@lizard-build/cli 4.0.64 → 4.0.66

package/src/commands/domain-owned.ts

@@ -0,0 +1,202 @@
+import chalk from "chalk";
+import * as p from "@clack/prompts";
+import { Command } from "commander";
+import { api, APIError } from "../lib/api.js";
+import { success, isJSONMode, printJSON, table, isTTY, info } from "../lib/format.js";
+
+/**
+ * Domains bought on Lizard (lizard.build/domains): `lizard domain owned` lists them,
+ * `lizard domain dns <domain>` reads and edits their DNS records, and `lizard domain
+ * <hostname>` on one of them (or a subdomain) sets the DNS itself instead of printing
+ * records to add. These endpoints take a login or an unscoped API key, never a scoped one.
+ */
+
+export interface OwnedDomain {
+  id: string;
+  domain: string;
+  status: string;
+  appId: string | null;
+  expiresAt: number | null;
+}
+
+type DnsType = "A" | "AAAA" | "CNAME" | "ALIAS" | "MX" | "TXT" | "URL301";
+interface DnsRecord { name: string; type: DnsType; value: string; ttl: number; priority?: number }
+const DNS_TYPES: DnsType[] = ["A", "AAAA", "CNAME", "ALIAS", "MX", "TXT", "URL301"];
+
+const SESSION_HINT = "Domains bought on Lizard need `lizard login` or an API key without scopes (a scoped key cannot reach them).";
+
+async function listOwned(): Promise<OwnedDomain[]> {
+  const r = await api.get<{ orders: OwnedDomain[] }>("/api/domains/orders").catch((err: unknown) => {
+    if (err instanceof APIError && err.status === 401) throw new Error(SESSION_HINT);
+    throw err;
+  });
+  return r.orders ?? [];
+}
+
+/** The bought domain `hostname` is, or is a subdomain of; null when none (or the
+ *  token cannot see bought domains, e.g. an API key). */
+export async function findOwnedDomain(hostname: string): Promise<OwnedDomain | null> {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  const orders = await api.get<{ orders: OwnedDomain[] }>("/api/domains/orders").then((r) => r.orders ?? []).catch(() => []);
+  return orders
+    .filter((o) => o.status === "registered" && (host === o.domain || host.endsWith(`.${o.domain}`)))
+    .sort((a, b) => b.domain.length - a.domain.length)[0] ?? null;
+}
+
+/** Points `hostname` (the bought domain, or a subdomain of it) at a service: DNS and attach in one call. */
+export async function connectOwned(order: OwnedDomain, hostname: string, service: { id: string; name: string }) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  const r = await api.post<{ ok: boolean; attached: string[]; note?: string }>(
+    `/api/domains/orders/${encodeURIComponent(order.id)}/connect`,
+    { appId: service.id, hostname: host },
+  );
+  if (isJSONMode()) {
+    printJSON({ ...r, domain: order.domain, hostname: host, service: service.name });
+    return;
+  }
+  success(`${r.attached.map((h) => chalk.cyan(h)).join(" and ")} now point at ${service.name}`);
+  console.log(chalk.dim(`  DNS records on ${order.domain} were set for you. ${r.note ?? "HTTPS follows on its own."}`));
+}
+
+async function ownedByName(domain: string): Promise<OwnedDomain> {
+  const d = domain.toLowerCase().replace(/\.$/, "");
+  const all = await listOwned();
+  const o = all.find((x) => x.domain === d);
+  if (!o) {
+    const names = all.filter((x) => x.status === "registered").map((x) => x.domain);
+    throw new Error(
+      `${d} is not a domain you bought on Lizard.` +
+        (names.length ? ` Yours: ${names.join(", ")}` : " Buy one at https://lizard.build/domains"),
+    );
+  }
+  if (o.status !== "registered") throw new Error(`${d} is not registered yet (status: ${o.status})`);
+  return o;
+}
+
+/** "@", "api", or "api.example.com" -> the name relative to the domain. */
+export function relativeName(name: string, domain: string): string {
+  const n = name.toLowerCase().replace(/\.$/, "");
+  if (n === "@" || n === domain) return "@";
+  if (n.endsWith(`.${domain}`)) return n.slice(0, -(domain.length + 1));
+  return n;
+}
+
+export function parseType(raw: string): DnsType {
+  const t = raw.toUpperCase();
+  if (t === "REDIRECT") return "URL301";
+  if (!(DNS_TYPES as string[]).includes(t)) {
+    throw new Error(`Unknown record type "${raw}". Use one of: ${DNS_TYPES.join(", ")} (redirect = URL301)`);
+  }
+  return t as DnsType;
+}
+
+function printRecords(domain: string, records: DnsRecord[]) {
+  if (!records.length) {
+    info(`${domain} has no DNS records. Add one: lizard domain dns ${domain} set <name> <type> <value>`);
+    return;
+  }
+  table(
+    ["NAME", "TYPE", "VALUE", "TTL"],
+    records.map((r) => [r.name, r.type === "URL301" ? "REDIRECT" : r.type, r.priority != null ? `${r.priority} ${r.value}` : r.value, String(r.ttl)]),
+  );
+}
+
+export function registerOwnedDomainCommands(dom: Command) {
+  dom
+    .command("owned")
+    .alias("bought")
+    .description("List the domains you bought on Lizard")
+    .action(async () => {
+      const orders = await listOwned();
+      if (isJSONMode()) return printJSON({ domains: orders });
+      if (!orders.length) {
+        info("You have not bought a domain on Lizard yet: https://lizard.build/domains");
+        return;
+      }
+      table(
+        ["DOMAIN", "STATUS", "EXPIRES", "APP"],
+        orders.map((o) => [
+          o.domain,
+          o.status,
+          o.expiresAt ? new Date(o.expiresAt).toISOString().slice(0, 10) : "-",
+          o.appId ? "connected" : "-",
+        ]),
+      );
+      console.log(chalk.dim("  Point one at a service:  lizard domain <domain or sub.domain> --service <svc>"));
+      console.log(chalk.dim("  Edit its DNS records:    lizard domain dns <domain>"));
+    });
+
+  dom
+    .command("dns")
+    .argument("<domain>", "A domain you bought on Lizard")
+    .argument("[action]", "set | add | rm (omit to list the records)")
+    .argument("[args...]", "set/add: <name> <type> <value>; rm: <name> [type] [value]")
+    .description("Show or change the DNS records of a domain you bought on Lizard")
+    .option("--ttl <seconds>", "TTL for set/add (default 1800)", (v) => parseInt(v, 10))
+    .option("--priority <n>", "MX priority (default 10)", (v) => parseInt(v, 10))
+    .option("-y, --yes", "Skip the confirmation for rm")
+    .addHelpText(
+      "after",
+      `
+Examples:
+  lizard domain dns example.com                                   list the records
+  lizard domain dns example.com set api CNAME myapp.onlizard.com  replace api's CNAME
+  lizard domain dns example.com set @ A 203.0.113.10
+  lizard domain dns example.com add @ MX mail.example.com --priority 10
+  lizard domain dns example.com add @ TXT "v=spf1 include:_spf.google.com ~all"
+  lizard domain dns example.com set old redirect https://example.com
+  lizard domain dns example.com rm api CNAME
+
+set replaces every record of that name and type; add keeps the existing ones (several MX or TXT).
+To point a name at a Lizard service, use: lizard domain api.example.com --service <svc>`,
+    )
+    .action(async (domain: string, action: string | undefined, args: string[], opts: { ttl?: number; priority?: number; yes?: boolean }) => {
+      const order = await ownedByName(domain);
+      const path = `/api/domains/orders/${encodeURIComponent(order.id)}/dns`;
+      const current = await api.get<{ domain: string; records: DnsRecord[]; version: string }>(path);
+
+      if (!action || action === "list" || action === "ls") {
+        if (isJSONMode()) return printJSON(current);
+        printRecords(order.domain, current.records);
+        return;
+      }
+
+      let records: DnsRecord[];
+      let summary: string;
+      if (action === "set" || action === "add") {
+        if (args.length < 3) throw new Error(`Usage: lizard domain dns ${order.domain} ${action} <name> <type> <value>`);
+        const name = relativeName(args[0], order.domain);
+        const type = parseType(args[1]);
+        const value = args.slice(2).join(" ");
+        const rec: DnsRecord = { name, type, value, ttl: opts.ttl ?? 1800 };
+        if (type === "MX") rec.priority = opts.priority ?? 10;
+        const kept = action === "set" ? current.records.filter((r) => !(r.name === name && r.type === type)) : current.records;
+        records = [...kept, rec];
+        summary = `${action === "set" ? "Set" : "Added"} ${type === "URL301" ? "REDIRECT" : type} ${name} -> ${value}`;
+      } else if (action === "rm" || action === "remove" || action === "delete") {
+        if (args.length < 1) throw new Error(`Usage: lizard domain dns ${order.domain} rm <name> [type] [value]`);
+        const name = relativeName(args[0], order.domain);
+        const type = args[1] ? parseType(args[1]) : null;
+        const value = args.length > 2 ? args.slice(2).join(" ") : null;
+        const match = (r: DnsRecord) => r.name === name && (!type || r.type === type) && (value === null || r.value === value);
+        const gone = current.records.filter(match);
+        if (!gone.length) throw new Error(`No record matches ${[name, type, value].filter(Boolean).join(" ")} on ${order.domain}`);
+        if (!opts.yes) {
+          if (!isTTY()) throw new Error("Use -y to confirm in non-interactive mode");
+          printRecords(order.domain, gone);
+          const ok = await p.confirm({ message: `Remove ${gone.length === 1 ? "this record" : `these ${gone.length} records`} from ${order.domain}?` });
+          if (p.isCancel(ok) || !ok) process.exit(5);
+        }
+        records = current.records.filter((r) => !match(r));
+        summary = `Removed ${gone.length} record${gone.length === 1 ? "" : "s"}`;
+      } else {
+        throw new Error(`Unknown action "${action}". Use set, add or rm (or nothing to list).`);
+      }
+
+      const saved = await api.put<{ records: DnsRecord[]; version: string }>(path, { version: current.version, records });
+      if (isJSONMode()) return printJSON({ domain: order.domain, ...saved });
+      success(`${summary} on ${order.domain}`);
+      printRecords(order.domain, saved.records);
+      console.log(chalk.dim("  Changes reach most resolvers within minutes (up to the old record's TTL)."));
+    });
+}

package/src/commands/domain.ts

@@ -5,6 +5,7 @@ import { api } from "../lib/api.js";
 import { resolveProjectId } from "../lib/config.js";
 import { getActiveService } from "../lib/resolve.js";
 import { success, isJSONMode, printJSON, table, isTTY, info } from "../lib/format.js";
+import { connectOwned, findOwnedDomain, registerOwnedDomainCommands } from "./domain-owned.js";
 
 interface DomainResponse {
   ok?: boolean;
@@ -31,6 +32,10 @@ interface AppLite {
  *   <hostname>   → attach a custom domain
  *   delete <h>   → remove a domain
  *   generate     → force-generate a fresh *.onlizard.com subdomain
+ *   owned        → domains bought on Lizard; dns <domain> → their DNS records
+ *
+ * A hostname on a domain bought on Lizard (or a subdomain of one) is pointed and attached
+ * in one step: the platform writes the DNS record itself, no records to copy.
  */
 export function registerDomain(program: Command) {
   const dom = program
@@ -100,6 +105,13 @@ export function registerDomain(program: Command) {
             "`lizard domain list` shows the service's domains.",
         );
       }
+      // Bought on Lizard: set the DNS record and attach, nothing for the user to copy.
+      const owned = await findOwnedDomain(hostname);
+      if (owned) {
+        await connectOwned(owned, hostname, service);
+        return;
+      }
+
       const result = await api
         .post<DomainResponse>(`/api/apps/${service.id}/domains`, {
           hostname,
@@ -284,6 +296,8 @@ export function registerDomain(program: Command) {
       }
     });
 
+  registerOwnedDomainCommands(dom);
+
   dom
     .command("verify")
     .argument("<hostname>", "Custom domain to verify")

package/src/commands/git-hosting.ts

@@ -7,11 +7,11 @@ import { APIError } from "../lib/api.js";
 import { validToken } from "../lib/auth.js";
 import { isJSONMode, printJSON, table, success, info, warn, link } from "../lib/format.js";
 import {
-  lg, qs, seg, segs, resolveRepo, repoPath, myLogin, cloneURL, gitURL, helperCommand, ago, ACTIVE_RUN,
+  lg, qs, seg, segs, resolveRepo, repoPath, myLogin, cloneURL, gitURL, gitURLs, helperCommand, ago, ACTIVE_RUN,
 } from "../lib/lizard-git.js";
 
 /**
- * Lizard Git (git.lizard.build) from the terminal: repositories, issues, pull requests,
+ * Lizard Git (lizard.build/git) from the terminal: repositories, issues, pull requests,
  * reviews, CI runs, releases, secrets, collaborators, webhooks, branch rules, labels,
  * notifications, tokens, and the credential helper that lets plain `git` push and pull.
  *
@@ -60,7 +60,7 @@ function repoOpt(c: Command): Command {
 }
 
 export function registerLizardGit(git: Command) {
-  git.description("Lizard Git (git.lizard.build) repositories, pull requests, CI; and GitHub integration");
+  git.description("Lizard Git (lizard.build/git) repositories, pull requests, CI; and GitHub integration");
 
   // ── Sign-in for plain git ────────────────────────────────────────────
   git
@@ -68,14 +68,17 @@ export function registerLizardGit(git: Command) {
     .description("Let git push and pull Lizard Git repositories with your Lizard sign-in (credential helper)")
     .option("--local", "Only for the repository in this directory")
     .action(async (opts: { local?: boolean }) => {
-      const key = `credential.${gitURL()}.helper`;
       const scope = opts.local ? "--local" : "--global";
-      // An empty value first resets helpers inherited for this host; then ours.
-      for (const value of ["", helperCommand()]) {
-        const r = spawnSync("git", ["config", scope, value ? "--add" : "--replace-all", key, value], { encoding: "utf8" });
-        if (r.status !== 0) throw new APIError(500, `git config failed: ${r.stderr || r.error?.message}`);
+      // For lizard.build/git only (git matches the path: the rest of lizard.build never gets
+      // the helper), and the old git.lizard.build for clones made before.
+      for (const url of gitURLs()) {
+        // An empty value first resets helpers inherited for this address; then ours.
+        for (const value of ["", helperCommand()]) {
+          const r = spawnSync("git", ["config", scope, value ? "--add" : "--replace-all", `credential.${url}.helper`, value], { encoding: "utf8" });
+          if (r.status !== 0) throw new APIError(500, `git config failed: ${r.stderr || r.error?.message}`);
+        }
+        spawnSync("git", ["config", scope, `credential.${url}.username`, "lizard"]);
       }
-      spawnSync("git", ["config", scope, `credential.${gitURL()}.username`, "lizard"]);
       const who = await myLogin();
       out({ helper: helperCommand(), scope: opts.local ? "local" : "global", host: gitURL(), login: who }, () => {
         success(`git now signs in to ${gitURL()} as ${chalk.bold(who)} (${opts.local ? "this repository" : "every repository"})`);
@@ -91,9 +94,8 @@ export function registerLizardGit(git: Command) {
       if (op !== "get") return; // store/erase: nothing kept, nothing to forget
       const input = readFileSync(0, "utf8");
       const fields = Object.fromEntries(input.split("\n").filter(Boolean).map((l) => l.split(/=(.*)/s).slice(0, 2)));
-      const want = new URL(gitURL());
       // Only for Lizard Git itself, over the same protocol (git always says both).
-      if (fields.host !== want.host || fields.protocol !== want.protocol.replace(":", "")) return;
+      if (!gitURLs().some((u) => { const w = new URL(u); return fields.host === w.host && fields.protocol === w.protocol.replace(":", ""); })) return;
       const token = process.env.LIZARD_GIT_TOKEN || validToken();
       if (!token) {
         process.stderr.write("lizard: not signed in; run `lizard login`\n");

package/src/lib/lizard-git.ts

@@ -3,14 +3,16 @@ import { realpathSync } from "node:fs";
 import { apiErrorFrom, clientHeaders, getRequestToken, APIError } from "./api.js";
 
 /**
- * Lizard Git (git.lizard.build) with the CLI's own sign-in: the session from `lizard login`,
+ * Lizard Git (lizard.build/git) with the CLI's own sign-in: the session from `lizard login`,
  * or LIZARD_TOKEN / LIZARD_API_KEY. Lizard Git asks the platform whose it is and acts as that
  * account's user. Scoped API keys are refused there (they don't say which repositories they
  * may reach); a Lizard Git token (lzg_..., `lizard git token create`) in LIZARD_GIT_TOKEN
  * is used instead when set.
  */
 
-export const DEFAULT_GIT_URL = "https://git.lizard.build";
+export const DEFAULT_GIT_URL = "https://lizard.build/git";
+/** The address before lizard.build/git: git and the API still answer there, for older clones. */
+export const OLD_GIT_URL = "https://git.lizard.build";
 
 /**
  * Where Lizard Git is. LIZARD_GIT_URL must be https (or http on this machine): the Lizard
@@ -92,11 +94,21 @@ export async function myLogin(): Promise<string> {
 }
 
 /** owner/name from a Lizard Git remote URL (https or ssh-style), or null. */
-export function repoFromRemote(url: string, base = gitURL()): string | null {
-  const host = new URL(base).host;
-  const m = url.trim().match(/^(?:https?:\/\/)(?:[^@/]+@)?([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  if (!m || m[1] !== host || [m[2], m[3]].some((x) => x === "." || x === "..")) return null;
-  return `${m[2]}/${m[3]}`;
+/** Every address a Lizard Git remote may use: LIZARD_GIT_URL, or lizard.build/git and the old one. */
+export function gitURLs(): string[] {
+  const u = gitURL();
+  return u === DEFAULT_GIT_URL ? [u, OLD_GIT_URL] : [u];
+}
+
+export function repoFromRemote(url: string, bases = gitURLs()): string | null {
+  const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  for (const base of bases) {
+    const b = new URL(base);
+    const re = new RegExp(`^https?://(?:[^@/]+@)?${esc(b.host)}${esc(b.pathname.replace(/\/+$/, ""))}/([^/]+)/([^/]+?)(?:\\.git)?/?$`);
+    const m = url.trim().match(re);
+    if (m && ![m[1], m[2]].some((x) => x === "." || x === "..")) return `${m[1]}/${m[2]}`;
+  }
+  return null;
 }
 
 function originRepo(): string | null {

package/src/lib/updater.ts

@@ -5,7 +5,7 @@ import { join, dirname } from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "4.0.64";
+export const CURRENT_VERSION = "4.0.66";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
 

package/test/unit/domain-owned.test.ts

@@ -0,0 +1,17 @@
+import { describe, it, expect } from "vitest";
+import { parseType, relativeName } from "../../src/commands/domain-owned.js";
+
+describe("lizard domain dns: names and types", () => {
+  it("makes names relative to the domain", () => {
+    expect(relativeName("@", "example.com")).toBe("@");
+    expect(relativeName("example.com", "example.com")).toBe("@");
+    expect(relativeName("api.example.com.", "example.com")).toBe("api");
+    expect(relativeName("API", "example.com")).toBe("api");
+    expect(relativeName("a.b", "example.com")).toBe("a.b");
+  });
+  it("accepts record types in any case, redirect as URL301", () => {
+    expect(parseType("cname")).toBe("CNAME");
+    expect(parseType("redirect")).toBe("URL301");
+    expect(() => parseType("SRV")).toThrow(/Unknown record type/);
+  });
+});

package/test/unit/lizard-git.test.ts

@@ -8,10 +8,15 @@ afterEach(() => {
 
 describe("lizard git helpers", () => {
   it("reads owner/name from Lizard Git remotes only", () => {
-    expect(repoFromRemote("https://git.lizard.build/alice/app.git")).toBe("alice/app");
+    expect(repoFromRemote("https://lizard.build/git/alice/app.git")).toBe("alice/app");
+    expect(repoFromRemote("https://lizard:liz_x@lizard.build/git/alice/app")).toBe("alice/app");
+    expect(repoFromRemote("https://git.lizard.build/alice/app.git")).toBe("alice/app"); // older clones
     expect(repoFromRemote("https://lizard:liz_x@git.lizard.build/alice/app")).toBe("alice/app");
     expect(repoFromRemote("https://github.com/alice/app.git")).toBeNull();
     expect(repoFromRemote("git@github.com:alice/app.git")).toBeNull();
+    expect(repoFromRemote("https://lizard.build/alice/app.git")).toBeNull();
+    expect(repoFromRemote("https://lizard.build/gitx/alice/app.git")).toBeNull();
+    expect(repoFromRemote("https://lizard.build/git/alice/app/extra.git")).toBeNull();
   });
 
   it("drops empty query values", () => {
@@ -21,7 +26,8 @@ describe("lizard git helpers", () => {
   it("honours LIZARD_GIT_URL", () => {
     vi.stubEnv("LIZARD_GIT_URL", "http://localhost:8080/");
     expect(gitURL()).toBe("http://localhost:8080");
-    expect(repoFromRemote("http://localhost:8080/a/b.git", gitURL())).toBe("a/b");
+    expect(repoFromRemote("http://localhost:8080/a/b.git")).toBe("a/b");
+    expect(repoFromRemote("https://git.lizard.build/a/b.git")).toBeNull(); // another server: only it
   });
 
   it("runs itself as git's credential helper", () => {
@@ -37,7 +43,7 @@ describe("lizard git helpers", () => {
     }));
     expect(await resolveRepo("alice/app")).toBe("alice/app");
     expect(await resolveRepo("app")).toBe("me/app");
-    expect(calls).toEqual(["GET https://git.lizard.build/api/session Bearer liz_test"]);
+    expect(calls).toEqual(["GET https://lizard.build/git/api/session Bearer liz_test"]);
     await expect(resolveRepo("a/b/c")).rejects.toThrow(/owner\/name/);
   });
 
@@ -61,5 +67,7 @@ describe("lizard git safety", () => {
     expect(() => segs("../../api/user/tokens")).toThrow(/bad path/);
     expect(segs("src/a b.js")).toBe("src/a%20b.js");
     expect(repoFromRemote("https://git.lizard.build/../x.git")).toBeNull();
+    expect(repoFromRemote("https://lizard.build/git/../x.git")).toBeNull();
+    expect(repoFromRemote("https://lizard.build/git/a/...git")).toBeNull();
   });
 });