0.69.0: tools.domains — a domain's history and the lists (OpenVibe.Tools' /api/v1/domains) (#96)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 5589059..5765da9 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,17 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.69.0 (2026-10-28)
++
++- **`openvibe-sdk/tools`: domain history** (OpenVibe.Tools' `/api/v1/domains`, 2026-10-28). What the WHOIS and RDAP
++  tools saw of a domain over time, public registration facts only (registrar, dates, status, name servers, DNSSEC;
++  never contact details).
++  - `tools.domains.history('example.com')` gives its snapshots and what changed when; it is null when nothing was kept.
++  - `tools.domains.lists({ limit })` gives the most looked up domains and those of them expiring soon (each looked up
++    five times or more).
++  - Both read without a token; a malformed name is refused in the client. Types: `DomainHistory`, `DomainLists`,
++    `DomainFacts`.
++
  ## 0.68.0 (2026-10-28)
  
  - **`openvibe-sdk/food`: food boxes** (OpenVibe.Food's `/boxes`, 2026-10-28). Every meal kit, ready meal and food box
ddiff --git a/README.md b/README.md
iindex 258eccd..00daa64 100644
---- a/README.md
++++ b/README.md
@@@ -2,14 +2,14 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.68.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.69.0 (roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat and AI clients from WS-F task 4; per-actor limits from WS-R task 4). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
  **If a capability is not in the SDK, it is not public.** Apps call services through `openvibe-sdk` and never build internal routes themselves. A route with no SDK wrapper is internal, even when you can reach it, and it can change without notice. To make a capability public, first define it in OpenVibe.Contracts, then wrap it here.
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.68.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.69.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from Contracts v0.86.0, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex eae73fc..80bf572 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.68.0",
++  "version": "0.69.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 0069f84..994ef2c 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.68.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.69.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, registry, modules, realtime, media, community, bot, search, themes, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -43,7 +43,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.68.0';
++const SDK_VERSION = '0.69.0';
  
  module.exports = {
      createClient,
@@@ -3031,7 +3031,23 @@ function createToolsClient(client, { baseUrl, service = 'tools', audience = 'ope
          });
      }
  
--    return { list, get, schema, run, jobs };
++    /**
++     * Domain history (OpenVibe.Tools 2026-10-28): what the WHOIS and RDAP tools saw of a domain over time, public
++     * registration facts only (registrar, dates, status, name servers, DNSSEC; never contact details).
++     *   domains.history('example.com') → { domain, snapshots: [{ facts, first_seen, last_seen, seen }], changes:
++     *                                      [{ at, changes: [{ field, before, after }] }], lookups, first_seen }
++     *   domains.lists({ limit })        → { most_looked_up, expiring_soon, min_lookups } (domains looked up 5+ times)
++     */
++    const domains = {
++        async history(domain, { signal } = {}) {
++            const d = String(domain || '').trim().toLowerCase();
++            if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(d)) throw new TypeError('tools.domains.history: a domain name, like example.com');
++            return orNull(read(`/api/v1/domains/${enc(d)}`, undefined, signal));
++        },
++        async lists({ limit, signal } = {}) { return read('/api/v1/domains', { limit }, signal); },
++    };
++
++    return { list, get, schema, run, jobs, domains };
  }
  
  module.exports = { createToolsClient, ToolRunError, isToolRunError };
ddiff --git a/package-lock.json b/package-lock.json
iindex c83d956..ce6b104 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.68.0",
++  "version": "0.69.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.68.0",
++      "version": "0.69.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 95ddd08..0dedee6 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.68.0",
++  "version": "0.69.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 5351591..4bba567 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.68.0';
++const SDK_VERSION = '0.69.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/tools.js b/src/tools.js
iindex cc08fa8..32edad4 100644
---- a/src/tools.js
++++ b/src/tools.js
@@@ -260,7 +260,23 @@ function createToolsClient(client, { baseUrl, service = 'tools', audience = 'ope
          });
      }
  
--    return { list, get, schema, run, jobs };
++    /**
++     * Domain history (OpenVibe.Tools 2026-10-28): what the WHOIS and RDAP tools saw of a domain over time, public
++     * registration facts only (registrar, dates, status, name servers, DNSSEC; never contact details).
++     *   domains.history('example.com') → { domain, snapshots: [{ facts, first_seen, last_seen, seen }], changes:
++     *                                      [{ at, changes: [{ field, before, after }] }], lookups, first_seen }
++     *   domains.lists({ limit })        → { most_looked_up, expiring_soon, min_lookups } (domains looked up 5+ times)
++     */
++    const domains = {
++        async history(domain, { signal } = {}) {
++            const d = String(domain || '').trim().toLowerCase();
++            if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(d)) throw new TypeError('tools.domains.history: a domain name, like example.com');
++            return orNull(read(`/api/v1/domains/${enc(d)}`, undefined, signal));
++        },
++        async lists({ limit, signal } = {}) { return read('/api/v1/domains', { limit }, signal); },
++    };
++
++    return { list, get, schema, run, jobs, domains };
  }
  
  module.exports = { createToolsClient, ToolRunError, isToolRunError };
ddiff --git a/test/tools.test.js b/test/tools.test.js
iindex db20436..55c3d1a 100644
---- a/test/tools.test.js
++++ b/test/tools.test.js
@@@ -292,6 +292,29 @@ run([
          assert.deepEqual(s.violations, []);
      }],
  
++    ['domains: a domain\'s history and the lists, read without a token; a bad name never leaves the client', async () => {
++        const asked = [];
++        const s = standIn({}, {
++            before: async (req, url) => {
++                if (!url.pathname.startsWith('/api/v1/domains')) return null;
++                asked.push([url.pathname + url.search, req.headers.get('authorization')]);
++                if (url.pathname === '/api/v1/domains/gone.example') return new Response(JSON.stringify({ type: 'about:blank', title: 'Not Found', status: 404 }), { status: 404, headers: { 'Content-Type': 'application/problem+json' } });
++                const body = url.pathname === '/api/v1/domains' ? { ok: true, most_looked_up: [{ domain: 'example.com', lookups: 9, registrar: 'R', expires: null }], expiring_soon: [], min_lookups: 5 }
++                    : { ok: true, domain: 'example.com', snapshots: [{ facts: { registrar: 'R', created: null, updated: null, expires: null, status: [], nameservers: ['a.ns'], dnssec: null }, first_seen: '2026-10-01T00:00:00.000Z', last_seen: '2026-10-02T00:00:00.000Z', seen: 2 }], changes: [], lookups: 2, first_seen: '2026-10-01T00:00:00.000Z' };
++                return new Response(JSON.stringify(body), { status: 200, headers: { 'Content-Type': 'application/json' } });
++            },
++        });
++        const tools = createToolsClient(s.client());
++        const h = await tools.domains.history('Example.COM');
++        assert.deepEqual([h.domain, h.snapshots.length, h.lookups], ['example.com', 1, 2]);
++        assert.equal(await tools.domains.history('gone.example'), null, 'a 404 is null');
++        const l = await tools.domains.lists({ limit: 5 });
++        assert.deepEqual(l.most_looked_up.map((d) => d.domain), ['example.com']);
++        assert.deepEqual(asked.map((a) => a[0]), ['/api/v1/domains/example.com', '/api/v1/domains/gone.example', '/api/v1/domains?limit=5']);
++        assert.ok(asked.every((a) => !a[1]), 'public reads carry no token');
++        await assert.rejects(tools.domains.history('not a domain'), TypeError);
++    }],
++
      ['429 with Retry-After is retried after the delay, with the same Idempotency-Key', async () => {
          let throttled = 0;
          const s = standIn({}, {
ddiff --git a/types/tools.d.ts b/types/tools.d.ts
iindex 139eb63..9c9a83c 100644
---- a/types/tools.d.ts
++++ b/types/tools.d.ts
@@@ -108,6 +108,11 @@ export interface ToolsClient {
      run(id: string, input?: Record<string, unknown>, opts?: ToolRunOptions): Promise<ToolRunOutcome>;
      /** openvibe-sdk/jobs on the same origin and credentials: the gateway's /api/v1/jobs facade. */
      jobs: JobsClient;
++    /** Domain history: what the WHOIS and RDAP tools saw of a domain over time (public registration facts only). */
++    domains: {
++        history(domain: string, opts?: { signal?: AbortSignal }): Promise<DomainHistory | null>;
++        lists(opts?: { limit?: number; signal?: AbortSignal }): Promise<DomainLists>;
++    };
  }
  
  export interface ToolsClientOptions {
@@@ -119,3 +124,24 @@ export interface ToolsClientOptions {
      anonymousReads?: boolean;
  }
  export declare function createToolsClient(client: OpenVibeClient, opts?: ToolsClientOptions): ToolsClient;
++
++/** A domain's public registration facts at one time (RDAP). Never contact details. */
++export interface DomainFacts {
++    registrar: string | null;
++    created: string | null;
++    updated: string | null;
++    expires: string | null;
++    status: string[];
++    nameservers: string[];
++    dnssec: boolean | null;
++}
++export interface DomainHistory {
++    ok: true;
++    domain: string;
++    snapshots: Array<{ facts: DomainFacts; first_seen: string; last_seen: string; seen: number }>;
++    changes: Array<{ at: string; changes: Array<{ field: keyof DomainFacts; before: unknown; after: unknown }> }>;
++    lookups: number;
++    first_seen: string | null;
++}
++export interface DomainListed { domain: string; lookups: number; registrar: string | null; expires: string | null }
++export interface DomainLists { ok: true; most_looked_up: DomainListed[]; expiring_soon: DomainListed[]; min_lookups: number }