@hasna/domains 0.0.20 → 0.0.22

package/dist/cli/index.js

@@ -993,7 +993,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -2344,31 +2344,31 @@ var init_migrations = __esm(() => {
 
 // src/db/database.ts
 import { Database } from "bun:sqlite";
-import { copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
-import { dirname, join, resolve } from "path";
-import { homedir } from "os";
+import { copyFileSync, existsSync as existsSync2, mkdirSync, readdirSync, statSync } from "fs";
+import { dirname, join as join2, resolve } from "path";
+import { homedir as homedir2 } from "os";
 function getDbPath() {
   if (process.env["HASNA_DOMAINS_DB_PATH"])
     return process.env["HASNA_DOMAINS_DB_PATH"];
   const explicit = process.env["HASNA_DOMAINS_DIR"] ?? process.env["DOMAINS_DIR"];
   if (explicit) {
-    return join(explicit, "domains.db");
+    return join2(explicit, "domains.db");
   }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir();
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
   migrateDotfile("domains");
-  return join(home, ".hasna", "domains", "domains.db");
+  return join2(home, ".hasna", "domains", "domains.db");
 }
 function migrateDotfile(name) {
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir();
-  const oldDir = join(home, `.${name}`);
-  const newDir = join(home, ".hasna", name);
-  if (!existsSync(oldDir) || existsSync(newDir))
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
+  const oldDir = join2(home, `.${name}`);
+  const newDir = join2(home, ".hasna", name);
+  if (!existsSync2(oldDir) || existsSync2(newDir))
     return;
   mkdirSync(newDir, { recursive: true });
   for (const file of readdirSync(oldDir)) {
-    const oldPath = join(oldDir, file);
+    const oldPath = join2(oldDir, file);
     if (statSync(oldPath).isFile())
-      copyFileSync(oldPath, join(newDir, file));
+      copyFileSync(oldPath, join2(newDir, file));
   }
 }
 function getDatabase() {
@@ -3541,6 +3541,146 @@ var init_domains = __esm(() => {
   init_monitoring();
 });
 
+// src/lib/godaddy.ts
+function getCredentials() {
+  const apiKey = process.env["GODADDY_API_KEY"];
+  const apiSecret = process.env["GODADDY_API_SECRET"];
+  if (!apiKey || !apiSecret) {
+    throw new Error("GoDaddy API credentials not configured. Set GODADDY_API_KEY and GODADDY_API_SECRET environment variables.");
+  }
+  return { apiKey, apiSecret };
+}
+function getHeaders() {
+  const { apiKey, apiSecret } = getCredentials();
+  return {
+    Authorization: `sso-key ${apiKey}:${apiSecret}`,
+    "Content-Type": "application/json",
+    Accept: "application/json"
+  };
+}
+async function apiRequest2(method, path, body) {
+  const fetchFn = _overriddenFetch || globalThis.fetch;
+  const url = `${GODADDY_API_BASE}${path}`;
+  const headers = getHeaders();
+  const options = { method, headers };
+  if (body !== undefined) {
+    options.body = JSON.stringify(body);
+  }
+  const response = await fetchFn(url, options);
+  if (!response.ok) {
+    const text = await response.text();
+    throw new GoDaddyApiError(`GoDaddy API ${method} ${path} failed with status ${response.status}: ${text}`, response.status, { responseBody: text });
+  }
+  if (response.status === 204) {
+    return;
+  }
+  return await response.json();
+}
+async function listGoDaddyDomains() {
+  return apiRequest2("GET", "/v1/domains");
+}
+async function getDomainInfo2(domain) {
+  return apiRequest2("GET", `/v1/domains/${encodeURIComponent(domain)}`);
+}
+async function renewDomain2(domain) {
+  return apiRequest2("POST", `/v1/domains/${encodeURIComponent(domain)}/renew`, { period: 1 });
+}
+async function getDnsRecords2(domain, type) {
+  const path = type ? `/v1/domains/${encodeURIComponent(domain)}/records/${encodeURIComponent(type)}` : `/v1/domains/${encodeURIComponent(domain)}/records`;
+  return apiRequest2("GET", path);
+}
+async function setDnsRecords2(domain, records) {
+  await apiRequest2("PUT", `/v1/domains/${encodeURIComponent(domain)}/records`, records);
+}
+async function checkAvailability2(domain) {
+  return apiRequest2("GET", `/v1/domains/available?domain=${encodeURIComponent(domain)}`);
+}
+function mapGoDaddyStatus(gdStatus) {
+  const s = gdStatus.toUpperCase();
+  if (s === "ACTIVE")
+    return "active";
+  if (s === "EXPIRED")
+    return "expired";
+  if (s === "TRANSFERRED_OUT" || s === "TRANSFERRING" || s === "PENDING_TRANSFER")
+    return "transferring";
+  if (s === "REDEMPTION" || s === "PENDING_REDEMPTION")
+    return "redemption";
+  return "active";
+}
+async function syncToLocalDb2(dbFns) {
+  const result = {
+    synced: 0,
+    created: 0,
+    updated: 0,
+    errors: []
+  };
+  let gdDomains;
+  try {
+    gdDomains = await listGoDaddyDomains();
+  } catch (err) {
+    result.errors.push(`Failed to list domains: ${err instanceof Error ? err.message : String(err)}`);
+    return result;
+  }
+  for (const gd of gdDomains) {
+    try {
+      let detail;
+      try {
+        detail = await getDomainInfo2(gd.domain);
+      } catch {
+        detail = gd;
+      }
+      const existing = dbFns.getDomainByName(gd.domain);
+      const domainData = {
+        name: gd.domain,
+        registrar: "GoDaddy",
+        status: mapGoDaddyStatus(gd.status),
+        expires_at: gd.expires ? new Date(gd.expires).toISOString() : undefined,
+        auto_renew: gd.renewAuto,
+        nameservers: gd.nameServers || [],
+        registered_at: detail.createdAt ? new Date(detail.createdAt).toISOString() : undefined,
+        metadata: {
+          godaddy_domain_id: detail.domainId,
+          provider: "godaddy",
+          locked: detail.locked,
+          privacy: detail.privacy
+        }
+      };
+      if (existing) {
+        dbFns.updateDomain(existing.id, domainData);
+        result.updated++;
+      } else {
+        dbFns.createDomain(domainData);
+        result.created++;
+      }
+      result.synced++;
+    } catch (err) {
+      result.errors.push(`Failed to sync ${gd.domain}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return result;
+}
+function godaddyCapability(env = process.env) {
+  const configured = !!(env["GODADDY_API_KEY"] && env["GODADDY_API_SECRET"]);
+  return {
+    configured,
+    gated: true,
+    notes: configured ? "Credentials present; DNS/domain management may work with qualifying account access, but availability remains threshold-gated and direct automated purchase is not exposed here. Prefer Route53 for purchases." : "Not configured; GoDaddy production availability remains threshold-gated and DNS/domain management requires qualifying account access."
+  };
+}
+var GoDaddyApiError, _overriddenFetch = null, GODADDY_API_BASE = "https://api.godaddy.com";
+var init_godaddy = __esm(() => {
+  GoDaddyApiError = class GoDaddyApiError extends Error {
+    statusCode;
+    details;
+    constructor(message, statusCode, details) {
+      super(message);
+      this.statusCode = statusCode;
+      this.details = details;
+      this.name = "GoDaddyApiError";
+    }
+  };
+});
+
 // node_modules/@smithy/types/dist-cjs/index.js
 var require_dist_cjs = __commonJS((exports) => {
   exports.HttpAuthLocation = undefined;
@@ -7316,11 +7456,11 @@ var require_randomUUID = __commonJS((exports) => {
 
 // node_modules/@smithy/uuid/dist-cjs/index.js
 var require_dist_cjs19 = __commonJS((exports) => {
-  var randomUUID = require_randomUUID();
+  var randomUUID3 = require_randomUUID();
   var decimalToHex = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
   var v4 = () => {
-    if (randomUUID.randomUUID) {
-      return randomUUID.randomUUID();
+    if (randomUUID3.randomUUID) {
+      return randomUUID3.randomUUID();
     }
     const rnds = new Uint8Array(16);
     crypto.getRandomValues(rnds);
@@ -7483,19 +7623,19 @@ var require_serde = __commonJS((exports) => {
   };
   var strictParseDouble = (value) => {
     if (typeof value == "string") {
-      return expectNumber(parseNumber(value));
+      return expectNumber(parseNumber2(value));
     }
     return expectNumber(value);
   };
   var strictParseFloat = strictParseDouble;
   var strictParseFloat32 = (value) => {
     if (typeof value == "string") {
-      return expectFloat32(parseNumber(value));
+      return expectFloat32(parseNumber2(value));
     }
     return expectFloat32(value);
   };
   var NUMBER_REGEX = /(-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)|(-?Infinity)|(NaN)/g;
-  var parseNumber = (value) => {
+  var parseNumber2 = (value) => {
     const matches = value.match(NUMBER_REGEX);
     if (matches === null || matches[0].length !== value.length) {
       throw new TypeError(`Expected real number, got implicit NaN`);
@@ -7530,26 +7670,26 @@ var require_serde = __commonJS((exports) => {
   };
   var strictParseLong = (value) => {
     if (typeof value === "string") {
-      return expectLong(parseNumber(value));
+      return expectLong(parseNumber2(value));
     }
     return expectLong(value);
   };
   var strictParseInt = strictParseLong;
   var strictParseInt32 = (value) => {
     if (typeof value === "string") {
-      return expectInt32(parseNumber(value));
+      return expectInt32(parseNumber2(value));
     }
     return expectInt32(value);
   };
   var strictParseShort = (value) => {
     if (typeof value === "string") {
-      return expectShort(parseNumber(value));
+      return expectShort(parseNumber2(value));
     }
     return expectShort(value);
   };
   var strictParseByte = (value) => {
     if (typeof value === "string") {
-      return expectByte(parseNumber(value));
+      return expectByte(parseNumber2(value));
     }
     return expectByte(value);
   };
@@ -10746,8 +10886,8 @@ ${utilHexEncoding.toHex(hashedRequest)}`;
         throw new Error("Resolved credential object is not valid");
       }
     }
-    formatDate(now) {
-      const longDate = iso8601(now).replace(/[\-:]/g, "");
+    formatDate(now2) {
+      const longDate = iso8601(now2).replace(/[\-:]/g, "");
       return {
         longDate,
         shortDate: longDate.slice(0, 8)
@@ -17519,7 +17659,7 @@ var require_readFile = __commonJS((exports) => {
   var promises_1 = __require("fs/promises");
   exports.filePromises = {};
   exports.fileIntercept = {};
-  var readFile = (path, options) => {
+  var readFile2 = (path, options) => {
     if (exports.fileIntercept[path] !== undefined) {
       return exports.fileIntercept[path];
     }
@@ -17528,7 +17668,7 @@ var require_readFile = __commonJS((exports) => {
     }
     return exports.filePromises[path];
   };
-  exports.readFile = readFile;
+  exports.readFile = readFile2;
 });
 
 // node_modules/@smithy/shared-ini-file-loader/dist-cjs/index.js
@@ -17538,7 +17678,7 @@ var require_dist_cjs36 = __commonJS((exports) => {
   var getSSOTokenFromFile = require_getSSOTokenFromFile();
   var path = __require("path");
   var types = require_dist_cjs();
-  var readFile = require_readFile();
+  var readFile2 = require_readFile();
   var ENV_PROFILE = "AWS_PROFILE";
   var DEFAULT_PROFILE = "default";
   var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE;
@@ -17622,10 +17762,10 @@ var require_dist_cjs36 = __commonJS((exports) => {
       resolvedConfigFilepath = path.join(homeDir, configFilepath.slice(2));
     }
     const parsedFiles = await Promise.all([
-      readFile.readFile(resolvedConfigFilepath, {
+      readFile2.readFile(resolvedConfigFilepath, {
         ignoreCache: init.ignoreCache
       }).then(parseIni).then(getConfigData).catch(swallowError$1),
-      readFile.readFile(resolvedFilepath, {
+      readFile2.readFile(resolvedFilepath, {
         ignoreCache: init.ignoreCache
       }).then(parseIni).catch(swallowError$1)
     ]);
@@ -17636,7 +17776,7 @@ var require_dist_cjs36 = __commonJS((exports) => {
   };
   var getSsoSessionData = (data) => Object.entries(data).filter(([key]) => key.startsWith(types.IniSectionType.SSO_SESSION + CONFIG_PREFIX_SEPARATOR)).reduce((acc, [key, value]) => ({ ...acc, [key.substring(key.indexOf(CONFIG_PREFIX_SEPARATOR) + 1)]: value }), {});
   var swallowError = () => ({});
-  var loadSsoSessionData = async (init = {}) => readFile.readFile(init.configFilepath ?? getConfigFilepath()).then(parseIni).then(getSsoSessionData).catch(swallowError);
+  var loadSsoSessionData = async (init = {}) => readFile2.readFile(init.configFilepath ?? getConfigFilepath()).then(parseIni).then(getSsoSessionData).catch(swallowError);
   var mergeConfigFiles = (...files) => {
     const merged = {};
     for (const file of files) {
@@ -17656,10 +17796,10 @@ var require_dist_cjs36 = __commonJS((exports) => {
   };
   var externalDataInterceptor = {
     getFileRecord() {
-      return readFile.fileIntercept;
+      return readFile2.fileIntercept;
     },
     interceptFile(path2, contents) {
-      readFile.fileIntercept[path2] = Promise.resolve(contents);
+      readFile2.fileIntercept[path2] = Promise.resolve(contents);
     },
     getTokenRecord() {
       return getSSOTokenFromFile.tokenIntercept;
@@ -17669,7 +17809,7 @@ var require_dist_cjs36 = __commonJS((exports) => {
     }
   };
   exports.getSSOTokenFromFile = getSSOTokenFromFile.getSSOTokenFromFile;
-  exports.readFile = readFile.readFile;
+  exports.readFile = readFile2.readFile;
   exports.CONFIG_PREFIX_SEPARATOR = CONFIG_PREFIX_SEPARATOR;
   exports.DEFAULT_PROFILE = DEFAULT_PROFILE;
   exports.ENV_PROFILE = ENV_PROFILE;
@@ -22581,14 +22721,14 @@ var init_validateTokenKey = __esm(() => {
 
 // node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
 import { promises as fsPromises } from "fs";
-var import_shared_ini_file_loader, writeFile, writeSSOTokenToFile = (id, ssoToken) => {
+var import_shared_ini_file_loader, writeFile2, writeSSOTokenToFile = (id, ssoToken) => {
   const tokenFilepath = import_shared_ini_file_loader.getSSOTokenFilepath(id);
   const tokenString = JSON.stringify(ssoToken, null, 2);
-  return writeFile(tokenFilepath, tokenString);
+  return writeFile2(tokenFilepath, tokenString);
 };
 var init_writeSSOTokenToFile = __esm(() => {
   import_shared_ini_file_loader = __toESM(require_dist_cjs36(), 1);
-  ({ writeFile } = fsPromises);
+  ({ writeFile: writeFile2 } = fsPromises);
 });
 
 // node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
@@ -25378,8 +25518,8 @@ var require_signin = __commonJS((exports) => {
 // node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, join as join3 } from "path";
 var import_property_provider18, import_protocol_http2, import_shared_ini_file_loader6, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
   import_property_provider18 = __toESM(require_dist_cjs23(), 1);
@@ -25401,9 +25541,9 @@ var init_LoginCredentialsFetcher = __esm(() => {
         throw new import_property_provider18.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
       }
       const accessToken = token.accessToken;
-      const now = Date.now();
+      const now2 = Date.now();
       const expiryTime = new Date(accessToken.expiresAt).getTime();
-      const timeUntilExpiry = expiryTime - now;
+      const timeUntilExpiry = expiryTime - now2;
       if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {
         return this.refresh(token);
       }
@@ -25539,10 +25679,10 @@ var init_LoginCredentialsFetcher = __esm(() => {
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join2(homedir2(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join3(homedir3(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
       const loginSessionSha256 = createHash("sha256").update(loginSessionBytes).digest("hex");
-      return join2(directory, `${loginSessionSha256}.json`);
+      return join3(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -34285,11 +34425,32 @@ var init_dist_es14 = __esm(() => {
 });
 
 // src/lib/route53.ts
+var exports_route53 = {};
+__export(exports_route53, {
+  upsertRecords: () => upsertRecords,
+  upsertRecord: () => upsertRecord,
+  updateNameservers: () => updateNameservers2,
+  registerDomain: () => registerDomain2,
+  listRegisteredDomains: () => listRegisteredDomains,
+  listRecords: () => listRecords,
+  listHostedZones: () => listHostedZones,
+  getRegistrationStatus: () => getRegistrationStatus,
+  getHostedZone: () => getHostedZone,
+  getDomainDetail: () => getDomainDetail,
+  getConfig: () => getConfig2,
+  findHostedZoneByDomain: () => findHostedZoneByDomain,
+  deleteRecord: () => deleteRecord,
+  deleteHostedZone: () => deleteHostedZone,
+  createRoute53Provider: () => createRoute53Provider,
+  createHostedZone: () => createHostedZone,
+  checkAvailability: () => checkAvailability3
+});
 function getConfig2() {
   return {
     region: process.env["AWS_REGION"] || "us-east-1",
     accessKeyId: process.env["AWS_ACCESS_KEY_ID"],
-    secretAccessKey: process.env["AWS_SECRET_ACCESS_KEY"]
+    secretAccessKey: process.env["AWS_SECRET_ACCESS_KEY"],
+    sessionToken: process.env["AWS_SESSION_TOKEN"]
   };
 }
 function checkCredentials(cfg) {
@@ -34305,7 +34466,7 @@ function makeClients(config) {
   const cfg = config ?? getConfig2();
   checkCredentials(cfg);
   const region = cfg.region || "us-east-1";
-  const credentials = cfg.accessKeyId && cfg.secretAccessKey ? { accessKeyId: cfg.accessKeyId, secretAccessKey: cfg.secretAccessKey } : undefined;
+  const credentials = cfg.accessKeyId && cfg.secretAccessKey ? { accessKeyId: cfg.accessKeyId, secretAccessKey: cfg.secretAccessKey, sessionToken: cfg.sessionToken } : undefined;
   return {
     route53: new Route53Client({ region, credentials }),
     domains: new Route53DomainsClient({ region: "us-east-1", credentials })
@@ -34334,7 +34495,7 @@ async function checkAvailability3(domain, config) {
   } catch {}
   return availability;
 }
-async function registerDomain(domain, contact, durationYears = 1, autoRenew = true, config) {
+async function registerDomain2(domain, contact, durationYears = 1, autoRenew = true, config) {
   const { domains } = makeClients(config);
   const contactDetail = {
     FirstName: contact.first_name,
@@ -34383,7 +34544,7 @@ async function getDomainDetail(domain, config) {
     nameservers: (result.Nameservers ?? []).map((ns) => ns.Name ?? "").filter(Boolean)
   };
 }
-async function updateNameservers(domain, nameservers, config, client) {
+async function updateNameservers2(domain, nameservers, config, client) {
   if (!nameservers.length) {
     throw new Error("updateNameservers requires at least one nameserver");
   }
@@ -34445,7 +34606,8 @@ async function listHostedZones(config) {
         id: cleanZoneId(z2.Id ?? ""),
         name: z2.Name ?? "",
         record_count: z2.ResourceRecordSetCount ?? 0,
-        comment: z2.Config?.Comment
+        comment: z2.Config?.Comment,
+        private_zone: z2.Config?.PrivateZone
       });
     }
     marker = result.IsTruncated ? result.NextMarker : undefined;
@@ -34460,7 +34622,8 @@ async function getHostedZone(hostedZoneId, config) {
     name: result.HostedZone?.Name ?? "",
     record_count: result.HostedZone?.ResourceRecordSetCount ?? 0,
     comment: result.HostedZone?.Config?.Comment,
-    name_servers: result.DelegationSet?.NameServers ?? []
+    name_servers: result.DelegationSet?.NameServers ?? [],
+    private_zone: result.HostedZone?.Config?.PrivateZone
   };
 }
 async function deleteHostedZone(hostedZoneId, config) {
@@ -34470,7 +34633,15 @@ async function deleteHostedZone(hostedZoneId, config) {
 async function findHostedZoneByDomain(domain, config) {
   const zones = await listHostedZones(config);
   const normalized = domain.endsWith(".") ? domain : `${domain}.`;
-  return zones.find((z2) => z2.name === normalized) ?? null;
+  const matches = zones.filter((z2) => z2.name === normalized);
+  if (matches.length === 0)
+    return null;
+  const publicMatches = matches.filter((z2) => !z2.private_zone);
+  const candidates = publicMatches.length > 0 ? publicMatches : matches;
+  if (candidates.length > 1) {
+    throw new Error(`Multiple Route 53 hosted zones found for ${domain}; specify hosted zone id`);
+  }
+  return candidates[0] ?? null;
 }
 function rrsToRecord(rrs) {
   if (rrs.AliasTarget) {
@@ -34568,19 +34739,55 @@ async function upsertRecords(hostedZoneId, records, config) {
 }
 function createRoute53Provider(config) {
   const cfg = config ?? getConfig2();
+  const registerWithRoute53 = registerDomain2;
+  const updateRoute53Nameservers = updateNameservers2;
+  async function listDomainInventory() {
+    const byDomain = new Map;
+    try {
+      const registered = await listRegisteredDomains(cfg);
+      for (const d3 of registered) {
+        byDomain.set(d3.domain, {
+          domain: d3.domain,
+          registrar: "AWS Route 53",
+          created: "",
+          expires: d3.expiry,
+          nameservers: [],
+          status: "active",
+          auto_renew: d3.auto_renew
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!message.includes("route53domains:ListDomains") && !message.includes("AccessDenied")) {
+        throw error;
+      }
+    }
+    const zones = await listHostedZones(cfg);
+    for (const z2 of zones) {
+      const zone = z2.name_servers?.length ? z2 : await getHostedZone(z2.id, cfg).catch(() => z2);
+      const domain = zone.name.replace(/\.$/, "");
+      const nameservers = zone.name_servers ?? [];
+      const existing = byDomain.get(domain);
+      if (existing) {
+        existing.nameservers = nameservers.length > 0 ? nameservers : existing.nameservers;
+        continue;
+      }
+      byDomain.set(domain, {
+        domain,
+        registrar: "AWS Route 53 DNS",
+        created: "",
+        expires: "",
+        nameservers,
+        status: "active",
+        auto_renew: false
+      });
+    }
+    return Array.from(byDomain.values());
+  }
   return {
     name: "route53",
     async listDomains() {
-      const domains = await listRegisteredDomains(cfg);
-      return domains.map((d3) => ({
-        domain: d3.domain,
-        registrar: "AWS Route 53",
-        created: "",
-        expires: d3.expiry,
-        nameservers: [],
-        status: "active",
-        auto_renew: d3.auto_renew
-      }));
+      return listDomainInventory();
     },
     async getDomainInfo(domain) {
       const detail = await getDomainDetail(domain, cfg);
@@ -34594,6 +34801,14 @@ function createRoute53Provider(config) {
         auto_renew: detail.auto_renew
       };
     },
+    async registerDomain(domain, contact, options = {}) {
+      const result = await registerWithRoute53(domain, contact, options.years ?? 1, options.autoRenew ?? true, cfg);
+      return { domain, success: !!result.operationId, operationId: result.operationId };
+    },
+    async updateNameservers(domain, nameservers) {
+      const result = await updateRoute53Nameservers(domain, nameservers, cfg);
+      return { domain, success: !!result.operationId, operationId: result.operationId };
+    },
     async renewDomain(_domain) {
       return { domain: _domain, success: false, orderId: undefined, chargedAmount: undefined };
     },
@@ -34641,7 +34856,7 @@ function createRoute53Provider(config) {
       };
     },
     async syncToLocalDb(dbFns) {
-      const domains = await listRegisteredDomains(cfg);
+      const domains = await listDomainInventory();
       let synced = 0;
       let created = 0;
       let updated = 0;
@@ -34650,20 +34865,39 @@ function createRoute53Provider(config) {
         try {
           const existing = dbFns.getDomainByName(d3.domain);
           if (existing) {
+            const existingRoute53 = existing.metadata["route53"];
+            const staleDnsOnlyRegistrar = d3.registrar !== "AWS Route 53" && (existing.registrar === "AWS Route 53 DNS" || existing.registrar === "AWS Route 53" && existingRoute53?.source === "route53:hosted_zones");
             dbFns.updateDomain(existing.id, {
-              registrar: "AWS Route 53",
-              expires_at: d3.expiry || undefined,
+              ...d3.registrar === "AWS Route 53" ? { registrar: "AWS Route 53" } : {},
+              ...staleDnsOnlyRegistrar ? { registrar: null } : {},
+              expires_at: d3.expires || undefined,
               auto_renew: d3.auto_renew,
+              nameservers: d3.nameservers.length > 0 ? d3.nameservers : existing.nameservers,
+              metadata: {
+                ...existing.metadata,
+                route53: {
+                  source: d3.registrar === "AWS Route 53" ? "route53domains+hosted_zones" : "route53:hosted_zones",
+                  synced_at: new Date().toISOString()
+                }
+              },
               status: "active"
             });
             updated++;
           } else {
             dbFns.createDomain({
               name: d3.domain,
-              registrar: "AWS Route 53",
-              expires_at: d3.expiry || undefined,
+              ...d3.registrar === "AWS Route 53" ? { registrar: "AWS Route 53" } : {},
+              expires_at: d3.expires || undefined,
               auto_renew: d3.auto_renew,
-              status: "active"
+              nameservers: d3.nameservers,
+              status: "active",
+              notes: d3.registrar === "AWS Route 53 DNS" ? "Discovered from Route 53 hosted zones; registrar ownership was not inferred." : undefined,
+              metadata: {
+                route53: {
+                  source: d3.registrar === "AWS Route 53" ? "route53domains+hosted_zones" : "route53:hosted_zones",
+                  synced_at: new Date().toISOString()
+                }
+              }
             });
             created++;
           }
@@ -34681,15 +34915,132 @@ var init_route53 = __esm(() => {
   init_dist_es14();
 });
 
-// src/lib/cloudflare-auth.ts
-function resolveCloudflareConfig(env = process.env) {
-  const accountId = env["CLOUDFLARE_ACCOUNT_ID"] || undefined;
-  if (env["CLOUDFLARE_API_TOKEN"]) {
-    return { apiToken: env["CLOUDFLARE_API_TOKEN"], accountId };
+// src/lib/env-aliases.ts
+function firstEnv(env, names) {
+  for (const key of names) {
+    const value = env[key];
+    if (value)
+      return { key, value };
   }
-  if (env["CLOUDFLARE_API_KEY"] && env["CLOUDFLARE_EMAIL"]) {
-    return { apiKey: env["CLOUDFLARE_API_KEY"], email: env["CLOUDFLARE_EMAIL"], accountId };
+  return;
+}
+function hasEveryEnv(env, groups) {
+  return groups.every((names) => !!firstEnv(env, names));
+}
+function flattenEnvNames(groups) {
+  return Array.from(new Set(groups.flatMap((names) => [...names])));
+}
+function providerEnvNames(provider) {
+  switch (provider.toLowerCase()) {
+    case "namecheap":
+      return flattenEnvNames([NAMECHEAP_ENV.apiKey, NAMECHEAP_ENV.username, NAMECHEAP_ENV.clientIp]);
+    case "godaddy":
+      return flattenEnvNames([GODADDY_ENV.apiKey, GODADDY_ENV.apiSecret]);
+    case "brandsight":
+      return flattenEnvNames([
+        BRANDSIGHT_ENV.apiKey,
+        BRANDSIGHT_ENV.apiSecret,
+        BRANDSIGHT_ENV.customerId,
+        BRANDSIGHT_ENV.shopperId,
+        BRANDSIGHT_ENV.accountId
+      ]);
+    case "sedo":
+      return flattenEnvNames([SEDO_ENV.partnerId, SEDO_ENV.signKey, SEDO_ENV.username, SEDO_ENV.password]);
+    case "cloudflare":
+      return flattenEnvNames([CLOUDFLARE_ENV.apiToken, CLOUDFLARE_ENV.apiKey, CLOUDFLARE_ENV.email, CLOUDFLARE_ENV.accountId]);
+    case "route53":
+      return ["AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"];
+    case "aws:beepmedia":
+      return flattenEnvNames([BEEPMEDIA_AWS_ENV.accessKeyId, BEEPMEDIA_AWS_ENV.secretAccessKey]);
+    default:
+      return [];
+  }
+}
+function hasProviderCredentials(provider, env = process.env) {
+  switch (provider.toLowerCase()) {
+    case "namecheap":
+      return hasEveryEnv(env, [NAMECHEAP_ENV.apiKey, NAMECHEAP_ENV.username, NAMECHEAP_ENV.clientIp]);
+    case "godaddy":
+      return hasEveryEnv(env, [GODADDY_ENV.apiKey, GODADDY_ENV.apiSecret]);
+    case "brandsight":
+      return hasEveryEnv(env, [BRANDSIGHT_ENV.apiKey, BRANDSIGHT_ENV.apiSecret, BRANDSIGHT_ENV.customerId]);
+    case "sedo":
+      return hasEveryEnv(env, [SEDO_ENV.partnerId, SEDO_ENV.signKey, SEDO_ENV.username, SEDO_ENV.password]);
+    case "cloudflare": {
+      const tokenMode = !!firstEnv(env, CLOUDFLARE_ENV.apiToken);
+      const keyMode = hasEveryEnv(env, [CLOUDFLARE_ENV.apiKey, CLOUDFLARE_ENV.email]);
+      return tokenMode || keyMode;
+    }
+    case "route53":
+      return !!env["AWS_PROFILE"] || hasEveryEnv(env, [["AWS_ACCESS_KEY_ID"], ["AWS_SECRET_ACCESS_KEY"]]);
+    case "aws:beepmedia":
+      return hasEveryEnv(env, [BEEPMEDIA_AWS_ENV.accessKeyId, BEEPMEDIA_AWS_ENV.secretAccessKey]);
+    default:
+      return false;
   }
+}
+var NAMECHEAP_ENV, GODADDY_ENV, BRANDSIGHT_ENV, SEDO_ENV, CLOUDFLARE_ENV, BEEPMEDIA_AWS_ENV;
+var init_env_aliases = __esm(() => {
+  NAMECHEAP_ENV = {
+    apiKey: ["NAMECHEAP_API_KEY"],
+    username: ["NAMECHEAP_USERNAME"],
+    clientIp: ["NAMECHEAP_CLIENT_IP"]
+  };
+  GODADDY_ENV = {
+    apiKey: ["GODADDY_API_KEY"],
+    apiSecret: ["GODADDY_API_SECRET"]
+  };
+  BRANDSIGHT_ENV = {
+    apiKey: [
+      "BRANDSIGHT_API_KEY",
+      "HASNAXYZ_BRANDSIGHT_LIVE_API_KEY",
+      "HASNAXYZ_BRANDSIGHT_SANDBOX_API_KEY"
+    ],
+    apiSecret: [
+      "BRANDSIGHT_API_SECRET",
+      "HASNAXYZ_BRANDSIGHT_LIVE_API_SECRET",
+      "HASNAXYZ_BRANDSIGHT_SANDBOX_API_SECRET"
+    ],
+    customerId: [
+      "BRANDSIGHT_CUSTOMER_ID",
+      "HASNAXYZ_BRANDSIGHT_LIVE_CUSTOMER_ID",
+      "HASNAXYZ_BRANDSIGHT_SANDBOX_CUSTOMER_ID"
+    ],
+    shopperId: [
+      "BRANDSIGHT_SHOPPER_ID",
+      "HASNAXYZ_BRANDSIGHT_LIVE_SHOPPER_ID",
+      "HASNAXYZ_BRANDSIGHT_SANDBOX_SHOPPER_ID"
+    ],
+    accountId: ["BRANDSIGHT_ACCOUNT_ID", "HASNAXYZ_BRANDSIGHT_LIVE_ACCOUNT_ID"]
+  };
+  SEDO_ENV = {
+    partnerId: ["SEDO_PARTNER_ID", "HASNAXYZ_SEDO_LIVE_PARTNER_ID"],
+    signKey: ["SEDO_API_KEY", "SEDO_SIGN_KEY", "HASNAXYZ_SEDO_LIVE_API_KEY"],
+    username: ["SEDO_USERNAME", "SEDO_EMAIL", "HASNAXYZ_SEDO_LIVE_USERNAME", "HASNAXYZ_SEDO_LIVE_EMAIL"],
+    password: ["SEDO_PASSWORD", "HASNAXYZ_SEDO_LIVE_PASSWORD"]
+  };
+  CLOUDFLARE_ENV = {
+    apiToken: ["CLOUDFLARE_API_TOKEN", "HASNAXYZ_CLOUDFLARE_LIVE_API_TOKEN"],
+    apiKey: ["CLOUDFLARE_API_KEY", "HASNAXYZ_CLOUDFLARE_LIVE_API_KEY"],
+    email: ["CLOUDFLARE_EMAIL", "HASNAXYZ_CLOUDFLARE_LIVE_EMAIL"],
+    accountId: ["CLOUDFLARE_ACCOUNT_ID", "HASNAXYZ_CLOUDFLARE_LIVE_ACCOUNT_ID"]
+  };
+  BEEPMEDIA_AWS_ENV = {
+    accessKeyId: ["HASNASTUDIO_BEEPMEDIA_AWS_LIVE_ACCESS_KEY_ID", "BEEPMEDIA_AWS_ACCESS_KEY_ID"],
+    secretAccessKey: ["HASNASTUDIO_BEEPMEDIA_AWS_LIVE_SECRET_ACCESS_KEY", "BEEPMEDIA_AWS_SECRET_ACCESS_KEY"]
+  };
+});
+
+// src/lib/cloudflare-auth.ts
+function resolveCloudflareConfig(env = process.env) {
+  const accountId = firstEnv(env, CLOUDFLARE_ENV.accountId)?.value;
+  const apiToken = firstEnv(env, CLOUDFLARE_ENV.apiToken)?.value;
+  if (apiToken)
+    return { apiToken, accountId };
+  const apiKey = firstEnv(env, CLOUDFLARE_ENV.apiKey)?.value;
+  const email = firstEnv(env, CLOUDFLARE_ENV.email)?.value;
+  if (apiKey && email)
+    return { apiKey, email, accountId };
   return accountId ? { accountId } : {};
 }
 function cloudflareAuthHeaders(cfg) {
@@ -34699,6 +35050,9 @@ function cloudflareAuthHeaders(cfg) {
     return { "X-Auth-Key": cfg.apiKey, "X-Auth-Email": cfg.email };
   throw new Error("Cloudflare credentials not configured. Set CLOUDFLARE_API_TOKEN, or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.");
 }
+var init_cloudflare_auth = __esm(() => {
+  init_env_aliases();
+});
 
 // src/lib/cloudflare.ts
 function getConfig3() {
@@ -34785,26 +35139,111 @@ async function listRecords2(zoneId, config) {
   }
   return records;
 }
-async function upsertRecord2(zoneId, record, config) {
-  const existing = await cfFetch(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.name)}`, { config });
-  const body = {
-    type: record.type,
-    name: record.name,
-    content: record.content,
-    ttl: record.ttl ?? 1,
-    priority: record.priority,
-    proxied: record.proxied ?? false
-  };
-  if (existing && existing.length > 0) {
-    await cfFetch(`/zones/${zoneId}/dns_records/${existing[0].id}`, { method: "PUT", body, config });
-  } else {
-    await cfFetch(`/zones/${zoneId}/dns_records`, { method: "POST", body, config });
+async function listRecordsByNameType(zoneId, type, name, config) {
+  const result = await cfFetch(`/zones/${zoneId}/dns_records?type=${encodeURIComponent(type)}&name=${encodeURIComponent(name)}`, { config });
+  return (result ?? []).map((r3) => ({
+    id: r3.id,
+    type: r3.type,
+    name: r3.name,
+    content: r3.content,
+    ttl: r3.ttl,
+    priority: r3.priority,
+    proxied: r3.proxied
+  }));
+}
+async function replaceRecordsByNameType(zoneId, records, config) {
+  if (records.length === 0)
+    return;
+  const { type, name } = records[0];
+  const existing = await listRecordsByNameType(zoneId, type, name, config);
+  for (const record of existing) {
+    if (record.id)
+      await deleteRecord2(zoneId, record.id, config);
+  }
+  for (const record of records) {
+    await cfFetch(`/zones/${zoneId}/dns_records`, {
+      method: "POST",
+      body: {
+        type: record.type,
+        name: record.name,
+        content: record.content,
+        ttl: record.ttl ?? 1,
+        priority: record.priority,
+        proxied: record.proxied ?? false
+      },
+      config
+    });
   }
 }
+async function deleteRecord2(zoneId, recordId, config) {
+  await cfFetch(`/zones/${zoneId}/dns_records/${recordId}`, { method: "DELETE", config });
+}
+function zoneToDomainInfo(zone) {
+  return {
+    domain: zone.name,
+    registrar: "Cloudflare DNS",
+    created: "",
+    expires: "",
+    nameservers: zone.nameservers,
+    status: zone.status === "active" ? "active" : "discovered",
+    auto_renew: false
+  };
+}
+function withCloudflareMetadata(existing, zone) {
+  return {
+    ...existing,
+    cloudflare: {
+      zone_id: zone.id,
+      zone_status: zone.status,
+      source: "cloudflare:zones",
+      synced_at: new Date().toISOString()
+    }
+  };
+}
 function createCloudflareProvider(config) {
   const cfg = config ?? getConfig3();
   return {
     name: "cloudflare",
+    async listDomains() {
+      const zones = await listZones(cfg);
+      return zones.map(zoneToDomainInfo);
+    },
+    async syncToLocalDb(dbFns) {
+      const zones = await listZones(cfg);
+      let synced = 0;
+      let created = 0;
+      let updated = 0;
+      const errors3 = [];
+      for (const zone of zones) {
+        try {
+          const info = zoneToDomainInfo(zone);
+          const existing = dbFns.getDomainByName(zone.name);
+          if (existing) {
+            dbFns.updateDomain(existing.id, {
+              ...existing.registrar === "Cloudflare DNS" ? { registrar: null } : {},
+              status: existing.status === "discovered" && info.status === "active" ? "active" : existing.status,
+              nameservers: zone.nameservers,
+              metadata: withCloudflareMetadata(existing.metadata, zone)
+            });
+            updated++;
+          } else {
+            dbFns.createDomain({
+              name: zone.name,
+              status: info.status === "active" ? "active" : "discovered",
+              auto_renew: false,
+              nameservers: zone.nameservers,
+              notes: "Discovered from Cloudflare zones; registrar ownership was not inferred.",
+              metadata: withCloudflareMetadata({}, zone)
+            });
+            created++;
+          }
+          synced++;
+        } catch (err) {
+          errors3.push(`${zone.name}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      return { synced, created, updated, errors: errors3 };
+    },
     async getDnsRecords(domain) {
       const zone = await getZone(domain, cfg);
       if (!zone)
@@ -34822,65 +35261,59 @@ function createCloudflareProvider(config) {
       const zone = await getZone(domain, cfg);
       if (!zone)
         throw new Error(`No Cloudflare zone found for ${domain}`);
+      const grouped = new Map;
       for (const r3 of records) {
-        await upsertRecord2(zone.id, { type: r3.type, name: r3.name, content: r3.value, ttl: r3.ttl || 1, priority: r3.priority }, cfg);
+        const key = `${r3.type}|${r3.name}`;
+        const existing = grouped.get(key) ?? [];
+        existing.push({ type: r3.type, name: r3.name, content: r3.value, ttl: r3.ttl || 1, priority: r3.priority });
+        grouped.set(key, existing);
+      }
+      for (const group of grouped.values()) {
+        await replaceRecordsByNameType(zone.id, group, cfg);
       }
       return true;
     }
   };
 }
 var CF_BASE = "https://api.cloudflare.com/client/v4";
-var init_cloudflare = () => {};
+var init_cloudflare = __esm(() => {
+  init_cloudflare_auth();
+});
 
 // src/lib/brandsight.ts
 function resolveBrandsightConfig(env = process.env) {
+  const apiKey = firstEnv(env, BRANDSIGHT_ENV.apiKey)?.value ?? "";
+  const apiSecret = firstEnv(env, BRANDSIGHT_ENV.apiSecret)?.value;
+  const customerId = firstEnv(env, BRANDSIGHT_ENV.customerId)?.value;
+  const shopperId = firstEnv(env, BRANDSIGHT_ENV.shopperId)?.value;
+  const accountId = firstEnv(env, BRANDSIGHT_ENV.accountId)?.value;
   return {
-    apiKey: env["BRANDSIGHT_API_KEY"] ?? "",
-    apiSecret: env["BRANDSIGHT_API_SECRET"],
-    customerId: env["BRANDSIGHT_CUSTOMER_ID"],
-    shopperId: env["BRANDSIGHT_SHOPPER_ID"],
-    accountId: env["BRANDSIGHT_ACCOUNT_ID"]
+    apiKey,
+    apiSecret,
+    customerId,
+    shopperId,
+    accountId,
+    baseUrl: env["BRANDSIGHT_BASE_URL"]
+  };
+}
+function brandsightCapability(env = process.env) {
+  const cfg = resolveBrandsightConfig(env);
+  const configured = !!(cfg.apiKey && cfg.apiSecret && cfg.customerId);
+  return {
+    configured,
+    gated: true,
+    notes: configured ? "Credentials present, but GoDaddy Corporate Domains (Brandsight) is enterprise/contract-only; use Route53 for automated purchase." : "Not configured and enterprise/contract-only; not usable for automated purchase."
   };
 }
 function getApiKey() {
-  const key = process.env["BRANDSIGHT_API_KEY"];
+  const key = resolveBrandsightConfig().apiKey;
   if (!key) {
-    throw new BrandsightApiError("BRANDSIGHT_API_KEY environment variable is not set");
+    throw new BrandsightApiError("Brandsight API key is not set. Set BRANDSIGHT_API_KEY or HASNAXYZ_BRANDSIGHT_LIVE_API_KEY.");
   }
   return key;
 }
 function getConfig4() {
-  return {
-    apiKey: process.env["BRANDSIGHT_API_KEY"] ?? "",
-    accountId: process.env["BRANDSIGHT_ACCOUNT_ID"]
-  };
-}
-async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": USER_AGENT
-  };
-  try {
-    const response = await fetchFn(url, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : undefined,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
-  }
+  return resolveBrandsightConfig();
 }
 async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
   const fetchFn = _fetchFn || globalThis.fetch;
@@ -34908,12 +35341,109 @@ async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
     return { data: null, stub: true };
   }
 }
+function requireDomainConfig(config) {
+  const cfg = config ?? getConfig4();
+  if (!cfg.apiKey || !cfg.apiSecret || !cfg.customerId) {
+    throw new BrandsightApiError("Brandsight Domain API credentials are not configured. Set BRANDSIGHT_API_KEY, BRANDSIGHT_API_SECRET, and BRANDSIGHT_CUSTOMER_ID (or HASNAXYZ_BRANDSIGHT_LIVE_* aliases).");
+  }
+  return cfg;
+}
+function domainBaseUrl(cfg) {
+  return cfg.baseUrl ?? BRANDSIGHT_DOMAIN_BASE;
+}
+function domainHeaders(cfg) {
+  return {
+    Authorization: `sso-key ${cfg.apiKey}:${cfg.apiSecret}`,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    "User-Agent": USER_AGENT
+  };
+}
+async function domainApiRequest(method, path, config, body) {
+  const cfg = requireDomainConfig(config);
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const response = await fetchFn(`${domainBaseUrl(cfg)}${path}`, {
+    method,
+    headers: domainHeaders(cfg),
+    body: body ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(30000)
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new BrandsightApiError(`Brandsight Domain API ${method} ${path} failed with status ${response.status}`, response.status, text);
+  }
+  if (!text.trim())
+    return {};
+  return JSON.parse(text);
+}
+function normalizeBrandsightDomain(raw) {
+  const nameServers = raw.nameServers ?? raw.nameservers ?? [];
+  const expiresAt = raw.expiresAt ?? raw.expires ?? "";
+  const createdAt = raw.createdAt ?? raw.created ?? "";
+  const renewAuto = raw.renewAuto ?? raw.auto_renew ?? false;
+  return {
+    ...raw,
+    domain: String(raw.domain ?? ""),
+    status: String(raw.status ?? "UNKNOWN"),
+    created: createdAt,
+    expires: expiresAt,
+    auto_renew: renewAuto,
+    locked: Boolean(raw.locked),
+    nameservers: nameServers,
+    createdAt,
+    expiresAt,
+    nameServers,
+    renewAuto
+  };
+}
+function customerPath(cfg, path) {
+  return `/customers/${encodeURIComponent(cfg.customerId)}${path}`;
+}
+function domainTld(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  if (parts.length < 2)
+    throw new BrandsightApiError(`Invalid domain name: ${domain}`);
+  return parts.slice(1).join(".");
+}
+function brandsightContact(contact) {
+  return {
+    addressMailing: {
+      address1: contact.address_line_1,
+      city: contact.city,
+      country: contact.country_code,
+      postalCode: contact.zip_code,
+      state: contact.state
+    },
+    email: contact.email,
+    encoding: "ASCII",
+    nameFirst: contact.first_name,
+    nameLast: contact.last_name,
+    organization: contact.organization_name,
+    phone: contact.phone
+  };
+}
+async function domainAvailability(domain, cfg, type, period = 1) {
+  const params = new URLSearchParams({
+    domain,
+    period: String(period),
+    type,
+    optimizeFor: "ACCURACY"
+  });
+  const result = await domainApiRequest("GET", `/domains/available?${params.toString()}`, cfg);
+  return {
+    domain: result.domain ?? domain,
+    available: Boolean(result.available),
+    price: result.price,
+    currency: result.currency,
+    registryPremiumPricing: result.registryPremiumPricing
+  };
+}
 function generateStubAlerts(brandName) {
-  const now = new Date().toISOString();
+  const now2 = new Date().toISOString();
   return [
-    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now },
-    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now },
-    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now }
+    { domain: `${brandName}-deals.com`, type: "keyword", registered_at: now2 },
+    { domain: `${brandName.replace(/a/gi, "4").replace(/e/gi, "3")}.com`, type: "homoglyph", registered_at: now2 },
+    { domain: `${brandName}s.com`, type: "typosquat", registered_at: now2 }
   ];
 }
 function generateStubSimilarDomains(domain) {
@@ -34960,32 +35490,160 @@ async function getThreatAssessment(domain) {
   return { ...result.data, stub: false };
 }
 async function listDomains2(config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet("/portfolio/domains", cfg.apiKey);
-  if (result.stub)
-    return [];
-  return result.data.domains ?? [];
+  const cfg = requireDomainConfig(config);
+  const domains = [];
+  const seenMarkers = new Set;
+  let marker;
+  while (true) {
+    const params = new URLSearchParams({ limit: "500" });
+    if (marker)
+      params.set("marker", marker);
+    const batch = await domainApiRequest("GET", customerPath(cfg, `/domains?${params.toString()}`), cfg);
+    if (!Array.isArray(batch) || batch.length === 0)
+      break;
+    domains.push(...batch.map(normalizeBrandsightDomain).filter((d3) => d3.domain));
+    if (batch.length < 500)
+      break;
+    const nextMarker = String(batch[batch.length - 1]?.domain ?? "");
+    if (!nextMarker || seenMarkers.has(nextMarker))
+      break;
+    seenMarkers.add(nextMarker);
+    marker = nextMarker;
+  }
+  return domains;
 }
 async function getDomainInfo3(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return null;
-  return result.data;
+  const cfg = requireDomainConfig(config);
+  const result = await domainApiRequest("GET", customerPath(cfg, `/domains/${encodeURIComponent(domain)}`), cfg);
+  return normalizeBrandsightDomain(result);
 }
 async function checkAvailability4(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return { domain, available: false };
-  return result.data;
+  const cfg = requireDomainConfig(config);
+  return domainAvailability(domain, cfg, "REGISTRATION", 1);
 }
 async function renewDomain3(domain, years = 1, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
-  if (result.stub)
-    return { success: false };
-  return { success: true, orderId: result.data.orderId };
+  const cfg = requireDomainConfig(config);
+  const current = await getDomainInfo3(domain, cfg);
+  if (!current?.expires)
+    throw new BrandsightApiError(`Cannot renew ${domain}: current expiry is unavailable`);
+  const quote = await domainAvailability(domain, cfg, "RENEWAL", years);
+  const price = quote.price ?? current.renewal?.price;
+  const currency = quote.currency ?? current.renewal?.currency;
+  if (price == null || !currency) {
+    throw new BrandsightApiError(`Cannot renew ${domain}: renewal quote did not include an exact price and currency`);
+  }
+  const result = await domainApiRequest("POST", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/renew`), cfg, {
+    consent: {
+      agreedAt: new Date().toISOString(),
+      agreedBy: cfg.shopperId ?? "domains-cli",
+      currency,
+      price,
+      registryPremiumPricing: quote.registryPremiumPricing ?? false
+    },
+    expires: current.expires,
+    period: years
+  });
+  return { success: true, orderId: result.orderId ?? result.id };
+}
+async function getLegalAgreements(tld, privacy = false, config) {
+  const cfg = requireDomainConfig(config);
+  const params = new URLSearchParams({
+    privacy: String(privacy),
+    tlds: tld
+  });
+  return domainApiRequest("GET", customerPath(cfg, `/domains/agreements?${params.toString()}`), cfg);
+}
+async function getRegistrationSchema(tld, config) {
+  const cfg = requireDomainConfig(config);
+  return domainApiRequest("GET", customerPath(cfg, `/domains/register/schema/${encodeURIComponent(tld)}`), cfg);
+}
+async function validateRegistrationRequest(payload, config) {
+  const cfg = requireDomainConfig(config);
+  await domainApiRequest("POST", customerPath(cfg, "/domains/register/validate"), cfg, payload);
+  return true;
+}
+async function registerBrandsightDomain(domain, contact, options = {}, config) {
+  const cfg = requireDomainConfig(config);
+  const period = options.years ?? 1;
+  const availability = await domainAvailability(domain, cfg, "REGISTRATION", period);
+  if (!availability.available)
+    throw new BrandsightApiError(`${domain} is not available for registration`);
+  const price = options.premiumPrice ?? availability.price;
+  if (price == null || !availability.currency) {
+    throw new BrandsightApiError(`Cannot register ${domain}: availability quote did not include an exact price and currency`);
+  }
+  const tld = domainTld(domain);
+  const schema = await getRegistrationSchema(tld, cfg);
+  const required = Array.isArray(schema["required"]) ? schema["required"] : [];
+  if (required.includes("metadata") && !options.metadata) {
+    throw new BrandsightApiError(`Cannot register ${domain}: ${tld} requires TLD-specific metadata; pass registration metadata before validation`);
+  }
+  const privacy = options.privacy ?? false;
+  const agreements = await getLegalAgreements(tld, privacy, cfg);
+  const agreementKeys = agreements.map((a3) => a3.agreementKey).filter(Boolean);
+  const c3 = brandsightContact(contact);
+  const payload = {
+    consent: {
+      agreedAt: new Date().toISOString(),
+      agreedBy: contact.email || cfg.shopperId || "domains-cli",
+      agreementKeys,
+      currency: availability.currency,
+      price,
+      registryPremiumPricing: availability.registryPremiumPricing ?? !!options.premiumPrice
+    },
+    contacts: {
+      admin: c3,
+      billing: c3,
+      registrant: c3,
+      tech: c3
+    },
+    domain,
+    metadata: options.metadata ?? {},
+    nameServers: options.nameservers ?? [],
+    period,
+    privacy,
+    renewAuto: options.autoRenew ?? true
+  };
+  await validateRegistrationRequest(payload, cfg);
+  const result = await domainApiRequest("POST", customerPath(cfg, "/domains/register"), cfg, payload);
+  return {
+    success: true,
+    orderId: result.orderId ?? result.id,
+    operationId: result.operationId ?? result.id,
+    chargedAmount: String(price)
+  };
+}
+async function updateNameservers3(domain, nameservers, config) {
+  const cfg = requireDomainConfig(config);
+  const result = await domainApiRequest("PUT", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/nameServers`), cfg, { nameServers: nameservers });
+  return { success: true, operationId: result.operationId ?? result.id };
+}
+async function getDnsRecords3(domain, config) {
+  const cfg = requireDomainConfig(config);
+  const records = [];
+  let offset = 0;
+  const limit = 1000;
+  while (true) {
+    const batch = await domainApiRequest("GET", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/records?offset=${offset}&limit=${limit}`), cfg);
+    if (!Array.isArray(batch) || batch.length === 0)
+      break;
+    records.push(...batch);
+    if (batch.length < limit)
+      break;
+    offset++;
+  }
+  return records;
+}
+function normalizeBrandsightDnsRecord(record) {
+  return {
+    ...record,
+    ttl: Math.max(record.ttl || 600, 600)
+  };
+}
+async function setDnsRecords3(domain, records, config) {
+  const cfg = requireDomainConfig(config);
+  await domainApiRequest("PUT", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/records`), cfg, records.map(normalizeBrandsightDnsRecord));
+  return true;
 }
 async function syncToLocalDb3(dbFns, config) {
   const domains = await listDomains2(config);
@@ -35030,7 +35688,7 @@ function createBrandsightProvider(config) {
       return domains.map((d3) => ({
         domain: d3.domain,
         registrar: "Brandsight",
-        created: "",
+        created: d3.created ?? "",
         expires: d3.expires,
         nameservers: d3.nameservers,
         status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
@@ -35044,23 +35702,58 @@ function createBrandsightProvider(config) {
       return {
         domain: d3.domain,
         registrar: "Brandsight",
-        created: "",
+        created: d3.created ?? "",
         expires: d3.expires,
         nameservers: d3.nameservers,
         status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
         auto_renew: d3.auto_renew
       };
     },
-    async renewDomain(domain) {
-      const result = await renewDomain3(domain, 1, cfg);
+    async renewDomain(domain, years = 1) {
+      const result = await renewDomain3(domain, years, cfg);
       return { domain, success: result.success, orderId: result.orderId };
     },
+    async registerDomain(domain, contact, options) {
+      const result = await registerBrandsightDomain(domain, contact, options, cfg);
+      return {
+        domain,
+        success: result.success,
+        orderId: result.orderId,
+        operationId: result.operationId,
+        chargedAmount: result.chargedAmount
+      };
+    },
+    async updateNameservers(domain, nameservers) {
+      const result = await updateNameservers3(domain, nameservers, cfg);
+      return { domain, success: result.success, operationId: result.operationId };
+    },
+    async getDnsRecords(domain) {
+      const records = await getDnsRecords3(domain, cfg);
+      return records.map((r3) => ({
+        type: r3.type,
+        name: r3.name,
+        value: r3.data,
+        ttl: r3.ttl,
+        priority: r3.priority
+      }));
+    },
+    async setDnsRecords(domain, records) {
+      return setDnsRecords3(domain, records.map((r3) => ({
+        type: r3.type,
+        name: r3.name,
+        data: r3.value,
+        ttl: r3.ttl,
+        priority: r3.priority
+      })), cfg);
+    },
     async checkAvailability(domain) {
       const result = await checkAvailability4(domain, cfg);
       return {
         domain: result.domain,
         available: result.available,
-        standard_price: result.price,
+        is_premium: result.registryPremiumPricing,
+        premium_price: result.registryPremiumPricing ? result.price : undefined,
+        standard_price: result.registryPremiumPricing ? undefined : result.price,
         currency: result.currency
       };
     },
@@ -35069,8 +35762,9 @@ function createBrandsightProvider(config) {
     }
   };
 }
-var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
+var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1", BRANDSIGHT_DOMAIN_BASE = "https://api.godaddy.com/v2";
 var init_brandsight = __esm(() => {
+  init_env_aliases();
   init_version();
   BrandsightApiError = class BrandsightApiError extends Error {
     statusCode;
@@ -35095,9 +35789,9 @@ __export(exports_config, {
   getConfigKey: () => getConfigKey,
   applyPurchaseProfile: () => applyPurchaseProfile
 });
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
 function getPurchaseProfile() {
   return loadConfig3().purchase_aws_profile ?? process.env["DOMAINS_PURCHASE_AWS_PROFILE"] ?? undefined;
 }
@@ -35110,11 +35804,11 @@ function applyPurchaseProfile() {
   return profile;
 }
 function configPath() {
-  return join3(homedir3(), ".hasna", "domains", "config.json");
+  return join4(homedir4(), ".hasna", "domains", "config.json");
 }
 function loadConfig3() {
   const path = configPath();
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return {};
   try {
     return JSON.parse(readFileSync3(path, "utf-8"));
@@ -35124,8 +35818,8 @@ function loadConfig3() {
 }
 function saveConfig(config) {
   const path = configPath();
-  const dir = join3(homedir3(), ".hasna", "domains");
-  if (!existsSync2(dir))
+  const dir = join4(homedir4(), ".hasna", "domains");
+  if (!existsSync3(dir))
     mkdirSync2(dir, { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2), "utf-8");
 }
@@ -35176,44 +35870,6 @@ function getConfigKey(keyPath) {
 }
 var init_config = () => {};
 
-// src/lib/creds-check.ts
-var exports_creds_check = {};
-__export(exports_creds_check, {
-  checkProvisioningCredentials: () => checkProvisioningCredentials
-});
-function checkProvisioningCredentials(env = process.env) {
-  const out = [];
-  const hasAws = !!(env["AWS_ACCESS_KEY_ID"] && env["AWS_SECRET_ACCESS_KEY"]) || !!env["AWS_PROFILE"];
-  out.push({
-    provider: "route53",
-    configured: hasAws,
-    mode: env["AWS_PROFILE"] ? `profile:${env["AWS_PROFILE"]}` : hasAws ? "access-keys" : "none",
-    detail: hasAws ? "AWS credentials present (region us-east-1 for Route53 Domains)" : "Set AWS_PROFILE or AWS_ACCESS_KEY_ID/SECRET"
-  });
-  const cf = resolveCloudflareConfig(env);
-  const cfMode = cf.apiToken ? "token" : cf.apiKey && cf.email ? "global-key" : "none";
-  out.push({
-    provider: "cloudflare",
-    configured: cfMode !== "none",
-    mode: cfMode + (cf.accountId ? "+account" : ""),
-    detail: cfMode === "none" ? "Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY+CLOUDFLARE_EMAIL" : cf.accountId ? "ok" : "missing CLOUDFLARE_ACCOUNT_ID (needed to create zones)"
-  });
-  const bs = resolveBrandsightConfig(env);
-  const bsConfigured = !!(bs.apiKey && bs.apiSecret && bs.customerId);
-  out.push({
-    provider: "brandsight",
-    configured: bsConfigured,
-    mode: bsConfigured ? "full-creds" : "none",
-    detail: "enterprise/contract-only (gated) \u2014 not used for automated purchase"
-  });
-  const gd = !!(env["GODADDY_API_KEY"] && env["GODADDY_API_SECRET"]);
-  out.push({ provider: "godaddy", configured: gd, mode: gd ? "key+secret" : "none", detail: "retail API gated for purchase/DNS since 2024" });
-  return out;
-}
-var init_creds_check = __esm(() => {
-  init_brandsight();
-});
-
 // src/db/domain-history.ts
 function rowToDomainHistory(row) {
   return {
@@ -35296,8 +35952,10 @@ var init_domain_history = __esm(() => {
 // src/lib/sedo.ts
 var exports_sedo = {};
 __export(exports_sedo, {
+  sedoCapability: () => sedoCapability,
   searchSedoDomains: () => searchSedoDomains,
   searchHealthDomains: () => searchHealthDomains,
+  resolveSedoConfig: () => resolveSedoConfig,
   removeDomainFromSedo: () => removeDomainFromSedo,
   recordSedoPurchase: () => recordSedoPurchase,
   listSedoPortfolio: () => listSedoPortfolio,
@@ -35307,16 +35965,31 @@ __export(exports_sedo, {
   checkSedoBlacklist: () => checkSedoBlacklist,
   addDomainToSedo: () => addDomainToSedo
 });
+function resolveSedoConfig(env = process.env) {
+  return {
+    partnerId: firstEnv(env, SEDO_ENV.partnerId)?.value,
+    signKey: firstEnv(env, SEDO_ENV.signKey)?.value,
+    username: firstEnv(env, SEDO_ENV.username)?.value,
+    password: firstEnv(env, SEDO_ENV.password)?.value
+  };
+}
 function getSedoConfig() {
-  const partnerId = process.env.SEDO_PARTNER_ID;
-  const signKey = process.env.SEDO_API_KEY;
-  const username = process.env.SEDO_USERNAME;
-  const password = process.env.SEDO_PASSWORD;
+  const config = resolveSedoConfig();
+  const { partnerId, signKey, username, password } = config;
   if (!partnerId || !signKey || !username || !password) {
-    throw new Error("Sedo credentials not configured. Required: SEDO_PARTNER_ID, SEDO_API_KEY, SEDO_USERNAME, SEDO_PASSWORD");
+    throw new Error("Sedo credentials not configured. Required: SEDO_PARTNER_ID, SEDO_API_KEY, SEDO_USERNAME, SEDO_PASSWORD (or HASNAXYZ_SEDO_LIVE_* aliases)");
   }
   return { partnerId, signKey, username, password };
 }
+function sedoCapability(env = process.env) {
+  const cfg = resolveSedoConfig(env);
+  const configured = !!(cfg.partnerId && cfg.signKey && cfg.username && cfg.password);
+  return {
+    configured,
+    gated: true,
+    notes: configured ? "Credentials present; Sedo supports marketplace search, portfolio listing, listing edits, and recorded purchases, but not registrar DNS or direct self-serve registration through this CLI." : "Not configured; Sedo is marketplace-only here, not registrar DNS."
+  };
+}
 function buildXmlParams(params) {
   return {
     partnerid: params.partnerId,
@@ -35515,10 +36188,85 @@ function recordSedoPurchase(domain, price, orderId) {
 }
 var BASE_URL = "https://api.sedo.com/api/v1/";
 var init_sedo = __esm(() => {
+  init_env_aliases();
   init_domains();
   init_domain_history();
 });
 
+// src/lib/creds-check.ts
+var exports_creds_check = {};
+__export(exports_creds_check, {
+  checkProvisioningCredentials: () => checkProvisioningCredentials
+});
+function configuredStatus(provider, mode, detail) {
+  return { provider, configured: true, mode, detail };
+}
+function missingStatus(provider, detail) {
+  return { provider, configured: false, mode: "none", detail };
+}
+function checkProvisioningCredentials(env = process.env) {
+  const out = [];
+  const hasAwsKeys = !!(env["AWS_ACCESS_KEY_ID"] && env["AWS_SECRET_ACCESS_KEY"]);
+  const hasAwsProfile = !!env["AWS_PROFILE"];
+  if (hasAwsProfile || hasAwsKeys) {
+    out.push(configuredStatus("route53", hasAwsProfile ? `profile:${env["AWS_PROFILE"]}` : "access-keys", "AWS credentials present (Route 53 Domains API uses us-east-1)"));
+  } else {
+    out.push(missingStatus("route53", "Set AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY"));
+  }
+  const beepmediaAws = hasProviderCredentials("aws:beepmedia", env);
+  out.push({
+    provider: "aws:beepmedia",
+    configured: beepmediaAws,
+    mode: beepmediaAws ? "scoped-env" : "none",
+    detail: beepmediaAws ? "Beepmedia AWS scoped env keys are present; export them as AWS_* or use AWS_PROFILE=beepmedia for Route53 sync." : `Set ${BEEPMEDIA_AWS_ENV.accessKeyId.join(" or ")} and ${BEEPMEDIA_AWS_ENV.secretAccessKey.join(" or ")}`
+  });
+  const cf = resolveCloudflareConfig(env);
+  const cfMode = cf.apiToken ? "token" : cf.apiKey && cf.email ? "global-key" : "none";
+  out.push({
+    provider: "cloudflare",
+    configured: cfMode !== "none",
+    mode: cfMode + (cf.accountId ? "+account" : ""),
+    detail: cfMode === "none" ? "Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY+CLOUDFLARE_EMAIL" : cf.accountId ? "ok" : "missing CLOUDFLARE_ACCOUNT_ID (needed to create zones)"
+  });
+  out.push({
+    provider: "namecheap",
+    configured: hasProviderCredentials("namecheap", env),
+    mode: hasProviderCredentials("namecheap", env) ? "api-key+username+client-ip" : "none",
+    detail: "Requires NAMECHEAP_API_KEY, NAMECHEAP_USERNAME, and whitelisted NAMECHEAP_CLIENT_IP"
+  });
+  const gd = godaddyCapability(env);
+  out.push({
+    provider: "godaddy",
+    configured: gd.configured,
+    mode: gd.configured ? "key+secret" : "none",
+    detail: gd.notes
+  });
+  const bs = brandsightCapability(env);
+  const bsMode = firstEnv(env, ["BRANDSIGHT_API_KEY"]) ? "standard-env" : bs.configured ? "scoped-env" : "none";
+  out.push({
+    provider: "brandsight",
+    configured: bs.configured,
+    mode: bsMode,
+    detail: bs.notes
+  });
+  const sedo = sedoCapability(env);
+  const sedoMode = firstEnv(env, ["SEDO_API_KEY"]) ? "standard-env" : sedo.configured ? "scoped-env" : "none";
+  out.push({
+    provider: "sedo",
+    configured: sedo.configured,
+    mode: sedoMode,
+    detail: sedo.notes
+  });
+  return out;
+}
+var init_creds_check = __esm(() => {
+  init_cloudflare_auth();
+  init_brandsight();
+  init_godaddy();
+  init_sedo();
+  init_env_aliases();
+});
+
 // src/lib/provision-state.ts
 function isDomainTerminal(s3) {
   return TERMINAL.has(s3);
@@ -35593,7 +36341,7 @@ function makeDomainDaemonDeps() {
           return;
         case "delegate_ns": {
           const zone = await ensureZone(domain);
-          await updateNameservers(domain, zone.nameservers);
+          await updateNameservers2(domain, zone.nameservers);
           return;
         }
         case "check_ns_propagation":
@@ -40553,6 +41301,684 @@ var {
   Help
 } = import__.default;
 
+// node_modules/@hasna/events/dist/commander.js
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { randomUUID } from "crypto";
+import { spawn } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+function getPathValue(input, path) {
+  return path.split(".").reduce((value, part) => {
+    if (value && typeof value === "object" && part in value) {
+      return value[part];
+    }
+    return;
+  }, input);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function matchString(value, matcher) {
+  if (matcher === undefined)
+    return true;
+  if (value === undefined)
+    return false;
+  const matchers = Array.isArray(matcher) ? matcher : [matcher];
+  return matchers.some((item) => wildcardToRegExp(item).test(value));
+}
+function matchRecord(input, matcher) {
+  if (!matcher)
+    return true;
+  return Object.entries(matcher).every(([path, expected]) => {
+    const actual = getPathValue(input, path);
+    if (typeof expected === "string" || Array.isArray(expected)) {
+      return matchString(actual === undefined ? undefined : String(actual), expected);
+    }
+    return actual === expected;
+  });
+}
+function eventMatchesFilter(event, filter) {
+  return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
+}
+function channelMatchesEvent(channel, event) {
+  if (!channel.enabled)
+    return false;
+  if (!channel.filters || channel.filters.length === 0)
+    return true;
+  return channel.filters.some((filter) => eventMatchesFilter(event, filter));
+}
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
+var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+function getEventsDataDir(override) {
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
+}
+
+class JsonEventsStore {
+  dataDir;
+  channelsPath;
+  eventsPath;
+  deliveriesPath;
+  constructor(dataDir = getEventsDataDir()) {
+    this.dataDir = dataDir;
+    this.channelsPath = join(dataDir, "channels.json");
+    this.eventsPath = join(dataDir, "events.json");
+    this.deliveriesPath = join(dataDir, "deliveries.json");
+  }
+  async init() {
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
+    await this.ensureArrayFile(this.channelsPath);
+    await this.ensureArrayFile(this.eventsPath);
+    await this.ensureArrayFile(this.deliveriesPath);
+  }
+  async addChannel(channel) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const index = channels.findIndex((item) => item.id === channel.id);
+    if (index >= 0) {
+      channels[index] = { ...channel, createdAt: channels[index].createdAt, updatedAt: new Date().toISOString() };
+    } else {
+      channels.push(channel);
+    }
+    await this.writeJson(this.channelsPath, channels);
+    return index >= 0 ? channels[index] : channel;
+  }
+  async listChannels() {
+    await this.init();
+    return this.readJson(this.channelsPath, []);
+  }
+  async getChannel(id) {
+    const channels = await this.listChannels();
+    return channels.find((channel) => channel.id === id);
+  }
+  async removeChannel(id) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const next = channels.filter((channel) => channel.id !== id);
+    await this.writeJson(this.channelsPath, next);
+    return next.length !== channels.length;
+  }
+  async appendEvent(event) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return event;
+  }
+  async listEvents() {
+    await this.init();
+    return this.readJson(this.eventsPath, []);
+  }
+  async findEventByIdentity(identity) {
+    const events = await this.listEvents();
+    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+  }
+  async appendDelivery(result) {
+    await this.init();
+    const deliveries = await this.readJson(this.deliveriesPath, []);
+    deliveries.push(result);
+    await this.writeJson(this.deliveriesPath, deliveries);
+    return result;
+  }
+  async listDeliveries() {
+    await this.init();
+    return this.readJson(this.deliveriesPath, []);
+  }
+  async exportData() {
+    return {
+      channels: await this.listChannels(),
+      events: await this.listEvents(),
+      deliveries: await this.listDeliveries()
+    };
+  }
+  async ensureArrayFile(path) {
+    if (!existsSync(path)) {
+      await writeFile(path, `[]
+`, { encoding: "utf-8", mode: 384 });
+    }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+  async readJson(path, fallback) {
+    try {
+      const raw = await readFile(path, "utf-8");
+      if (!raw.trim())
+        return fallback;
+      return JSON.parse(raw);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return fallback;
+      throw error;
+    }
+  }
+  async writeJson(path, value) {
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+    await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+}
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+function buildSignatureBase(timestamp, body) {
+  return `${timestamp}.${body}`;
+}
+function signPayload(secret, timestamp, body) {
+  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
+  return `sha256=${digest}`;
+}
+function now() {
+  return new Date().toISOString();
+}
+function truncate(value, max = 4096) {
+  return value.length > max ? `${value.slice(0, max)}...` : value;
+}
+function buildWebhookRequest(event, channel) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const body = JSON.stringify(event);
+  const timestamp = event.time;
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": "@hasna/events",
+    "X-Hasna-Event-Id": event.id,
+    "X-Hasna-Event-Type": event.type,
+    "X-Hasna-Timestamp": timestamp,
+    ...channel.webhook.headers
+  };
+  if (channel.webhook.secret) {
+    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  }
+  return { body, headers };
+}
+async function dispatchWebhook(event, channel, options = {}) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const startedAt = now();
+  const { body, headers } = buildWebhookRequest(event, channel);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
+  try {
+    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const responseBody = truncate(await response.text());
+    return {
+      attempt: 1,
+      status: response.ok ? "success" : "failed",
+      startedAt,
+      completedAt: now(),
+      responseStatus: response.status,
+      responseBody,
+      error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+    };
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function dispatchCommand(event, channel) {
+  if (!channel.command)
+    throw new Error(`Channel ${channel.id} has no command config`);
+  const startedAt = now();
+  const eventJson = JSON.stringify(event);
+  const env = {
+    ...process.env,
+    ...channel.command.env,
+    HASNA_CHANNEL_ID: channel.id,
+    HASNA_EVENT_ID: event.id,
+    HASNA_EVENT_TYPE: event.type,
+    HASNA_EVENT_SOURCE: event.source,
+    HASNA_EVENT_SUBJECT: event.subject ?? "",
+    HASNA_EVENT_SEVERITY: event.severity,
+    HASNA_EVENT_TIME: event.time,
+    HASNA_EVENT_DEDUPE_KEY: event.dedupeKey ?? "",
+    HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
+    HASNA_EVENT_JSON: eventJson
+  };
+  return new Promise((resolve) => {
+    const child = spawn(channel.command.command, channel.command.args ?? [], {
+      cwd: channel.command.cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill("SIGTERM"), channel.command.timeoutMs ?? 15000);
+    child.stdin.end(eventJson);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      clearTimeout(timeout);
+      resolve({
+        attempt: 1,
+        status: "failed",
+        startedAt,
+        completedAt: now(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: error.message
+      });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timeout);
+      const success = code === 0;
+      resolve({
+        attempt: 1,
+        status: success ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: success ? undefined : `Command exited with ${signal ? `signal ${signal}` : `code ${code}`}`
+      });
+    });
+  });
+}
+async function dispatchChannel(event, channel, options = {}) {
+  if (channel.transport === "webhook")
+    return dispatchWebhook(event, channel, options);
+  if (channel.transport === "command")
+    return dispatchCommand(event, channel);
+  return {
+    attempt: 1,
+    status: "skipped",
+    startedAt: now(),
+    completedAt: now(),
+    error: `Unsupported transport: ${channel.transport}`
+  };
+}
+function createDeliveryResult(event, channel, attempts) {
+  const status = attempts.some((attempt) => attempt.status === "success") ? "success" : attempts.every((attempt) => attempt.status === "skipped") ? "skipped" : "failed";
+  return {
+    id: randomUUID(),
+    eventId: event.id,
+    channelId: channel.id,
+    transport: channel.transport,
+    status,
+    attempts,
+    createdAt: attempts[0]?.startedAt ?? now(),
+    completedAt: attempts.at(-1)?.completedAt ?? now()
+  };
+}
+function createEvent(input) {
+  return {
+    id: input.id ?? randomUUID2(),
+    source: input.source,
+    type: input.type,
+    time: normalizeTime(input.time),
+    subject: input.subject,
+    severity: input.severity ?? "info",
+    data: input.data ?? {},
+    message: input.message,
+    dedupeKey: input.dedupeKey,
+    schemaVersion: input.schemaVersion ?? "1.0",
+    metadata: input.metadata ?? {}
+  };
+}
+
+class EventsClient {
+  store;
+  redactors;
+  transportOptions;
+  constructor(options = {}) {
+    this.store = options.store ?? new JsonEventsStore(options.dataDir);
+    this.redactors = options.redactors ?? [];
+    this.transportOptions = { fetchImpl: options.fetchImpl };
+  }
+  async addChannel(input) {
+    const timestamp = new Date().toISOString();
+    return this.store.addChannel({
+      ...input,
+      createdAt: input.createdAt ?? timestamp,
+      updatedAt: input.updatedAt ?? timestamp
+    });
+  }
+  async listChannels() {
+    return this.store.listChannels();
+  }
+  async removeChannel(id) {
+    return this.store.removeChannel(id);
+  }
+  async emit(input, options = {}) {
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
+    if (options.dedupe !== false) {
+      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return { event: existing, deliveries: [], deduped: true };
+      }
+    }
+    await this.store.appendEvent(event);
+    const deliveries = options.deliver === false ? [] : await this.deliver(event);
+    return { event, deliveries, deduped: false };
+  }
+  async listEvents() {
+    return this.store.listEvents();
+  }
+  async listDeliveries() {
+    return this.store.listDeliveries();
+  }
+  async deliver(event) {
+    const channels = await this.store.listChannels();
+    const selected = channels.filter((channel) => channelMatchesEvent(channel, event));
+    const deliveries = [];
+    for (const channel of selected) {
+      const eventForChannel = await this.applyRedaction(event, channel);
+      const result = await this.deliverWithRetry(eventForChannel, channel);
+      await this.store.appendDelivery(result);
+      deliveries.push(result);
+    }
+    return deliveries;
+  }
+  async testChannel(id, input = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const event = createEvent({
+      source: input.source ?? "hasna.events",
+      type: input.type ?? "events.test",
+      subject: input.subject ?? id,
+      severity: input.severity ?? "info",
+      data: input.data ?? { test: true },
+      message: input.message ?? "Hasna events test delivery",
+      dedupeKey: input.dedupeKey,
+      schemaVersion: input.schemaVersion,
+      metadata: input.metadata,
+      time: input.time,
+      id: input.id
+    });
+    const eventForChannel = await this.applyRedaction(event, channel);
+    const result = await this.deliverWithRetry(eventForChannel, channel);
+    await this.store.appendDelivery(result);
+    return result;
+  }
+  async replay(options = {}) {
+    const events = (await this.store.listEvents()).filter((event) => {
+      if (options.eventId && event.id !== options.eventId)
+        return false;
+      if (options.source && event.source !== options.source)
+        return false;
+      if (options.type && event.type !== options.type)
+        return false;
+      return true;
+    });
+    if (options.dryRun)
+      return { events, deliveries: [] };
+    const deliveries = [];
+    for (const event of events) {
+      deliveries.push(...await this.deliver(event));
+    }
+    return { events, deliveries };
+  }
+  async applyRedaction(event, channel) {
+    let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
+    for (const redactor of this.redactors) {
+      next = await redactor(next, channel);
+    }
+    return next;
+  }
+  async deliverWithRetry(event, channel) {
+    const policy = normalizeRetryPolicy(channel.retry);
+    const attempts = [];
+    for (let index = 0;index < policy.maxAttempts; index += 1) {
+      const attempt = await dispatchChannel(event, channel, this.transportOptions);
+      attempt.attempt = index + 1;
+      if (attempt.status === "failed" && index + 1 < policy.maxAttempts) {
+        attempt.nextBackoffMs = Math.round(policy.backoffMs * policy.multiplier ** index);
+      }
+      attempts.push(attempt);
+      if (attempt.status !== "failed")
+        break;
+      if (attempt.nextBackoffMs)
+        await Bun.sleep(attempt.nextBackoffMs);
+    }
+    return createDeliveryResult(event, channel, attempts);
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function sanitizeChannelForOutput(channel) {
+  const copy = structuredClone(channel);
+  if (copy.webhook?.secret)
+    copy.webhook.secret = "[REDACTED]";
+  if (copy.command?.env) {
+    copy.command.env = Object.fromEntries(Object.entries(copy.command.env).map(([key, value]) => [key, shouldRedactKey(key) ? "[REDACTED]" : value]));
+  }
+  return copy;
+}
+function sanitizeChannelsForOutput(channels) {
+  return channels.map(sanitizeChannelForOutput);
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
+function normalizeTime(value) {
+  if (!value)
+    return new Date().toISOString();
+  return value instanceof Date ? value.toISOString() : value;
+}
+function normalizeRetryPolicy(policy) {
+  return {
+    maxAttempts: Math.max(1, policy?.maxAttempts ?? 1),
+    backoffMs: Math.max(0, policy?.backoffMs ?? 250),
+    multiplier: Math.max(1, policy?.multiplier ?? 2)
+  };
+}
+function parseJsonObject(value, fallback) {
+  if (!value)
+    return fallback;
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Expected a JSON object");
+  }
+  return parsed;
+}
+function parseHeaders(values) {
+  if (!values?.length)
+    return;
+  const headers = {};
+  for (const value of values) {
+    const separator = value.indexOf("=");
+    if (separator === -1)
+      throw new Error(`Invalid header, expected name=value: ${value}`);
+    headers[value.slice(0, separator)] = value.slice(separator + 1);
+  }
+  return headers;
+}
+function parseFilter(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
+function createClient(options) {
+  if (options.createClient)
+    return options.createClient();
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
+}
+function print(value, json, text) {
+  if (json)
+    console.log(JSON.stringify(value, null, 2));
+  else
+    console.log(text);
+}
+function registerWebhookCommands(program2, options) {
+  const webhooks = program2.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
+  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions) => {
+    const timestamp = new Date().toISOString();
+    const channel = {
+      id: actionOptions.id,
+      name: actionOptions.name,
+      enabled: !actionOptions.disabled,
+      transport: actionOptions.transport,
+      filters: parseFilter(actionOptions),
+      retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
+      redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
+      createdAt: timestamp,
+      updatedAt: timestamp
+    };
+    if (actionOptions.transport === "webhook") {
+      channel.webhook = { url: target, secret: actionOptions.secret, headers: parseHeaders(actionOptions.header), timeoutMs: actionOptions.timeoutMs };
+    } else if (actionOptions.transport === "command") {
+      channel.command = { command: target, args: actionOptions.arg ?? [], timeoutMs: actionOptions.timeoutMs };
+    } else {
+      throw new Error(`Transport ${actionOptions.transport} is reserved for future use and cannot be added yet`);
+    }
+    const saved = await createClient(options).addChannel(channel);
+    print(sanitizeChannelForOutput(saved), Boolean(actionOptions.json), `Added ${saved.transport} channel ${saved.id}`);
+  });
+  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions) => {
+    const channels = await createClient(options).listChannels();
+    if (actionOptions.json) {
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
+      return;
+    }
+    if (!channels.length) {
+      console.log("No channels configured.");
+      return;
+    }
+    for (const channel of channels) {
+      console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
+    }
+  });
+  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions) => {
+    const removed = await createClient(options).removeChannel(id);
+    print({ removed }, Boolean(actionOptions.json), removed ? `Removed ${id}` : `Channel not found: ${id}`);
+  });
+  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions) => {
+    const result = await createClient(options).testChannel(id, {
+      source: options.source,
+      type: actionOptions.type,
+      subject: actionOptions.subject ?? id,
+      message: actionOptions.message,
+      data: parseJsonObject(actionOptions.data, { test: true })
+    });
+    print(result, Boolean(actionOptions.json), `${result.status}: ${result.channelId}`);
+  });
+  return webhooks;
+}
+function registerEventCommands(program2, options) {
+  const events = program2.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
+  events.command("emit").description("Emit an event from this app").argument("<type>", "Event type").option("--source <source>", "Event source override").option("--subject <subject>", "Event subject").option("--severity <severity>", "Event severity", "info").option("--message <message>", "Event message").option("--dedupe-key <key>", "Dedupe key").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--no-deliver", "Record without delivering").option("--no-dedupe", "Allow duplicate id/dedupeKey events").option("-j, --json", "Print JSON output", false).action(async (type, actionOptions) => {
+    const result = await createClient(options).emit({
+      source: actionOptions.source ?? options.source,
+      type,
+      subject: actionOptions.subject,
+      severity: actionOptions.severity,
+      message: actionOptions.message,
+      dedupeKey: actionOptions.dedupeKey,
+      data: parseJsonObject(actionOptions.data, {}),
+      metadata: parseJsonObject(actionOptions.metadata, {})
+    }, { deliver: actionOptions.deliver, dedupe: actionOptions.dedupe });
+    print(result, Boolean(actionOptions.json), `${result.deduped ? "Deduped" : "Emitted"} ${result.event.id} to ${result.deliveries.length} channel(s)`);
+  });
+  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", "Limit results", parseNumber).option("-j, --json", "Print JSON output", false).action(async (actionOptions) => {
+    let rows = await createClient(options).listEvents();
+    if (actionOptions.source)
+      rows = rows.filter((event) => event.source === actionOptions.source);
+    if (actionOptions.type)
+      rows = rows.filter((event) => event.type === actionOptions.type);
+    if (actionOptions.limit)
+      rows = rows.slice(-actionOptions.limit);
+    if (actionOptions.json) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (!rows.length) {
+      console.log("No events recorded.");
+      return;
+    }
+    for (const event of rows)
+      console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
+  });
+  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions) => {
+    const result = await createClient(options).replay({
+      eventId: actionOptions.id,
+      source: actionOptions.source,
+      type: actionOptions.type,
+      dryRun: actionOptions.dryRun
+    });
+    print(result, Boolean(actionOptions.json), `Replayed ${result.events.length} event(s), ${result.deliveries.length} delivery result(s)`);
+  });
+  return events;
+}
+function registerEventsCommands(program2, options) {
+  registerWebhookCommands(program2, options);
+  registerEventCommands(program2, options);
+}
+function parseNumber(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed))
+    throw new Error(`Expected a number, got ${value}`);
+  return parsed;
+}
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
+}
+
 // src/cli/commands/domain.ts
 init_domains();
 
@@ -40655,6 +42081,61 @@ async function renewDomain(domain, years = 1, config) {
     chargedAmount: chargedAmount || undefined
   };
 }
+function namecheapContactParams(contact) {
+  const organization = contact.organization_name || "NA";
+  const base = {
+    FirstName: contact.first_name,
+    LastName: contact.last_name,
+    OrganizationName: organization,
+    Address1: contact.address_line_1,
+    City: contact.city,
+    StateProvince: contact.state,
+    PostalCode: contact.zip_code,
+    Country: contact.country_code,
+    Phone: contact.phone,
+    EmailAddress: contact.email
+  };
+  const params = {};
+  for (const prefix of ["Registrant", "Tech", "Admin", "AuxBilling"]) {
+    for (const [key, value] of Object.entries(base)) {
+      params[prefix + key] = value;
+    }
+  }
+  return params;
+}
+async function registerDomain(domain, contact, options = {}, config) {
+  const cfg = config || getConfig();
+  const params = {
+    DomainName: domain,
+    Years: String(options.years ?? 1),
+    AddFreeWhoisguard: options.whoisGuard === false ? "no" : "yes",
+    WGEnabled: options.whoisGuard === false ? "no" : "yes",
+    ...namecheapContactParams(contact)
+  };
+  if (options.premiumPrice !== undefined) {
+    params.IsPremiumDomain = "true";
+    params.PremiumPrice = String(options.premiumPrice);
+  }
+  const xml = await apiRequest(cfg, "namecheap.domains.create", params);
+  return {
+    domain,
+    success: xml.includes('Status="OK"') || xml.includes('Registered="true"'),
+    orderId: parseXmlValue(xml, "OrderId") || undefined,
+    chargedAmount: parseXmlValue(xml, "ChargedAmount") || undefined
+  };
+}
+async function updateNameservers(domain, nameservers, config) {
+  if (nameservers.length === 0)
+    throw new Error("updateNameservers requires at least one nameserver");
+  const cfg = config || getConfig();
+  const { sld, tld } = splitDomain(domain);
+  const xml = await apiRequest(cfg, "namecheap.domains.dns.setCustom", {
+    SLD: sld,
+    TLD: tld,
+    Nameservers: nameservers.join(",")
+  });
+  return xml.includes('Status="OK"') || xml.includes('Updated="true"');
+}
 async function getDnsRecords(_domain, sld, tld, config) {
   const cfg = config || getConfig();
   const xml = await apiRequest(cfg, "namecheap.domains.dns.getHosts", {
@@ -40783,141 +42264,12 @@ function normalizeDate(dateStr) {
   }
 }
 
-// src/lib/godaddy.ts
-class GoDaddyApiError extends Error {
-  statusCode;
-  details;
-  constructor(message, statusCode, details) {
-    super(message);
-    this.statusCode = statusCode;
-    this.details = details;
-    this.name = "GoDaddyApiError";
-  }
-}
-var _overriddenFetch = null;
-function getCredentials() {
-  const apiKey = process.env["GODADDY_API_KEY"];
-  const apiSecret = process.env["GODADDY_API_SECRET"];
-  if (!apiKey || !apiSecret) {
-    throw new Error("GoDaddy API credentials not configured. Set GODADDY_API_KEY and GODADDY_API_SECRET environment variables.");
-  }
-  return { apiKey, apiSecret };
-}
-function getHeaders() {
-  const { apiKey, apiSecret } = getCredentials();
-  return {
-    Authorization: `sso-key ${apiKey}:${apiSecret}`,
-    "Content-Type": "application/json",
-    Accept: "application/json"
-  };
-}
-var GODADDY_API_BASE = "https://api.godaddy.com";
-async function apiRequest2(method, path, body) {
-  const fetchFn = _overriddenFetch || globalThis.fetch;
-  const url = `${GODADDY_API_BASE}${path}`;
-  const headers = getHeaders();
-  const options = { method, headers };
-  if (body !== undefined) {
-    options.body = JSON.stringify(body);
-  }
-  const response = await fetchFn(url, options);
-  if (!response.ok) {
-    const text = await response.text();
-    throw new GoDaddyApiError(`GoDaddy API ${method} ${path} failed with status ${response.status}: ${text}`, response.status, { responseBody: text });
-  }
-  if (response.status === 204) {
-    return;
-  }
-  return await response.json();
-}
-async function listGoDaddyDomains() {
-  return apiRequest2("GET", "/v1/domains");
-}
-async function getDomainInfo2(domain) {
-  return apiRequest2("GET", `/v1/domains/${encodeURIComponent(domain)}`);
-}
-async function renewDomain2(domain) {
-  return apiRequest2("POST", `/v1/domains/${encodeURIComponent(domain)}/renew`, { period: 1 });
-}
-async function getDnsRecords2(domain, type) {
-  const path = type ? `/v1/domains/${encodeURIComponent(domain)}/records/${encodeURIComponent(type)}` : `/v1/domains/${encodeURIComponent(domain)}/records`;
-  return apiRequest2("GET", path);
-}
-async function setDnsRecords2(domain, records) {
-  await apiRequest2("PUT", `/v1/domains/${encodeURIComponent(domain)}/records`, records);
-}
-async function checkAvailability2(domain) {
-  return apiRequest2("GET", `/v1/domains/available?domain=${encodeURIComponent(domain)}`);
-}
-function mapGoDaddyStatus(gdStatus) {
-  const s = gdStatus.toUpperCase();
-  if (s === "ACTIVE")
-    return "active";
-  if (s === "EXPIRED")
-    return "expired";
-  if (s === "TRANSFERRED_OUT" || s === "TRANSFERRING" || s === "PENDING_TRANSFER")
-    return "transferring";
-  if (s === "REDEMPTION" || s === "PENDING_REDEMPTION")
-    return "redemption";
-  return "active";
-}
-async function syncToLocalDb2(dbFns) {
-  const result = {
-    synced: 0,
-    created: 0,
-    updated: 0,
-    errors: []
-  };
-  let gdDomains;
-  try {
-    gdDomains = await listGoDaddyDomains();
-  } catch (err) {
-    result.errors.push(`Failed to list domains: ${err instanceof Error ? err.message : String(err)}`);
-    return result;
-  }
-  for (const gd of gdDomains) {
-    try {
-      let detail;
-      try {
-        detail = await getDomainInfo2(gd.domain);
-      } catch {
-        detail = gd;
-      }
-      const existing = dbFns.getDomainByName(gd.domain);
-      const domainData = {
-        name: gd.domain,
-        registrar: "GoDaddy",
-        status: mapGoDaddyStatus(gd.status),
-        expires_at: gd.expires ? new Date(gd.expires).toISOString() : undefined,
-        auto_renew: gd.renewAuto,
-        nameservers: gd.nameServers || [],
-        registered_at: detail.createdAt ? new Date(detail.createdAt).toISOString() : undefined,
-        metadata: {
-          godaddy_domain_id: detail.domainId,
-          provider: "godaddy",
-          locked: detail.locked,
-          privacy: detail.privacy
-        }
-      };
-      if (existing) {
-        dbFns.updateDomain(existing.id, domainData);
-        result.updated++;
-      } else {
-        dbFns.createDomain(domainData);
-        result.created++;
-      }
-      result.synced++;
-    } catch (err) {
-      result.errors.push(`Failed to sync ${gd.domain}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-  }
-  return result;
-}
-
 // src/lib/registrar.ts
+init_godaddy();
 init_route53();
 init_cloudflare();
 init_brandsight();
+init_env_aliases();
 function createNamecheapProvider() {
   return {
     name: "namecheap",
@@ -40947,9 +42299,27 @@ function createNamecheapProvider() {
         auto_renew: true
       };
     },
-    async renewDomain(domain) {
+    async registerDomain(domain, contact, options = {}) {
       const config = getConfig();
-      const result = await renewDomain(domain, 1, config);
+      const result = await registerDomain(domain, contact, {
+        years: options.years,
+        premiumPrice: options.premiumPrice
+      }, config);
+      return {
+        domain: result.domain,
+        success: result.success,
+        orderId: result.orderId,
+        chargedAmount: result.chargedAmount
+      };
+    },
+    async updateNameservers(domain, nameservers) {
+      const config = getConfig();
+      const success = await updateNameservers(domain, nameservers, config);
+      return { domain, success };
+    },
+    async renewDomain(domain, years = 1) {
+      const config = getConfig();
+      const result = await renewDomain(domain, years, config);
       return {
         domain: result.domain,
         success: result.success,
@@ -41085,8 +42455,9 @@ var providerRegistry = new Map([
       name: "namecheap",
       type: "full",
       configured: false,
-      envVars: ["NAMECHEAP_API_KEY", "NAMECHEAP_USERNAME", "NAMECHEAP_CLIENT_IP"]
+      envVars: providerEnvNames("namecheap")
     },
+    createInventory: createNamecheapProvider,
     createRegistrar: createNamecheapProvider,
     createDns: createNamecheapProvider
   }],
@@ -41095,8 +42466,9 @@ var providerRegistry = new Map([
       name: "godaddy",
       type: "full",
       configured: false,
-      envVars: ["GODADDY_API_KEY", "GODADDY_API_SECRET"]
+      envVars: providerEnvNames("godaddy")
     },
+    createInventory: createGoDaddyProvider,
     createRegistrar: createGoDaddyProvider,
     createDns: createGoDaddyProvider
   }],
@@ -41105,8 +42477,9 @@ var providerRegistry = new Map([
       name: "route53",
       type: "full",
       configured: false,
-      envVars: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"]
+      envVars: providerEnvNames("route53")
     },
+    createInventory: () => createRoute53Provider(),
     createRegistrar: () => createRoute53Provider(),
     createDns: () => createRoute53Provider()
   }],
@@ -41115,47 +42488,77 @@ var providerRegistry = new Map([
       name: "cloudflare",
       type: "dns",
       configured: false,
-      envVars: ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"]
+      envVars: providerEnvNames("cloudflare")
     },
+    createInventory: () => createCloudflareProvider(),
     createDns: createCloudflareProvider
   }],
   ["brandsight", {
     info: {
       name: "brandsight",
-      type: "registrar",
+      type: "full",
       configured: false,
-      envVars: ["BRANDSIGHT_API_KEY", "BRANDSIGHT_ACCOUNT_ID"]
+      envVars: providerEnvNames("brandsight")
     },
-    createRegistrar: createBrandsightProvider
+    createInventory: createBrandsightProvider,
+    createRegistrar: createBrandsightProvider,
+    createDns: createBrandsightProvider
+  }],
+  ["sedo", {
+    info: {
+      name: "sedo",
+      type: "marketplace",
+      configured: false,
+      envVars: providerEnvNames("sedo")
+    }
   }]
 ]);
-function isConfigured(envVars) {
-  return envVars.slice(0, 2).every((v3) => !!process.env[v3]);
+function isConfigured(providerName) {
+  return hasProviderCredentials(providerName);
 }
 function getAvailableProviders() {
   return Array.from(providerRegistry.values()).map((e3) => ({
     ...e3.info,
-    configured: isConfigured(e3.info.envVars)
+    configured: isConfigured(e3.info.name),
+    inventory: !!e3.createInventory
   }));
 }
+function getProviderInfo(name) {
+  const entry = providerRegistry.get(name.toLowerCase());
+  if (!entry)
+    return null;
+  return { ...entry.info, configured: isConfigured(entry.info.name), inventory: !!entry.createInventory };
+}
+function providerHasRegistrar(name) {
+  return !!providerRegistry.get(name.toLowerCase())?.createRegistrar;
+}
+function providerHasInventory(name) {
+  return !!providerRegistry.get(name.toLowerCase())?.createInventory;
+}
+function getDomainInventoryProvider(name) {
+  const entry = providerRegistry.get(name.toLowerCase());
+  if (!entry?.createInventory)
+    throw new Error(`No domain inventory provider: ${name}`);
+  return entry.createInventory();
+}
 function getRegistrarProvider(name) {
-  const entry = providerRegistry.get(name);
+  const entry = providerRegistry.get(name.toLowerCase());
   if (!entry?.createRegistrar)
     throw new Error(`No registrar provider: ${name}`);
   return entry.createRegistrar();
 }
 function getDnsProvider(name) {
-  const entry = providerRegistry.get(name);
+  const entry = providerRegistry.get(name.toLowerCase());
   if (!entry?.createDns)
     throw new Error(`No DNS provider: ${name}`);
   return entry.createDns();
 }
 async function syncAll(dbFns) {
-  const available = getAvailableProviders().filter((p3) => p3.configured && (p3.type === "registrar" || p3.type === "full") && p3.name !== "brandsight");
+  const available = getAvailableProviders().filter((p3) => p3.configured && providerHasInventory(p3.name));
   const result = { providers: [], totalSynced: 0, totalErrors: [] };
   for (const info of available) {
     try {
-      const provider = getRegistrarProvider(info.name);
+      const provider = getDomainInventoryProvider(info.name);
       const syncResult = await provider.syncToLocalDb(dbFns);
       result.providers.push({ name: info.name, result: syncResult });
       result.totalSynced += syncResult.synced;
@@ -41173,14 +42576,16 @@ function autoDetectRegistrar(domain, getDomainByName2) {
   if (!dbDomain?.registrar)
     return null;
   const r3 = dbDomain.registrar.toLowerCase();
+  if (r3.includes("cloudflare dns") || r3.includes("route 53 dns") || r3.includes("route53 dns"))
+    return null;
   if (r3.includes("namecheap"))
     return "namecheap";
   if (r3.includes("godaddy"))
     return "godaddy";
-  if (r3.includes("route 53") || r3.includes("route53") || r3.includes("aws"))
+  if (r3.includes("route 53") || r3.includes("route53"))
     return "route53";
   if (r3.includes("cloudflare"))
-    return "cloudflare";
+    return null;
   if (r3.includes("brandsight"))
     return "brandsight";
   return null;
@@ -41520,10 +42925,10 @@ WHOIS for ${result.domain} [${result.source}]:`);
       process.exit(1);
   });
   domain.command("sync").description("Sync domains from a provider to the local DB").option("--provider <name>", "Provider name (default: all configured)").action(async (opts) => {
-    const providers = opts.provider ? [opts.provider] : getAvailableProviders().filter((p3) => p3.configured && p3.type !== "dns" && p3.name !== "brandsight").map((p3) => p3.name);
+    const providers = opts.provider ? [opts.provider] : getAvailableProviders().filter((p3) => p3.configured && providerHasInventory(p3.name)).map((p3) => p3.name);
     for (const name of providers) {
       try {
-        const provider = getRegistrarProvider(name);
+        const provider = getDomainInventoryProvider(name);
         const result = await provider.syncToLocalDb({ getDomainByName, createDomain, updateDomain });
         console.log(`\u2713 [${name}] Synced ${result.synced} (${result.created} new, ${result.updated} updated)`);
         if (result.errors.length > 0)
@@ -41607,14 +43012,14 @@ WHOIS for ${result.domain} [${result.source}]:`);
     }
     console.log(`Linked ${emailId} to ${details.domain.name}`);
   });
-  domain.command("renew <name>").description("Renew a domain via its registrar provider").option("--provider <name>", "Override provider").action(async (name, opts) => {
+  domain.command("renew <name>").description("Renew a domain via its registrar provider").option("--provider <name>", "Override provider").option("--years <n>", "Number of years to renew", "1").action(async (name, opts) => {
     const providerName = opts.provider ?? autoDetectRegistrar(name, getDomainByName) ?? loadConfig3().default_registrar;
     if (!providerName) {
       console.error("Could not detect provider. Use --provider.");
       process.exit(1);
     }
     const provider = getRegistrarProvider(providerName);
-    const result = await provider.renewDomain(name);
+    const result = await provider.renewDomain(name, parseInt(opts.years, 10));
     if (result.success) {
       console.log(`\u2713 Renewed: ${name}`);
       if (result.orderId)
@@ -41624,7 +43029,7 @@ WHOIS for ${result.domain} [${result.source}]:`);
       process.exit(1);
     }
   });
-  domain.command("buy <name>").description("Purchase a domain via Route 53 (contact defaults from: domains config set contact.*)").option("--provider <name>", "Registrar provider (default: config default-registrar or route53)").option("--registrar <name>", "Registrar/seller for recorded purchases (alias of --provider)").option("--email <email>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--price <amount>", "Record a completed purchase instead of registering via Route 53").option("--expires <date>", "Expiry date for recorded purchases").option("--auto-renew <bool>", "Auto-renew for recorded purchases (true/false)").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes").option("--dns <provider>", "DNS provider to delegate to after purchase (always cloudflare)", "cloudflare").option("--no-delegate", "Skip delegating DNS to Cloudflare after purchase").action(async (name, opts) => {
+  domain.command("buy <name>").description("Purchase or record a domain via registrar provider (contact defaults from: domains config set contact.*)").option("--provider <name>", "Registrar provider (default: config default-registrar or route53)").option("--registrar <name>", "Registrar/seller for recorded purchases (alias of --provider)").option("--email <email>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--price <amount>", "Record a completed purchase instead of registering via Route 53").option("--expires <date>", "Expiry date for recorded purchases").option("--auto-renew <bool>", "Auto-renew for recorded purchases (true/false)").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes").option("--dns <provider>", "DNS provider to delegate to after purchase (always cloudflare)", "cloudflare").option("--no-delegate", "Skip delegating DNS to Cloudflare after purchase").action(async (name, opts) => {
     const recordedPrice = parseOptionalNumber(opts.price, "--price");
     if (recordedPrice !== undefined) {
       const registrarName = opts.registrar ?? opts.provider ?? "manual";
@@ -41648,12 +43053,75 @@ WHOIS for ${result.domain} [${result.source}]:`);
     }
     const cfg = loadConfig3();
     const providerName = opts.registrar ?? opts.provider ?? cfg.default_registrar ?? "route53";
-    const purchaseProfile = applyPurchaseProfile();
+    const purchaseProfile = providerName === "route53" ? applyPurchaseProfile() : undefined;
     if (purchaseProfile)
       console.log(`Using purchase AWS profile: ${purchaseProfile}`);
     if (providerName !== "route53") {
-      console.error(`Direct domain purchase only supported via route53. Got: ${providerName}`);
-      process.exit(1);
+      try {
+        const provider = getRegistrarProvider(providerName);
+        if (!provider.registerDomain) {
+          console.error(`Direct domain purchase is not supported for ${providerName}. Use route53 or record a marketplace/manual purchase with --price.`);
+          process.exit(1);
+        }
+        const avail = await provider.checkAvailability(name);
+        if (!avail.available) {
+          console.error(`\u2717 ${name} is not available`);
+          process.exit(1);
+        }
+        console.log(`\u2713 Available via ${providerName}`);
+        let contact;
+        try {
+          contact = resolveContact(opts);
+        } catch (e3) {
+          console.error(`Error: ${e3 instanceof Error ? e3.message : String(e3)}`);
+          process.exit(1);
+        }
+        console.log(`Registering ${name} via ${providerName}...`);
+        const reg = await provider.registerDomain(name, contact, {
+          years: parseInt(opts.years, 10),
+          premiumPrice: avail.premium_price,
+          autoRenew: opts.autoRenew ? opts.autoRenew === "true" : true
+        });
+        if (!reg.success) {
+          console.error(`\u2717 Registration failed via ${providerName}`);
+          process.exit(1);
+        }
+        const existing = getDomainByName(name);
+        const dbInput = {
+          registrar: providerName,
+          status: "active",
+          auto_renew: opts.autoRenew ? opts.autoRenew === "true" : true,
+          purchase_price: reg.chargedAmount ? Number(reg.chargedAmount) : avail.standard_price,
+          purchase_date: new Date().toISOString(),
+          standard_price: avail.standard_price,
+          is_premium: avail.is_premium,
+          premium_price: avail.premium_price
+        };
+        if (existing)
+          updateDomain(existing.id, dbInput);
+        else
+          createDomain({ name, ...dbInput });
+        console.log(`\u2713 Registered and added to portfolio`);
+        if (reg.orderId)
+          console.log(`  Order: ${reg.orderId}`);
+        const dnsProvider = opts.dns ?? "cloudflare";
+        if (opts.delegate !== false && dnsProvider === "cloudflare") {
+          if (!provider.updateNameservers) {
+            console.log(`  DNS: ${providerName} registration succeeded, but nameserver updates are not implemented for this provider.`);
+          } else {
+            const zone = await ensureZone(name);
+            const nsUpdate = await provider.updateNameservers(name, zone.nameservers);
+            const existing2 = getDomainByName(name);
+            if (existing2)
+              updateDomain(existing2.id, { nameservers: zone.nameservers });
+            console.log(`\u2713 Cloudflare zone ${zone.id}; nameservers updated${nsUpdate.operationId ? ` (op ${nsUpdate.operationId})` : ""}`);
+          }
+        }
+        return;
+      } catch (e3) {
+        console.error(`Error: ${e3 instanceof Error ? e3.message : String(e3)}`);
+        process.exit(1);
+      }
     }
     try {
       const avail = await checkAvailability3(name);
@@ -41671,7 +43139,7 @@ WHOIS for ${result.domain} [${result.source}]:`);
         process.exit(1);
       }
       console.log(`Registering ${name}...`);
-      const reg = await registerDomain(name, contact, parseInt(opts.years));
+      const reg = await registerDomain2(name, contact, parseInt(opts.years));
       console.log(`\u2713 Submitted (operation: ${reg.operationId})`);
       if (opts.wait) {
         let status = "IN_PROGRESS";
@@ -41719,10 +43187,10 @@ WHOIS for ${result.domain} [${result.source}]:`);
             console.log(`Delegating DNS to Cloudflare...`);
             const del = await delegateDomainToCloudflare(name, {
               createCloudflareZone: async (d3) => {
-                const z2 = await createZone(d3);
+                const z2 = await ensureZone(d3);
                 return { id: z2.id, nameservers: z2.nameservers };
               },
-              updateNameservers: (d3, ns) => updateNameservers(d3, ns)
+              updateNameservers: (d3, ns) => updateNameservers2(d3, ns)
             });
             const existing2 = getDomainByName(name);
             if (existing2)
@@ -41741,16 +43209,16 @@ WHOIS for ${result.domain} [${result.source}]:`);
       process.exit(1);
     }
   });
-  domain.command("setup <name>").description("Full setup: buy domain + create DNS zone + point nameservers (contact defaults from config)").option("--registrar <n>", "Registrar provider (default: config default-registrar or route53)").option("--dns <n>", "DNS provider (default: config default-dns or route53)").option("--email <e>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes before creating DNS zone").action(async (name, opts) => {
+  domain.command("setup <name>").description("Full setup: buy domain + create DNS zone + point nameservers (contact defaults from config)").option("--registrar <n>", "Registrar provider (default: config default-registrar or route53)").option("--dns <n>", "DNS provider (default: config default-dns or cloudflare)").option("--email <e>", "Registrant email").option("--first-name <n>", "First name").option("--last-name <n>", "Last name").option("--phone <p>", "Phone").option("--address <a>", "Street address").option("--city <c>", "City").option("--state <s>", "State/province").option("--country <c>", "Country code").option("--zip <z>", "ZIP code").option("--org <o>", "Organization").option("--years <n>", "Years", "1").option("--wait", "Poll until registration completes before creating DNS zone").action(async (name, opts) => {
     const cfg = loadConfig3();
     const registrarName = opts.registrar ?? cfg.default_registrar ?? "route53";
-    const dnsName = opts.dns ?? cfg.default_dns ?? registrarName;
+    const dnsName = opts.dns ?? cfg.default_dns ?? "cloudflare";
     console.log(`
 Setting up ${name}`);
     console.log(`  Registrar: ${registrarName}  |  DNS: ${dnsName}
 `);
     try {
-      process.stdout.write("[1/4] Checking availability... ");
+      process.stdout.write(opts.wait ? "[1/5] Checking availability... " : "[1/4] Checking availability... ");
       const avail = await checkAvailability3(name);
       if (!avail.available) {
         console.log("not available");
@@ -41770,8 +43238,8 @@ Setting up ${name}`);
         console.error(`Error: ${e3 instanceof Error ? e3.message : String(e3)}`);
         process.exit(1);
       }
-      process.stdout.write("[2/4] Registering domain... ");
-      const reg = await registerDomain(name, contact, parseInt(opts.years));
+      process.stdout.write(opts.wait ? "[2/5] Registering domain... " : "[2/4] Registering domain... ");
+      const reg = await registerDomain2(name, contact, parseInt(opts.years));
       console.log(`submitted (${reg.operationId})`);
       if (opts.wait) {
         let status = "IN_PROGRESS";
@@ -41788,19 +43256,38 @@ Setting up ${name}`);
         }
         console.log("  Registration confirmed");
       }
-      process.stdout.write("[3/4] Creating DNS zone... ");
+      process.stdout.write(opts.wait ? "[3/5] Creating DNS zone... " : "[3/4] Creating DNS zone... ");
       let nameservers = [];
       if (dnsName === "cloudflare") {
-        const zone = await createZone(name);
+        const zone = await ensureZone(name);
         nameservers = zone.nameservers ?? [];
-        console.log(`created (${zone.id})`);
+        console.log("ready (" + zone.id + ")");
       } else {
         const zone = await createHostedZone(name, `Managed by @hasna/domains`);
         nameservers = zone.name_servers ?? [];
         console.log(`created (${zone.id})`);
       }
-      process.stdout.write("[4/4] Adding to portfolio... ");
-      createDomain({ name, registrar: `AWS Route 53`, status: "active", auto_renew: true, nameservers });
+      if (nameservers.length > 0) {
+        if (opts.wait) {
+          process.stdout.write("[4/5] Updating registrar nameservers... ");
+          if (registrarName !== "route53") {
+            console.log("skipped");
+            console.error("Only Route53 nameserver delegation is currently implemented for setup.");
+            process.exit(1);
+          }
+          const nsUpdate = await updateNameservers2(name, nameservers);
+          console.log("submitted (" + nsUpdate.operationId + ")");
+        } else {
+          console.log("  Nameserver delegation skipped until registration completes; re-run with --wait or use domains r53 domain-info/status first.");
+        }
+      }
+      process.stdout.write(opts.wait ? "[5/5] Adding to portfolio... " : "[4/4] Adding to portfolio... ");
+      const existing = getDomainByName(name);
+      const dbInput = { registrar: `AWS Route 53`, status: "active", auto_renew: true, nameservers };
+      if (existing)
+        updateDomain(existing.id, dbInput);
+      else
+        createDomain({ name, ...dbInput });
       console.log("done");
       console.log(`
 \u2713 Setup complete for ${name}`);
@@ -42294,6 +43781,10 @@ function registerMonitorCommand(program2) {
 }
 
 // src/cli/commands/provider.ts
+function isAwsAccessDenied(error) {
+  const msg = error instanceof Error ? error.message : String(error);
+  return msg.includes("AccessDenied") || msg.includes("route53domains:ListDomains");
+}
 function registerProviderCommand(program2) {
   const provider = program2.command("provider").description("Configure and test registrar/DNS providers");
   provider.command("list").description("Show all providers and their configuration status").option("-j, --json", "Output JSON").action((opts) => {
@@ -42307,7 +43798,8 @@ Registrar / DNS Providers:`);
     for (const p3 of providers) {
       const status = p3.configured ? "\u2713 configured" : "\u2717 not configured";
       const type = p3.type === "full" ? "registrar + dns" : p3.type;
-      console.log(`  ${p3.name.padEnd(12)} [${type}]  ${status}`);
+      const capabilities = [type, p3.inventory ? "inventory" : null].filter(Boolean).join(", ");
+      console.log(`  ${p3.name.padEnd(12)} [${capabilities}]  ${status}`);
       if (!p3.configured) {
         console.log(`    Missing: ${p3.envVars.join(", ")}`);
       }
@@ -42315,22 +43807,23 @@ Registrar / DNS Providers:`);
     console.log();
   });
   provider.command("test <name>").description("Live-test a provider's credentials").option("-j, --json", "Output JSON").action(async (name, opts) => {
+    const providerName = name.toLowerCase();
     const providers = getAvailableProviders();
-    const info = providers.find((p3) => p3.name === name);
+    const info = providers.find((p3) => p3.name === providerName);
     if (!info) {
       const error = `Unknown provider: ${name}`;
       if (opts.json) {
-        console.log(JSON.stringify({ provider: name, ok: false, error }, null, 2));
+        console.log(JSON.stringify({ provider: providerName, ok: false, error }, null, 2));
       } else {
         console.error(error);
       }
       process.exit(1);
     }
     if (!info.configured) {
-      const error = `${name} is not configured. Set: ${info.envVars.join(", ")}`;
+      const error = `${providerName} is not configured. Set: ${info.envVars.join(", ")}`;
       if (opts.json) {
         console.log(JSON.stringify({
-          provider: name,
+          provider: providerName,
           ok: false,
           configured: false,
           required_env: info.envVars,
@@ -42342,33 +43835,70 @@ Registrar / DNS Providers:`);
       process.exit(1);
     }
     if (!opts.json) {
-      console.log(`Testing ${name}...`);
+      console.log(`Testing ${providerName}...`);
     }
     let registrarOk = null;
     let dnsOk = null;
+    let marketplaceOk = null;
+    const notes = [];
     try {
       if (info.type === "registrar" || info.type === "full") {
-        const reg = getRegistrarProvider(name);
-        await reg.listDomains();
-        registrarOk = true;
-        if (!opts.json)
-          console.log("\u2713 Registrar connection OK");
+        if (providerName === "route53") {
+          try {
+            const { listRegisteredDomains: listRegisteredDomains2 } = await Promise.resolve().then(() => (init_route53(), exports_route53));
+            await listRegisteredDomains2();
+            registrarOk = true;
+            if (!opts.json)
+              console.log("\u2713 Registrar connection OK");
+          } catch (error) {
+            if (!isAwsAccessDenied(error))
+              throw error;
+            registrarOk = false;
+            notes.push("route53domains-listdomains-access-denied");
+            if (!opts.json)
+              console.log("\u2022 Route53 Domains registrar API is not available for these AWS credentials");
+          }
+        } else {
+          const reg = getRegistrarProvider(providerName);
+          await reg.listDomains();
+          registrarOk = true;
+          if (!opts.json)
+            console.log("\u2713 Registrar connection OK");
+        }
       }
       if (info.type === "dns" || info.type === "full") {
-        const dns = getDnsProvider(name);
-        await dns.getDnsRecords("__test_nonexistent_domain__.invalid");
-        dnsOk = true;
+        if (providerName === "brandsight" && registrarOk) {
+          dnsOk = null;
+          notes.push("dns-not-probed-with-synthetic-invalid-domain");
+          if (!opts.json)
+            console.log("\u2022 DNS not probed with synthetic invalid domain");
+        } else {
+          const dns = getDnsProvider(providerName);
+          await dns.getDnsRecords("__test_nonexistent_domain__.invalid");
+          dnsOk = true;
+          if (!opts.json)
+            console.log("\u2713 DNS connection OK");
+        }
+      }
+      if (info.type === "marketplace") {
+        if (providerName !== "sedo")
+          throw new Error("No marketplace tester for provider: " + providerName);
+        const { listSedoPortfolio: listSedoPortfolio2 } = await Promise.resolve().then(() => (init_sedo(), exports_sedo));
+        await listSedoPortfolio2({ limit: 1 });
+        marketplaceOk = true;
         if (!opts.json)
-          console.log("\u2713 DNS connection OK");
+          console.log("\u2713 Marketplace connection OK");
       }
       if (opts.json) {
         console.log(JSON.stringify({
-          provider: name,
+          provider: providerName,
           ok: true,
           configured: true,
           type: info.type,
           registrar_ok: registrarOk,
-          dns_ok: dnsOk
+          dns_ok: dnsOk,
+          marketplace_ok: marketplaceOk,
+          ...notes.length > 0 ? { notes } : {}
         }, null, 2));
       }
     } catch (e3) {
@@ -42376,13 +43906,15 @@ Registrar / DNS Providers:`);
       if (msg.includes("not found") || msg.includes("No hosted zone") || msg.includes("NXDOMAIN")) {
         if (opts.json) {
           console.log(JSON.stringify({
-            provider: name,
+            provider: providerName,
             ok: true,
             configured: true,
             type: info.type,
             registrar_ok: registrarOk,
             dns_ok: true,
-            note: "connection-ok-no-domains-yet"
+            marketplace_ok: marketplaceOk,
+            note: "connection-ok-no-domains-yet",
+            ...notes.length > 0 ? { notes } : {}
           }, null, 2));
         } else {
           console.log("\u2713 Connection OK (no domains yet)");
@@ -42391,16 +43923,17 @@ Registrar / DNS Providers:`);
       }
       if (opts.json) {
         console.log(JSON.stringify({
-          provider: name,
+          provider: providerName,
           ok: false,
           configured: true,
           type: info.type,
           registrar_ok: registrarOk,
           dns_ok: dnsOk,
+          marketplace_ok: marketplaceOk,
           error: msg
         }, null, 2));
       } else {
-        console.error(`\u2717 ${name} test failed: ${msg}`);
+        console.error(`\u2717 ${providerName} test failed: ${msg}`);
       }
       process.exit(1);
     }
@@ -42410,23 +43943,48 @@ Registrar / DNS Providers:`);
 // src/cli/commands/providers.ts
 init_config();
 init_domains();
+function registrarProviderNames() {
+  return getAvailableProviders().filter((p3) => providerHasRegistrar(p3.name)).map((p3) => p3.name).join(", ");
+}
+function inventoryProviderNames() {
+  return getAvailableProviders().filter((p3) => providerHasInventory(p3.name)).map((p3) => p3.name).join(", ");
+}
+function requireInventoryProvider(name) {
+  const info = getProviderInfo(name);
+  if (!info) {
+    throw new Error(`Unknown provider: ${name}. Supported domain inventory providers: ${inventoryProviderNames()}`);
+  }
+  if (!providerHasInventory(name)) {
+    throw new Error(`${name} is a ${info.type} provider without domain inventory sync. Supported domain inventory providers: ${inventoryProviderNames()}`);
+  }
+}
+function requireRegistrarProvider(name) {
+  const info = getProviderInfo(name);
+  if (!info) {
+    throw new Error(`Unknown provider: ${name}. Supported registrars: ${registrarProviderNames()}`);
+  }
+  if (!providerHasRegistrar(name)) {
+    throw new Error(`${name} is a ${info.type} provider, not a registrar. Supported registrars: ${registrarProviderNames()}`);
+  }
+}
 function registerProviderCommands(program2) {
-  program2.command("providers").description("Show which registrar providers are configured").option("--json", "Output as JSON", false).action((opts) => {
+  program2.command("providers").description("Show which providers are configured").option("--json", "Output as JSON", false).action((opts) => {
     const providers = getAvailableProviders();
     if (opts.json) {
       console.log(JSON.stringify(providers, null, 2));
     } else {
-      console.log("Registrar Providers:");
+      console.log("Providers:");
       for (const p3 of providers) {
         const status = p3.configured ? "CONFIGURED" : "not configured";
-        console.log(`  ${p3.name}: ${status}`);
+        const capabilities = [p3.type, p3.inventory ? "inventory" : null].filter(Boolean).join(", ");
+        console.log(`  ${p3.name} [${capabilities}]: ${status}`);
         if (!p3.configured) {
-          console.log(`    Missing: ${p3.envVars.join(", ")}`);
+          console.log(`    Accepted env: ${p3.envVars.join(", ")}`);
         }
       }
     }
   });
-  program2.command("sync").description("Sync domains from a provider to local DB").option("--provider <provider>", "Provider name (namecheap, godaddy)").option("--all", "Sync from all configured providers").option("--json", "Output as JSON", false).action(async (opts) => {
+  program2.command("sync").description("Sync domains from a domain inventory provider to local DB").option("--provider <provider>", "Provider name").option("--all", "Sync from all configured domain inventory providers").option("--json", "Output as JSON", false).action(async (opts) => {
     if (opts.all) {
       try {
         const result = await syncAll({
@@ -42439,7 +43997,7 @@ function registerProviderCommands(program2) {
         } else {
           console.log(`Synced ${result.totalSynced} domain(s) from ${result.providers.length} provider(s)`);
           for (const p3 of result.providers) {
-            console.log(`  ${p3.name}: ${p3.result.synced} synced`);
+            console.log(`  ${p3.name}: ${p3.result.synced} synced (${p3.result.created} new, ${p3.result.updated} updated)`);
           }
           if (result.totalErrors.length > 0) {
             console.log("Errors:");
@@ -42459,59 +44017,29 @@ function registerProviderCommands(program2) {
       console.error("Specify --provider <name> or --all");
       process.exit(1);
     }
-    if (provider === "namecheap") {
-      try {
-        const result = await syncToLocalDb({
-          getDomainByName,
-          createDomain,
-          updateDomain
-        });
-        if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
-          console.log(`Synced ${result.synced} domain(s) from Namecheap`);
-          for (const d3 of result.domains) {
-            console.log(`  ${d3}`);
-          }
-          if (result.errors.length > 0) {
-            console.log("Errors:");
-            for (const e3 of result.errors) {
-              console.log(`  - ${e3}`);
-            }
-          }
-        }
-      } catch (error) {
-        console.error(`Sync failed: ${error instanceof Error ? error.message : String(error)}`);
-        process.exit(1);
-      }
-    } else if (provider === "godaddy") {
-      try {
-        const result = await syncToLocalDb2({
-          getDomainByName,
-          createDomain,
-          updateDomain
-        });
-        if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
-          console.log(`Synced ${result.synced} domain(s) from GoDaddy (created: ${result.created}, updated: ${result.updated})`);
-          if (result.errors.length > 0) {
-            console.log("Errors:");
-            for (const e3 of result.errors) {
-              console.log(`  - ${e3}`);
-            }
-          }
+    try {
+      requireInventoryProvider(provider);
+      const result = await getDomainInventoryProvider(provider).syncToLocalDb({
+        getDomainByName,
+        createDomain,
+        updateDomain
+      });
+      if (opts.json) {
+        console.log(JSON.stringify({ provider, ...result }, null, 2));
+      } else {
+        console.log(`Synced ${result.synced} domain(s) from ${provider} (${result.created} new, ${result.updated} updated)`);
+        if (result.errors.length > 0) {
+          console.log("Errors:");
+          for (const e3 of result.errors)
+            console.log(`  - ${e3}`);
         }
-      } catch (error) {
-        console.error(`Sync failed: ${error instanceof Error ? error.message : String(error)}`);
-        process.exit(1);
       }
-    } else {
-      console.error(`Unsupported provider: ${provider}. Supported: namecheap, godaddy`);
+    } catch (error) {
+      console.error(`Sync failed: ${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
     }
   });
-  program2.command("renew").description("Renew a domain via provider (auto-detects registrar from DB if --provider not given)").argument("<name>", "Domain name (e.g. example.com)").option("--provider <provider>", "Provider name (namecheap, godaddy)").option("--years <n>", "Number of years to renew", "1").option("--json", "Output as JSON", false).action(async (name, opts) => {
+  program2.command("renew").description("Renew a domain via provider (auto-detects registrar from DB if --provider not given)").argument("<name>", "Domain name (e.g. example.com)").option("--provider <provider>", "Provider name").option("--years <n>", "Number of years to renew", "1").option("--json", "Output as JSON", false).action(async (name, opts) => {
     let provider = (opts.provider || "").toLowerCase();
     if (!provider) {
       const detected = autoDetectRegistrar(name, getDomainByName);
@@ -42520,53 +44048,44 @@ function registerProviderCommands(program2) {
         process.exit(1);
       }
       provider = detected;
-      console.log(`Auto-detected registrar: ${provider}`);
+      if (!opts.json)
+        console.log(`Auto-detected registrar: ${provider}`);
     }
-    if (provider === "namecheap") {
-      try {
-        const result = await renewDomain(name, parseInt(opts.years));
-        if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
-          console.log(`Renewed ${result.domain} successfully via Namecheap`);
-          if (result.chargedAmount)
-            console.log(`  Charged: $${result.chargedAmount}`);
-          if (result.orderId)
-            console.log(`  Order ID: ${result.orderId}`);
-        }
-      } catch (error) {
-        console.error(`Renewal failed: ${error instanceof Error ? error.message : String(error)}`);
-        process.exit(1);
+    try {
+      requireRegistrarProvider(provider);
+      const result = await getRegistrarProvider(provider).renewDomain(name, parseInt(opts.years, 10));
+      if (!result.success) {
+        throw new Error(`Renewal failed or is not supported for ${provider}`);
       }
-    } else if (provider === "godaddy") {
-      try {
-        const result = await renewDomain2(name);
-        if (opts.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
-          console.log(`Renewed ${name} successfully via GoDaddy`);
-          if (result.orderId)
-            console.log(`  Order ID: ${result.orderId}`);
-          if (result.total)
-            console.log(`  Total: $${(result.total / 100).toFixed(2)}`);
-        }
-      } catch (error) {
-        console.error(`Renewal failed: ${error instanceof Error ? error.message : String(error)}`);
-        process.exit(1);
+      if (opts.json) {
+        console.log(JSON.stringify({ provider, ...result }, null, 2));
+      } else {
+        console.log(`Renewed ${result.domain} successfully via ${provider}`);
+        if (result.chargedAmount)
+          console.log(`  Charged: $${result.chargedAmount}`);
+        if (result.orderId)
+          console.log(`  Order ID: ${result.orderId}`);
       }
-    } else {
-      console.error(`Unsupported provider: ${provider}. Supported: namecheap, godaddy`);
+    } catch (error) {
+      console.error(`Renewal failed: ${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
     }
   });
-  program2.command("check").description("Check domain availability via a registrar provider (route53, namecheap, godaddy)").argument("<name>", "Domain name (e.g. example.com)").option("--provider <name>", "Registrar provider \u2014 defaults to config default-registrar, else namecheap").option("--json", "Output as JSON", false).action(async (name, opts) => {
+  program2.command("check").description("Check domain availability via a registrar provider").argument("<name>", "Domain name (e.g. example.com)").option("--provider <name>", "Registrar provider \u2014 defaults to config default-registrar, else route53").option("--json", "Output as JSON", false).action(async (name, opts) => {
     try {
-      const providerName = opts.provider ?? loadConfig3().default_registrar ?? "namecheap";
-      const result = providerName === "namecheap" ? await checkAvailability(name) : await getRegistrarProvider(providerName).checkAvailability(name);
+      const providerName = (opts.provider ?? loadConfig3().default_registrar ?? "route53").toLowerCase();
+      requireRegistrarProvider(providerName);
+      const result = await getRegistrarProvider(providerName).checkAvailability(name);
       if (opts.json) {
         console.log(JSON.stringify({ provider: providerName, ...result }, null, 2));
       } else {
         console.log(`${result.domain} is ${result.available ? "AVAILABLE" : "NOT available"} (via ${providerName})`);
+        if (result.is_premium)
+          console.log(`  Premium ask: ${result.premium_price ?? "unknown"}`);
+        if (result.standard_price !== undefined) {
+          const currency = result.currency ? ` ${result.currency}` : "";
+          console.log(`  Standard price: ${result.standard_price}${currency}`);
+        }
       }
     } catch (error) {
       console.error(`Availability check failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -42580,6 +44099,7 @@ init_config();
 var VALID_KEYS = [
   "default-registrar",
   "default-dns",
+  "purchase-aws-profile",
   "contact.first-name",
   "contact.last-name",
   "contact.email",
@@ -42601,8 +44121,9 @@ function registerConfigCommands(program2) {
     }
     console.log(`
 Configuration (~/.hasna/domains/config.json):`);
-    console.log(`  default-registrar: ${cfg.default_registrar ?? "(not set)"}`);
-    console.log(`  default-dns:       ${cfg.default_dns ?? "(not set)"}`);
+    console.log(`  default-registrar:    ${cfg.default_registrar ?? "(not set)"}`);
+    console.log(`  default-dns:          ${cfg.default_dns ?? "(not set)"}`);
+    console.log(`  purchase-aws-profile: ${cfg.purchase_aws_profile ?? "(not set)"}`);
     if (cfg.contact && Object.keys(cfg.contact).length > 0) {
       console.log(`
   contact:`);
@@ -42703,7 +44224,7 @@ function registerDoctorCommand(program2) {
         fail(`${c3.provider}: not configured (${c3.detail})`);
     }
     section("Providers");
-    const providers = getAvailableProviders().filter((p3) => p3.name !== "brandsight");
+    const providers = getAvailableProviders().filter((p3) => p3.type !== "marketplace");
     for (const p3 of providers) {
       if (!p3.configured) {
         fail(`${p3.name}: not configured`, `Set: ${p3.envVars.join(", ")}`);
@@ -42753,15 +44274,15 @@ ${"\u2500".repeat(45)}`);
 }
 
 // src/cli/commands/mcp-install.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname4, join as join5 } from "path";
 import { execSync as execSync3 } from "child_process";
 var MCP_SERVER_NAME = "domains";
 function getClaudeConfigPaths() {
   return {
-    global: join4(homedir4(), ".claude", "claude_desktop_config.json"),
-    project: join4(process.cwd(), ".claude", "settings.json")
+    global: join5(homedir5(), ".claude", "claude_desktop_config.json"),
+    project: join5(process.cwd(), ".claude", "settings.json")
   };
 }
 function getMcpBinaryPath() {
@@ -42773,12 +44294,12 @@ function getMcpBinaryPath() {
 }
 function ensureConfigDir(configPath2) {
   const dir = dirname4(configPath2);
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
 }
 function readConfig(configPath2) {
-  if (!existsSync3(configPath2))
+  if (!existsSync4(configPath2))
     return {};
   try {
     return JSON.parse(readFileSync5(configPath2, "utf-8"));
@@ -42807,7 +44328,7 @@ function registerMcpCommand(program2) {
   mcp.command("uninstall").description("Remove domains MCP server from Claude Code config").option("--project", "Remove from project config instead of global").action((opts) => {
     const paths = getClaudeConfigPaths();
     const configPath2 = opts.project ? paths.project : paths.global;
-    if (!existsSync3(configPath2)) {
+    if (!existsSync4(configPath2)) {
       console.log("Config file not found \u2014 nothing to remove.");
       return;
     }
@@ -42825,7 +44346,7 @@ function registerMcpCommand(program2) {
     const paths = getClaudeConfigPaths();
     const status = [];
     for (const [scope, configPath2] of [["global", paths.global], ["project", paths.project]]) {
-      if (!existsSync3(configPath2)) {
+      if (!existsSync4(configPath2)) {
         status.push({ scope, config_path: configPath2, exists: false, registered: false });
         continue;
       }
@@ -43049,7 +44570,7 @@ function registerRoute53Commands(program2) {
         process.exit(1);
       }
       console.log(`Registering ${domain}...`);
-      const result = await registerDomain(domain, contact, parseInt(opts.years), opts.autoRenew);
+      const result = await registerDomain2(domain, contact, parseInt(opts.years), opts.autoRenew);
       console.log(`\u2713 Registration submitted: ${domain}`);
       console.log(`  Operation ID: ${result.operationId}`);
       console.log(`  Check status: domains r53 status ${result.operationId}`);
@@ -43346,7 +44867,7 @@ DNS Records for ${domain}:`);
         console.error(`Error: ${e3 instanceof Error ? e3.message : String(e3)}`);
         process.exit(1);
       }
-      const reg = await registerDomain(domain, contact, parseInt(opts.years));
+      const reg = await registerDomain2(domain, contact, parseInt(opts.years));
       console.log(`  \u2713 Submitted (operation: ${reg.operationId})`);
       console.log(`  Waiting for registration to complete...`);
       let status = "IN_PROGRESS";
@@ -43377,7 +44898,7 @@ DNS Records for ${domain}:`);
         },
         getRegistrarNs: async (d3) => (await getDomainDetail(d3)).nameservers,
         setRegistrarNs: async (d3, ns) => {
-          await updateNameservers(d3, ns);
+          await updateNameservers2(d3, ns);
         }
       });
       console.log(`  \u2713 Zone ${setup.created ? "created" : "reused"} (${setup.zoneId})` + (setup.nsUpdated ? ` \u2014 registry NS repointed to this zone` : ``));
@@ -45554,10 +47075,10 @@ function registerInteractiveCommand(program2) {
   });
 }
 
-// src/cli/commands/cloud.ts
+// src/cli/commands/storage.ts
 import chalk2 from "chalk";
 
-// src/db/cloud-sync.ts
+// src/db/storage-sync.ts
 init_database();
 
 // src/db/pg-migrations.ts
@@ -45734,8 +47255,8 @@ class PgAdapterAsync {
   }
 }
 
-// src/db/cloud-sync.ts
-var CLOUD_TABLES = [
+// src/db/storage-sync.ts
+var STORAGE_TABLES = [
   "domains",
   "dns_records",
   "alerts",
@@ -45755,25 +47276,50 @@ var PRIMARY_KEYS = {
   domain_history: ["id"],
   domain_reputation: ["id"]
 };
-function getCloudDatabaseUrl() {
-  return process.env["HASNA_DOMAINS_CLOUD_DATABASE_URL"] ?? process.env["OPEN_DOMAINS_CLOUD_DATABASE_URL"] ?? process.env["DOMAINS_CLOUD_DATABASE_URL"] ?? null;
+var DOMAINS_STORAGE_ENV = "HASNA_DOMAINS_DATABASE_URL";
+var DOMAINS_STORAGE_FALLBACK_ENV = "DOMAINS_DATABASE_URL";
+var DOMAINS_STORAGE_MODE_ENV = "HASNA_DOMAINS_STORAGE_MODE";
+var DOMAINS_STORAGE_MODE_FALLBACK_ENV = "DOMAINS_STORAGE_MODE";
+var STORAGE_DATABASE_ENV = [DOMAINS_STORAGE_ENV, DOMAINS_STORAGE_FALLBACK_ENV];
+var STORAGE_MODE_ENV = [DOMAINS_STORAGE_MODE_ENV, DOMAINS_STORAGE_MODE_FALLBACK_ENV];
+function firstEnv2(names) {
+  for (const name of names) {
+    const value = process.env[name];
+    if (value)
+      return value;
+  }
+  return null;
+}
+function normalizeStorageMode(value) {
+  if (!value)
+    return null;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "local" || normalized === "remote" || normalized === "hybrid")
+    return normalized;
+  return null;
 }
-async function getCloudPg() {
-  const url = getCloudDatabaseUrl();
+function getStorageDatabaseUrl() {
+  return firstEnv2(STORAGE_DATABASE_ENV);
+}
+function getStorageMode() {
+  return normalizeStorageMode(firstEnv2(STORAGE_MODE_ENV)) ?? (getStorageDatabaseUrl() ? "remote" : "local");
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
   if (!url) {
-    throw new Error("Missing HASNA_DOMAINS_CLOUD_DATABASE_URL, OPEN_DOMAINS_CLOUD_DATABASE_URL, or DOMAINS_CLOUD_DATABASE_URL");
+    throw new Error("Missing HASNA_DOMAINS_DATABASE_URL or DOMAINS_DATABASE_URL");
   }
   return new PgAdapterAsync(url);
 }
-async function runCloudMigrations(remote) {
+async function runStorageMigrations(remote) {
   for (const sql of PG_MIGRATIONS)
     await remote.run(sql);
 }
-async function cloudPush(options) {
-  const remote = await getCloudPg();
+async function storagePush(options) {
+  const remote = await getStoragePg();
   const db = getDatabase();
   try {
-    await runCloudMigrations(remote);
+    await runStorageMigrations(remote);
     const results = [];
     for (const table of resolveTables(options?.tables))
       results.push(await pushTable(db, remote, table));
@@ -45783,11 +47329,11 @@ async function cloudPush(options) {
     await remote.close();
   }
 }
-async function cloudPull(options) {
-  const remote = await getCloudPg();
+async function storagePull(options) {
+  const remote = await getStoragePg();
   const db = getDatabase();
   try {
-    await runCloudMigrations(remote);
+    await runStorageMigrations(remote);
     const results = [];
     for (const table of resolveTables(options?.tables))
       results.push(await pullTable(remote, db, table));
@@ -45797,20 +47343,30 @@ async function cloudPull(options) {
     await remote.close();
   }
 }
-async function cloudSync(options) {
-  const pull = await cloudPull(options);
-  const push = await cloudPush(options);
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
   return { pull, push };
 }
-function getSyncMetaAll() {
+function getStorageSyncMetaAll() {
   const db = getDatabase();
   ensureSyncMetaTable(db);
   return db.query("SELECT table_name, last_synced_at, direction FROM _domains_sync_meta ORDER BY table_name, direction").all();
 }
+function getStorageStatus() {
+  return {
+    configured: Boolean(getStorageDatabaseUrl()),
+    env: STORAGE_DATABASE_ENV,
+    mode: getStorageMode(),
+    service: "domains",
+    tables: STORAGE_TABLES,
+    sync: getStorageSyncMetaAll()
+  };
+}
 function resolveTables(tables) {
   if (!tables || tables.length === 0)
-    return [...CLOUD_TABLES];
-  const allowed = new Set(CLOUD_TABLES);
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
   const requested = tables.map((table) => table.trim()).filter(Boolean);
   const invalid = requested.filter((table) => !allowed.has(table));
   if (invalid.length > 0)
@@ -45946,12 +47502,7 @@ function coerceForSqlite(value) {
   return String(value);
 }
 
-// src/cli/commands/cloud.ts
-var CLOUD_ENV = [
-  "HASNA_DOMAINS_CLOUD_DATABASE_URL",
-  "OPEN_DOMAINS_CLOUD_DATABASE_URL",
-  "DOMAINS_CLOUD_DATABASE_URL"
-];
+// src/cli/commands/storage.ts
 function parseTables(value) {
   if (!value)
     return;
@@ -45968,21 +47519,15 @@ function printResults(results, label) {
   }
   console.log(`Done. ${total} rows ${label}.`);
 }
-function registerCloudCommand(program2) {
-  const cloud = program2.command("cloud").description("Cloud sync commands");
-  cloud.command("status").description("Show cloud config and local sync state").option("--json", "Output as JSON").action((opts) => {
-    const info = {
-      configured: Boolean(getCloudDatabaseUrl()),
-      env: CLOUD_ENV,
-      service: "domains",
-      tables: CLOUD_TABLES,
-      sync: getSyncMetaAll()
-    };
+function installStorageSubcommands(storage) {
+  storage.command("status").description("Show remote storage config and local sync state").option("--json", "Output as JSON").action((opts) => {
+    const info = getStorageStatus();
     if (opts.json) {
       printJson(info);
       return;
     }
-    console.log(`Cloud configured: ${info.configured ? "yes" : "no"}`);
+    console.log(`Storage mode: ${info.mode}`);
+    console.log(`Remote storage configured: ${info.configured ? "yes" : "no"}`);
     console.log(`Tables: ${info.tables.join(", ")}`);
     if (info.sync.length === 0)
       console.log("Sync: no local sync history");
@@ -45990,9 +47535,9 @@ function registerCloudCommand(program2) {
       console.log(`  ${entry.table_name} ${entry.direction}: ${entry.last_synced_at ?? "never"}`);
     }
   });
-  cloud.command("push").description("Push local domains data to cloud PostgreSQL").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
+  storage.command("push").description("Push local domains data to remote PostgreSQL storage").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
     try {
-      const results = await cloudPush({ tables: parseTables(opts.tables) });
+      const results = await storagePush({ tables: parseTables(opts.tables) });
       if (opts.json) {
         printJson(results);
         return;
@@ -46003,9 +47548,9 @@ function registerCloudCommand(program2) {
       process.exit(1);
     }
   });
-  cloud.command("pull").description("Pull domains data from cloud PostgreSQL to local SQLite").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
+  storage.command("pull").description("Pull domains data from remote PostgreSQL storage to local SQLite").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
     try {
-      const results = await cloudPull({ tables: parseTables(opts.tables) });
+      const results = await storagePull({ tables: parseTables(opts.tables) });
       if (opts.json) {
         printJson(results);
         return;
@@ -46016,9 +47561,9 @@ function registerCloudCommand(program2) {
       process.exit(1);
     }
   });
-  cloud.command("sync").description("Bidirectional sync: pull then push").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
+  storage.command("sync").description("Bidirectional sync: pull then push").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
     try {
-      const result = await cloudSync({ tables: parseTables(opts.tables) });
+      const result = await storageSync({ tables: parseTables(opts.tables) });
       if (opts.json) {
         printJson(result);
         return;
@@ -46031,6 +47576,9 @@ function registerCloudCommand(program2) {
     }
   });
 }
+function registerStorageCommand(program2) {
+  installStorageSubcommands(program2.command("storage").description("Manage domains local/remote storage sync"));
+}
 
 // src/cli/index.ts
 init_version();
@@ -46056,6 +47604,7 @@ registerOutreachCommand(program2);
 registerSedoCommand(program2);
 registerWalletCommand(program2);
 registerProvisionCommand(program2);
-registerCloudCommand(program2);
+registerStorageCommand(program2);
+registerEventsCommands(program2, { source: "domains" });
 registerInteractiveCommand(program2);
 program2.parse(process.argv);