@hasna/domains 0.0.45 → 0.0.47

package/dist/sdk/index.js

@@ -162,6 +162,7 @@ class DomainsClient {
 }
 // ../contracts/dist/client/transport.js
 import { readFileSync, statSync } from "fs";
+import { createRequire } from "module";
 import { join } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -177,6 +178,9 @@ function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
 var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 
 class CredentialResolutionError extends Error {
   appName;
@@ -189,31 +193,55 @@ class CredentialResolutionError extends Error {
   }
 }
 var HASNA_STATE_DIR = ".hasna";
-var FLEET_CREDENTIAL_DIR = "cloud";
+var FLEET_CREDENTIAL_DIR = "fleet-env";
+var LEGACY_CLOUD_DIR = "cloud";
 var CONFIG_DIR = ".config";
 var CONFIG_NAMESPACE = "hasna";
+var LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01";
 var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -264,6 +292,9 @@ function readCredentialFile(path, apiKeyKeys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -287,6 +318,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -359,6 +398,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -383,26 +443,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -428,6 +504,8 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
 var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "host",

package/dist/server/migrations.d.ts

@@ -12,6 +12,41 @@ import { type Migration, type MigrationResult } from "../generated/storage-kit/i
 /** Env var holding the owner-role DSN (DDL privileges). Falls back to the app DSN. */
 export declare const OWNER_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL_OWNER";
 export declare const APP_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL";
+/**
+ * Applied-ledger rows recorded before the ledger's id scheme stabilized, which
+ * no build in this repo's history generates (verified across every published
+ * tarball 0.0.30-0.0.46 and all git history). They are acknowledged via the
+ * storage kit's `acknowledgedLegacyIds`: they pass the downgrade guard, are
+ * never checksum-compared (their SQL is not reproducible from any source), and
+ * are never re-applied or re-inserted.
+ *
+ * `domains_apikeys_tenancy_0001`, `domains_apikeys_tenancy_0002`,
+ * `domains_tenancy_0001`..`domains_tenancy_0010` were recorded against the
+ * prod ledger out-of-band during the 2026-07 self-hosted cutover. Deploy
+ * evidence 2026-08-25: the 02:00Z pass failed on `_0001` (O15-00671 filed);
+ * the 16:44Z pass, carrying the kit with `_0001` acknowledged
+ * (hasna/apps#1176), advanced to `_0002`; the next pass then failed on the
+ * third row `domains_tenancy_0001` (O15-00758 filed), the 2026-08-25 PASS-18
+ * pass then failed on the fourth row `domains_tenancy_0002` at
+ * `domains-prod-migrate:42` (O15-00762 filed), and the 2026-08-25 pass then
+ * failed on the fifth row `domains_tenancy_0003` at `domains-prod-migrate:42`
+ * (O15-00766 filed). Deploy evidence 2026-08-26: passes 48-96 then failed on
+ * the sixth row `domains_tenancy_0004` at `domains-prod-migrate:44` through
+ * `:49` (todos 2b474505). Deploy evidence 2026-08-26/27: the 2026-08-27
+ * 06:47Z pass failed on the seventh row `domains_tenancy_0005` at
+ * `domains-prod-migrate:50` (O15-01822 filed). The ledger census (inspection
+ * task oss-fleet-prod/4b7c37626965439e96d5386c8e8a73d4) shows the complete
+ * out-of-band set is the 12 rows below — `domains_apikeys_tenancy_0001-0002`
+ * plus `domains_tenancy_0001..0010` — so this list covers the full measured
+ * prod ledger rather than one row per deploy pass. The apikeys rows'
+ * substance — the api-keys tenancy (`tid`) column — is carried today by
+ * `hasna_auth_0003_api_keys_tenant`; the substance of the `domains_tenancy_*`
+ * rows is not reproducible from any source in this repo, and no build
+ * generates the ids, so they are acknowledged as history rather than
+ * re-applied. Acknowledging all twelve unblocks `domains db migrate` (the ECS
+ * migrate task) and therefore the domains deploy lane.
+ */
+export declare const ACKNOWLEDGED_LEGACY_MIGRATION_IDS: readonly string[];
 /** The ordered migration set: app schema first, then the shared api-keys table. */
 export declare function buildMigrations(): Migration[];
 /** Run all pending migrations against the owner DSN. */

package/dist/server/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/server/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAK3C,sFAAsF;AACtF,eAAO,MAAM,aAAa,qCAAqC,CAAC;AAChE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAGxD,mFAAmF;AACnF,wBAAgB,eAAe,IAAI,SAAS,EAAE,CAU7C;AAYD,wDAAwD;AACxD,wBAAsB,aAAa,CACjC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACvD,OAAO,CAAC,eAAe,CAAC,CAW1B"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/server/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAK3C,sFAAsF;AACtF,eAAO,MAAM,aAAa,qCAAqC,CAAC;AAChE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAa9D,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,eAAe,IAAI,SAAS,EAAE,CAU7C;AAYD,wDAAwD;AACxD,wBAAsB,aAAa,CACjC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACvD,OAAO,CAAC,eAAe,CAAC,CAa1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/domains",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "description": "Domain portfolio, registrar, marketplace, and DNS management for AI agents — CLI + MCP + HTTP API + SDK, local SQLite or cloud Postgres",
   "type": "module",
   "main": "dist/index.js",
@@ -47,7 +47,8 @@
   "files": [
     "dist",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "postinstall.js"
   ],
   "scripts": {
     "clean": "rm -rf dist",
@@ -60,9 +61,9 @@
     "dev:mcp": "bun run src/mcp/index.ts",
     "dev:serve": "bun run src/server/index.ts",
     "prepublishOnly": "bun run build",
-    "postinstall": "mkdir -p $HOME/.hasna/domains 2>/dev/null || true",
+    "postinstall": "node postinstall.js",
     "prepack": "bun run build && bun run artifact-scan",
-    "artifact-scan": "bun pm pack --ignore-scripts --quiet --filename \"$PWD/domains-artifact-scan.tgz\" && bunx @hasna/contracts@0.13.4 artifact-scan domains-artifact-scan.tgz; rc=$?; rm -f \"$PWD/domains-artifact-scan.tgz\"; exit $rc"
+    "artifact-scan": "bun pm pack --ignore-scripts --quiet --filename \"$PWD/domains-artifact-scan.tgz\" && bunx @hasna/contracts@0.14.1 artifact-scan domains-artifact-scan.tgz; rc=$?; rm -f \"$PWD/domains-artifact-scan.tgz\"; exit $rc"
   },
   "keywords": [
     "domains",
@@ -97,7 +98,8 @@
     "@aws-sdk/client-route-53": "^3.1067.0",
     "@aws-sdk/client-route-53-domains": "^3.1067.0",
     "@aws-sdk/credential-provider-ini": "3.972.53",
-    "@hasna/contracts": "0.14.0",
+    "@hasna/contracts": "0.14.1",
+    "@hasna/paths": "0.1.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",

package/postinstall.js

@@ -0,0 +1,42 @@
+// Best-effort install-time creation of the domains home directory, resolving
+// the SAME effective home the runtime uses (src/lib/app-home.ts): an exact-app
+// override (HASNA_DOMAINS_HOME / DOMAINS_HOME / HASNA_DOMAINS_DIR / DOMAINS_DIR)
+// wins; otherwise the @hasna/paths XDG data home once adopted (HASNA_DATA_HOME
+// set, or domains.db already migrated there); otherwise the legacy
+// ~/.hasna/domains default. Failures are non-fatal: the runtime creates the
+// same directory on first use.
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+try {
+  const { dataDir } = await import("@hasna/paths");
+  const env = process.env;
+  const override = (
+    env["HASNA_DOMAINS_HOME"] ||
+    env["DOMAINS_HOME"] ||
+    env["HASNA_DOMAINS_DIR"] ||
+    env["DOMAINS_DIR"] ||
+    ""
+  ).trim();
+  const dataHomeOverride = (env["HASNA_DATA_HOME"] || "").trim();
+  const home = env["HOME"] || env["USERPROFILE"] || homedir();
+
+  let dir;
+  if (override) {
+    dir = override;
+  } else {
+    const resolved = dataDir({ app: "domains", home, env });
+    const adopted = Boolean(dataHomeOverride) || existsSync(join(resolved, "domains.db"));
+    dir = adopted ? resolved : join(home, ".hasna", "domains");
+  }
+
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try {
+    chmodSync(dir, 0o700);
+  } catch {
+    // best-effort on platforms without POSIX perms
+  }
+} catch {
+  // never fail an install over pre-created directories
+}