@hasna/domains 0.0.12 → 0.0.14

package/dist/index.d.ts

@@ -7,5 +7,10 @@ export { createAlert, getAlert, listAlerts, deleteAlert, type Alert, type Create
 export { whoisLookup, checkDnsPropagation, checkSsl, exportZoneFile, importZoneFile, discoverSubdomains, validateDns, exportPortfolio, checkAllDomains, type WhoisResult, type DnsPropagationResult, type SslCheckResult, type ZoneImportResult, type SubdomainResult, type DnsValidationIssue, type DnsValidationResult, type BulkCheckResult, } from "./db/domains.js";
 export { getDatabase, closeDatabase } from "./db/database.js";
 export { getProvider, getAvailableProviders, syncAll, autoDetectRegistrar, type RegistrarProvider, type ProviderDnsRecord, type ProviderDomainInfo, type ProviderAvailability, type ProviderInfo, type SyncAllResult, } from "./lib/registrar.js";
-export { checkAvailability as r53CheckAvailability, registerDomain as r53RegisterDomain, getRegistrationStatus as r53GetRegistrationStatus, listRegisteredDomains as r53ListRegisteredDomains, createHostedZone as r53CreateHostedZone, listHostedZones as r53ListHostedZones, getHostedZone as r53GetHostedZone, deleteHostedZone as r53DeleteHostedZone, findHostedZoneByDomain as r53FindHostedZoneByDomain, listRecords as r53ListRecords, upsertRecord as r53UpsertRecord, upsertRecords as r53UpsertRecords, deleteRecord as r53DeleteRecord, createRoute53Provider, getConfig as r53GetConfig, type Route53Config, type DomainContactInfo, type DomainAvailability, type RegisteredDomain, type HostedZoneInfo, type Route53Record, type Route53RecordInput, } from "./lib/route53.js";
+export { checkAvailability as r53CheckAvailability, registerDomain as r53RegisterDomain, getRegistrationStatus as r53GetRegistrationStatus, updateNameservers as r53UpdateNameservers, listRegisteredDomains as r53ListRegisteredDomains, createHostedZone as r53CreateHostedZone, listHostedZones as r53ListHostedZones, getHostedZone as r53GetHostedZone, deleteHostedZone as r53DeleteHostedZone, findHostedZoneByDomain as r53FindHostedZoneByDomain, listRecords as r53ListRecords, upsertRecord as r53UpsertRecord, upsertRecords as r53UpsertRecords, deleteRecord as r53DeleteRecord, createRoute53Provider, getConfig as r53GetConfig, type Route53Config, type DomainContactInfo, type DomainAvailability, type RegisteredDomain, type HostedZoneInfo, type Route53Record, type Route53RecordInput, } from "./lib/route53.js";
+export { createZone as cfCreateZone, getZone as cfGetZone, ensureZone as cfEnsureZone, upsertRecord as cfUpsertRecord, type CloudflareZone, } from "./lib/cloudflare.js";
+export { resolveCloudflareConfig, cloudflareAuthHeaders, type CloudflareConfig } from "./lib/cloudflare-auth.js";
+export { delegateDomainToCloudflare, type DelegateResult } from "./lib/delegate.js";
+export { PROVIDER_CAPABILITIES, getCapability, canBuy, selectBuyRegistrar, selectDnsProvider, type ProviderCapability, } from "./lib/capability.js";
+export { classifyRegistrationStatus, pollRegistrationUntilDone, type RegVerdict, type PollResult as RegistrationPollResult, } from "./lib/registration-poll.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,KAAK,KAAK,EACV,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,cAAc,IAAI,iBAAiB,EACnC,qBAAqB,IAAI,wBAAwB,EACjD,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,eAAe,IAAI,kBAAkB,EACrC,aAAa,IAAI,gBAAgB,EACjC,gBAAgB,IAAI,mBAAmB,EACvC,sBAAsB,IAAI,yBAAyB,EACnD,WAAW,IAAI,cAAc,EAC7B,YAAY,IAAI,eAAe,EAC/B,aAAa,IAAI,gBAAgB,EACjC,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,SAAS,IAAI,YAAY,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,KAAK,KAAK,EACV,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,cAAc,IAAI,iBAAiB,EACnC,qBAAqB,IAAI,wBAAwB,EACjD,iBAAiB,IAAI,oBAAoB,EACzC,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,eAAe,IAAI,kBAAkB,EACrC,aAAa,IAAI,gBAAgB,EACjC,gBAAgB,IAAI,mBAAmB,EACvC,sBAAsB,IAAI,yBAAyB,EACnD,WAAW,IAAI,cAAc,EAC7B,YAAY,IAAI,eAAe,EAC/B,aAAa,IAAI,gBAAgB,EACjC,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,SAAS,IAAI,YAAY,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,UAAU,IAAI,YAAY,EAC1B,OAAO,IAAI,SAAS,EACpB,UAAU,IAAI,YAAY,EAC1B,YAAY,IAAI,cAAc,EAC9B,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,UAAU,EACf,KAAK,UAAU,IAAI,sBAAsB,GAC1C,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -15823,7 +15823,7 @@ var require_package = __commonJS((exports, module) => {
 
 // node_modules/@aws-sdk/util-user-agent-node/dist-cjs/index.js
 var require_dist_cjs41 = __commonJS((exports) => {
-  var __dirname = "/Users/hasna/Workspace/hasna/opensource/open-domains/node_modules/@aws-sdk/util-user-agent-node/dist-cjs";
+  var __dirname = "/home/hasna/workspace/hasna/opensource/open-domains/node_modules/@aws-sdk/util-user-agent-node/dist-cjs";
   var node_os = __require("os");
   var node_process = __require("process");
   var utilConfigProvider = require_dist_cjs33();
@@ -29640,6 +29640,7 @@ var _Ex = "Expiry";
 var _F2 = "Fax";
 var _FC = "FilterCondition";
 var _FCi = "FilterConditions";
+var _FIAK = "FIAuthKey";
 var _FN = "FirstName";
 var _Fl2 = "Flags";
 var _GDD = "GetDomainDetail";
@@ -29713,6 +29714,9 @@ var _TTD = "TagsToDelete";
 var _Tl = "Tld";
 var _Ty = "Type";
 var _UD = "UpdatedDate";
+var _UDN = "UpdateDomainNameservers";
+var _UDNR = "UpdateDomainNameserversRequest";
+var _UDNRp = "UpdateDomainNameserversResponse";
 var _UTLD = "UnsupportedTLD";
 var _V2 = "Value";
 var _Va = "Values";
@@ -29803,6 +29807,7 @@ var ContactNumber = [0, n02, _CNo2, 8, 0];
 var CountryCode = [0, n02, _CC2, 8, 0];
 var Email = [0, n02, _E, 8, 0];
 var ExtraParamValue = [0, n02, _EPV, 8, 0];
+var FIAuthKey = [0, n02, _FIAK, 8, 0];
 var State = [0, n02, _S2, 8, 0];
 var ZipCode = [0, n02, _ZC, 8, 0];
 var CheckDomainAvailabilityRequest$ = [
@@ -29999,6 +30004,23 @@ var SortCondition$ = [
   [0, 0],
   2
 ];
+var UpdateDomainNameserversRequest$ = [
+  3,
+  n02,
+  _UDNR,
+  0,
+  [_DN, _Na2, _FIAK],
+  [0, () => NameserverList, [() => FIAuthKey, 0]],
+  2
+];
+var UpdateDomainNameserversResponse$ = [
+  3,
+  n02,
+  _UDNRp,
+  0,
+  [_OI],
+  [0]
+];
 var DnssecKeyList = [
   1,
   n02,
@@ -30098,6 +30120,14 @@ var RegisterDomain$ = [
   () => RegisterDomainRequest$,
   () => RegisterDomainResponse$
 ];
+var UpdateDomainNameservers$ = [
+  9,
+  n02,
+  _UDN,
+  0,
+  () => UpdateDomainNameserversRequest$,
+  () => UpdateDomainNameserversResponse$
+];
 
 // node_modules/@aws-sdk/client-route-53-domains/dist-es/runtimeConfig.shared.js
 var getRuntimeConfig3 = (config) => {
@@ -30302,6 +30332,14 @@ class RegisterDomainCommand extends import_smithy_client23.Command.classBuilder(
 }).s("Route53Domains_v20140515", "RegisterDomain", {}).n("Route53DomainsClient", "RegisterDomainCommand").sc(RegisterDomain$).build() {
 }
 
+// node_modules/@aws-sdk/client-route-53-domains/dist-es/commands/UpdateDomainNameserversCommand.js
+var import_middleware_endpoint15 = __toESM(require_dist_cjs39(), 1);
+var import_smithy_client24 = __toESM(require_dist_cjs27(), 1);
+class UpdateDomainNameserversCommand extends import_smithy_client24.Command.classBuilder().ep(commonParams2).m(function(Command, cs, config, o3) {
+  return [import_middleware_endpoint15.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];
+}).s("Route53Domains_v20140515", "UpdateDomainNameservers", {}).n("Route53DomainsClient", "UpdateDomainNameserversCommand").sc(UpdateDomainNameservers$).build() {
+}
+
 // src/lib/route53.ts
 function getConfig2() {
   return {
@@ -30401,6 +30439,17 @@ async function getDomainDetail(domain, config) {
     nameservers: (result.Nameservers ?? []).map((ns) => ns.Name ?? "").filter(Boolean)
   };
 }
+async function updateNameservers(domain, nameservers, config, client) {
+  if (!nameservers.length) {
+    throw new Error("updateNameservers requires at least one nameserver");
+  }
+  const domains = client ?? makeClients(config).domains;
+  const result = await domains.send(new UpdateDomainNameserversCommand({
+    DomainName: domain,
+    Nameservers: nameservers.map((name) => ({ Name: name }))
+  }));
+  return { operationId: result.OperationId ?? "" };
+}
 async function listRegisteredDomains(config) {
   const { domains } = makeClients(config);
   const all = [];
@@ -30684,17 +30733,38 @@ function createRoute53Provider(config) {
   };
 }
 
+// src/lib/cloudflare-auth.ts
+function resolveCloudflareConfig(env = process.env) {
+  const accountId = env["CLOUDFLARE_ACCOUNT_ID"] || env["HASNAXYZ_CLOUDFLARE_LIVE_ACCOUNT_ID"] || undefined;
+  if (env["CLOUDFLARE_API_TOKEN"]) {
+    return { apiToken: env["CLOUDFLARE_API_TOKEN"], accountId };
+  }
+  if (env["CLOUDFLARE_API_KEY"] && env["CLOUDFLARE_EMAIL"]) {
+    return { apiKey: env["CLOUDFLARE_API_KEY"], email: env["CLOUDFLARE_EMAIL"], accountId };
+  }
+  if (env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"] && env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"]) {
+    return {
+      apiKey: env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"],
+      email: env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"],
+      accountId
+    };
+  }
+  return accountId ? { accountId } : {};
+}
+function cloudflareAuthHeaders(cfg) {
+  if (cfg.apiToken)
+    return { Authorization: `Bearer ${cfg.apiToken}` };
+  if (cfg.apiKey && cfg.email)
+    return { "X-Auth-Key": cfg.apiKey, "X-Auth-Email": cfg.email };
+  throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.");
+}
+
 // src/lib/cloudflare.ts
 function getConfig3() {
-  return {
-    apiToken: process.env["CLOUDFLARE_API_TOKEN"],
-    accountId: process.env["CLOUDFLARE_ACCOUNT_ID"]
-  };
+  return resolveCloudflareConfig();
 }
 function checkCredentials2(cfg) {
-  if (!cfg.apiToken) {
-    throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN environment variable.");
-  }
+  cloudflareAuthHeaders(cfg);
 }
 var CF_BASE = "https://api.cloudflare.com/client/v4";
 async function cfFetch(path, opts = {}) {
@@ -30703,7 +30773,7 @@ async function cfFetch(path, opts = {}) {
   const res = await fetch(`${CF_BASE}${path}`, {
     method: opts.method ?? "GET",
     headers: {
-      Authorization: `Bearer ${cfg.apiToken}`,
+      ...cloudflareAuthHeaders(cfg),
       "Content-Type": "application/json"
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined
@@ -30722,6 +30792,24 @@ async function getZone(domain, config) {
   const z2 = result[0];
   return { id: z2.id, name: z2.name, status: z2.status, nameservers: z2.name_servers, original_nameservers: z2.original_name_servers };
 }
+async function createZone(domain, config) {
+  const cfg = config ?? getConfig3();
+  if (!cfg.accountId) {
+    throw new Error("CLOUDFLARE_ACCOUNT_ID is required to create a zone.");
+  }
+  const result = await cfFetch("/zones", { method: "POST", body: { name: domain, account: { id: cfg.accountId }, jump_start: false }, config: cfg });
+  return { id: result.id, name: result.name, status: result.status, nameservers: result.name_servers };
+}
+async function ensureZone(domain, config, deps) {
+  const get = deps?.getZone ?? getZone;
+  const create = deps?.createZone ?? createZone;
+  const existing = await get(domain, config);
+  const zone = existing ?? await create(domain, config);
+  if (!zone.nameservers || zone.nameservers.length === 0) {
+    throw new Error(`Cloudflare zone for ${domain} has no nameservers yet`);
+  }
+  return zone;
+}
 async function listRecords2(zoneId, config) {
   const records = [];
   let page = 1;
@@ -31231,6 +31319,72 @@ function autoDetectRegistrar(domain, getDomainByName2) {
     return "brandsight";
   return null;
 }
+// src/lib/delegate.ts
+async function delegateDomainToCloudflare(domain, deps) {
+  const zone = await deps.createCloudflareZone(domain);
+  if (!zone.nameservers || zone.nameservers.length === 0) {
+    throw new Error(`Cloudflare zone for ${domain} returned no nameservers; cannot delegate`);
+  }
+  const { operationId } = await deps.updateNameservers(domain, zone.nameservers);
+  return { zoneId: zone.id, nameservers: zone.nameservers, operationId };
+}
+// src/lib/capability.ts
+var PROVIDER_CAPABILITIES = {
+  route53: { canBuy: true, canDns: true, gated: false, notes: "Full self-serve buy + hosted zones via AWS API; primary buy path." },
+  cloudflare: { canBuy: false, canDns: true, gated: false, notes: "DNS/zone management only; not a registrar. Always our DNS." },
+  namecheap: { canBuy: true, canDns: true, gated: false, notes: "Buy + DNS via API; requires API access + whitelisted IP." },
+  godaddy: { canBuy: true, canDns: true, gated: true, notes: "Domains API gated behind account thresholds (>=10 / Discount Domain Club) since 2024; purchase + DNS writes unreliable." },
+  brandsight: { canBuy: true, canDns: true, gated: true, notes: "GoDaddy Corporate Domains (enterprise/contract-only); credentials issued to onboarded clients, not self-serve." }
+};
+var UNKNOWN = { canBuy: false, canDns: false, gated: true, notes: "Unknown provider." };
+function getCapability(name) {
+  return PROVIDER_CAPABILITIES[name.toLowerCase()] ?? UNKNOWN;
+}
+function canBuy(name) {
+  const c3 = getCapability(name);
+  return c3.canBuy && !c3.gated;
+}
+function selectBuyRegistrar(preference) {
+  if (preference) {
+    const c3 = getCapability(preference);
+    if (!c3.canBuy)
+      throw new Error(`Registrar '${preference}' cannot buy domains`);
+    if (c3.gated)
+      throw new Error(`Registrar '${preference}' is gated/enterprise-only and not available for automated purchase: ${c3.notes}`);
+    return preference.toLowerCase();
+  }
+  return "route53";
+}
+function selectDnsProvider() {
+  return "cloudflare";
+}
+// src/lib/registration-poll.ts
+function classifyRegistrationStatus(status) {
+  const s3 = status.toUpperCase();
+  if (s3 === "SUCCESSFUL")
+    return "success";
+  if (s3 === "ERROR" || s3 === "FAILED")
+    return "failed";
+  return "pending";
+}
+async function pollRegistrationUntilDone(operationId, opts) {
+  const maxAttempts = opts.maxAttempts ?? 60;
+  const intervalMs = opts.intervalMs ?? 1e4;
+  const sleep = opts.sleep ?? ((ms) => new Promise((r3) => setTimeout(r3, ms)));
+  let attempts = 0;
+  while (attempts < maxAttempts) {
+    const { status, message } = await opts.getStatus(operationId);
+    attempts++;
+    const verdict = classifyRegistrationStatus(status);
+    if (verdict === "success")
+      return { status: "success", attempts, message };
+    if (verdict === "failed")
+      return { status: "failed", attempts, message };
+    if (attempts < maxAttempts)
+      await sleep(intervalMs);
+  }
+  return { status: "timeout", attempts };
+}
 export {
   whoisLookup,
   validateDns,
@@ -31238,10 +31392,14 @@ export {
   updateDomain,
   updateDnsRecord,
   syncAll,
+  selectDnsProvider,
+  selectBuyRegistrar,
   searchDomains,
+  resolveCloudflareConfig,
   recordDomainPurchase,
   upsertRecords as r53UpsertRecords,
   upsertRecord as r53UpsertRecord,
+  updateNameservers as r53UpdateNameservers,
   registerDomain as r53RegisterDomain,
   listRegisteredDomains as r53ListRegisteredDomains,
   listRecords as r53ListRecords,
@@ -31254,6 +31412,7 @@ export {
   deleteHostedZone as r53DeleteHostedZone,
   createHostedZone as r53CreateHostedZone,
   checkAvailability3 as r53CheckAvailability,
+  pollRegistrationUntilDone,
   markDomainPremium,
   listSslExpiring,
   listExpiring,
@@ -31274,6 +31433,7 @@ export {
   getDomain,
   getDnsRecord,
   getDatabase,
+  getCapability,
   getByRegistrar,
   getAvailableProviders,
   getAlert,
@@ -31283,17 +31443,26 @@ export {
   deleteDomain,
   deleteDnsRecord,
   deleteAlert,
+  delegateDomainToCloudflare,
   createRoute53Provider,
   createDomainOffer,
   createDomain,
   createDnsRecord,
   createAlert,
   countDomains,
+  cloudflareAuthHeaders,
   closeDatabase,
+  classifyRegistrationStatus,
   checkSsl,
   checkDnsPropagation,
   checkAllDomains,
+  upsertRecord2 as cfUpsertRecord,
+  getZone as cfGetZone,
+  ensureZone as cfEnsureZone,
+  createZone as cfCreateZone,
+  canBuy,
   autoDetectRegistrar,
+  PROVIDER_CAPABILITIES,
   DOMAIN_STATUSES,
   DOMAIN_OFFER_STATUSES,
   DOMAIN_EMAIL_TYPES

package/dist/lib/brandsight.d.ts

@@ -11,9 +11,29 @@
  */
 export interface BrandsightConfig {
     apiKey: string;
+    apiSecret?: string;
+    customerId?: string;
+    shopperId?: string;
     accountId?: string;
     baseUrl?: string;
 }
+/**
+ * Resolve Brandsight (GoDaddy Corporate Domains) credentials from env, including
+ * the HASNAXYZ vault names which carry the full GoDaddy-style credential set
+ * (api_key + api_secret + customer_id + shopper_id). Pure / testable.
+ */
+export declare function resolveBrandsightConfig(env?: Record<string, string | undefined>): BrandsightConfig;
+export interface BrandsightCapability {
+    configured: boolean;
+    gated: boolean;
+    notes: string;
+}
+/**
+ * Brandsight is GoDaddy Corporate Domains — an enterprise/contract-only
+ * registrar. Even with credentials present, automated self-serve purchase is
+ * gated, so callers must not attempt it blindly.
+ */
+export declare function brandsightCapability(env?: Record<string, string | undefined>): BrandsightCapability;
 export interface BrandsightDomain {
     domain: string;
     status: string;

package/dist/lib/brandsight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brandsight.d.ts","sourceRoot":"","sources":["../../src/lib/brandsight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,UAAU,CAAC,EAAE,MAAM;IACnB,YAAY,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,YAAY,CAAC,EAAE,MAAM,YAAA;CAK/B;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAQlC;AAED,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAoID,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAYrH;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYnF;AAMD,wBAAsB,WAAW,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAKxF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAK/G;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAKlH;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAI,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvI;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE;IAAE,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE,EAC9T,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCjF;AAMD,OAAO,KAAK,EAAE,iBAAiB,EAAkG,MAAM,gBAAgB,CAAC;AAExJ,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAoDrF"}
+{"version":3,"file":"brandsight.d.ts","sourceRoot":"","sources":["../../src/lib/brandsight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,gBAAgB,CAQlB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,oBAAoB,CAUtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,UAAU,CAAC,EAAE,MAAM;IACnB,YAAY,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,YAAY,CAAC,EAAE,MAAM,YAAA;CAK/B;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAQlC;AAED,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAoID,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAYrH;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYnF;AAMD,wBAAsB,WAAW,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAKxF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAK/G;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAKlH;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAI,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvI;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE;IAAE,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE,EAC9T,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCjF;AAMD,OAAO,KAAK,EAAE,iBAAiB,EAAkG,MAAM,gBAAgB,CAAC;AAExJ,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAoDrF"}

package/dist/lib/capability.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Registrar / DNS provider capability matrix (2026) and auto-selection.
+ *
+ * Captures what each provider can actually do via API, so callers never attempt
+ * a gated path silently. Findings (research, 2026):
+ *   - Route53 Domains: full self-serve buy API, not volume-gated → primary buy.
+ *   - GoDaddy retail: Domains API gated behind account thresholds (≥10 / DDC)
+ *     since 2024; purchase + DNS writes unreliable → gated.
+ *   - Brandsight / GoDaddy Corporate Domains: enterprise-contract-only → gated.
+ *   - Cloudflare: DNS only (no registration) → always our DNS.
+ *   - Namecheap: buy + DNS via API (sandbox/whitelist required) → usable.
+ */
+export interface ProviderCapability {
+    canBuy: boolean;
+    canDns: boolean;
+    /** True when the API path exists but requires special access we may not have. */
+    gated: boolean;
+    notes: string;
+}
+export declare const PROVIDER_CAPABILITIES: Record<string, ProviderCapability>;
+export declare function getCapability(name: string): ProviderCapability;
+export declare function canBuy(name: string): boolean;
+/**
+ * Choose the registrar to buy through. Defaults to Route53 (the only reliable
+ * self-serve API). An explicit preference is honored only if it is non-gated.
+ */
+export declare function selectBuyRegistrar(preference?: string): string;
+/** DNS is always Cloudflare, regardless of where the domain was bought. */
+export declare function selectDnsProvider(): string;
+//# sourceMappingURL=capability.d.ts.map

package/dist/lib/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAMpE,CAAC;AAIF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE9D;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/lib/cloudflare-auth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Cloudflare auth resolution for open-domains — supports BOTH a scoped API
+ * token and a Global API Key + email (our vault stores the latter:
+ * HASNAXYZ_CLOUDFLARE_LIVE_API_KEY / _EMAIL). Pure + testable.
+ */
+export interface CloudflareConfig {
+    apiToken?: string;
+    apiKey?: string;
+    email?: string;
+    accountId?: string;
+}
+export declare function resolveCloudflareConfig(env?: Record<string, string | undefined>): CloudflareConfig;
+/** The auth headers to send for a given config. */
+export declare function cloudflareAuthHeaders(cfg: CloudflareConfig): Record<string, string>;
+//# sourceMappingURL=cloudflare-auth.d.ts.map

package/dist/lib/cloudflare-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-auth.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,gBAAgB,CAqBlB;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnF"}

package/dist/lib/cloudflare.d.ts

@@ -6,10 +6,8 @@
  *   CLOUDFLARE_ACCOUNT_ID  — Account ID (required for zone creation)
  */
 import type { DnsProvider } from "./registrar.js";
-export interface CloudflareConfig {
-    apiToken?: string;
-    accountId?: string;
-}
+import { type CloudflareConfig } from "./cloudflare-auth.js";
+export type { CloudflareConfig };
 export interface CloudflareZone {
     id: string;
     name: string;
@@ -30,6 +28,17 @@ export declare function getConfig(): CloudflareConfig;
 export declare function listZones(config?: CloudflareConfig): Promise<CloudflareZone[]>;
 export declare function getZone(domain: string, config?: CloudflareConfig): Promise<CloudflareZone | null>;
 export declare function createZone(domain: string, config?: CloudflareConfig): Promise<CloudflareZone>;
+/**
+ * Find-or-create a Cloudflare zone and return its assigned nameservers.
+ * Idempotent: reuses an existing zone for the domain if present. The returned
+ * nameservers are what the registrar should be delegated to (always-Cloudflare).
+ *
+ * `deps` is injectable for testing; defaults to the real getZone/createZone.
+ */
+export declare function ensureZone(domain: string, config?: CloudflareConfig, deps?: {
+    getZone: (d: string, c?: CloudflareConfig) => Promise<CloudflareZone | null>;
+    createZone: (d: string, c?: CloudflareConfig) => Promise<CloudflareZone>;
+}): Promise<CloudflareZone>;
 export declare function deleteZone(zoneId: string, config?: CloudflareConfig): Promise<void>;
 export declare function listRecords(zoneId: string, config?: CloudflareConfig): Promise<CloudflareRecord[]>;
 export declare function upsertRecord(zoneId: string, record: CloudflareRecord, config?: CloudflareConfig): Promise<void>;

package/dist/lib/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,gBAAgB,CAAC;AAIrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAwCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrH;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AAID,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,CA4B/E"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAIjC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAqCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE;IACL,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E,GACA,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrH;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AAID,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,CA4B/E"}

package/dist/lib/creds-check.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Provisioning credential status — reports, per provider, whether usable
+ * credentials are present (across all supported auth modes incl. HASNAXYZ vault
+ * env names). Pure (env injected) + used by `domains doctor`.
+ */
+export interface CredStatus {
+    provider: string;
+    configured: boolean;
+    mode: string;
+    detail: string;
+}
+export declare function checkProvisioningCredentials(env?: Record<string, string | undefined>): CredStatus[];
+//# sourceMappingURL=creds-check.d.ts.map

package/dist/lib/creds-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creds-check.d.ts","sourceRoot":"","sources":["../../src/lib/creds-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,UAAU,EAAE,CAqCd"}

package/dist/lib/delegate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Cloudflare delegation — the always-Cloudflare-DNS rule in one place.
+ *
+ * After a domain is registered with ANY registrar, DNS is managed in Cloudflare:
+ * create (or reuse) a Cloudflare zone, then point the registrar's nameservers at
+ * the zone's assigned Cloudflare nameservers.
+ *
+ * Dependency-injected so it is fully unit-testable; the CLI wires the real
+ * Cloudflare `createZone` and Route53 `updateNameservers`.
+ */
+export interface DelegateDeps {
+    /** Create or reuse a Cloudflare zone; returns its id + assigned nameservers. */
+    createCloudflareZone: (domain: string) => Promise<{
+        id: string;
+        nameservers: string[];
+    }>;
+    /** Point the registrar's nameservers at the given set. */
+    updateNameservers: (domain: string, nameservers: string[]) => Promise<{
+        operationId: string;
+    }>;
+}
+export interface DelegateResult {
+    zoneId: string;
+    nameservers: string[];
+    operationId: string;
+}
+export declare function delegateDomainToCloudflare(domain: string, deps: DelegateDeps): Promise<DelegateResult>;
+//# sourceMappingURL=delegate.d.ts.map

package/dist/lib/delegate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../src/lib/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACzF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAOzB"}

package/dist/lib/domain-daemon.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Domain provisioning daemon — reconciles a set of domains toward `ready`.
+ *
+ * Each tick: gather live signals per domain, derive its lifecycle state, and run
+ * the next action (register / create_cf_zone / delegate_ns / check_ns_propagation
+ * / verify_dns / finalize). Signals + actions are injected so the loop is fully
+ * testable; the CLI wires real Route53/Cloudflare/DNS calls. State is derived
+ * live (no separate persistence needed), so a restart simply re-derives.
+ */
+import { type DomainSignals, type DomainProvAction } from "./provision-state.js";
+export interface DomainReconcileDeps {
+    gatherSignals: (domain: string) => Promise<DomainSignals>;
+    runAction: (domain: string, action: DomainProvAction) => Promise<void>;
+    log?: (event: string, detail: Record<string, unknown>) => void;
+}
+export interface DomainReconcileSummary {
+    processed: number;
+    advanced: number;
+    ready: number;
+    errors: number;
+}
+export declare function reconcileDomainTick(domains: string[], deps: DomainReconcileDeps): Promise<DomainReconcileSummary>;
+export interface DomainDaemonOptions extends DomainReconcileDeps {
+    intervalSec?: number;
+    maxTicks?: number;
+    shouldStop?: () => boolean;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function runDomainDaemon(domains: () => Promise<string[]>, opts: DomainDaemonOptions): Promise<DomainReconcileSummary>;
+//# sourceMappingURL=domain-daemon.d.ts.map

package/dist/lib/domain-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-daemon.d.ts","sourceRoot":"","sources":["../../src/lib/domain-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAyBjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAiBjC"}

package/dist/lib/godaddy.d.ts

@@ -66,5 +66,17 @@ export declare function syncToLocalDb(dbFns: {
     createDomain: (input: CreateDomainInput) => Domain;
     updateDomain: (id: string, input: UpdateDomainInput) => Domain | null;
 }): Promise<GoDaddySyncResult>;
+export interface GodaddyCapability {
+    configured: boolean;
+    gated: boolean;
+    notes: string;
+}
+/**
+ * GoDaddy retail Domains API capability. Since 2024 GoDaddy gated the Domains
+ * API behind account thresholds (>=10 domains / Discount Domain Club): the
+ * availability endpoint often still works, but production purchase and DNS
+ * writes require a qualifying account. We therefore treat purchase/DNS as gated.
+ */
+export declare function godaddyCapability(env?: Record<string, string | undefined>): GodaddyCapability;
 export {};
 //# sourceMappingURL=godaddy.d.ts.map

package/dist/lib/godaddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"godaddy.d.ts","sourceRoot":"","sources":["../../src/lib/godaddy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAMrF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAG/B,UAAU,CAAC,EAAE,MAAM;IACnB,OAAO,CAAC,EAAE,OAAO;gBAFxB,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,OAAO,CAAC,EAAE,OAAO,YAAA;CAK3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAsED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAEnE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEhF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAM/E;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK9F;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAsBD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;CACvE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6D7B"}
+{"version":3,"file":"godaddy.d.ts","sourceRoot":"","sources":["../../src/lib/godaddy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAMrF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAG/B,UAAU,CAAC,EAAE,MAAM;IACnB,OAAO,CAAC,EAAE,OAAO;gBAFxB,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,OAAO,CAAC,EAAE,OAAO,YAAA;CAK3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAsED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAEnE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEhF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAM/E;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK9F;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAsBD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;CACvE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6D7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,iBAAiB,CASnB"}

package/dist/lib/ns-drift.d.ts

@@ -0,0 +1,29 @@
+/**
+ * NS drift reconciler — enforces the always-Cloudflare-DNS invariant across the
+ * portfolio: every domain's nameservers must point to Cloudflare. Detects drift
+ * (registrar NS not Cloudflare) and can re-delegate. Pure detection + an
+ * injected reconcile loop, so it is fully testable.
+ */
+export declare function isCloudflareNs(ns: string[]): boolean;
+export interface NsDriftVerdict {
+    domain: string;
+    drifted: boolean;
+    reason: string;
+}
+export declare function classifyNsDrift(domain: string, registrarNs: string[]): NsDriftVerdict;
+export interface NsReconcileDeps {
+    getRegistrarNs: (domain: string) => Promise<string[]>;
+    getCloudflareNs: (domain: string) => Promise<string[]>;
+    setRegistrarNs: (domain: string, ns: string[]) => Promise<void>;
+    log?: (event: string, detail: Record<string, unknown>) => void;
+}
+export interface NsReconcileSummary {
+    checked: number;
+    drifted: NsDriftVerdict[];
+    fixed: string[];
+    errors: number;
+}
+export declare function reconcileNsDrift(domains: string[], deps: NsReconcileDeps, opts?: {
+    fix?: boolean;
+}): Promise<NsReconcileSummary>;
+//# sourceMappingURL=ns-drift.d.ts.map

package/dist/lib/ns-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ns-drift.d.ts","sourceRoot":"","sources":["../../src/lib/ns-drift.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,cAAc,CAIrF;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAwB7B"}