@hasna/domains 0.0.12 → 0.0.14

package/dist/cli/index.js

@@ -19207,7 +19207,7 @@ var require_package = __commonJS((exports, module) => {
 
 // node_modules/@aws-sdk/util-user-agent-node/dist-cjs/index.js
 var require_dist_cjs41 = __commonJS((exports) => {
-  var __dirname = "/Users/hasna/Workspace/hasna/opensource/open-domains/node_modules/@aws-sdk/util-user-agent-node/dist-cjs";
+  var __dirname = "/home/hasna/workspace/hasna/opensource/open-domains/node_modules/@aws-sdk/util-user-agent-node/dist-cjs";
   var node_os = __require("os");
   var node_process = __require("process");
   var utilConfigProvider = require_dist_cjs33();
@@ -25599,6 +25599,322 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
 
+// src/lib/cloudflare-auth.ts
+function resolveCloudflareConfig(env = process.env) {
+  const accountId = env["CLOUDFLARE_ACCOUNT_ID"] || env["HASNAXYZ_CLOUDFLARE_LIVE_ACCOUNT_ID"] || undefined;
+  if (env["CLOUDFLARE_API_TOKEN"]) {
+    return { apiToken: env["CLOUDFLARE_API_TOKEN"], accountId };
+  }
+  if (env["CLOUDFLARE_API_KEY"] && env["CLOUDFLARE_EMAIL"]) {
+    return { apiKey: env["CLOUDFLARE_API_KEY"], email: env["CLOUDFLARE_EMAIL"], accountId };
+  }
+  if (env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"] && env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"]) {
+    return {
+      apiKey: env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"],
+      email: env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"],
+      accountId
+    };
+  }
+  return accountId ? { accountId } : {};
+}
+function cloudflareAuthHeaders(cfg) {
+  if (cfg.apiToken)
+    return { Authorization: `Bearer ${cfg.apiToken}` };
+  if (cfg.apiKey && cfg.email)
+    return { "X-Auth-Key": cfg.apiKey, "X-Auth-Email": cfg.email };
+  throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.");
+}
+
+// src/lib/brandsight.ts
+function resolveBrandsightConfig(env = process.env) {
+  return {
+    apiKey: env["BRANDSIGHT_API_KEY"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_API_KEY"] ?? "",
+    apiSecret: env["BRANDSIGHT_API_SECRET"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_API_SECRET"],
+    customerId: env["BRANDSIGHT_CUSTOMER_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_CUSTOMER_ID"],
+    shopperId: env["BRANDSIGHT_SHOPPER_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_SHOPPER_ID"],
+    accountId: env["BRANDSIGHT_ACCOUNT_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_CUSTOMER_ID"]
+  };
+}
+function getApiKey() {
+  const key = process.env["BRANDSIGHT_API_KEY"];
+  if (!key) {
+    throw new BrandsightApiError("BRANDSIGHT_API_KEY environment variable is not set");
+  }
+  return key;
+}
+function getConfig4() {
+  return {
+    apiKey: process.env["BRANDSIGHT_API_KEY"] ?? "",
+    accountId: process.env["BRANDSIGHT_ACCOUNT_ID"]
+  };
+}
+async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const url = `${baseUrl}${path}`;
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "User-Agent": USER_AGENT
+  };
+  try {
+    const response = await fetchFn(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
+    }
+    const data = await response.json();
+    return { data, stub: false };
+  } catch (error) {
+    if (error instanceof BrandsightApiError)
+      throw error;
+    return { data: null, stub: true };
+  }
+}
+async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const url = `${baseUrl}${path}`;
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "User-Agent": USER_AGENT
+  };
+  try {
+    const response = await fetchFn(url, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
+    }
+    const data = await response.json();
+    return { data, stub: false };
+  } catch (error) {
+    if (error instanceof BrandsightApiError)
+      throw error;
+    return { data: null, stub: true };
+  }
+}
+function generateStubAlerts(brandName) {
+  const now = new Date().toISOString();
+  return [
+    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now },
+    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now },
+    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now }
+  ];
+}
+function generateStubSimilarDomains(domain) {
+  const base = domain.replace(/\.[^.]+$/, "");
+  const tld = domain.slice(base.length);
+  return [
+    `${base}-online${tld}`,
+    `${base}s${tld}`,
+    `${base.replace(/a/gi, "4")}${tld}`,
+    `${base}-app${tld}`,
+    `get${base}${tld}`
+  ];
+}
+function generateStubThreatAssessment(domain) {
+  return {
+    domain,
+    risk_level: "low",
+    threats: [],
+    recommendation: "No immediate threats detected. Continue routine monitoring."
+  };
+}
+async function monitorBrand(brandName) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/brands/${encodeURIComponent(brandName)}/monitor`, apiKey);
+  if (result.stub) {
+    return { brand: brandName, alerts: generateStubAlerts(brandName), stub: true };
+  }
+  return { brand: brandName, alerts: result.data.alerts, stub: false };
+}
+async function getSimilarDomains(domain) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/similar`, apiKey);
+  if (result.stub) {
+    return { domain, similar: generateStubSimilarDomains(domain), stub: true };
+  }
+  return { domain, similar: result.data.similar, stub: false };
+}
+async function getThreatAssessment(domain) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/threats`, apiKey);
+  if (result.stub) {
+    return { ...generateStubThreatAssessment(domain), stub: true };
+  }
+  return { ...result.data, stub: false };
+}
+async function listDomains2(config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet("/portfolio/domains", cfg.apiKey);
+  if (result.stub)
+    return [];
+  return result.data.domains ?? [];
+}
+async function getDomainInfo3(domain, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
+  if (result.stub)
+    return null;
+  return result.data;
+}
+async function checkAvailability4(domain, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
+  if (result.stub)
+    return { domain, available: false };
+  return result.data;
+}
+async function renewDomain3(domain, years = 1, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
+  if (result.stub)
+    return { success: false };
+  return { success: true, orderId: result.data.orderId };
+}
+async function syncToLocalDb3(dbFns, config) {
+  const domains = await listDomains2(config);
+  let synced = 0, created = 0, updated = 0;
+  const errors = [];
+  for (const d3 of domains) {
+    try {
+      const existing = dbFns.getDomainByName(d3.domain);
+      if (existing) {
+        dbFns.updateDomain(existing.id, {
+          registrar: "Brandsight",
+          expires_at: d3.expires || undefined,
+          auto_renew: d3.auto_renew,
+          status: "active",
+          nameservers: d3.nameservers
+        });
+        updated++;
+      } else {
+        dbFns.createDomain({
+          name: d3.domain,
+          registrar: "Brandsight",
+          expires_at: d3.expires || undefined,
+          auto_renew: d3.auto_renew,
+          status: "active",
+          nameservers: d3.nameservers
+        });
+        created++;
+      }
+      synced++;
+    } catch (err) {
+      errors.push(`${d3.domain}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { synced, created, updated, errors };
+}
+function createBrandsightProvider(config) {
+  const cfg = config ?? getConfig4();
+  return {
+    name: "brandsight",
+    async listDomains() {
+      const domains = await listDomains2(cfg);
+      return domains.map((d3) => ({
+        domain: d3.domain,
+        registrar: "Brandsight",
+        created: "",
+        expires: d3.expires,
+        nameservers: d3.nameservers,
+        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
+        auto_renew: d3.auto_renew
+      }));
+    },
+    async getDomainInfo(domain) {
+      const d3 = await getDomainInfo3(domain, cfg);
+      if (!d3)
+        throw new Error(`Domain not found in Brandsight: ${domain}`);
+      return {
+        domain: d3.domain,
+        registrar: "Brandsight",
+        created: "",
+        expires: d3.expires,
+        nameservers: d3.nameservers,
+        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
+        auto_renew: d3.auto_renew
+      };
+    },
+    async renewDomain(domain) {
+      const result = await renewDomain3(domain, 1, cfg);
+      return { domain, success: result.success, orderId: result.orderId };
+    },
+    async checkAvailability(domain) {
+      const result = await checkAvailability4(domain, cfg);
+      return {
+        domain: result.domain,
+        available: result.available,
+        standard_price: result.price,
+        currency: result.currency
+      };
+    },
+    async syncToLocalDb(dbFns) {
+      return syncToLocalDb3(dbFns, cfg);
+    }
+  };
+}
+var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
+var init_brandsight = __esm(() => {
+  init_version();
+  BrandsightApiError = class BrandsightApiError extends Error {
+    statusCode;
+    responseBody;
+    constructor(message, statusCode, responseBody) {
+      super(message);
+      this.statusCode = statusCode;
+      this.responseBody = responseBody;
+      this.name = "BrandsightApiError";
+    }
+  };
+});
+
+// src/lib/creds-check.ts
+var exports_creds_check = {};
+__export(exports_creds_check, {
+  checkProvisioningCredentials: () => checkProvisioningCredentials
+});
+function checkProvisioningCredentials(env = process.env) {
+  const out = [];
+  const hasAws = !!(env["AWS_ACCESS_KEY_ID"] && env["AWS_SECRET_ACCESS_KEY"]) || !!env["AWS_PROFILE"];
+  out.push({
+    provider: "route53",
+    configured: hasAws,
+    mode: env["AWS_PROFILE"] ? `profile:${env["AWS_PROFILE"]}` : hasAws ? "access-keys" : "none",
+    detail: hasAws ? "AWS credentials present (region us-east-1 for Route53 Domains)" : "Set AWS_PROFILE or AWS_ACCESS_KEY_ID/SECRET"
+  });
+  const cf = resolveCloudflareConfig(env);
+  const cfMode = cf.apiToken ? "token" : cf.apiKey && cf.email ? "global-key" : "none";
+  out.push({
+    provider: "cloudflare",
+    configured: cfMode !== "none",
+    mode: cfMode + (cf.accountId ? "+account" : ""),
+    detail: cfMode === "none" ? "Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY+CLOUDFLARE_EMAIL" : cf.accountId ? "ok" : "missing CLOUDFLARE_ACCOUNT_ID (needed to create zones)"
+  });
+  const bs = resolveBrandsightConfig(env);
+  const bsConfigured = !!(bs.apiKey && bs.apiSecret && bs.customerId);
+  out.push({
+    provider: "brandsight",
+    configured: bsConfigured,
+    mode: bsConfigured ? "full-creds" : "none",
+    detail: "enterprise/contract-only (gated) \u2014 not used for automated purchase"
+  });
+  const gd = !!(env["GODADDY_API_KEY"] && env["GODADDY_API_SECRET"]);
+  out.push({ provider: "godaddy", configured: gd, mode: gd ? "key+secret" : "none", detail: "retail API gated for purchase/DNS since 2024" });
+  return out;
+}
+var init_creds_check = __esm(() => {
+  init_brandsight();
+});
+
 // src/db/domain-history.ts
 function rowToDomainHistory(row) {
   return {
@@ -31990,6 +32306,7 @@ var _Ex = "Expiry";
 var _F2 = "Fax";
 var _FC = "FilterCondition";
 var _FCi = "FilterConditions";
+var _FIAK = "FIAuthKey";
 var _FN = "FirstName";
 var _Fl2 = "Flags";
 var _GDD = "GetDomainDetail";
@@ -32063,6 +32380,9 @@ var _TTD = "TagsToDelete";
 var _Tl = "Tld";
 var _Ty = "Type";
 var _UD = "UpdatedDate";
+var _UDN = "UpdateDomainNameservers";
+var _UDNR = "UpdateDomainNameserversRequest";
+var _UDNRp = "UpdateDomainNameserversResponse";
 var _UTLD = "UnsupportedTLD";
 var _V2 = "Value";
 var _Va = "Values";
@@ -32153,6 +32473,7 @@ var ContactNumber = [0, n02, _CNo2, 8, 0];
 var CountryCode = [0, n02, _CC2, 8, 0];
 var Email = [0, n02, _E, 8, 0];
 var ExtraParamValue = [0, n02, _EPV, 8, 0];
+var FIAuthKey = [0, n02, _FIAK, 8, 0];
 var State = [0, n02, _S2, 8, 0];
 var ZipCode = [0, n02, _ZC, 8, 0];
 var CheckDomainAvailabilityRequest$ = [
@@ -32349,8 +32670,25 @@ var SortCondition$ = [
   [0, 0],
   2
 ];
-var DnssecKeyList = [
-  1,
+var UpdateDomainNameserversRequest$ = [
+  3,
+  n02,
+  _UDNR,
+  0,
+  [_DN, _Na2, _FIAK],
+  [0, () => NameserverList, [() => FIAuthKey, 0]],
+  2
+];
+var UpdateDomainNameserversResponse$ = [
+  3,
+  n02,
+  _UDNRp,
+  0,
+  [_OI],
+  [0]
+];
+var DnssecKeyList = [
+  1,
   n02,
   _DKL,
   0,
@@ -32448,6 +32786,14 @@ var RegisterDomain$ = [
   () => RegisterDomainRequest$,
   () => RegisterDomainResponse$
 ];
+var UpdateDomainNameservers$ = [
+  9,
+  n02,
+  _UDN,
+  0,
+  () => UpdateDomainNameserversRequest$,
+  () => UpdateDomainNameserversResponse$
+];
 
 // node_modules/@aws-sdk/client-route-53-domains/dist-es/runtimeConfig.shared.js
 var getRuntimeConfig3 = (config) => {
@@ -32652,6 +32998,14 @@ class RegisterDomainCommand extends import_smithy_client23.Command.classBuilder(
 }).s("Route53Domains_v20140515", "RegisterDomain", {}).n("Route53DomainsClient", "RegisterDomainCommand").sc(RegisterDomain$).build() {
 }
 
+// node_modules/@aws-sdk/client-route-53-domains/dist-es/commands/UpdateDomainNameserversCommand.js
+var import_middleware_endpoint15 = __toESM(require_dist_cjs39(), 1);
+var import_smithy_client24 = __toESM(require_dist_cjs27(), 1);
+class UpdateDomainNameserversCommand extends import_smithy_client24.Command.classBuilder().ep(commonParams2).m(function(Command2, cs, config, o3) {
+  return [import_middleware_endpoint15.getEndpointPlugin(config, Command2.getEndpointParameterInstructions())];
+}).s("Route53Domains_v20140515", "UpdateDomainNameservers", {}).n("Route53DomainsClient", "UpdateDomainNameserversCommand").sc(UpdateDomainNameservers$).build() {
+}
+
 // src/lib/route53.ts
 function getConfig2() {
   return {
@@ -32751,6 +33105,17 @@ async function getDomainDetail(domain, config) {
     nameservers: (result.Nameservers ?? []).map((ns) => ns.Name ?? "").filter(Boolean)
   };
 }
+async function updateNameservers(domain, nameservers, config, client) {
+  if (!nameservers.length) {
+    throw new Error("updateNameservers requires at least one nameserver");
+  }
+  const domains = client ?? makeClients(config).domains;
+  const result = await domains.send(new UpdateDomainNameserversCommand({
+    DomainName: domain,
+    Nameservers: nameservers.map((name) => ({ Name: name }))
+  }));
+  return { operationId: result.OperationId ?? "" };
+}
 async function listRegisteredDomains(config) {
   const { domains } = makeClients(config);
   const all = [];
@@ -33036,15 +33401,10 @@ function createRoute53Provider(config) {
 
 // src/lib/cloudflare.ts
 function getConfig3() {
-  return {
-    apiToken: process.env["CLOUDFLARE_API_TOKEN"],
-    accountId: process.env["CLOUDFLARE_ACCOUNT_ID"]
-  };
+  return resolveCloudflareConfig();
 }
 function checkCredentials2(cfg) {
-  if (!cfg.apiToken) {
-    throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN environment variable.");
-  }
+  cloudflareAuthHeaders(cfg);
 }
 var CF_BASE = "https://api.cloudflare.com/client/v4";
 async function cfFetch(path, opts = {}) {
@@ -33053,7 +33413,7 @@ async function cfFetch(path, opts = {}) {
   const res = await fetch(`${CF_BASE}${path}`, {
     method: opts.method ?? "GET",
     headers: {
-      Authorization: `Bearer ${cfg.apiToken}`,
+      ...cloudflareAuthHeaders(cfg),
       "Content-Type": "application/json"
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined
@@ -33160,250 +33520,8 @@ function createCloudflareProvider(config) {
   };
 }
 
-// src/lib/brandsight.ts
-init_version();
-
-class BrandsightApiError extends Error {
-  statusCode;
-  responseBody;
-  constructor(message, statusCode, responseBody) {
-    super(message);
-    this.statusCode = statusCode;
-    this.responseBody = responseBody;
-    this.name = "BrandsightApiError";
-  }
-}
-var _fetchFn = null;
-function getApiKey() {
-  const key = process.env["BRANDSIGHT_API_KEY"];
-  if (!key) {
-    throw new BrandsightApiError("BRANDSIGHT_API_KEY environment variable is not set");
-  }
-  return key;
-}
-function getConfig4() {
-  return {
-    apiKey: process.env["BRANDSIGHT_API_KEY"] ?? "",
-    accountId: process.env["BRANDSIGHT_ACCOUNT_ID"]
-  };
-}
-var BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
-async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": USER_AGENT
-  };
-  try {
-    const response = await fetchFn(url, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
-  }
-}
-async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": USER_AGENT
-  };
-  try {
-    const response = await fetchFn(url, {
-      method: "GET",
-      headers,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
-  }
-}
-function generateStubAlerts(brandName) {
-  const now = new Date().toISOString();
-  return [
-    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now },
-    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now },
-    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now }
-  ];
-}
-function generateStubSimilarDomains(domain) {
-  const base = domain.replace(/\.[^.]+$/, "");
-  const tld = domain.slice(base.length);
-  return [
-    `${base}-online${tld}`,
-    `${base}s${tld}`,
-    `${base.replace(/a/gi, "4")}${tld}`,
-    `${base}-app${tld}`,
-    `get${base}${tld}`
-  ];
-}
-function generateStubThreatAssessment(domain) {
-  return {
-    domain,
-    risk_level: "low",
-    threats: [],
-    recommendation: "No immediate threats detected. Continue routine monitoring."
-  };
-}
-async function monitorBrand(brandName) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/brands/${encodeURIComponent(brandName)}/monitor`, apiKey);
-  if (result.stub) {
-    return { brand: brandName, alerts: generateStubAlerts(brandName), stub: true };
-  }
-  return { brand: brandName, alerts: result.data.alerts, stub: false };
-}
-async function getSimilarDomains(domain) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/similar`, apiKey);
-  if (result.stub) {
-    return { domain, similar: generateStubSimilarDomains(domain), stub: true };
-  }
-  return { domain, similar: result.data.similar, stub: false };
-}
-async function getThreatAssessment(domain) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/threats`, apiKey);
-  if (result.stub) {
-    return { ...generateStubThreatAssessment(domain), stub: true };
-  }
-  return { ...result.data, stub: false };
-}
-async function listDomains2(config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet("/portfolio/domains", cfg.apiKey);
-  if (result.stub)
-    return [];
-  return result.data.domains ?? [];
-}
-async function getDomainInfo3(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return null;
-  return result.data;
-}
-async function checkAvailability4(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return { domain, available: false };
-  return result.data;
-}
-async function renewDomain3(domain, years = 1, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
-  if (result.stub)
-    return { success: false };
-  return { success: true, orderId: result.data.orderId };
-}
-async function syncToLocalDb3(dbFns, config) {
-  const domains = await listDomains2(config);
-  let synced = 0, created = 0, updated = 0;
-  const errors = [];
-  for (const d3 of domains) {
-    try {
-      const existing = dbFns.getDomainByName(d3.domain);
-      if (existing) {
-        dbFns.updateDomain(existing.id, {
-          registrar: "Brandsight",
-          expires_at: d3.expires || undefined,
-          auto_renew: d3.auto_renew,
-          status: "active",
-          nameservers: d3.nameservers
-        });
-        updated++;
-      } else {
-        dbFns.createDomain({
-          name: d3.domain,
-          registrar: "Brandsight",
-          expires_at: d3.expires || undefined,
-          auto_renew: d3.auto_renew,
-          status: "active",
-          nameservers: d3.nameservers
-        });
-        created++;
-      }
-      synced++;
-    } catch (err) {
-      errors.push(`${d3.domain}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return { synced, created, updated, errors };
-}
-function createBrandsightProvider(config) {
-  const cfg = config ?? getConfig4();
-  return {
-    name: "brandsight",
-    async listDomains() {
-      const domains = await listDomains2(cfg);
-      return domains.map((d3) => ({
-        domain: d3.domain,
-        registrar: "Brandsight",
-        created: "",
-        expires: d3.expires,
-        nameservers: d3.nameservers,
-        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
-        auto_renew: d3.auto_renew
-      }));
-    },
-    async getDomainInfo(domain) {
-      const d3 = await getDomainInfo3(domain, cfg);
-      if (!d3)
-        throw new Error(`Domain not found in Brandsight: ${domain}`);
-      return {
-        domain: d3.domain,
-        registrar: "Brandsight",
-        created: "",
-        expires: d3.expires,
-        nameservers: d3.nameservers,
-        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
-        auto_renew: d3.auto_renew
-      };
-    },
-    async renewDomain(domain) {
-      const result = await renewDomain3(domain, 1, cfg);
-      return { domain, success: result.success, orderId: result.orderId };
-    },
-    async checkAvailability(domain) {
-      const result = await checkAvailability4(domain, cfg);
-      return {
-        domain: result.domain,
-        available: result.available,
-        standard_price: result.price,
-        currency: result.currency
-      };
-    },
-    async syncToLocalDb(dbFns) {
-      return syncToLocalDb3(dbFns, cfg);
-    }
-  };
-}
-
 // src/lib/registrar.ts
+init_brandsight();
 function createNamecheapProvider() {
   return {
     name: "namecheap",
@@ -33732,6 +33850,16 @@ function resolveContact(opts) {
   return { first_name, last_name, email, phone, address_line_1, city, state, country_code, zip_code, organization_name };
 }
 
+// src/lib/delegate.ts
+async function delegateDomainToCloudflare(domain, deps) {
+  const zone = await deps.createCloudflareZone(domain);
+  if (!zone.nameservers || zone.nameservers.length === 0) {
+    throw new Error(`Cloudflare zone for ${domain} returned no nameservers; cannot delegate`);
+  }
+  const { operationId } = await deps.updateNameservers(domain, zone.nameservers);
+  return { zoneId: zone.id, nameservers: zone.nameservers, operationId };
+}
+
 // src/cli/commands/domain.ts
 var DOMAIN_STATUS_HELP = DOMAIN_STATUSES.join("/");
 var DOMAIN_OFFER_STATUS_HELP = DOMAIN_OFFER_STATUSES.join("/");
@@ -34155,7 +34283,7 @@ WHOIS for ${result.domain} [${result.source}]:`);
       process.exit(1);
     }
   });
-  domain.command("buy <name>").description("Purchase a domain via Route 53 (contact defaults from: domains config set contact.*)").option("--provider <name>", "Registrar provider (default: config default-registrar or route53)").option("--registrar <name>", "Registrar/seller for recorded purchases (alias of --provider)").option("--email <email>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--price <amount>", "Record a completed purchase instead of registering via Route 53").option("--expires <date>", "Expiry date for recorded purchases").option("--auto-renew <bool>", "Auto-renew for recorded purchases (true/false)").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes").action(async (name, opts) => {
+  domain.command("buy <name>").description("Purchase a domain via Route 53 (contact defaults from: domains config set contact.*)").option("--provider <name>", "Registrar provider (default: config default-registrar or route53)").option("--registrar <name>", "Registrar/seller for recorded purchases (alias of --provider)").option("--email <email>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--price <amount>", "Record a completed purchase instead of registering via Route 53").option("--expires <date>", "Expiry date for recorded purchases").option("--auto-renew <bool>", "Auto-renew for recorded purchases (true/false)").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes").option("--dns <provider>", "DNS provider to delegate to after purchase (always cloudflare)", "cloudflare").option("--no-delegate", "Skip delegating DNS to Cloudflare after purchase").action(async (name, opts) => {
     const recordedPrice = parseOptionalNumber(opts.price, "--price");
     if (recordedPrice !== undefined) {
       const registrarName = opts.registrar ?? opts.provider ?? "manual";
@@ -34238,6 +34366,30 @@ WHOIS for ${result.domain} [${result.source}]:`);
         });
       }
       console.log(`\u2713 Added to portfolio`);
+      const dnsProvider = opts.dns ?? "cloudflare";
+      if (opts.delegate !== false && dnsProvider === "cloudflare") {
+        if (!opts.wait) {
+          console.log(`  DNS: run 'domains domain buy ${name} --wait' or delegate later \u2014 registration must finish before NS can change.`);
+        } else {
+          try {
+            console.log(`Delegating DNS to Cloudflare...`);
+            const del = await delegateDomainToCloudflare(name, {
+              createCloudflareZone: async (d3) => {
+                const z2 = await createZone(d3);
+                return { id: z2.id, nameservers: z2.nameservers };
+              },
+              updateNameservers: (d3, ns) => updateNameservers(d3, ns)
+            });
+            const existing2 = getDomainByName(name);
+            if (existing2)
+              updateDomain(existing2.id, { nameservers: del.nameservers });
+            console.log(`\u2713 Cloudflare zone ${del.zoneId}; nameservers \u2192 ${del.nameservers.join(", ")} (op ${del.operationId})`);
+          } catch (e3) {
+            console.error(`\u26A0 DNS delegation failed (domain is registered): ${e3 instanceof Error ? e3.message : String(e3)}`);
+            console.error(`  Retry: create the Cloudflare zone and point Route53 NS at it.`);
+          }
+        }
+      }
       if (!opts.wait)
         console.log(`  Check: domains r53 status ${reg.operationId}`);
     } catch (e3) {
@@ -34749,6 +34901,7 @@ function registerAlertCommands(program2) {
 }
 
 // src/cli/commands/monitor.ts
+init_brandsight();
 function registerMonitorCommand(program2) {
   const monitor = program2.command("monitor").description("Brand monitoring and threat detection (Brandsight)");
   monitor.command("watch <brand>").description("Monitor a brand for new lookalike domain registrations").option("--json", "Output JSON").action(async (brand, opts) => {
@@ -35193,6 +35346,14 @@ function registerDoctorCommand(program2) {
       ok("Registrant contact info complete");
     else
       fail(`Missing contact fields: ${missingContact.join(", ")}`, "domains config set contact.<field> <value>");
+    section("Provisioning Credentials");
+    const { checkProvisioningCredentials: checkProvisioningCredentials2 } = await Promise.resolve().then(() => (init_creds_check(), exports_creds_check));
+    for (const c3 of checkProvisioningCredentials2()) {
+      if (c3.configured)
+        ok(`${c3.provider}: ${c3.mode} \u2014 ${c3.detail}`);
+      else
+        fail(`${c3.provider}: not configured (${c3.detail})`);
+    }
     section("Providers");
     const providers = getAvailableProviders().filter((p3) => p3.name !== "brandsight");
     for (const p3 of providers) {
@@ -37250,6 +37411,67 @@ function registerWalletCommand(program2) {
   });
 }
 
+// src/lib/provision-state.ts
+var DOMAIN_FLOW = {
+  requested: { action: "register", next: "registered" },
+  registered: { action: "create_cf_zone", next: "cf_zone_ready" },
+  cf_zone_ready: { action: "delegate_ns", next: "ns_delegated" },
+  ns_delegated: { action: "check_ns_propagation", next: "ns_propagated" },
+  ns_propagated: { action: "verify_dns", next: "dns_managed" },
+  dns_managed: { action: "finalize", next: "ready" }
+};
+var TERMINAL = new Set(["ready", "failed"]);
+function domainHappyPath() {
+  return [...Object.keys(DOMAIN_FLOW), "ready"];
+}
+function deriveDomainState(sig) {
+  if (!sig.registered)
+    return "requested";
+  if (!sig.zoneExists)
+    return "registered";
+  if (!sig.registrarNsAreCloudflare)
+    return "cf_zone_ready";
+  if (!sig.publicNsAreCloudflare)
+    return "ns_delegated";
+  if (!sig.zoneActive)
+    return "ns_propagated";
+  return "ready";
+}
+
+// src/cli/commands/provision.ts
+var CF_NS_SUFFIX = ".ns.cloudflare.com";
+function registerProvisionCommand(program2) {
+  const provision = program2.command("provision").description("Domain provisioning lifecycle");
+  provision.command("status <name>").description("Show the provisioning state of a domain (derived from live signals)").action(async (name) => {
+    const signals = {};
+    try {
+      const detail = await getDomainDetail(name).catch(() => null);
+      signals["registered"] = !!detail;
+      const registrarNs = detail?.nameservers ?? [];
+      signals["registrarNsAreCloudflare"] = registrarNs.length > 0 && registrarNs.every((n3) => n3.includes(CF_NS_SUFFIX));
+      const zone = await getZone(name).catch(() => null);
+      signals["zoneExists"] = !!zone;
+      signals["zoneActive"] = zone?.status === "active";
+      try {
+        const resolved = await (await import("dns")).promises.resolveNs(name).catch(() => []);
+        signals["publicNsAreCloudflare"] = resolved.length > 0 && resolved.every((n3) => n3.includes(CF_NS_SUFFIX));
+      } catch {
+        signals["publicNsAreCloudflare"] = false;
+      }
+    } catch (e3) {
+      console.error(`Error gathering signals: ${e3 instanceof Error ? e3.message : String(e3)}`);
+    }
+    const state = deriveDomainState(signals);
+    console.log(`
+Domain: ${name}`);
+    console.log(`State:  ${state}`);
+    console.log(`Signals: ${JSON.stringify(signals)}`);
+    const path = domainHappyPath();
+    const idx = path.indexOf(state);
+    console.log(`Progress: ${idx >= 0 ? idx + 1 : "?"}/${path.length}  [${path.join(" \u2192 ")}]`);
+  });
+}
+
 // src/cli/index.ts
 init_version();
 var program2 = new Command;
@@ -37273,4 +37495,5 @@ registerResearchCommand(program2);
 registerOutreachCommand(program2);
 registerSedoCommand(program2);
 registerWalletCommand(program2);
+registerProvisionCommand(program2);
 program2.parse(process.argv);