@exla/rudder 3.9.1 → 3.9.4

package/assets/skills/namecheap/scripts/namecheap

@@ -0,0 +1,785 @@
+#!/usr/bin/env python3
+"""namecheap: the Namecheap account from the command line, safely, for agents.
+
+Namecheap's setHosts REPLACES every host record on a domain, so record changes
+never write blind: read the live records, merge, back the old set up, write,
+re-read and check. Anything that costs money (register, renew) shows the price
+and the balance and does nothing without --yes.
+
+Account
+  namecheap setup <api-user> [<api-key>] [--username U] [--client-ip IP]
+  namecheap check                         credentials + IP whitelist + domain list
+  namecheap balance                       account balance
+  namecheap domains [--expiring|--expired] [--search TEXT]
+  namecheap info <domain>                 status, expiry, auto-renew, privacy, nameservers
+  namecheap contacts <domain>             registrant/admin/tech/billing contacts
+
+Buying (prices first; --yes to spend)
+  namecheap available <domain> [...]      availability + premium price
+  namecheap price <tld> [--action register|renew|transfer]
+  namecheap register <domain> --contacts-from <owned domain> [--years N] [--yes]
+  namecheap renew <domain> [--years N] [--yes]
+  namecheap transfers                     incoming transfers and their status
+
+Registrar settings
+  namecheap nameservers <domain> [--set NS1 NS2 ...|--default]
+  namecheap lock <domain> [--on|--off]    registrar (transfer) lock
+  namecheap privacy [<domain>] [--on [--email E]|--off]   free domain privacy
+
+DNS (Namecheap BasicDNS)
+  namecheap list <domain>                 host records and email mode
+  namecheap set <domain> --add "A @ 76.76.21.21" --remove "CNAME www" [--replace] [--dry-run]
+  namecheap vercel <domain> [--sub NAME ...] [--dry-run]
+                                          apex + www (or subdomains) to Vercel, parking removed
+  namecheap forward <domain> [--add hello=you@example.com] [--remove hello] [--dry-run]
+  namecheap lookup <name> [TYPE]          DNS-over-HTTPS lookup (no dig needed)
+  namecheap restore <backup.json> [--dry-run]
+
+Credentials come from the environment or ~/.config/namecheap/credentials.env:
+  NAMECHEAP_API_USER, NAMECHEAP_API_KEY, NAMECHEAP_USERNAME (defaults to the
+  API user), NAMECHEAP_CLIENT_IP (defaults to this machine's public IPv4),
+  NAMECHEAP_SANDBOX=1 for the sandbox API.
+"""
+import argparse
+import json
+import os
+import shlex
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+import xml.etree.ElementTree as ET
+from datetime import datetime
+from pathlib import Path
+
+API = 'https://api.namecheap.com/xml.response'
+SANDBOX_API = 'https://api.sandbox.namecheap.com/xml.response'
+CONFIG_DIR = Path(os.environ.get('NAMECHEAP_CONFIG_DIR', Path.home() / '.config' / 'namecheap'))
+CRED_FILE = CONFIG_DIR / 'credentials.env'
+BACKUP_DIR = CONFIG_DIR / 'backups'
+NS = '{http://api.namecheap.com/xml.response}'
+TWO_LEVEL_TLDS = {
+    'co.uk', 'org.uk', 'me.uk', 'ltd.uk', 'plc.uk', 'net.uk', 'com.au', 'net.au', 'org.au',
+    'co.nz', 'net.nz', 'org.nz', 'co.jp', 'com.br', 'com.mx', 'co.in', 'co.za', 'com.sg', 'com.tr',
+}
+# Types this tool can read back and write again without losing fields.
+ROUND_TRIP_TYPES = {'A', 'AAAA', 'ALIAS', 'CNAME', 'MX', 'MXE', 'NS', 'TXT', 'URL', 'URL301', 'FRAME'}
+REDIRECT_TYPES = {'URL', 'URL301', 'FRAME'}
+PARKING_TARGETS = ('parkingpage.namecheap.com',)
+VERCEL_A = '76.76.21.21'
+VERCEL_CNAME = 'cname.vercel-dns.com.'
+DEFAULT_TTL = '1800'
+
+
+class ApiError(Exception):
+    def __init__(self, errors, client_ip):
+        self.errors = errors
+        hints = []
+        numbers = {number for number, _ in errors}
+        text = ' '.join(message for _, message in errors).lower()
+        if '1011150' in numbers or ('ip' in text and ('whitelist' in text or 'invalid request ip' in text)):
+            hints.append(
+                f'This machine\'s IP {client_ip} is not whitelisted. Namecheap dashboard: Profile > Tools > '
+                'Namecheap API Access > Whitelisted IPs > add it.')
+        if numbers & {'1011102', '1011104', '1010102', '1010104'} or 'api key' in text or 'apiuser' in text:
+            hints.append('API user or key rejected. Re-run `namecheap setup` with the key from Profile > Tools > Namecheap API Access.')
+        if 'not associated' in text or 'domain not found' in text or numbers & {'2019166', '2016166'}:
+            hints.append('That domain is not in this Namecheap account.')
+        detail = '; '.join(f'{number}: {message}' for number, message in errors)
+        super().__init__(detail + ''.join(f'\n  -> {hint}' for hint in hints))
+
+
+# ---------- credentials and transport ----------
+
+def read_cred_file():
+    values = {}
+    if CRED_FILE.exists():
+        for line in CRED_FILE.read_text().splitlines():
+            line = line.strip()
+            if line and not line.startswith('#') and '=' in line:
+                key, value = line.split('=', 1)
+                values[key.strip()] = value.strip().strip('"').strip("'")
+    return values
+
+
+def public_ip():
+    for url in ('https://api.ipify.org', 'https://ifconfig.me/ip', 'https://ipv4.icanhazip.com'):
+        try:
+            with urllib.request.urlopen(url, timeout=8) as response:
+                ip = response.read().decode().strip()
+                if ip.count('.') == 3:
+                    return ip
+        except (urllib.error.URLError, OSError):
+            continue
+    sys.exit('Could not find this machine\'s public IPv4. Set NAMECHEAP_CLIENT_IP.')
+
+
+def load_creds():
+    stored = read_cred_file()
+    get = lambda key: os.environ.get(key) or stored.get(key)
+    user, key = get('NAMECHEAP_API_USER'), get('NAMECHEAP_API_KEY')
+    if not user or not key:
+        sys.exit(
+            'NO_NAMECHEAP_CREDENTIALS: no API user/key in the environment or ' + str(CRED_FILE) + '.\n'
+            'One-time setup (the user does this once, then never again):\n'
+            '  1. Namecheap dashboard > Profile > Tools > Namecheap API Access > turn ON\n'
+            '     (Namecheap requires $50 balance, $50 spent in 2 years, or 20 domains).\n'
+            f'  2. Whitelisted IPs > add {public_ip()} (this machine).\n'
+            '  3. namecheap setup <namecheap-username>   (prompts for the key)')
+    return {
+        'ApiUser': user,
+        'ApiKey': key,
+        'UserName': get('NAMECHEAP_USERNAME') or user,
+        'ClientIp': get('NAMECHEAP_CLIENT_IP') or public_ip(),
+        'sandbox': get('NAMECHEAP_SANDBOX') == '1',
+    }
+
+
+def call(creds, command, **params):
+    data = {name: creds[name] for name in ('ApiUser', 'ApiKey', 'UserName', 'ClientIp')}
+    data['Command'] = command
+    data.update({name: str(value) for name, value in params.items()})
+    request = urllib.request.Request(
+        SANDBOX_API if creds['sandbox'] else API,
+        data=urllib.parse.urlencode(data).encode(),
+        method='POST',
+    )
+    with urllib.request.urlopen(request, timeout=30) as response:
+        root = ET.fromstring(response.read())
+    if root.get('Status') != 'OK':
+        errors = [(error.get('Number', '?'), (error.text or '').strip()) for error in root.iter(NS + 'Error')]
+        raise ApiError(errors or [('?', 'unknown error')], creds['ClientIp'])
+    return root.find(NS + 'CommandResponse')
+
+
+# ---------- domain records ----------
+
+def split_domain(domain):
+    labels = domain.lower().strip().strip('.').split('.')
+    if len(labels) >= 3 and '.'.join(labels[-2:]) in TWO_LEVEL_TLDS:
+        sld, tld, extra = labels[-3], '.'.join(labels[-2:]), labels[:-3]
+    elif len(labels) >= 2:
+        sld, tld, extra = labels[-2], labels[-1], labels[:-2]
+    else:
+        sys.exit(f'Not a domain: {domain}')
+    if extra:
+        sys.exit(f'Pass the registered domain ({sld}.{tld}), not a subdomain; use the host field for "{".".join(extra)}".')
+    return sld, tld
+
+
+def norm(record_type, value):
+    value = (value or '').strip()
+    return value if record_type == 'TXT' else value.rstrip('.').lower()
+
+
+def same(a, b):
+    return (a['type'] == b['type'] and a['host'].lower() == b['host'].lower()
+            and norm(a['type'], a['address']) == norm(b['type'], b['address']))
+
+
+def fmt(record):
+    extra = f" pref={record['mxpref']}" if record['type'] in ('MX', 'MXE') else ''
+    return f"{record['type']:<6} {record['host']:<14} {record['address']}  ttl={record['ttl']}{extra}"
+
+
+def get_hosts(creds, domain):
+    sld, tld = split_domain(domain)
+    result = call(creds, 'namecheap.domains.dns.getHosts', SLD=sld, TLD=tld).find(NS + 'DomainDNSGetHostsResult')
+    records = [{
+        'type': host.get('Type', '').upper(),
+        'host': host.get('Name', ''),
+        'address': host.get('Address', ''),
+        'ttl': host.get('TTL') or DEFAULT_TTL,
+        'mxpref': host.get('MXPref') or '10',
+    } for host in result.iter(NS + 'host')]
+    return {
+        'domain': domain,
+        'records': records,
+        'email_type': (result.get('EmailType') or '').upper(),
+        'using_namecheap_dns': (result.get('IsUsingOurDNS') or '').lower() == 'true',
+    }
+
+
+def set_hosts(creds, domain, records, email_type):
+    sld, tld = split_domain(domain)
+    params = {'SLD': sld, 'TLD': tld}
+    for index, record in enumerate(records, 1):
+        params[f'HostName{index}'] = record['host']
+        params[f'RecordType{index}'] = record['type']
+        params[f'Address{index}'] = record['address']
+        params[f'TTL{index}'] = record['ttl'] or DEFAULT_TTL
+        if record['type'] in ('MX', 'MXE'):
+            params[f'MXPref{index}'] = record['mxpref'] or '10'
+    if email_type and email_type != 'NONE':
+        params['EmailType'] = email_type
+    result = call(creds, 'namecheap.domains.dns.setHosts', **params).find(NS + 'DomainDNSSetHostsResult')
+    if result is None or (result.get('IsSuccess') or '').lower() != 'true':
+        sys.exit('setHosts did not report success; nothing verified. Check the domain in the dashboard.')
+
+
+def parse_spec(spec, need_value):
+    parts = shlex.split(spec)
+    if len(parts) < (3 if need_value else 2):
+        sys.exit(f'Bad record "{spec}". Use "TYPE HOST VALUE [TTL] [MXPREF]", e.g. "A @ 76.76.21.21".')
+    record = {'type': parts[0].upper(), 'host': parts[1], 'address': parts[2] if len(parts) > 2 else None,
+              'ttl': parts[3] if len(parts) > 3 else DEFAULT_TTL, 'mxpref': parts[4] if len(parts) > 4 else '10'}
+    if need_value and record['type'] not in ROUND_TRIP_TYPES:
+        sys.exit(f'Record type {record["type"]} is not supported by this tool.')
+    return record
+
+
+def conflicts(existing, new):
+    """Records that cannot coexist with `new` at the same host."""
+    host = new['host'].lower()
+    out = []
+    for record in existing:
+        if record['host'].lower() != host or same(record, new):
+            continue
+        if new['type'] == 'CNAME' or record['type'] == 'CNAME':
+            out.append(record)  # a CNAME owns its name outright
+        elif new['type'] in ('A', 'AAAA', 'ALIAS') and record['type'] in REDIRECT_TYPES | {'ALIAS'}:
+            out.append(record)  # a redirect or ALIAS answers for the same name
+        elif new['type'] in REDIRECT_TYPES and record['type'] in {'A', 'AAAA', 'ALIAS'} | REDIRECT_TYPES:
+            out.append(record)
+        elif new['type'] == record['type'] and new['type'] in ('A', 'AAAA'):
+            out.append(record)  # a second A would round-robin traffic to the old target
+    return out
+
+
+def plan_change(current, adds, removes, replace):
+    records = [dict(record) for record in current]
+    removed, added = [], []
+    for spec in removes:
+        for record in list(records):
+            if (record['type'] == spec['type'] and record['host'].lower() == spec['host'].lower()
+                    and (spec['address'] is None or norm(record['type'], record['address']) == norm(spec['type'], spec['address']))):
+                records.remove(record)
+                removed.append(record)
+    for new in adds:
+        if any(same(record, new) for record in records):
+            continue
+        clash = conflicts(records, new)
+        if clash and not replace:
+            sys.exit('Refusing: ' + fmt(new) + ' conflicts with existing record(s):\n  '
+                     + '\n  '.join(fmt(record) for record in clash)
+                     + '\nRe-run with --replace to swap them, or --remove them explicitly.')
+        for record in clash:
+            records.remove(record)
+            removed.append(record)
+        records.append(new)
+        added.append(new)
+    return records, removed, added
+
+
+def backup(state):
+    BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+    os.chmod(CONFIG_DIR, 0o700)
+    # Microseconds keep two writes in the same second from overwriting each other's backup.
+    path = BACKUP_DIR / f"{state['domain']}-{datetime.now().strftime('%Y%m%dT%H%M%S.%f')}.json"
+    path.write_text(json.dumps(state, indent=2))
+    return path
+
+
+def apply(creds, domain, state, records, removed, added, dry_run, email_type=None):
+    unknown = [record for record in state['records'] if record['type'] not in ROUND_TRIP_TYPES]
+    if unknown:
+        sys.exit('Refusing to rewrite: the domain has record types this tool cannot round-trip:\n  '
+                 + '\n  '.join(fmt(record) for record in unknown) + '\nChange them in the dashboard instead.')
+    if not state['using_namecheap_dns']:
+        sys.exit(f'{domain} is not on Namecheap DNS (custom nameservers). Change records at that DNS host instead.')
+    for record in removed:
+        print('- ' + fmt(record))
+    for record in added:
+        print('+ ' + fmt(record))
+    target_email = email_type or state['email_type']
+    if target_email != state['email_type']:
+        print(f"~ email mode {state['email_type'] or 'NONE'} -> {target_email}")
+    if not removed and not added and target_email == state['email_type']:
+        print('No change needed; the records are already in place.')
+        return
+    if dry_run:
+        print('(dry run: nothing written)')
+        return
+    saved = backup(state)
+    print(f'Backed up previous records to {saved}')
+    set_hosts(creds, domain, records, target_email)
+    after = get_hosts(creds, domain)
+    missing = [record for record in added if not any(same(record, live) for live in after['records'])]
+    lingering = [record for record in removed if any(same(record, live) for live in after['records'])]
+    if missing or lingering:
+        sys.exit('Verification failed after write. Missing: ' + ', '.join(map(fmt, missing))
+                 + ' Still present: ' + ', '.join(map(fmt, lingering)) + f'\nRestore with: namecheap restore {saved}')
+    print(f'Verified: {len(after["records"])} records live on Namecheap. Public DNS catches up within the TTL:')
+    print(f'  namecheap lookup {domain} A')
+
+
+# ---------- commands ----------
+
+def cmd_setup(args):
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    os.chmod(CONFIG_DIR, 0o700)
+    api_key = args.api_key
+    if not api_key:
+        import getpass
+        # Prompted, not an argument: a key on the command line lands in shell
+        # history and the process list.
+        api_key = getpass.getpass('Namecheap API key: ').strip()
+    if not api_key:
+        sys.exit('No API key given.')
+    lines = [f'NAMECHEAP_API_USER={args.api_user}', f'NAMECHEAP_API_KEY={api_key}']
+    if args.username:
+        lines.append(f'NAMECHEAP_USERNAME={args.username}')
+    if args.client_ip:
+        lines.append(f'NAMECHEAP_CLIENT_IP={args.client_ip}')
+    fd = os.open(CRED_FILE, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, 'w') as handle:
+        handle.write('\n'.join(lines) + '\n')
+    os.chmod(CRED_FILE, 0o600)
+    print(f'Saved credentials to {CRED_FILE} (mode 600).')
+    cmd_check(args)
+
+
+def cmd_check(_args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.domains.getList', PageSize=100).find(NS + 'DomainGetListResult')
+    domains = [(domain.get('Name'), domain.get('IsOurDNS'), domain.get('Expires')) for domain in result.iter(NS + 'Domain')]
+    print(f"OK: API user {creds['ApiUser']} from IP {creds['ClientIp']}. {len(domains)} domain(s):")
+    for name, ours, expires in domains:
+        print(f"  {name:<32} {'Namecheap DNS' if (ours or '').lower() == 'true' else 'custom nameservers':<20} expires {expires}")
+
+
+def cmd_list(args):
+    state = get_hosts(load_creds(), args.domain)
+    print(f"{args.domain}: {'Namecheap DNS' if state['using_namecheap_dns'] else 'custom nameservers'}, "
+          f"email mode {state['email_type'] or 'NONE'}")
+    for record in state['records']:
+        print('  ' + fmt(record))
+
+
+def cmd_set(args):
+    creds = load_creds()
+    state = get_hosts(creds, args.domain)
+    adds = [parse_spec(spec, True) for spec in args.add]
+    removes = [parse_spec(spec, False) for spec in args.remove]
+    records, removed, added = plan_change(state['records'], adds, removes, args.replace)
+    apply(creds, args.domain, state, records, removed, added, args.dry_run)
+
+
+def cmd_vercel(args):
+    creds = load_creds()
+    state = get_hosts(creds, args.domain)
+    removes = []
+    for record in state['records']:
+        if norm('CNAME', record['address']).endswith(PARKING_TARGETS) or (
+                record['type'] in REDIRECT_TYPES and record['host'] in ('@', 'www')):
+            removes.append(dict(record))  # Namecheap's default parking page and redirects
+    names = args.sub or ['@', 'www']
+    adds = []
+    for name in names:
+        if name == '@':
+            adds.append({'type': 'A', 'host': '@', 'address': VERCEL_A, 'ttl': DEFAULT_TTL, 'mxpref': '10'})
+        else:
+            adds.append({'type': 'CNAME', 'host': name, 'address': VERCEL_CNAME, 'ttl': DEFAULT_TTL, 'mxpref': '10'})
+    records, removed, added = plan_change(state['records'], adds, removes, replace=True)
+    apply(creds, args.domain, state, records, removed, added, args.dry_run)
+    if not args.dry_run:
+        print('Next: `vercel domains add ' + (args.domain if names == ['@', 'www'] else f'{names[0]}.{args.domain}')
+              + ' <project>` if not attached yet, then `vercel domains inspect` to confirm.')
+
+
+def cmd_forward(args):
+    creds = load_creds()
+    domain = args.domain.lower()
+    result = call(creds, 'namecheap.domains.dns.getEmailForwarding', DomainName=domain).find(
+        NS + 'DomainDNSGetEmailForwardingResult')
+    forwards = [(forward.get('mailbox'), (forward.text or '').strip()) for forward in result.iter(NS + 'Forward')]
+    if not args.add and not args.remove:
+        print(f'{domain} email forwards:' if forwards else f'{domain}: no email forwards')
+        for mailbox, target in forwards:
+            print(f'  {mailbox}@{domain} -> {target}')
+        return
+    wanted = [(mailbox, target) for mailbox, target in forwards if mailbox not in set(args.remove)]
+    for spec in args.add:
+        if '=' not in spec:
+            sys.exit(f'Bad forward "{spec}". Use mailbox=destination, e.g. hello=you@example.com')
+        mailbox, target = (part.strip() for part in spec.split('=', 1))
+        wanted = [(m, t) for m, t in wanted if m != mailbox] + [(mailbox, target)]
+    state = get_hosts(creds, domain)
+    if state['email_type'] != 'FWD':
+        has_mx = any(record['type'] in ('MX', 'MXE') for record in state['records'])
+        if has_mx and not args.force:
+            sys.exit(f"{domain} receives mail through MX records (mode {state['email_type']}). Switching to "
+                     'forwarding would cut that mail off. Re-run with --force only if that mail setup is unused.')
+        print(f"Switching {domain} email mode {state['email_type'] or 'NONE'} -> FWD")
+        records = [record for record in state['records'] if record['type'] not in ('MX', 'MXE')]
+        removed = [record for record in state['records'] if record['type'] in ('MX', 'MXE')]
+        apply(creds, domain, state, records, removed, [], args.dry_run, email_type='FWD')
+    for mailbox, target in wanted:
+        print(f'  {mailbox}@{domain} -> {target}')
+    if args.dry_run:
+        print('(dry run: forwards not written)')
+        return
+    params = {'DomainName': domain}
+    for index, (mailbox, target) in enumerate(wanted, 1):
+        params[f'MailBox{index}'] = mailbox
+        params[f'ForwardTo{index}'] = target
+    call(creds, 'namecheap.domains.dns.setEmailForwarding', **params)
+    print('Forwards saved.')
+
+
+def text(node, tag):
+    found = node.find(NS + tag) if node is not None else None
+    return (found.text or '').strip() if found is not None else ''
+
+
+def cmd_balance(_args):
+    result = call(load_creds(), 'namecheap.users.getBalances').find(NS + 'UserGetBalancesResult')
+    print(f"Available {result.get('AvailableBalance')} {result.get('Currency')} "
+          f"(account {result.get('AccountBalance')}, earned {result.get('EarnedAmount')}, "
+          f"funds needed for auto-renew {result.get('FundsRequiredForAutoRenew')})")
+
+
+def all_domains(creds, list_type='ALL', search=None):
+    page, out = 1, []
+    while True:
+        params = {'PageSize': 100, 'Page': page, 'ListType': list_type}
+        if search:
+            params['SearchTerm'] = search
+        response = call(creds, 'namecheap.domains.getList', **params)
+        batch = list(response.find(NS + 'DomainGetListResult').iter(NS + 'Domain'))
+        out.extend(batch)
+        paging = response.find(NS + 'Paging')
+        total = int(text(paging, 'TotalItems') or len(out))
+        if not batch or len(out) >= total:
+            return out
+        page += 1
+
+
+def cmd_domains(args):
+    list_type = 'EXPIRING' if args.expiring else 'EXPIRED' if args.expired else 'ALL'
+    domains = all_domains(load_creds(), list_type, args.search)
+    print(f'{len(domains)} domain(s):')
+    for domain in domains:
+        flags = [label for label, attr in (('auto-renew', 'AutoRenew'), ('locked', 'IsLocked'), ('privacy', 'WhoisGuard'))
+                 if (domain.get(attr) or '').lower() in ('true', 'enabled')]
+        dns = 'Namecheap DNS' if (domain.get('IsOurDNS') or '').lower() == 'true' else 'custom NS'
+        print(f"  {domain.get('Name'):<32} expires {domain.get('Expires'):<11} {dns:<14} {' '.join(flags)}")
+
+
+def cmd_info(args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.domains.getInfo', DomainName=args.domain).find(NS + 'DomainGetInfoResult')
+    details = result.find(NS + 'DomainDetails')
+    privacy = result.find(NS + 'Whoisguard')
+    dns = result.find(NS + 'DnsDetails')
+    print(f"{result.get('DomainName')}: status {result.get('Status')}, owner {result.get('OwnerName')}, "
+          f"premium {result.get('IsPremium')}")
+    print(f"  created {text(details, 'CreatedDate')}, expires {text(details, 'ExpiredDate')}")
+    print(f"  privacy {privacy.get('Enabled') if privacy is not None else '?'}"
+          f"{' until ' + text(privacy, 'ExpiredDate') if privacy is not None and text(privacy, 'ExpiredDate') else ''}")
+    if dns is not None:
+        servers = [(server.text or '').strip() for server in dns.iter(NS + 'Nameserver')]
+        print(f"  DNS {dns.get('ProviderType')}: {', '.join(servers) or '(none listed)'}")
+    lock = call(creds, 'namecheap.domains.getRegistrarLock', DomainName=args.domain).find(NS + 'DomainGetRegistrarLockResult')
+    print(f"  registrar lock {lock.get('RegistrarLockStatus') if lock is not None else '?'}")
+
+
+CONTACT_ROLES = ('Registrant', 'Tech', 'Admin', 'AuxBilling')
+CONTACT_FIELDS = ('OrganizationName', 'JobTitle', 'FirstName', 'LastName', 'Address1', 'Address2', 'City',
+                  'StateProvince', 'StateProvinceChoice', 'PostalCode', 'Country', 'Phone', 'PhoneExt', 'Fax',
+                  'EmailAddress')
+
+
+def get_contacts(creds, domain):
+    result = call(creds, 'namecheap.domains.getContacts', DomainName=domain).find(NS + 'DomainContactsResult')
+    return {role: {field: text(result.find(NS + role), field) for field in CONTACT_FIELDS} for role in CONTACT_ROLES}
+
+
+def cmd_contacts(args):
+    for role, fields in get_contacts(load_creds(), args.domain).items():
+        name = ' '.join(filter(None, (fields['FirstName'], fields['LastName'])))
+        place = ', '.join(filter(None, (fields['City'], fields['StateProvince'], fields['Country'])))
+        print(f"  {role:<10} {name} <{fields['EmailAddress']}> {fields['OrganizationName']} {place}".rstrip())
+
+
+def cmd_available(args):
+    result = call(load_creds(), 'namecheap.domains.check', DomainList=','.join(args.domains))
+    for domain in result.iter(NS + 'DomainCheckResult'):
+        available = (domain.get('Available') or '').lower() == 'true'
+        premium = (domain.get('IsPremiumName') or '').lower() == 'true'
+        price = f" premium {domain.get('PremiumRegistrationPrice')}" if premium else ''
+        print(f"  {domain.get('Domain'):<32} {'AVAILABLE' if available else 'taken'}{price}")
+
+
+def tld_price(creds, tld, action, years=1):
+    response = call(creds, 'namecheap.users.getPricing', ProductType='DOMAIN',
+                    ProductCategory=action.upper(), ProductName=tld)
+    for product in response.iter(NS + 'Product'):
+        for price in product.iter(NS + 'Price'):
+            if price.get('Duration') == str(years):
+                return price
+    return None
+
+
+def cmd_price(args):
+    tld = args.tld.lstrip('.').lower()
+    price = tld_price(load_creds(), tld, args.action, args.years)
+    if price is None:
+        sys.exit(f'No {args.action} price for .{tld} ({args.years} year).')
+    print(f".{tld} {args.action} {args.years} year(s): {price.get('YourPrice') or price.get('Price')} {price.get('Currency')}"
+          f" (list {price.get('RegularPrice') or price.get('Price')}{', +ICANN fee ' + price.get('YourAdditonalCost') if price.get('YourAdditonalCost') else ''})")
+
+
+def money_gate(creds, what, price_node, years, yes):
+    balance = call(creds, 'namecheap.users.getBalances').find(NS + 'UserGetBalancesResult')
+    cost = price_node.get('YourPrice') or price_node.get('Price') if price_node is not None else '?'
+    currency = price_node.get('Currency') if price_node is not None else ''
+    print(f"{what}: {cost} {currency} per year x {years}; account balance {balance.get('AvailableBalance')} {balance.get('Currency')}")
+    if not yes:
+        sys.exit('Not charged. This spends money: confirm the item and total with the user, then re-run with --yes.')
+
+
+def cmd_renew(args):
+    creds = load_creds()
+    _, tld = split_domain(args.domain)
+    money_gate(creds, f'Renew {args.domain}', tld_price(creds, tld, 'renew', 1), args.years, args.yes)
+    result = call(creds, 'namecheap.domains.renew', DomainName=args.domain, Years=args.years).find(NS + 'DomainRenewResult')
+    print(f"Renewed {args.domain}: charged {result.get('ChargedAmount')}, order {result.get('OrderID')}")
+
+
+def cmd_register(args):
+    creds = load_creds()
+    _, tld = split_domain(args.domain)
+    check = call(creds, 'namecheap.domains.check', DomainList=args.domain).find(NS + 'DomainCheckResult')
+    if (check.get('Available') or '').lower() != 'true':
+        sys.exit(f'{args.domain} is not available.')
+    if (check.get('IsPremiumName') or '').lower() == 'true':
+        sys.exit(f"{args.domain} is a premium name ({check.get('PremiumRegistrationPrice')}); register it in the dashboard.")
+    contacts = get_contacts(creds, args.contacts_from)
+    money_gate(creds, f'Register {args.domain}', tld_price(creds, tld, 'register', 1), args.years, args.yes)
+    params = {'DomainName': args.domain, 'Years': args.years, 'AddFreeWhoisguard': 'yes', 'WGEnabled': 'yes'}
+    for role, fields in contacts.items():
+        for field, value in fields.items():
+            if value:
+                params[role + field] = value
+    if args.nameservers:
+        params['Nameservers'] = ','.join(args.nameservers)
+    result = call(creds, 'namecheap.domains.create', **params).find(NS + 'DomainCreateResult')
+    print(f"Registered {result.get('Domain')}: {result.get('Registered')}, charged {result.get('ChargedAmount')}, "
+          f"order {result.get('OrderID')}, privacy on")
+
+
+def cmd_transfers(_args):
+    result = call(load_creds(), 'namecheap.domains.transfer.getList', PageSize=100).find(NS + 'TransferGetListResult')
+    transfers = list(result.iter(NS + 'Transfer')) if result is not None else []
+    print(f'{len(transfers)} transfer(s):')
+    for transfer in transfers:
+        print(f"  {transfer.get('DomainName'):<32} {transfer.get('Status')} ({transfer.get('StatusDescription')}) "
+              f"id {transfer.get('ID')} {transfer.get('TransferDate')}")
+
+
+def cmd_nameservers(args):
+    creds = load_creds()
+    sld, tld = split_domain(args.domain)
+    if args.set and args.default:
+        sys.exit('Use --set or --default, not both.')
+    if args.set:
+        if len(args.set) < 2:
+            sys.exit('Give at least two nameservers.')
+        print(f"{args.domain}: nameservers -> {', '.join(args.set)}. Namecheap's own records stop being served.")
+        if not args.yes:
+            sys.exit('Not changed: re-run with --yes (it moves the whole domain to another DNS host).')
+        call(creds, 'namecheap.domains.dns.setCustom', SLD=sld, TLD=tld, Nameservers=','.join(args.set))
+    elif args.default:
+        print(f'{args.domain}: nameservers -> Namecheap BasicDNS.')
+        if not args.yes:
+            sys.exit('Not changed: re-run with --yes (records at the current DNS host stop being served).')
+        call(creds, 'namecheap.domains.dns.setDefault', SLD=sld, TLD=tld)
+    result = call(creds, 'namecheap.domains.dns.getList', SLD=sld, TLD=tld).find(NS + 'DomainDNSGetListResult')
+    servers = [(server.text or '').strip() for server in result.iter(NS + 'Nameserver')]
+    kind = 'Namecheap DNS' if (result.get('IsUsingOurDNS') or '').lower() == 'true' else 'custom'
+    print(f"{args.domain}: {kind}: {', '.join(servers)}")
+
+
+def cmd_lock(args):
+    creds = load_creds()
+    if args.on or args.off:
+        call(creds, 'namecheap.domains.setRegistrarLock', DomainName=args.domain, LockAction='LOCK' if args.on else 'UNLOCK')
+    result = call(creds, 'namecheap.domains.getRegistrarLock', DomainName=args.domain).find(NS + 'DomainGetRegistrarLockResult')
+    print(f"{args.domain}: registrar lock {result.get('RegistrarLockStatus')}")
+
+
+def cmd_privacy(args):
+    creds = load_creds()
+    result = call(creds, 'namecheap.whoisguard.getList', PageSize=100, ListType='ALL').find(NS + 'WhoisguardGetListResult')
+    entries = list(result.iter(NS + 'Whoisguard')) if result is not None else []
+    if args.domain:
+        entries = [entry for entry in entries if (entry.get('DomainName') or '').lower() == args.domain.lower()]
+        if not entries:
+            sys.exit(f'No domain privacy subscription found for {args.domain}.')
+    if args.on or args.off:
+        if not args.domain:
+            sys.exit('Name the domain to change.')
+        entry = entries[0]
+        if args.on:
+            email = args.email or get_contacts(creds, args.domain)['Registrant']['EmailAddress']
+            call(creds, 'namecheap.whoisguard.enable', WhoisguardID=entry.get('ID'), ForwardedToEmail=email)
+        else:
+            call(creds, 'namecheap.whoisguard.disable', WhoisguardID=entry.get('ID'))
+        return cmd_privacy(argparse.Namespace(domain=args.domain, on=False, off=False, email=None))
+    for entry in entries:
+        print(f"  {entry.get('DomainName') or '(unassigned)':<32} {entry.get('Status'):<10} id {entry.get('ID')} expires {entry.get('Expires')}")
+
+
+def cmd_lookup(args):
+    """Resolve through Google and Cloudflare DNS-over-HTTPS; works where dig is not installed."""
+    for resolver in ('https://dns.google/resolve', 'https://cloudflare-dns.com/dns-query'):
+        url = f'{resolver}?' + urllib.parse.urlencode({'name': args.name, 'type': args.type.upper()})
+        request = urllib.request.Request(url, headers={'Accept': 'application/dns-json'})
+        try:
+            with urllib.request.urlopen(request, timeout=10) as response:
+                answers = json.load(response).get('Answer', [])
+        except (urllib.error.URLError, OSError, ValueError):
+            continue
+        records = [answer['data'] for answer in answers]
+        print(f"{args.name} {args.type.upper()} via {resolver.split('/')[2]}: " + (', '.join(records) or '(no answer)'))
+        if args.type.upper() == 'NS' and any('registrar-servers.com' in record for record in records):
+            print('-> Namecheap BasicDNS: use this tool.')
+        return
+    sys.exit('Both DNS-over-HTTPS resolvers were unreachable.')
+
+
+def cmd_restore(args):
+    saved = json.loads(Path(args.backup).read_text())
+    creds = load_creds()
+    state = get_hosts(creds, saved['domain'])
+    removed = [record for record in state['records'] if not any(same(record, old) for old in saved['records'])]
+    added = [record for record in saved['records'] if not any(same(record, live) for live in state['records'])]
+    apply(creds, saved['domain'], state, saved['records'], removed, added, args.dry_run, email_type=saved['email_type'])
+
+
+def main():
+    parser = argparse.ArgumentParser(prog='namecheap', description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    sub = parser.add_subparsers(dest='command', required=True)
+
+    p = sub.add_parser('setup', help='store API credentials, then check them')
+    p.add_argument('api_user')
+    p.add_argument('api_key', nargs='?', help='omit to be prompted (keeps it out of shell history)')
+    p.add_argument('--username')
+    p.add_argument('--client-ip')
+    p.set_defaults(func=cmd_setup)
+
+    sub.add_parser('check', help='verify credentials and list domains').set_defaults(func=cmd_check)
+
+    sub.add_parser('balance', help='account balance').set_defaults(func=cmd_balance)
+
+    p = sub.add_parser('domains', help='list domains in the account')
+    p.add_argument('--expiring', action='store_true')
+    p.add_argument('--expired', action='store_true')
+    p.add_argument('--search')
+    p.set_defaults(func=cmd_domains)
+
+    p = sub.add_parser('info', help='status, expiry, privacy, nameservers, lock')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_info)
+
+    p = sub.add_parser('contacts', help='WHOIS contacts on a domain')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_contacts)
+
+    p = sub.add_parser('available', help='is a domain free to register')
+    p.add_argument('domains', nargs='+')
+    p.set_defaults(func=cmd_available)
+
+    p = sub.add_parser('price', help='your price for a TLD')
+    p.add_argument('tld')
+    p.add_argument('--action', choices=('register', 'renew', 'transfer'), default='register')
+    p.add_argument('--years', type=int, default=1)
+    p.set_defaults(func=cmd_price)
+
+    p = sub.add_parser('register', help='buy a domain (price first; --yes to charge)')
+    p.add_argument('domain')
+    p.add_argument('--contacts-from', required=True, metavar='OWNED_DOMAIN', help='copy WHOIS contacts from a domain you own')
+    p.add_argument('--years', type=int, default=1)
+    p.add_argument('--nameservers', nargs='+', help='custom nameservers (default: Namecheap BasicDNS)')
+    p.add_argument('--yes', action='store_true', help='actually charge the account')
+    p.set_defaults(func=cmd_register)
+
+    p = sub.add_parser('renew', help='renew a domain (price first; --yes to charge)')
+    p.add_argument('domain')
+    p.add_argument('--years', type=int, default=1)
+    p.add_argument('--yes', action='store_true', help='actually charge the account')
+    p.set_defaults(func=cmd_renew)
+
+    sub.add_parser('transfers', help='incoming domain transfers').set_defaults(func=cmd_transfers)
+
+    p = sub.add_parser('nameservers', help='show or change nameservers')
+    p.add_argument('domain')
+    p.add_argument('--set', nargs='+', metavar='NS')
+    p.add_argument('--default', action='store_true', help='back to Namecheap BasicDNS')
+    p.add_argument('--yes', action='store_true', help='confirm the switch')
+    p.set_defaults(func=cmd_nameservers)
+
+    p = sub.add_parser('lock', help='show or change the registrar lock')
+    p.add_argument('domain')
+    group = p.add_mutually_exclusive_group()
+    group.add_argument('--on', action='store_true')
+    group.add_argument('--off', action='store_true')
+    p.set_defaults(func=cmd_lock)
+
+    p = sub.add_parser('privacy', help='show or change free domain privacy')
+    p.add_argument('domain', nargs='?')
+    group = p.add_mutually_exclusive_group()
+    group.add_argument('--on', action='store_true')
+    group.add_argument('--off', action='store_true')
+    p.add_argument('--email', help='where privacy forwards mail (default: the registrant email)')
+    p.set_defaults(func=cmd_privacy)
+
+    p = sub.add_parser('list', help='show host records')
+    p.add_argument('domain')
+    p.set_defaults(func=cmd_list)
+
+    p = sub.add_parser('set', help='add/remove host records (merged, backed up, verified)')
+    p.add_argument('domain')
+    p.add_argument('--add', action='append', default=[], metavar='"TYPE HOST VALUE [TTL] [MXPREF]"')
+    p.add_argument('--remove', action='append', default=[], metavar='"TYPE HOST [VALUE]"')
+    p.add_argument('--replace', action='store_true', help='swap out records that conflict with an added one')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_set)
+
+    p = sub.add_parser('vercel', help='point the apex + www (or --sub names) at Vercel')
+    p.add_argument('domain')
+    p.add_argument('--sub', action='append', metavar='NAME', help='subdomain(s) to CNAME to Vercel instead of @ + www')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_vercel)
+
+    p = sub.add_parser('forward', help='list or change free email forwarding')
+    p.add_argument('domain')
+    p.add_argument('--add', action='append', default=[], metavar='mailbox=destination')
+    p.add_argument('--remove', action='append', default=[], metavar='mailbox')
+    p.add_argument('--force', action='store_true', help='allow switching a domain off MX mail to forwarding')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_forward)
+
+    p = sub.add_parser('lookup', help='resolve a name over DNS-over-HTTPS (no dig needed)')
+    p.add_argument('name')
+    p.add_argument('type', nargs='?', default='A')
+    p.set_defaults(func=cmd_lookup)
+
+    p = sub.add_parser('restore', help='put a backup back')
+    p.add_argument('backup')
+    p.add_argument('--dry-run', action='store_true')
+    p.set_defaults(func=cmd_restore)
+
+    args = parser.parse_args()
+    try:
+        args.func(args)
+    except ApiError as error:
+        sys.exit(f'Namecheap API error: {error}')
+    except urllib.error.URLError as error:
+        sys.exit(f'Could not reach the Namecheap API: {error}')
+
+
+if __name__ == '__main__':
+    main()