@hasna/domains 0.0.28 → 0.0.31

package/dist/server/index.js

@@ -1,8 +1,359 @@
 #!/usr/bin/env bun
 // @bun
 
-// src/server/index.ts
-import { ApiKeyStore } from "@hasna/contracts/auth";
+// node_modules/.pnpm/@hasna+contracts@0.5.2/node_modules/@hasna/contracts/dist/auth/index.js
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var API_KEY_TOKEN_VERSION = 1;
+var API_KEY_NAMESPACE = "hasna";
+var TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var DEFAULT_API_KEY_TTL_SECONDS = 90 * 24 * 60 * 60;
+function toBuffer(secret) {
+  return typeof secret === "string" ? Buffer.from(secret, "utf8") : secret;
+}
+function hmac(signingSecret, message) {
+  return createHmac("sha256", toBuffer(signingSecret)).update(message, "utf8").digest();
+}
+function apiKeyPrefix(app) {
+  return `${API_KEY_NAMESPACE}_${app}_`;
+}
+function parseApiKey(token) {
+  if (typeof token !== "string")
+    return null;
+  const match = TOKEN_PATTERN.exec(token);
+  if (!match)
+    return null;
+  const [, app, body, sig] = match;
+  if (!app || !body || !sig)
+    return null;
+  let claims;
+  try {
+    claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || !Array.isArray(claims.scopes)) {
+    return null;
+  }
+  return { app, body, sig, claims };
+}
+function verifyApiKeyToken(token, options) {
+  const parsed = parseApiKey(token);
+  if (!parsed) {
+    return { ok: false, reason: "malformed", message: "Token is malformed." };
+  }
+  const { app, body, sig, claims } = parsed;
+  if (claims.v !== API_KEY_TOKEN_VERSION) {
+    return { ok: false, reason: "unsupported_version", message: `Unsupported token version ${claims.v}.` };
+  }
+  if (claims.app !== app) {
+    return { ok: false, reason: "app_mismatch", message: "Token prefix app does not match claims." };
+  }
+  if (options.expectedApp !== undefined && app !== options.expectedApp) {
+    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${options.expectedApp}'.` };
+  }
+  const expected = hmac(options.signingSecret, `${apiKeyPrefix(app)}${body}`);
+  let provided;
+  try {
+    provided = Buffer.from(sig, "base64url");
+  } catch {
+    return { ok: false, reason: "bad_signature", message: "Signature is not valid base64url." };
+  }
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+    return { ok: false, reason: "bad_signature", message: "Signature verification failed." };
+  }
+  const now = Math.floor((options.nowMs ?? Date.now()) / 1000);
+  const leeway = options.leewaySeconds ?? 0;
+  if (typeof claims.iat === "number" && now + leeway < claims.iat) {
+    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid." };
+  }
+  if (claims.exp !== null && typeof claims.exp === "number" && now - leeway >= claims.exp) {
+    return { ok: false, reason: "expired", message: "Token has expired." };
+  }
+  if (options.requiredScopes && options.requiredScopes.length > 0) {
+    const granted = claims.scopes;
+    const satisfies = (required) => granted.some((g) => {
+      if (g === "*")
+        return true;
+      const gi = g.indexOf(":");
+      const ri = required.indexOf(":");
+      if (gi < 0 || ri < 0)
+        return false;
+      const gApp = g.slice(0, gi);
+      const gAction = g.slice(gi + 1);
+      const rApp = required.slice(0, ri);
+      const rAction = required.slice(ri + 1);
+      return (gApp === "*" || gApp === rApp) && (gAction === "*" || gAction === rAction);
+    });
+    for (const required of options.requiredScopes) {
+      if (!satisfies(required)) {
+        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.` };
+      }
+    }
+  }
+  return { ok: true, claims, kid: claims.kid, app };
+}
+var DEFAULT_API_KEYS_TABLE = "api_keys";
+function createTableSql(table) {
+  return `CREATE TABLE IF NOT EXISTS ${table} (
+    kid TEXT PRIMARY KEY,
+    app TEXT NOT NULL,
+    agent TEXT,
+    scopes JSONB NOT NULL,
+    token_hash TEXT NOT NULL UNIQUE,
+    issued_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ,
+    revoked_reason TEXT,
+    last_used_at TIMESTAMPTZ,
+    created_by TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+  )`;
+}
+function apiKeyMigrations(table = DEFAULT_API_KEYS_TABLE) {
+  return [
+    { id: `hasna_auth_0001_${table}`, sql: createTableSql(table) },
+    {
+      id: `hasna_auth_0002_${table}_indexes`,
+      sql: `CREATE INDEX IF NOT EXISTS ${table}_app_idx ON ${table} (app);
+            CREATE INDEX IF NOT EXISTS ${table}_token_hash_idx ON ${table} (token_hash);`
+    }
+  ];
+}
+function toIso(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (value instanceof Date)
+    return value.toISOString();
+  return new Date(String(value)).toISOString();
+}
+function parseScopes(value) {
+  if (Array.isArray(value))
+    return value.map((v) => String(v));
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return Array.isArray(parsed) ? parsed.map((v) => String(v)) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+function rowToRecord(row) {
+  return {
+    kid: String(row.kid),
+    app: String(row.app),
+    agent: row.agent === null || row.agent === undefined ? null : String(row.agent),
+    scopes: parseScopes(row.scopes),
+    tokenHash: String(row.token_hash),
+    issuedAt: toIso(row.issued_at) ?? new Date(0).toISOString(),
+    expiresAt: toIso(row.expires_at),
+    revokedAt: toIso(row.revoked_at),
+    revokedReason: row.revoked_reason === null || row.revoked_reason === undefined ? null : String(row.revoked_reason),
+    lastUsedAt: toIso(row.last_used_at),
+    createdBy: row.created_by === null || row.created_by === undefined ? null : String(row.created_by)
+  };
+}
+
+class ApiKeyStore {
+  client;
+  table;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.table = options.table ?? DEFAULT_API_KEYS_TABLE;
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(this.table)) {
+      throw new Error(`Invalid api-keys table name '${this.table}'.`);
+    }
+  }
+  migrations() {
+    return apiKeyMigrations(this.table);
+  }
+  async ensureSchema() {
+    for (const migration of this.migrations()) {
+      await this.client.execute(migration.sql);
+    }
+  }
+  async insert(input) {
+    await this.client.execute(`INSERT INTO ${this.table}
+         (kid, app, agent, scopes, token_hash, issued_at, expires_at, created_by)
+       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)`, [
+      input.kid,
+      input.app,
+      input.agent ?? null,
+      JSON.stringify(input.scopes),
+      input.tokenHash,
+      input.issuedAt.toISOString(),
+      input.expiresAt ? input.expiresAt.toISOString() : null,
+      input.createdBy ?? null
+    ]);
+  }
+  async insertMinted(minted, createdBy) {
+    const claims = minted.claims;
+    await this.insert({
+      kid: minted.kid,
+      app: claims.app,
+      agent: claims.agent ?? null,
+      scopes: claims.scopes,
+      tokenHash: minted.tokenHash,
+      issuedAt: new Date(claims.iat * 1000),
+      expiresAt: claims.exp === null ? null : new Date(claims.exp * 1000),
+      createdBy: createdBy ?? null
+    });
+  }
+  async findByKid(kid) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE kid = $1`, [kid]);
+    return row ? rowToRecord(row) : null;
+  }
+  async findByTokenHash(tokenHash) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE token_hash = $1`, [tokenHash]);
+    return row ? rowToRecord(row) : null;
+  }
+  isRevoked = async (kid) => {
+    const row = await this.client.get(`SELECT revoked_at FROM ${this.table} WHERE kid = $1`, [kid]);
+    if (!row)
+      return false;
+    return row.revoked_at !== null && row.revoked_at !== undefined;
+  };
+  async status(kid, nowMs = Date.now()) {
+    const record = await this.findByKid(kid);
+    if (!record)
+      return "unknown";
+    if (record.revokedAt)
+      return "revoked";
+    if (record.expiresAt && new Date(record.expiresAt).getTime() <= nowMs)
+      return "expired";
+    return "active";
+  }
+  statusChecker() {
+    return async (kid) => {
+      const status = await this.status(kid);
+      return status !== "active";
+    };
+  }
+  async revoke(kid, reason, atMs = Date.now()) {
+    const row = await this.client.get(`UPDATE ${this.table}
+          SET revoked_at = COALESCE(revoked_at, $2), revoked_reason = COALESCE(revoked_reason, $3)
+        WHERE kid = $1
+      RETURNING kid`, [kid, new Date(atMs).toISOString(), reason ?? null]);
+    return row !== null;
+  }
+  async touchLastUsed(kid, atMs = Date.now()) {
+    await this.client.execute(`UPDATE ${this.table} SET last_used_at = $2 WHERE kid = $1`, [
+      kid,
+      new Date(atMs).toISOString()
+    ]);
+  }
+  async list(options = {}) {
+    const clauses = [];
+    const params = [];
+    if (options.app) {
+      params.push(options.app);
+      clauses.push(`app = $${params.length}`);
+    }
+    if (!options.includeRevoked) {
+      clauses.push("revoked_at IS NULL");
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`);
+    return rows.map(rowToRecord);
+  }
+  async revokedKids() {
+    const rows = await this.client.many(`SELECT kid FROM ${this.table} WHERE revoked_at IS NOT NULL`);
+    return rows.map((row) => String(row.kid));
+  }
+}
+function readHeader(source, name) {
+  const lower = name.toLowerCase();
+  if (typeof source === "function") {
+    return source(name) ?? source(lower) ?? null;
+  }
+  if (typeof Headers !== "undefined" && source instanceof Headers) {
+    return source.get(name);
+  }
+  const record = source;
+  const value = record[name] ?? record[lower] ?? record[name.toUpperCase()];
+  if (Array.isArray(value))
+    return value[0] ?? null;
+  return value ?? null;
+}
+function extractToken(source, headerName = "x-api-key", scheme = "Bearer") {
+  const direct = readHeader(source, headerName);
+  if (direct && direct.trim().length > 0)
+    return direct.trim();
+  const authz = readHeader(source, "authorization");
+  if (authz) {
+    const prefix = `${scheme} `;
+    if (authz.toLowerCase().startsWith(prefix.toLowerCase())) {
+      const token = authz.slice(prefix.length).trim();
+      if (token.length > 0)
+        return token;
+    }
+  }
+  return null;
+}
+function verifyApiKey(options) {
+  if (!options.app)
+    throw new Error("verifyApiKey requires an 'app' slug.");
+  if (!options.signingSecret) {
+    throw new Error("verifyApiKey requires a 'signingSecret'. Set it from HASNA_<APP>_API_SIGNING_KEY.");
+  }
+  const headerName = options.headerName ?? "x-api-key";
+  const scheme = options.scheme ?? "Bearer";
+  const clock = options.nowMs ?? (() => Date.now());
+  async function emit(event) {
+    if (!options.audit)
+      return;
+    try {
+      await options.audit(event);
+    } catch {}
+  }
+  async function authenticate(headers, context = {}) {
+    const method = context.method ?? null;
+    const path = context.path ?? null;
+    const requiredScopes = [...options.requiredScopes ?? [], ...context.requiredScopes ?? []];
+    const at = new Date(clock()).toISOString();
+    const token = extractToken(headers, headerName, scheme);
+    if (!token) {
+      const decision = {
+        ok: false,
+        status: 401,
+        reason: "missing_token",
+        message: `Missing API key. Send it as '${headerName}: <key>' or 'Authorization: ${scheme} <key>'.`
+      };
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
+      return decision;
+    }
+    const verified = verifyApiKeyToken(token, {
+      signingSecret: options.signingSecret,
+      expectedApp: options.app,
+      nowMs: clock(),
+      ...options.leewaySeconds !== undefined ? { leewaySeconds: options.leewaySeconds } : {},
+      requiredScopes
+    });
+    if (!verified.ok) {
+      const status = verified.reason === "insufficient_scope" ? 403 : 401;
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: verified.reason, scopesRequired: requiredScopes, method, path, status, at });
+      return { ok: false, status, reason: verified.reason, message: verified.message };
+    }
+    if (options.isRevoked) {
+      const revoked = await options.isRevoked(verified.kid);
+      if (revoked) {
+        await emit({ outcome: "deny", app: options.app, kid: verified.kid, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
+        return { ok: false, status: 401, reason: "revoked", message: "API key has been revoked." };
+      }
+    }
+    const principal = {
+      kid: verified.kid,
+      app: verified.app,
+      scopes: verified.claims.scopes,
+      agent: verified.claims.agent ?? null,
+      claims: verified.claims
+    };
+    await emit({ outcome: "allow", app: options.app, kid: verified.kid, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
+    return { ok: true, status: 200, principal };
+  }
+  return { authenticate, app: options.app };
+}
 
 // src/generated/storage-kit/mode.ts
 var DEPRECATED_STORAGE_MODE_ALIASES = [
@@ -228,11 +579,11 @@ function createCloudPoolFromEnv(appName, options = {}) {
   };
 }
 // src/generated/storage-kit/migrations.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function checksumSql(sql) {
   const normalized = sql.trim().replace(/\r\n/g, `
 `);
-  return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
+  return `sha256:${createHash2("sha256").update(normalized).digest("hex")}`;
 }
 function defineMigration(id, sql) {
   return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
@@ -271,9 +622,6 @@ function getPackageVersion() {
 }
 var USER_AGENT = `open-domains/${getPackageVersion()}`;
 
-// src/server/app.ts
-import { verifyApiKey } from "@hasna/contracts/auth";
-
 // src/db/domain-records.ts
 var DOMAIN_STATUSES = [
   "discovered",
@@ -290,6 +638,29 @@ var DOMAIN_STATUSES = [
   "redemption"
 ];
 var DOMAIN_OFFER_STATUSES = ["pending", "accepted", "rejected", "countered"];
+var DOMAIN_EMAIL_TYPES = [
+  "inquiry",
+  "offer",
+  "counter_offer",
+  "confirmation",
+  "renewal_notice",
+  "transfer"
+];
+
+// src/db/domain-owners.ts
+var DOMAIN_OWNER_SOURCES = ["whois", "manual", "brandsight", "import"];
+
+// src/db/domain-history.ts
+var HISTORY_TYPES = [
+  "whois",
+  "rdap",
+  "dns",
+  "ssl",
+  "reputation",
+  "exa_research",
+  "purchase",
+  "renewal"
+];
 
 // src/server/repo.ts
 function parseJson(value, fallback) {
@@ -584,11 +955,406 @@ class DomainsRepo {
     ]);
     return row;
   }
+  async getOffer(id) {
+    const row = await this.db.get("SELECT * FROM domain_offers WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async updateDnsRecord(id, patch) {
+    const existing = await this.getDnsRecord(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    if (patch.type !== undefined) {
+      if (!DNS_TYPES.includes(patch.type)) {
+        throw new HttpError(400, `dns record 'type' must be one of ${DNS_TYPES.join(", ")}`);
+      }
+      setCol("type", patch.type);
+    }
+    if (patch.name !== undefined)
+      setCol("name", patch.name);
+    if (patch.value !== undefined)
+      setCol("value", patch.value);
+    if (patch.ttl !== undefined)
+      setCol("ttl", patch.ttl);
+    if (patch.priority !== undefined)
+      setCol("priority", patch.priority ?? null);
+    if (sets.length === 0)
+      return existing;
+    params.push(id);
+    const row = await this.db.get(`UPDATE dns_records SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? rowToDnsRecord(row) : null;
+  }
+  async listEmailLinks(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_emails WHERE domain_id = $1 ORDER BY created_at ASC", [domainId]);
+    return rows;
+  }
+  async getEmailLink(id) {
+    const row = await this.db.get("SELECT * FROM domain_emails WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async linkEmail(domainId, input) {
+    if (!DOMAIN_EMAIL_TYPES.includes(input.type)) {
+      throw new HttpError(400, `invalid email link type '${input.type}'`);
+    }
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const existing = await this.db.get("SELECT id, thread_id FROM domain_emails WHERE domain_id = $1 AND email_id = $2", [domainId, input.email_id]);
+    if (existing) {
+      const row2 = await this.db.get("UPDATE domain_emails SET thread_id = $1, type = $2 WHERE id = $3 RETURNING *", [input.thread_id ?? existing.thread_id ?? null, input.type, existing.id]);
+      return row2;
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_emails (id, domain_id, email_id, thread_id, type, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6) RETURNING *`, [id, domainId, input.email_id, input.thread_id ?? null, input.type, new Date().toISOString()]);
+    return row;
+  }
+  async listAlerts(domainId) {
+    const rows = await this.db.many("SELECT * FROM alerts WHERE domain_id = $1 ORDER BY type, trigger_days_before", [domainId]);
+    return rows;
+  }
+  async getAlert(id) {
+    const row = await this.db.get("SELECT * FROM alerts WHERE id = $1", [id]);
+    return row ? row : null;
+  }
+  async createAlert(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    if (!["expiry", "ssl_expiry", "dns_change"].includes(input.type)) {
+      throw new HttpError(400, `invalid alert type '${input.type}'`);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO alerts (id, domain_id, type, trigger_days_before, created_at)
+       VALUES ($1,$2,$3,$4,$5) RETURNING *`, [id, domainId, input.type, input.trigger_days_before ?? null, new Date().toISOString()]);
+    return row;
+  }
+  async deleteAlert(id) {
+    const result = await this.db.query("DELETE FROM alerts WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  ownerRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      contact_id: row["contact_id"] ?? null,
+      owner_name: row["owner_name"] ?? null,
+      owner_email: row["owner_email"] ?? null,
+      owner_phone: row["owner_phone"] ?? null,
+      owner_organization: row["owner_organization"] ?? null,
+      source: row["source"],
+      verified: Boolean(row["verified"]),
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"],
+      updated_at: row["updated_at"]
+    };
+  }
+  async listOwnersForDomain(domainId) {
+    const rows = await this.db.many("SELECT * FROM domain_owners WHERE domain_id = $1 ORDER BY created_at DESC", [domainId]);
+    return rows.map((r) => this.ownerRow(r));
+  }
+  async listOwners(opts) {
+    const clauses = [];
+    const params = [];
+    if (opts.search) {
+      params.push(`%${opts.search}%`);
+      const p = `$${params.length}`;
+      clauses.push(`(owner_name ILIKE ${p} OR owner_email ILIKE ${p} OR owner_organization ILIKE ${p} OR notes ILIKE ${p})`);
+    }
+    if (opts.source) {
+      params.push(opts.source);
+      clauses.push(`source = $${params.length}`);
+    }
+    if (opts.verified !== undefined) {
+      params.push(opts.verified);
+      clauses.push(`verified = $${params.length}`);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = await this.db.many(`SELECT * FROM domain_owners ${where} ORDER BY created_at DESC`, params);
+    return rows.map((r) => this.ownerRow(r));
+  }
+  async getOwner(id) {
+    const row = await this.db.get("SELECT * FROM domain_owners WHERE id = $1", [id]);
+    return row ? this.ownerRow(row) : null;
+  }
+  async createOwner(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const source = input.source ?? "manual";
+    if (!DOMAIN_OWNER_SOURCES.includes(source))
+      throw new HttpError(400, `invalid owner source '${source}'`);
+    const id = crypto.randomUUID();
+    const now = new Date().toISOString();
+    const row = await this.db.get(`INSERT INTO domain_owners (id, domain_id, contact_id, owner_name, owner_email, owner_phone, owner_organization, source, verified, notes, created_at, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING *`, [
+      id,
+      domainId,
+      input.contact_id ?? null,
+      input.owner_name ?? null,
+      input.owner_email ?? null,
+      input.owner_phone ?? null,
+      input.owner_organization ?? null,
+      source,
+      input.verified ?? false,
+      input.notes ?? null,
+      now,
+      now
+    ]);
+    return this.ownerRow(row);
+  }
+  async updateOwner(id, patch) {
+    const existing = await this.getOwner(id);
+    if (!existing)
+      return null;
+    const sets = [];
+    const params = [];
+    const setCol = (col, val) => {
+      params.push(val);
+      sets.push(`${col} = $${params.length}`);
+    };
+    if (patch.contact_id !== undefined)
+      setCol("contact_id", patch.contact_id ?? null);
+    if (patch.owner_name !== undefined)
+      setCol("owner_name", patch.owner_name ?? null);
+    if (patch.owner_email !== undefined)
+      setCol("owner_email", patch.owner_email ?? null);
+    if (patch.owner_phone !== undefined)
+      setCol("owner_phone", patch.owner_phone ?? null);
+    if (patch.owner_organization !== undefined)
+      setCol("owner_organization", patch.owner_organization ?? null);
+    if (patch.source !== undefined)
+      setCol("source", patch.source);
+    if (patch.verified !== undefined)
+      setCol("verified", Boolean(patch.verified));
+    if (patch.notes !== undefined)
+      setCol("notes", patch.notes ?? null);
+    if (sets.length === 0)
+      return existing;
+    setCol("updated_at", new Date().toISOString());
+    params.push(id);
+    const row = await this.db.get(`UPDATE domain_owners SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+    return row ? this.ownerRow(row) : null;
+  }
+  async deleteOwner(id) {
+    const result = await this.db.query("DELETE FROM domain_owners WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listDomainsWithOwners() {
+    const rows = await this.db.many(`SELECT d.name as domain_name, d.status as domain_status, d.is_premium, d.premium_price,
+              o.owner_name, o.owner_email, o.owner_organization, o.contact_id, o.source, o.verified
+         FROM domains d
+         LEFT JOIN domain_owners o ON d.id = o.domain_id
+        WHERE o.id IS NOT NULL OR d.is_premium = true
+           OR d.status IN ('premium_only','not_available','negotiating','offered','researching')
+        ORDER BY d.name`);
+    return rows.map((r) => ({
+      domain_name: r["domain_name"],
+      domain_status: r["domain_status"],
+      is_premium: Boolean(r["is_premium"]),
+      premium_price: r["premium_price"] ?? null,
+      owner_name: r["owner_name"] ?? null,
+      owner_email: r["owner_email"] ?? null,
+      owner_organization: r["owner_organization"] ?? null,
+      contact_id: r["contact_id"] ?? null,
+      source: r["source"] ?? null,
+      verified: Boolean(r["verified"])
+    }));
+  }
+  historyRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      snapshot_type: row["snapshot_type"],
+      raw_data: parseJson(row["raw_data"], {}),
+      registrant_name: row["registrant_name"] ?? null,
+      registrant_email: row["registrant_email"] ?? null,
+      registrant_org: row["registrant_org"] ?? null,
+      nameservers: parseJson(row["nameservers"], []),
+      registrar: row["registrar"] ?? null,
+      status: row["status"] ?? null,
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"]
+    };
+  }
+  async createHistory(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    if (!HISTORY_TYPES.includes(input.snapshot_type))
+      throw new HttpError(400, `invalid snapshot_type '${input.snapshot_type}'`);
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_history (id, domain_id, snapshot_type, raw_data, registrant_name, registrant_email, registrant_org, nameservers, registrar, status, notes, created_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) RETURNING *`, [
+      id,
+      domainId,
+      input.snapshot_type,
+      JSON.stringify(input.raw_data ?? {}),
+      input.registrant_name ?? null,
+      input.registrant_email ?? null,
+      input.registrant_org ?? null,
+      JSON.stringify(input.nameservers ?? []),
+      input.registrar ?? null,
+      input.status ?? null,
+      input.notes ?? null,
+      new Date().toISOString()
+    ]);
+    return this.historyRow(row);
+  }
+  async getHistory(id) {
+    const row = await this.db.get("SELECT * FROM domain_history WHERE id = $1", [id]);
+    return row ? this.historyRow(row) : null;
+  }
+  async listHistory(domainId, opts) {
+    const clauses = ["domain_id = $1"];
+    const params = [domainId];
+    if (opts.type) {
+      params.push(opts.type);
+      clauses.push(`snapshot_type = $${params.length}`);
+    }
+    let sql = `SELECT * FROM domain_history WHERE ${clauses.join(" AND ")} ORDER BY created_at DESC`;
+    if (opts.limit) {
+      params.push(Math.min(Math.max(opts.limit, 1), 1000));
+      sql += ` LIMIT $${params.length}`;
+    }
+    const rows = await this.db.many(sql, params);
+    return rows.map((r) => this.historyRow(r));
+  }
+  async listHistoryByDateRange(start, end, domainId) {
+    const clauses = ["created_at BETWEEN $1 AND $2"];
+    const params = [start, end];
+    if (domainId) {
+      params.push(domainId);
+      clauses.push(`domain_id = $${params.length}`);
+    }
+    const rows = await this.db.many(`SELECT * FROM domain_history WHERE ${clauses.join(" AND ")} ORDER BY created_at DESC`, params);
+    return rows.map((r) => this.historyRow(r));
+  }
+  async deleteHistory(id) {
+    const result = await this.db.query("DELETE FROM domain_history WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async deleteHistoryByDomain(domainId) {
+    const result = await this.db.query("DELETE FROM domain_history WHERE domain_id = $1", [domainId]);
+    return result.rowCount > 0;
+  }
+  async listHistoryChanges() {
+    const rows = await this.db.many(`SELECT d.id as domain_id, d.name as domain_name,
+              (SELECT snapshot_type FROM domain_history h2 WHERE h2.domain_id = d.id ORDER BY created_at DESC LIMIT 1) as latest_snapshot_type,
+              MAX(h.created_at) as latest_snapshot_at,
+              COUNT(h.id)::text as snapshot_count
+         FROM domains d JOIN domain_history h ON d.id = h.domain_id
+        GROUP BY d.id ORDER BY latest_snapshot_at DESC`);
+    return rows.map((r) => ({
+      domain_id: r["domain_id"],
+      domain_name: r["domain_name"],
+      latest_snapshot_type: r["latest_snapshot_type"],
+      latest_snapshot_at: r["latest_snapshot_at"],
+      snapshot_count: parseInt(r["snapshot_count"] ?? "0", 10)
+    }));
+  }
+  reputationRow(row) {
+    return {
+      id: row["id"],
+      domain_id: row["domain_id"],
+      is_blacklisted: Boolean(row["is_blacklisted"]),
+      blacklist_sources: parseJson(row["blacklist_sources"], []),
+      threat_score: row["threat_score"] ?? null,
+      spam_score: row["spam_score"] ?? null,
+      malware_detected: Boolean(row["malware_detected"]),
+      phishing_detected: Boolean(row["phishing_detected"]),
+      reputation_sources: parseJson(row["reputation_sources"], []),
+      last_checked_at: row["last_checked_at"] ?? null,
+      notes: row["notes"] ?? null,
+      created_at: row["created_at"],
+      updated_at: row["updated_at"]
+    };
+  }
+  async getReputation(domainId) {
+    const row = await this.db.get("SELECT * FROM domain_reputation WHERE domain_id = $1", [domainId]);
+    return row ? this.reputationRow(row) : null;
+  }
+  async upsertReputation(domainId, input) {
+    const domain = await this.getDomain(domainId);
+    if (!domain)
+      throw new HttpError(404, `domain '${domainId}' not found`);
+    const existing = await this.getReputation(domainId);
+    const now = new Date().toISOString();
+    if (existing) {
+      const sets = [];
+      const params = [];
+      const setCol = (col, val) => {
+        params.push(val);
+        sets.push(`${col} = $${params.length}`);
+      };
+      if (input.is_blacklisted !== undefined)
+        setCol("is_blacklisted", Boolean(input.is_blacklisted));
+      if (input.blacklist_sources !== undefined)
+        setCol("blacklist_sources", JSON.stringify(input.blacklist_sources));
+      if (input.threat_score !== undefined)
+        setCol("threat_score", input.threat_score);
+      if (input.spam_score !== undefined)
+        setCol("spam_score", input.spam_score);
+      if (input.malware_detected !== undefined)
+        setCol("malware_detected", Boolean(input.malware_detected));
+      if (input.phishing_detected !== undefined)
+        setCol("phishing_detected", Boolean(input.phishing_detected));
+      if (input.reputation_sources !== undefined)
+        setCol("reputation_sources", JSON.stringify(input.reputation_sources));
+      if (input.last_checked_at !== undefined)
+        setCol("last_checked_at", input.last_checked_at);
+      if (input.notes !== undefined)
+        setCol("notes", input.notes);
+      setCol("updated_at", now);
+      params.push(existing.id);
+      const row2 = await this.db.get(`UPDATE domain_reputation SET ${sets.join(", ")} WHERE id = $${params.length} RETURNING *`, params);
+      return this.reputationRow(row2);
+    }
+    const id = crypto.randomUUID();
+    const row = await this.db.get(`INSERT INTO domain_reputation (id, domain_id, is_blacklisted, blacklist_sources, threat_score, spam_score, malware_detected, phishing_detected, reputation_sources, last_checked_at, notes, created_at, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13) RETURNING *`, [
+      id,
+      domainId,
+      input.is_blacklisted ?? false,
+      JSON.stringify(input.blacklist_sources ?? []),
+      input.threat_score ?? null,
+      input.spam_score ?? null,
+      input.malware_detected ?? false,
+      input.phishing_detected ?? false,
+      JSON.stringify(input.reputation_sources ?? []),
+      input.last_checked_at ?? null,
+      input.notes ?? null,
+      now,
+      now
+    ]);
+    return this.reputationRow(row);
+  }
+  async updateReputation(id, patch) {
+    const existing = await this.db.get("SELECT * FROM domain_reputation WHERE id = $1", [id]);
+    if (!existing)
+      return null;
+    return this.upsertReputation(existing["domain_id"], patch);
+  }
+  async deleteReputation(id) {
+    const result = await this.db.query("DELETE FROM domain_reputation WHERE id = $1", [id]);
+    return result.rowCount > 0;
+  }
+  async listReputation(opts) {
+    if (opts.blacklisted) {
+      const rows2 = await this.db.many("SELECT * FROM domain_reputation WHERE is_blacklisted = true ORDER BY updated_at DESC");
+      return rows2.map((r) => this.reputationRow(r));
+    }
+    const threshold = opts.threshold ?? 70;
+    const rows = await this.db.many("SELECT * FROM domain_reputation WHERE threat_score >= $1 ORDER BY threat_score DESC", [threshold]);
+    return rows.map((r) => this.reputationRow(r));
+  }
 }
 
-// src/server/migrations.ts
-import { apiKeyMigrations } from "@hasna/contracts/auth";
-
 // src/db/pg-migrations.ts
 var PG_MIGRATIONS = [
   `CREATE TABLE IF NOT EXISTS domains (
@@ -1260,6 +2026,13 @@ function createServeApp(options) {
           const record = await repo.getDnsRecord(id);
           return record ? json(record) : json({ error: "dns record not found" }, 404);
         }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const record = await repo.updateDnsRecord(id, await readBody(req));
+          return record ? json(record) : json({ error: "dns record not found" }, 404);
+        }
         if (method === "DELETE") {
           const denied = await auth(req, path, ["domains:write"]);
           if (denied)
@@ -1286,6 +2059,237 @@ function createServeApp(options) {
           return json(offer, 201);
         }
       }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/alerts$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const alerts = await repo.listAlerts(id);
+          return json({ alerts, count: alerts.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createAlert(id, await readBody(req)), 201);
+        }
+      }
+      m = path.match(/^\/v1\/alerts\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const alert = await repo.getAlert(id);
+          return alert ? json(alert) : json({ error: "alert not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteAlert(id) });
+        }
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/emails$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const emails = await repo.listEmailLinks(id);
+          return json({ emails, count: emails.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.linkEmail(id, await readBody(req)), 201);
+        }
+      }
+      m = path.match(/^\/v1\/emails\/([^/]+)$/);
+      if (m && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const link = await repo.getEmailLink(decodeURIComponent(m[1]));
+        return link ? json(link) : json({ error: "email link not found" }, 404);
+      }
+      m = path.match(/^\/v1\/offers\/([^/]+)$/);
+      if (m && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const offer = await repo.getOffer(decodeURIComponent(m[1]));
+        return offer ? json(offer) : json({ error: "offer not found" }, 404);
+      }
+      if (path === "/v1/owners-portfolio" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const domains = await repo.listDomainsWithOwners();
+        return json({ domains, count: domains.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/owners$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const owners = await repo.listOwnersForDomain(id);
+          return json({ owners, count: owners.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createOwner(id, await readBody(req)), 201);
+        }
+      }
+      if (path === "/v1/owners" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const owners = await repo.listOwners({
+          search: url.searchParams.get("search") ?? undefined,
+          source: url.searchParams.get("source") ?? undefined,
+          verified: url.searchParams.has("verified") ? url.searchParams.get("verified") === "true" : undefined
+        });
+        return json({ owners, count: owners.length });
+      }
+      m = path.match(/^\/v1\/owners\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const owner = await repo.getOwner(id);
+          return owner ? json(owner) : json({ error: "owner not found" }, 404);
+        }
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const owner = await repo.updateOwner(id, await readBody(req));
+          return owner ? json(owner) : json({ error: "owner not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteOwner(id) });
+        }
+      }
+      if (path === "/v1/history-changes" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const domains = await repo.listHistoryChanges();
+        return json({ domains, count: domains.length });
+      }
+      if (path === "/v1/history" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const start = url.searchParams.get("start");
+        const end = url.searchParams.get("end");
+        if (!start || !end)
+          return json({ error: "start and end are required" }, 400);
+        const hist = await repo.listHistoryByDateRange(start, end, url.searchParams.get("domain") ?? undefined);
+        return json({ history: hist, count: hist.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/history$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const hist = await repo.listHistory(id, {
+            type: url.searchParams.get("type") ?? undefined,
+            limit: url.searchParams.get("limit") ? Number(url.searchParams.get("limit")) : undefined
+          });
+          return json({ history: hist, count: hist.length });
+        }
+        if (method === "POST") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.createHistory(id, await readBody(req)), 201);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteHistoryByDomain(id) });
+        }
+      }
+      m = path.match(/^\/v1\/history\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const entry = await repo.getHistory(id);
+          return entry ? json(entry) : json({ error: "history entry not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteHistory(id) });
+        }
+      }
+      if (path === "/v1/reputation" && method === "GET") {
+        const denied = await auth(req, path, ["domains:read"]);
+        if (denied)
+          return denied;
+        const reputation = await repo.listReputation({
+          blacklisted: url.searchParams.get("blacklisted") === "true",
+          threshold: url.searchParams.get("threshold") ? Number(url.searchParams.get("threshold")) : undefined
+        });
+        return json({ reputation, count: reputation.length });
+      }
+      m = path.match(/^\/v1\/domains\/([^/]+)\/reputation$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "GET") {
+          const denied = await auth(req, path, ["domains:read"]);
+          if (denied)
+            return denied;
+          const rep = await repo.getReputation(id);
+          return rep ? json(rep) : json({ error: "reputation not found" }, 404);
+        }
+        if (method === "PUT" || method === "PATCH") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json(await repo.upsertReputation(id, await readBody(req)));
+        }
+      }
+      m = path.match(/^\/v1\/reputation\/([^/]+)$/);
+      if (m) {
+        const id = decodeURIComponent(m[1]);
+        if (method === "PATCH" || method === "PUT") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          const rep = await repo.updateReputation(id, await readBody(req));
+          return rep ? json(rep) : json({ error: "reputation not found" }, 404);
+        }
+        if (method === "DELETE") {
+          const denied = await auth(req, path, ["domains:write"]);
+          if (denied)
+            return denied;
+          return json({ id, deleted: await repo.deleteReputation(id) });
+        }
+      }
       return json({ error: "Not found" }, 404);
     } catch (e) {
       if (e instanceof HttpError)