@hasna/domains 0.0.27 → 0.0.30

package/dist/server/index.js

@@ -0,0 +1,2388 @@
+#!/usr/bin/env bun
+// @bun
+
+// node_modules/.pnpm/@hasna+contracts@0.5.2/node_modules/@hasna/contracts/dist/auth/index.js
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var API_KEY_TOKEN_VERSION = 1;
+var API_KEY_NAMESPACE = "hasna";
+var TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var DEFAULT_API_KEY_TTL_SECONDS = 90 * 24 * 60 * 60;
+function toBuffer(secret) {
+  return typeof secret === "string" ? Buffer.from(secret, "utf8") : secret;
+}
+function hmac(signingSecret, message) {
+  return createHmac("sha256", toBuffer(signingSecret)).update(message, "utf8").digest();
+}
+function apiKeyPrefix(app) {
+  return `${API_KEY_NAMESPACE}_${app}_`;
+}
+function parseApiKey(token) {
+  if (typeof token !== "string")
+    return null;
+  const match = TOKEN_PATTERN.exec(token);
+  if (!match)
+    return null;
+  const [, app, body, sig] = match;
+  if (!app || !body || !sig)
+    return null;
+  let claims;
+  try {
+    claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || !Array.isArray(claims.scopes)) {
+    return null;
+  }
+  return { app, body, sig, claims };
+}
+function verifyApiKeyToken(token, options) {
+  const parsed = parseApiKey(token);
+  if (!parsed) {
+    return { ok: false, reason: "malformed", message: "Token is malformed." };
+  }
+  const { app, body, sig, claims } = parsed;
+  if (claims.v !== API_KEY_TOKEN_VERSION) {
+    return { ok: false, reason: "unsupported_version", message: `Unsupported token version ${claims.v}.` };
+  }
+  if (claims.app !== app) {
+    return { ok: false, reason: "app_mismatch", message: "Token prefix app does not match claims." };
+  }
+  if (options.expectedApp !== undefined && app !== options.expectedApp) {
+    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${options.expectedApp}'.` };
+  }
+  const expected = hmac(options.signingSecret, `${apiKeyPrefix(app)}${body}`);
+  let provided;
+  try {
+    provided = Buffer.from(sig, "base64url");
+  } catch {
+    return { ok: false, reason: "bad_signature", message: "Signature is not valid base64url." };
+  }
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+    return { ok: false, reason: "bad_signature", message: "Signature verification failed." };
+  }
+  const now = Math.floor((options.nowMs ?? Date.now()) / 1000);
+  const leeway = options.leewaySeconds ?? 0;
+  if (typeof claims.iat === "number" && now + leeway < claims.iat) {
+    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid." };
+  }
+  if (claims.exp !== null && typeof claims.exp === "number" && now - leeway >= claims.exp) {
+    return { ok: false, reason: "expired", message: "Token has expired." };
+  }
+  if (options.requiredScopes && options.requiredScopes.length > 0) {
+    const granted = claims.scopes;
+    const satisfies = (required) => granted.some((g) => {
+      if (g === "*")
+        return true;
+      const gi = g.indexOf(":");
+      const ri = required.indexOf(":");
+      if (gi < 0 || ri < 0)
+        return false;
+      const gApp = g.slice(0, gi);
+      const gAction = g.slice(gi + 1);
+      const rApp = required.slice(0, ri);
+      const rAction = required.slice(ri + 1);
+      return (gApp === "*" || gApp === rApp) && (gAction === "*" || gAction === rAction);
+    });
+    for (const required of options.requiredScopes) {
+      if (!satisfies(required)) {
+        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.` };
+      }
+    }
+  }
+  return { ok: true, claims, kid: claims.kid, app };
+}
+var DEFAULT_API_KEYS_TABLE = "api_keys";
+function createTableSql(table) {
+  return `CREATE TABLE IF NOT EXISTS ${table} (
+    kid TEXT PRIMARY KEY,
+    app TEXT NOT NULL,
+    agent TEXT,
+    scopes JSONB NOT NULL,
+    token_hash TEXT NOT NULL UNIQUE,
+    issued_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ,
+    revoked_reason TEXT,
+    last_used_at TIMESTAMPTZ,
+    created_by TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+  )`;
+}
+function apiKeyMigrations(table = DEFAULT_API_KEYS_TABLE) {
+  return [
+    { id: `hasna_auth_0001_${table}`, sql: createTableSql(table) },
+    {
+      id: `hasna_auth_0002_${table}_indexes`,
+      sql: `CREATE INDEX IF NOT EXISTS ${table}_app_idx ON ${table} (app);
+            CREATE INDEX IF NOT EXISTS ${table}_token_hash_idx ON ${table} (token_hash);`
+    }
+  ];
+}
+function toIso(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (value instanceof Date)
+    return value.toISOString();
+  return new Date(String(value)).toISOString();
+}
+function parseScopes(value) {
+  if (Array.isArray(value))
+    return value.map((v) => String(v));
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return Array.isArray(parsed) ? parsed.map((v) => String(v)) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+function rowToRecord(row) {
+  return {
+    kid: String(row.kid),
+    app: String(row.app),
+    agent: row.agent === null || row.agent === undefined ? null : String(row.agent),
+    scopes: parseScopes(row.scopes),
+    tokenHash: String(row.token_hash),
+    issuedAt: toIso(row.issued_at) ?? new Date(0).toISOString(),
+    expiresAt: toIso(row.expires_at),
+    revokedAt: toIso(row.revoked_at),
+    revokedReason: row.revoked_reason === null || row.revoked_reason === undefined ? null : String(row.revoked_reason),
+    lastUsedAt: toIso(row.last_used_at),
+    createdBy: row.created_by === null || row.created_by === undefined ? null : String(row.created_by)
+  };
+}
+
+class ApiKeyStore {
+  client;
+  table;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.table = options.table ?? DEFAULT_API_KEYS_TABLE;
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(this.table)) {
+      throw new Error(`Invalid api-keys table name '${this.table}'.`);
+    }
+  }
+  migrations() {
+    return apiKeyMigrations(this.table);
+  }
+  async ensureSchema() {
+    for (const migration of this.migrations()) {
+      await this.client.execute(migration.sql);
+    }
+  }
+  async insert(input) {
+    await this.client.execute(`INSERT INTO ${this.table}
+         (kid, app, agent, scopes, token_hash, issued_at, expires_at, created_by)
+       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)`, [
+      input.kid,
+      input.app,
+      input.agent ?? null,
+      JSON.stringify(input.scopes),
+      input.tokenHash,
+      input.issuedAt.toISOString(),
+      input.expiresAt ? input.expiresAt.toISOString() : null,
+      input.createdBy ?? null
+    ]);
+  }
+  async insertMinted(minted, createdBy) {
+    const claims = minted.claims;
+    await this.insert({
+      kid: minted.kid,
+      app: claims.app,
+      agent: claims.agent ?? null,
+      scopes: claims.scopes,
+      tokenHash: minted.tokenHash,
+      issuedAt: new Date(claims.iat * 1000),
+      expiresAt: claims.exp === null ? null : new Date(claims.exp * 1000),
+      createdBy: createdBy ?? null
+    });
+  }
+  async findByKid(kid) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE kid = $1`, [kid]);
+    return row ? rowToRecord(row) : null;
+  }
+  async findByTokenHash(tokenHash) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE token_hash = $1`, [tokenHash]);
+    return row ? rowToRecord(row) : null;
+  }
+  isRevoked = async (kid) => {
+    const row = await this.client.get(`SELECT revoked_at FROM ${this.table} WHERE kid = $1`, [kid]);
+    if (!row)
+      return false;
+    return row.revoked_at !== null && row.revoked_at !== undefined;
+  };
+  async status(kid, nowMs = Date.now()) {
+    const record = await this.findByKid(kid);
+    if (!record)
+      return "unknown";
+    if (record.revokedAt)
+      return "revoked";
+    if (record.expiresAt && new Date(record.expiresAt).getTime() <= nowMs)
+      return "expired";
+    return "active";
+  }
+  statusChecker() {
+    return async (kid) => {
+      const status = await this.status(kid);
+      return status !== "active";
+    };
+  }
+  async revoke(kid, reason, atMs = Date.now()) {
+    const row = await this.client.get(`UPDATE ${this.table}
+          SET revoked_at = COALESCE(revoked_at, $2), revoked_reason = COALESCE(revoked_reason, $3)
+        WHERE kid = $1
+      RETURNING kid`, [kid, new Date(atMs).toISOString(), reason ?? null]);
+    return row !== null;
+  }
+  async touchLastUsed(kid, atMs = Date.now()) {
+    await this.client.execute(`UPDATE ${this.table} SET last_used_at = $2 WHERE kid = $1`, [
+      kid,
+      new Date(atMs).toISOString()
+    ]);
+  }
+  async list(options = {}) {
+    const clauses = [];
+    const params = [];
+    if (options.app) {
+      params.push(options.app);
+      clauses.push(`app = $${params.length}`);
+    }
+    if (!options.includeRevoked) {
+      clauses.push("revoked_at IS NULL");
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`);
+    return rows.map(rowToRecord);
+  }
+  async revokedKids() {
+    const rows = await this.client.many(`SELECT kid FROM ${this.table} WHERE revoked_at IS NOT NULL`);
+    return rows.map((row) => String(row.kid));
+  }
+}
+function readHeader(source, name) {
+  const lower = name.toLowerCase();
+  if (typeof source === "function") {
+    return source(name) ?? source(lower) ?? null;
+  }
+  if (typeof Headers !== "undefined" && source instanceof Headers) {
+    return source.get(name);
+  }
+  const record = source;
+  const value = record[name] ?? record[lower] ?? record[name.toUpperCase()];
+  if (Array.isArray(value))
+    return value[0] ?? null;
+  return value ?? null;
+}
+function extractToken(source, headerName = "x-api-key", scheme = "Bearer") {
+  const direct = readHeader(source, headerName);
+  if (direct && direct.trim().length > 0)
+    return direct.trim();
+  const authz = readHeader(source, "authorization");
+  if (authz) {
+    const prefix = `${scheme} `;
+    if (authz.toLowerCase().startsWith(prefix.toLowerCase())) {
+      const token = authz.slice(prefix.length).trim();
+      if (token.length > 0)
+        return token;
+    }
+  }
+  return null;
+}
+function verifyApiKey(options) {
+  if (!options.app)
+    throw new Error("verifyApiKey requires an 'app' slug.");
+  if (!options.signingSecret) {
+    throw new Error("verifyApiKey requires a 'signingSecret'. Set it from HASNA_<APP>_API_SIGNING_KEY.");
+  }
+  const headerName = options.headerName ?? "x-api-key";
+  const scheme = options.scheme ?? "Bearer";
+  const clock = options.nowMs ?? (() => Date.now());
+  async function emit(event) {
+    if (!options.audit)
+      return;
+    try {
+      await options.audit(event);
+    } catch {}
+  }
+  async function authenticate(headers, context = {}) {
+    const method = context.method ?? null;
+    const path = context.path ?? null;
+    const requiredScopes = [...options.requiredScopes ?? [], ...context.requiredScopes ?? []];
+    const at = new Date(clock()).toISOString();
+    const token = extractToken(headers, headerName, scheme);
+    if (!token) {
+      const decision = {
+        ok: false,
+        status: 401,
+        reason: "missing_token",
+        message: `Missing API key. Send it as '${headerName}: <key>' or 'Authorization: ${scheme} <key>'.`
+      };
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
+      return decision;
+    }
+    const verified = verifyApiKeyToken(token, {
+      signingSecret: options.signingSecret,
+      expectedApp: options.app,
+      nowMs: clock(),
+      ...options.leewaySeconds !== undefined ? { leewaySeconds: options.leewaySeconds } : {},
+      requiredScopes
+    });
+    if (!verified.ok) {
+      const status = verified.reason === "insufficient_scope" ? 403 : 401;
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: verified.reason, scopesRequired: requiredScopes, method, path, status, at });
+      return { ok: false, status, reason: verified.reason, message: verified.message };
+    }
+    if (options.isRevoked) {
+      const revoked = await options.isRevoked(verified.kid);
+      if (revoked) {
+        await emit({ outcome: "deny", app: options.app, kid: verified.kid, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
+        return { ok: false, status: 401, reason: "revoked", message: "API key has been revoked." };
+      }
+    }
+    const principal = {
+      kid: verified.kid,
+      app: verified.app,
+      scopes: verified.claims.scopes,
+      agent: verified.claims.agent ?? null,
+      claims: verified.claims
+    };
+    await emit({ outcome: "allow", app: options.app, kid: verified.kid, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
+    return { ok: true, status: 200, principal };
+  }
+  return { authenticate, app: options.app };
+}
+
+// src/generated/storage-kit/mode.ts
+var DEPRECATED_STORAGE_MODE_ALIASES = [
+  "remote",
+  "hybrid",
+  "self_hosted"
+];
+function normalizeStorageMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return { mode: "local", deprecatedAlias: null };
+  if (normalized === "cloud")
+    return { mode: "cloud", deprecatedAlias: null };
+  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
+    return { mode: "cloud", deprecatedAlias: normalized };
+  }
+  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+}
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function storageEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function resolveStorageMode(name, env = process.env) {
+  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
+  const dbHit = firstEnv(env, databaseUrlKeys);
+  const databaseUrlPresent = Boolean(dbHit);
+  const databaseUrlSource = dbHit ? dbHit.key : null;
+  const modeHit = firstEnv(env, modeKeys);
+  if (!modeHit) {
+    return {
+      mode: "local",
+      source: "default",
+      deprecatedAlias: null,
+      databaseUrlPresent,
+      databaseUrlSource,
+      warning: null
+    };
+  }
+  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
+  const warnings = [];
+  if (deprecatedAlias) {
+    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
+  }
+  if (mode === "cloud" && !databaseUrlPresent) {
+    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
+  }
+  if (modeHit.key !== modeKeys[0]) {
+    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
+  }
+  return {
+    mode,
+    source: modeHit.key,
+    deprecatedAlias,
+    databaseUrlPresent,
+    databaseUrlSource,
+    warning: warnings.length > 0 ? warnings.join(" ") : null
+  };
+}
+function resolveDatabaseUrl(name, env = process.env) {
+  const { databaseUrlKeys } = storageEnvKeys(name);
+  const hit = firstEnv(env, databaseUrlKeys);
+  return hit ? hit.value : null;
+}
+// src/generated/storage-kit/tls.ts
+import { readFileSync } from "fs";
+function sslModeFromConnectionString(connectionString) {
+  const queryStart = connectionString.indexOf("?");
+  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
+  const sslmode = params.get("sslmode")?.trim().toLowerCase();
+  if (sslmode) {
+    switch (sslmode) {
+      case "disable":
+      case "prefer":
+      case "require":
+      case "verify-ca":
+      case "verify-full":
+        return sslmode;
+      case "allow":
+        return "prefer";
+      default:
+        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+    }
+  }
+  const ssl = params.get("ssl")?.trim().toLowerCase();
+  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+    return "require";
+  return "disable";
+}
+function loadCaBundle(options) {
+  const env = options.env ?? process.env;
+  if (options.ca && options.ca.trim())
+    return options.ca;
+  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+  if (path && path.trim())
+    return readFileSync(path.trim(), "utf8");
+  return null;
+}
+function resolveTlsConfig(connectionString, options = {}) {
+  const mode = sslModeFromConnectionString(connectionString);
+  if (mode === "disable" || mode === "prefer") {
+    return;
+  }
+  const ca = loadCaBundle(options);
+  if (mode === "require") {
+    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  }
+  if (!ca) {
+    throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
+  }
+  return { rejectUnauthorized: true, ca };
+}
+// src/generated/storage-kit/query.ts
+function wrapExecutor(executor) {
+  return {
+    async query(sql, params) {
+      const result = await executor.query(sql, params);
+      return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+    },
+    async many(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows;
+    },
+    async get(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows[0] ?? null;
+    },
+    async one(sql, params) {
+      const result = await executor.query(sql, params);
+      if (result.rows.length !== 1) {
+        throw new Error(`Expected exactly one row, got ${result.rows.length}.`);
+      }
+      return result.rows[0];
+    },
+    async execute(sql, params) {
+      await executor.query(sql, params);
+    }
+  };
+}
+function createQueryClient(pool) {
+  const base = wrapExecutor(pool);
+  return {
+    ...base,
+    pool,
+    async transaction(fn) {
+      const client = await pool.connect();
+      try {
+        await client.query("BEGIN");
+        const result = await fn(wrapExecutor(client));
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await client.query("ROLLBACK");
+        } catch {}
+        throw error;
+      } finally {
+        client.release();
+      }
+    },
+    async close() {
+      await pool.end();
+    }
+  };
+}
+// src/generated/storage-kit/pool.ts
+import pg from "pg";
+function createPgPool(options) {
+  const ssl = resolveTlsConfig(options.connectionString, {
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    ...options.env !== undefined ? { env: options.env } : {}
+  });
+  const config = { connectionString: options.connectionString };
+  if (ssl !== undefined)
+    config.ssl = ssl;
+  if (options.max !== undefined)
+    config.max = options.max;
+  if (options.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = options.idleTimeoutMillis;
+  if (options.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
+  if (options.applicationName !== undefined)
+    config.application_name = options.applicationName;
+  return new pg.Pool(config);
+}
+function createCloudPoolFromEnv(appName, options = {}) {
+  const env = options.env ?? process.env;
+  const resolution = resolveStorageMode(appName, env);
+  if (resolution.mode !== "cloud") {
+    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
+  }
+  const connectionString = resolveDatabaseUrl(appName, env);
+  if (!connectionString) {
+    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+  }
+  const pool = createPgPool({
+    connectionString,
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    env,
+    ...options.max !== undefined ? { max: options.max } : {},
+    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
+    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
+    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+  });
+  return {
+    client: createQueryClient(pool),
+    connectionSource: resolution.databaseUrlSource ?? "unknown"
+  };
+}
+// src/generated/storage-kit/migrations.ts
+import { createHash as createHash2 } from "crypto";
+function checksumSql(sql) {
+  const normalized = sql.trim().replace(/\r\n/g, `
+`);
+  return `sha256:${createHash2("sha256").update(normalized).digest("hex")}`;
+}
+function defineMigration(id, sql) {
+  return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
+}
+// src/generated/storage-kit/health.ts
+async function checkHealth(client) {
+  const start = Date.now();
+  try {
+    await client.get("SELECT 1 AS ok");
+    return { ok: true, latencyMs: Date.now() - start };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+// src/lib/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+var cachedVersion = null;
+function getPackageVersion() {
+  if (cachedVersion)
+    return cachedVersion;
+  try {
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const packageJsonPath = resolve(moduleDir, "../../package.json");
+    const pkg = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
+    cachedVersion = pkg.version ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+var USER_AGENT = `open-domains/${getPackageVersion()}`;
+
+// src/db/domain-records.ts
+var DOMAIN_STATUSES = [
+  "discovered",
+  "researching",
+  "offered",
+  "negotiating",
+  "purchased",
+  "active",
+  "not_available",
+  "premium_only",
+  "declined",
+  "expired",
+  "transferring",
+  "redemption"
+];
+var DOMAIN_OFFER_STATUSES = ["pending", "accepted", "rejected", "countered"];
+var DOMAIN_EMAIL_TYPES = [
+  "inquiry",
+  "offer",
+  "counter_offer",
+  "confirmation",
+  "renewal_notice",
+  "transfer"
+];
+
+// src/db/domain-owners.ts
+var DOMAIN_OWNER_SOURCES = ["whois", "manual", "brandsight", "import"];
+
+// src/db/domain-history.ts
+var HISTORY_TYPES = [
+  "whois",
+  "rdap",
+  "dns",
+  "ssl",
+  "reputation",
+  "exa_research",
+  "purchase",
+  "renewal"
+];
+
+// src/server/repo.ts
+function parseJson(value, fallback) {
+  if (value === null || value === undefined)
+    return fallback;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+function rowToDomain(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    registrar: row.registrar,
+    status: row.status,
+    registered_at: row.registered_at,
+    expires_at: row.expires_at,
+    auto_renew: Boolean(row.auto_renew),
+    is_premium: Boolean(row.is_premium),
+    premium_price: row.premium_price,
+    standard_price: row.standard_price,
+    purchase_price: row.purchase_price,
+    purchase_date: row.purchase_date,
+    nameservers: parseJson(row.nameservers, []),
+    whois: parseJson(row.whois, {}),
+    ssl_expires_at: row.ssl_expires_at,
+    ssl_issuer: row.ssl_issuer,
+    notes: row.notes,
+    metadata: parseJson(row.metadata, {}),
+    created_at: row.created_at,
+    updated_at: row.updated_at
+  };
+}
+function rowToDnsRecord(row) {
+  return {
+    id: row.id,
+    domain_id: row.domain_id,
+    type: row.type,
+    name: row.name,
+    value: row.value,
+    ttl: row.ttl,
+    priority: row.priority,
+    created_at: row.created_at
+  };
+}
+
+class HttpError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "HttpError";
+  }
+}
+var DNS_TYPES = ["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV"];
+
+class DomainsRepo {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async createDomain(input) {
+    if (!input || typeof input.name !== "string" || input.name.trim() === "") {
+      throw new HttpError(400, "domain 'name' is required");
+    }
+    const status = input.status ?? "active";
+    if (!DOMAIN_STATUSES.includes(status)) {
+      throw new HttpError(400, `invalid status '${status}'`);
+    }
+    const id = crypto.randomUUID();
+    const nowIso = new Date().toISOString();
+    try {
+      const row = await this.db.get(`INSERT INTO domains (
+           id, name, registrar, status, registered_at, expires_at, auto_renew,
+           is_premium, premium_price, standard_price, purchase_price, purchase_date,
+           nameservers, whois, ssl_expires_at, ssl_issuer, notes, metadata,
+           created_at, updated_at
+         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20)
+         RETURNING *`, [
+        id,
+        input.name.trim(),
+        input.registrar ?? null,
+        status,
+        input.registered_at ?? null,
+        input.expires_at ?? null,
+        input.auto_renew !== undefined ? input.auto_renew : true,
+        input.is_premium ?? false,
+        input.premium_price ?? null,
+        input.standard_price ?? null,
+        input.purchase_price ?? null,
+        input.purchase_date ?? null,
+        JSON.stringify(input.nameservers ?? []),
+        JSON.stringify(input.whois ?? {}),
+        input.ssl_expires_at ?? null,
+        input.ssl_issuer ?? null,
+        input.notes ?? null,
+        JSON.stringify(input.metadata ?? {}),
+        nowIso,
+        nowIso
+      ]);
+      return rowToDomain(row);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (/duplicate key|unique constraint/i.test(msg)) {
+        throw new HttpError(409, `domain '${input.name}' already exists`);
+      }
+      throw e;
+    }
+  }
+  async getDomain(id) {
+    const row = await this.db.get("SELECT * FROM domains WHERE id = $1", [id]);
+    return row ? rowToDomain(row) : null;
+  }
+  async getDomainByName(name) {
+    const row = await this.db.get("SELECT * FROM domains WHERE name = $1", [name]);
+    return row ? rowToDomain(row) : null;
+  }
+  async listDomains(opts) {
+    const clauses = [];
+    const params = [];
+    if (opts.search) {
+      params.push(`%${opts.search}%`);
+      clauses.push(`name ILIKE $${params.length}`);
+    }
+    if (opts.status) {
+      if (!DOMAIN_STATUSES.includes(opts.status)) {
+        throw new HttpError(400, `invalid status filter '${opts.status}'`);
+      }
+      params.push(opts.status);
+      clauses.push(`status = $${params.length}`);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const limit = Math.min(Math.max(opts.limit ?? 100, 1), 1000);
+    const offset = Math.max(opts.offset ?? 0, 0);
+    params.push(limit, offset);
+    const rows = await this.db.many(`SELECT * FROM domains ${where} ORDER BY name ASC LIMIT $${params.length - 1} OFFSET $${params.length}`, params);
+    return rows.map(rowToDomain);
+  }
+  async updateDomain(id, patch) {
+    const existing = await this.getDomain(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    const p = patch;
+    if ("name" in p)
+      setCol("name", p["name"]);
+    if ("registrar" in p)
+      setCol("registrar", p["registrar"] ?? null);
+    if ("status" in p) {
+      if (!DOMAIN_STATUSES.includes(p["status"])) {
+        throw new HttpError(400, `invalid status '${String(p["status"])}'`);
+      }
+      setCol("status", p["status"]);
+    }
+    if ("registered_at" in p)
+      setCol("registered_at", p["registered_at"] ?? null);
+    if ("expires_at" in p)
+      setCol("expires_at", p["expires_at"] ?? null);
+    if ("auto_renew" in p)
+      setCol("auto_renew", Boolean(p["auto_renew"]));
+    if ("is_premium" in p)
+      setCol("is_premium", Boolean(p["is_premium"]));
+    if ("premium_price" in p)
+      setCol("premium_price", p["premium_price"] ?? null);
+    if ("standard_price" in p)
+      setCol("standard_price", p["standard_price"] ?? null);
+    if ("purchase_price" in p)
+      setCol("purchase_price", p["purchase_price"] ?? null);
+    if ("purchase_date" in p)
+      setCol("purchase_date", p["purchase_date"] ?? null);
+    if ("nameservers" in p)
+      setCol("nameservers", JSON.stringify(p["nameservers"] ?? []));
+    if ("whois" in p)
+      setCol("whois", JSON.stringify(p["whois"] ?? {}));
+    if ("ssl_expires_at" in p)
+      setCol("ssl_expires_at", p["ssl_expires_at"] ?? null);
+    if ("ssl_issuer" in p)
+      setCol("ssl_issuer", p["ssl_issuer"] ?? null);
+    if ("notes" in p)
+      setCol("notes", p["notes"] ?? null);
+    if ("metadata" in p)
+      setCol("metadata", JSON.stringify(p["metadata"] ?? {}));
+    if (sets.length === 0)
+      return existing;
+    setCol("updated_at", new Date().toISOString());
+    params.push(id);
+    const row = await this.db.get(`UPDATE domains SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? rowToDomain(row) : null;
+  }
+  async deleteDomain(id) {
+    const result = await this.db.query("DELETE FROM domains WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async countDomains() {
+    const row = await this.db.get("SELECT count(*)::text AS n FROM domains");
+    return row ? parseInt(row.n, 10) : 0;
+  }
+  async getStats() {
+    const row = await this.db.get(`SELECT
+         count(*)::text AS total,
+         count(*) FILTER (WHERE status = 'active')::text AS active,
+         count(*) FILTER (WHERE status = 'expired')::text AS expired,
+         count(*) FILTER (WHERE status = 'transferring')::text AS transferring,
+         count(*) FILTER (WHERE status = 'redemption')::text AS redemption,
+         count(*) FILTER (WHERE auto_renew = true)::text AS auto_renew_enabled,
+         count(*) FILTER (
+           WHERE NULLIF(expires_at, '')::timestamptz
+             BETWEEN now() AND now() + interval '30 days'
+         )::text AS expiring_30_days,
+         count(*) FILTER (
+           WHERE NULLIF(ssl_expires_at, '')::timestamptz
+             BETWEEN now() AND now() + interval '30 days'
+         )::text AS ssl_expiring_30_days
+       FROM domains`);
+    const n = (k) => row && row[k] ? parseInt(row[k], 10) : 0;
+    return {
+      total: n("total"),
+      active: n("active"),
+      expired: n("expired"),
+      transferring: n("transferring"),
+      redemption: n("redemption"),
+      auto_renew_enabled: n("auto_renew_enabled"),
+      expiring_30_days: n("expiring_30_days"),
+      ssl_expiring_30_days: n("ssl_expiring_30_days")
+    };
+  }
+  async listDnsRecords(domainId) {
+    const rows = await this.db.many("SELECT * FROM dns_records WHERE domain_id = $1 ORDER BY type, name", [domainId]);
+    return rows.map(rowToDnsRecord);
+  }
+  async createDnsRecord(domainId, input) {
+    if (!input || typeof input.type !== "string" || !DNS_TYPES.includes(input.type)) {
+      throw new HttpError(400, `dns record 'type' must be one of ${DNS_TYPES.join(", ")}`);
+    }
+    if (typeof input.name !== "string" || typeof input.value !== "string") {
+      throw new HttpError(400, "dns record 'name' and 'value' are required");
+    }
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO dns_records (id, domain_id, type, name, value, ttl, priority, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8) RETURNING *`, [
+      id,
+      domainId,
+      input.type,
+      input.name,
+      input.value,
+      input.ttl ?? 3600,
+      input.priority ?? null,
+      new Date().toISOString()
+    ]);
+    return rowToDnsRecord(row);
+  }
+  async getDnsRecord(id) {
+    const row = await this.db.get("SELECT * FROM dns_records WHERE id = $1", [id]);
+    return row ? rowToDnsRecord(row) : null;
+  }
+  async deleteDnsRecord(id) {
+    const result = await this.db.query("DELETE FROM dns_records WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listOffers(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_offers WHERE domain_id = $1 ORDER BY created_at DESC", [domainId]);
+    return rows;
+  }
+  async createOffer(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const status = input.status ?? "pending";
+    if (!DOMAIN_OFFER_STATUSES.includes(status)) {
+      throw new HttpError(400, `invalid offer status '${status}'`);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_offers (id, domain_id, our_offer, their_ask, status, notes, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7) RETURNING *`, [
+      id,
+      domainId,
+      input.our_offer ?? null,
+      input.their_ask ?? null,
+      status,
+      input.notes ?? null,
+      new Date().toISOString()
+    ]);
+    return row;
+  }
+  async getOffer(id) {
+    const row = await this.db.get("SELECT * FROM domain_offers WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async updateDnsRecord(id, patch) {
+    const existing = await this.getDnsRecord(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    if (patch.type !== undefined) {
+      if (!DNS_TYPES.includes(patch.type)) {
+        throw new HttpError(400, `dns record 'type' must be one of ${DNS_TYPES.join(", ")}`);
+      }
+      setCol("type", patch.type);
+    }
+    if (patch.name !== undefined)
+      setCol("name", patch.name);
+    if (patch.value !== undefined)
+      setCol("value", patch.value);
+    if (patch.ttl !== undefined)
+      setCol("ttl", patch.ttl);
+    if (patch.priority !== undefined)
+      setCol("priority", patch.priority ?? null);
+    if (sets.length === 0)
+      return existing;
+    params.push(id);
+    const row = await this.db.get(`UPDATE dns_records SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? rowToDnsRecord(row) : null;
+  }
+  async listEmailLinks(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_emails WHERE domain_id = $1 ORDER BY created_at ASC", [domainId]);
+    return rows;
+  }
+  async getEmailLink(id) {
+    const row = await this.db.get("SELECT * FROM domain_emails WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async linkEmail(domainId, input) {
+    if (!DOMAIN_EMAIL_TYPES.includes(input.type)) {
+      throw new HttpError(400, `invalid email link type '${input.type}'`);
+    }
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const existing = await this.db.get("SELECT id, thread_id FROM domain_emails WHERE domain_id = $1 AND email_id = $2", [domainId, input.email_id]);
+    if (existing) {
+      const row2 = await this.db.get("UPDATE domain_emails SET thread_id = $1, type = $2 WHERE id = $3 RETURNING *", [input.thread_id ?? existing.thread_id ?? null, input.type, existing.id]);
+      return row2;
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_emails (id, domain_id, email_id, thread_id, type, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6) RETURNING *`, [id, domainId, input.email_id, input.thread_id ?? null, input.type, new Date().toISOString()]);
+    return row;
+  }
+  async listAlerts(domainId) {
+    const rows = await this.db.many("SELECT * FROM alerts WHERE domain_id = $1 ORDER BY type, trigger_days_before", [domainId]);
+    return rows;
+  }
+  async getAlert(id) {
+    const row = await this.db.get("SELECT * FROM alerts WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async createAlert(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    if (!["expiry", "ssl_expiry", "dns_change"].includes(input.type)) {
+      throw new HttpError(400, `invalid alert type '${input.type}'`);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO alerts (id, domain_id, type, trigger_days_before, created_at)
+       VALUES ($1,$2,$3,$4,$5) RETURNING *`, [id, domainId, input.type, input.trigger_days_before ?? null, new Date().toISOString()]);
+    return row;
+  }
+  async deleteAlert(id) {
+    const result = await this.db.query("DELETE FROM alerts WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  ownerRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      contact_id: row["contact_id"] ?? null,
+      owner_name: row["owner_name"] ?? null,
+      owner_email: row["owner_email"] ?? null,
+      owner_phone: row["owner_phone"] ?? null,
+      owner_organization: row["owner_organization"] ?? null,
+      source: row["source"],
+      verified: Boolean(row["verified"]),
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"],
+      updated_at: row["updated_at"]
+    };
+  }
+  async listOwnersForDomain(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_owners WHERE domain_id = $1 ORDER BY created_at DESC", [domainId]);
+    return rows.map((r) => this.ownerRow(r));
+  }
+  async listOwners(opts) {
+    const clauses = [];
+    const params = [];
+    if (opts.search) {
+      params.push(`%${opts.search}%`);
+      const p = `$${params.length}`;
+      clauses.push(`(owner_name ILIKE ${p} OR owner_email ILIKE ${p} OR owner_organization ILIKE ${p} OR notes ILIKE ${p})`);
+    }
+    if (opts.source) {
+      params.push(opts.source);
+      clauses.push(`source = $${params.length}`);
+    }
+    if (opts.verified !== undefined) {
+      params.push(opts.verified);
+      clauses.push(`verified = $${params.length}`);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = await this.db.many(`SELECT * FROM domain_owners ${where} ORDER BY created_at DESC`, params);
+    return rows.map((r) => this.ownerRow(r));
+  }
+  async getOwner(id) {
+    const row = await this.db.get("SELECT * FROM domain_owners WHERE id = $1", [id]);
+    return row ? this.ownerRow(row) : null;
+  }
+  async createOwner(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const source = input.source ?? "manual";
+    if (!DOMAIN_OWNER_SOURCES.includes(source))
+      throw new HttpError(400, `invalid owner source '${source}'`);
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const row = await this.db.get(`INSERT INTO domain_owners (id, domain_id, contact_id, owner_name, owner_email, owner_phone, owner_organization, source, verified, notes, created_at, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING *`, [
+      id,
+      domainId,
+      input.contact_id ?? null,
+      input.owner_name ?? null,
+      input.owner_email ?? null,
+      input.owner_phone ?? null,
+      input.owner_organization ?? null,
+      source,
+      input.verified ?? false,
+      input.notes ?? null,
+      now,
+      now
+    ]);
+    return this.ownerRow(row);
+  }
+  async updateOwner(id, patch) {
+    const existing = await this.getOwner(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    if (patch.contact_id !== undefined)
+      setCol("contact_id", patch.contact_id ?? null);
+    if (patch.owner_name !== undefined)
+      setCol("owner_name", patch.owner_name ?? null);
+    if (patch.owner_email !== undefined)
+      setCol("owner_email", patch.owner_email ?? null);
+    if (patch.owner_phone !== undefined)
+      setCol("owner_phone", patch.owner_phone ?? null);
+    if (patch.owner_organization !== undefined)
+      setCol("owner_organization", patch.owner_organization ?? null);
+    if (patch.source !== undefined)
+      setCol("source", patch.source);
+    if (patch.verified !== undefined)
+      setCol("verified", Boolean(patch.verified));
+    if (patch.notes !== undefined)
+      setCol("notes", patch.notes ?? null);
+    if (sets.length === 0)
+      return existing;
+    setCol("updated_at", new Date().toISOString());
+    params.push(id);
+    const row = await this.db.get(`UPDATE domain_owners SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? this.ownerRow(row) : null;
+  }
+  async deleteOwner(id) {
+    const result = await this.db.query("DELETE FROM domain_owners WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listDomainsWithOwners() {
+    const rows = await this.db.many(`SELECT d.name as domain_name, d.status as domain_status, d.is_premium, d.premium_price,
+              o.owner_name, o.owner_email, o.owner_organization, o.contact_id, o.source, o.verified
+         FROM domains d
+         LEFT JOIN domain_owners o ON d.id = o.domain_id
+        WHERE o.id IS NOT NULL OR d.is_premium = true
+           OR d.status IN ('premium_only','not_available','negotiating','offered','researching')
+        ORDER BY d.name`);
+    return rows.map((r) => ({
+      domain_name: r["domain_name"],
+      domain_status: r["domain_status"],
+      is_premium: Boolean(r["is_premium"]),
+      premium_price: r["premium_price"] ?? null,
+      owner_name: r["owner_name"] ?? null,
+      owner_email: r["owner_email"] ?? null,
+      owner_organization: r["owner_organization"] ?? null,
+      contact_id: r["contact_id"] ?? null,
+      source: r["source"] ?? null,
+      verified: Boolean(r["verified"])
+    }));
+  }
+  historyRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      snapshot_type: row["snapshot_type"],
+      raw_data: parseJson(row["raw_data"], {}),
+      registrant_name: row["registrant_name"] ?? null,
+      registrant_email: row["registrant_email"] ?? null,
+      registrant_org: row["registrant_org"] ?? null,
+      nameservers: parseJson(row["nameservers"], []),
+      registrar: row["registrar"] ?? null,
+      status: row["status"] ?? null,
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"]
+    };
+  }
+  async createHistory(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    if (!HISTORY_TYPES.includes(input.snapshot_type))
+      throw new HttpError(400, `invalid snapshot_type '${input.snapshot_type}'`);
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_history (id, domain_id, snapshot_type, raw_data, registrant_name, registrant_email, registrant_org, nameservers, registrar, status, notes, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING *`, [
+      id,
+      domainId,
+      input.snapshot_type,
+      JSON.stringify(input.raw_data ?? {}),
+      input.registrant_name ?? null,
+      input.registrant_email ?? null,
+      input.registrant_org ?? null,
+      JSON.stringify(input.nameservers ?? []),
+      input.registrar ?? null,
+      input.status ?? null,
+      input.notes ?? null,
+      new Date().toISOString()
+    ]);
+    return this.historyRow(row);
+  }
+  async getHistory(id) {
+    const row = await this.db.get("SELECT * FROM domain_history WHERE id = $1", [id]);
+    return row ? this.historyRow(row) : null;
+  }
+  async listHistory(domainId, opts) {
+    const clauses = ["domain_id = $1"];
+    const params = [domainId];
+    if (opts.type) {
+      params.push(opts.type);
+      clauses.push(`snapshot_type = $${params.length}`);
+    }
+    let sql = `SELECT * FROM domain_history WHERE ${clauses.join(" AND ")} ORDER BY created_at DESC`;
+    if (opts.limit) {
+      params.push(Math.min(Math.max(opts.limit, 1), 1000));
+      sql += ` LIMIT $${params.length}`;
+    }
+    const rows = await this.db.many(sql, params);
+    return rows.map((r) => this.historyRow(r));
+  }
+  async listHistoryByDateRange(start, end, domainId) {
+    const clauses = ["created_at BETWEEN $1 AND $2"];
+    const params = [start, end];
+    if (domainId) {
+      params.push(domainId);
+      clauses.push(`domain_id = $${params.length}`);
+    }
+    const rows = await this.db.many(`SELECT * FROM domain_history WHERE ${clauses.join(" AND ")} ORDER BY created_at DESC`, params);
+    return rows.map((r) => this.historyRow(r));
+  }
+  async deleteHistory(id) {
+    const result = await this.db.query("DELETE FROM domain_history WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async deleteHistoryByDomain(domainId) {
+    const result = await this.db.query("DELETE FROM domain_history WHERE domain_id = $1", [domainId]);
+    return result.rowCount > 0;
+  }
+  async listHistoryChanges() {
+    const rows = await this.db.many(`SELECT d.id as domain_id, d.name as domain_name,
+              (SELECT snapshot_type FROM domain_history h2 WHERE h2.domain_id = d.id ORDER BY created_at DESC LIMIT 1) as latest_snapshot_type,
+              MAX(h.created_at) as latest_snapshot_at,
+              COUNT(h.id)::text as snapshot_count
+         FROM domains d JOIN domain_history h ON d.id = h.domain_id
+        GROUP BY d.id ORDER BY latest_snapshot_at DESC`);
+    return rows.map((r) => ({
+      domain_id: r["domain_id"],
+      domain_name: r["domain_name"],
+      latest_snapshot_type: r["latest_snapshot_type"],
+      latest_snapshot_at: r["latest_snapshot_at"],
+      snapshot_count: parseInt(r["snapshot_count"] ?? "0", 10)
+    }));
+  }
+  reputationRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      is_blacklisted: Boolean(row["is_blacklisted"]),
+      blacklist_sources: parseJson(row["blacklist_sources"], []),
+      threat_score: row["threat_score"] ?? null,
+      spam_score: row["spam_score"] ?? null,
+      malware_detected: Boolean(row["malware_detected"]),
+      phishing_detected: Boolean(row["phishing_detected"]),
+      reputation_sources: parseJson(row["reputation_sources"], []),
+      last_checked_at: row["last_checked_at"] ?? null,
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"],
+      updated_at: row["updated_at"]
+    };
+  }
+  async getReputation(domainId) {
+    const row = await this.db.get("SELECT * FROM domain_reputation WHERE domain_id = $1", [domainId]);
+    return row ? this.reputationRow(row) : null;
+  }
+  async upsertReputation(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const existing = await this.getReputation(domainId);
+    const now = new Date().toISOString();
+    if (existing) {
+      const sets = [];
+      const params = [];
+      const setCol = (col, val) => {
+        params.push(val);
+        sets.push(`${col} = $${params.length}`);
+      };
+      if (input.is_blacklisted !== undefined)
+        setCol("is_blacklisted", Boolean(input.is_blacklisted));
+      if (input.blacklist_sources !== undefined)
+        setCol("blacklist_sources", JSON.stringify(input.blacklist_sources));
+      if (input.threat_score !== undefined)
+        setCol("threat_score", input.threat_score);
+      if (input.spam_score !== undefined)
+        setCol("spam_score", input.spam_score);
+      if (input.malware_detected !== undefined)
+        setCol("malware_detected", Boolean(input.malware_detected));
+      if (input.phishing_detected !== undefined)
+        setCol("phishing_detected", Boolean(input.phishing_detected));
+      if (input.reputation_sources !== undefined)
+        setCol("reputation_sources", JSON.stringify(input.reputation_sources));
+      if (input.last_checked_at !== undefined)
+        setCol("last_checked_at", input.last_checked_at);
+      if (input.notes !== undefined)
+        setCol("notes", input.notes);
+      setCol("updated_at", now);
+      params.push(existing.id);
+      const row2 = await this.db.get(`UPDATE domain_reputation SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+      return this.reputationRow(row2);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_reputation (id, domain_id, is_blacklisted, blacklist_sources, threat_score, spam_score, malware_detected, phishing_detected, reputation_sources, last_checked_at, notes, created_at, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13) RETURNING *`, [
+      id,
+      domainId,
+      input.is_blacklisted ?? false,
+      JSON.stringify(input.blacklist_sources ?? []),
+      input.threat_score ?? null,
+      input.spam_score ?? null,
+      input.malware_detected ?? false,
+      input.phishing_detected ?? false,
+      JSON.stringify(input.reputation_sources ?? []),
+      input.last_checked_at ?? null,
+      input.notes ?? null,
+      now,
+      now
+    ]);
+    return this.reputationRow(row);
+  }
+  async updateReputation(id, patch) {
+    const existing = await this.db.get("SELECT * FROM domain_reputation WHERE id = $1", [id]);
+    if (!existing)
+      return null;
+    return this.upsertReputation(existing["domain_id"], patch);
+  }
+  async deleteReputation(id) {
+    const result = await this.db.query("DELETE FROM domain_reputation WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listReputation(opts) {
+    if (opts.blacklisted) {
+      const rows2 = await this.db.many("SELECT * FROM domain_reputation WHERE is_blacklisted = true ORDER BY updated_at DESC");
+      return rows2.map((r) => this.reputationRow(r));
+    }
+    const threshold = opts.threshold ?? 70;
+    const rows = await this.db.many("SELECT * FROM domain_reputation WHERE threat_score >= $1 ORDER BY threat_score DESC", [threshold]);
+    return rows.map((r) => this.reputationRow(r));
+  }
+}
+
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS domains (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE,
+    registrar TEXT,
+    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('discovered', 'researching', 'offered', 'negotiating', 'purchased', 'active', 'not_available', 'premium_only', 'declined', 'expired', 'transferring', 'redemption')),
+    registered_at TEXT,
+    expires_at TEXT,
+    auto_renew BOOLEAN NOT NULL DEFAULT TRUE,
+    is_premium BOOLEAN NOT NULL DEFAULT FALSE,
+    premium_price DOUBLE PRECISION,
+    standard_price DOUBLE PRECISION,
+    purchase_price DOUBLE PRECISION,
+    purchase_date TEXT,
+    nameservers TEXT NOT NULL DEFAULT '[]',
+    whois TEXT NOT NULL DEFAULT '{}',
+    ssl_expires_at TEXT,
+    ssl_issuer TEXT,
+    notes TEXT,
+    metadata TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS dns_records (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    type TEXT NOT NULL CHECK (type IN ('A', 'AAAA', 'CNAME', 'MX', 'TXT', 'NS', 'SRV')),
+    name TEXT NOT NULL,
+    value TEXT NOT NULL,
+    ttl INTEGER NOT NULL DEFAULT 3600,
+    priority INTEGER,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS alerts (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    type TEXT NOT NULL CHECK (type IN ('expiry', 'ssl_expiry', 'dns_change')),
+    trigger_days_before INTEGER,
+    sent_at TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_offers (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    our_offer DOUBLE PRECISION,
+    their_ask DOUBLE PRECISION,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'accepted', 'rejected', 'countered')),
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    owner_contact_id TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_emails (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    email_id TEXT NOT NULL,
+    thread_id TEXT,
+    type TEXT NOT NULL CHECK (type IN ('inquiry', 'offer', 'counter_offer', 'confirmation', 'renewal_notice', 'transfer')),
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    UNIQUE(domain_id, email_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_owners (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    contact_id TEXT,
+    owner_name TEXT,
+    owner_email TEXT,
+    owner_phone TEXT,
+    owner_organization TEXT,
+    source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('whois', 'manual', 'brandsight', 'import')),
+    verified BOOLEAN NOT NULL DEFAULT FALSE,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_history (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    snapshot_type TEXT NOT NULL CHECK (snapshot_type IN ('whois', 'rdap', 'dns', 'ssl', 'reputation', 'exa_research', 'purchase', 'renewal')),
+    raw_data TEXT NOT NULL DEFAULT '{}',
+    registrant_name TEXT,
+    registrant_email TEXT,
+    registrant_org TEXT,
+    nameservers TEXT NOT NULL DEFAULT '[]',
+    registrar TEXT,
+    status TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE TABLE IF NOT EXISTS domain_reputation (
+    id TEXT PRIMARY KEY,
+    domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    is_blacklisted BOOLEAN NOT NULL DEFAULT FALSE,
+    blacklist_sources TEXT NOT NULL DEFAULT '[]',
+    threat_score INTEGER,
+    spam_score INTEGER,
+    malware_detected BOOLEAN NOT NULL DEFAULT FALSE,
+    phishing_detected BOOLEAN NOT NULL DEFAULT FALSE,
+    reputation_sources TEXT NOT NULL DEFAULT '[]',
+    last_checked_at TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text,
+    updated_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_name ON domains(name)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_registrar ON domains(registrar)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_status ON domains(status)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_expires_at ON domains(expires_at)`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_is_premium ON domains(is_premium)`,
+  `CREATE INDEX IF NOT EXISTS idx_dns_records_domain ON dns_records(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_dns_records_type ON dns_records(type)`,
+  `CREATE INDEX IF NOT EXISTS idx_alerts_domain ON alerts(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_alerts_type ON alerts(type)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_offers_domain ON domain_offers(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_offers_owner ON domain_offers(owner_contact_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_emails_domain ON domain_emails(domain_id)`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_domain_emails_unique ON domain_emails(domain_id, email_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_domain ON domain_owners(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_contact ON domain_owners(contact_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_owners_email ON domain_owners(owner_email)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_domain ON domain_history(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_type ON domain_history(snapshot_type)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_created ON domain_history(created_at)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_history_email ON domain_history(registrant_email)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_domain ON domain_reputation(domain_id)`,
+  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_blacklisted ON domain_reputation(is_blacklisted)`
+];
+
+// src/server/migrations.ts
+function buildMigrations() {
+  const migrations2 = [];
+  PG_MIGRATIONS.forEach((sql, i) => {
+    const id = `domains_${String(i + 1).padStart(4, "0")}`;
+    migrations2.push(defineMigration(id, sql));
+  });
+  for (const m of apiKeyMigrations("api_keys")) {
+    migrations2.push(defineMigration(m.id, m.sql));
+  }
+  return migrations2;
+}
+
+// src/server/openapi.ts
+var ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+function jsonResponse(schema, description) {
+  return { description, content: { "application/json": { schema } } };
+}
+function jsonBody(schema) {
+  return { required: true, content: { "application/json": { schema } } };
+}
+function buildOpenApiSpec(version) {
+  const idParam = {
+    name: "id",
+    in: "path",
+    required: true,
+    schema: { type: "string" },
+    description: "Resource identifier (UUID)."
+  };
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "domains",
+      version,
+      description: "Domain portfolio, registrar, marketplace, and DNS management HTTP API (self_hosted). API-key authenticated."
+    },
+    security: [{ apiKey: [] }],
+    paths: {
+      "/health": {
+        get: {
+          operationId: "getHealth",
+          summary: "Liveness probe (DB reachable).",
+          responses: { "200": jsonResponse(ref("HealthResponse"), "Service healthy") }
+        }
+      },
+      "/ready": {
+        get: {
+          operationId: "getReady",
+          summary: "Readiness probe (DB reachable and schema migrated).",
+          responses: {
+            "200": jsonResponse(ref("ReadyResponse"), "Service ready"),
+            "503": jsonResponse(ref("ReadyResponse"), "Not ready")
+          }
+        }
+      },
+      "/version": {
+        get: {
+          operationId: "getVersion",
+          summary: "Service version and mode.",
+          responses: { "200": jsonResponse(ref("VersionResponse"), "Version info") }
+        }
+      },
+      "/v1/domains": {
+        get: {
+          operationId: "listDomains",
+          summary: "List domains.",
+          parameters: [
+            { name: "search", in: "query", required: false, schema: { type: "string" } },
+            { name: "status", in: "query", required: false, schema: { type: "string" } },
+            { name: "limit", in: "query", required: false, schema: { type: "integer" } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer" } }
+          ],
+          responses: { "200": jsonResponse(ref("DomainList"), "A page of domains") }
+        },
+        post: {
+          operationId: "createDomain",
+          summary: "Create a domain.",
+          requestBody: jsonBody(ref("CreateDomainInput")),
+          responses: {
+            "201": jsonResponse(ref("Domain"), "Created"),
+            "400": jsonResponse(ref("Error"), "Invalid input"),
+            "409": jsonResponse(ref("Error"), "Already exists")
+          }
+        }
+      },
+      "/v1/domains/{id}": {
+        get: {
+          operationId: "getDomain",
+          summary: "Get a domain by id.",
+          parameters: [idParam],
+          responses: {
+            "200": jsonResponse(ref("Domain"), "The domain"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        patch: {
+          operationId: "updateDomain",
+          summary: "Update a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("UpdateDomainInput")),
+          responses: {
+            "200": jsonResponse(ref("Domain"), "Updated"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        delete: {
+          operationId: "deleteDomain",
+          summary: "Delete a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DeleteResult"), "Deleted") }
+        }
+      },
+      "/v1/stats": {
+        get: {
+          operationId: "getDomainStats",
+          summary: "Portfolio statistics.",
+          responses: { "200": jsonResponse(ref("DomainStats"), "Stats") }
+        }
+      },
+      "/v1/domains/{id}/dns": {
+        get: {
+          operationId: "listDnsRecords",
+          summary: "List DNS records for a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DnsRecordList"), "DNS records") }
+        },
+        post: {
+          operationId: "createDnsRecord",
+          summary: "Create a DNS record for a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("CreateDnsRecordInput")),
+          responses: {
+            "201": jsonResponse(ref("DnsRecord"), "Created"),
+            "404": jsonResponse(ref("Error"), "Domain not found")
+          }
+        }
+      },
+      "/v1/dns/{id}": {
+        get: {
+          operationId: "getDnsRecord",
+          summary: "Get a DNS record by id.",
+          parameters: [idParam],
+          responses: {
+            "200": jsonResponse(ref("DnsRecord"), "The record"),
+            "404": jsonResponse(ref("Error"), "Not found")
+          }
+        },
+        delete: {
+          operationId: "deleteDnsRecord",
+          summary: "Delete a DNS record.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("DeleteResult"), "Deleted") }
+        }
+      },
+      "/v1/domains/{id}/offers": {
+        get: {
+          operationId: "listOffers",
+          summary: "List marketplace offers for a domain.",
+          parameters: [idParam],
+          responses: { "200": jsonResponse(ref("OfferList"), "Offers") }
+        },
+        post: {
+          operationId: "createOffer",
+          summary: "Create a marketplace offer for a domain.",
+          parameters: [idParam],
+          requestBody: jsonBody(ref("CreateOfferInput")),
+          responses: {
+            "201": jsonResponse(ref("DomainOffer"), "Created"),
+            "404": jsonResponse(ref("Error"), "Domain not found")
+          }
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        apiKey: { type: "apiKey", in: "header", name: "x-api-key" }
+      },
+      schemas: {
+        Error: {
+          type: "object",
+          properties: { error: { type: "string" }, reason: { type: "string" } },
+          required: ["error"]
+        },
+        HealthResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" },
+            latencyMs: { type: "number" }
+          },
+          required: ["status", "version", "mode"]
+        },
+        ReadyResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" },
+            pendingMigrations: { type: "array", items: { type: "string" } }
+          },
+          required: ["status", "version", "mode"]
+        },
+        VersionResponse: {
+          type: "object",
+          properties: {
+            status: { type: "string" },
+            version: { type: "string" },
+            mode: { type: "string" }
+          },
+          required: ["status", "version", "mode"]
+        },
+        DeleteResult: {
+          type: "object",
+          properties: { id: { type: "string" }, deleted: { type: "boolean" } },
+          required: ["id", "deleted"]
+        },
+        Domain: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            name: { type: "string" },
+            registrar: { type: "string", nullable: true },
+            status: { type: "string" },
+            registered_at: { type: "string", nullable: true },
+            expires_at: { type: "string", nullable: true },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number", nullable: true },
+            standard_price: { type: "number", nullable: true },
+            purchase_price: { type: "number", nullable: true },
+            purchase_date: { type: "string", nullable: true },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string", nullable: true },
+            ssl_issuer: { type: "string", nullable: true },
+            notes: { type: "string", nullable: true },
+            metadata: { type: "object", additionalProperties: true },
+            created_at: { type: "string" },
+            updated_at: { type: "string" }
+          },
+          required: ["id", "name", "status", "auto_renew", "is_premium", "created_at", "updated_at"]
+        },
+        DomainList: {
+          type: "object",
+          properties: {
+            domains: { type: "array", items: ref("Domain") },
+            count: { type: "integer" }
+          },
+          required: ["domains", "count"]
+        },
+        CreateDomainInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            registrar: { type: "string" },
+            status: { type: "string" },
+            registered_at: { type: "string" },
+            expires_at: { type: "string" },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number" },
+            standard_price: { type: "number" },
+            purchase_price: { type: "number" },
+            purchase_date: { type: "string" },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string" },
+            ssl_issuer: { type: "string" },
+            notes: { type: "string" },
+            metadata: { type: "object", additionalProperties: true }
+          },
+          required: ["name"]
+        },
+        UpdateDomainInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            registrar: { type: "string", nullable: true },
+            status: { type: "string" },
+            registered_at: { type: "string", nullable: true },
+            expires_at: { type: "string", nullable: true },
+            auto_renew: { type: "boolean" },
+            is_premium: { type: "boolean" },
+            premium_price: { type: "number", nullable: true },
+            standard_price: { type: "number", nullable: true },
+            purchase_price: { type: "number", nullable: true },
+            purchase_date: { type: "string", nullable: true },
+            nameservers: { type: "array", items: { type: "string" } },
+            whois: { type: "object", additionalProperties: true },
+            ssl_expires_at: { type: "string", nullable: true },
+            ssl_issuer: { type: "string", nullable: true },
+            notes: { type: "string", nullable: true },
+            metadata: { type: "object", additionalProperties: true }
+          }
+        },
+        DnsRecord: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            domain_id: { type: "string" },
+            type: { type: "string" },
+            name: { type: "string" },
+            value: { type: "string" },
+            ttl: { type: "integer" },
+            priority: { type: "integer", nullable: true },
+            created_at: { type: "string" }
+          },
+          required: ["id", "domain_id", "type", "name", "value", "ttl", "created_at"]
+        },
+        DnsRecordList: {
+          type: "object",
+          properties: {
+            records: { type: "array", items: ref("DnsRecord") },
+            count: { type: "integer" }
+          },
+          required: ["records", "count"]
+        },
+        CreateDnsRecordInput: {
+          type: "object",
+          properties: {
+            type: { type: "string", enum: ["A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV"] },
+            name: { type: "string" },
+            value: { type: "string" },
+            ttl: { type: "integer" },
+            priority: { type: "integer" }
+          },
+          required: ["type", "name", "value"]
+        },
+        DomainOffer: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            domain_id: { type: "string" },
+            our_offer: { type: "number", nullable: true },
+            their_ask: { type: "number", nullable: true },
+            status: { type: "string" },
+            notes: { type: "string", nullable: true },
+            created_at: { type: "string" }
+          },
+          required: ["id", "domain_id", "status", "created_at"]
+        },
+        OfferList: {
+          type: "object",
+          properties: {
+            offers: { type: "array", items: ref("DomainOffer") },
+            count: { type: "integer" }
+          },
+          required: ["offers", "count"]
+        },
+        CreateOfferInput: {
+          type: "object",
+          properties: {
+            our_offer: { type: "number" },
+            their_ask: { type: "number" },
+            status: { type: "string" },
+            notes: { type: "string" }
+          }
+        },
+        DomainStats: {
+          type: "object",
+          properties: {
+            total: { type: "integer" },
+            active: { type: "integer" },
+            expired: { type: "integer" },
+            transferring: { type: "integer" },
+            redemption: { type: "integer" },
+            auto_renew_enabled: { type: "integer" },
+            expiring_30_days: { type: "integer" },
+            ssl_expiring_30_days: { type: "integer" }
+          },
+          required: ["total"]
+        }
+      }
+    }
+  };
+}
+
+// src/server/app.ts
+async function readReadiness(db, knownIds) {
+  const start = Date.now();
+  try {
+    const rows = await db.many("SELECT id FROM schema_migrations");
+    const applied = new Set(rows.map((r) => r.id));
+    const pending = knownIds.filter((id) => !applied.has(id));
+    return { ok: pending.length === 0, pendingMigrations: pending, latencyMs: Date.now() - start };
+  } catch (e) {
+    return {
+      ok: false,
+      pendingMigrations: knownIds,
+      latencyMs: Date.now() - start,
+      error: e instanceof Error ? e.message : String(e)
+    };
+  }
+}
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...SECURITY_HEADERS }
+  });
+}
+function createServeApp(options) {
+  const { db, version } = options;
+  const mode2 = options.mode ?? "self_hosted";
+  const repo = new DomainsRepo(db);
+  const migrationIds = buildMigrations().map((m) => m.id);
+  const spec = buildOpenApiSpec(version);
+  const verifier = verifyApiKey({
+    app: "domains",
+    signingSecret: options.signingSecret,
+    ...options.isRevoked ? { isRevoked: options.isRevoked } : {},
+    ...options.audit ? { audit: options.audit } : {}
+  });
+  async function readBody(req) {
+    const text = await req.text();
+    if (!text)
+      return {};
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new HttpError(400, "invalid JSON body");
+    }
+  }
+  async function auth(req, path, scopes) {
+    const decision = await verifier.authenticate(req.headers, {
+      method: req.method,
+      path,
+      requiredScopes: scopes
+    });
+    if (decision.ok)
+      return null;
+    return json({ error: decision.message, reason: decision.reason }, decision.status);
+  }
+  async function handle(req) {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    const method = req.method;
+    try {
+      if (method === "GET" && path === "/health") {
+        const h = await checkHealth(db);
+        return json({ status: h.ok ? "ok" : "error", version, mode: mode2, latencyMs: h.latencyMs, ...h.error ? { error: h.error } : {} }, h.ok ? 200 : 503);
+      }
+      if (method === "GET" && path === "/ready") {
+        const r = await readReadiness(db, migrationIds);
+        return json({
+          status: r.ok ? "ok" : "not_ready",
+          version,
+          mode: mode2,
+          pendingMigrations: r.pendingMigrations,
+          ...r.error ? { error: r.error } : {}
+        }, r.ok ? 200 : 503);
+      }
+      if (method === "GET" && (path === "/version" || path === "/v1/version")) {
+        return json({ status: "ok", version, mode: mode2 });
+      }
+      if (method === "GET" && (path === "/openapi.json" || path === "/v1/openapi.json")) {
+        return json(spec);
+      }
+      if (path === "/v1/domains") {
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const domains = await repo.listDomains({
+            search: url.searchParams.get("search") ?? undefined,
+            status: url.searchParams.get("status") ?? undefined,
+            limit: url.searchParams.get("limit") ? Number(url.searchParams.get("limit")) : undefined,
+            offset: url.searchParams.get("offset") ? Number(url.searchParams.get("offset")) : undefined
+          });
+          return json({ domains, count: domains.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const domain = await repo.createDomain(await readBody(req));
+          return json(domain, 201);
+        }
+      }
+      if (method === "GET" && path === "/v1/stats") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        return json(await repo.getStats());
+      }
+      let m = path.match(/^\/v1\/domains\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const domain = await repo.getDomain(id);
+          return domain ? json(domain) : json({ error: "domain not found" }, 404);
+        }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const domain = await repo.updateDomain(id, await readBody(req));
+          return domain ? json(domain) : json({ error: "domain not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const deleted = await repo.deleteDomain(id);
+          return json({ id, deleted });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/dns$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const records = await repo.listDnsRecords(id);
+          return json({ records, count: records.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const record = await repo.createDnsRecord(id, await readBody(req));
+          return json(record, 201);
+        }
+      }
+      m = path.match(/^\/v1\/dns\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const record = await repo.getDnsRecord(id);
+          return record ? json(record) : json({ error: "dns record not found" }, 404);
+        }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const record = await repo.updateDnsRecord(id, await readBody(req));
+          return record ? json(record) : json({ error: "dns record not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const deleted = await repo.deleteDnsRecord(id);
+          return json({ id, deleted });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/offers$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const offers = await repo.listOffers(id);
+          return json({ offers, count: offers.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const offer = await repo.createOffer(id, await readBody(req));
+          return json(offer, 201);
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/alerts$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const alerts = await repo.listAlerts(id);
+          return json({ alerts, count: alerts.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createAlert(id, await readBody(req)), 201);
+        }
+      }
+      m = path.match(/^\/v1\/alerts\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const alert = await repo.getAlert(id);
+          return alert ? json(alert) : json({ error: "alert not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteAlert(id) });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/emails$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const emails = await repo.listEmailLinks(id);
+          return json({ emails, count: emails.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.linkEmail(id, await readBody(req)), 201);
+        }
+      }
+      m = path.match(/^\/v1\/emails\/([^/]+)$/);
+      if (m && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const link = await repo.getEmailLink(decodeURIComponent(m[1]));
+        return link ? json(link) : json({ error: "email link not found" }, 404);
+      }
+      m = path.match(/^\/v1\/offers\/([^/]+)$/);
+      if (m && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const offer = await repo.getOffer(decodeURIComponent(m[1]));
+        return offer ? json(offer) : json({ error: "offer not found" }, 404);
+      }
+      if (path === "/v1/owners-portfolio" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const domains = await repo.listDomainsWithOwners();
+        return json({ domains, count: domains.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/owners$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const owners = await repo.listOwnersForDomain(id);
+          return json({ owners, count: owners.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createOwner(id, await readBody(req)), 201);
+        }
+      }
+      if (path === "/v1/owners" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const owners = await repo.listOwners({
+          search: url.searchParams.get("search") ?? undefined,
+          source: url.searchParams.get("source") ?? undefined,
+          verified: url.searchParams.has("verified") ? url.searchParams.get("verified") === "true" : undefined
+        });
+        return json({ owners, count: owners.length });
+      }
+      m = path.match(/^\/v1\/owners\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const owner = await repo.getOwner(id);
+          return owner ? json(owner) : json({ error: "owner not found" }, 404);
+        }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const owner = await repo.updateOwner(id, await readBody(req));
+          return owner ? json(owner) : json({ error: "owner not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteOwner(id) });
+        }
+      }
+      if (path === "/v1/history-changes" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const domains = await repo.listHistoryChanges();
+        return json({ domains, count: domains.length });
+      }
+      if (path === "/v1/history" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const start = url.searchParams.get("start");
+        const end = url.searchParams.get("end");
+        if (!start || !end)
+          return json({ error: "start and end are required" }, 400);
+        const hist = await repo.listHistoryByDateRange(start, end, url.searchParams.get("domain") ?? undefined);
+        return json({ history: hist, count: hist.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/history$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const hist = await repo.listHistory(id, {
+            type: url.searchParams.get("type") ?? undefined,
+            limit: url.searchParams.get("limit") ? Number(url.searchParams.get("limit")) : undefined
+          });
+          return json({ history: hist, count: hist.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createHistory(id, await readBody(req)), 201);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteHistoryByDomain(id) });
+        }
+      }
+      m = path.match(/^\/v1\/history\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const entry = await repo.getHistory(id);
+          return entry ? json(entry) : json({ error: "history entry not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteHistory(id) });
+        }
+      }
+      if (path === "/v1/reputation" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const reputation = await repo.listReputation({
+          blacklisted: url.searchParams.get("blacklisted") === "true",
+          threshold: url.searchParams.get("threshold") ? Number(url.searchParams.get("threshold")) : undefined
+        });
+        return json({ reputation, count: reputation.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/reputation$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const rep = await repo.getReputation(id);
+          return rep ? json(rep) : json({ error: "reputation not found" }, 404);
+        }
+        if (method === "PUT" || method === "PATCH") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.upsertReputation(id, await readBody(req)));
+        }
+      }
+      m = path.match(/^\/v1\/reputation\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const rep = await repo.updateReputation(id, await readBody(req));
+          return rep ? json(rep) : json({ error: "reputation not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteReputation(id) });
+        }
+      }
+      return json({ error: "Not found" }, 404);
+    } catch (e) {
+      if (e instanceof HttpError)
+        return json({ error: e.message }, e.status);
+      const message = e instanceof Error ? e.message : String(e);
+      return json({ error: message }, 500);
+    }
+  }
+  return { handle };
+}
+
+// src/server/index.ts
+var DEFAULT_PORT = 8080;
+var SIGNING_KEY_ENVS = [
+  "HASNA_DOMAINS_API_SIGNING_KEY",
+  "HASNA_API_SIGNING_KEY",
+  "API_KEY_SIGNING_SECRET"
+];
+function normalizeEnv(env = process.env) {
+  if (!env["HASNA_DOMAINS_DATABASE_URL"] && env["DATABASE_URL"]) {
+    env["HASNA_DOMAINS_DATABASE_URL"] = env["DATABASE_URL"];
+  }
+  if (!env["HASNA_DOMAINS_STORAGE_MODE"] && env["HASNA_DOMAINS_DATABASE_URL"]) {
+    env["HASNA_DOMAINS_STORAGE_MODE"] = "cloud";
+  }
+}
+function resolveSigningSecret(env = process.env) {
+  for (const key of SIGNING_KEY_ENVS) {
+    const v = env[key]?.trim();
+    if (v)
+      return v;
+  }
+  throw new Error(`Missing API-key signing secret. Set ${SIGNING_KEY_ENVS[0]} (or ${SIGNING_KEY_ENVS[2]}).`);
+}
+function parseArg(name, fallback) {
+  const eq = process.argv.find((a) => a.startsWith(`${name}=`));
+  if (eq)
+    return eq.split("=")[1];
+  const idx = process.argv.indexOf(name);
+  if (idx >= 0 && process.argv[idx + 1])
+    return process.argv[idx + 1];
+  return fallback;
+}
+async function main() {
+  if (process.argv.includes("--version") || process.argv.includes("-V")) {
+    console.log(getPackageVersion());
+    return;
+  }
+  normalizeEnv();
+  const version = getPackageVersion();
+  const signingSecret = resolveSigningSecret();
+  const { client, connectionSource } = createCloudPoolFromEnv("domains", {
+    applicationName: "domains-serve",
+    max: 5
+  });
+  const store = new ApiKeyStore(client);
+  const app = createServeApp({
+    db: client,
+    signingSecret,
+    version,
+    mode: process.env["HASNA_APP_MODE"] ?? "self_hosted",
+    isRevoked: store.isRevoked,
+    audit: (e) => {
+      if (e.outcome === "deny") {
+        console.error(JSON.stringify({ level: "warn", event: "api_auth_deny", ...e }));
+      }
+    }
+  });
+  const port = Number(parseArg("--port", process.env["PORT"]) ?? DEFAULT_PORT) || DEFAULT_PORT;
+  const host = parseArg("--host", process.env["HOST"]) ?? "0.0.0.0";
+  Bun.serve({
+    port,
+    hostname: host,
+    idleTimeout: 30,
+    fetch: (req) => app.handle(req)
+  });
+  console.log(JSON.stringify({
+    level: "info",
+    event: "domains_serve_started",
+    version,
+    port,
+    host,
+    dsnSource: connectionSource
+  }));
+}
+if (import.meta.main) {
+  main().catch((err) => {
+    console.error(JSON.stringify({ level: "error", event: "domains_serve_fatal", error: err instanceof Error ? err.message : String(err) }));
+    process.exit(1);
+  });
+}
+export {
+  resolveSigningSecret,
+  normalizeEnv,
+  SIGNING_KEY_ENVS
+};