@hasna/domains 0.0.27 → 0.0.28

package/dist/server/index.js

@@ -0,0 +1,1384 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/server/index.ts
+import { ApiKeyStore } from "@hasna/contracts/auth";
+
+// src/generated/storage-kit/mode.ts
+var DEPRECATED_STORAGE_MODE_ALIASES = [
+  "remote",
+  "hybrid",
+  "self_hosted"
+];
+function normalizeStorageMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return { mode: "local", deprecatedAlias: null };
+  if (normalized === "cloud")
+    return { mode: "cloud", deprecatedAlias: null };
+  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
+    return { mode: "cloud", deprecatedAlias: normalized };
+  }
+  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+}
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function storageEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function resolveStorageMode(name, env = process.env) {
+  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
+  const dbHit = firstEnv(env, databaseUrlKeys);
+  const databaseUrlPresent = Boolean(dbHit);
+  const databaseUrlSource = dbHit ? dbHit.key : null;
+  const modeHit = firstEnv(env, modeKeys);
+  if (!modeHit) {
+    return {
+      mode: "local",
+      source: "default",
+      deprecatedAlias: null,
+      databaseUrlPresent,
+      databaseUrlSource,
+      warning: null
+    };
+  }
+  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
+  const warnings = [];
+  if (deprecatedAlias) {
+    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
+  }
+  if (mode === "cloud" && !databaseUrlPresent) {
+    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
+  }
+  if (modeHit.key !== modeKeys[0]) {
+    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
+  }
+  return {
+    mode,
+    source: modeHit.key,
+    deprecatedAlias,
+    databaseUrlPresent,
+    databaseUrlSource,
+    warning: warnings.length > 0 ? warnings.join(" ") : null
+  };
+}
+function resolveDatabaseUrl(name, env = process.env) {
+  const { databaseUrlKeys } = storageEnvKeys(name);
+  const hit = firstEnv(env, databaseUrlKeys);
+  return hit ? hit.value : null;
+}
+// src/generated/storage-kit/tls.ts
+import { readFileSync } from "fs";
+function sslModeFromConnectionString(connectionString) {
+  const queryStart = connectionString.indexOf("?");
+  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
+  const sslmode = params.get("sslmode")?.trim().toLowerCase();
+  if (sslmode) {
+    switch (sslmode) {
+      case "disable":
+      case "prefer":
+      case "require":
+      case "verify-ca":
+      case "verify-full":
+        return sslmode;
+      case "allow":
+        return "prefer";
+      default:
+        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+    }
+  }
+  const ssl = params.get("ssl")?.trim().toLowerCase();
+  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+    return "require";
+  return "disable";
+}
+function loadCaBundle(options) {
+  const env = options.env ?? process.env;
+  if (options.ca && options.ca.trim())
+    return options.ca;
+  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+  if (path && path.trim())
+    return readFileSync(path.trim(), "utf8");
+  return null;
+}
+function resolveTlsConfig(connectionString, options = {}) {
+  const mode = sslModeFromConnectionString(connectionString);
+  if (mode === "disable" || mode === "prefer") {
+    return;
+  }
+  const ca = loadCaBundle(options);
+  if (mode === "require") {
+    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  }
+  if (!ca) {
+    throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
+  }
+  return { rejectUnauthorized: true, ca };
+}
+// src/generated/storage-kit/query.ts
+function wrapExecutor(executor) {
+  return {
+    async query(sql, params) {
+      const result = await executor.query(sql, params);
+      return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+    },
+    async many(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows;
+    },
+    async get(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows[0] ?? null;
+    },
+    async one(sql, params) {
+      const result = await executor.query(sql, params);
+      if (result.rows.length !== 1) {
+        throw new Error(`Expected exactly one row, got ${result.rows.length}.`);
+      }
+      return result.rows[0];
+    },
+    async execute(sql, params) {
+      await executor.query(sql, params);
+    }
+  };
+}
+function createQueryClient(pool) {
+  const base = wrapExecutor(pool);
+  return {
+    ...base,
+    pool,
+    async transaction(fn) {
+      const client = await pool.connect();
+      try {
+        await client.query("BEGIN");
+        const result = await fn(wrapExecutor(client));
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await client.query("ROLLBACK");
+        } catch {}
+        throw error;
+      } finally {
+        client.release();
+      }
+    },
+    async close() {
+      await pool.end();
+    }
+  };
+}
+// src/generated/storage-kit/pool.ts
+import pg from "pg";
+function createPgPool(options) {
+  const ssl = resolveTlsConfig(options.connectionString, {
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    ...options.env !== undefined ? { env: options.env } : {}
+  });
+  const config = { connectionString: options.connectionString };
+  if (ssl !== undefined)
+    config.ssl = ssl;
+  if (options.max !== undefined)
+    config.max = options.max;
+  if (options.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = options.idleTimeoutMillis;
+  if (options.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
+  if (options.applicationName !== undefined)
+    config.application_name = options.applicationName;
+  return new pg.Pool(config);
+}
+function createCloudPoolFromEnv(appName, options = {}) {
+  const env = options.env ?? process.env;
+  const resolution = resolveStorageMode(appName, env);
+  if (resolution.mode !== "cloud") {
+    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
+  }
+  const connectionString = resolveDatabaseUrl(appName, env);
+  if (!connectionString) {
+    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+  }
+  const pool = createPgPool({
+    connectionString,
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    env,
+    ...options.max !== undefined ? { max: options.max } : {},
+    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
+    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
+    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+  });
+  return {
+    client: createQueryClient(pool),
+    connectionSource: resolution.databaseUrlSource ?? "unknown"
+  };
+}
+// src/generated/storage-kit/migrations.ts
+import { createHash } from "crypto";
+function checksumSql(sql) {
+  const normalized = sql.trim().replace(/\r\n/g, `
+`);
+  return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
+}
+function defineMigration(id, sql) {
+  return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
+}
+// src/generated/storage-kit/health.ts
+async function checkHealth(client) {
+  const start = Date.now();
+  try {
+    await client.get("SELECT 1 AS ok");
+    return { ok: true, latencyMs: Date.now() - start };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+// src/lib/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+var cachedVersion = null;
+function getPackageVersion() {
+  if (cachedVersion)
+    return cachedVersion;
+  try {
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const packageJsonPath = resolve(moduleDir, "../../package.json");
+    const pkg = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
+    cachedVersion = pkg.version ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+var USER_AGENT = `open-domains/${getPackageVersion()}`;
+
+// src/server/app.ts
+import { verifyApiKey } from "@hasna/contracts/auth";
+
+// src/db/domain-records.ts
+var DOMAIN_STATUSES = [
+  "discovered",
+  "researching",
+  "offered",
+  "negotiating",
+  "purchased",
+  "active",
+  "not_available",
+  "premium_only",
+  "declined",
+  "expired",
+  "transferring",
+  "redemption"
+];
+var DOMAIN_OFFER_STATUSES = ["pending", "accepted", "rejected", "countered"];
+
+// src/server/repo.ts
+function parseJson(value, fallback) {
+  if (value === null || value === undefined)
+    return fallback;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+function rowToDomain(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    registrar: row.registrar,
+    status: row.status,
+    registered_at: row.registered_at,
+    expires_at: row.expires_at,
+    auto_renew: Boolean(row.auto_renew),
+    is_premium: Boolean(row.is_premium),
+    premium_price: row.premium_price,
+    standard_price: row.standard_price,
+    purchase_price: row.purchase_price,
+    purchase_date: row.purchase_date,
+    nameservers: parseJson(row.nameservers, []),
+    whois: parseJson(row.whois, {}),
+    ssl_expires_at: row.ssl_expires_at,
+    ssl_issuer: row.ssl_issuer,
+    notes: row.notes,
+    metadata: parseJson(row.metadata, {}),
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function rowToDnsRecord(row) {
+  return {
+    id: row.id,
+    domain_id: row.domain_id,
+    type: row.type,
+    name: row.name,
+    value: row.value,
+    ttl: row.ttl,
+    priority: row.priority,
+    created_at: row.created_at
+  };
+}
+
+class HttpError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "HttpError";
+  }
+}
+var DNS_TYPES = ["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV"];
+
+class DomainsRepo {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async createDomain(input) {
+    if (!input || typeof input.name !== "string" || input.name.trim() === "") {
+      throw new HttpError(400, "domain 'name' is required");
+    }
+    const status = input.status ?? "active";
+    if (!DOMAIN_STATUSES.includes(status)) {
+      throw new HttpError(400, `invalid status '${status}'`);
+    }
+    const id = crypto.randomUUID();
+    const nowIso = new Date().toISOString();
+    try {
+      const row = await this.db.get(`INSERT INTO domains (
+           id, name, registrar, status, registered_at, expires_at, auto_renew,
+           is_premium, premium_price, standard_price, purchase_price, purchase_date,
+           nameservers, whois, ssl_expires_at, ssl_issuer, notes, metadata,
+           created_at, updated_at
+         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20)
+         RETURNING *`, [
+        id,
+        input.name.trim(),
+        input.registrar ?? null,
+        status,
+        input.registered_at ?? null,
+        input.expires_at ?? null,
+        input.auto_renew !== undefined ? input.auto_renew : true,
+        input.is_premium ?? false,
+        input.premium_price ?? null,
+        input.standard_price ?? null,
+        input.purchase_price ?? null,
+        input.purchase_date ?? null,
+        JSON.stringify(input.nameservers ?? []),
+        JSON.stringify(input.whois ?? {}),
+        input.ssl_expires_at ?? null,
+        input.ssl_issuer ?? null,
+        input.notes ?? null,
+        JSON.stringify(input.metadata ?? {}),
+        nowIso,
+        nowIso
+      ]);
+      return rowToDomain(row);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (/duplicate key|unique constraint/i.test(msg)) {
+        throw new HttpError(409, `domain '${input.name}' already exists`);
+      }
+      throw e;
+    }
+  }
+  async getDomain(id) {
+    const row = await this.db.get("SELECT * FROM domains WHERE id = $1", [id]);
+    return row ? rowToDomain(row) : null;
+  }
+  async getDomainByName(name) {
+    const row = await this.db.get("SELECT * FROM domains WHERE name = $1", [name]);
+    return row ? rowToDomain(row) : null;
+  }
+  async listDomains(opts) {
+    const clauses = [];
+    const params = [];
+    if (opts.search) {
+      params.push(`%${opts.search}%`);
+      clauses.push(`name ILIKE $${params.length}`);
+    }
+    if (opts.status) {
+      if (!DOMAIN_STATUSES.includes(opts.status)) {
+        throw new HttpError(400, `invalid status filter '${opts.status}'`);
+      }
+      params.push(opts.status);
+      clauses.push(`status = $${params.length}`);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const limit = Math.min(Math.max(opts.limit ?? 100, 1), 1000);
+    const offset = Math.max(opts.offset ?? 0, 0);
+    params.push(limit, offset);
+    const rows = await this.db.many(`SELECT * FROM domains ${where} ORDER BY name ASC LIMIT $${params.length - 1} OFFSET $${params.length}`, params);
+    return rows.map(rowToDomain);
+  }
+  async updateDomain(id, patch) {
+    const existing = await this.getDomain(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    const p = patch;
+    if ("name" in p)
+      setCol("name", p["name"]);
+    if ("registrar" in p)
+      setCol("registrar", p["registrar"] ?? null);
+    if ("status" in p) {
+      if (!DOMAIN_STATUSES.includes(p["status"])) {
+        throw new HttpError(400, `invalid status '${String(p["status"])}'`);
+      }
+      setCol("status", p["status"]);
+    }
+    if ("registered_at" in p)
+      setCol("registered_at", p["registered_at"] ?? null);
+    if ("expires_at" in p)
+      setCol("expires_at", p["expires_at"] ?? null);
+    if ("auto_renew" in p)
+      setCol("auto_renew", Boolean(p["auto_renew"]));
+    if ("is_premium" in p)
+      setCol("is_premium", Boolean(p["is_premium"]));
+    if ("premium_price" in p)
+      setCol("premium_price", p["premium_price"] ?? null);
+    if ("standard_price" in p)
+      setCol("standard_price", p["standard_price"] ?? null);
+    if ("purchase_price" in p)
+      setCol("purchase_price", p["purchase_price"] ?? null);
+    if ("purchase_date" in p)
+      setCol("purchase_date", p["purchase_date"] ?? null);
+    if ("nameservers" in p)
+      setCol("nameservers", JSON.stringify(p["nameservers"] ?? []));
+    if ("whois" in p)
+      setCol("whois", JSON.stringify(p["whois"] ?? {}));
+    if ("ssl_expires_at" in p)
+      setCol("ssl_expires_at", p["ssl_expires_at"] ?? null);
+    if ("ssl_issuer" in p)
+      setCol("ssl_issuer", p["ssl_issuer"] ?? null);
+    if ("notes" in p)
+      setCol("notes", p["notes"] ?? null);
+    if ("metadata" in p)
+      setCol("metadata", JSON.stringify(p["metadata"] ?? {}));
+    if (sets.length === 0)
+      return existing;
+    setCol("updated_at", new Date().toISOString());
+    params.push(id);
+    const row = await this.db.get(`UPDATE domains SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? rowToDomain(row) : null;
+  }
+  async deleteDomain(id) {
+    const result = await this.db.query("DELETE FROM domains WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async countDomains() {
+    const row = await this.db.get("SELECT count(*)::text AS n FROM domains");
+    return row ? parseInt(row.n, 10) : 0;
+  }
+  async getStats() {
+    const row = await this.db.get(`SELECT
+         count(*)::text AS total,
+         count(*) FILTER (WHERE status = 'active')::text AS active,
+         count(*) FILTER (WHERE status = 'expired')::text AS expired,
+         count(*) FILTER (WHERE status = 'transferring')::text AS transferring,
+         count(*) FILTER (WHERE status = 'redemption')::text AS redemption,
+         count(*) FILTER (WHERE auto_renew = true)::text AS auto_renew_enabled,
+         count(*) FILTER (
+           WHERE NULLIF(expires_at, '')::timestamptz
+             BETWEEN now() AND now() + interval '30 days'
+         )::text AS expiring_30_days,
+         count(*) FILTER (
+           WHERE NULLIF(ssl_expires_at, '')::timestamptz
+             BETWEEN now() AND now() + interval '30 days'
+         )::text AS ssl_expiring_30_days
+       FROM domains`);
+    const n = (k) => row && row[k] ? parseInt(row[k], 10) : 0;
+    return {
+      total: n("total"),
+      active: n("active"),
+      expired: n("expired"),
+      transferring: n("transferring"),
+      redemption: n("redemption"),
+      auto_renew_enabled: n("auto_renew_enabled"),
+      expiring_30_days: n("expiring_30_days"),
+      ssl_expiring_30_days: n("ssl_expiring_30_days")
+    };
+  }
+  async listDnsRecords(domainId) {
+    const rows = await this.db.many("SELECT * FROM dns_records WHERE domain_id = $1 ORDER BY type, name", [domainId]);
+    return rows.map(rowToDnsRecord);
+  }
+  async createDnsRecord(domainId, input) {
+    if (!input || typeof input.type !== "string" || !DNS_TYPES.includes(input.type)) {
+      throw new HttpError(400, `dns record 'type' must be one of ${DNS_TYPES.join(", ")}`);
+    }
+    if (typeof input.name !== "string" || typeof input.value !== "string") {
+      throw new HttpError(400, "dns record 'name' and 'value' are required");
+    }
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO dns_records (id, domain_id, type, name, value, ttl, priority, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8) RETURNING *`, [
+      id,
+      domainId,
+      input.type,
+      input.name,
+      input.value,
+      input.ttl ?? 3600,
+      input.priority ?? null,
+      new Date().toISOString()
+    ]);
+    return rowToDnsRecord(row);
+  }
+  async getDnsRecord(id) {
+    const row = await this.db.get("SELECT * FROM dns_records WHERE id = $1", [id]);
+    return row ? rowToDnsRecord(row) : null;
+  }
+  async deleteDnsRecord(id) {
+    const result = await this.db.query("DELETE FROM dns_records WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listOffers(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_offers WHERE domain_id = $1 ORDER BY created_at DESC", [domainId]);
+    return rows;
+  }
+  async createOffer(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const status = input.status ?? "pending";
+    if (!DOMAIN_OFFER_STATUSES.includes(status)) {
+      throw new HttpError(400, `invalid offer status '${status}'`);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_offers (id, domain_id, our_offer, their_ask, status, notes, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7) RETURNING *`, [
+      id,
+      domainId,
+      input.our_offer ?? null,
+      input.their_ask ?? null,
+      status,
+      input.notes ?? null,
+      new Date().toISOString()
+    ]);
+    return row;
+  }
+}
+
+// src/server/migrations.ts
+import { apiKeyMigrations } from "@hasna/contracts/auth";
+
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS domains (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE,
+    registrar TEXT,
+    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('discovered', 'researching', 'offered', 'negotiating', 'purchased', 'active', 'not_available', 'premium_only', 'declined', 'expired', 'transferring', 'redemption')),
+    registered_at TEXT,
+    expires_at TEXT,
+    auto_renew BOOLEAN NOT NULL DEFAULT TRUE,
+    is_premium BOOLEAN NOT NULL DEFAULT FALSE,
+    premium_price DOUBLE PRECISION,
+    standard_price DOUBLE PRECISION,
+    purchase_price DOUBLE PRECISION,
+    purchase_date TEXT,
+    nameservers TEXT NOT NULL DEFAULT '[]',
+    whois TEXT NOT NULL DEFAULT '{}',
+    ssl_expires_at TEXT,
+    ssl_issuer TEXT,
+    notes TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS dns_records (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    type TEXT NOT NULL CHECK (type IN ('A', 'AAAA', 'CNAME', 'MX', 'TXT', 'NS', 'SRV')),
+    name TEXT NOT NULL,
+    value TEXT NOT NULL,
+    ttl INTEGER NOT NULL DEFAULT 3600,
+    priority INTEGER,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS alerts (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    type TEXT NOT NULL CHECK (type IN ('expiry', 'ssl_expiry', 'dns_change')),
+    trigger_days_before INTEGER,
+    sent_at TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_offers (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    our_offer DOUBLE PRECISION,
+    their_ask DOUBLE PRECISION,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'accepted', 'rejected', 'countered')),
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    owner_contact_id TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_emails (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    email_id TEXT NOT NULL,
+    thread_id TEXT,
+    type TEXT NOT NULL CHECK (type IN ('inquiry', 'offer', 'counter_offer', 'confirmation', 'renewal_notice', 'transfer')),
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    UNIQUE(domain_id, email_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_owners (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    contact_id TEXT,
+    owner_name TEXT,
+    owner_email TEXT,
+    owner_phone TEXT,
+    owner_organization TEXT,
+    source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('whois', 'manual', 'brandsight', 'import')),
+    verified BOOLEAN NOT NULL DEFAULT FALSE,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_history (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    snapshot_type TEXT NOT NULL CHECK (snapshot_type IN ('whois', 'rdap', 'dns', 'ssl', 'reputation', 'exa_research', 'purchase', 'renewal')),
+    raw_data TEXT NOT NULL DEFAULT '{}',
+    registrant_name TEXT,
+    registrant_email TEXT,
+    registrant_org TEXT,
+    nameservers TEXT NOT NULL DEFAULT '[]',
+    registrar TEXT,
+    status TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_reputation (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    is_blacklisted BOOLEAN NOT NULL DEFAULT FALSE,
+    blacklist_sources TEXT NOT NULL DEFAULT '[]',
+    threat_score INTEGER,
+    spam_score INTEGER,
+    malware_detected BOOLEAN NOT NULL DEFAULT FALSE,
+    phishing_detected BOOLEAN NOT NULL DEFAULT FALSE,
+    reputation_sources TEXT NOT NULL DEFAULT '[]',
+    last_checked_at TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_name ON domains(name)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_registrar ON domains(registrar)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_status ON domains(status)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_expires_at ON domains(expires_at)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_is_premium ON domains(is_premium)`,
+  `CREATE INDEX IF NOT EXISTS idx_dns_records_domain ON dns_records(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_dns_records_type ON dns_records(type)`,
+  `CREATE INDEX IF NOT EXISTS idx_alerts_domain ON alerts(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_alerts_type ON alerts(type)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_offers_domain ON domain_offers(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_offers_owner ON domain_offers(owner_contact_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_emails_domain ON domain_emails(domain_id)`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_domain_emails_unique ON domain_emails(domain_id, email_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_domain ON domain_owners(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_contact ON domain_owners(contact_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_email ON domain_owners(owner_email)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_domain ON domain_history(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_type ON domain_history(snapshot_type)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_created ON domain_history(created_at)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_email ON domain_history(registrant_email)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_domain ON domain_reputation(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_blacklisted ON domain_reputation(is_blacklisted)`
+];
+
+// src/server/migrations.ts
+function buildMigrations() {
+  const migrations2 = [];
+  PG_MIGRATIONS.forEach((sql, i) => {
+    const id = `domains_${String(i + 1).padStart(4, "0")}`;
+    migrations2.push(defineMigration(id, sql));
+  });
+  for (const m of apiKeyMigrations("api_keys")) {
+    migrations2.push(defineMigration(m.id, m.sql));
+  }
+  return migrations2;
+}
+
+// src/server/openapi.ts
+var ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+function jsonResponse(schema, description) {
+  return { description, content: { "application/json": { schema } } };
+}
+function jsonBody(schema) {
+  return { required: true, content: { "application/json": { schema } } };
+}
+function buildOpenApiSpec(version) {
+  const idParam = {
+    name: "id",
+    in: "path",
+    required: true,
+    schema: { type: "string" },
+    description: "Resource identifier (UUID)."
+  };
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "domains",
+      version,
+      description: "Domain portfolio, registrar, marketplace, and DNS management HTTP API (self_hosted). API-key authenticated."
+    },
+    security: [{ apiKey: [] }],
+    paths: {
+      "/health": {
+        get: {
+          operationId: "getHealth",
+          summary: "Liveness probe (DB reachable).",
+          responses: { "200": jsonResponse(ref("HealthResponse"), "Service healthy") }
+        }
+      },
+      "/ready": {
+        get: {
+          operationId: "getReady",
+          summary: "Readiness probe (DB reachable and schema migrated).",
+          responses: {
+            "200": jsonResponse(ref("ReadyResponse"), "Service ready"),
+            "503": jsonResponse(ref("ReadyResponse"), "Not ready")
+          }
+        }
+      },
+      "/version": {
+        get: {
+          operationId: "getVersion",
+          summary: "Service version and mode.",
+          responses: { "200": jsonResponse(ref("VersionResponse"), "Version info") }
+        }
+      },
+      "/v1/domains": {
+        get: {
+          operationId: "listDomains",
+          summary: "List domains.",
+          parameters: [
+            { name: "search", in: "query", required: false, schema: { type: "string" } },
+            { name: "status", in: "query", required: false, schema: { type: "string" } },
+            { name: "limit", in: "query", required: false, schema: { type: "integer" } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer" } }
+          ],
+          responses: { "200": jsonResponse(ref("DomainList"), "A page of domains") }
+        },
+        post: {
+          operationId: "createDomain",
+          summary: "Create a domain.",
+          requestBody: jsonBody(ref("CreateDomainInput")),
+          responses: {
+            "201": jsonResponse(ref("Domain"), "Created"),
+            "400": jsonResponse(ref("Error"), "Invalid input"),
+            "409": jsonResponse(ref("Error"), "Already exists")
+          }
+        }
+      },
+      "/v1/domains/{id}": {
+        get: {
+          operationId: "getDomain",
+          summary: "Get a domain by id.",
+          parameters: [idParam],
+          responses: {
+            "200": jsonResponse(ref("Domain"), "The domain"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        patch: {
+          operationId: "updateDomain",
+          summary: "Update a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("UpdateDomainInput")),
+          responses: {
+            "200": jsonResponse(ref("Domain"), "Updated"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        delete: {
+          operationId: "deleteDomain",
+          summary: "Delete a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DeleteResult"), "Deleted") }
+        }
+      },
+      "/v1/stats": {
+        get: {
+          operationId: "getDomainStats",
+          summary: "Portfolio statistics.",
+          responses: { "200": jsonResponse(ref("DomainStats"), "Stats") }
+        }
+      },
+      "/v1/domains/{id}/dns": {
+        get: {
+          operationId: "listDnsRecords",
+          summary: "List DNS records for a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DnsRecordList"), "DNS records") }
+        },
+        post: {
+          operationId: "createDnsRecord",
+          summary: "Create a DNS record for a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("CreateDnsRecordInput")),
+          responses: {
+            "201": jsonResponse(ref("DnsRecord"), "Created"),
+            "404": jsonResponse(ref("Error"), "Domain not found")
+          }
+        }
+      },
+      "/v1/dns/{id}": {
+        get: {
+          operationId: "getDnsRecord",
+          summary: "Get a DNS record by id.",
+          parameters: [idParam],
+          responses: {
+            "200": jsonResponse(ref("DnsRecord"), "The record"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        delete: {
+          operationId: "deleteDnsRecord",
+          summary: "Delete a DNS record.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DeleteResult"), "Deleted") }
+        }
+      },
+      "/v1/domains/{id}/offers": {
+        get: {
+          operationId: "listOffers",
+          summary: "List marketplace offers for a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("OfferList"), "Offers") }
+        },
+        post: {
+          operationId: "createOffer",
+          summary: "Create a marketplace offer for a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("CreateOfferInput")),
+          responses: {
+            "201": jsonResponse(ref("DomainOffer"), "Created"),
+            "404": jsonResponse(ref("Error"), "Domain not found")
+          }
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        apiKey: { type: "apiKey", in: "header", name: "x-api-key" }
+      },
+      schemas: {
+        Error: {
+          type: "object",
+          properties: { error: { type: "string" }, reason: { type: "string" } },
+          required: ["error"]
+        },
+        HealthResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" },
+            latencyMs: { type: "number" }
+          },
+          required: ["status", "version", "mode"]
+        },
+        ReadyResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" },
+            pendingMigrations: { type: "array", items: { type: "string" } }
+          },
+          required: ["status", "version", "mode"]
+        },
+        VersionResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" }
+          },
+          required: ["status", "version", "mode"]
+        },
+        DeleteResult: {
+          type: "object",
+          properties: { id: { type: "string" }, deleted: { type: "boolean" } },
+          required: ["id", "deleted"]
+        },
+        Domain: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            name: { type: "string" },
+            registrar: { type: "string", nullable: true },
+            status: { type: "string" },
+            registered_at: { type: "string", nullable: true },
+            expires_at: { type: "string", nullable: true },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number", nullable: true },
+            standard_price: { type: "number", nullable: true },
+            purchase_price: { type: "number", nullable: true },
+            purchase_date: { type: "string", nullable: true },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string", nullable: true },
+            ssl_issuer: { type: "string", nullable: true },
+            notes: { type: "string", nullable: true },
+            metadata: { type: "object", additionalProperties: true },
+            created_at: { type: "string" },
+            updated_at: { type: "string" }
+          },
+          required: ["id", "name", "status", "auto_renew", "is_premium", "created_at", "updated_at"]
+        },
+        DomainList: {
+          type: "object",
+          properties: {
+            domains: { type: "array", items: ref("Domain") },
+            count: { type: "integer" }
+          },
+          required: ["domains", "count"]
+        },
+        CreateDomainInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            registrar: { type: "string" },
+            status: { type: "string" },
+            registered_at: { type: "string" },
+            expires_at: { type: "string" },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number" },
+            standard_price: { type: "number" },
+            purchase_price: { type: "number" },
+            purchase_date: { type: "string" },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string" },
+            ssl_issuer: { type: "string" },
+            notes: { type: "string" },
+            metadata: { type: "object", additionalProperties: true }
+          },
+          required: ["name"]
+        },
+        UpdateDomainInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            registrar: { type: "string", nullable: true },
+            status: { type: "string" },
+            registered_at: { type: "string", nullable: true },
+            expires_at: { type: "string", nullable: true },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number", nullable: true },
+            standard_price: { type: "number", nullable: true },
+            purchase_price: { type: "number", nullable: true },
+            purchase_date: { type: "string", nullable: true },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string", nullable: true },
+            ssl_issuer: { type: "string", nullable: true },
+            notes: { type: "string", nullable: true },
+            metadata: { type: "object", additionalProperties: true }
+          }
+        },
+        DnsRecord: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            domain_id: { type: "string" },
+            type: { type: "string" },
+            name: { type: "string" },
+            value: { type: "string" },
+            ttl: { type: "integer" },
+            priority: { type: "integer", nullable: true },
+            created_at: { type: "string" }
+          },
+          required: ["id", "domain_id", "type", "name", "value", "ttl", "created_at"]
+        },
+        DnsRecordList: {
+          type: "object",
+          properties: {
+            records: { type: "array", items: ref("DnsRecord") },
+            count: { type: "integer" }
+          },
+          required: ["records", "count"]
+        },
+        CreateDnsRecordInput: {
+          type: "object",
+          properties: {
+            type: { type: "string", enum: ["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV"] },
+            name: { type: "string" },
+            value: { type: "string" },
+            ttl: { type: "integer" },
+            priority: { type: "integer" }
+          },
+          required: ["type", "name", "value"]
+        },
+        DomainOffer: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            domain_id: { type: "string" },
+            our_offer: { type: "number", nullable: true },
+            their_ask: { type: "number", nullable: true },
+            status: { type: "string" },
+            notes: { type: "string", nullable: true },
+            created_at: { type: "string" }
+          },
+          required: ["id", "domain_id", "status", "created_at"]
+        },
+        OfferList: {
+          type: "object",
+          properties: {
+            offers: { type: "array", items: ref("DomainOffer") },
+            count: { type: "integer" }
+          },
+          required: ["offers", "count"]
+        },
+        CreateOfferInput: {
+          type: "object",
+          properties: {
+            our_offer: { type: "number" },
+            their_ask: { type: "number" },
+            status: { type: "string" },
+            notes: { type: "string" }
+          }
+        },
+        DomainStats: {
+          type: "object",
+          properties: {
+            total: { type: "integer" },
+            active: { type: "integer" },
+            expired: { type: "integer" },
+            transferring: { type: "integer" },
+            redemption: { type: "integer" },
+            auto_renew_enabled: { type: "integer" },
+            expiring_30_days: { type: "integer" },
+            ssl_expiring_30_days: { type: "integer" }
+          },
+          required: ["total"]
+        }
+      }
+    }
+  };
+}
+
+// src/server/app.ts
+async function readReadiness(db, knownIds) {
+  const start = Date.now();
+  try {
+    const rows = await db.many("SELECT id FROM schema_migrations");
+    const applied = new Set(rows.map((r) => r.id));
+    const pending = knownIds.filter((id) => !applied.has(id));
+    return { ok: pending.length === 0, pendingMigrations: pending, latencyMs: Date.now() - start };
+  } catch (e) {
+    return {
+      ok: false,
+      pendingMigrations: knownIds,
+      latencyMs: Date.now() - start,
+      error: e instanceof Error ? e.message : String(e)
+    };
+  }
+}
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...SECURITY_HEADERS }
+  });
+}
+function createServeApp(options) {
+  const { db, version } = options;
+  const mode2 = options.mode ?? "self_hosted";
+  const repo = new DomainsRepo(db);
+  const migrationIds = buildMigrations().map((m) => m.id);
+  const spec = buildOpenApiSpec(version);
+  const verifier = verifyApiKey({
+    app: "domains",
+    signingSecret: options.signingSecret,
+    ...options.isRevoked ? { isRevoked: options.isRevoked } : {},
+    ...options.audit ? { audit: options.audit } : {}
+  });
+  async function readBody(req) {
+    const text = await req.text();
+    if (!text)
+      return {};
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new HttpError(400, "invalid JSON body");
+    }
+  }
+  async function auth(req, path, scopes) {
+    const decision = await verifier.authenticate(req.headers, {
+      method: req.method,
+      path,
+      requiredScopes: scopes
+    });
+    if (decision.ok)
+      return null;
+    return json({ error: decision.message, reason: decision.reason }, decision.status);
+  }
+  async function handle(req) {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    const method = req.method;
+    try {
+      if (method === "GET" && path === "/health") {
+        const h = await checkHealth(db);
+        return json({ status: h.ok ? "ok" : "error", version, mode: mode2, latencyMs: h.latencyMs, ...h.error ? { error: h.error } : {} }, h.ok ? 200 : 503);
+      }
+      if (method === "GET" && path === "/ready") {
+        const r = await readReadiness(db, migrationIds);
+        return json({
+          status: r.ok ? "ok" : "not_ready",
+          version,
+          mode: mode2,
+          pendingMigrations: r.pendingMigrations,
+          ...r.error ? { error: r.error } : {}
+        }, r.ok ? 200 : 503);
+      }
+      if (method === "GET" && (path === "/version" || path === "/v1/version")) {
+        return json({ status: "ok", version, mode: mode2 });
+      }
+      if (method === "GET" && (path === "/openapi.json" || path === "/v1/openapi.json")) {
+        return json(spec);
+      }
+      if (path === "/v1/domains") {
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const domains = await repo.listDomains({
+            search: url.searchParams.get("search") ?? undefined,
+            status: url.searchParams.get("status") ?? undefined,
+            limit: url.searchParams.get("limit") ? Number(url.searchParams.get("limit")) : undefined,
+            offset: url.searchParams.get("offset") ? Number(url.searchParams.get("offset")) : undefined
+          });
+          return json({ domains, count: domains.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const domain = await repo.createDomain(await readBody(req));
+          return json(domain, 201);
+        }
+      }
+      if (method === "GET" && path === "/v1/stats") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        return json(await repo.getStats());
+      }
+      let m = path.match(/^\/v1\/domains\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const domain = await repo.getDomain(id);
+          return domain ? json(domain) : json({ error: "domain not found" }, 404);
+        }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const domain = await repo.updateDomain(id, await readBody(req));
+          return domain ? json(domain) : json({ error: "domain not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const deleted = await repo.deleteDomain(id);
+          return json({ id, deleted });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/dns$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const records = await repo.listDnsRecords(id);
+          return json({ records, count: records.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const record = await repo.createDnsRecord(id, await readBody(req));
+          return json(record, 201);
+        }
+      }
+      m = path.match(/^\/v1\/dns\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const record = await repo.getDnsRecord(id);
+          return record ? json(record) : json({ error: "dns record not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const deleted = await repo.deleteDnsRecord(id);
+          return json({ id, deleted });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/offers$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const offers = await repo.listOffers(id);
+          return json({ offers, count: offers.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const offer = await repo.createOffer(id, await readBody(req));
+          return json(offer, 201);
+        }
+      }
+      return json({ error: "Not found" }, 404);
+    } catch (e) {
+      if (e instanceof HttpError)
+        return json({ error: e.message }, e.status);
+      const message = e instanceof Error ? e.message : String(e);
+      return json({ error: message }, 500);
+    }
+  }
+  return { handle };
+}
+
+// src/server/index.ts
+var DEFAULT_PORT = 8080;
+var SIGNING_KEY_ENVS = [
+  "HASNA_DOMAINS_API_SIGNING_KEY",
+  "HASNA_API_SIGNING_KEY",
+  "API_KEY_SIGNING_SECRET"
+];
+function normalizeEnv(env = process.env) {
+  if (!env["HASNA_DOMAINS_DATABASE_URL"] && env["DATABASE_URL"]) {
+    env["HASNA_DOMAINS_DATABASE_URL"] = env["DATABASE_URL"];
+  }
+  if (!env["HASNA_DOMAINS_STORAGE_MODE"] && env["HASNA_DOMAINS_DATABASE_URL"]) {
+    env["HASNA_DOMAINS_STORAGE_MODE"] = "cloud";
+  }
+}
+function resolveSigningSecret(env = process.env) {
+  for (const key of SIGNING_KEY_ENVS) {
+    const v = env[key]?.trim();
+    if (v)
+      return v;
+  }
+  throw new Error(`Missing API-key signing secret. Set ${SIGNING_KEY_ENVS[0]} (or ${SIGNING_KEY_ENVS[2]}).`);
+}
+function parseArg(name, fallback) {
+  const eq = process.argv.find((a) => a.startsWith(`${name}=`));
+  if (eq)
+    return eq.split("=")[1];
+  const idx = process.argv.indexOf(name);
+  if (idx >= 0 && process.argv[idx + 1])
+    return process.argv[idx + 1];
+  return fallback;
+}
+async function main() {
+  if (process.argv.includes("--version") || process.argv.includes("-V")) {
+    console.log(getPackageVersion());
+    return;
+  }
+  normalizeEnv();
+  const version = getPackageVersion();
+  const signingSecret = resolveSigningSecret();
+  const { client, connectionSource } = createCloudPoolFromEnv("domains", {
+    applicationName: "domains-serve",
+    max: 5
+  });
+  const store = new ApiKeyStore(client);
+  const app = createServeApp({
+    db: client,
+    signingSecret,
+    version,
+    mode: process.env["HASNA_APP_MODE"] ?? "self_hosted",
+    isRevoked: store.isRevoked,
+    audit: (e) => {
+      if (e.outcome === "deny") {
+        console.error(JSON.stringify({ level: "warn", event: "api_auth_deny", ...e }));
+      }
+    }
+  });
+  const port = Number(parseArg("--port", process.env["PORT"]) ?? DEFAULT_PORT) || DEFAULT_PORT;
+  const host = parseArg("--host", process.env["HOST"]) ?? "0.0.0.0";
+  Bun.serve({
+    port,
+    hostname: host,
+    idleTimeout: 30,
+    fetch: (req) => app.handle(req)
+  });
+  console.log(JSON.stringify({
+    level: "info",
+    event: "domains_serve_started",
+    version,
+    port,
+    host,
+    dsnSource: connectionSource
+  }));
+}
+if (import.meta.main) {
+  main().catch((err) => {
+    console.error(JSON.stringify({ level: "error", event: "domains_serve_fatal", error: err instanceof Error ? err.message : String(err) }));
+    process.exit(1);
+  });
+}
+export {
+  resolveSigningSecret,
+  normalizeEnv,
+  SIGNING_KEY_ENVS
+};