@hasna/domains 0.0.21 → 0.0.22

package/dist/cli/index.js

@@ -3664,7 +3664,7 @@ function godaddyCapability(env = process.env) {
   return {
     configured,
     gated: true,
-    notes: configured ? "Credentials present; availability checks may work, but purchase + DNS writes require a qualifying account (>=10 domains / DDC). Prefer Route53." : "Not configured; and retail Domains API is gated for purchase/DNS since 2024."
+    notes: configured ? "Credentials present; DNS/domain management may work with qualifying account access, but availability remains threshold-gated and direct automated purchase is not exposed here. Prefer Route53 for purchases." : "Not configured; GoDaddy production availability remains threshold-gated and DNS/domain management requires qualifying account access."
   };
 }
 var GoDaddyApiError, _overriddenFetch = null, GODADDY_API_BASE = "https://api.godaddy.com";
@@ -34425,11 +34425,32 @@ var init_dist_es14 = __esm(() => {
 });
 
 // src/lib/route53.ts
+var exports_route53 = {};
+__export(exports_route53, {
+  upsertRecords: () => upsertRecords,
+  upsertRecord: () => upsertRecord,
+  updateNameservers: () => updateNameservers2,
+  registerDomain: () => registerDomain2,
+  listRegisteredDomains: () => listRegisteredDomains,
+  listRecords: () => listRecords,
+  listHostedZones: () => listHostedZones,
+  getRegistrationStatus: () => getRegistrationStatus,
+  getHostedZone: () => getHostedZone,
+  getDomainDetail: () => getDomainDetail,
+  getConfig: () => getConfig2,
+  findHostedZoneByDomain: () => findHostedZoneByDomain,
+  deleteRecord: () => deleteRecord,
+  deleteHostedZone: () => deleteHostedZone,
+  createRoute53Provider: () => createRoute53Provider,
+  createHostedZone: () => createHostedZone,
+  checkAvailability: () => checkAvailability3
+});
 function getConfig2() {
   return {
     region: process.env["AWS_REGION"] || "us-east-1",
     accessKeyId: process.env["AWS_ACCESS_KEY_ID"],
-    secretAccessKey: process.env["AWS_SECRET_ACCESS_KEY"]
+    secretAccessKey: process.env["AWS_SECRET_ACCESS_KEY"],
+    sessionToken: process.env["AWS_SESSION_TOKEN"]
   };
 }
 function checkCredentials(cfg) {
@@ -34445,7 +34466,7 @@ function makeClients(config) {
   const cfg = config ?? getConfig2();
   checkCredentials(cfg);
   const region = cfg.region || "us-east-1";
-  const credentials = cfg.accessKeyId && cfg.secretAccessKey ? { accessKeyId: cfg.accessKeyId, secretAccessKey: cfg.secretAccessKey } : undefined;
+  const credentials = cfg.accessKeyId && cfg.secretAccessKey ? { accessKeyId: cfg.accessKeyId, secretAccessKey: cfg.secretAccessKey, sessionToken: cfg.sessionToken } : undefined;
   return {
     route53: new Route53Client({ region, credentials }),
     domains: new Route53DomainsClient({ region: "us-east-1", credentials })
@@ -34585,7 +34606,8 @@ async function listHostedZones(config) {
         id: cleanZoneId(z2.Id ?? ""),
         name: z2.Name ?? "",
         record_count: z2.ResourceRecordSetCount ?? 0,
-        comment: z2.Config?.Comment
+        comment: z2.Config?.Comment,
+        private_zone: z2.Config?.PrivateZone
       });
     }
     marker = result.IsTruncated ? result.NextMarker : undefined;
@@ -34600,7 +34622,8 @@ async function getHostedZone(hostedZoneId, config) {
     name: result.HostedZone?.Name ?? "",
     record_count: result.HostedZone?.ResourceRecordSetCount ?? 0,
     comment: result.HostedZone?.Config?.Comment,
-    name_servers: result.DelegationSet?.NameServers ?? []
+    name_servers: result.DelegationSet?.NameServers ?? [],
+    private_zone: result.HostedZone?.Config?.PrivateZone
   };
 }
 async function deleteHostedZone(hostedZoneId, config) {
@@ -34610,7 +34633,15 @@ async function deleteHostedZone(hostedZoneId, config) {
 async function findHostedZoneByDomain(domain, config) {
   const zones = await listHostedZones(config);
   const normalized = domain.endsWith(".") ? domain : `${domain}.`;
-  return zones.find((z2) => z2.name === normalized) ?? null;
+  const matches = zones.filter((z2) => z2.name === normalized);
+  if (matches.length === 0)
+    return null;
+  const publicMatches = matches.filter((z2) => !z2.private_zone);
+  const candidates = publicMatches.length > 0 ? publicMatches : matches;
+  if (candidates.length > 1) {
+    throw new Error(`Multiple Route 53 hosted zones found for ${domain}; specify hosted zone id`);
+  }
+  return candidates[0] ?? null;
 }
 function rrsToRecord(rrs) {
   if (rrs.AliasTarget) {
@@ -34710,19 +34741,53 @@ function createRoute53Provider(config) {
   const cfg = config ?? getConfig2();
   const registerWithRoute53 = registerDomain2;
   const updateRoute53Nameservers = updateNameservers2;
+  async function listDomainInventory() {
+    const byDomain = new Map;
+    try {
+      const registered = await listRegisteredDomains(cfg);
+      for (const d3 of registered) {
+        byDomain.set(d3.domain, {
+          domain: d3.domain,
+          registrar: "AWS Route 53",
+          created: "",
+          expires: d3.expiry,
+          nameservers: [],
+          status: "active",
+          auto_renew: d3.auto_renew
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!message.includes("route53domains:ListDomains") && !message.includes("AccessDenied")) {
+        throw error;
+      }
+    }
+    const zones = await listHostedZones(cfg);
+    for (const z2 of zones) {
+      const zone = z2.name_servers?.length ? z2 : await getHostedZone(z2.id, cfg).catch(() => z2);
+      const domain = zone.name.replace(/\.$/, "");
+      const nameservers = zone.name_servers ?? [];
+      const existing = byDomain.get(domain);
+      if (existing) {
+        existing.nameservers = nameservers.length > 0 ? nameservers : existing.nameservers;
+        continue;
+      }
+      byDomain.set(domain, {
+        domain,
+        registrar: "AWS Route 53 DNS",
+        created: "",
+        expires: "",
+        nameservers,
+        status: "active",
+        auto_renew: false
+      });
+    }
+    return Array.from(byDomain.values());
+  }
   return {
     name: "route53",
     async listDomains() {
-      const domains = await listRegisteredDomains(cfg);
-      return domains.map((d3) => ({
-        domain: d3.domain,
-        registrar: "AWS Route 53",
-        created: "",
-        expires: d3.expiry,
-        nameservers: [],
-        status: "active",
-        auto_renew: d3.auto_renew
-      }));
+      return listDomainInventory();
     },
     async getDomainInfo(domain) {
       const detail = await getDomainDetail(domain, cfg);
@@ -34791,7 +34856,7 @@ function createRoute53Provider(config) {
       };
     },
     async syncToLocalDb(dbFns) {
-      const domains = await listRegisteredDomains(cfg);
+      const domains = await listDomainInventory();
       let synced = 0;
       let created = 0;
       let updated = 0;
@@ -34800,20 +34865,39 @@ function createRoute53Provider(config) {
         try {
           const existing = dbFns.getDomainByName(d3.domain);
           if (existing) {
+            const existingRoute53 = existing.metadata["route53"];
+            const staleDnsOnlyRegistrar = d3.registrar !== "AWS Route 53" && (existing.registrar === "AWS Route 53 DNS" || existing.registrar === "AWS Route 53" && existingRoute53?.source === "route53:hosted_zones");
             dbFns.updateDomain(existing.id, {
-              registrar: "AWS Route 53",
-              expires_at: d3.expiry || undefined,
+              ...d3.registrar === "AWS Route 53" ? { registrar: "AWS Route 53" } : {},
+              ...staleDnsOnlyRegistrar ? { registrar: null } : {},
+              expires_at: d3.expires || undefined,
               auto_renew: d3.auto_renew,
+              nameservers: d3.nameservers.length > 0 ? d3.nameservers : existing.nameservers,
+              metadata: {
+                ...existing.metadata,
+                route53: {
+                  source: d3.registrar === "AWS Route 53" ? "route53domains+hosted_zones" : "route53:hosted_zones",
+                  synced_at: new Date().toISOString()
+                }
+              },
               status: "active"
             });
             updated++;
           } else {
             dbFns.createDomain({
               name: d3.domain,
-              registrar: "AWS Route 53",
-              expires_at: d3.expiry || undefined,
+              ...d3.registrar === "AWS Route 53" ? { registrar: "AWS Route 53" } : {},
+              expires_at: d3.expires || undefined,
               auto_renew: d3.auto_renew,
-              status: "active"
+              nameservers: d3.nameservers,
+              status: "active",
+              notes: d3.registrar === "AWS Route 53 DNS" ? "Discovered from Route 53 hosted zones; registrar ownership was not inferred." : undefined,
+              metadata: {
+                route53: {
+                  source: d3.registrar === "AWS Route 53" ? "route53domains+hosted_zones" : "route53:hosted_zones",
+                  synced_at: new Date().toISOString()
+                }
+              }
             });
             created++;
           }
@@ -35055,26 +35139,111 @@ async function listRecords2(zoneId, config) {
   }
   return records;
 }
-async function upsertRecord2(zoneId, record, config) {
-  const existing = await cfFetch(`/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.name)}`, { config });
-  const body = {
-    type: record.type,
-    name: record.name,
-    content: record.content,
-    ttl: record.ttl ?? 1,
-    priority: record.priority,
-    proxied: record.proxied ?? false
-  };
-  if (existing && existing.length > 0) {
-    await cfFetch(`/zones/${zoneId}/dns_records/${existing[0].id}`, { method: "PUT", body, config });
-  } else {
-    await cfFetch(`/zones/${zoneId}/dns_records`, { method: "POST", body, config });
+async function listRecordsByNameType(zoneId, type, name, config) {
+  const result = await cfFetch(`/zones/${zoneId}/dns_records?type=${encodeURIComponent(type)}&name=${encodeURIComponent(name)}`, { config });
+  return (result ?? []).map((r3) => ({
+    id: r3.id,
+    type: r3.type,
+    name: r3.name,
+    content: r3.content,
+    ttl: r3.ttl,
+    priority: r3.priority,
+    proxied: r3.proxied
+  }));
+}
+async function replaceRecordsByNameType(zoneId, records, config) {
+  if (records.length === 0)
+    return;
+  const { type, name } = records[0];
+  const existing = await listRecordsByNameType(zoneId, type, name, config);
+  for (const record of existing) {
+    if (record.id)
+      await deleteRecord2(zoneId, record.id, config);
+  }
+  for (const record of records) {
+    await cfFetch(`/zones/${zoneId}/dns_records`, {
+      method: "POST",
+      body: {
+        type: record.type,
+        name: record.name,
+        content: record.content,
+        ttl: record.ttl ?? 1,
+        priority: record.priority,
+        proxied: record.proxied ?? false
+      },
+      config
+    });
   }
 }
+async function deleteRecord2(zoneId, recordId, config) {
+  await cfFetch(`/zones/${zoneId}/dns_records/${recordId}`, { method: "DELETE", config });
+}
+function zoneToDomainInfo(zone) {
+  return {
+    domain: zone.name,
+    registrar: "Cloudflare DNS",
+    created: "",
+    expires: "",
+    nameservers: zone.nameservers,
+    status: zone.status === "active" ? "active" : "discovered",
+    auto_renew: false
+  };
+}
+function withCloudflareMetadata(existing, zone) {
+  return {
+    ...existing,
+    cloudflare: {
+      zone_id: zone.id,
+      zone_status: zone.status,
+      source: "cloudflare:zones",
+      synced_at: new Date().toISOString()
+    }
+  };
+}
 function createCloudflareProvider(config) {
   const cfg = config ?? getConfig3();
   return {
     name: "cloudflare",
+    async listDomains() {
+      const zones = await listZones(cfg);
+      return zones.map(zoneToDomainInfo);
+    },
+    async syncToLocalDb(dbFns) {
+      const zones = await listZones(cfg);
+      let synced = 0;
+      let created = 0;
+      let updated = 0;
+      const errors3 = [];
+      for (const zone of zones) {
+        try {
+          const info = zoneToDomainInfo(zone);
+          const existing = dbFns.getDomainByName(zone.name);
+          if (existing) {
+            dbFns.updateDomain(existing.id, {
+              ...existing.registrar === "Cloudflare DNS" ? { registrar: null } : {},
+              status: existing.status === "discovered" && info.status === "active" ? "active" : existing.status,
+              nameservers: zone.nameservers,
+              metadata: withCloudflareMetadata(existing.metadata, zone)
+            });
+            updated++;
+          } else {
+            dbFns.createDomain({
+              name: zone.name,
+              status: info.status === "active" ? "active" : "discovered",
+              auto_renew: false,
+              nameservers: zone.nameservers,
+              notes: "Discovered from Cloudflare zones; registrar ownership was not inferred.",
+              metadata: withCloudflareMetadata({}, zone)
+            });
+            created++;
+          }
+          synced++;
+        } catch (err) {
+          errors3.push(`${zone.name}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      return { synced, created, updated, errors: errors3 };
+    },
     async getDnsRecords(domain) {
       const zone = await getZone(domain, cfg);
       if (!zone)
@@ -35092,8 +35261,15 @@ function createCloudflareProvider(config) {
       const zone = await getZone(domain, cfg);
       if (!zone)
         throw new Error(`No Cloudflare zone found for ${domain}`);
+      const grouped = new Map;
       for (const r3 of records) {
-        await upsertRecord2(zone.id, { type: r3.type, name: r3.name, content: r3.value, ttl: r3.ttl || 1, priority: r3.priority }, cfg);
+        const key = `${r3.type}|${r3.name}`;
+        const existing = grouped.get(key) ?? [];
+        existing.push({ type: r3.type, name: r3.name, content: r3.value, ttl: r3.ttl || 1, priority: r3.priority });
+        grouped.set(key, existing);
+      }
+      for (const group of grouped.values()) {
+        await replaceRecordsByNameType(zone.id, group, cfg);
       }
       return true;
     }
@@ -35139,7 +35315,7 @@ function getApiKey() {
 function getConfig4() {
   return resolveBrandsightConfig();
 }
-async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE) {
+async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
   const fetchFn = _fetchFn || globalThis.fetch;
   const url = `${baseUrl}${path}`;
   const headers = {
@@ -35150,13 +35326,12 @@ async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE
   };
   try {
     const response = await fetchFn(url, {
-      method,
+      method: "GET",
       headers,
-      body: body ? JSON.stringify(body) : undefined,
       signal: AbortSignal.timeout(15000)
     });
     if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API ${method} ${path} failed with status ${response.status}`, response.status, await response.text());
+      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
     }
     const data = await response.json();
     return { data, stub: false };
@@ -35166,31 +35341,102 @@ async function apiRequest3(method, path, apiKey, body, baseUrl = BRANDSIGHT_BASE
     return { data: null, stub: true };
   }
 }
-async function apiGet(path, apiKey, baseUrl = BRANDSIGHT_BASE) {
-  const fetchFn = _fetchFn || globalThis.fetch;
-  const url = `${baseUrl}${path}`;
-  const headers = {
-    Authorization: `Bearer ${apiKey}`,
+function requireDomainConfig(config) {
+  const cfg = config ?? getConfig4();
+  if (!cfg.apiKey || !cfg.apiSecret || !cfg.customerId) {
+    throw new BrandsightApiError("Brandsight Domain API credentials are not configured. Set BRANDSIGHT_API_KEY, BRANDSIGHT_API_SECRET, and BRANDSIGHT_CUSTOMER_ID (or HASNAXYZ_BRANDSIGHT_LIVE_* aliases).");
+  }
+  return cfg;
+}
+function domainBaseUrl(cfg) {
+  return cfg.baseUrl ?? BRANDSIGHT_DOMAIN_BASE;
+}
+function domainHeaders(cfg) {
+  return {
+    Authorization: `sso-key ${cfg.apiKey}:${cfg.apiSecret}`,
     "Content-Type": "application/json",
     Accept: "application/json",
     "User-Agent": USER_AGENT
   };
-  try {
-    const response = await fetchFn(url, {
-      method: "GET",
-      headers,
-      signal: AbortSignal.timeout(15000)
-    });
-    if (!response.ok) {
-      throw new BrandsightApiError(`Brandsight API GET ${path} failed with status ${response.status}`, response.status, await response.text());
-    }
-    const data = await response.json();
-    return { data, stub: false };
-  } catch (error) {
-    if (error instanceof BrandsightApiError)
-      throw error;
-    return { data: null, stub: true };
+}
+async function domainApiRequest(method, path, config, body) {
+  const cfg = requireDomainConfig(config);
+  const fetchFn = _fetchFn || globalThis.fetch;
+  const response = await fetchFn(`${domainBaseUrl(cfg)}${path}`, {
+    method,
+    headers: domainHeaders(cfg),
+    body: body ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(30000)
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new BrandsightApiError(`Brandsight Domain API ${method} ${path} failed with status ${response.status}`, response.status, text);
   }
+  if (!text.trim())
+    return {};
+  return JSON.parse(text);
+}
+function normalizeBrandsightDomain(raw) {
+  const nameServers = raw.nameServers ?? raw.nameservers ?? [];
+  const expiresAt = raw.expiresAt ?? raw.expires ?? "";
+  const createdAt = raw.createdAt ?? raw.created ?? "";
+  const renewAuto = raw.renewAuto ?? raw.auto_renew ?? false;
+  return {
+    ...raw,
+    domain: String(raw.domain ?? ""),
+    status: String(raw.status ?? "UNKNOWN"),
+    created: createdAt,
+    expires: expiresAt,
+    auto_renew: renewAuto,
+    locked: Boolean(raw.locked),
+    nameservers: nameServers,
+    createdAt,
+    expiresAt,
+    nameServers,
+    renewAuto
+  };
+}
+function customerPath(cfg, path) {
+  return `/customers/${encodeURIComponent(cfg.customerId)}${path}`;
+}
+function domainTld(domain) {
+  const parts = domain.split(".").filter(Boolean);
+  if (parts.length < 2)
+    throw new BrandsightApiError(`Invalid domain name: ${domain}`);
+  return parts.slice(1).join(".");
+}
+function brandsightContact(contact) {
+  return {
+    addressMailing: {
+      address1: contact.address_line_1,
+      city: contact.city,
+      country: contact.country_code,
+      postalCode: contact.zip_code,
+      state: contact.state
+    },
+    email: contact.email,
+    encoding: "ASCII",
+    nameFirst: contact.first_name,
+    nameLast: contact.last_name,
+    organization: contact.organization_name,
+    phone: contact.phone
+  };
+}
+async function domainAvailability(domain, cfg, type, period = 1) {
+  const params = new URLSearchParams({
+    domain,
+    period: String(period),
+    type,
+    optimizeFor: "ACCURACY"
+  });
+  const result = await domainApiRequest("GET", `/domains/available?${params.toString()}`, cfg);
+  return {
+    domain: result.domain ?? domain,
+    available: Boolean(result.available),
+    price: result.price,
+    currency: result.currency,
+    registryPremiumPricing: result.registryPremiumPricing
+  };
 }
 function generateStubAlerts(brandName) {
   const now2 = new Date().toISOString();
@@ -35244,32 +35490,160 @@ async function getThreatAssessment(domain) {
   return { ...result.data, stub: false };
 }
 async function listDomains2(config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet("/portfolio/domains", cfg.apiKey);
-  if (result.stub)
-    return [];
-  return result.data.domains ?? [];
+  const cfg = requireDomainConfig(config);
+  const domains = [];
+  const seenMarkers = new Set;
+  let marker;
+  while (true) {
+    const params = new URLSearchParams({ limit: "500" });
+    if (marker)
+      params.set("marker", marker);
+    const batch = await domainApiRequest("GET", customerPath(cfg, `/domains?${params.toString()}`), cfg);
+    if (!Array.isArray(batch) || batch.length === 0)
+      break;
+    domains.push(...batch.map(normalizeBrandsightDomain).filter((d3) => d3.domain));
+    if (batch.length < 500)
+      break;
+    const nextMarker = String(batch[batch.length - 1]?.domain ?? "");
+    if (!nextMarker || seenMarkers.has(nextMarker))
+      break;
+    seenMarkers.add(nextMarker);
+    marker = nextMarker;
+  }
+  return domains;
 }
 async function getDomainInfo3(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/portfolio/domains/${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return null;
-  return result.data;
+  const cfg = requireDomainConfig(config);
+  const result = await domainApiRequest("GET", customerPath(cfg, `/domains/${encodeURIComponent(domain)}`), cfg);
+  return normalizeBrandsightDomain(result);
 }
 async function checkAvailability4(domain, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiGet(`/domains/check?domain=${encodeURIComponent(domain)}`, cfg.apiKey);
-  if (result.stub)
-    return { domain, available: false };
-  return result.data;
+  const cfg = requireDomainConfig(config);
+  return domainAvailability(domain, cfg, "REGISTRATION", 1);
 }
 async function renewDomain3(domain, years = 1, config) {
-  const cfg = config ?? getConfig4();
-  const result = await apiRequest3("POST", `/portfolio/domains/${encodeURIComponent(domain)}/renew`, cfg.apiKey, { years });
-  if (result.stub)
-    return { success: false };
-  return { success: true, orderId: result.data.orderId };
+  const cfg = requireDomainConfig(config);
+  const current = await getDomainInfo3(domain, cfg);
+  if (!current?.expires)
+    throw new BrandsightApiError(`Cannot renew ${domain}: current expiry is unavailable`);
+  const quote = await domainAvailability(domain, cfg, "RENEWAL", years);
+  const price = quote.price ?? current.renewal?.price;
+  const currency = quote.currency ?? current.renewal?.currency;
+  if (price == null || !currency) {
+    throw new BrandsightApiError(`Cannot renew ${domain}: renewal quote did not include an exact price and currency`);
+  }
+  const result = await domainApiRequest("POST", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/renew`), cfg, {
+    consent: {
+      agreedAt: new Date().toISOString(),
+      agreedBy: cfg.shopperId ?? "domains-cli",
+      currency,
+      price,
+      registryPremiumPricing: quote.registryPremiumPricing ?? false
+    },
+    expires: current.expires,
+    period: years
+  });
+  return { success: true, orderId: result.orderId ?? result.id };
+}
+async function getLegalAgreements(tld, privacy = false, config) {
+  const cfg = requireDomainConfig(config);
+  const params = new URLSearchParams({
+    privacy: String(privacy),
+    tlds: tld
+  });
+  return domainApiRequest("GET", customerPath(cfg, `/domains/agreements?${params.toString()}`), cfg);
+}
+async function getRegistrationSchema(tld, config) {
+  const cfg = requireDomainConfig(config);
+  return domainApiRequest("GET", customerPath(cfg, `/domains/register/schema/${encodeURIComponent(tld)}`), cfg);
+}
+async function validateRegistrationRequest(payload, config) {
+  const cfg = requireDomainConfig(config);
+  await domainApiRequest("POST", customerPath(cfg, "/domains/register/validate"), cfg, payload);
+  return true;
+}
+async function registerBrandsightDomain(domain, contact, options = {}, config) {
+  const cfg = requireDomainConfig(config);
+  const period = options.years ?? 1;
+  const availability = await domainAvailability(domain, cfg, "REGISTRATION", period);
+  if (!availability.available)
+    throw new BrandsightApiError(`${domain} is not available for registration`);
+  const price = options.premiumPrice ?? availability.price;
+  if (price == null || !availability.currency) {
+    throw new BrandsightApiError(`Cannot register ${domain}: availability quote did not include an exact price and currency`);
+  }
+  const tld = domainTld(domain);
+  const schema = await getRegistrationSchema(tld, cfg);
+  const required = Array.isArray(schema["required"]) ? schema["required"] : [];
+  if (required.includes("metadata") && !options.metadata) {
+    throw new BrandsightApiError(`Cannot register ${domain}: ${tld} requires TLD-specific metadata; pass registration metadata before validation`);
+  }
+  const privacy = options.privacy ?? false;
+  const agreements = await getLegalAgreements(tld, privacy, cfg);
+  const agreementKeys = agreements.map((a3) => a3.agreementKey).filter(Boolean);
+  const c3 = brandsightContact(contact);
+  const payload = {
+    consent: {
+      agreedAt: new Date().toISOString(),
+      agreedBy: contact.email || cfg.shopperId || "domains-cli",
+      agreementKeys,
+      currency: availability.currency,
+      price,
+      registryPremiumPricing: availability.registryPremiumPricing ?? !!options.premiumPrice
+    },
+    contacts: {
+      admin: c3,
+      billing: c3,
+      registrant: c3,
+      tech: c3
+    },
+    domain,
+    metadata: options.metadata ?? {},
+    nameServers: options.nameservers ?? [],
+    period,
+    privacy,
+    renewAuto: options.autoRenew ?? true
+  };
+  await validateRegistrationRequest(payload, cfg);
+  const result = await domainApiRequest("POST", customerPath(cfg, "/domains/register"), cfg, payload);
+  return {
+    success: true,
+    orderId: result.orderId ?? result.id,
+    operationId: result.operationId ?? result.id,
+    chargedAmount: String(price)
+  };
+}
+async function updateNameservers3(domain, nameservers, config) {
+  const cfg = requireDomainConfig(config);
+  const result = await domainApiRequest("PUT", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/nameServers`), cfg, { nameServers: nameservers });
+  return { success: true, operationId: result.operationId ?? result.id };
+}
+async function getDnsRecords3(domain, config) {
+  const cfg = requireDomainConfig(config);
+  const records = [];
+  let offset = 0;
+  const limit = 1000;
+  while (true) {
+    const batch = await domainApiRequest("GET", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/records?offset=${offset}&limit=${limit}`), cfg);
+    if (!Array.isArray(batch) || batch.length === 0)
+      break;
+    records.push(...batch);
+    if (batch.length < limit)
+      break;
+    offset++;
+  }
+  return records;
+}
+function normalizeBrandsightDnsRecord(record) {
+  return {
+    ...record,
+    ttl: Math.max(record.ttl || 600, 600)
+  };
+}
+async function setDnsRecords3(domain, records, config) {
+  const cfg = requireDomainConfig(config);
+  await domainApiRequest("PUT", customerPath(cfg, `/domains/${encodeURIComponent(domain)}/records`), cfg, records.map(normalizeBrandsightDnsRecord));
+  return true;
 }
 async function syncToLocalDb3(dbFns, config) {
   const domains = await listDomains2(config);
@@ -35314,7 +35688,7 @@ function createBrandsightProvider(config) {
       return domains.map((d3) => ({
         domain: d3.domain,
         registrar: "Brandsight",
-        created: "",
+        created: d3.created ?? "",
         expires: d3.expires,
         nameservers: d3.nameservers,
         status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
@@ -35328,7 +35702,7 @@ function createBrandsightProvider(config) {
       return {
         domain: d3.domain,
         registrar: "Brandsight",
-        created: "",
+        created: d3.created ?? "",
         expires: d3.expires,
         nameservers: d3.nameservers,
         status: d3.status === "ACTIVE" ? "active" : d3.status.toLowerCase(),
@@ -35339,12 +35713,47 @@ function createBrandsightProvider(config) {
       const result = await renewDomain3(domain, years, cfg);
       return { domain, success: result.success, orderId: result.orderId };
     },
+    async registerDomain(domain, contact, options) {
+      const result = await registerBrandsightDomain(domain, contact, options, cfg);
+      return {
+        domain,
+        success: result.success,
+        orderId: result.orderId,
+        operationId: result.operationId,
+        chargedAmount: result.chargedAmount
+      };
+    },
+    async updateNameservers(domain, nameservers) {
+      const result = await updateNameservers3(domain, nameservers, cfg);
+      return { domain, success: result.success, operationId: result.operationId };
+    },
+    async getDnsRecords(domain) {
+      const records = await getDnsRecords3(domain, cfg);
+      return records.map((r3) => ({
+        type: r3.type,
+        name: r3.name,
+        value: r3.data,
+        ttl: r3.ttl,
+        priority: r3.priority
+      }));
+    },
+    async setDnsRecords(domain, records) {
+      return setDnsRecords3(domain, records.map((r3) => ({
+        type: r3.type,
+        name: r3.name,
+        data: r3.value,
+        ttl: r3.ttl,
+        priority: r3.priority
+      })), cfg);
+    },
     async checkAvailability(domain) {
       const result = await checkAvailability4(domain, cfg);
       return {
         domain: result.domain,
         available: result.available,
-        standard_price: result.price,
+        is_premium: result.registryPremiumPricing,
+        premium_price: result.registryPremiumPricing ? result.price : undefined,
+        standard_price: result.registryPremiumPricing ? undefined : result.price,
         currency: result.currency
       };
     },
@@ -35353,7 +35762,7 @@ function createBrandsightProvider(config) {
     }
   };
 }
-var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1";
+var BrandsightApiError, _fetchFn = null, BRANDSIGHT_BASE = "https://api.brandsight.com/v1", BRANDSIGHT_DOMAIN_BASE = "https://api.godaddy.com/v2";
 var init_brandsight = __esm(() => {
   init_env_aliases();
   init_version();
@@ -42048,6 +42457,7 @@ var providerRegistry = new Map([
       configured: false,
       envVars: providerEnvNames("namecheap")
     },
+    createInventory: createNamecheapProvider,
     createRegistrar: createNamecheapProvider,
     createDns: createNamecheapProvider
   }],
@@ -42058,6 +42468,7 @@ var providerRegistry = new Map([
       configured: false,
       envVars: providerEnvNames("godaddy")
     },
+    createInventory: createGoDaddyProvider,
     createRegistrar: createGoDaddyProvider,
     createDns: createGoDaddyProvider
   }],
@@ -42068,6 +42479,7 @@ var providerRegistry = new Map([
       configured: false,
       envVars: providerEnvNames("route53")
     },
+    createInventory: () => createRoute53Provider(),
     createRegistrar: () => createRoute53Provider(),
     createDns: () => createRoute53Provider()
   }],
@@ -42078,16 +42490,19 @@ var providerRegistry = new Map([
       configured: false,
       envVars: providerEnvNames("cloudflare")
     },
+    createInventory: () => createCloudflareProvider(),
     createDns: createCloudflareProvider
   }],
   ["brandsight", {
     info: {
       name: "brandsight",
-      type: "registrar",
+      type: "full",
       configured: false,
       envVars: providerEnvNames("brandsight")
     },
-    createRegistrar: createBrandsightProvider
+    createInventory: createBrandsightProvider,
+    createRegistrar: createBrandsightProvider,
+    createDns: createBrandsightProvider
   }],
   ["sedo", {
     info: {
@@ -42104,18 +42519,28 @@ function isConfigured(providerName) {
 function getAvailableProviders() {
   return Array.from(providerRegistry.values()).map((e3) => ({
     ...e3.info,
-    configured: isConfigured(e3.info.name)
+    configured: isConfigured(e3.info.name),
+    inventory: !!e3.createInventory
   }));
 }
 function getProviderInfo(name) {
   const entry = providerRegistry.get(name.toLowerCase());
   if (!entry)
     return null;
-  return { ...entry.info, configured: isConfigured(entry.info.name) };
+  return { ...entry.info, configured: isConfigured(entry.info.name), inventory: !!entry.createInventory };
 }
 function providerHasRegistrar(name) {
   return !!providerRegistry.get(name.toLowerCase())?.createRegistrar;
 }
+function providerHasInventory(name) {
+  return !!providerRegistry.get(name.toLowerCase())?.createInventory;
+}
+function getDomainInventoryProvider(name) {
+  const entry = providerRegistry.get(name.toLowerCase());
+  if (!entry?.createInventory)
+    throw new Error(`No domain inventory provider: ${name}`);
+  return entry.createInventory();
+}
 function getRegistrarProvider(name) {
   const entry = providerRegistry.get(name.toLowerCase());
   if (!entry?.createRegistrar)
@@ -42129,11 +42554,11 @@ function getDnsProvider(name) {
   return entry.createDns();
 }
 async function syncAll(dbFns) {
-  const available = getAvailableProviders().filter((p3) => p3.configured && providerHasRegistrar(p3.name));
+  const available = getAvailableProviders().filter((p3) => p3.configured && providerHasInventory(p3.name));
   const result = { providers: [], totalSynced: 0, totalErrors: [] };
   for (const info of available) {
     try {
-      const provider = getRegistrarProvider(info.name);
+      const provider = getDomainInventoryProvider(info.name);
       const syncResult = await provider.syncToLocalDb(dbFns);
       result.providers.push({ name: info.name, result: syncResult });
       result.totalSynced += syncResult.synced;
@@ -42151,14 +42576,16 @@ function autoDetectRegistrar(domain, getDomainByName2) {
   if (!dbDomain?.registrar)
     return null;
   const r3 = dbDomain.registrar.toLowerCase();
+  if (r3.includes("cloudflare dns") || r3.includes("route 53 dns") || r3.includes("route53 dns"))
+    return null;
   if (r3.includes("namecheap"))
     return "namecheap";
   if (r3.includes("godaddy"))
     return "godaddy";
-  if (r3.includes("route 53") || r3.includes("route53") || r3.includes("aws"))
+  if (r3.includes("route 53") || r3.includes("route53"))
     return "route53";
   if (r3.includes("cloudflare"))
-    return "cloudflare";
+    return null;
   if (r3.includes("brandsight"))
     return "brandsight";
   return null;
@@ -42498,10 +42925,10 @@ WHOIS for ${result.domain} [${result.source}]:`);
       process.exit(1);
   });
   domain.command("sync").description("Sync domains from a provider to the local DB").option("--provider <name>", "Provider name (default: all configured)").action(async (opts) => {
-    const providers = opts.provider ? [opts.provider] : getAvailableProviders().filter((p3) => p3.configured && (p3.type === "registrar" || p3.type === "full")).map((p3) => p3.name);
+    const providers = opts.provider ? [opts.provider] : getAvailableProviders().filter((p3) => p3.configured && providerHasInventory(p3.name)).map((p3) => p3.name);
     for (const name of providers) {
       try {
-        const provider = getRegistrarProvider(name);
+        const provider = getDomainInventoryProvider(name);
         const result = await provider.syncToLocalDb({ getDomainByName, createDomain, updateDomain });
         console.log(`\u2713 [${name}] Synced ${result.synced} (${result.created} new, ${result.updated} updated)`);
         if (result.errors.length > 0)
@@ -43354,6 +43781,10 @@ function registerMonitorCommand(program2) {
 }
 
 // src/cli/commands/provider.ts
+function isAwsAccessDenied(error) {
+  const msg = error instanceof Error ? error.message : String(error);
+  return msg.includes("AccessDenied") || msg.includes("route53domains:ListDomains");
+}
 function registerProviderCommand(program2) {
   const provider = program2.command("provider").description("Configure and test registrar/DNS providers");
   provider.command("list").description("Show all providers and their configuration status").option("-j, --json", "Output JSON").action((opts) => {
@@ -43367,7 +43798,8 @@ Registrar / DNS Providers:`);
     for (const p3 of providers) {
       const status = p3.configured ? "\u2713 configured" : "\u2717 not configured";
       const type = p3.type === "full" ? "registrar + dns" : p3.type;
-      console.log(`  ${p3.name.padEnd(12)} [${type}]  ${status}`);
+      const capabilities = [type, p3.inventory ? "inventory" : null].filter(Boolean).join(", ");
+      console.log(`  ${p3.name.padEnd(12)} [${capabilities}]  ${status}`);
       if (!p3.configured) {
         console.log(`    Missing: ${p3.envVars.join(", ")}`);
       }
@@ -43408,20 +43840,45 @@ Registrar / DNS Providers:`);
     let registrarOk = null;
     let dnsOk = null;
     let marketplaceOk = null;
+    const notes = [];
     try {
       if (info.type === "registrar" || info.type === "full") {
-        const reg = getRegistrarProvider(providerName);
-        await reg.listDomains();
-        registrarOk = true;
-        if (!opts.json)
-          console.log("\u2713 Registrar connection OK");
+        if (providerName === "route53") {
+          try {
+            const { listRegisteredDomains: listRegisteredDomains2 } = await Promise.resolve().then(() => (init_route53(), exports_route53));
+            await listRegisteredDomains2();
+            registrarOk = true;
+            if (!opts.json)
+              console.log("\u2713 Registrar connection OK");
+          } catch (error) {
+            if (!isAwsAccessDenied(error))
+              throw error;
+            registrarOk = false;
+            notes.push("route53domains-listdomains-access-denied");
+            if (!opts.json)
+              console.log("\u2022 Route53 Domains registrar API is not available for these AWS credentials");
+          }
+        } else {
+          const reg = getRegistrarProvider(providerName);
+          await reg.listDomains();
+          registrarOk = true;
+          if (!opts.json)
+            console.log("\u2713 Registrar connection OK");
+        }
       }
       if (info.type === "dns" || info.type === "full") {
-        const dns = getDnsProvider(providerName);
-        await dns.getDnsRecords("__test_nonexistent_domain__.invalid");
-        dnsOk = true;
-        if (!opts.json)
-          console.log("\u2713 DNS connection OK");
+        if (providerName === "brandsight" && registrarOk) {
+          dnsOk = null;
+          notes.push("dns-not-probed-with-synthetic-invalid-domain");
+          if (!opts.json)
+            console.log("\u2022 DNS not probed with synthetic invalid domain");
+        } else {
+          const dns = getDnsProvider(providerName);
+          await dns.getDnsRecords("__test_nonexistent_domain__.invalid");
+          dnsOk = true;
+          if (!opts.json)
+            console.log("\u2713 DNS connection OK");
+        }
       }
       if (info.type === "marketplace") {
         if (providerName !== "sedo")
@@ -43440,7 +43897,8 @@ Registrar / DNS Providers:`);
           type: info.type,
           registrar_ok: registrarOk,
           dns_ok: dnsOk,
-          marketplace_ok: marketplaceOk
+          marketplace_ok: marketplaceOk,
+          ...notes.length > 0 ? { notes } : {}
         }, null, 2));
       }
     } catch (e3) {
@@ -43455,7 +43913,8 @@ Registrar / DNS Providers:`);
             registrar_ok: registrarOk,
             dns_ok: true,
             marketplace_ok: marketplaceOk,
-            note: "connection-ok-no-domains-yet"
+            note: "connection-ok-no-domains-yet",
+            ...notes.length > 0 ? { notes } : {}
           }, null, 2));
         } else {
           console.log("\u2713 Connection OK (no domains yet)");
@@ -43487,6 +43946,18 @@ init_domains();
 function registrarProviderNames() {
   return getAvailableProviders().filter((p3) => providerHasRegistrar(p3.name)).map((p3) => p3.name).join(", ");
 }
+function inventoryProviderNames() {
+  return getAvailableProviders().filter((p3) => providerHasInventory(p3.name)).map((p3) => p3.name).join(", ");
+}
+function requireInventoryProvider(name) {
+  const info = getProviderInfo(name);
+  if (!info) {
+    throw new Error(`Unknown provider: ${name}. Supported domain inventory providers: ${inventoryProviderNames()}`);
+  }
+  if (!providerHasInventory(name)) {
+    throw new Error(`${name} is a ${info.type} provider without domain inventory sync. Supported domain inventory providers: ${inventoryProviderNames()}`);
+  }
+}
 function requireRegistrarProvider(name) {
   const info = getProviderInfo(name);
   if (!info) {
@@ -43505,14 +43976,15 @@ function registerProviderCommands(program2) {
       console.log("Providers:");
       for (const p3 of providers) {
         const status = p3.configured ? "CONFIGURED" : "not configured";
-        console.log(`  ${p3.name} [${p3.type}]: ${status}`);
+        const capabilities = [p3.type, p3.inventory ? "inventory" : null].filter(Boolean).join(", ");
+        console.log(`  ${p3.name} [${capabilities}]: ${status}`);
         if (!p3.configured) {
           console.log(`    Accepted env: ${p3.envVars.join(", ")}`);
         }
       }
     }
   });
-  program2.command("sync").description("Sync domains from a registrar provider to local DB").option("--provider <provider>", "Provider name").option("--all", "Sync from all configured registrar providers").option("--json", "Output as JSON", false).action(async (opts) => {
+  program2.command("sync").description("Sync domains from a domain inventory provider to local DB").option("--provider <provider>", "Provider name").option("--all", "Sync from all configured domain inventory providers").option("--json", "Output as JSON", false).action(async (opts) => {
     if (opts.all) {
       try {
         const result = await syncAll({
@@ -43546,8 +44018,8 @@ function registerProviderCommands(program2) {
       process.exit(1);
     }
     try {
-      requireRegistrarProvider(provider);
-      const result = await getRegistrarProvider(provider).syncToLocalDb({
+      requireInventoryProvider(provider);
+      const result = await getDomainInventoryProvider(provider).syncToLocalDb({
         getDomainByName,
         createDomain,
         updateDomain