      .filter((subscription: any) => subscription?.name)
+      .map((subscription: any) => [
+        normalizeDomainLike(String(subscription.name)),
+        {
+          id: String(subscription.id),
+          status: subscription?.status
+            ? String(subscription.status)
+            : "unknown",
+        },
+      ]),
+  );
+
+  const subscriptionNameCandidates: Array<{
+    id: string;
+    status: string;
+    normalizedName: string;
+  }> = (subscriptions ?? [])
+    .filter((subscription: any) => subscription?.name)
+    .map((subscription: any) => ({
+      id: String(subscription.id),
+      status: subscription?.status ? String(subscription.status) : "unknown",
+      normalizedName: normalizeDomainLike(String(subscription.name)),
+    }));
+
+  let linkedCount = 0;
+  const failures: Array<{ domain_id: string; error: string }> = [];
+
+  for (const domain of domains ?? []) {
+    const matchByExternal = domain?.external_subscription_id
+      ? subscriptionByExternalId.get(String(domain.external_subscription_id))
+      : undefined;
+    const matchByDomainName = domain?.domain_name
+      ? subscriptionByName.get(normalizeDomainLike(String(domain.domain_name)))
+      : undefined;
+    const normalizedDomainName = domain?.domain_name
+      ? normalizeDomainLike(String(domain.domain_name))
+      : null;
+    const matchBySuffix = normalizedDomainName
+      ? findBestSuffixSubscriptionMatch(
+          normalizedDomainName,
+          subscriptionNameCandidates,
+        )
+      : undefined;
+    const linkedSubscription =
+      matchByExternal ?? matchByDomainName ?? matchBySuffix;
+
+    if (!linkedSubscription) continue;
+
+    const { error: updateError } = await supabase
+      .from("plesk_domains")
+      .update({
+        subscription_id: linkedSubscription.id,
+        status: linkedSubscription.status,
+      })
+      .eq("id", domain.id)
+      .eq("agency_id", agencyId);
+
+    if (updateError) {
+      failures.push({
+        domain_id: String(domain.id),
+        error: updateError.message,
+      });
+      continue;
+    }
+
+    linkedCount += 1;
+  }
+
+  await supabase.from("actions_log").insert({
+    agency_id: agencyId,
+    actor_user_id: actorUserId ?? null,
+    target_type: "plesk_instance",
+    target_id: instanceId,
+    action: "domain_subscription_backfill",
+    status: failures.length > 0 ? "failed" : "success",
+    error_message:
+      failures.length > 0
+        ? `${failures.length} domain links failed during backfill`
+        : null,
+    metadata: {
+      attempted: (domains ?? []).length,
+      linked: linkedCount,
+      failures: failures.slice(0, 25),
+    },
+  });
+
+  return {
+    attempted: (domains ?? []).length,
+    linked: linkedCount,
+    failed: failures.length,
+  };
+}
--- a/lib/types.ts
+++ b/lib/types.ts
@@ -83,6 +83,12 @@ export type Database = {
          last_sync_error: string | null;
          last_sync_subscriptions: number;
          last_sync_domains: number;
+          auto_sync_enabled: boolean;
+          auto_sync_frequency_minutes: number;
+          last_auto_sync_at: string | null;
+          next_auto_sync_at: string | null;
+          auto_sync_lock_until: string | null;
+          auto_sync_lock_token: string | null;
          created_at: string;
        };
        Insert: {
@@ -101,6 +107,12 @@ export type Database = {
          last_sync_error?: string | null;
          last_sync_subscriptions?: number;
          last_sync_domains?: number;
+          auto_sync_enabled?: boolean;
+          auto_sync_frequency_minutes?: number;
+          last_auto_sync_at?: string | null;
+          next_auto_sync_at?: string | null;
+          auto_sync_lock_until?: string | null;
+          auto_sync_lock_token?: string | null;
          created_at?: string;
        };
        Update: {
@@ -119,6 +131,12 @@ export type Database = {
          last_sync_error?: string | null;
          last_sync_subscriptions?: number;
          last_sync_domains?: number;
+          auto_sync_enabled?: boolean;
+          auto_sync_frequency_minutes?: number;
+          last_auto_sync_at?: string | null;
+          next_auto_sync_at?: string | null;
+          auto_sync_lock_until?: string | null;
+          auto_sync_lock_token?: string | null;
          created_at?: string;
        };
      };
--- a/supabase/migrations/CL37_domain_status_backfill_from_subscription.sql
+++ b/supabase/migrations/CL37_domain_status_backfill_from_subscription.sql
@@ -0,0 +1,10 @@
+-- One-time backfill: align existing domain status with linked subscription status
+update public.plesk_domains d
+set status = coalesce(s.status, 'unknown')
+from public.plesk_subscriptions s
+where d.subscription_id = s.id
+  and d.agency_id = s.agency_id;
+
+update public.plesk_subscriptions
+set status = 'unknown'
+where status is null;
--- a/supabase/migrations/CL4_subscription_status_fields.sql
+++ b/supabase/migrations/CL4_subscription_status_fields.sql
@@ -0,0 +1,8 @@
+alter table public.plesk_subscriptions
+add column if not exists status text default 'unknown',
+add column if not exists status_raw text,
+add column if not exists last_status_sync_at timestamptz;
+
+update public.plesk_subscriptions
+set status = 'unknown'
+where status is null;
--- a/supabase/migrations/CL6_auto_sync_worker.sql
+++ b/supabase/migrations/CL6_auto_sync_worker.sql
@@ -0,0 +1,62 @@
+-- CL6: auto-sync worker scheduling fields + per-instance lock helpers
+
+alter table public.plesk_instances
+  add column if not exists auto_sync_enabled boolean not null default false,
+  add column if not exists auto_sync_frequency_minutes integer not null default 60,
+  add column if not exists last_auto_sync_at timestamptz,
+  add column if not exists next_auto_sync_at timestamptz,
+  add column if not exists auto_sync_lock_until timestamptz,
+  add column if not exists auto_sync_lock_token text;
+
+alter table public.plesk_instances
+  drop constraint if exists plesk_instances_auto_sync_frequency_minutes_check;
+
+alter table public.plesk_instances
+  add constraint plesk_instances_auto_sync_frequency_minutes_check
+  check (auto_sync_frequency_minutes between 5 and 10080);
+
+create index if not exists idx_plesk_instances_auto_sync_due
+  on public.plesk_instances (auto_sync_enabled, next_auto_sync_at);
+
+create or replace function public.acquire_instance_auto_sync_lock(
+  p_instance_id uuid,
+  p_lock_token text,
+  p_ttl_seconds integer default 900
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_acquired boolean := false;
+begin
+  update public.plesk_instances
+  set
+    auto_sync_lock_until = now() + make_interval(secs => p_ttl_seconds),
+    auto_sync_lock_token = p_lock_token
+  where id = p_instance_id
+    and auto_sync_enabled = true
+    and (next_auto_sync_at is null or next_auto_sync_at <= now())
+    and (auto_sync_lock_until is null or auto_sync_lock_until < now());
+
+  get diagnostics v_acquired = row_count;
+  return v_acquired;
+end;
+$$;
+
+create or replace function public.release_instance_auto_sync_lock(
+  p_instance_id uuid,
+  p_lock_token text
+)
+returns void
+language sql
+security definer
+set search_path = public
+as $$
+  update public.plesk_instances
+  set auto_sync_lock_until = null,
+      auto_sync_lock_token = null
+  where id = p_instance_id
+    and auto_sync_lock_token = p_lock_token;
+$$;
--- a/tsconfig.tsbuildinfo
+++ b/tsconfig.tsbuildinfo
Author	SHA1	Message	Date
robbond	5e5fb3221a	feat(worker): add autosync scheduler, endpoint, locking and UI controls	2026-03-05 17:33:14 +00:00
robbond	34aa17a74a	Merge pull request 'feat(logging): add best-effort requested/succeeded/failed action logs' (#22 ) from feature/cl5-action-logging into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/22	2026-03-05 17:19:05 +00:00
robbond	c943d2cbf6	feat(logging): add best-effort requested/succeeded/failed action logs	2026-03-05 17:13:18 +00:00
robbond	c11fcd01a4	Merge pull request 'feat(ui): polish domains list subscription/status display' (#21 ) from feature/ui-domains-polish into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/21	2026-03-05 17:07:48 +00:00
robbond	710227a49a	feat(ui): polish domains list subscription/status display	2026-03-05 17:06:29 +00:00
robbond	b72176b276	Merge pull request 'fix(actions): use plesk bin site for suspend/unsuspend domain state' (#20 ) from fix/domain-actions-use-site-cli into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/20	2026-03-05 17:03:55 +00:00
robbond	81b0617390	fix(actions): use plesk bin site for suspend/unsuspend domain state	2026-03-05 16:59:40 +00:00
robbond	757e8953be	Merge pull request 'fix(plesk): use subscription --unsuspend for unsuspend action' (#19 ) from fix/plesk-unsuspend-command into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/19	2026-03-05 16:04:42 +00:00
robbond	c528392682	fix(plesk): use subscription --unsuspend for unsuspend action	2026-03-05 16:04:11 +00:00
robbond	a678713d1d	Merge pull request 'fix(actions): unsuspend using canonical subscription identifier + refresh status' (#18 ) from fix/unsuspend-verify-and-refresh into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/18	2026-03-05 14:27:56 +00:00
robbond	033d816d42	fix(actions): unsuspend using canonical subscription identifier + refresh status	2026-03-05 14:26:58 +00:00
robbond	a22fc2c4d2	Merge pull request 'fix(actions): send and use subscription_id for domain suspend/unsuspend' (#17 ) from fix/actions-use-subscription-id into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/17	2026-03-05 14:20:34 +00:00
robbond	825bf8dc84	fix(actions): send and use subscription_id for domain suspend/unsuspend	2026-03-05 14:20:07 +00:00
robbond	2c52d89dc9	Merge pull request 'fix(linking): link subdomains to parent subscription via suffix match' (#16 ) from fix/subdomain-inherit-subscription into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/16	2026-03-05 14:14:52 +00:00
robbond	cc7e30092d	fix(linking): link subdomains to parent subscription via suffix match	2026-03-05 14:14:20 +00:00
robbond	ce8b04285a	Merge pull request 'fix(actions): refresh subscription status after suspend/unsuspend' (#15 ) from fix/action-refresh-status into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/15	2026-03-05 14:10:56 +00:00
robbond	ed31598a1d	fix(actions): refresh subscription status after suspend/unsuspend	2026-03-05 14:10:27 +00:00
robbond	a49448c04b	Merge pull request 'fix(sync): link domains to subscriptions and add backfill endpoint' (#14 ) from fix/link-domains-to-subscriptions into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/14	2026-03-05 14:09:56 +00:00
robbond	dceccecf0c	fix(sync): link domains to subscriptions and add backfill endpoint	2026-03-05 14:03:03 +00:00
robbond	8e5d9865ac	Merge pull request 'fix(domains): correctly match subscriptions to domains for status' (#13 ) from fix/cl4-domain-status-merge into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/13	2026-03-05 13:46:31 +00:00
robbond	ee9b90e3d1	fix(domains): correctly match subscriptions to domains for status	2026-03-05 13:46:03 +00:00
robbond	ea671336d3	Merge pull request 'fix(domains): prevent status enrichment from filtering domains' (#12 ) from hotfix/domains-list-server-join-empty into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/12	2026-03-05 13:36:34 +00:00
robbond	0d914f5973	fix(domains): prevent status enrichment from filtering domains	2026-03-05 13:36:08 +00:00
robbond	fbeb089b9e	Merge pull request 'fix(ui): show subscription status on domains list' (#11 ) from feature/cl4-domain-status-from-subscription into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/11	2026-03-05 13:23:15 +00:00
robbond	269c9e47c9	Merge pull request 'fix(sync): robustly map domain rows to subscription status' (#10 ) from feature/cl4-fix-domain-status-ui into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/10	2026-03-05 13:23:07 +00:00
robbond	c9e3fe1dbc	fix(ui): show subscription status on domains list	2026-03-05 13:22:33 +00:00
robbond	78d3f104de	fix(sync): robustly map domain rows to subscription status	2026-03-05 13:14:26 +00:00
robbond	e4465d9549	docs: add system architecture documentation	2026-03-05 13:06:29 +00:00
robbond	698090853c	docs: add ai project context for development agents	2026-03-05 13:06:29 +00:00
robbond	e9c65f8096	Merge pull request 'feat/cl4-subscription-status-cli' (#9 ) from feat/cl4-subscription-status-cli into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/9	2026-03-05 12:57:15 +00:00
robbond	84a1396265	feat(ui): show subscription status in dashboard	2026-03-05 12:42:56 +00:00
robbond	fec7c682f0	feat(sync): ingest subscription status during sync	2026-03-05 12:42:51 +00:00
robbond	5adc9f0923	feat(plesk): parse subscription status from CLI	2026-03-05 12:42:44 +00:00
robbond	d87808af23	feat(db): add subscription status fields	2026-03-05 12:42:34 +00:00
robbond	57005859c3	Merge pull request 'Dashboard: make domains clickable links opening in new tab' (#8 ) from feature/domain-links into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/8	2026-03-05 11:56:14 +00:00
robbond	b221ad45fa	Dashboard: make domains clickable links opening in new tab	2026-03-05 11:53:29 +00:00
robbond	9ec1259403	Merge pull request 'feature/domain-actions' (#7 ) from feature/domain-actions into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/7	2026-03-05 11:44:16 +00:00
robbond	84165f47ff	Dashboard: make domains table span full width	2026-03-05 10:44:15 +00:00
robbond	067e0d9080	CL3.8 domain actions: suspend/unsuspend subscription from domains table	2026-03-05 10:38:05 +00:00
robbond	e90b34e6ca	Merge pull request 'Parse Plesk subscription status via CLI; domains inherit; UI badges' (#6 ) from feature/plesk-status-parsing into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/6	2026-03-05 10:22:59 +00:00
robbond	f2ad5c9d7d	Merge branch 'master' into feature/plesk-status-parsing	2026-03-05 10:22:52 +00:00
robbond	3bc2cf09c3	Parse Plesk subscription status via CLI; domains inherit; UI badges	2026-03-05 10:22:18 +00:00
robbond	e619c12c35	Merge pull request 'Use Plesk CLI subscription info to populate status; domains inherit status; UI badges' (#5 ) from feature/subscription-status into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/5	2026-03-05 10:20:01 +00:00
robbond	a64de5aba3	Use Plesk CLI subscription info to populate status; domains inherit status; UI badges	2026-03-05 10:17:28 +00:00
robbond	b80b3797fe	Merge pull request 'fix/subscription-status' (#4 ) from fix/subscription-status into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/4	2026-03-05 10:12:43 +00:00
robbond	fa43428153	Fix subscription status via CLI; derive domain status + badges	2026-03-05 10:10:17 +00:00
robbond	37a70cafdd	checkpoint before subscription/domain status fix	2026-03-05 10:07:28 +00:00
robbond	878ef7555d	Merge pull request 'fix/domain-status-from-subscription' (#3 ) from fix/domain-status-from-subscription into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/3	2026-03-05 10:03:52 +00:00
robbond	3599ccbb39	Derive domain status from subscription status and add backfill	2026-03-05 10:01:08 +00:00
robbond	09d66ea601	checkpoint before domain status = subscription status	2026-03-05 09:58:50 +00:00
robbond	698bd85c7d	Merge pull request 'feature/domain-health-dashboard' (#2 ) from feature/domain-health-dashboard into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/2	2026-03-05 09:53:46 +00:00
robbond	736cee870c	Refine domain table name cell styling	2026-03-05 09:44:01 +00:00
robbond	0b7a95947f	CL3.6b instance overview and CL3.7 domain status badges	2026-03-05 09:41:46 +00:00
robbond	0dba5d2ebf	Merge pull request 'fixed sync' (#1 ) from cl3.6a-domains-ui into master Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/1	2026-03-05 09:35:43 +00:00