@hasna/domains 0.0.13 → 0.0.14

package/dist/cli/index.js

@@ -25599,6 +25599,322 @@ var init_dist_es9 = __esm(() => {
   init_fromIni();
 });
 
+// src/lib/cloudflare-auth.ts
+function resolveCloudflareConfig(env = process.env) {
+  const accountId = env["CLOUDFLARE_ACCOUNT_ID"] || env["HASNAXYZ_CLOUDFLARE_LIVE_ACCOUNT_ID"] || undefined;
+  if (env["CLOUDFLARE_API_TOKEN"]) {
+    return { apiToken: env["CLOUDFLARE_API_TOKEN"], accountId };
+  }
+  if (env["CLOUDFLARE_API_KEY"] && env["CLOUDFLARE_EMAIL"]) {
+    return { apiKey: env["CLOUDFLARE_API_KEY"], email: env["CLOUDFLARE_EMAIL"], accountId };
+  }
+  if (env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"] && env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"]) {
+    return {
+      apiKey: env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"],
+      email: env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"],
+      accountId
+    };
+  }
+  return accountId ? { accountId } : {};
+}
+function cloudflareAuthHeaders(cfg) {
+  if (cfg.apiToken)
+    return { Authorization: `Bearer ${cfg.apiToken}` };
+  if (cfg.apiKey && cfg.email)
+    return { "X-Auth-Key": cfg.apiKey, "X-Auth-Email": cfg.email };
+  throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.");
+}
+
+// src/lib/brandsight.ts
+function resolveBrandsightConfig(env = process.env) {
+  return {
+    apiKey: env["BRANDSIGHT_API_KEY"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_API_KEY"] ?? "",
+    apiSecret: env["BRANDSIGHT_API_SECRET"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_API_SECRET"],
+    customerId: env["BRANDSIGHT_CUSTOMER_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_CUSTOMER_ID"],
+    shopperId: env["BRANDSIGHT_SHOPPER_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_SHOPPER_ID"],
+    accountId: env["BRANDSIGHT_ACCOUNT_ID"] ?? env["HASNAXYZ_BRANDSIGHT_LIVE_CUSTOMER_ID"]
+  };
+}
+function getApiKey() {
+  const key = process.env["BRANDSIGHT_API_KEY"];
+  if (!key) {
+    throw new BrandsightApiError("BRANDSIGHT_API_KEY environment variable is not set");
+  }
+  return key;
+}
+function getConfig4() {
+  return {
+    apiKey: process.env["BRANDSIGHT_API_KEY"] ?? "",
+    accountId: process.env["BRANDSIGHT_ACCOUNT_ID"]
+  };
+}
+async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const url = `${baseUrl}${path}`;
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "User-Agent": USER_AGENT
+  };
+  try {
+    const response = await fetchFn(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
+    }
+    const data = await response.json();
+    return { data, stub: false };
+  } catch (error) {
+    if (error instanceof BrandsightApiError)
+      throw error;
+    return { data: null, stub: true };
+  }
+}
+async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const url = `${baseUrl}${path}`;
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "User-Agent": USER_AGENT
+  };
+  try {
+    const response = await fetchFn(url, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok) {
+      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
+    }
+    const data = await response.json();
+    return { data, stub: false };
+  } catch (error) {
+    if (error instanceof BrandsightApiError)
+      throw error;
+    return { data: null, stub: true };
+  }
+}
+function generateStubAlerts(brandName) {
+  const now = new Date().toISOString();
+  return [
+    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now },
+    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now },
+    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now }
+  ];
+}
+function generateStubSimilarDomains(domain) {
+  const base = domain.replace(/\.[^.]+$/, "");
+  const tld = domain.slice(base.length);
+  return [
+    `${base}-online${tld}`,
+    `${base}s${tld}`,
+    `${base.replace(/a/gi, "4")}${tld}`,
+    `${base}-app${tld}`,
+    `get${base}${tld}`
+  ];
+}
+function generateStubThreatAssessment(domain) {
+  return {
+    domain,
+    risk_level: "low",
+    threats: [],
+    recommendation: "No immediate threats detected. Continue routine monitoring."
+  };
+}
+async function monitorBrand(brandName) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/brands/${encodeURIComponent(brandName)}/monitor`, apiKey);
+  if (result.stub) {
+    return { brand: brandName, alerts: generateStubAlerts(brandName), stub: true };
+  }
+  return { brand: brandName, alerts: result.data.alerts, stub: false };
+}
+async function getSimilarDomains(domain) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/similar`, apiKey);
+  if (result.stub) {
+    return { domain, similar: generateStubSimilarDomains(domain), stub: true };
+  }
+  return { domain, similar: result.data.similar, stub: false };
+}
+async function getThreatAssessment(domain) {
+  const apiKey = getApiKey();
+  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/threats`, apiKey);
+  if (result.stub) {
+    return { ...generateStubThreatAssessment(domain), stub: true };
+  }
+  return { ...result.data, stub: false };
+}
+async function listDomains2(config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet("/portfolio/domains", cfg.apiKey);
+  if (result.stub)
+    return [];
+  return result.data.domains ?? [];
+}
+async function getDomainInfo3(domain, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
+  if (result.stub)
+    return null;
+  return result.data;
+}
+async function checkAvailability4(domain, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
+  if (result.stub)
+    return { domain, available: false };
+  return result.data;
+}
+async function renewDomain3(domain, years = 1, config) {
+  const cfg = config ?? getConfig4();
+  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
+  if (result.stub)
+    return { success: false };
+  return { success: true, orderId: result.data.orderId };
+}
+async function syncToLocalDb3(dbFns, config) {
+  const domains = await listDomains2(config);
+  let synced = 0, created = 0, updated = 0;
+  const errors = [];
+  for (const d3 of domains) {
+    try {
+      const existing = dbFns.getDomainByName(d3.domain);
+      if (existing) {
+        dbFns.updateDomain(existing.id, {
+          registrar: "Brandsight",
+          expires_at: d3.expires || undefined,
+          auto_renew: d3.auto_renew,
+          status: "active",
+          nameservers: d3.nameservers
+        });
+        updated++;
+      } else {
+        dbFns.createDomain({
+          name: d3.domain,
+          registrar: "Brandsight",
+          expires_at: d3.expires || undefined,
+          auto_renew: d3.auto_renew,
+          status: "active",
+          nameservers: d3.nameservers
+        });
+        created++;
+      }
+      synced++;
+    } catch (err) {
+      errors.push(`${d3.domain}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return { synced, created, updated, errors };
+}
+function createBrandsightProvider(config) {
+  const cfg = config ?? getConfig4();
+  return {
+    name: "brandsight",
+    async listDomains() {
+      const domains = await listDomains2(cfg);
+      return domains.map((d3) => ({
+        domain: d3.domain,
+        registrar: "Brandsight",
+        created: "",
+        expires: d3.expires,
+        nameservers: d3.nameservers,
+        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
+        auto_renew: d3.auto_renew
+      }));
+    },
+    async getDomainInfo(domain) {
+      const d3 = await getDomainInfo3(domain, cfg);
+      if (!d3)
+        throw new Error(`Domain not found in Brandsight: ${domain}`);
+      return {
+        domain: d3.domain,
+        registrar: "Brandsight",
+        created: "",
+        expires: d3.expires,
+        nameservers: d3.nameservers,
+        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
+        auto_renew: d3.auto_renew
+      };
+    },
+    async renewDomain(domain) {
+      const result = await renewDomain3(domain, 1, cfg);
+      return { domain, success: result.success, orderId: result.orderId };
+    },
+    async checkAvailability(domain) {
+      const result = await checkAvailability4(domain, cfg);
+      return {
+        domain: result.domain,
+        available: result.available,
+        standard_price: result.price,
+        currency: result.currency
+      };
+    },
+    async syncToLocalDb(dbFns) {
+      return syncToLocalDb3(dbFns, cfg);
+    }
+  };
+}
+var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
+var init_brandsight = __esm(() => {
+  init_version();
+  BrandsightApiError = class BrandsightApiError extends Error {
+    statusCode;
+    responseBody;
+    constructor(message, statusCode, responseBody) {
+      super(message);
+      this.statusCode = statusCode;
+      this.responseBody = responseBody;
+      this.name = "BrandsightApiError";
+    }
+  };
+});
+
+// src/lib/creds-check.ts
+var exports_creds_check = {};
+__export(exports_creds_check, {
+  checkProvisioningCredentials: () => checkProvisioningCredentials
+});
+function checkProvisioningCredentials(env = process.env) {
+  const out = [];
+  const hasAws = !!(env["AWS_ACCESS_KEY_ID"] && env["AWS_SECRET_ACCESS_KEY"]) || !!env["AWS_PROFILE"];
+  out.push({
+    provider: "route53",
+    configured: hasAws,
+    mode: env["AWS_PROFILE"] ? `profile:${env["AWS_PROFILE"]}` : hasAws ? "access-keys" : "none",
+    detail: hasAws ? "AWS credentials present (region us-east-1 for Route53 Domains)" : "Set AWS_PROFILE or AWS_ACCESS_KEY_ID/SECRET"
+  });
+  const cf = resolveCloudflareConfig(env);
+  const cfMode = cf.apiToken ? "token" : cf.apiKey && cf.email ? "global-key" : "none";
+  out.push({
+    provider: "cloudflare",
+    configured: cfMode !== "none",
+    mode: cfMode + (cf.accountId ? "+account" : ""),
+    detail: cfMode === "none" ? "Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY+CLOUDFLARE_EMAIL" : cf.accountId ? "ok" : "missing CLOUDFLARE_ACCOUNT_ID (needed to create zones)"
+  });
+  const bs = resolveBrandsightConfig(env);
+  const bsConfigured = !!(bs.apiKey && bs.apiSecret && bs.customerId);
+  out.push({
+    provider: "brandsight",
+    configured: bsConfigured,
+    mode: bsConfigured ? "full-creds" : "none",
+    detail: "enterprise/contract-only (gated) \u2014 not used for automated purchase"
+  });
+  const gd = !!(env["GODADDY_API_KEY"] && env["GODADDY_API_SECRET"]);
+  out.push({ provider: "godaddy", configured: gd, mode: gd ? "key+secret" : "none", detail: "retail API gated for purchase/DNS since 2024" });
+  return out;
+}
+var init_creds_check = __esm(() => {
+  init_brandsight();
+});
+
 // src/db/domain-history.ts
 function rowToDomainHistory(row) {
   return {
@@ -33085,15 +33401,10 @@ function createRoute53Provider(config) {
 
 // src/lib/cloudflare.ts
 function getConfig3() {
-  return {
-    apiToken: process.env["CLOUDFLARE_API_TOKEN"],
-    accountId: process.env["CLOUDFLARE_ACCOUNT_ID"]
-  };
+  return resolveCloudflareConfig();
 }
 function checkCredentials2(cfg) {
-  if (!cfg.apiToken) {
-    throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN environment variable.");
-  }
+  cloudflareAuthHeaders(cfg);
 }
 var CF_BASE = "https://api.cloudflare.com/client/v4";
 async function cfFetch(path, opts = {}) {
@@ -33102,7 +33413,7 @@ async function cfFetch(path, opts = {}) {
   const res = await fetch(`${CF_BASE}${path}`, {
     method: opts.method ?? "GET",
     headers: {
-      Authorization: `Bearer ${cfg.apiToken}`,
+      ...cloudflareAuthHeaders(cfg),
       "Content-Type": "application/json"
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined
@@ -33209,250 +33520,8 @@ function createCloudflareProvider(config) {
   };
 }
 
-// src/lib/brandsight.ts
-init_version();
-
-class BrandsightApiError extends Error {
-  statusCode;
-  responseBody;
-  constructor(message, statusCode, responseBody) {
-    super(message);
-    this.statusCode = statusCode;
-    this.responseBody = responseBody;
-    this.name = "BrandsightApiError";
-  }
-}
-var _fetchFn = null;
-function getApiKey() {
-  const key = process.env["BRANDSIGHT_API_KEY"];
-  if (!key) {
-    throw new BrandsightApiError("BRANDSIGHT_API_KEY environment variable is not set");
-  }
-  return key;
-}
-function getConfig4() {
-  return {
-    apiKey: process.env["BRANDSIGHT_API_KEY"] ?? "",
-    accountId: process.env["BRANDSIGHT_ACCOUNT_ID"]
-  };
-}
-var BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
-async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": USER_AGENT
-  };
-  try {
-    const response = await fetchFn(url, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
-  }
-}
-async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": USER_AGENT
-  };
-  try {
-    const response = await fetchFn(url, {
-      method: "GET",
-      headers,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
-  }
-}
-function generateStubAlerts(brandName) {
-  const now = new Date().toISOString();
-  return [
-    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now },
-    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now },
-    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now }
-  ];
-}
-function generateStubSimilarDomains(domain) {
-  const base = domain.replace(/\.[^.]+$/, "");
-  const tld = domain.slice(base.length);
-  return [
-    `${base}-online${tld}`,
-    `${base}s${tld}`,
-    `${base.replace(/a/gi, "4")}${tld}`,
-    `${base}-app${tld}`,
-    `get${base}${tld}`
-  ];
-}
-function generateStubThreatAssessment(domain) {
-  return {
-    domain,
-    risk_level: "low",
-    threats: [],
-    recommendation: "No immediate threats detected. Continue routine monitoring."
-  };
-}
-async function monitorBrand(brandName) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/brands/${encodeURIComponent(brandName)}/monitor`, apiKey);
-  if (result.stub) {
-    return { brand: brandName, alerts: generateStubAlerts(brandName), stub: true };
-  }
-  return { brand: brandName, alerts: result.data.alerts, stub: false };
-}
-async function getSimilarDomains(domain) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/similar`, apiKey);
-  if (result.stub) {
-    return { domain, similar: generateStubSimilarDomains(domain), stub: true };
-  }
-  return { domain, similar: result.data.similar, stub: false };
-}
-async function getThreatAssessment(domain) {
-  const apiKey = getApiKey();
-  const result = await apiGet(`/domains/${encodeURIComponent(domain)}/threats`, apiKey);
-  if (result.stub) {
-    return { ...generateStubThreatAssessment(domain), stub: true };
-  }
-  return { ...result.data, stub: false };
-}
-async function listDomains2(config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet("/portfolio/domains", cfg.apiKey);
-  if (result.stub)
-    return [];
-  return result.data.domains ?? [];
-}
-async function getDomainInfo3(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return null;
-  return result.data;
-}
-async function checkAvailability4(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return { domain, available: false };
-  return result.data;
-}
-async function renewDomain3(domain, years = 1, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
-  if (result.stub)
-    return { success: false };
-  return { success: true, orderId: result.data.orderId };
-}
-async function syncToLocalDb3(dbFns, config) {
-  const domains = await listDomains2(config);
-  let synced = 0, created = 0, updated = 0;
-  const errors = [];
-  for (const d3 of domains) {
-    try {
-      const existing = dbFns.getDomainByName(d3.domain);
-      if (existing) {
-        dbFns.updateDomain(existing.id, {
-          registrar: "Brandsight",
-          expires_at: d3.expires || undefined,
-          auto_renew: d3.auto_renew,
-          status: "active",
-          nameservers: d3.nameservers
-        });
-        updated++;
-      } else {
-        dbFns.createDomain({
-          name: d3.domain,
-          registrar: "Brandsight",
-          expires_at: d3.expires || undefined,
-          auto_renew: d3.auto_renew,
-          status: "active",
-          nameservers: d3.nameservers
-        });
-        created++;
-      }
-      synced++;
-    } catch (err) {
-      errors.push(`${d3.domain}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return { synced, created, updated, errors };
-}
-function createBrandsightProvider(config) {
-  const cfg = config ?? getConfig4();
-  return {
-    name: "brandsight",
-    async listDomains() {
-      const domains = await listDomains2(cfg);
-      return domains.map((d3) => ({
-        domain: d3.domain,
-        registrar: "Brandsight",
-        created: "",
-        expires: d3.expires,
-        nameservers: d3.nameservers,
-        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
-        auto_renew: d3.auto_renew
-      }));
-    },
-    async getDomainInfo(domain) {
-      const d3 = await getDomainInfo3(domain, cfg);
-      if (!d3)
-        throw new Error(`Domain not found in Brandsight: ${domain}`);
-      return {
-        domain: d3.domain,
-        registrar: "Brandsight",
-        created: "",
-        expires: d3.expires,
-        nameservers: d3.nameservers,
-        status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
-        auto_renew: d3.auto_renew
-      };
-    },
-    async renewDomain(domain) {
-      const result = await renewDomain3(domain, 1, cfg);
-      return { domain, success: result.success, orderId: result.orderId };
-    },
-    async checkAvailability(domain) {
-      const result = await checkAvailability4(domain, cfg);
-      return {
-        domain: result.domain,
-        available: result.available,
-        standard_price: result.price,
-        currency: result.currency
-      };
-    },
-    async syncToLocalDb(dbFns) {
-      return syncToLocalDb3(dbFns, cfg);
-    }
-  };
-}
-
 // src/lib/registrar.ts
+init_brandsight();
 function createNamecheapProvider() {
   return {
     name: "namecheap",
@@ -34832,6 +34901,7 @@ function registerAlertCommands(program2) {
 }
 
 // src/cli/commands/monitor.ts
+init_brandsight();
 function registerMonitorCommand(program2) {
   const monitor = program2.command("monitor").description("Brand monitoring and threat detection (Brandsight)");
   monitor.command("watch <brand>").description("Monitor a brand for new lookalike domain registrations").option("--json", "Output JSON").action(async (brand, opts) => {
@@ -35276,6 +35346,14 @@ function registerDoctorCommand(program2) {
       ok("Registrant contact info complete");
     else
       fail(`Missing contact fields: ${missingContact.join(", ")}`, "domains config set contact.<field> <value>");
+    section("Provisioning Credentials");
+    const { checkProvisioningCredentials: checkProvisioningCredentials2 } = await Promise.resolve().then(() => (init_creds_check(), exports_creds_check));
+    for (const c3 of checkProvisioningCredentials2()) {
+      if (c3.configured)
+        ok(`${c3.provider}: ${c3.mode} \u2014 ${c3.detail}`);
+      else
+        fail(`${c3.provider}: not configured (${c3.detail})`);
+    }
     section("Providers");
     const providers = getAvailableProviders().filter((p3) => p3.name !== "brandsight");
     for (const p3 of providers) {
@@ -37333,6 +37411,67 @@ function registerWalletCommand(program2) {
   });
 }
 
+// src/lib/provision-state.ts
+var DOMAIN_FLOW = {
+  requested: { action: "register", next: "registered" },
+  registered: { action: "create_cf_zone", next: "cf_zone_ready" },
+  cf_zone_ready: { action: "delegate_ns", next: "ns_delegated" },
+  ns_delegated: { action: "check_ns_propagation", next: "ns_propagated" },
+  ns_propagated: { action: "verify_dns", next: "dns_managed" },
+  dns_managed: { action: "finalize", next: "ready" }
+};
+var TERMINAL = new Set(["ready", "failed"]);
+function domainHappyPath() {
+  return [...Object.keys(DOMAIN_FLOW), "ready"];
+}
+function deriveDomainState(sig) {
+  if (!sig.registered)
+    return "requested";
+  if (!sig.zoneExists)
+    return "registered";
+  if (!sig.registrarNsAreCloudflare)
+    return "cf_zone_ready";
+  if (!sig.publicNsAreCloudflare)
+    return "ns_delegated";
+  if (!sig.zoneActive)
+    return "ns_propagated";
+  return "ready";
+}
+
+// src/cli/commands/provision.ts
+var CF_NS_SUFFIX = ".ns.cloudflare.com";
+function registerProvisionCommand(program2) {
+  const provision = program2.command("provision").description("Domain provisioning lifecycle");
+  provision.command("status <name>").description("Show the provisioning state of a domain (derived from live signals)").action(async (name) => {
+    const signals = {};
+    try {
+      const detail = await getDomainDetail(name).catch(() => null);
+      signals["registered"] = !!detail;
+      const registrarNs = detail?.nameservers ?? [];
+      signals["registrarNsAreCloudflare"] = registrarNs.length > 0 && registrarNs.every((n3) => n3.includes(CF_NS_SUFFIX));
+      const zone = await getZone(name).catch(() => null);
+      signals["zoneExists"] = !!zone;
+      signals["zoneActive"] = zone?.status === "active";
+      try {
+        const resolved = await (await import("dns")).promises.resolveNs(name).catch(() => []);
+        signals["publicNsAreCloudflare"] = resolved.length > 0 && resolved.every((n3) => n3.includes(CF_NS_SUFFIX));
+      } catch {
+        signals["publicNsAreCloudflare"] = false;
+      }
+    } catch (e3) {
+      console.error(`Error gathering signals: ${e3 instanceof Error ? e3.message : String(e3)}`);
+    }
+    const state = deriveDomainState(signals);
+    console.log(`
+Domain: ${name}`);
+    console.log(`State:  ${state}`);
+    console.log(`Signals: ${JSON.stringify(signals)}`);
+    const path = domainHappyPath();
+    const idx = path.indexOf(state);
+    console.log(`Progress: ${idx >= 0 ? idx + 1 : "?"}/${path.length}  [${path.join(" \u2192 ")}]`);
+  });
+}
+
 // src/cli/index.ts
 init_version();
 var program2 = new Command;
@@ -37356,4 +37495,5 @@ registerResearchCommand(program2);
 registerOutreachCommand(program2);
 registerSedoCommand(program2);
 registerWalletCommand(program2);
+registerProvisionCommand(program2);
 program2.parse(process.argv);