feat(moshpit): TLD aliases with per-name exemptions

[ralyodio]

The Reddit-for-DNS bit: point one TLD at another you own, and hold individual names back
from the redirect.

.agentic          -> .agent            so foo.agentic  -> foo.agent
.financewizards   -> .financialadvice  so anyone.financewizards -> anyone.financialadvice
tonyrobbins.financewizards             ...except this one, which stays put

Stacked on #70 (which is stacked on #69). Retargets to master as those merge.

API

PUT    /api/moshpit/tlds/:tld/alias   { to }      point it
DELETE /api/moshpit/tlds/:tld/alias               stop pointing it
GET    /api/moshpit/tlds/:tld/exempt              names held back
POST   /api/moshpit/tlds/:tld/exempt  { label }   hold one back
DELETE /api/moshpit/tlds/:tld/exempt  { label }   let it follow again
GET    /api/moshpit/resolve?name=foo.agentic      the resolver lookup

Rules, and why

An alias requires owning both TLDs. Otherwise this becomes a land-grab — claim .agent,
absorb forty related words without registering any — and first-come-first-served stops
meaning anything.

Chains are rejected, not followed. A TLD is either a target or an alias, never both.
Resolution is a single hop and a cycle is impossible to construct, rather than something to
detect at read time forever. Checked in both directions: can't alias to something already
aliased, can't alias something that's already a target.

The label carries across. An alias redirects the namespace, not the name — everything
under it keeps its identity on the other side.

Exemptions are evaluated at resolve time, not baked in when the alias is set, so they
survive the alias being repointed. They can also be created before any alias exists — you
should be able to carve out what you're keeping before redirecting everyone, not redirect
first and repair after.

One parser detail worth flagging

parseMoshpitName rejects a.b.c rather than guessing which two parts were meant. The
namespace is one level deep, and a parser that guesses is a resolver that sends people
somewhere they never asked for. It reuses the TLD label rule instead of keeping a second copy
that can drift.

Verified

• tsc --noEmit clean
• next build succeeds, all five routes in the table
• bun test tests/ — 46 pass, 0 fail

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.