update

internal/api/handlers.go

···
 		"discovered_at": ep.DiscoveredAt,
 		"last_checked":  ep.LastChecked,
 		"status":        statusToString(ep.Status),
-		// REMOVED: "user_count": ep.UserCount,  // No longer exists
 	}
 
-	// Add IP if available
+	// Add IPs if available
 	if ep.IP != "" {
 		response["ip"] = ep.IP
 	}
-
-	// REMOVED: IP info extraction - no longer in Endpoint struct
-	// IPInfo is now in separate table, joined only in PDS handlers
+	if ep.IPv6 != "" {
+		response["ipv6"] = ep.IPv6
+	}
 
 	return response
 }
···
 		}
 	}
 
-	// Add IP if available
+	// Add IPs if available
 	if pds.IP != "" {
 		response["ip"] = pds.IP
+	}
+	if pds.IPv6 != "" {
+		response["ipv6"] = pds.IPv6
 	}
 
 	// Add IP info (from ip_infos table via JOIN)

internal/plc/helpers.go

···
 package plc
 
-import "strings"
+import (
+	"regexp"
+	"strings"
+)
 
 // MaxHandleLength is the maximum allowed handle length for database storage
 const MaxHandleLength = 500
+
+// Handle validation regex per AT Protocol spec
+// Ensures proper domain format: alphanumeric labels separated by dots, TLD starts with letter
+var handleRegex = regexp.MustCompile(`^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$`)
 
 // ExtractHandle safely extracts the handle from a PLC operation
 func ExtractHandle(op *PLCOperation) string {
···
 }
 
 // ValidateHandle checks if a handle is valid for database storage
-// Returns empty string if handle is too long
+// Returns empty string if handle is invalid (too long or wrong format)
 func ValidateHandle(handle string) string {
+	if handle == "" {
+		return ""
+	}
+
+	// Check length first (faster)
 	if len(handle) > MaxHandleLength {
 		return ""
 	}
+
+	// Validate format using regex
+	if !handleRegex.MatchString(handle) {
+		return ""
+	}
+
 	return handle
 }
 

internal/storage/postgres.go

···
 	log.Info("Running database migrations...")
 
 	schema := `
-	-- Endpoints table (NO user_count, NO ip_info)
-	CREATE TABLE IF NOT EXISTS endpoints (
-		id BIGSERIAL PRIMARY KEY,
-		endpoint_type TEXT NOT NULL DEFAULT 'pds',
-		endpoint TEXT NOT NULL,
-		server_did TEXT,
-		discovered_at TIMESTAMP NOT NULL,
-		last_checked TIMESTAMP,
-		status INTEGER DEFAULT 0,
-		ip TEXT,
-		ipv6 TEXT,
-		ip_resolved_at TIMESTAMP,
-		updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-		UNIQUE(endpoint_type, endpoint)
-	);
+    -- Endpoints table (with IPv6 support)
+    CREATE TABLE IF NOT EXISTS endpoints (
+        id BIGSERIAL PRIMARY KEY,
+        endpoint_type TEXT NOT NULL DEFAULT 'pds',
+        endpoint TEXT NOT NULL,
+        server_did TEXT,
+        discovered_at TIMESTAMP NOT NULL,
+        last_checked TIMESTAMP,
+        status INTEGER DEFAULT 0,
+        ip TEXT,
+        ipv6 TEXT,
+        ip_resolved_at TIMESTAMP,
+        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE(endpoint_type, endpoint)
+    );
 
-	CREATE INDEX IF NOT EXISTS idx_endpoints_type_endpoint ON endpoints(endpoint_type, endpoint);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_status ON endpoints(status);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_type ON endpoints(endpoint_type);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_ip ON endpoints(ip);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_ipv6 ON endpoints(ipv6);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_server_did ON endpoints(server_did);
-	CREATE INDEX IF NOT EXISTS idx_endpoints_server_did_type_discovered ON endpoints(server_did, endpoint_type, discovered_at);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_type_endpoint ON endpoints(endpoint_type, endpoint);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_status ON endpoints(status);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_type ON endpoints(endpoint_type);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_ip ON endpoints(ip);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_ipv6 ON endpoints(ipv6);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_server_did ON endpoints(server_did);
+    CREATE INDEX IF NOT EXISTS idx_endpoints_server_did_type_discovered ON endpoints(server_did, endpoint_type, discovered_at);
 
 	-- IP infos table (IP as PRIMARY KEY)
 	CREATE TABLE IF NOT EXISTS ip_infos (
···
 				discovered_at,
 				last_checked,
 				status,
-				ip
+				ip,
+				ipv6
 			FROM endpoints
 			WHERE endpoint_type = 'pds'
 			ORDER BY COALESCE(server_did, id::text), discovered_at ASC
 		)
 		SELECT 
-			e.id, e.endpoint, e.server_did, e.discovered_at, e.last_checked, e.status, e.ip,
+			e.id, e.endpoint, e.server_did, e.discovered_at, e.last_checked, e.status, e.ip, e.ipv6,
 			latest.user_count, latest.response_time, latest.version, latest.scanned_at,
 			i.city, i.country, i.country_code, i.asn, i.asn_org,
 			i.is_datacenter, i.is_vpn, i.is_crawler, i.is_tor, i.is_proxy,
···
 	var items []*PDSListItem
 	for rows.Next() {
 		item := &PDSListItem{}
-		var ip, serverDID, city, country, countryCode, asnOrg sql.NullString
+		var ip, ipv6, serverDID, city, country, countryCode, asnOrg sql.NullString
 		var asn sql.NullInt32
 		var isDatacenter, isVPN, isCrawler, isTor, isProxy sql.NullBool
 		var lat, lon sql.NullFloat64
···
 		var scannedAt sql.NullTime
 
 		err := rows.Scan(
-			&item.ID, &item.Endpoint, &serverDID, &item.DiscoveredAt, &item.LastChecked, &item.Status, &ip,
+			&item.ID, &item.Endpoint, &serverDID, &item.DiscoveredAt, &item.LastChecked, &item.Status, &ip, &ipv6,
 			&userCount, &responseTime, &version, &scannedAt,
 			&city, &country, &countryCode, &asn, &asnOrg,
 			&isDatacenter, &isVPN, &isCrawler, &isTor, &isProxy,
···
 
 		if ip.Valid {
 			item.IP = ip.String
+		}
+		if ipv6.Valid {
+			item.IPv6 = ipv6.String
 		}
 		if serverDID.Valid {
 			item.ServerDID = serverDID.String
···
 				e.discovered_at, 
 				e.last_checked, 
 				e.status, 
-				e.ip
+				e.ip,
+				e.ipv6
 			FROM endpoints e
 			WHERE e.endpoint = $1 AND e.endpoint_type = 'pds'
 		),
···
 			te.last_checked, 
 			te.status, 
 			te.ip,
+			te.ipv6,
 			latest.user_count,
 			latest.response_time,
 			latest.version,
···
 	`
 
 	detail := &PDSDetail{}
-	var ip, city, country, countryCode, asnOrg, serverDID sql.NullString
+	var ip, ipv6, city, country, countryCode, asnOrg, serverDID sql.NullString
 	var asn sql.NullInt32
 	var isDatacenter, isVPN, isCrawler, isTor, isProxy sql.NullBool
 	var lat, lon sql.NullFloat64
···
 	var firstDiscoveredAt sql.NullTime
 
 	err := p.db.QueryRowContext(ctx, query, endpoint).Scan(
-		&detail.ID, &detail.Endpoint, &serverDID, &detail.DiscoveredAt, &detail.LastChecked, &detail.Status, &ip,
+		&detail.ID, &detail.Endpoint, &serverDID, &detail.DiscoveredAt, &detail.LastChecked, &detail.Status, &ip, &ipv6,
 		&userCount, &responseTime, &version, &serverInfoJSON, &scannedAt,
 		&city, &country, &countryCode, &asn, &asnOrg,
 		&isDatacenter, &isVPN, &isCrawler, &isTor, &isProxy,
···
 
 	if ip.Valid {
 		detail.IP = ip.String
+	}
+	if ipv6.Valid {
+		detail.IPv6 = ipv6.String
 	}
 
 	if serverDID.Valid {

internal/storage/types.go

···
 	// From endpoints table
 	ID           int64
 	Endpoint     string
-	ServerDID    string // NEW: Add this
+	ServerDID    string
 	DiscoveredAt time.Time
 	LastChecked  time.Time
 	Status       int
 	IP           string
+	IPv6         string // NEW
 
 	// From latest endpoint_scans (via JOIN)
 	LatestScan *struct {