insta 0.1.19 → 0.1.20

package/dist/commands/compute.js

@@ -68,10 +68,26 @@ export function domainGuidanceLines(r, ctx = {}) {
 // where the hostname resolves — we cannot confirm routing, and must not call it serving. A Fly
 // answer carries no `ssl` and has no per-hostname origin concept, so its own verdict stands.
 const reportsOrigin = (r) => r.ssl !== undefined;
+// A deployment with NO edge custody for custom domains (a pre-Cloudflare plane). It reports
+// `origin: ""` exactly like a region whose operator forgot cf-custom-origin, so the pair alone reads
+// it backwards and names a setting this deployment does not have. The plane's own verdict
+// (`originStatus: 'unmanaged'`) decides when relayed; without it, `ssl: 'external'` is the plane's
+// marker for the same deployment class (it manages no edge certificate here) — the same fallback the
+// console uses. Only an unconfirmed origin is reinterpreted: a reported, confirmed origin stands.
+const edgeUnmanaged = (r) => r.originStatus === 'unmanaged' ||
+    (r.originStatus === undefined && r.ssl === 'external' && (r.origin === undefined || r.origin === ''));
 // Where the hostname actually resolves — the region-specific origin the plane requested vs what
 // Cloudflare holds. Each shape carries its action; absent fields are reported as absent.
 export function domainResolveLine(r) {
     const region = r.region ?? 'this region';
+    if (edgeUnmanaged(r)) {
+        // Not ready (routing cannot be confirmed from here), but no operator knob to name either:
+        // setting cf-custom-origin does nothing on a deployment with no edge custody.
+        return {
+            line: `  ${pad('resolves to', 12)}UNMANAGED — ${region} does not manage edge certificates for custom domains, so where ${r.hostname} lands cannot be confirmed from here; if it does not serve, contact support`,
+            ready: false,
+        };
+    }
     if (r.origin === undefined) {
         if (reportsOrigin(r)) {
             return {
@@ -194,6 +210,7 @@ export function domainStatusLines(r, ctx = {}) {
         }
     }
     const ssl = r.ssl ?? (r.configured ? 'active' : undefined);
+    const reasonOnCert = !!r.errorReason && r.status !== 'error' && ssl !== undefined && ssl !== 'active' && ssl !== 'external';
     if (ssl === 'active')
         stage('certificate', 'active', '(edge TLS issued)');
     else if (ssl === 'external')
@@ -203,7 +220,11 @@ export function domainStatusLines(r, ctx = {}) {
         blockers.push('certificate');
     }
     else {
-        stage('certificate', 'pending', `(${ssl} — issues once ownership is verified)`);
+        // A pending certificate with a reason from the plane: the reason IS why it has not issued (a CAA
+        // block, the hostname not pointed at the edge), so it replaces the generic text here and is not
+        // repeated below. An `error` row keeps its reason on its own error line.
+        const detail = reasonOnCert ? `(${ssl}) ${r.errorReason}` : `(${ssl} — issues once ownership is verified)`;
+        stage('certificate', 'pending', detail);
         blockers.push('certificate');
     }
     const resolve = domainResolveLine(r);
@@ -214,9 +235,17 @@ export function domainStatusLines(r, ctx = {}) {
         stage('error', r.status, r.errorReason || '(the plane reported an error state with no reason)');
         blockers.push('the plane reports an error state');
     }
-    else if (r.errorReason) {
-        stage('error', r.status, r.errorReason);
-        blockers.push(r.errorReason);
+    else if (r.errorReason && !reasonOnCert) {
+        // On an ACTIVE row the plane keeps serving and REPORTS what the edge says has regressed (it
+        // never demotes a serving row on an edge read). That is a warning beside a serving hostname,
+        // not a blocker: turning it into one would print "not yet" for a domain taking traffic.
+        // Every other state with a reason is still being set up, and the reason is what blocks it.
+        if (r.status === 'active')
+            stage('warning', r.status, r.errorReason);
+        else {
+            stage('error', r.status, r.errorReason);
+            blockers.push(r.errorReason);
+        }
     }
     // An unconfirmed routing target is one blocker among the others, not a headline that hides them:
     // a user fixing their DNS needs the whole outstanding list, not whichever item sorted first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [