insta 0.1.0 → 0.1.2

package/dist/commands/domain.js

@@ -92,12 +92,20 @@ export async function domainAttach(host, opts, deps) {
 function domainLines(d, linked = true) {
     const out = [`${d.domainName}  ${d.status}${d.expiresAt ? `  (expires ${d.expiresAt.slice(0, 10)}${d.autorenew ? ', auto-renews' : ''})` : ''}`];
     // Vacuously true for a domain with no hostnames, which is every domain until something attaches.
-    if (linked && d.hostnames.every((h) => h.state === 'failed')) {
+    // Not while delegated: the platform fails every hostname on the way out, and refuses the attach.
+    if (linked && !d.delegated && d.hostnames.every((h) => h.state === 'failed')) {
         const names = d.hostnames.map((h) => h.hostname);
         // Attaching the bought name itself re-attaches its www.
         const retry = names.includes(d.domainName) ? names.filter((h) => h !== `www.${d.domainName}`) : names;
         out.push(`  nothing serving — ${(retry.length ? retry : [d.domainName]).map((h) => `insta domain attach ${h}`).join('; ')}`);
     }
+    // The zone answers elsewhere, so nothing published here resolves and an attach is refused. The
+    // repair is a next action, so it follows `linked` like the others: under --org it would name this org.
+    if (d.delegated) {
+        out.push(`  delegated to ${d.nameservers.join(', ')}${linked ? '' : ' — attach is refused'}`);
+        if (linked)
+            out.push(`  attach is refused until: insta domain nameservers reset ${d.domainName}`);
+    }
     const w = Math.max(0, ...d.hostnames.map((x) => x.hostname.length));
     for (const h of d.hostnames)
         out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.service ? ` → ${h.service}` : ''}${h.reason ? ` — ${h.reason}` : ''}`);
@@ -136,6 +144,53 @@ export async function domainStatus(name, opts, deps) {
     for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order, !opts.org))
         info(line);
 }
+// ---- nameservers and transferring out ----
+const domainPath = (orgId, domainName) => `/orgs/${orgId}/domains/${encodeURIComponent(domainName)}`;
+export async function domainNameserversSet(domainName, hosts, opts, deps) {
+    const nameservers = hosts.flatMap((h) => h.split(/[\s,]+/)).map((h) => h.replace(/\.$/, '')).filter(Boolean);
+    if (!nameservers.length)
+        die("name at least one nameserver, or `insta domain nameservers reset <domain>` to restore the registrar's own");
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PUT', `${domainPath(orgId, domainName)}/nameservers`, { nameservers });
+    if (opts.json)
+        return printJson(r);
+    for (const line of domainLines(r, !opts.org))
+        info(line);
+}
+export async function domainNameserversReset(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('DELETE', `${domainPath(orgId, domainName)}/nameservers`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of domainLines(r, !opts.org))
+        info(line);
+}
+export async function domainTransferLock(domainName, mode, opts, deps) {
+    if (mode !== 'on' && mode !== 'off')
+        die('mode must be on or off');
+    const locked = mode === 'on';
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PATCH', domainPath(orgId, domainName), { locked });
+    if (opts.json)
+        return printJson(r);
+    info(`${r.domainName}  transfer lock ${r.locked ? 'on' : 'off'}`);
+    if (!r.locked) {
+        // ICANN's post-registration lock outranks this one and nothing here can waive it.
+        if (r.transferLockExpiresAt && new Date(r.transferLockExpiresAt).getTime() > Date.now()) {
+            info(`  ICANN holds the registration until ${r.transferLockExpiresAt.slice(0, 10)} whatever this says`);
+        }
+        if (!opts.org)
+            info(`  authorization code: insta domain transfer code ${r.domainName}`);
+    }
+}
+export async function domainTransferCode(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('POST', `${domainPath(orgId, domainName)}/auth-code`);
+    if (opts.json)
+        return printJson(r);
+    info(r.authCode);
+}
+// ---- records ----
 export function recordLines(records) {
     const w = (pick) => Math.max(...records.map((r) => pick(r).length));
     const idW = w((r) => String(r.id)), typeW = w((r) => r.type), nameW = w((r) => r.fqdn), answerW = w((r) => r.answer), ttlW = w((r) => String(r.ttl));

package/dist/commands/github.js

@@ -41,7 +41,7 @@ export function parseWatchPaths(raw) {
         throw new Error("watch paths need at least one pattern, e.g. 'apps/web/**,packages/ui/**' (quote them, or the shell expands the *)");
     return out;
 }
-// Build/start come from detection only: the platform's nixpacks lane fails a build whose commands differ from it.
+// Persisted commands constrain builder selection; automatic detection must leave them unset.
 // autoDeploy rides along only when switched off: a public repo 400s on autoDeploy: true.
 export function sourceBody(src, c, o) {
     const repo = src.source === 'app'
@@ -50,8 +50,6 @@ export function sourceBody(src, c, o) {
     return {
         ...repo,
         rootDir: c.rootDir,
-        buildCommand: c.buildCommand,
-        startCommand: c.startCommand,
         port: o.port !== undefined ? parsePort(o.port) : c.port,
         ...(o.repoBranch ? { branch: o.repoBranch } : {}),
         ...(o.autoDeploy === false ? { autoDeploy: false } : {}),

package/dist/index.js

@@ -214,6 +214,20 @@ dom.command('list').description("Domains bought through InstaCloud in this org
 dom.command('status <name>').description("A bought domain's order and attach state")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((name, o) => domainCmd.domainStatus(name, o)));
+const ns = dom.command('nameservers').description("Delegate a bought domain's zone to nameservers you name, or put it back on InstaCloud's registrar");
+ns.command('set <domain> <nameservers...>').description("Delegate the zone — the nameservers must already host it. Every hostname the domain serves stops answering, unless they are the registrar's own: the records an attach published live in the zone you are leaving")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, hosts, o) => domainCmd.domainNameserversSet(domain, hosts, o)));
+ns.command('reset <domain>').description("Put the zone back on the registrar's own nameservers; a hostname it took down is re-attached with `insta domain attach`")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.domainNameserversReset(domain, o)));
+const xfer = dom.command('transfer').description('Take a bought domain to another registrar — open the lock, then read the code (all three need org admin)');
+xfer.command('lock <domain> <mode>').description("Open or close the registrar transfer lock (mode: on|off). ICANN's own 60-day lock on a new registration outranks it")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, mode, o) => domainCmd.domainTransferLock(domain, mode, o)));
+xfer.command('code <domain>').description('The EPP authorization code the gaining registrar asks for — it moves nothing on its own')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.domainTransferCode(domain, o)));
 const rec = dom.command('records').description('DNS records of a bought domain — the zone InstaCloud holds at the registrar');
 rec.command('list <domain>').description('Every record in the zone, managed ones marked')
     .option('--org <id>', "target org (default: linked project's org)").option('--json')

package/dist/template-manifest.js

@@ -121,6 +121,16 @@ export function validateManifest(m) {
         if (svc.port !== undefined && (!Number.isInteger(svc.port) || svc.port < 1 || svc.port > 65535)) {
             problems.push(`${where}: port must be an integer between 1 and 65535, got: ${svc.port}`);
         }
+        // A worker is PORTLESS: the platform deploys it as its own port-0 service, so nothing is routed
+        // to it and nothing probes it. The server's three refusals, said here before the upload.
+        if (svc.type === 'worker') {
+            if (svc.port !== undefined)
+                problems.push(`${where}.port: a worker has no routed port — remove it (a worker is portless; declare type: web to serve HTTP)`);
+            if (svc.healthcheck !== undefined)
+                problems.push(`${where}.healthcheck: a worker has no HTTP endpoint to probe — its health is the machine's state; remove it (or declare type: web)`);
+            if (svc.alwaysOn === false)
+                problems.push(`${where}.alwaysOn: a worker cannot scale to zero — nothing is routed to it, so nothing would wake it; remove alwaysOn or set it true`);
+        }
         if (svc.type === 'web' && !svc.healthcheck)
             problems.push(`${where}: web services must declare a healthcheck path`);
         if (svc.healthcheck && !String(svc.healthcheck).startsWith('/'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [