Runbook — repair domains.region after the create-path fix

One-time deploy step. Required on any deployment whose AWS_REGION is not us-east-1 and that added domains before the fix landed. A us-east-1 deployment is unaffected — the wrong value and the right value are the same string there.

This deployment runs AWS_REGION=ap-southeast-2, so it needs it.

Why

createDomainIdentity has always created the SES identity in AWS_REGION. Until the fix, both add-domain routes then inserted a domains row with no region, so Postgres filled in the schema column default "us-east-1" (src/lib/db/schema/domains.ts). Every row written before the fix therefore names a region its identity was never in, and every later operation keys off the row, not off the env:

• domain-verify-poll calls checkDomainStatus(d.domain, d.region), gets NotFoundException from us-east-1, and substitutes verified: false. The "identity missing" early return is guarded on !wasVerified, so a row that is already verified skips it, falls through to justUnverified, flips to pending and fans out a domain.unverified webhook at the customer — for a domain that is verified and sending.
• Deleting a domain (internal/domains) calls deleteDomainIdentity(record.domain, record.region), so the delete goes to us-east-1, finds nothing, and the real ap-southeast-2 identity survives and keeps sending. The row is gone by then, so nothing in the product mentions that identity again.

The fix stops new rows being written wrong. It does not touch the rows that already are — nothing self-heals.

Run it dry first

scripts/repair-domain-regions.ts is dry run by default: it prints every row it would change and writes nothing.

npx tsx --env-file=.env scripts/repair-domain-regions.ts

It does not guess the target region. For each domains row it issues GetEmailIdentity in every plausible region (ALLOWED_REGIONS, plus AWS_REGION and the row's own value when those sit outside that list) and records which regions answer. Read-only at AWS in both modes — --apply changes what happens in Postgres and nothing else.

Read the output, then apply:

npx tsx --env-file=.env scripts/repair-domain-regions.ts --apply

⚠️ Dev and prod share one Neon database. There is no staging copy to rehearse against — whatever DATABASE_URL resolves to is production. Run the dry pass and read it before --apply.

Idempotent and resumable: a second run finds the rows it corrected already correct and writes nothing. Exit code is 0 when every row resolved to exactly one region, 1 when any row needs a human.

What it will not write, and what to do about it

Only a row whose identity is found in exactly one region is corrected automatically. Three outcomes are reported and left alone:

After

Nothing else to do — no migration, no redeploy. The schema default stays "us-east-1"; it is simply no longer reachable from either create path, which src/app/api/domain-create-region.test.ts asserts.