@hasna/domains 0.0.13 → 0.0.15

package/dist/index.d.ts

@@ -8,4 +8,9 @@ export { whoisLookup, checkDnsPropagation, checkSsl, exportZoneFile, importZoneF
 export { getDatabase, closeDatabase } from "./db/database.js";
 export { getProvider, getAvailableProviders, syncAll, autoDetectRegistrar, type RegistrarProvider, type ProviderDnsRecord, type ProviderDomainInfo, type ProviderAvailability, type ProviderInfo, type SyncAllResult, } from "./lib/registrar.js";
 export { checkAvailability as r53CheckAvailability, registerDomain as r53RegisterDomain, getRegistrationStatus as r53GetRegistrationStatus, updateNameservers as r53UpdateNameservers, listRegisteredDomains as r53ListRegisteredDomains, createHostedZone as r53CreateHostedZone, listHostedZones as r53ListHostedZones, getHostedZone as r53GetHostedZone, deleteHostedZone as r53DeleteHostedZone, findHostedZoneByDomain as r53FindHostedZoneByDomain, listRecords as r53ListRecords, upsertRecord as r53UpsertRecord, upsertRecords as r53UpsertRecords, deleteRecord as r53DeleteRecord, createRoute53Provider, getConfig as r53GetConfig, type Route53Config, type DomainContactInfo, type DomainAvailability, type RegisteredDomain, type HostedZoneInfo, type Route53Record, type Route53RecordInput, } from "./lib/route53.js";
+export { createZone as cfCreateZone, getZone as cfGetZone, ensureZone as cfEnsureZone, upsertRecord as cfUpsertRecord, type CloudflareZone, } from "./lib/cloudflare.js";
+export { resolveCloudflareConfig, cloudflareAuthHeaders, type CloudflareConfig } from "./lib/cloudflare-auth.js";
+export { delegateDomainToCloudflare, type DelegateResult } from "./lib/delegate.js";
+export { PROVIDER_CAPABILITIES, getCapability, canBuy, selectBuyRegistrar, selectDnsProvider, type ProviderCapability, } from "./lib/capability.js";
+export { classifyRegistrationStatus, pollRegistrationUntilDone, type RegVerdict, type PollResult as RegistrationPollResult, } from "./lib/registration-poll.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,KAAK,KAAK,EACV,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,cAAc,IAAI,iBAAiB,EACnC,qBAAqB,IAAI,wBAAwB,EACjD,iBAAiB,IAAI,oBAAoB,EACzC,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,eAAe,IAAI,kBAAkB,EACrC,aAAa,IAAI,gBAAgB,EACjC,gBAAgB,IAAI,mBAAmB,EACvC,sBAAsB,IAAI,yBAAyB,EACnD,WAAW,IAAI,cAAc,EAC7B,YAAY,IAAI,eAAe,EAC/B,aAAa,IAAI,gBAAgB,EACjC,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,SAAS,IAAI,YAAY,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,UAAU,EACV,WAAW,EACX,KAAK,KAAK,EACV,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,cAAc,IAAI,iBAAiB,EACnC,qBAAqB,IAAI,wBAAwB,EACjD,iBAAiB,IAAI,oBAAoB,EACzC,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,eAAe,IAAI,kBAAkB,EACrC,aAAa,IAAI,gBAAgB,EACjC,gBAAgB,IAAI,mBAAmB,EACvC,sBAAsB,IAAI,yBAAyB,EACnD,WAAW,IAAI,cAAc,EAC7B,YAAY,IAAI,eAAe,EAC/B,aAAa,IAAI,gBAAgB,EACjC,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,SAAS,IAAI,YAAY,EACzB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EACL,UAAU,IAAI,YAAY,EAC1B,OAAO,IAAI,SAAS,EACpB,UAAU,IAAI,YAAY,EAC1B,YAAY,IAAI,cAAc,EAC9B,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,UAAU,EACf,KAAK,UAAU,IAAI,sBAAsB,GAC1C,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -30733,17 +30733,38 @@ function createRoute53Provider(config) {
   };
 }
 
+// src/lib/cloudflare-auth.ts
+function resolveCloudflareConfig(env = process.env) {
+  const accountId = env["CLOUDFLARE_ACCOUNT_ID"] || env["HASNAXYZ_CLOUDFLARE_LIVE_ACCOUNT_ID"] || undefined;
+  if (env["CLOUDFLARE_API_TOKEN"]) {
+    return { apiToken: env["CLOUDFLARE_API_TOKEN"], accountId };
+  }
+  if (env["CLOUDFLARE_API_KEY"] && env["CLOUDFLARE_EMAIL"]) {
+    return { apiKey: env["CLOUDFLARE_API_KEY"], email: env["CLOUDFLARE_EMAIL"], accountId };
+  }
+  if (env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"] && env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"]) {
+    return {
+      apiKey: env["HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"],
+      email: env["HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"],
+      accountId
+    };
+  }
+  return accountId ? { accountId } : {};
+}
+function cloudflareAuthHeaders(cfg) {
+  if (cfg.apiToken)
+    return { Authorization: `Bearer ${cfg.apiToken}` };
+  if (cfg.apiKey && cfg.email)
+    return { "X-Auth-Key": cfg.apiKey, "X-Auth-Email": cfg.email };
+  throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.");
+}
+
 // src/lib/cloudflare.ts
 function getConfig3() {
-  return {
-    apiToken: process.env["CLOUDFLARE_API_TOKEN"],
-    accountId: process.env["CLOUDFLARE_ACCOUNT_ID"]
-  };
+  return resolveCloudflareConfig();
 }
 function checkCredentials2(cfg) {
-  if (!cfg.apiToken) {
-    throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN environment variable.");
-  }
+  cloudflareAuthHeaders(cfg);
 }
 var CF_BASE = "https://api.cloudflare.com/client/v4";
 async function cfFetch(path, opts = {}) {
@@ -30752,7 +30773,7 @@ async function cfFetch(path, opts = {}) {
   const res = await fetch(`${CF_BASE}${path}`, {
     method: opts.method ?? "GET",
     headers: {
-      Authorization: `Bearer ${cfg.apiToken}`,
+      ...cloudflareAuthHeaders(cfg),
       "Content-Type": "application/json"
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined
@@ -30771,6 +30792,24 @@ async function getZone(domain, config) {
   const z2 = result[0];
   return { id: z2.id, name: z2.name, status: z2.status, nameservers: z2.name_servers, original_nameservers: z2.original_name_servers };
 }
+async function createZone(domain, config) {
+  const cfg = config ?? getConfig3();
+  if (!cfg.accountId) {
+    throw new Error("CLOUDFLARE_ACCOUNT_ID is required to create a zone.");
+  }
+  const result = await cfFetch("/zones", { method: "POST", body: { name: domain, account: { id: cfg.accountId }, jump_start: false }, config: cfg });
+  return { id: result.id, name: result.name, status: result.status, nameservers: result.name_servers };
+}
+async function ensureZone(domain, config, deps) {
+  const get = deps?.getZone ?? getZone;
+  const create = deps?.createZone ?? createZone;
+  const existing = await get(domain, config);
+  const zone = existing ?? await create(domain, config);
+  if (!zone.nameservers || zone.nameservers.length === 0) {
+    throw new Error(`Cloudflare zone for ${domain} has no nameservers yet`);
+  }
+  return zone;
+}
 async function listRecords2(zoneId, config) {
   const records = [];
   let page = 1;
@@ -31280,6 +31319,72 @@ function autoDetectRegistrar(domain, getDomainByName2) {
     return "brandsight";
   return null;
 }
+// src/lib/delegate.ts
+async function delegateDomainToCloudflare(domain, deps) {
+  const zone = await deps.createCloudflareZone(domain);
+  if (!zone.nameservers || zone.nameservers.length === 0) {
+    throw new Error(`Cloudflare zone for ${domain} returned no nameservers; cannot delegate`);
+  }
+  const { operationId } = await deps.updateNameservers(domain, zone.nameservers);
+  return { zoneId: zone.id, nameservers: zone.nameservers, operationId };
+}
+// src/lib/capability.ts
+var PROVIDER_CAPABILITIES = {
+  route53: { canBuy: true, canDns: true, gated: false, notes: "Full self-serve buy + hosted zones via AWS API; primary buy path." },
+  cloudflare: { canBuy: false, canDns: true, gated: false, notes: "DNS/zone management only; not a registrar. Always our DNS." },
+  namecheap: { canBuy: true, canDns: true, gated: false, notes: "Buy + DNS via API; requires API access + whitelisted IP." },
+  godaddy: { canBuy: true, canDns: true, gated: true, notes: "Domains API gated behind account thresholds (>=10 / Discount Domain Club) since 2024; purchase + DNS writes unreliable." },
+  brandsight: { canBuy: true, canDns: true, gated: true, notes: "GoDaddy Corporate Domains (enterprise/contract-only); credentials issued to onboarded clients, not self-serve." }
+};
+var UNKNOWN = { canBuy: false, canDns: false, gated: true, notes: "Unknown provider." };
+function getCapability(name) {
+  return PROVIDER_CAPABILITIES[name.toLowerCase()] ?? UNKNOWN;
+}
+function canBuy(name) {
+  const c3 = getCapability(name);
+  return c3.canBuy && !c3.gated;
+}
+function selectBuyRegistrar(preference) {
+  if (preference) {
+    const c3 = getCapability(preference);
+    if (!c3.canBuy)
+      throw new Error(`Registrar '${preference}' cannot buy domains`);
+    if (c3.gated)
+      throw new Error(`Registrar '${preference}' is gated/enterprise-only and not available for automated purchase: ${c3.notes}`);
+    return preference.toLowerCase();
+  }
+  return "route53";
+}
+function selectDnsProvider() {
+  return "cloudflare";
+}
+// src/lib/registration-poll.ts
+function classifyRegistrationStatus(status) {
+  const s3 = status.toUpperCase();
+  if (s3 === "SUCCESSFUL")
+    return "success";
+  if (s3 === "ERROR" || s3 === "FAILED")
+    return "failed";
+  return "pending";
+}
+async function pollRegistrationUntilDone(operationId, opts) {
+  const maxAttempts = opts.maxAttempts ?? 60;
+  const intervalMs = opts.intervalMs ?? 1e4;
+  const sleep = opts.sleep ?? ((ms) => new Promise((r3) => setTimeout(r3, ms)));
+  let attempts = 0;
+  while (attempts < maxAttempts) {
+    const { status, message } = await opts.getStatus(operationId);
+    attempts++;
+    const verdict = classifyRegistrationStatus(status);
+    if (verdict === "success")
+      return { status: "success", attempts, message };
+    if (verdict === "failed")
+      return { status: "failed", attempts, message };
+    if (attempts < maxAttempts)
+      await sleep(intervalMs);
+  }
+  return { status: "timeout", attempts };
+}
 export {
   whoisLookup,
   validateDns,
@@ -31287,7 +31392,10 @@ export {
   updateDomain,
   updateDnsRecord,
   syncAll,
+  selectDnsProvider,
+  selectBuyRegistrar,
   searchDomains,
+  resolveCloudflareConfig,
   recordDomainPurchase,
   upsertRecords as r53UpsertRecords,
   upsertRecord as r53UpsertRecord,
@@ -31304,6 +31412,7 @@ export {
   deleteHostedZone as r53DeleteHostedZone,
   createHostedZone as r53CreateHostedZone,
   checkAvailability3 as r53CheckAvailability,
+  pollRegistrationUntilDone,
   markDomainPremium,
   listSslExpiring,
   listExpiring,
@@ -31324,6 +31433,7 @@ export {
   getDomain,
   getDnsRecord,
   getDatabase,
+  getCapability,
   getByRegistrar,
   getAvailableProviders,
   getAlert,
@@ -31333,17 +31443,26 @@ export {
   deleteDomain,
   deleteDnsRecord,
   deleteAlert,
+  delegateDomainToCloudflare,
   createRoute53Provider,
   createDomainOffer,
   createDomain,
   createDnsRecord,
   createAlert,
   countDomains,
+  cloudflareAuthHeaders,
   closeDatabase,
+  classifyRegistrationStatus,
   checkSsl,
   checkDnsPropagation,
   checkAllDomains,
+  upsertRecord2 as cfUpsertRecord,
+  getZone as cfGetZone,
+  ensureZone as cfEnsureZone,
+  createZone as cfCreateZone,
+  canBuy,
   autoDetectRegistrar,
+  PROVIDER_CAPABILITIES,
   DOMAIN_STATUSES,
   DOMAIN_OFFER_STATUSES,
   DOMAIN_EMAIL_TYPES

package/dist/lib/brandsight.d.ts

@@ -11,9 +11,29 @@
  */
 export interface BrandsightConfig {
     apiKey: string;
+    apiSecret?: string;
+    customerId?: string;
+    shopperId?: string;
     accountId?: string;
     baseUrl?: string;
 }
+/**
+ * Resolve Brandsight (GoDaddy Corporate Domains) credentials from env, including
+ * the HASNAXYZ vault names which carry the full GoDaddy-style credential set
+ * (api_key + api_secret + customer_id + shopper_id). Pure / testable.
+ */
+export declare function resolveBrandsightConfig(env?: Record<string, string | undefined>): BrandsightConfig;
+export interface BrandsightCapability {
+    configured: boolean;
+    gated: boolean;
+    notes: string;
+}
+/**
+ * Brandsight is GoDaddy Corporate Domains — an enterprise/contract-only
+ * registrar. Even with credentials present, automated self-serve purchase is
+ * gated, so callers must not attempt it blindly.
+ */
+export declare function brandsightCapability(env?: Record<string, string | undefined>): BrandsightCapability;
 export interface BrandsightDomain {
     domain: string;
     status: string;

package/dist/lib/brandsight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brandsight.d.ts","sourceRoot":"","sources":["../../src/lib/brandsight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,UAAU,CAAC,EAAE,MAAM;IACnB,YAAY,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,YAAY,CAAC,EAAE,MAAM,YAAA;CAK/B;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAQlC;AAED,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAoID,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAYrH;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYnF;AAMD,wBAAsB,WAAW,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAKxF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAK/G;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAKlH;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAI,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvI;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE;IAAE,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE,EAC9T,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCjF;AAMD,OAAO,KAAK,EAAE,iBAAiB,EAAkG,MAAM,gBAAgB,CAAC;AAExJ,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAoDrF"}
+{"version":3,"file":"brandsight.d.ts","sourceRoot":"","sources":["../../src/lib/brandsight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,gBAAgB,CAQlB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,oBAAoB,CAUtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGlC,UAAU,CAAC,EAAE,MAAM;IACnB,YAAY,CAAC,EAAE,MAAM;gBAF5B,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,YAAY,CAAC,EAAE,MAAM,YAAA;CAK/B;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAQlC;AAED,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAoID,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAYrH;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYjF;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYnF;AAMD,wBAAsB,WAAW,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAKxF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAK/G;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAKlH;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAI,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvI;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE;IAAE,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,iBAAiB,KAAK,OAAO,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE,EAC9T,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCjF;AAMD,OAAO,KAAK,EAAE,iBAAiB,EAAkG,MAAM,gBAAgB,CAAC;AAExJ,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAoDrF"}

package/dist/lib/capability.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Registrar / DNS provider capability matrix (2026) and auto-selection.
+ *
+ * Captures what each provider can actually do via API, so callers never attempt
+ * a gated path silently. Findings (research, 2026):
+ *   - Route53 Domains: full self-serve buy API, not volume-gated → primary buy.
+ *   - GoDaddy retail: Domains API gated behind account thresholds (≥10 / DDC)
+ *     since 2024; purchase + DNS writes unreliable → gated.
+ *   - Brandsight / GoDaddy Corporate Domains: enterprise-contract-only → gated.
+ *   - Cloudflare: DNS only (no registration) → always our DNS.
+ *   - Namecheap: buy + DNS via API (sandbox/whitelist required) → usable.
+ */
+export interface ProviderCapability {
+    canBuy: boolean;
+    canDns: boolean;
+    /** True when the API path exists but requires special access we may not have. */
+    gated: boolean;
+    notes: string;
+}
+export declare const PROVIDER_CAPABILITIES: Record<string, ProviderCapability>;
+export declare function getCapability(name: string): ProviderCapability;
+export declare function canBuy(name: string): boolean;
+/**
+ * Choose the registrar to buy through. Defaults to Route53 (the only reliable
+ * self-serve API). An explicit preference is honored only if it is non-gated.
+ */
+export declare function selectBuyRegistrar(preference?: string): string;
+/** DNS is always Cloudflare, regardless of where the domain was bought. */
+export declare function selectDnsProvider(): string;
+//# sourceMappingURL=capability.d.ts.map

package/dist/lib/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAMpE,CAAC;AAIF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE9D;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/lib/cloudflare-auth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Cloudflare auth resolution for open-domains — supports BOTH a scoped API
+ * token and a Global API Key + email (our vault stores the latter:
+ * HASNAXYZ_CLOUDFLARE_LIVE_API_KEY / _EMAIL). Pure + testable.
+ */
+export interface CloudflareConfig {
+    apiToken?: string;
+    apiKey?: string;
+    email?: string;
+    accountId?: string;
+}
+export declare function resolveCloudflareConfig(env?: Record<string, string | undefined>): CloudflareConfig;
+/** The auth headers to send for a given config. */
+export declare function cloudflareAuthHeaders(cfg: CloudflareConfig): Record<string, string>;
+//# sourceMappingURL=cloudflare-auth.d.ts.map

package/dist/lib/cloudflare-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-auth.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,gBAAgB,CAqBlB;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnF"}

package/dist/lib/cloudflare.d.ts

@@ -6,10 +6,8 @@
  *   CLOUDFLARE_ACCOUNT_ID  — Account ID (required for zone creation)
  */
 import type { DnsProvider } from "./registrar.js";
-export interface CloudflareConfig {
-    apiToken?: string;
-    accountId?: string;
-}
+import { type CloudflareConfig } from "./cloudflare-auth.js";
+export type { CloudflareConfig };
 export interface CloudflareZone {
     id: string;
     name: string;
@@ -30,6 +28,17 @@ export declare function getConfig(): CloudflareConfig;
 export declare function listZones(config?: CloudflareConfig): Promise<CloudflareZone[]>;
 export declare function getZone(domain: string, config?: CloudflareConfig): Promise<CloudflareZone | null>;
 export declare function createZone(domain: string, config?: CloudflareConfig): Promise<CloudflareZone>;
+/**
+ * Find-or-create a Cloudflare zone and return its assigned nameservers.
+ * Idempotent: reuses an existing zone for the domain if present. The returned
+ * nameservers are what the registrar should be delegated to (always-Cloudflare).
+ *
+ * `deps` is injectable for testing; defaults to the real getZone/createZone.
+ */
+export declare function ensureZone(domain: string, config?: CloudflareConfig, deps?: {
+    getZone: (d: string, c?: CloudflareConfig) => Promise<CloudflareZone | null>;
+    createZone: (d: string, c?: CloudflareConfig) => Promise<CloudflareZone>;
+}): Promise<CloudflareZone>;
 export declare function deleteZone(zoneId: string, config?: CloudflareConfig): Promise<void>;
 export declare function listRecords(zoneId: string, config?: CloudflareConfig): Promise<CloudflareRecord[]>;
 export declare function upsertRecord(zoneId: string, record: CloudflareRecord, config?: CloudflareConfig): Promise<void>;

package/dist/lib/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,gBAAgB,CAAC;AAIrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAK5C;AAwCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrH;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AAID,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,CA4B/E"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAIjC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAqCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE;IACL,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E,GACA,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrH;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AAID,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,CA4B/E"}

package/dist/lib/config.d.ts

@@ -16,8 +16,18 @@ export interface DomainContact {
 export interface DomainsConfig {
     default_registrar?: string;
     default_dns?: string;
+    /** AWS profile/account used for domain purchases (Route53 Domains). */
+    purchase_aws_profile?: string;
     contact?: DomainContact;
 }
+/**
+ * AWS profile to use for domain purchases. For this app, domains are bought in
+ * the hasna-xyz-infra account. Resolved from config, then env. Applying it sets
+ * process.env.AWS_PROFILE when no explicit AWS creds are already present.
+ */
+export declare function getPurchaseProfile(): string | undefined;
+/** Set AWS_PROFILE from config for purchase ops if no explicit creds are set. */
+export declare function applyPurchaseProfile(): string | undefined;
 export declare function loadConfig(): DomainsConfig;
 export declare function saveConfig(config: DomainsConfig): void;
 export declare function setConfigKey(keyPath: string, value: string): DomainsConfig;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAMD,wBAAgB,UAAU,IAAI,aAAa,CAQ1C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAKtD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAe1E;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CAC9C,GAAG;IACF,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACpE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9C,CA2BA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAKzD;AAMD,wBAAgB,UAAU,IAAI,aAAa,CAQ1C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAKtD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAe1E;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CAC9C,GAAG;IACF,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACpE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9C,CA2BA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE"}

package/dist/lib/creds-check.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Provisioning credential status — reports, per provider, whether usable
+ * credentials are present (across all supported auth modes incl. HASNAXYZ vault
+ * env names). Pure (env injected) + used by `domains doctor`.
+ */
+export interface CredStatus {
+    provider: string;
+    configured: boolean;
+    mode: string;
+    detail: string;
+}
+export declare function checkProvisioningCredentials(env?: Record<string, string | undefined>): CredStatus[];
+//# sourceMappingURL=creds-check.d.ts.map

package/dist/lib/creds-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creds-check.d.ts","sourceRoot":"","sources":["../../src/lib/creds-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,UAAU,EAAE,CAqCd"}

package/dist/lib/domain-daemon-deps.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Real deps for the domain provisioning daemon — gather live signals and run
+ * the next action for a domain (toward "ready" = registered + CF zone + NS
+ * delegated + propagated + zone active). DNS is always Cloudflare.
+ */
+import type { DomainReconcileDeps } from "./domain-daemon.js";
+export declare function makeDomainDaemonDeps(): DomainReconcileDeps;
+//# sourceMappingURL=domain-daemon-deps.d.ts.map

package/dist/lib/domain-daemon-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-daemon-deps.d.ts","sourceRoot":"","sources":["../../src/lib/domain-daemon-deps.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAS9D,wBAAgB,oBAAoB,IAAI,mBAAmB,CAwC1D"}

package/dist/lib/domain-daemon.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Domain provisioning daemon — reconciles a set of domains toward `ready`.
+ *
+ * Each tick: gather live signals per domain, derive its lifecycle state, and run
+ * the next action (register / create_cf_zone / delegate_ns / check_ns_propagation
+ * / verify_dns / finalize). Signals + actions are injected so the loop is fully
+ * testable; the CLI wires real Route53/Cloudflare/DNS calls. State is derived
+ * live (no separate persistence needed), so a restart simply re-derives.
+ */
+import { type DomainSignals, type DomainProvAction } from "./provision-state.js";
+export interface DomainReconcileDeps {
+    gatherSignals: (domain: string) => Promise<DomainSignals>;
+    runAction: (domain: string, action: DomainProvAction) => Promise<void>;
+    log?: (event: string, detail: Record<string, unknown>) => void;
+}
+export interface DomainReconcileSummary {
+    processed: number;
+    advanced: number;
+    ready: number;
+    errors: number;
+}
+export declare function reconcileDomainTick(domains: string[], deps: DomainReconcileDeps): Promise<DomainReconcileSummary>;
+export interface DomainDaemonOptions extends DomainReconcileDeps {
+    intervalSec?: number;
+    maxTicks?: number;
+    shouldStop?: () => boolean;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function runDomainDaemon(domains: () => Promise<string[]>, opts: DomainDaemonOptions): Promise<DomainReconcileSummary>;
+//# sourceMappingURL=domain-daemon.d.ts.map

package/dist/lib/domain-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-daemon.d.ts","sourceRoot":"","sources":["../../src/lib/domain-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAyBjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,EAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,sBAAsB,CAAC,CAiBjC"}

package/dist/lib/godaddy.d.ts

@@ -66,5 +66,17 @@ export declare function syncToLocalDb(dbFns: {
     createDomain: (input: CreateDomainInput) => Domain;
     updateDomain: (id: string, input: UpdateDomainInput) => Domain | null;
 }): Promise<GoDaddySyncResult>;
+export interface GodaddyCapability {
+    configured: boolean;
+    gated: boolean;
+    notes: string;
+}
+/**
+ * GoDaddy retail Domains API capability. Since 2024 GoDaddy gated the Domains
+ * API behind account thresholds (>=10 domains / Discount Domain Club): the
+ * availability endpoint often still works, but production purchase and DNS
+ * writes require a qualifying account. We therefore treat purchase/DNS as gated.
+ */
+export declare function godaddyCapability(env?: Record<string, string | undefined>): GodaddyCapability;
 export {};
 //# sourceMappingURL=godaddy.d.ts.map

package/dist/lib/godaddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"godaddy.d.ts","sourceRoot":"","sources":["../../src/lib/godaddy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAMrF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAG/B,UAAU,CAAC,EAAE,MAAM;IACnB,OAAO,CAAC,EAAE,OAAO;gBAFxB,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,OAAO,CAAC,EAAE,OAAO,YAAA;CAK3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAsED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAEnE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEhF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAM/E;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK9F;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAsBD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;CACvE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6D7B"}
+{"version":3,"file":"godaddy.d.ts","sourceRoot":"","sources":["../../src/lib/godaddy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAMrF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAG/B,UAAU,CAAC,EAAE,MAAM;IACnB,OAAO,CAAC,EAAE,OAAO;gBAFxB,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,OAAO,CAAC,EAAE,OAAO,YAAA;CAK3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAMD,KAAK,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAIvC,wBAAgB,SAAS,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAElD;AAsED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAEnE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEhF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAM/E;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK9F;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAKpF;AAsBD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;CACvE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6D7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAqD,GAC1F,iBAAiB,CASnB"}

package/dist/lib/ns-drift.d.ts

@@ -0,0 +1,29 @@
+/**
+ * NS drift reconciler — enforces the always-Cloudflare-DNS invariant across the
+ * portfolio: every domain's nameservers must point to Cloudflare. Detects drift
+ * (registrar NS not Cloudflare) and can re-delegate. Pure detection + an
+ * injected reconcile loop, so it is fully testable.
+ */
+export declare function isCloudflareNs(ns: string[]): boolean;
+export interface NsDriftVerdict {
+    domain: string;
+    drifted: boolean;
+    reason: string;
+}
+export declare function classifyNsDrift(domain: string, registrarNs: string[]): NsDriftVerdict;
+export interface NsReconcileDeps {
+    getRegistrarNs: (domain: string) => Promise<string[]>;
+    getCloudflareNs: (domain: string) => Promise<string[]>;
+    setRegistrarNs: (domain: string, ns: string[]) => Promise<void>;
+    log?: (event: string, detail: Record<string, unknown>) => void;
+}
+export interface NsReconcileSummary {
+    checked: number;
+    drifted: NsDriftVerdict[];
+    fixed: string[];
+    errors: number;
+}
+export declare function reconcileNsDrift(domains: string[], deps: NsReconcileDeps, opts?: {
+    fix?: boolean;
+}): Promise<NsReconcileSummary>;
+//# sourceMappingURL=ns-drift.d.ts.map

package/dist/lib/ns-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ns-drift.d.ts","sourceRoot":"","sources":["../../src/lib/ns-drift.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,cAAc,CAIrF;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAwB7B"}

package/dist/lib/provision-state.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Domain provisioning state machine (open-domains side) — pure transitions plus
+ * a `deriveDomainState` that maps live signals (registered? zone? NS delegated?
+ * propagated? active?) to the current lifecycle state. The CLI `provision-status`
+ * command derives state live so no extra persistence is required, while the
+ * daemon advances domains transition-by-transition.
+ */
+export type DomainProvState = "requested" | "registered" | "cf_zone_ready" | "ns_delegated" | "ns_propagated" | "dns_managed" | "ready" | "failed";
+export type DomainProvAction = "register" | "create_cf_zone" | "delegate_ns" | "check_ns_propagation" | "verify_dns" | "finalize";
+interface Step {
+    action: DomainProvAction;
+    next: DomainProvState;
+}
+export declare const DOMAIN_FLOW: Record<Exclude<DomainProvState, "ready" | "failed">, Step>;
+export declare function isDomainTerminal(s: DomainProvState): boolean;
+export declare function domainActionFor(s: DomainProvState): DomainProvAction | null;
+export declare function domainNext(s: DomainProvState): DomainProvState | null;
+export declare function domainHappyPath(): DomainProvState[];
+export interface DomainSignals {
+    registered?: boolean;
+    zoneExists?: boolean;
+    registrarNsAreCloudflare?: boolean;
+    publicNsAreCloudflare?: boolean;
+    zoneActive?: boolean;
+}
+/** Map observed live signals to the furthest lifecycle state reached. */
+export declare function deriveDomainState(sig: DomainSignals): DomainProvState;
+export {};
+//# sourceMappingURL=provision-state.d.ts.map

package/dist/lib/provision-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-state.d.ts","sourceRoot":"","sources":["../../src/lib/provision-state.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,cAAc,GACd,eAAe,GACf,aAAa,GACb,OAAO,GACP,QAAQ,CAAC;AAEb,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,sBAAsB,GACtB,YAAY,GACZ,UAAU,CAAC;AAEf,UAAU,IAAI;IAAG,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE;AAElE,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,EAAE,IAAI,CAOlF,CAAC;AAIF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAE5D;AACD,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAG3E;AACD,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,GAAG,eAAe,GAAG,IAAI,CAGrE;AACD,wBAAgB,eAAe,IAAI,eAAe,EAAE,CAEnD;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,eAAe,CAOrE"}

package/dist/lib/registration-poll.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Route53 domain-registration polling — pure, reusable by the buy command and
+ * the domain provisioning daemon. The AWS status string is classified into a
+ * terminal/pending verdict; pollRegistrationUntilDone drives it to completion
+ * with an injectable status getter + sleep (so it is fully unit-testable).
+ */
+export type RegVerdict = "pending" | "success" | "failed";
+export declare function classifyRegistrationStatus(status: string): RegVerdict;
+export interface PollResult {
+    status: "success" | "failed" | "timeout";
+    attempts: number;
+    message?: string;
+}
+export interface PollOptions {
+    getStatus: (operationId: string) => Promise<{
+        status: string;
+        message?: string;
+    }>;
+    maxAttempts?: number;
+    intervalMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function pollRegistrationUntilDone(operationId: string, opts: PollOptions): Promise<PollResult>;
+//# sourceMappingURL=registration-poll.d.ts.map

package/dist/lib/registration-poll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-poll.d.ts","sourceRoot":"","sources":["../../src/lib/registration-poll.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE1D,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAKrE;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,UAAU,CAAC,CAerB"}

package/dist/mcp/http.d.ts

@@ -1,8 +1,9 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 export declare const MCP_HTTP_HOST = "127.0.0.1";
 export declare const MCP_SERVER_NAME = "domains";
-export declare const DEFAULT_MCP_HTTP_PORT = 8814;
+export declare const DEFAULT_MCP_HTTP_PORT = 8859;
 export declare function isHttpMode(argv: readonly string[]): boolean;
+export declare function isStdioMode(argv: readonly string[]): boolean;
 export declare function resolveMcpHttpPort(argv: readonly string[]): number;
 export declare function mcpHealthJson(): {
     status: string;

package/dist/mcp/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,eAAO,MAAM,aAAa,cAAc,CAAC;AACzC,eAAO,MAAM,eAAe,YAAY,CAAC;AACzC,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASlE;AAED,wBAAgB,aAAa,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAEhE;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,MAAM,SAAS,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,SAAS,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC,CAmB7C;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAAG"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,eAAO,MAAM,aAAa,cAAc,CAAC;AACzC,eAAO,MAAM,eAAe,YAAY,CAAC;AACzC,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE5D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CASlE;AAED,wBAAgB,aAAa,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAEhE;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,MAAM,SAAS,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,SAAS,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC,CAmB7C;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAAG"}