@hasna/domains 0.0.39 → 0.0.43

package/dist/server/index.js

@@ -1,14 +1,90 @@
 #!/usr/bin/env bun
 // @bun
 
-// node_modules/@hasna/contracts/dist/auth/index.js
+// ../contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var MAX_TENANT_ID_LENGTH = 64;
+var TENANT_ID_PATTERN = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${MAX_TENANT_ID_LENGTH - 1}}$`);
+var UUID_HEX = "[0-9a-fA-F]";
+var UUID_PATTERN = new RegExp(`^\\{?(?:${UUID_HEX}{8}-${UUID_HEX}{4}-${UUID_HEX}{4}-${UUID_HEX}{4}-${UUID_HEX}{12}|${UUID_HEX}{32})\\}?$`);
+function isValidTenantId(value) {
+  return typeof value === "string" && TENANT_ID_PATTERN.test(value);
+}
+function isUuidTenantId(value) {
+  return typeof value === "string" && UUID_PATTERN.test(value);
+}
+function canonicalizeTenantId(value) {
+  if (!isUuidTenantId(value))
+    return value;
+  const hex = value.replace(/[{}-]/g, "").toLowerCase();
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function normalizeTenantId(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  const canonical = canonicalizeTenantId(trimmed);
+  if (!isValidTenantId(canonical)) {
+    throw new Error(`Invalid tenant id '${value}'. Expected 1-${MAX_TENANT_ID_LENGTH} characters matching ${TENANT_ID_PATTERN} (a UUID, ULID, slug, or prefixed id).`);
+  }
+  return canonical;
+}
+function tenantIdsEqual(left, right) {
+  const canonical = (value) => {
+    if (typeof value !== "string")
+      return null;
+    const folded = canonicalizeTenantId(value.trim());
+    return isValidTenantId(folded) ? folded : null;
+  };
+  const a = canonical(left);
+  const b = canonical(right);
+  return a !== null && b !== null && a === b;
+}
+function ownTenantId(source) {
+  return Object.hasOwn(source, "tid") ? source.tid : undefined;
+}
 var API_KEY_TOKEN_VERSION = 1;
 var API_KEY_NAMESPACE = "hasna";
-var TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var API_KEY_TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var TOKEN_PATTERN = API_KEY_TOKEN_PATTERN;
 var DEFAULT_API_KEY_TTL_SECONDS = 90 * 24 * 60 * 60;
+function ownAgentClaim(source) {
+  return Object.hasOwn(source, "agent") && typeof source.agent === "string" ? source.agent : null;
+}
+function ownScopesClaim(source) {
+  return Object.hasOwn(source, "scopes") && Array.isArray(source.scopes) ? source.scopes : null;
+}
+function ownOption(options, name) {
+  return Object.hasOwn(options, name) ? options[name] : undefined;
+}
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var intrinsicViewBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+var intrinsicViewByteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
+var intrinsicViewByteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var intrinsicDataViewBuffer = Object.getOwnPropertyDescriptor(DataView.prototype, "buffer").get;
+var intrinsicDataViewByteOffset = Object.getOwnPropertyDescriptor(DataView.prototype, "byteOffset").get;
+var intrinsicDataViewByteLength = Object.getOwnPropertyDescriptor(DataView.prototype, "byteLength").get;
+function viewWindow(view) {
+  try {
+    return [
+      intrinsicViewBuffer.call(view),
+      intrinsicViewByteOffset.call(view),
+      intrinsicViewByteLength.call(view)
+    ];
+  } catch {
+    return [
+      intrinsicDataViewBuffer.call(view),
+      intrinsicDataViewByteOffset.call(view),
+      intrinsicDataViewByteLength.call(view)
+    ];
+  }
+}
 function toBuffer(secret) {
-  return typeof secret === "string" ? Buffer.from(secret, "utf8") : secret;
+  if (typeof secret === "string")
+    return Buffer.from(secret, "utf8");
+  if (ArrayBuffer.isView(secret)) {
+    const [store, byteOffset, byteLength] = viewWindow(secret);
+    return Buffer.from(store, byteOffset, byteLength);
+  }
+  return Buffer.from(secret);
 }
 function hmac(signingSecret, message) {
   return createHmac("sha256", toBuffer(signingSecret)).update(message, "utf8").digest();
@@ -31,12 +107,23 @@ function parseApiKey(token) {
   } catch {
     return null;
   }
-  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || !Array.isArray(claims.scopes)) {
+  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || ownScopesClaim(claims) === null) {
+    return null;
+  }
+  const claimedTid = ownTenantId(claims);
+  if (claimedTid !== undefined && !isValidTenantId(claimedTid)) {
     return null;
   }
   return { app, body, sig, claims };
 }
 function verifyApiKeyToken(token, options) {
+  const optSigningSecret = ownOption(options, "signingSecret");
+  const optExpectedApp = ownOption(options, "expectedApp");
+  const optNowMs = ownOption(options, "nowMs");
+  const optLeewaySeconds = ownOption(options, "leewaySeconds");
+  const optRequiredScopes = ownOption(options, "requiredScopes");
+  const optRequireTenant = ownOption(options, "requireTenant");
+  const optExpectedTid = ownOption(options, "expectedTid");
   const parsed = parseApiKey(token);
   if (!parsed) {
     return { ok: false, reason: "malformed", message: "Token is malformed." };
@@ -48,10 +135,10 @@ function verifyApiKeyToken(token, options) {
   if (claims.app !== app) {
     return { ok: false, reason: "app_mismatch", message: "Token prefix app does not match claims." };
   }
-  if (options.expectedApp !== undefined && app !== options.expectedApp) {
-    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${options.expectedApp}'.` };
+  if (optExpectedApp !== undefined && app !== optExpectedApp) {
+    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${optExpectedApp}'.` };
   }
-  const expected = hmac(options.signingSecret, `${apiKeyPrefix(app)}${body}`);
+  const expected = hmac(optSigningSecret, `${apiKeyPrefix(app)}${body}`);
   let provided;
   try {
     provided = Buffer.from(sig, "base64url");
@@ -61,16 +148,41 @@ function verifyApiKeyToken(token, options) {
   if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
     return { ok: false, reason: "bad_signature", message: "Signature verification failed." };
   }
-  const now = Math.floor((options.nowMs ?? Date.now()) / 1000);
-  const leeway = options.leewaySeconds ?? 0;
+  const agent = ownAgentClaim(claims);
+  const now = Math.floor((optNowMs ?? Date.now()) / 1000);
+  const leeway = optLeewaySeconds ?? 0;
   if (typeof claims.iat === "number" && now + leeway < claims.iat) {
-    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid." };
+    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid.", agent };
   }
   if (claims.exp !== null && typeof claims.exp === "number" && now - leeway >= claims.exp) {
-    return { ok: false, reason: "expired", message: "Token has expired." };
+    return { ok: false, reason: "expired", message: "Token has expired.", agent };
+  }
+  const verifiedTid = ownTenantId(claims);
+  const tid = verifiedTid === undefined ? null : canonicalizeTenantId(verifiedTid);
+  const tenantRequired = Boolean(optRequireTenant) || optExpectedTid !== undefined;
+  if (tenantRequired && tid === null) {
+    return {
+      ok: false,
+      reason: "tenant_required",
+      message: "Token carries no tenant id ('tid') and this service requires one.",
+      kid: claims.kid,
+      tid: null,
+      agent
+    };
+  }
+  if (optExpectedTid !== undefined && !tenantIdsEqual(tid, optExpectedTid)) {
+    const expectationIsWellFormed = typeof optExpectedTid === "string" && isValidTenantId(optExpectedTid.trim());
+    return {
+      ok: false,
+      reason: "tenant_mismatch",
+      message: expectationIsWellFormed ? "Token is for a different tenant than the one this service accepts." : "Token tenant cannot be checked: the expected tenant id is not a valid tenant id.",
+      kid: claims.kid,
+      tid,
+      agent
+    };
   }
-  if (options.requiredScopes && options.requiredScopes.length > 0) {
-    const granted = claims.scopes;
+  if (optRequiredScopes && optRequiredScopes.length > 0) {
+    const granted = ownScopesClaim(claims) ?? [];
     const satisfies = (required) => granted.some((g) => {
       if (g === "*")
         return true;
@@ -84,15 +196,16 @@ function verifyApiKeyToken(token, options) {
       const rAction = required.slice(ri + 1);
       return (gApp === "*" || gApp === rApp) && (gAction === "*" || gAction === rAction);
     });
-    for (const required of options.requiredScopes) {
+    for (const required of optRequiredScopes) {
       if (!satisfies(required)) {
-        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.` };
+        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.`, agent };
       }
     }
   }
-  return { ok: true, claims, kid: claims.kid, app };
+  return { ok: true, claims, kid: claims.kid, app, tid, agent };
 }
 var DEFAULT_API_KEYS_TABLE = "api_keys";
+var API_KEY_ISSUANCE_PENDING_REASON = "credential_delivery_pending";
 function createTableSql(table) {
   return `CREATE TABLE IF NOT EXISTS ${table} (
     kid TEXT PRIMARY KEY,
@@ -116,6 +229,11 @@ function apiKeyMigrations(table = DEFAULT_API_KEYS_TABLE) {
       id: `hasna_auth_0002_${table}_indexes`,
       sql: `CREATE INDEX IF NOT EXISTS ${table}_app_idx ON ${table} (app);
             CREATE INDEX IF NOT EXISTS ${table}_token_hash_idx ON ${table} (token_hash);`
+    },
+    {
+      id: `hasna_auth_0003_${table}_tenant`,
+      sql: `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS tid TEXT;
+            CREATE INDEX IF NOT EXISTS ${table}_tid_idx ON ${table} (tid);`
     }
   ];
 }
@@ -140,10 +258,13 @@ function parseScopes(value) {
   return [];
 }
 function rowToRecord(row) {
+  const tid = ownTenantId(row);
+  const agentValue = Object.hasOwn(row, "agent") ? row.agent : null;
   return {
     kid: String(row.kid),
     app: String(row.app),
-    agent: row.agent === null || row.agent === undefined ? null : String(row.agent),
+    agent: agentValue === null || agentValue === undefined ? null : String(agentValue),
+    tid: tid === null || tid === undefined ? null : String(tid),
     scopes: parseScopes(row.scopes),
     tokenHash: String(row.token_hash),
     issuedAt: toIso(row.issued_at) ?? new Date(0).toISOString(),
@@ -174,31 +295,63 @@ class ApiKeyStore {
     }
   }
   async insert(input) {
+    await this.insertWithLifecycle(input, null, null);
+  }
+  async insertWithLifecycle(input, revokedAt, revokedReason) {
+    const tid = ownTenantId(input);
+    const agent = ownAgentClaim(input);
     await this.client.execute(`INSERT INTO ${this.table}
-         (kid, app, agent, scopes, token_hash, issued_at, expires_at, created_by)
-       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)`, [
+         (kid, app, agent, tid, scopes, token_hash, issued_at, expires_at, created_by, revoked_at, revoked_reason)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7, $8, $9, $10, $11)`, [
       input.kid,
       input.app,
-      input.agent ?? null,
+      agent,
+      tid === undefined || tid === null ? null : normalizeTenantId(tid),
       JSON.stringify(input.scopes),
       input.tokenHash,
       input.issuedAt.toISOString(),
       input.expiresAt ? input.expiresAt.toISOString() : null,
-      input.createdBy ?? null
+      input.createdBy ?? null,
+      revokedAt,
+      revokedReason
     ]);
   }
-  async insertMinted(minted, createdBy) {
+  mintedInput(minted, createdBy) {
     const claims = minted.claims;
-    await this.insert({
+    return {
       kid: minted.kid,
       app: claims.app,
-      agent: claims.agent ?? null,
+      agent: ownAgentClaim(claims),
+      tid: ownTenantId(claims) ?? null,
       scopes: claims.scopes,
       tokenHash: minted.tokenHash,
       issuedAt: new Date(claims.iat * 1000),
       expiresAt: claims.exp === null ? null : new Date(claims.exp * 1000),
       createdBy: createdBy ?? null
-    });
+    };
+  }
+  async insertMinted(minted, createdBy) {
+    await this.insert(this.mintedInput(minted, createdBy));
+  }
+  async insertMintedPending(minted, createdBy, atMs = Date.now()) {
+    await this.insertWithLifecycle(this.mintedInput(minted, createdBy), new Date(atMs).toISOString(), API_KEY_ISSUANCE_PENDING_REASON);
+  }
+  async activatePending(kid, tokenHash) {
+    const row = await this.client.get(`UPDATE ${this.table}
+          SET revoked_at = NULL, revoked_reason = NULL
+        WHERE kid = $1
+          AND revoked_at IS NOT NULL
+          AND revoked_reason = $2
+          AND token_hash = $3
+      RETURNING kid`, [kid, API_KEY_ISSUANCE_PENDING_REASON, tokenHash]);
+    if (row)
+      return true;
+    const active = await this.client.get(`SELECT kid FROM ${this.table}
+        WHERE kid = $1
+          AND token_hash = $2
+          AND revoked_at IS NULL
+          AND revoked_reason IS NULL`, [kid, tokenHash]);
+    return active !== null;
   }
   async findByKid(kid) {
     const row = await this.client.get(`SELECT * FROM ${this.table} WHERE kid = $1`, [kid]);
@@ -224,6 +377,9 @@ class ApiKeyStore {
       return "expired";
     return "active";
   }
+  keyStatus = async (kid) => {
+    return this.status(kid);
+  };
   statusChecker() {
     return async (kid) => {
       const status = await this.status(kid);
@@ -250,11 +406,16 @@ class ApiKeyStore {
       params.push(options.app);
       clauses.push(`app = $${params.length}`);
     }
+    const tid = ownTenantId(options);
+    if (tid !== undefined) {
+      params.push(normalizeTenantId(tid));
+      clauses.push(`tid = $${params.length}`);
+    }
     if (!options.includeRevoked) {
       clauses.push("revoked_at IS NULL");
     }
     const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
-    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`);
+    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`, params);
     return rows.map(rowToRecord);
   }
   async revokedKids() {
@@ -291,27 +452,65 @@ function extractToken(source, headerName = "x-api-key", scheme = "Bearer") {
   }
   return null;
 }
+function ownOption2(bag, name) {
+  return Object.hasOwn(bag, name) ? bag[name] : undefined;
+}
 function verifyApiKey(options) {
-  if (!options.app)
+  const optionApp = ownOption2(options, "app");
+  const optionSigningSecret = ownOption2(options, "signingSecret");
+  const optionExpectedTid = ownOption2(options, "expectedTid");
+  const optionRequiredScopes = ownOption2(options, "requiredScopes");
+  const optionRequireTenant = ownOption2(options, "requireTenant");
+  const optionLeewaySeconds = ownOption2(options, "leewaySeconds");
+  const audit = ownOption2(options, "audit");
+  const headerName = ownOption2(options, "headerName") ?? "x-api-key";
+  const scheme = ownOption2(options, "scheme") ?? "Bearer";
+  const clock = ownOption2(options, "nowMs") ?? (() => Date.now());
+  if (!optionApp)
     throw new Error("verifyApiKey requires an 'app' slug.");
-  if (!options.signingSecret) {
+  if (!optionSigningSecret) {
     throw new Error("verifyApiKey requires a 'signingSecret'. Set it from HASNA_<APP>_API_SIGNING_KEY.");
   }
-  const headerName = options.headerName ?? "x-api-key";
-  const scheme = options.scheme ?? "Bearer";
-  const clock = options.nowMs ?? (() => Date.now());
+  if (optionExpectedTid !== undefined && !isValidTenantId(optionExpectedTid)) {
+    throw new Error(`verifyApiKey received an invalid 'expectedTid': '${optionExpectedTid}'.`);
+  }
+  const app = optionApp;
+  const signingSecret = optionSigningSecret;
+  const ownKeyStatus = ownOption2(options, "keyStatus");
+  const ownIsRevoked = ownOption2(options, "isRevoked");
+  const allowUnregistered = ownOption2(options, "allowUnregisteredKeys") === true;
+  if (ownKeyStatus && ownIsRevoked) {
+    throw new Error("verifyApiKey received both 'keyStatus' and 'isRevoked'. Supply exactly one \u2014 " + "letting one silently win would hide which check is actually guarding the service. " + "Use 'keyStatus' (store.keyStatus); drop 'isRevoked'.");
+  }
+  if (!ownKeyStatus && !allowUnregistered) {
+    throw new Error(ownIsRevoked ? "verifyApiKey was given only 'isRevoked', which cannot refuse a key this service has " + "no record of: it returns false both for an active key and for one that was never " + "registered, so an unregistered key is irrevocable. Wire 'keyStatus: store.keyStatus' " + "(or 'isRevoked: store.statusChecker()'), or set 'allowUnregisteredKeys: true' to " + "accept that risk explicitly." : "verifyApiKey requires a key-status hook. Without one this service performs NO " + "revocation check and cannot turn any of its keys off. Wire " + "'keyStatus: store.keyStatus', or set 'allowUnregisteredKeys: true' to declare that " + "this service intentionally cannot revoke keys.");
+  }
   async function emit(event) {
-    if (!options.audit)
+    if (!audit)
       return;
     try {
-      await options.audit(event);
+      await audit(event);
     } catch {}
   }
   async function authenticate(headers, context = {}) {
-    const method = context.method ?? null;
-    const path = context.path ?? null;
-    const requiredScopes = [...options.requiredScopes ?? [], ...context.requiredScopes ?? []];
+    const method = ownOption2(context, "method") ?? null;
+    const path = ownOption2(context, "path") ?? null;
+    const requiredScopes = [
+      ...optionRequiredScopes ?? [],
+      ...ownOption2(context, "requiredScopes") ?? []
+    ];
     const at = new Date(clock()).toISOString();
+    const perCallTid = ownOption2(context, "expectedTid");
+    const expectedTid = perCallTid !== undefined ? perCallTid : optionExpectedTid;
+    if (perCallTid !== undefined && optionExpectedTid !== undefined && !tenantIdsEqual(perCallTid, optionExpectedTid)) {
+      await emit({ outcome: "deny", app, kid: null, tid: null, reason: "tenant_mismatch", scopesRequired: requiredScopes, method, path, status: 403, at });
+      return {
+        ok: false,
+        status: 403,
+        reason: "tenant_mismatch",
+        message: "This route addresses a tenant other than the one this service is pinned to."
+      };
+    }
     const token = extractToken(headers, headerName, scheme);
     if (!token) {
       const decision = {
@@ -320,25 +519,72 @@ function verifyApiKey(options) {
         reason: "missing_token",
         message: `Missing API key. Send it as '${headerName}: <key>' or 'Authorization: ${scheme} <key>'.`
       };
-      await emit({ outcome: "deny", app: options.app, kid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
+      await emit({ outcome: "deny", app, kid: null, tid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
       return decision;
     }
     const verified = verifyApiKeyToken(token, {
-      signingSecret: options.signingSecret,
-      expectedApp: options.app,
+      signingSecret,
+      expectedApp: app,
       nowMs: clock(),
-      ...options.leewaySeconds !== undefined ? { leewaySeconds: options.leewaySeconds } : {},
+      ...optionLeewaySeconds !== undefined ? { leewaySeconds: optionLeewaySeconds } : {},
+      ...optionRequireTenant !== undefined ? { requireTenant: optionRequireTenant } : {},
+      ...expectedTid !== undefined ? { expectedTid } : {},
       requiredScopes
     });
     if (!verified.ok) {
-      const status = verified.reason === "insufficient_scope" ? 403 : 401;
-      await emit({ outcome: "deny", app: options.app, kid: null, reason: verified.reason, scopesRequired: requiredScopes, method, path, status, at });
+      const status = verified.reason === "insufficient_scope" || verified.reason === "tenant_mismatch" || verified.reason === "tenant_required" ? 403 : 401;
+      await emit({
+        outcome: "deny",
+        app,
+        kid: ownOption2(verified, "kid") ?? null,
+        tid: ownTenantId(verified) ?? null,
+        ...Object.hasOwn(verified, "agent") ? { agent: verified.agent } : {},
+        reason: verified.reason,
+        scopesRequired: requiredScopes,
+        method,
+        path,
+        status,
+        at
+      });
       return { ok: false, status, reason: verified.reason, message: verified.message };
     }
-    if (options.isRevoked) {
-      const revoked = await options.isRevoked(verified.kid);
+    if (ownKeyStatus) {
+      let status;
+      try {
+        status = await ownKeyStatus(verified.kid);
+      } catch {
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "status_unavailable", scopesRequired: requiredScopes, method, path, status: 503, at });
+        return {
+          ok: false,
+          status: 503,
+          reason: "status_unavailable",
+          message: "Could not verify API key status. Try again shortly."
+        };
+      }
+      if (status !== "active") {
+        const known = status === "revoked" || status === "expired" || status === "unknown";
+        if (!(status === "unknown" && allowUnregistered)) {
+          const reason = status === "revoked" || status === "expired" ? status : "unknown_key";
+          const message = reason === "unknown_key" ? known ? "API key is not registered with this service." : "API key status could not be recognized." : status === "expired" ? "API key has expired." : "API key has been revoked.";
+          await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason, scopesRequired: requiredScopes, method, path, status: 401, at });
+          return { ok: false, status: 401, reason, message };
+        }
+      }
+    } else if (ownIsRevoked) {
+      let revoked;
+      try {
+        revoked = await ownIsRevoked(verified.kid);
+      } catch {
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "status_unavailable", scopesRequired: requiredScopes, method, path, status: 503, at });
+        return {
+          ok: false,
+          status: 503,
+          reason: "status_unavailable",
+          message: "Could not verify API key status. Try again shortly."
+        };
+      }
       if (revoked) {
-        await emit({ outcome: "deny", app: options.app, kid: verified.kid, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
         return { ok: false, status: 401, reason: "revoked", message: "API key has been revoked." };
       }
     }
@@ -346,138 +592,202 @@ function verifyApiKey(options) {
       kid: verified.kid,
       app: verified.app,
       scopes: verified.claims.scopes,
-      agent: verified.claims.agent ?? null,
+      agent: verified.agent,
+      tid: verified.tid,
       claims: verified.claims
     };
-    await emit({ outcome: "allow", app: options.app, kid: verified.kid, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
+    await emit({ outcome: "allow", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
     return { ok: true, status: 200, principal };
   }
-  return { authenticate, app: options.app };
+  return { authenticate, app };
 }
+var MAX_FLEET_TOKEN_TTL_SECONDS = 24 * 60 * 60;
 
-// src/generated/storage-kit/mode.ts
-var DEPRECATED_STORAGE_MODE_ALIASES = [
-  "remote",
-  "hybrid",
-  "self_hosted"
-];
-function normalizeStorageMode(value) {
-  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
-  if (normalized === "local")
-    return { mode: "local", deprecatedAlias: null };
-  if (normalized === "cloud")
-    return { mode: "cloud", deprecatedAlias: null };
-  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
-    return { mode: "cloud", deprecatedAlias: normalized };
-  }
-  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+// src/generated/storage-kit/own.ts
+function ownProp(source, key) {
+  if (source === null || source === undefined)
+    return;
+  const kind = typeof source;
+  if (kind !== "object" && kind !== "function")
+    return;
+  if (!Object.hasOwn(source, key))
+    return;
+  return source[key];
+}
+function ownString(source, key) {
+  const value = ownProp(source, key);
+  return typeof value === "string" ? value : undefined;
 }
+
+// src/generated/storage-kit/backend.ts
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
-function storageEnvKeys(name) {
+function serverDataBackendEnvKeys(name) {
   const token = envToken(name);
   return {
-    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
     databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
   };
 }
 function firstEnv(env, keys) {
   for (const key of keys) {
-    const value = env[key]?.trim();
+    const value = ownString(env, key)?.trim();
     if (value)
       return { key, value };
   }
   return null;
 }
-function resolveStorageMode(name, env = process.env) {
-  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
-  const dbHit = firstEnv(env, databaseUrlKeys);
-  const databaseUrlPresent = Boolean(dbHit);
-  const databaseUrlSource = dbHit ? dbHit.key : null;
-  const modeHit = firstEnv(env, modeKeys);
-  if (!modeHit) {
+function resolveServerDataBackend(name, env = process.env) {
+  const databaseUrl = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
+  if (!databaseUrl) {
     return {
-      mode: "local",
+      backend: "sqlite",
       source: "default",
-      deprecatedAlias: null,
-      databaseUrlPresent,
-      databaseUrlSource,
-      warning: null
+      databaseUrlPresent: false,
+      databaseUrlSource: null
     };
   }
-  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
-  const warnings = [];
-  if (deprecatedAlias) {
-    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
-  }
-  if (mode === "cloud" && !databaseUrlPresent) {
-    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
-  }
-  if (modeHit.key !== modeKeys[0]) {
-    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
-  }
   return {
-    mode,
-    source: modeHit.key,
-    deprecatedAlias,
-    databaseUrlPresent,
-    databaseUrlSource,
-    warning: warnings.length > 0 ? warnings.join(" ") : null
+    backend: "postgresql",
+    source: databaseUrl.key,
+    databaseUrlPresent: true,
+    databaseUrlSource: databaseUrl.key
   };
 }
 function resolveDatabaseUrl(name, env = process.env) {
-  const { databaseUrlKeys } = storageEnvKeys(name);
-  const hit = firstEnv(env, databaseUrlKeys);
-  return hit ? hit.value : null;
+  const hit = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
+  return hit?.value ?? null;
 }
 // src/generated/storage-kit/tls.ts
 import { readFileSync } from "fs";
-function sslModeFromConnectionString(connectionString) {
+var PG_TLS_QUERY_PARAMETERS = new Set([
+  "ssl",
+  "sslmode",
+  "sslrootcert",
+  "sslcert",
+  "sslkey",
+  "sslpassword",
+  "sslnegotiation",
+  "uselibpqcompat"
+]);
+var EXPLICIT_SSL_ON_VALUES = new Set(["1", "true", "yes", "on", "require"]);
+var EXPLICIT_SSL_OFF_VALUES = new Set(["0", "false", "no", "off", "disable"]);
+var SSLMODE_VALUES = new Map([
+  ["disable", "disable"],
+  ["allow", "prefer"],
+  ["prefer", "prefer"],
+  ["require", "require"],
+  ["verify-ca", "verify-ca"],
+  ["verify-full", "verify-full"]
+]);
+function connectionStringParts(connectionString) {
   const queryStart = connectionString.indexOf("?");
-  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
-  const sslmode = params.get("sslmode")?.trim().toLowerCase();
-  if (sslmode) {
-    switch (sslmode) {
-      case "disable":
-      case "prefer":
-      case "require":
-      case "verify-ca":
-      case "verify-full":
-        return sslmode;
-      case "allow":
-        return "prefer";
-      default:
-        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+  if (queryStart === -1) {
+    return { base: connectionString, fragment: "", params: new URLSearchParams };
+  }
+  const base = connectionString.slice(0, queryStart);
+  const queryAndFragment = connectionString.slice(queryStart + 1);
+  const fragmentStart = queryAndFragment.indexOf("#");
+  const query = fragmentStart === -1 ? queryAndFragment : queryAndFragment.slice(0, fragmentStart);
+  const fragment = fragmentStart === -1 ? "" : queryAndFragment.slice(fragmentStart);
+  return { base, fragment, params: new URLSearchParams(query) };
+}
+function tlsQueryValues(connectionString) {
+  const values = new Map;
+  for (const [key, value] of connectionStringParts(connectionString).params) {
+    const normalized = key.toLowerCase();
+    if (PG_TLS_QUERY_PARAMETERS.has(normalized))
+      values.set(normalized, value);
+  }
+  return values;
+}
+function connectionStringWithoutTlsParameters(connectionString) {
+  const { base, fragment, params } = connectionStringParts(connectionString);
+  for (const key of [...params.keys()]) {
+    if (PG_TLS_QUERY_PARAMETERS.has(key.toLowerCase()))
+      params.delete(key);
+  }
+  const query = params.toString();
+  return `${base}${query ? `?${query}` : ""}${fragment}`;
+}
+function rawSslMode(values) {
+  const raw = values.get("sslmode");
+  return raw === undefined ? undefined : raw.trim().toLowerCase();
+}
+function sslNegotiationFromConnectionString(connectionString) {
+  const value = tlsQueryValues(connectionString).get("sslnegotiation")?.trim().toLowerCase();
+  if (!value)
+    return;
+  if (value === "postgres" || value === "direct")
+    return value;
+  throw new Error(`Unknown sslnegotiation '${value}' in connection string; expected postgres or direct.`);
+}
+function sslModeFromConnectionString(connectionString) {
+  const values = tlsQueryValues(connectionString);
+  const sslmode = rawSslMode(values);
+  if (sslmode !== undefined) {
+    const resolved = SSLMODE_VALUES.get(sslmode);
+    if (resolved)
+      return resolved;
+    throw new Error(`Unknown sslmode '${sslmode}' in connection string; expected one of ` + `${[...SSLMODE_VALUES.keys()].join(", ")}. Remove the parameter entirely to defer to ` + `PGSSLMODE \u2014 an empty value is not how that is spelled.`);
+  }
+  if (values.has("ssl")) {
+    const ssl = values.get("ssl")?.trim().toLowerCase() ?? "";
+    if (EXPLICIT_SSL_ON_VALUES.has(ssl))
+      return "require";
+    if (!EXPLICIT_SSL_OFF_VALUES.has(ssl)) {
+      throw new Error(`Unknown ssl value '${ssl}' in connection string.`);
     }
+    return "disable";
   }
-  const ssl = params.get("ssl")?.trim().toLowerCase();
-  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+  const sslnegotiation = values.get("sslnegotiation")?.trim().toLowerCase();
+  if (sslnegotiation === "direct")
     return "require";
   return "disable";
 }
-function loadCaBundle(options) {
-  const env = options.env ?? process.env;
-  if (options.ca && options.ca.trim())
-    return options.ca;
-  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+function loadCaBundle(connectionString, options) {
+  const env = ownProp(options, "env") ?? process.env;
+  const ca = ownString(options, "ca");
+  if (ca && ca.trim())
+    return ca;
+  const sslRootCert = tlsQueryValues(connectionString).get("sslrootcert")?.trim();
+  const path = ownString(options, "caCertPath") ?? (sslRootCert ? sslRootCert : undefined) ?? ownString(env, "PGSSLROOTCERT") ?? ownString(env, "NODE_EXTRA_CA_CERTS");
   if (path && path.trim())
     return readFileSync(path.trim(), "utf8");
   return null;
 }
+function loadClientCertificate(connectionString) {
+  const values = tlsQueryValues(connectionString);
+  const material = {};
+  const certPath = values.get("sslcert")?.trim();
+  if (certPath)
+    material.cert = readFileSync(certPath, "utf8");
+  const keyPath = values.get("sslkey")?.trim();
+  if (keyPath)
+    material.key = readFileSync(keyPath, "utf8");
+  const passphrase = values.get("sslpassword");
+  if (passphrase)
+    material.passphrase = passphrase;
+  return material;
+}
 function resolveTlsConfig(connectionString, options = {}) {
   const mode = sslModeFromConnectionString(connectionString);
-  if (mode === "disable" || mode === "prefer") {
-    return;
-  }
-  const ca = loadCaBundle(options);
-  if (mode === "require") {
-    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  if (mode === "disable") {
+    const values = tlsQueryValues(connectionString);
+    const sslmode = rawSslMode(values);
+    const ssl = values.get("ssl")?.trim().toLowerCase();
+    const explicitlyOff = sslmode === "disable" || ssl !== undefined && EXPLICIT_SSL_OFF_VALUES.has(ssl);
+    return explicitlyOff ? false : undefined;
+  }
+  const ca = loadCaBundle(connectionString, options);
+  const clientCertificate = loadClientCertificate(connectionString);
+  if (mode === "prefer" || mode === "require") {
+    return { rejectUnauthorized: true, ...ca ? { ca } : {}, ...clientCertificate };
   }
   if (!ca) {
     throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
   }
-  return { rejectUnauthorized: true, ca };
+  return { rejectUnauthorized: true, ca, ...clientCertificate };
 }
 // src/generated/storage-kit/query.ts
 function wrapExecutor(executor) {
@@ -534,44 +844,72 @@ function createQueryClient(pool) {
 }
 // src/generated/storage-kit/pool.ts
 import pg from "pg";
+function ownPoolOptions(options) {
+  const own = Object.create(null);
+  const ca = ownString(options, "ca");
+  if (ca !== undefined)
+    own.ca = ca;
+  const caCertPath = ownString(options, "caCertPath");
+  if (caCertPath !== undefined)
+    own.caCertPath = caCertPath;
+  const env = ownProp(options, "env");
+  if (env !== undefined)
+    own.env = env;
+  const max = ownProp(options, "max");
+  if (max !== undefined)
+    own.max = max;
+  const idleTimeoutMillis = ownProp(options, "idleTimeoutMillis");
+  if (idleTimeoutMillis !== undefined)
+    own.idleTimeoutMillis = idleTimeoutMillis;
+  const connectionTimeoutMillis = ownProp(options, "connectionTimeoutMillis");
+  if (connectionTimeoutMillis !== undefined)
+    own.connectionTimeoutMillis = connectionTimeoutMillis;
+  const applicationName = ownString(options, "applicationName");
+  if (applicationName !== undefined)
+    own.applicationName = applicationName;
+  return own;
+}
 function createPgPool(options) {
-  const ssl = resolveTlsConfig(options.connectionString, {
-    ...options.ca !== undefined ? { ca: options.ca } : {},
-    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
-    ...options.env !== undefined ? { env: options.env } : {}
+  const connectionString = ownString(options, "connectionString");
+  if (!connectionString || !connectionString.trim()) {
+    throw new Error("createPgPool requires an own `connectionString` on the options object.");
+  }
+  const own = ownPoolOptions(options);
+  const ssl = resolveTlsConfig(connectionString, {
+    ...own.ca !== undefined ? { ca: own.ca } : {},
+    ...own.caCertPath !== undefined ? { caCertPath: own.caCertPath } : {},
+    ...own.env !== undefined ? { env: own.env } : {}
   });
-  const config = { connectionString: options.connectionString };
+  const config = {
+    connectionString: connectionStringWithoutTlsParameters(connectionString)
+  };
   if (ssl !== undefined)
     config.ssl = ssl;
-  if (options.max !== undefined)
-    config.max = options.max;
-  if (options.idleTimeoutMillis !== undefined)
-    config.idleTimeoutMillis = options.idleTimeoutMillis;
-  if (options.connectionTimeoutMillis !== undefined)
-    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
-  if (options.applicationName !== undefined)
-    config.application_name = options.applicationName;
+  const sslnegotiation = sslNegotiationFromConnectionString(connectionString);
+  if (sslnegotiation !== undefined)
+    config.sslnegotiation = sslnegotiation;
+  if (own.max !== undefined)
+    config.max = own.max;
+  if (own.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = own.idleTimeoutMillis;
+  if (own.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = own.connectionTimeoutMillis;
+  if (own.applicationName !== undefined)
+    config.application_name = own.applicationName;
   return new pg.Pool(config);
 }
-function createCloudPoolFromEnv(appName, options = {}) {
-  const env = options.env ?? process.env;
-  const resolution = resolveStorageMode(appName, env);
-  if (resolution.mode !== "cloud") {
-    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
-  }
+function createServerPoolFromEnv(appName, options = {}) {
+  const own = ownPoolOptions(options);
+  const env = own.env ?? process.env;
+  const resolution = resolveServerDataBackend(appName, env);
   const connectionString = resolveDatabaseUrl(appName, env);
   if (!connectionString) {
-    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+    throw new Error(`postgresql storage for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
   }
   const pool = createPgPool({
+    ...own,
     connectionString,
-    ...options.ca !== undefined ? { ca: options.ca } : {},
-    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
-    env,
-    ...options.max !== undefined ? { max: options.max } : {},
-    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
-    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
-    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+    env
   });
   return {
     client: createQueryClient(pool),
@@ -693,7 +1031,8 @@ function rowToDomain(row) {
     notes: row.notes,
     metadata: parseJson(row.metadata, {}),
     created_at: row.created_at,
-    updated_at: row.updated_at
+    updated_at: row.updated_at,
+    expiry_synced_at: row.expiry_synced_at ?? null
   };
 }
 function rowToDnsRecord(row) {
@@ -739,8 +1078,8 @@ class DomainsRepo {
            id, name, registrar, status, registered_at, expires_at, auto_renew,
            is_premium, premium_price, standard_price, purchase_price, purchase_date,
            nameservers, whois, ssl_expires_at, ssl_issuer, notes, metadata,
-           created_at, updated_at
-         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20)
+           created_at, updated_at, expiry_synced_at
+         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)
          RETURNING *`, [
         id,
         input.name.trim(),
@@ -761,7 +1100,8 @@ class DomainsRepo {
         input.notes ?? null,
         JSON.stringify(input.metadata ?? {}),
         nowIso,
-        nowIso
+        nowIso,
+        input.expiry_synced_at ?? null
       ]);
       return rowToDomain(row);
     } catch (e) {
@@ -850,6 +1190,8 @@ class DomainsRepo {
       setCol("notes", p["notes"] ?? null);
     if ("metadata" in p)
       setCol("metadata", JSON.stringify(p["metadata"] ?? {}));
+    if ("expiry_synced_at" in p)
+      setCol("expiry_synced_at", p["expiry_synced_at"] ?? null);
     if (sets.length === 0)
       return existing;
     setCol("updated_at", new Date().toISOString());
@@ -880,7 +1222,15 @@ class DomainsRepo {
          count(*) FILTER (
            WHERE NULLIF(ssl_expires_at, '')::timestamptz
              BETWEEN now() AND now() + interval '30 days'
-         )::text AS ssl_expiring_30_days
+         )::text AS ssl_expiring_30_days,
+         count(*) FILTER (
+           WHERE status = 'active'
+             AND NULLIF(expires_at, '')::timestamptz < now()
+         )::text AS past_expiry,
+         count(*) FILTER (
+           WHERE NULLIF(ssl_expires_at, '')::timestamptz < now()
+         )::text AS ssl_past_expiry,
+         count(*) FILTER (WHERE expiry_synced_at IS NULL)::text AS never_synced
        FROM domains`);
     const n = (k) => row && row[k] ? parseInt(row[k], 10) : 0;
     return {
@@ -891,7 +1241,10 @@ class DomainsRepo {
       redemption: n("redemption"),
       auto_renew_enabled: n("auto_renew_enabled"),
       expiring_30_days: n("expiring_30_days"),
-      ssl_expiring_30_days: n("ssl_expiring_30_days")
+      ssl_expiring_30_days: n("ssl_expiring_30_days"),
+      past_expiry: n("past_expiry"),
+      ssl_past_expiry: n("ssl_past_expiry"),
+      never_synced: n("never_synced")
     };
   }
   async listDnsRecords(domainId) {
@@ -1480,7 +1833,9 @@ var PG_MIGRATIONS = [
   `CREATE INDEX IF NOT EXISTS idx_domain_history_created ON domain_history(created_at)`,
   `CREATE INDEX IF NOT EXISTS idx_domain_history_email ON domain_history(registrant_email)`,
   `CREATE INDEX IF NOT EXISTS idx_domain_reputation_domain ON domain_reputation(domain_id)`,
-  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_blacklisted ON domain_reputation(is_blacklisted)`
+  `CREATE INDEX IF NOT EXISTS idx_domain_reputation_blacklisted ON domain_reputation(is_blacklisted)`,
+  `ALTER TABLE domains ADD COLUMN IF NOT EXISTS expiry_synced_at TEXT`,
+  `CREATE INDEX IF NOT EXISTS idx_domains_expiry_synced_at ON domains(expiry_synced_at)`
 ];
 
 // src/server/migrations.ts
@@ -1517,7 +1872,7 @@ function buildOpenApiSpec(version) {
     info: {
       title: "domains",
       version,
-      description: "Domain portfolio, registrar, marketplace, and DNS management HTTP API (self_hosted). API-key authenticated."
+      description: "Domain portfolio, registrar, marketplace, and DNS management HTTP API. API-key authenticated."
     },
     security: [{ apiKey: [] }],
     paths: {
@@ -1671,29 +2026,26 @@ function buildOpenApiSpec(version) {
           properties: {
             status: { type: "string" },
             version: { type: "string" },
-            mode: { type: "string" },
             latencyMs: { type: "number" }
           },
-          required: ["status", "version", "mode"]
+          required: ["status", "version"]
         },
         ReadyResponse: {
           type: "object",
           properties: {
             status: { type: "string" },
             version: { type: "string" },
-            mode: { type: "string" },
             pendingMigrations: { type: "array", items: { type: "string" } }
           },
-          required: ["status", "version", "mode"]
+          required: ["status", "version"]
         },
         VersionResponse: {
           type: "object",
           properties: {
             status: { type: "string" },
-            version: { type: "string" },
-            mode: { type: "string" }
+            version: { type: "string" }
           },
-          required: ["status", "version", "mode"]
+          required: ["status", "version"]
         },
         DeleteResult: {
           type: "object",
@@ -1891,14 +2243,13 @@ function json(data, status = 200) {
 }
 function createServeApp(options) {
   const { db, version } = options;
-  const mode2 = options.mode ?? "self_hosted";
   const repo = new DomainsRepo(db);
   const migrationIds = buildMigrations().map((m) => m.id);
   const spec = buildOpenApiSpec(version);
   const verifier = verifyApiKey({
     app: "domains",
     signingSecret: options.signingSecret,
-    ...options.isRevoked ? { isRevoked: options.isRevoked } : {},
+    keyStatus: options.keyStatus,
     ...options.audit ? { audit: options.audit } : {}
   });
   async function readBody(req) {
@@ -1928,20 +2279,19 @@ function createServeApp(options) {
     try {
       if (method === "GET" && path === "/health") {
         const h = await checkHealth(db);
-        return json({ status: h.ok ? "ok" : "error", version, mode: mode2, latencyMs: h.latencyMs, ...h.error ? { error: h.error } : {} }, h.ok ? 200 : 503);
+        return json({ status: h.ok ? "ok" : "error", version, latencyMs: h.latencyMs, ...h.error ? { error: h.error } : {} }, h.ok ? 200 : 503);
       }
       if (method === "GET" && path === "/ready") {
         const r = await readReadiness(db, migrationIds);
         return json({
           status: r.ok ? "ok" : "not_ready",
           version,
-          mode: mode2,
           pendingMigrations: r.pendingMigrations,
           ...r.error ? { error: r.error } : {}
         }, r.ok ? 200 : 503);
       }
       if (method === "GET" && (path === "/version" || path === "/v1/version")) {
-        return json({ status: "ok", version, mode: mode2 });
+        return json({ status: "ok", version });
       }
       if (method === "GET" && (path === "/openapi.json" || path === "/v1/openapi.json")) {
         return json(spec);
@@ -2312,9 +2662,6 @@ function normalizeEnv(env = process.env) {
   if (!env["HASNA_DOMAINS_DATABASE_URL"] && env["DATABASE_URL"]) {
     env["HASNA_DOMAINS_DATABASE_URL"] = env["DATABASE_URL"];
   }
-  if (!env["HASNA_DOMAINS_STORAGE_MODE"] && env["HASNA_DOMAINS_DATABASE_URL"]) {
-    env["HASNA_DOMAINS_STORAGE_MODE"] = "cloud";
-  }
 }
 function resolveSigningSecret(env = process.env) {
   for (const key of SIGNING_KEY_ENVS) {
@@ -2341,7 +2688,7 @@ async function main() {
   normalizeEnv();
   const version = getPackageVersion();
   const signingSecret = resolveSigningSecret();
-  const { client, connectionSource } = createCloudPoolFromEnv("domains", {
+  const { client, connectionSource } = createServerPoolFromEnv("domains", {
     applicationName: "domains-serve",
     max: 5
   });
@@ -2350,8 +2697,7 @@ async function main() {
     db: client,
     signingSecret,
     version,
-    mode: process.env["HASNA_APP_MODE"] ?? "self_hosted",
-    isRevoked: store.isRevoked,
+    keyStatus: store.keyStatus,
     audit: (e) => {
       if (e.outcome === "deny") {
         console.error(JSON.stringify({ level: "warn", event: "api_auth_deny", ...e }));